last executing test programs:

1m9.572504743s ago: executing program 2 (id=873):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0)

1m9.397651331s ago: executing program 2 (id=876):
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xf, {[@main=@item_012={0x0, 0x0, 0xb}, @main=@item_4={0x3, 0x0, 0x8, "62966124"}, @global=@item_012={0x1, 0x1, 0x8, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "86"}, @main=@item_4={0x3, 0x0, 0xb, "4070f43f"}]}}, 0x0}, 0x0)
r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0)
ioctl$HIDIOCGCOLLECTIONINDEX(r1, 0x40184810, &(0x7f00000002c0)={0x3, 0xffffffff, 0xfffffffe, 0xffff01c2, 0x2, 0xa})
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\f\x00\x00'], 0x0, 0x0, 0x0}, 0x0)

1m5.999688811s ago: executing program 1 (id=905):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000140)={0x44, r1, 0x1, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x28, 0x33, @probe_request={{{0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1}, {0x1c00}, @device_b, @device_a, @initial, {0x6, 0x1}}, @val, @val, @void, @void, @val={0x72, 0x6}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x28008004)

1m5.999486551s ago: executing program 2 (id=906):
syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x8c0, &(0x7f0000000600)=ANY=[@ANYBLOB="61636c2c6865617274626561743d6e6f6e652c6469725f726573765f6c6576656c3d30303030303030303030303030303030303030332c726573765f6c6576656c3d30303030303030303030303030303030303030362c636f686572656e63793d66756c6c2c6c6f63616c666c6f636b732c636f686572656e63793d66756c6c2c6e6f61636c2c004c98065b85e5b137d63b2211c62c402045083da9bddc3b0d88d44ecd24ba5288d428197284f332858b83349af2c7646f1e07e91120d7f23ce20389bbc031d81d654f1ca08f61c92d90e6ea478843c1ad942c7c257f9ff5348dd038e947775991ad90f8861dada21d5fa2de7042b5e2cbbcd1ada2b568e375812eb0bc448e68eda4c70cf1d5adf566142ed45924fe72a1eb1a914faf754b9d94bf0fdc1f98c708bd89940b5ef96e328240c39559b35bc83c15c15104f3b3fe1945f0278c34e2399dadcd9776ac659afcbb239569140ab408ad87f15b353941"], 0x1, 0x442a, &(0x7f0000004480)="$eJzs3c9vVNUeAPBzb/seLQ94LY8FLzFxEkk0apqWlVoSSymUFioGhRg3w7QdoDrtkHZqXLCoOxJXJi6MC6KJu65IF27xT3DjEtckunBjQkKsmZk7be/tTDrWTivk80nonXt+z3znnjl3cTlxonJ7bik3t5QrLOTKMzeXTuc+KZeW54sh3icH3T/t6UScxP7gXDl34b3rp0P4Yfanx+vr6+uhqjs0NbTl9e+/3Z3ZemyIM3Wq7TZvba98GEI4sW1cVV0hhA++DyEKIZxN0kaTY28I4Vio512/+/mN3B6N5sGj4pn806l7a8OnJlfvr7V+71EIX5f+//qt+V9e6hr++dU96h4AAAAAAAAAAAAAAAAAgGfc+NUr194dHAoPo9C9Gm1/Xnc8ObZ6PnZ9z7zY1nifJKX/7vsGAAAAAAAAAAAAAAAAAACAf5LN5/9z0fEmz/+PJceRFvXX3+78GOmciXeujJ0fHEr2f4+25b+RJP16tiv0N9n3Pbv/+9lM/eb7v2/vZ7ca42v02xeieCB1HscDAyF8m2z8fjI6HJfKS5XXbpaXF2b3bBjPrHT867v3p6KTbOjfbvxHM+13fv///237NlXPb+zdV+y5lo5/V8ty330WtRX/c5l6+xF/di8d/+5aWu/WAiP1CaAa/y+6d47/WKb9TsX/WAghF1XHmkvNANU1TDW91XqFtHT8/1VLS02dyQfZ6vp/kon/+Uz7BzX/r2R/iGgqHf9/19J6UiU2r//+eOfr/0Km/YOIf3X8K37/25KO/6F6YneqSO2TbHf+H8+036n4X4uTcR6LUt+A1aie3ur/qyMtHf+ebfmb939xW+u/i5n6+3X/1+i3cf/XmP5fier3fzSXjn9vy3LtXv8TmXqdnv9Haus/disd/8O1tPTaua/2t934T2ba71T8a6uSnkb8N+eTPw7V07+x/mtLOv7/qSfGW0us1P7W1n/Rzuv/S5n2D2L9Vx3/StzZXp8X6fgfaVmuGv8f2/j9v5yp1/n4hzBorb9r6fgfbVmudv337Bz/qUy9Tsf/5U42DgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAMGE2OfSGKB1LncTwwEMK55PxkOBxNF2bz06XyzMdLIYwl6blwPLpVKk8XSvm5hfJsMV8olcozIZxP8k+EnmipVK7k5wt3Lmy01RvdLhYWK9PFQiWEMJ6kvxCONtqanqvMF+6EEC5u5P03Li/euV1YyM/OLb41ODg4GCY2xtAfFT+tFBcq9d7ruSFMbtTti7YMrpZ9aWMsR6KPysuLC4VSLf3yljql8kyhtKXOVJL3ZeiPKovLCzOFSjFfKt9q9HeQRpLj2MTV969eHtqWfyOqH0f3d1gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/EUPh9/8KoTQXT+LQwi5KHkRJf9SHjwqnsk/nbq3NnxqcvX+2uNmZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPiTHTgQAAAAAADyf22EqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqKuzSP0oDQRQH4DdjoaXHsFp2O9sVRbRwRfAEegwPo0fxEt7BIkXaFCGQzELYP7BNUn1f82B+zLwH8wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWe3zr3l/rJiLF1fYy4vfz7/84fy71+276/sUZZuR0nl66+4e6Kf+eRvltOVq1eZ9u1l8fMVF7P4M9Ge7TwbjP0Ny+zc3X972OlKuIaEt+k3KuqmVvAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOzYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCwAAAAAI87eOom8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4FcAAAD//0OnJ0Q=")
openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x24044015)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff)
ioctl$FITRIM(r0, 0x40406f06, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x100})

1m5.839336019s ago: executing program 1 (id=908):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x1a, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
preadv(r1, &(0x7f00000001c0)=[{&(0x7f0000001a80)=""/102384, 0x18ff0}], 0x1, 0x0, 0x5)

1m5.141896462s ago: executing program 1 (id=915):
r0 = fsopen(&(0x7f0000000140)='debugfs\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0xd)
fchdir(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/kvm/kvm_hv_stimer_cleanup/trigger\x00', 0x2d80, 0x82)
preadv2(r2, &(0x7f00000018c0)=[{&(0x7f0000000000)=""/217, 0xd9}], 0x1, 0x2, 0x40, 0x0)

1m4.937994411s ago: executing program 1 (id=917):
syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB='utf8=0,shortname=lower,rodir,utf8=0,uni_xlate=1,utf8=0,iocharset=koi8-ru,shortname=lower,iocharset=utf8,check=relaxed,shortname=mixed,shortname=win95,showexec,shortname=winnt,shortname=win95,rodir,nonumtail=0,errors=continue,nnonuage=936,nonumtail=0,shortname=winnt,shortname=win95,obj_user=errors=remount-ro,\x00'], 0x1, 0x36b, &(0x7f0000000a00)="$eJzs3U1vG1UXAODTvM1H85I6C4QECHFVNrCxkvAHGqFWQkQChRoVFkhTMgEr0zjyWEGuEHTHlt9RsWSHhPgDWcCeHbtsWHZRdVDsuPloCIvUHgrPI0X3xPce+4zHM7qb0dm//d3drc2yuZn1Yup6iqmImHoYsTiIhi4djlODeCaOux9vNW7/9tqHH3/y3ura2o31lG6u3np7JaV09fWfvvzq+2s/9/7/0Q9Xf5yNvcVP9/9Y+X3vpb2X9x/f+qJdpnaZtju9lKU7nU4vu1PkaaNdbjVT+qDIszJP7e0y756Y3yw6Ozv9lG1vLMzvdPOyTNl2P23l/dTrpF63n7LPs/Z2ajabaWE++DutB+vr2eownjtn3fVJFcQYdLur2cE1PPvUTOtBLQUBALW66P5/5pnu/6fD/n+Sju//+bc62P/PHF6/J9n/AwAAAAAAAAAAAADA8+BhVTWqqmqMxmr0kPDh/zWXx5g9df5P/dVdH+N17MG9uYji293Wbms4DudXN6MdReSxFI14dHBbGBnGN99du7GUBhZj4e43g/xrv0S0/ncyfzkasXh2/vIwPz3Jj4NxOuaP569EI148O3/lzPyZePONY/nNaMSvn0UnitgY3N6O8r9eTumd99dO5c8O1gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw39BMI6/GsO/9biviSuwe9u9vHi1YPNkff5j/pL/+UjTi0dn9+ZfO7M9/OV65XO+xAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBI2b+3lRVF3p1UMOr5P3hlZhT8ddal4fL7p6auxARrLop86lm94eOqqsZV6txkT+VFgumI885gdfgrufhnvRAR56yZjYj6v41/YlDXHQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADqc9T0u+5KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqFPZv7eVFUXeHWNQ9zECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8T/4MAAD//yeQEY0=")
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x29)
write(r0, &(0x7f0000000000)='7', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)

1m3.834596123s ago: executing program 2 (id=923):
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x1400c, &(0x7f0000000000)={[{@jqfmt_vfsv0}, {@dioread_lock}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==")
creat(&(0x7f0000000380)='./bus\x00', 0x0)
mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0)
ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0xa, 0x8005, 0x0, 0x0, 0x12, 0xd, "ef359f413bb93852f7d6a409080000d1ce5d29c2ee0000070000000fc6ea110ff4118039c2eb4b87c660d577df701905b9aafab4afaaf755e376a00400", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f78359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x204]})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x40100, 0x92)
ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000000)={0x101, 0x2000003, 0x1758})

1m3.746966938s ago: executing program 1 (id=926):
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0)
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00'})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x1, 0x9}, &(0x7f0000000080)=0x8)

1m2.951880735s ago: executing program 2 (id=933):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
r1 = dup(r0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c)
sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043)
r2 = dup(r0)
setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10)
shutdown(r2, 0x1)
write(r1, &(0x7f0000001840)="07d0e7b60a0e489d945acd06b2526992e23c4bb459f0000ffb7d11dcd76ca347e80abd27c6e1689a3f003fea8ef6bfb6ae092eaa10bc1b76f4cf438732066dea47", 0x41)

1m2.236640808s ago: executing program 2 (id=942):
io_uring_setup(0x136a, &(0x7f0000000080)={0x0, 0x1f8a, 0x10, 0x4, 0x28c})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x3ab983, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4, <r2=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x1, 0x2, &(0x7f0000000240)=0x4})

1m1.922040733s ago: executing program 32 (id=942):
io_uring_setup(0x136a, &(0x7f0000000080)={0x0, 0x1f8a, 0x10, 0x4, 0x28c})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x3ab983, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x4, <r2=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x1, 0x2, &(0x7f0000000240)=0x4})

1m1.869440246s ago: executing program 1 (id=944):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r1, &(0x7f0000000400), &(0x7f0000000080)=@tcp6=r0, 0x1}, 0x20)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r4=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r2, r4, 0x25, 0x2, @void}, 0x10)
syz_emit_ethernet(0x66, &(0x7f0000000300)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @broadcast, @void, {@mpls_uc={0x8847, {[], @ipv4=@gre={{0x5, 0x4, 0x1, 0x5, 0x58, 0x65, 0x0, 0x8, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x3, {{0x7, 0x1, 0x9, 0x0, 0x1, 0x2, 0x2, 0xb}, 0x1, {0x2}}}, {0x8, 0x22eb, 0x4, {{0x6, 0x2, 0x6, 0x3, 0x1, 0x1, 0x4, 0x2e}, 0x2, {0x5, 0x5, 0x3, 0x7, 0x1, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0)

1m1.545045041s ago: executing program 33 (id=944):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r1, &(0x7f0000000400), &(0x7f0000000080)=@tcp6=r0, 0x1}, 0x20)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r4=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r2, r4, 0x25, 0x2, @void}, 0x10)
syz_emit_ethernet(0x66, &(0x7f0000000300)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @broadcast, @void, {@mpls_uc={0x8847, {[], @ipv4=@gre={{0x5, 0x4, 0x1, 0x5, 0x58, 0x65, 0x0, 0x8, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x3, {{0x7, 0x1, 0x9, 0x0, 0x1, 0x2, 0x2, 0xb}, 0x1, {0x2}}}, {0x8, 0x22eb, 0x4, {{0x6, 0x2, 0x6, 0x3, 0x1, 0x1, 0x4, 0x2e}, 0x2, {0x5, 0x5, 0x3, 0x7, 0x1, 0x1, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0)

6.697201024s ago: executing program 6 (id=1284):
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x0, &(0x7f0000000680)={[{@user_xattr}, {@noquota}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@jqfmt_vfsv1}, {@block_validity}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x7b1}}, {@stripe={'stripe', 0x3d, 0x20}}, {@bsdgroups}, {@max_batch_time}, {@user_xattr}, {@quota}]}, 0x1, 0x562, &(0x7f0000001080)="$eJzs3c1rHOUfAPDvbHb7/vs1hVJURAI9WKndNIkvFTzUo2ixoPe6JNNQsumW7KY0sWB7sBcvUgQRC+Jd7x6L/4B/RUELRUrQg5fIbGbTbbObt26abffzgWmfZ2aSZ77zzPfJMzu7bAADayT7pxDxckR8k0QcbttWjHzjyMp+Sw+vT2ZLEsvLn/6VRJKva+2f5P8fzCsvRcRvX0WcLKxtt76wOFOpVtO5vD7amL0yWl9YPHVptjKdTqeXxycmzrw9Mf7eu+/0LNY3zv/z/Sd3Pzzz9fGl7365f+R2EmfjUL6tPY6ncKO9MhIj+TkpxdkndhzrQWP9JNntA2BbhvI8L0U2BhwutbIeePF9GRHLwIBKtpj/e40X8IJozQNa9/Y9ug9+bjz4YOUGaG38xZXXRmJf897owFLy2J1Rdr873IP2szZ+/fPO7WyJ3r0OAbChGzcj4nSxuHb8S/Lxb/tOb2KfJ9sw/sGzczeb/7zZaf5TWJ3/RIf5z8EOubsdG+d/4X4Pmukqm/+933H+u/rQangor/2vOecrJRcvVdNsbPt/RJyI0t6svt7znDNL95a7bWuf/2VL1n5rLpgfx/3i3sd/ZqrSqDxNzO0e3Ix4peP8N1nt/6RD/2fn4/wm2ziW3nmt27aN499Zyz9FvN6x/x890UrWfz452rweRltXxVp/3zr2e7f2dzv+rP8PrB//cNL+vLa+9TZ+3Pdv2m3bdq//PclnzfKefN21SqMxNxaxJ/l47frxRz/bqrf2z+I/cXz98a/T9b8/Ij7fZPy3jv786vbj31lZ/FNb6v+tF+599MUP3drfXP+/1SydyNdsZvzb7AE+zbkDAAAAAACAflOIiEORFMqr5UKhXF55f8fROFCo1uqNkxdr85enovlZ2eEoFVpPug+3vR9iLH8/bKs+/kR9IiKORMS3Q/ub9fJkrTq128EDAAAAAAAAAAAAAAAAAABAnzjY5fP/mT+GdvvogB3nK79hcG2Y/734piegL/n7D4NL/sPgkv8wuOQ/DC75D4NL/sPgkv8wuOQ/AAAAAAAAAAAAAAAAAAAAAAAAAAAA9NT5c+eyZXnp4fXJrD51dWF+pnb11FRanynPzk+WJ2tzV8rTtdp0NS1P1mY3+n3VWu3K2HjMXxttpPXGaH1h8cJsbf5y48Kl2cp0eiEtPZOoAAAAAAAAAAAAAAAAAAAA4PlSX1icqVSr6VyPCoWI6OkvVFhTyPrtRrFfznOxPw5DoceF3R6ZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCR/wIAAP//f14x3A==")
mkdirat(0xffffffffffffff9c, 0x0, 0x0)
setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x4d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b)
write(r1, &(0x7f0000000000)='7', 0x1)
mkdirat(0xffffffffffffffff, 0x0, 0x18)
pwrite64(r0, &(0x7f0000000140)='\"', 0x1, 0xe7c)

5.733040679s ago: executing program 6 (id=1286):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000002900)=r1, 0x4)
bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x10, 0x2ffffffff}, 0xc)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000000700)=@deltaction={0x14, 0x31, 0x800, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x80)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x600, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b000000000004001a80180002"], 0x44}}, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0)

4.930567737s ago: executing program 0 (id=1289):
syz_open_procfs(0x0, &(0x7f0000000280)='net/packet\x00')
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x41000, 0x42}, 0x94)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000040)={[0x7, 0x3a15, 0x3, 0xfffffffffffffffd, 0x8, 0x5, 0x4, 0x2, 0x8, 0x4, 0x3, 0x3, 0x1932be21, 0x100000000, 0x4, 0x4], 0xeeee0000, 0x1406c1})
ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0x10, 0x0, 0x8, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff, 0x1})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

4.488630288s ago: executing program 0 (id=1290):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
chdir(&(0x7f0000000000)='./proc/fs/nfsd\x00')
ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(0xffffffffffffffff, 0xf505, 0x0)
inotify_add_watch(0xffffffffffffffff, 0x0, 0x10000823)
r0 = open(0x0, 0x8000, 0x112)
getdents(r0, 0x0, 0x0)
getdents(r0, 0x0, 0x0)
syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000180)={[{@usrquota}, {@auto_da_alloc_val}, {@nolazytime}]}, 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=")
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)

4.265294628s ago: executing program 0 (id=1291):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4)
connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_128={{0x304}, "b928a7020253641e", "e282d495ff61cdd0c6df00e85dc14e09", "7ec8b2c1", "39ab3e87f65cfcb9"}, 0x28)
sendto$inet6(r0, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x40000)
sendto$inet6(r0, &(0x7f0000000300)="c62ee5d6a8ec1dc4f4d714ffff87cb40ff", 0x11, 0x8040, 0x0, 0x0)
write$binfmt_elf64(r0, 0x0, 0x78)

3.689080066s ago: executing program 5 (id=1292):
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000003"], 0x48)
close(r0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x4, 0xc, 0x4}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', <r2=>0x0})
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10)
syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[], 0x0)

3.057478765s ago: executing program 4 (id=1299):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0xa, 0x4})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0})
dup3(r1, r0, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x10000000000)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000280)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x2, 0x37}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x0, 0x3d}, @fda={0x66646185, 0x0, 0x1, 0x21}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0})

3.054587455s ago: executing program 3 (id=1300):
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000080)='./file1\x00')
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
setpgid(r0, r0)
setpgid(0x0, r0)
mount$fuse(0x0, &(0x7f0000000200)='./file0/file0\x00', 0x0, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/core/rd_mcp_0/ramdisk_0/alua/test_group/alua_access_type\x00', 0x1, 0x0)
mount$9p_rdma(0x0, &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x400000, 0x0)

3.021583437s ago: executing program 6 (id=1301):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
r1 = dup(r0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c)
sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f00000001c0)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x4}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000240)="086a8333", 0x4}], 0x1}, 0x4048043)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='dummy0\x00', 0x10)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88)
r3 = dup(r1)
write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {0xffffffffffffffff, 0x4}}, 0x39fab)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000340)={0x0, @in6={{0xa, 0x4e24, 0x4, @empty, 0x3}}, 0x800, 0x6, 0xffff1891, 0x0, 0xb23be0fbe66397b6, 0x9, 0x1b}, 0x9c)

2.96465784s ago: executing program 5 (id=1302):
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
recvmsg$unix(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x109d40, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f})
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r3, {0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4044084}, 0x0)

2.859639875s ago: executing program 4 (id=1303):
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10)
sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x8044000}, 0x1)
setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x80000081, 0x30}, 0xc)
r1 = dup(r0)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000740)={0x0, 0x2}, 0x8)
write$cgroup_subtree(r1, &(0x7f00000001c0)=ANY=[], 0x32600)
setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0x5, 0x5404, 0x204, 0x5, 0x4, 0x1, 0x1, 0x80000001}, 0x20)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x2}}, 0x20)
write(r1, &(0x7f0000000040)="99", 0x1)

2.826406796s ago: executing program 3 (id=1304):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840)
openat$fuse(0xffffffffffffff9c, &(0x7f0000000980), 0x2, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f00000000c0)="f31fbd0d660f2a630066b8000000000f23d80f21f86635000000000f23f8b80d008ed82e667c75f364b646660fc735b800008ee866b9ff03000066ba000000000f3066b9bb0800000f32", 0x4a}], 0x1, 0x55, 0x0, 0x0)
pipe(&(0x7f0000000000))
ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000005700)=@vmx={0x100, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0xfffffffffffffffe}, {'\x00', "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe2d1f2b6255614c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c955000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200"}})
ioctl$KVM_RUN(r3, 0xae80, 0x0)

2.74926875s ago: executing program 3 (id=1305):
fchdir(0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1)
r0 = socket$inet6(0xa, 0x3, 0x7)
r1 = socket$packet(0x11, 0x2, 0x300)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x12, 0x5, 0x4, 0x2}, 0x50)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r3, <r4=>0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r2}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4)
sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='$'], 0x28}}], 0x1, 0x0)

2.725781011s ago: executing program 6 (id=1306):
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0)
pipe2$9p(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80800)
write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15)
r2 = dup(r1)
write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137)
mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000640)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_fscache}]}})
chdir(&(0x7f0000000040)='./file0\x00')
symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00')
open(&(0x7f0000000300)='.\x00', 0x0, 0x0)

2.705459352s ago: executing program 0 (id=1307):
syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000200)='./file2\x00', 0x800000, &(0x7f0000000340), 0x3, 0xbdd, &(0x7f0000000bc0)="$eJzs3M1rHOcZAPBnRqsP23JXLqXUvVilFBtK17KLTG0KtYtLLz0U2mvAQl4ZofUHkoIjWZBV8g+EJP9ALjkkJsGH+OxLArnmkjjXmBwCJihWAiEkCrMfkiztSpa00jjS7wev5v2Ymfd5PNLOvGZ3AziwBrMfacTxiLiSRBQb/WlE9NRqfRHV+n6LC3Oj3y3MjSaxtPS/r5NIIuLJwtxo81xJY3uk0eiLiE/+mcSvX10/79TM7MRIpVKebLRPT1+/dXpqZvYv49dHrpWvlW+cOfe34bPD54bOD3cs1++/uHj/2z/8+8vqD+/8ePebN95O4mL0N8ZW59HIescGY3D532S1QkSMdOD8z4OuRj6r80wKmxyU7nJQAAC0la56hvttFKMrVh7eivHhp7kGBwAAAHTEUlfEEgAAALDPJdb/AAAAsM813wfwZGFutFnyfUfC3np8KSIG6vkvNkp9pBDV2rYvuiPi8JMkVn+sNakftmODEfHo8/PvZyVafA55t1XnI+J3ra5/Ust/oPFJ6LX5pxEx1IH5B9e0f0n5X+zA/HnnD8DB9OBS/Ua2/v6XLj//RIv7X6HFvWs78r7/NZ//Ftc9/63k39Xm+e+/zzjHnULcbjeW5f/3+/96r1my+bPtjpLagsfzEb8vtMo/Wc4/aZP/lU3OnUT9FMWfbpfb7ZN3/ktvRZyM1vk3JRt/P9HpsfFKeaj+s+Uc8x8Pv9tu/rzzz67/4Tb5b3D9+7K+W0+dqf2X+rxw+fK9dZ2N3TfPP/2qJ/l/rdbT6HlpZHp68kxET/Kf9f1nN863uU/zHFn+p/648d9/q9//7DWh2vjdyFKZb2yz9itr5vzH3TsftIunuf7L8/pf3fr1r/W99oxz/Omj10+t7Wt+v9bq9W9WsvkfJfW1MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0pRHRH0laioikVk/TUiniSET8Jg6nlZtT038eu/nijavZWMRAdKdj45XyUEQU6+0ka5+p1VfaZ9e0/xoRxyLizeKhWrs0erNyNe/kAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHYkIvojSUsRkUbEYjFNS6W8owIAAAA6biDvAAAAAIBdZ/0PAAAA+5/1PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALvs2IkHD5OIqF44VCuZnsZYd66RAbst3dZRvR2PA9h7XXkHAOSmkHcAQG62uMb3uAD7zPn+zffpa9nb7f8CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6Yk8cfPEwionrhUK1kehpj3S2POLGH0QG7Kc07ACA3XRsNFvYuDmDvbftP/Ghn4wD2Xus1PnCQJJuM963sU316pHfXYgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg+dNfK0laioi0Vk/TUiniaEQMRHcyNl4pD0XEryLis2J3b9buzTtoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOm5qZnZipFIpT26nkuzscBWVdpWXn48w9raS1Cp9eYdRr+T9ygQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQB6mZmYnRiqV8uRU3pEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeZuamZ0YqVTKk89QubeVnVdV8s4RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID8/BwAAP//a5YMgQ==")
timer_create(0x73d8edad9145909b, 0x0, 0x0)
bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000480)='./file2\x00', 0x18000, &(0x7f0000000640)=ANY=[@ANYRES32=0x0, @ANYRES16, @ANYRESOCT, @ANYRES8=0x0, @ANYRES32=0x0, @ANYRES64, @ANYRESDEC=0x0], 0x1, 0x304, &(0x7f0000000bc0)="$eJzs3M9PE2kYwPGnPyhtCZTDZje7yYZ3dy/rZQLVs9IYSIxNJEiNPxKTAabadGxJp8HUGJGTV+PNf8AD4ciNRPkHuHjTixdvXEw8yME4ptMZSssUpLSUH99PQubhfd5nOm9byDMNL1u3Xz7KZy0tq5clGFUSEBHZFhmWoHgC7jHoxBHZ7blcGPj64e+bd+5eT6XTE9NKTaZmLiaVUkMjbx8/jbnT1vtlc/j+1pfk583fN//c+jHzMGepnKUKxbLS1WzxU1mfNQ01n7PymlJTpqFbhsoVLKNUyxdr+axZXFioKL0wPxhfKBmWpfRCReWNiioXVblUUaEHeq6gNE1Tg3HBQTIr09N6qs3iuQ5fDLqkVErpIRGJ7clkVnpyQQAAoKea+/+gqE72/6v/bpQHbq0Nuf3/esSv/7/0sXauhv4/KiK+/b/3+L79v364/n9vR3RK2XZbZUfq/3EyjET2DAXqYTVZSulx9+fXsXxvddQJ6P8BAAAAAAAAAAAAAAAAAAAAADgNtm07Ydt2wjt6X/0iEnU2ltS+9ykNiciVHlwyOugIrz/OgPrGvfCQiPliMbOYqR3dCRsiYjqvf0K+O+8HVzX2dh6pqmF5Zy659UuLmZCTSWUlJ6YYMiaJPmmut+3Ja+mJMVXTWN8n8d31SUnIb/71Sd/6iPz/3656TRLyfk6KYsq8u2HOq382ptTVG+mm+pgzDwAAAACAs0BTO3zv3zWtVb5Wv3N/Pdr0+UCofn896nt/Hpa/wr1dOwAAAAAA54VVeZLXTdMo7QSDItI4EpPmOZ0Mwl06s7fCX63y/paheyvdJ/AevCEVdQc7/rQEDvG0tAiC0k7VSHU1qin1z7LP2vcLvI+NWs2RqXF35HXLOd0J/nj15lvnTnh5LXrAStsPQvu/AfqO57cPAAAAgONUb/q9kfHeXhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOfQcfx3tF6vEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgpfgYAAP//2a0C7Q==")
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
fdatasync(r0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
socket$inet6(0xa, 0x800000000000002, 0x0)
prlimit64(0x0, 0x4, 0x0, &(0x7f0000000240))

2.614254086s ago: executing program 5 (id=1308):
syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x3000802, &(0x7f0000000280)=ANY=[@ANYRES16=0x0, @ANYRESHEX=0x0, @ANYBLOB="2c6572726f72733d636f6e74696e75652c696f636861727365743d63703835352c666d61736b3d30303030303030303030303030303030303030303230342c756d61736b3d30303030303030303030303030303030303031303030002c6b6565705f6c6173745f646f74732c757466382c696f636861727365743d69736f383835382d322c00716e38bcb049da85848e6756a3bd4745417549b1cb9a33b753aa8794c7e33757ce7c8e8fffc81ac6d5041b8ed65bd4dbe75b53ad789c5f492cb5866d74265428e77c8824127d6f36cd183083f016bdaf33c30f8645e367d089cb4235517369a13ead2b4ea75585050ac51ba363c593780cf08ef99a97db4c453e6fded10a48d332668e93902504c38866c149921b590e1dd141206e28b0b817e984629c659b02a0508f2b8ca4ae4a125af4831e79e8bbb571147676f45a4e36f460952320d5a1d97c98508c7f149f9a30b543949899e532f8be39abce"], 0x1, 0x1533, &(0x7f0000000440)="$eJzs3AucTVXbAPDnWWvtMSROk1wma61nc5LLIklySZJLklSSJLeEpEleSUgMIUlDEpLLkMQQksvEpHG/3y8JSdIkSW65Jev7Tczn7a33q++t7/X+vnn+v9/+zVqz97P2s88z55y19zmzv+0ypFbj2tUbEhH8KXjhRyIAxALAAADICwABAJSPKx+XuT6nxMQ/txP213ow5XJnwC4nrn/2xvXP3rj+2RvXP3vj+mdvXP/sjeufvXH9GcvONk4tdBUv2Xfh6//ZGb///z+SUXrMl6tLX9MVIOaPhnD9szeu//9bwR/ZiOufvXH9s6vYy50A+w/Az//sIMc/XcP1z964/oxlZ5f7+vPlXiDyH/YYHM55oTC/v21WCf/c8TPGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY/8Gp/0lCgCy2pc7L8YYY4wxxhhjjP11fI7LnQFjjDHGGGOMMcb+7yEIkKAggBjIAbGQE3KBAIArIQ/khQhcBXFwNeSDayA/FICCUAji4VooDBoMWCAIoQgUhShcB8XgeigOJaAklAIHpaEM3ABl4UYoBzdBebgZKsAtUBEqQWWoArdCVbgNqsHtUB3ugBpQE2pBbbgT6sBdUBfuhnpwD9SHe+E+uB8awAPQEB6ERvAQNIaHoQk8Ak2hGTSHFtDyX4p/HnrAC9ATekEi9IY+8CL0hX7QH16CAfAyDIRXYBC8CkkwGIbAazAUXodh8AYMhxEwEt6EUfAWjIYxMBbGQTKMhwnwNkyEd2ASvAuTYQqkwFSYBu/BdJgBM+F9mAUfwGyYA3NhHqTChzAfFkAafAQL4WNIh0WwGJbAUlgGy2EFrIRVsBrWwFpYB+thA2yETbAZtsBW2Abb4RPYAZ/CTtgFu+Ez2AOf/y/jT/1DfFcEBBQoUKHCGIzBWIzFXJgLc2NuzIN5MIIRjMM4zIf5MD/mx4JYEOMxHgtjYTRokJCwCBbBKEaxGBbD4lgcS2JJdOiwDJbBsngjlsNyWB7LYwWsgBWxElbCKlgFq2JVrIbVsDpWxxpYA2thLbwT78TeWBfrYj2sh/WxftblKWyIDbERNsLG2BibYBNsik2xOTbHltgSW2ErbI2tsS22xXbYDttje0zABOyAHbAjdsRO2Ak7Y2fsgl2wK3bDbhnP5wB8AV/AXlhD9MY+2Af7YlKO/vgSvoQv40B8BV/BVzEJB+MQfA1fw9dxGJ7E4TgCR+JIrCrewtE4BkmMw2RMxgk4ASfiRMxM9F2cgik4FafhNJyOM3AGvo+z8AP8AOfgHJyHqZiK83EBpmEaLsRTmI6LcDEuwaW4DJfiClyJK3A1rsHVuA7X4QbcgJtwE27BLbgNt+EnqADwU9yFuzAJ9+Ae3It7cR/uw/24HzMwAw/gATyIB/EQHsLDeBiP4FE8hkfxBJ7Ak3gKT+NpPItn8Rw+G/91o09KrEoCkUkJJWJEjIgVsSKXyCVyi9wij8gjIiIi4kScyCfyifwivygoCop4ES8Ki8LCCCNIhDEAIKIiKoqJYqK4KC5KipLCCSfKiDKirCgryolyory4WVQQt4iKopJo46qIKqKqaOuqidtFdVFd1BA1RS1RW9QWdUQdUVfUFfVEPVFf1Bf3iftFA9Eb++ODIrMyjcVgbCKGYFPRTMiLr2CtxDBsLdqItuJxMQKHY3vRyiWIp0QHMRo7ir+JMfiM6CzGYRfxnOgquonu4nnRQ7R2PUUvMQl7iz5iCvYV/UR/8ZKYjjXF+zgrZy3xqkgSg8UQ8ZqYh6+LYeINMVyMECPFm2KUeEuMFmPEWDFOJIvxYoJ4W0wU74hJ4l0xWUwRKWKqmCbeE9PFDDFTvC9miQ/EbDFHzBXzRKr4UMwXC0Sa+EgsFB+LdLFILBZLxFKxTCwXK8RKsUqsFmvEWrFOrBcbxEaxSWwWsbBVbBPbxSdih/hU7BS7xG7xmdgjPhd7xRdin/hS7BdfiQzxtTggvhEHxbfikPhOHBbfiyPiqDgmjosT4gdxUpwSp8UZcVb8KM6Jn8R54QVIlEJKqWQgY2QOGStzylzyCplbBhcf3atknLxa5pPXyPyygCwoC8l4ea0sLLU00kqSoSwii8qovE4Wk9fL4rKELClLSSdLyzLyBllW3ijLyZtkeXmzrCBvkRVlJVn5v8eGyIUfNWRNWUvWlnfKRLhL1pV3y3ryHllf3ivvk/fLBvIB2VA+KBvJh2Rj+bBsIh+RTWUz2Vy2kC3lo7KVfEy2lm1kW/m4bCefkO3lkzJBPiU7SH/xT+QZ2Vk+K7vI52RX2U12lz/J89LLnrKXhN4g+8gXZV/ZT/aPBQD5shwoX5GD5KsySQ6WQ+Rrcqh8XQ6Tb8jhcoQcKd+Uo+RbcrQcI8fKcTJZjpcT5NtyonxHTpLvyslyikyRU2V/OeDnkWZK+bvxb/9G/KCf975BbpSb5Ga5RW6V2+R2+YncIXfInXKn3C13yz1yj9wr98p9cp/cL/fLDJkhD8gD8qA8KA/JQ/KwPCyPyKPyjDwuT8gf5El5Sp6SZ+RZeVaeu/gYgEIllFRKBSpG5VCxKqfKpa5QudWVKo/KqyLqKhWnrlb51DUqvyqQs6AqpOLVtaqw0sooq0iFqogqqqLqOrxYU1VSlVJOlVZl1A3/GK/+h3hVTF2viqsSv4jPyi/xn+TXUrVUrVQr1Vq1Vm1VW9VOtVPtVXuVoBJUB9VBdVQdVSfVSXVWnVUX1SXz70F1V91VD9VD9VQ9VaJKVH3Ui6qv6qf6q5fUAPWyGqgGqkFqkEpSSWqIGqKGqqFqmBqmhucANVKNVKPUKDVajVZj1ViVrJLVBDVBTVQT1SQ1SU1Wk1WKSlHT1DQ1XU1XM9VMNUvNUrPVbDVXzVWpKlXNV/NVmkpTC9VCla4WqUVqiVqilqllaoVaoVapVWqNWqPWqXUqXW1UG9VmtVltVVvVdrVd7VA71E6xU+1Wu9UetUftVXvVPrVP7Vf7VYbKUAfUAXVQHVSH1CF1WB1WR9QRdUwdUyfUCXVSnVSn1Wl1Vp1V59Q5dV6dz5z2BSIQgQpUEBPEBLFBbJAryBXkDnIHeYI8QSSIBHFBXJAvuCbIHxQICgaFgvjg2qBwoAMT2EBcLHo0uC4oFlwfFA9KBCWDUoELSgdlghuCssGNQbngpqB8cHNQIbglqBhUCioHVYJbg6rBbUG14PagenBHUCOoGdQKagd3BnWCu4K6wd1BveCeoH5wb3BfcH/QIHggaBg8GDQKHgoaBw8HTYJHgqZBs6B50CJo+ZeO7/3JAo+5nrqXTtS9dR/9ou6r++n++iU9QL+sB+pX9CD9qk7Sg/UQ/Zoeql/Xw/QbergeoUfqN/Uo/ZYercfosXqcTtbj9QT9tp6o39GT9Lt6sp6iU/RUPU2/p6frGXqmfl/P0h/o2XqOnqvn6VT9oZ6vF+g0/ZFeqD/W6XqRXqyX6KV6mV6uV+iVepVerdfotXqdXq836I16k96st+itepverj/RO/SneqfepXfrz/Qe/bneq7/Q+/SXer/+Smfor/UB/Y0+qL/Vh/R3+rD+Xh/RR/UxfVyf0D/ok/qUPq3P6LP6R31O/6TPa585uc98ezfKKBNjYkysiTW5TC6T2+Q2eUweEzERE2fiTD6Tz+Q3+U1BU9DEm3hT2BQ2mciQKWKKmKiJmmKmmCluipuSpqRxWa/8pqwpZ8qZ8qa8qWAqmIqmoqlsKptbza3mNnObud3cbu4wd5iapqapbWqbOqaOqWvqmnqmnqlv6pv7zH2mgWlgGpqGppFpZBqbxqaJaWKamqamuWluWpqWppVpZVqb1qataWvamXamvWlvEkyC6WA6mI6mo+lkOpnOprPpYrqYrqar6W66mx6mh+lpLn4Julcf09f0Nf1NfzPADDADzUAzyAwySSbJDDFDzFAz1Awzw8xwM8KMzJyomrfMaDPGjDXjTLJJNhPMBDPRTDSTzCQz2Uw2KSbFTDPTzHQz3cw0M80sM8vMNrPNXDPXpJpUM9/MN2kmzSw0C026STeLzWKz1Cw1y81ys9KsNKvNarMW1pr1Zr3ZaDaazWaz2Wq2mu1mu9lhdpidZqfZbXabPWaP2Wv2mn1mn9lv9psMk2EOmAPmoDloDplD5rA5bI6YI+aYOWZOmBPmpDlpTpvT5qwpcPH90ptYm9PmslfY3PZKm8fmtf/YL2gL2Xh7rS1stc1vC/yib6y1xW0JW9KWss6WtmXsDb/qV7SVbGVbxd5qq9rbbLVf9evYu2xde7etZ++xte2dv+jXt/fazBlEA0QA28w2si1sY/uwbWIfsU1tM9vctrDt7BO2vX3SJtinbAf79K/68+0Cu9KusqvtGrvT7rKn7Rl70H5rz9ofbU/byw6wL9uB9hU7yL5qk+zgX/VH2jftKPuWHW3H2LF23K/6k+0Um2Kn2mn2PTvdzvhVP9V+aGfZNDvbzrFz7byf+5k5pdmP7EL7sU23ASy2S+xSu8wutyuycvV57Tq73m6wO+yndrPdYrfabXZ71kTY7rK77Wd2j/3cHrDf2H32S7vfHrIZ9uuf+5nHd8h+Zw/b7+0Re9Qes8ftCfuDyorOPPbj9id73noLhAQkSVFAMZSDYikn5aIrKDddSXkoL0XoKoqjqykfXUP5qQAVpEIUT9dSYdJkyBJRSEWoKEXpOspKrySVIkelqQzdQGXpRhpBN1F5upkq0C1UkSpRZapCt1JVuo2q0e1Une6gGlSTalFtupPq0F1Ul+6menQP1ad76T66nxrQA9SQHqRG9BA1poepCT1CTakZNacW1JIepVb0GLWmNtSWHqd29AS1pycpgZ6iDvQ0daS/USd6hjrTs9SFnqOu1I260/PUg16gntSLEqk39aEXqS/1o/70Eg2gl2kgvUKD6FVKosE0hF6jofQ6DaM3aDiNoJH0Jo2it2g0jaGxNI6SaTxNoLdpIr1Dk+hdmkxTKIWm0jR6j6bTDJpJ79Ms+oBm0xyaS/MolT6k+bSA0ugjWkgfUzotosW0hJbSMlpOK2glraLVtIbW0jpaTxtoI22izbSFttI22k6f0A76lHbSLtpNn9Ee+pyQvqB99CXtp68og76mA/QNHaRv6RB953vR93SEjtIxOk4n6Ac6SafoNJ2hs/QjnaOf6Dx5ghBDEcpQhUEYE+YIY8OcYa7wijB3eGWYJ8wbRsKrwrjw6jBfeE2YPywQFgwLhfHhtWHhUIcmtCGFYVgkLBpGw+vCYuH1YfGwRFgyLBW6sHRYJrwhLBveGJYLbwrLhzeHFcJbwophpfDhe6qEt4ZVw9vCauHtYfXwjrBGWDOsFdYO7wzrhHeFdcO7w3rhPWG58N7wvvD+sEH4QNgwfDBsFD4UNg4fDpuEj4RNw2Zh87BF2DJ8NGwVPha2DtuEbcPHw3bhE2H78MkwIXwq7BA+/fP6exf88/WJYe+wT/hi+GLo/d1ybnReNDX6YXR+dEE0LfpRdGH042h6dFF0cXRJdGl0WXR5dEV0ZXRVdHV0TXRtdF10fXRD1PvaOcChE0465QIX43K4WJfT5XJXuNzuSpfH5XURd5WLc1e7fO4al98VcAVdIRd/Ww5X2GlnnHXkQlfEFXVRd50r5q53xV0JV9KVcs6VdmVcC9fStXSt3GOutWvj2rrH3ePuCfeEe9I96Z5yHdzTrqP7m+vknnGd3bPuWfec6+q6ue7uedfDjc9z4TmZ6Pq4Pq6v6+v6u/5ugBvgBrqBbpAb5JJckhvihrihbqgb5oa54W64G+lGulFulBvtRruxbqxLdslugpvgJrqJbpKb5Ca7yS7Fpbhpbpqb7qa7qjMu7GW2m+3murku1aW6+S5zzpjmFrqFLt2lu8VusVvqlrrlbrlb6Va61W61W+vWuvVuvdvoNrrNbrPb6ra67W672+F2uJ0+74VB3R631+11+9w+t9995TLc1+6A+8YddN+6Q+47d9h97464o+6YO+5OuB/cSXfKnXZn3Fn3ozvnfnLnnXfJkfGRCZG3IxMj70QmRd79+Yw0JTI1Mi3yXmR6ZEZkZuT9yKzIB5HZkTmRuZF5kdTIh5H5kQWRtMhHkYWRjyPpkUWRxZElkaWRZRHvr90c+iK+qI/663wxf70v7kv4kr6Ud760L+Nv8GX9jb6cv8mX9zf7Cv4WX9FX8pX9I76pb+ab+xa+pX/Ut/KP+da+jW/rH/ft/BO+vX/SJ/infAf/tO/o/+Y7+Wd8Z/+s7+Kf8119N9/dP+97+Bd8T9/LJ/revo9/0ff1/Xx//5If4F/2A/0rfpB/1Sf5wX6If80P9a/7Yf4NP9yP8CNj3vSjsk6RYZxP9uP9BP+2n+jf8ZP8u36yn+JT/FQ/zb/np/sZfqZ/38/yH/jZfo6f6+f5VP+hn+8X+DT/kV/oP/bpflHW7M4v9yv8Sr/Kr/Zr/Fq/zq/3G/xGv8lv9lv8Vr/Nb/ef+B3+U7/T7/K7/Wd+j//c7/Vf+H3+S7/ff+Uz/Nf+gP/GH/Tf+kP+O3/Yf++P+KP+mD/uT/gf/El/yp/2Z/xZ/6M/53/y5/l/1hhjjDHG/pDxl5ril2suXM7v/Rsx4u827gMAV24plPH36zNnlGvzX2j3E/HtIgDwVK8uD2YtNWokJiZe3DZdQlB0TtYnQRfuPBADlz4ZWgRt4QlIgDZQ9jfz7ye6naXfGT96M0Cuv4uJhUv9S+N/AYCJvzH+o4+PnF8hPB33P4w/B6B40UsxOeFSfxG0/fn6Shso90/yL9Dqd/LP+WUyQOu/i8kNl/qX8i8Dj8HTkPCLLRljjDHGGGOMsQv6icqdss4/s76V+Vvn5/HqUkwOuNT/vfNzxhhjjDHGGGOMXX7PdOv+5KMJCW06/e8b1X5/G/XHBoz5rVVN4F9NjBv/UsN7gP8uHAD8yQEBMhvy33kUm/4t+0q6+NTJ+k3WHTSXnvEB/GeU8q9oXMYXJcYYY4wxxtj/iUuT/l/+Xl2uhBhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMsWzoz97jDf7AXfou9zEyxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjl9t/BQAA///SzPcN")
openat$kvm(0xffffffffffffff9c, 0x0, 0x1e9100, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
sync()
socket$inet6(0xa, 0xa, 0x9)
writev(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000440)="2e9b3d0007e03dd651", 0x9}], 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)

2.579888548s ago: executing program 3 (id=1309):
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000200), 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ")
r0 = creat(&(0x7f0000000140)='./bus\x00', 0x182)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x2002, 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x8541, 0x1a9)
fallocate(r2, 0x10, 0x354a, 0x8000)
fallocate(r0, 0x0, 0xbf5, 0x2000402)
ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000001c0)={0xc, r0, 0x9, 0x1, 0x400, 0xfffffffffdffffff})
r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x84c42, 0x1fa)
ioctl$TUNSETIFF(r3, 0x400454ca, 0x0)
write$tun(r3, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x38)

2.510380121s ago: executing program 6 (id=1310):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101})
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
r3 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
r6 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x4, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x4, 0xd}, {}, {0x3, 0xfff1}}}, 0x24}}, 0x40004)
recvmmsg(r6, &(0x7f00000056c0)=[{{0x0, 0x0, &(0x7f0000004f40)=[{&(0x7f0000001a00)=""/4096, 0x1000}, {&(0x7f0000003f40)=""/4080, 0xff0}], 0x2}, 0xfff}, {{0x0, 0x0, 0x0}, 0x7}], 0x2, 0x10022, 0x0)

2.505558141s ago: executing program 4 (id=1311):
socket$inet6_mptcp(0xa, 0x1, 0x106)
r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000200), 0x20000, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001}, 0x50)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, &(0x7f0000000040)={0x2, @pix_mp={0x0, 0x2, 0x33565348, 0x5, 0x0, [{0x4, 0x7}, {0x80000001, 0xffffffff}, {0xfffffff7, 0x5}, {0x6, 0x4}, {0x10, 0x7}, {0xe2, 0xaa6}, {0xfffffffb, 0x8}, {0xffffffff, 0x400}], 0xe9, 0x3, 0x3, 0x0, 0x6}})
sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084)
sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
keyctl$reject(0x13, 0x0, 0xd59, 0x1, 0x0)
ioctl$TIOCSISO7816(r0, 0xc0285443, &(0x7f0000000240)={0x7, 0xfffff60b, 0xfffffff9, 0x9, 0x2})

2.092284971s ago: executing program 4 (id=1312):
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000002900)=r1, 0x4)
bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x10, 0x2ffffffff}, 0xc)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000000700)=@deltaction={0x14, 0x31, 0x800, 0x70bd27, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x80)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x600, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b000000000004001a80180002"], 0x44}}, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0)

1.795008805s ago: executing program 0 (id=1313):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='+3 +4 +4.1 +4.2\n', 0x10)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f00000001c0)='1\n', 0x2) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
nanosleep(&(0x7f0000000240)={0x2}, 0x0)
mount$nfs4(&(0x7f0000000280)='127.0.0.1:/\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f00000002c0), 0x0, 0x0)

1.759100517s ago: executing program 5 (id=1314):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x22)
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x1860, 0x0, 0x1, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
lsetxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000680)={{}, {0x1, 0x2}, [], {0x4, 0x2}, [], {0x10, 0x4}, {0x20, 0x1}}, 0x24, 0x2)
mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200)
r0 = fanotify_init(0x4, 0x800)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x124)
fanotify_mark(r0, 0x441, 0x800003b, r1, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000540)='./file5\x00', 0x82c0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f0000000140)='./file0/file1\x00', 0x1021002, 0x0, 0x0, 0x0, 0x0)

1.374106404s ago: executing program 5 (id=1315):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000300)="000000000000000000000000000000000a000000000400000200000002")
ioctl(r1, 0x40140921, &(0x7f0000000400)="0000000001")
ioctl(r1, 0x40140921, &(0x7f0000000420)="010000000100000001")
ioctl(r1, 0x932, 0x0)

1.089565108s ago: executing program 3 (id=1316):
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, &(0x7f0000000340)})
ioctl$KVM_SET_CLOCK(r1, 0x4188aec6, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x20000000000003, 0x1004})
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, &(0x7f0000000080)="66b9800000c00f326635010000000f3064660f38828e4258660f08676ac744240012e93bf96766c744240201000000f20f78ecf5543e660f3829544e66b9800000c00f326635002000000f300f01df66b805000000f3a5baf80c66b80e5ca48f66efbafc0cec0f01310f019c09000f01c2", 0x71}], 0x1, 0x7d, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000100)={0xbc, 0x0, 0x4})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

1.03809124s ago: executing program 6 (id=1317):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0, 0x4b}], 0x1, 0x0, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000040)={[0xd419, 0x2, 0xe9b, 0x2, 0xd, 0x7f, 0x44233, 0x9, 0x80, 0x941, 0x8001, 0x1005, 0x4, 0x4, 0x0, 0xfffffdfffffffffd], 0xb000, 0x84340})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x4)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

992.120283ms ago: executing program 4 (id=1318):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040))
ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x81, 0x2, 0x182, 0x1, 0x10, 0xf1, 0x10000000000003, 0x1, 0x5, 0x0, 0x200, 0x0, 0xf48, 0x9, 0xfffffffffffffffa], 0xe000})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x3, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0x0, 0x68ff, 0x7529, 0x8000000009, 0x803, 0x0, 0x9, 0x2], 0xeeee8000, 0x306780})
fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xff, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x1, 0x6, 0x6, 0x6, 0x36, 0xe, 0x2, 0x87}, {0x3000, 0xdddd0000, 0x4, 0x5, 0x3, 0x6, 0xfc, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x4, 0xeeee0000, 0x8, 0x6, 0x5, 0x7f, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0x8000000, 0xf, 0x3, 0x16, 0x1, 0x2, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0x0, 0xd, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x10000, 0xdddd0000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x8, 0x8, 0x81, 0x7f, 0x70}, {0xdddd0000, 0xa000, 0xf, 0x5, 0xcd, 0x0, 0x9, 0xd, 0x7, 0xc, 0xb0, 0x91}, {0xffff1000, 0x30}, {0x100000, 0x7}, 0x1, 0x0, 0x3000, 0x2024, 0x2, 0xdc01, 0x100000, [0x6800000000000000, 0x3, 0x4, 0x8]})
ioctl$KVM_RUN(r2, 0xae80, 0x0)

957.914384ms ago: executing program 5 (id=1319):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x4000000008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$sock_int(r3, 0x1, 0x45, &(0x7f0000000200), 0x4)

901.961617ms ago: executing program 3 (id=1320):
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = socket$rds(0x15, 0x5, 0x0)
ioctl$XFS_IOC_FSGEOMETRY(r0, 0x8100587e, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0)
bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0xa, 0x9, 0x8, 0x2, 0x100}, 0x50)
socket(0x10, 0x3, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000880)=ANY=[@ANYBLOB="1c0000005e00019eb17738540600000000000000", @ANYRES32=0x0, @ANYRES8=r1], 0x1c}], 0x1, 0x0, 0x0, 0x810}, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0)
recvfrom(r1, 0x0, 0x0, 0x200, 0x0, 0x0)

862.551648ms ago: executing program 4 (id=1321):
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, 0x0, 0x40)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
close(0x3)
sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x34, r3, 0x1, 0x1070bd0c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x40811}, 0x20)
bind$inet6(r2, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0x1, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}, "0400000000bc"}}}}}}}, 0x0)

0s ago: executing program 0 (id=1322):
socket$inet6_mptcp(0xa, 0x1, 0x106)
r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000200), 0x20000, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001}, 0x50)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, &(0x7f0000000040)={0x2, @pix_mp={0x0, 0x2, 0x33565348, 0x5, 0x0, [{0x4, 0x7}, {0x80000001, 0xffffffff}, {0xfffffff7, 0x5}, {0x6, 0x4}, {0x10, 0x7}, {0xe2, 0xaa6}, {0xfffffffb, 0x8}, {0xffffffff, 0x400}], 0xe9, 0x3, 0x3, 0x0, 0x6}})
sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084)
sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
keyctl$reject(0x13, 0x0, 0xd59, 0x1, 0x0)
ioctl$TIOCSISO7816(r0, 0xc0285443, &(0x7f0000000240)={0x7, 0xfffff60b, 0xfffffff9, 0x9, 0x2})

kernel console output (not intermixed with test programs):

50] EXT4-fs error (device loop2): ext4_do_update_inode:5229: inode #2: comm syz.2.583: corrupted inode contents
[  269.468396][ T6350] EXT4-fs (loop2): Remounting filesystem read-only
[  269.523592][ T6350] EXT4-fs error (device loop2): ext4_dirty_inode:6077: inode #2: comm syz.2.583: mark_inode_dirty error
[  270.109465][ T6350] EXT4-fs (loop2): Remounting filesystem read-only
[  270.228633][ T6351] EXT4-fs error (device loop2): ext4_do_update_inode:5229: inode #2: comm syz.2.583: corrupted inode contents
[  270.279425][ T6351] EXT4-fs (loop2): Remounting filesystem read-only
[  270.334297][ T6373] FAULT_INJECTION: forcing a failure.
[  270.334297][ T6373] name failslab, interval 1, probability 0, space 0, times 1
[  270.388318][ T6373] CPU: 0 PID: 6373 Comm: syz.0.593 Not tainted syzkaller #0
[  270.395691][ T6373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  270.405931][ T6373] Call Trace:
[  270.409339][ T6373]  <TASK>
[  270.412413][ T6373]  dump_stack_lvl+0x188/0x250
[  270.417372][ T6373]  ? show_regs_print_info+0x20/0x20
[  270.422703][ T6373]  ? load_image+0x410/0x410
[  270.427344][ T6373]  ? __lock_acquire+0x7b50/0x7b50
[  270.432506][ T6373]  should_fail+0x383/0x4b0
[  270.437034][ T6373]  should_failslab+0x5/0x20
[  270.441636][ T6373]  slab_pre_alloc_hook+0x51/0xc0
[  270.446665][ T6373]  kmem_cache_alloc_trace+0x47/0x290
[  270.452003][ T6373]  ? sctp_endpoint_new+0x82/0xa00
[  270.457359][ T6373]  ? lockdep_softirqs_off+0x430/0x430
[  270.462804][ T6373]  sctp_endpoint_new+0x82/0xa00
[  270.467708][ T6373]  ? __raw_spin_lock_init+0x41/0x100
[  270.473050][ T6373]  sctp_init_sock+0x95b/0x11c0
[  270.477961][ T6373]  sctp_v6_init_sock+0x12/0x60
[  270.482771][ T6373]  inet6_create+0xd88/0x1130
[  270.487494][ T6373]  __sock_create+0x473/0x910
[  270.492288][ T6373]  __sys_socket+0xe2/0x170
[  270.496759][ T6373]  __x64_sys_socket+0x76/0x80
[  270.501501][ T6373]  do_syscall_64+0x4c/0xa0
[  270.505982][ T6373]  ? clear_bhb_loop+0x30/0x80
[  270.510801][ T6373]  ? clear_bhb_loop+0x30/0x80
[  270.515530][ T6373]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  270.521469][ T6373] RIP: 0033:0x7f162f1a4159
[  270.525997][ T6373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  270.546317][ T6373] RSP: 002b:00007f162d3fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
[  270.555150][ T6373] RAX: ffffffffffffffda RBX: 00007f162f42bfa0 RCX: 00007f162f1a4159
[  270.563468][ T6373] RDX: 0000000000000084 RSI: 0000000000000801 RDI: 000000000000000a
[  270.571486][ T6373] RBP: 00007f162f23b03b R08: 0000000000000000 R09: 0000000000000000
[  270.579608][ T6373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  270.587632][ T6373] R13: 00007f162f42c038 R14: 00007f162f42bfa0 R15: 00007ffc6939e5a8
[  270.595705][ T6373]  </TASK>
[  271.209154][ T6190] usb 2-1: new high-speed USB device number 4 using dummy_hcd
[  271.531850][ T6382] loop2: detected capacity change from 0 to 32768
[  271.561673][ T6403] loop0: detected capacity change from 0 to 1024
[  271.597258][ T6403] EXT4-fs (loop0): Ignoring removed bh option
[  271.665922][ T6403] EXT4-fs (loop0): mounted filesystem without journal. Opts: block_validity,max_dir_size_kb=0x0000000000000001,nombcache,sysvgroups,noinit_itable,dioread_lock,nogrpid,bh,grpjquota=,,errors=continue. Quota mode: none.
[  271.762529][ T6190] usb 2-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40
[  271.771756][ T6190] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  271.842422][ T6190] usb 2-1: Product: syz
[  271.846855][ T6190] usb 2-1: Manufacturer: syz
[  271.851494][ T6190] usb 2-1: SerialNumber: syz
[  271.930125][ T6414] loop0: detected capacity change from 0 to 128
[  271.975162][ T6414] EXT4-fs (loop0): mounting ext2 file system using the ext4 subsystem
[  272.084484][ T6414] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none.
[  272.147929][ T6414] ext2 filesystem being mounted at /115/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  272.665646][ T6437] loop2: detected capacity change from 0 to 4096
[  272.678399][ T6440] overlayfs: failed to clone upperpath
[  272.812116][ T6443] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  272.899236][   T26] audit: type=1800 audit(1789142669.428:94): pid=6437 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.619" name="file1" dev="loop2" ino=15 res=0 errno=0
[  272.978392][   T26] audit: type=1800 audit(1789142669.458:95): pid=6437 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.619" name="file1" dev="loop2" ino=15 res=0 errno=0
[  273.308538][ T6461] loop2: detected capacity change from 0 to 256
[  273.354366][ T6190] usb 2-1: USB disconnect, device number 4
[  273.395233][ T6463] loop0: detected capacity change from 0 to 1024
[  273.477937][ T6463] EXT4-fs (loop0): Ignoring removed bh option
[  273.520081][ T6463] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobarrier,dioread_lock,grpjquota=,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000010,bh,init_itable,. Quota mode: none.
[  273.591081][ T6463] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2812: Unable to expand inode 15. Delete some EAs or run e2fsck.
[  273.664502][ T6468] loop2: detected capacity change from 0 to 512
[  273.731590][ T6468] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option
[  273.752468][ T6468] EXT4-fs (loop2): Ignoring removed orlov option
[  273.761444][ T4292] udevd[4292]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  273.782409][ T6468] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[  273.859424][ T6468] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0002]
[  273.887598][ T6468] System zones: 1-12
[  273.898403][ T6472] loop1: detected capacity change from 0 to 2048
[  273.910619][ T6468] EXT4-fs (loop2): 1 truncate cleaned up
[  273.916644][ T6468] EXT4-fs (loop2): mounted filesystem without journal. Opts: nomblk_io_submit,max_batch_time=0x0000000000000002,orlov,mb_optimize_scan=0x0000000000000001,debug,data=journal,,errors=continue. Quota mode: none.
[  273.944422][ T6468] EXT4-fs warning (device loop2): verify_group_input:165: Last group not full
[  273.973258][ T6472] UDF-fs: error (device loop1): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[  274.052590][ T6472] UDF-fs: error (device loop1): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4
[  274.156308][ T6472] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  274.438491][ T6482] loop0: detected capacity change from 0 to 256
[  274.483616][ T6485] netlink: 16 bytes leftover after parsing attributes in process `syz.3.638'.
[  274.507016][ T6482] exFAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  274.524922][ T6482] exFAT-fs (loop0): Medium has reported failures. Some data may be lost.
[  274.620300][ T6482] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  274.633462][ T6489] loop2: detected capacity change from 0 to 128
[  274.684323][ T6489] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a802c018, mo2=0002]
[  274.711053][ T6489] System zones: 1-3, 19-19, 35-36
[  274.723321][ T6489] EXT4-fs (loop2): mounted filesystem without journal. Opts: journal_ioprio=0x0000000000000004,debug,,errors=continue. Quota mode: none.
[  274.737695][   T26] audit: type=1800 audit(1789142671.258:96): pid=6482 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.635" name="file1" dev="loop0" ino=1048612 res=0 errno=0
[  274.762558][ T6489] ext4 filesystem being mounted at /110/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff)
[  274.796693][   T26] audit: type=1800 audit(1789142671.268:97): pid=6482 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.635" name="file1" dev="loop0" ino=1048612 res=0 errno=0
[  274.923307][ T6493] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  274.987953][   T26] audit: type=1800 audit(1789142671.518:98): pid=6492 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.637" name="file1" dev="loop1" ino=15 res=0 errno=0
[  275.116039][   T26] audit: type=1800 audit(1789142671.548:99): pid=6492 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.637" name="file1" dev="loop1" ino=15 res=0 errno=0
[  275.410723][ T4174] usb 1-1: new full-speed USB device number 3 using dummy_hcd
[  275.530612][ T6503] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback.
[  275.622491][ T6503] ext4 filesystem being mounted at /93/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  275.917217][ T6495] XFS (loop2): Mounting V5 Filesystem
[  275.972402][ T4174] usb 1-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6
[  276.012982][ T4174] usb 1-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3
[  276.021158][ T4174] usb 1-1: Product: syz
[  276.026113][ T4174] usb 1-1: Manufacturer: syz
[  276.030766][ T4174] usb 1-1: SerialNumber: syz
[  276.039397][ T4174] usb 1-1: config 0 descriptor??
[  276.634669][ T6527] set_capacity_and_notify: 3 callbacks suppressed
[  276.634705][ T6527] loop1: detected capacity change from 0 to 131072
[  276.718794][ T6495] XFS (loop2): Ending clean mount
[  276.744263][ T6527] F2FS-fs (loop1): invalid crc value
[  276.793475][ T6527] F2FS-fs (loop1): Found nat_bits in checkpoint
[  276.839643][ T4174] usb 1-1: USB disconnect, device number 3
[  276.855331][ T6527] F2FS-fs (loop1): Cannot turn on quotas: -2 on 2
[  276.882376][ T6527] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4
[  277.002388][   T26] audit: type=1800 audit(1789142673.468:100): pid=6527 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.649" name="file1" dev="loop1" ino=7 res=0 errno=0
[  277.104901][ T4185] XFS (loop2): Unmounting Filesystem
[  277.115050][ T4511] udevd[4511]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  278.096567][ T6560] loop2: detected capacity change from 0 to 256
[  278.209751][ T6560] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d)
[  278.519937][ T6568] loop5: detected capacity change from 0 to 7
[  278.541399][ T4303] Dev loop5: unable to read RDB block 7
[  278.550637][ T4303]  loop5: unable to read partition table
[  278.556546][ T4303] loop5: partition table beyond EOD, truncated
[  278.603741][ T6568] Dev loop5: unable to read RDB block 7
[  278.609416][ T6568]  loop5: unable to read partition table
[  278.627066][ T6570] loop0: detected capacity change from 0 to 16
[  278.645582][ T6570] erofs: (device loop0): erofs_superblock_csum_verify: invalid checksum 0x7cda66ab, 0x7bbbea8c expected
[  278.660761][ T6568] loop5: partition table beyond EOD, truncated
[  278.672568][ T6568] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5)
[  278.678143][ T4511] udevd[4511]: incorrect erofs checksum on /dev/loop0
[  278.762267][    T7] usb 2-1: new full-speed USB device number 5 using dummy_hcd
[  278.829523][ T6574] overlayfs: failed to decode file handle (len=5, type=0, flags=0, err=-22)
[  279.148133][    T7] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  279.170395][ T6588] loop2: detected capacity change from 0 to 4096
[  279.180259][    T7] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  279.203855][    T7] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64
[  279.252738][ T6596] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  279.300832][    T7] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64
[  279.350912][    T7] usb 2-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  279.676239][ T6602] loop2: detected capacity change from 0 to 1024
[  279.712569][    T7] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  279.729926][    T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  279.755134][ T6602] EXT4-fs (loop2): Ignoring removed bh option
[  279.798013][    T7] usb 2-1: Product: syz
[  279.819799][ T6602] EXT4-fs (loop2): mounted filesystem without journal. Opts: nodelalloc,dioread_lock,barrier=0x0000000000000004,nolazytime,mb_optimize_scan=0x0000000000000000,lazytime,errors=remount-ro,stripe=0x0000000000000005,bh,init_itable,. Quota mode: none.
[  279.847870][    T7] usb 2-1: Manufacturer: syz
[  279.872996][    T7] usb 2-1: SerialNumber: syz
[  279.922680][ T6566] raw-gadget.0 gadget: fail, usb_ep_enable returned -22
[  279.945017][    T7] cdc_mbim 2-1:1.0: skipping garbage
[  280.176334][ T6566] raw-gadget.0 gadget: fail, usb_ep_enable returned -22
[  280.922993][ T6566] raw-gadget.0 gadget: fail, usb_ep_enable returned -22
[  281.252406][    T7] cdc_mbim 2-1:1.0: bind() failure
[  281.282479][    T7] cdc_ncm: probe of 2-1:1.1 failed with error -71
[  281.302365][    T7] cdc_mbim: probe of 2-1:1.1 failed with error -71
[  281.322346][    T7] usbtest: probe of 2-1:1.1 failed with error -71
[  281.344210][    T7] usb 2-1: USB disconnect, device number 5
[  281.417195][ T6633] fuse: Bad value for 'fd'
[  281.827537][ T6645] loop0: detected capacity change from 0 to 1024
[  281.937603][ T6650] fuse: Bad value for 'fd'
[  282.190404][ T6654] CIFS: Attempting to mount \\127.0.0.1\share
[  282.344083][ T6658] 0x000000000010-0x000300000020 : ""
[  282.375813][ T6658] mtd: partition "" extends beyond the end of device "mtdram test device" -- size truncated to 0x1fff0
[  282.499141][ T6658] ftl_cs: FTL header corrupt!
[  282.827683][ T6652] loop2: detected capacity change from 0 to 131072
[  282.853659][ T6664] loop0: detected capacity change from 0 to 512
[  282.903048][ T6664] EXT4-fs (loop0): Ignoring removed nobh option
[  282.995094][ T6654] CIFS: VFS: cifs_mount failed w/return code = -112
[  283.033046][ T6652] F2FS-fs (loop2): invalid crc value
[  283.078449][ T6652] F2FS-fs (loop2): Found nat_bits in checkpoint
[  283.124811][ T6652] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4
[  283.284412][ T6664] EXT4-fs (loop0): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000001000,nobh,quota,,errors=continue. Quota mode: writeback.
[  283.364121][ T6664] ext4 filesystem being mounted at /136/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  283.404664][ T6679] netlink: 12 bytes leftover after parsing attributes in process `syz.3.707'.
[  284.152309][ T4174] usb 2-1: new high-speed USB device number 6 using dummy_hcd
[  284.430093][ T6707] Illegal XDP return value 4294967277, expect packet loss!
[  284.449938][ T6684] loop0: detected capacity change from 0 to 32768
[  284.525240][ T6684] find_entry called with index = 0
[  284.529140][ T4174] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 1.00
[  284.551309][ T4174] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  284.562459][ T6684] read_mapping_page failed!
[  284.567132][ T6684] ERROR: (device loop0): txCommit: 
[  284.567132][ T6684] 
[  284.634654][ T6684] read_mapping_page failed!
[  284.652940][ T6684] ERROR: (device loop0): txCommit: 
[  284.652940][ T6684] 
[  284.686076][ T4174] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work!
[  284.762469][ T1236] read_mapping_page failed!
[  284.767652][ T1236] ERROR: (device loop0): txCommit: 
[  284.767652][ T1236] 
[  284.828160][ T1236] jfs_write_inode: jfs_commit_inode failed!
[  285.618289][ T6722] overlayfs: failed to set xattr on upper
[  285.662948][ T6722] overlayfs: ...falling back to index=off,metacopy=off.
[  285.752475][ T4568] usb 2-1: Failed to submit usb control message: -110
[  285.762345][ T4568] usb 2-1: unable to send the bmi data to the device: -110
[  285.769776][ T4568] usb 2-1: unable to get target info from device
[  285.817611][ T4568] usb 2-1: could not get target info (-110)
[  285.825798][ T4568] usb 2-1: could not probe fw (-110)
[  285.973127][ T6732] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
[  286.233200][ T6741] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
[  286.792215][ T6191] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[  286.858801][   T23] usb 2-1: USB disconnect, device number 6
[  287.213032][ T6191] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47
[  287.267059][ T6191] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  287.288659][ T6191] usb 1-1: config 0 descriptor??
[  287.344864][ T6191] gspca_main: STV06xx-2.14.0 probing 046d:0870
[  287.591416][ T6795] loop2: detected capacity change from 0 to 16
[  287.622237][ T4174] usb 2-1: new high-speed USB device number 7 using dummy_hcd
[  287.639325][ T6795] erofs: (device loop2): mounted with root inode @ nid 36.
[  287.656544][ T6795] erofs: (device loop2): z_erofs_map_blocks_iter: unknown type 3 @ offset 589823 of nid 36
[  287.667196][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 143 @ nid 36
[  287.676626][ T6795] erofs: (device loop2): z_erofs_map_blocks_iter: unknown type 3 @ offset 585727 of nid 36
[  287.686913][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 142 @ nid 36
[  287.696170][ T6795] erofs: (device loop2): z_erofs_map_blocks_iter: unknown type 3 @ offset 581631 of nid 36
[  287.706405][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 141 @ nid 36
[  287.715665][ T6795] erofs: (device loop2): z_erofs_map_blocks_iter: unknown type 3 @ offset 577535 of nid 36
[  287.726541][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 140 @ nid 36
[  287.735790][ T6795] erofs: (device loop2): z_erofs_map_blocks_iter: unknown type 3 @ offset 573439 of nid 36
[  287.745983][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 139 @ nid 36
[  287.755373][ T6795] erofs: (device loop2): z_erofs_map_blocks_iter: unknown type 3 @ offset 569343 of nid 36
[  287.765477][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 138 @ nid 36
[  287.775728][ T6795] erofs: (device loop2): z_erofs_map_blocks_iter: unknown type 3 @ offset 565247 of nid 36
[  287.785987][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 137 @ nid 36
[  287.795234][ T6795] erofs: (device loop2): z_erofs_map_blocks_iter: unknown type 3 @ offset 561151 of nid 36
[  287.805286][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 136 @ nid 36
[  287.814839][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 111 @ nid 36
[  287.824046][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 110 @ nid 36
[  287.833976][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 109 @ nid 36
[  287.845213][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 108 @ nid 36
[  287.854621][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 107 @ nid 36
[  287.863910][ T6795] erofs: (device loop2): z_erofs_readahead: readahead error at page 106 @ nid 36
[  287.873830][ T6795] attempt to access beyond end of device
[  287.873830][ T6795] loop2: rw=524288, want=13478624064, limit=16
[  287.885604][ T6795] attempt to access beyond end of device
[  287.885604][ T6795] loop2: rw=524288, want=13478624072, limit=16
[  287.897326][ T6795] attempt to access beyond end of device
[  287.897326][ T6795] loop2: rw=524288, want=14550774184, limit=16
[  287.909076][ T6795] attempt to access beyond end of device
[  287.909076][ T6795] loop2: rw=524288, want=14550774192, limit=16
[  287.921093][ T6795] attempt to access beyond end of device
[  287.921093][ T6795] loop2: rw=524288, want=13716630408, limit=16
[  287.933508][ T6795] attempt to access beyond end of device
[  287.933508][ T6795] loop2: rw=524288, want=13716630416, limit=16
[  287.944671][ T4174] usb 2-1: Using ep0 maxpacket: 8
[  287.945649][ T6795] attempt to access beyond end of device
[  287.945649][ T6795] loop2: rw=524288, want=790416, limit=16
[  287.961918][ T6795] attempt to access beyond end of device
[  287.961918][ T6795] loop2: rw=524288, want=790424, limit=16
[  287.973492][ T6795] attempt to access beyond end of device
[  287.973492][ T6795] loop2: rw=524288, want=104, limit=16
[  287.984542][ T6795] attempt to access beyond end of device
[  287.984542][ T6795] loop2: rw=524288, want=112, limit=16
[  288.142674][ T4174] usb 2-1: config index 0 descriptor too short (expected 301, got 45)
[  288.151401][ T4174] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  288.168987][ T4174] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  288.210540][ T4174] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  288.257009][ T4174] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  288.300426][ T4174] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  288.317596][ T4174] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  288.362568][ T6191] gspca_stv06xx: I2C: Read error writing address: -71
[  288.428521][ T6191] usb 1-1: USB disconnect, device number 4
[  288.602608][ T4174] usb 2-1: usb_control_msg returned -32
[  288.608415][ T4174] usbtmc 2-1:16.0: can't read capabilities
[  288.642229][   T13] usb 3-1: new high-speed USB device number 4 using dummy_hcd
[  288.868687][ T6809] FAULT_INJECTION: forcing a failure.
[  288.868687][ T6809] name failslab, interval 1, probability 0, space 0, times 0
[  288.916099][ T6809] CPU: 0 PID: 6809 Comm: syz.0.760 Not tainted syzkaller #0
[  288.923472][ T6809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  288.933659][ T6809] Call Trace:
[  288.936985][ T6809]  <TASK>
[  288.939955][ T6809]  dump_stack_lvl+0x188/0x250
[  288.944692][ T6809]  ? show_regs_print_info+0x20/0x20
[  288.949942][ T6809]  ? load_image+0x410/0x410
[  288.954498][ T6809]  ? __might_sleep+0xf0/0xf0
[  288.959376][ T6809]  ? __lock_acquire+0x7b50/0x7b50
[  288.964459][ T6809]  should_fail+0x383/0x4b0
[  288.968932][ T6809]  should_failslab+0x5/0x20
[  288.973475][ T6809]  slab_pre_alloc_hook+0x51/0xc0
[  288.978456][ T6809]  __kmalloc+0x6b/0x340
[  288.982655][ T6809]  ? security_prepare_creds+0x47/0x130
[  288.988271][ T6809]  ? prepare_creds+0x3c/0x610
[  288.993055][ T6809]  security_prepare_creds+0x47/0x130
[  288.998388][ T6809]  prepare_creds+0x450/0x610
[  289.003034][ T6809]  cap_task_prctl+0x330/0xc00
[  289.007769][ T6809]  security_task_prctl+0x75/0x100
[  289.012904][ T6809]  __se_sys_prctl+0xba/0x1050
[  289.017744][ T6809]  ? __x64_sys_prctl+0xc0/0xc0
[  289.022600][ T6809]  ? lockdep_hardirqs_on+0x94/0x140
[  289.028124][ T6809]  ? __x64_sys_prctl+0x1c/0xc0
[  289.032946][ T6809]  do_syscall_64+0x4c/0xa0
[  289.037471][ T6809]  ? clear_bhb_loop+0x30/0x80
[  289.042231][ T6809]  ? clear_bhb_loop+0x30/0x80
[  289.046961][ T6809]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  289.052898][ T6809] RIP: 0033:0x7f162f1a4159
[  289.057366][ T6809] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  289.077013][ T6809] RSP: 002b:00007f162d3fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d
[  289.085476][ T6809] RAX: ffffffffffffffda RBX: 00007f162f42bfa0 RCX: 00007f162f1a4159
[  289.093489][ T6809] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
[  289.101469][ T6809] RBP: 00007f162f23b03b R08: 0000000000000000 R09: 0000000000000000
[  289.109450][ T6809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  289.117772][ T6809] R13: 00007f162f42c038 R14: 00007f162f42bfa0 R15: 00007ffc6939e5a8
[  289.125789][ T6809]  </TASK>
[  289.198003][ T6815] process '/newroot/194/file0' started with executable stack
[  289.206070][ T6814] usbtmc 2-1:16.0: INITIATE_ABORT_BULK_OUT returned 0
[  289.222450][   T13] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[  289.252275][   T13] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47
[  289.289073][   T13] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
[  289.308970][   T13] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  289.372798][ T6805] raw-gadget.2 gadget: fail, usb_ep_enable returned -22
[  289.421779][ T6191] usb 2-1: USB disconnect, device number 7
[  289.613723][   T13] usb 3-1: USB disconnect, device number 4
[  290.429149][ T6840] loop0: detected capacity change from 0 to 8192
[  290.463736][ T6840] REISERFS warning (device loop0): super-6515 reiserfs_parse_options: journaled quota format not specified.
[  290.722469][ T6191] usb 3-1: new high-speed USB device number 5 using dummy_hcd
[  291.012516][ T6191] usb 3-1: Using ep0 maxpacket: 32
[  291.052859][ T6191] usb 3-1: too many configurations: 17, using maximum allowed: 8
[  291.188826][ T6191] usb 3-1: config 0 has an invalid interface number: 2 but max is 0
[  291.207400][ T6191] usb 3-1: config 0 has no interface number 0
[  291.338280][ T6191] usb 3-1: config 0 has an invalid interface number: 2 but max is 0
[  291.355778][ T6191] usb 3-1: config 0 has no interface number 0
[  291.462580][ T6191] usb 3-1: config 0 has an invalid interface number: 2 but max is 0
[  291.491094][ T6191] usb 3-1: config 0 has no interface number 0
[  291.609864][ T6879] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  291.622510][ T6191] usb 3-1: config 0 has an invalid interface number: 2 but max is 0
[  291.630580][ T6191] usb 3-1: config 0 has no interface number 0
[  291.852670][ T6191] usb 3-1: config 0 has an invalid interface number: 2 but max is 0
[  291.942276][ T6191] usb 3-1: config 0 has no interface number 0
[  292.026271][ T6888] FAULT_INJECTION: forcing a failure.
[  292.026271][ T6888] name fail_page_alloc, interval 1, probability 0, space 0, times 1
[  292.072626][ T6191] usb 3-1: config 0 has an invalid interface number: 2 but max is 0
[  292.089318][ T6191] usb 3-1: config 0 has no interface number 0
[  292.101379][ T6888] CPU: 0 PID: 6888 Comm: syz.0.786 Not tainted syzkaller #0
[  292.108785][ T6888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  292.119055][ T6888] Call Trace:
[  292.122376][ T6888]  <TASK>
[  292.125342][ T6888]  dump_stack_lvl+0x188/0x250
[  292.130078][ T6888]  ? show_regs_print_info+0x20/0x20
[  292.135513][ T6888]  ? load_image+0x410/0x410
[  292.140070][ T6888]  ? __lock_acquire+0x7b50/0x7b50
[  292.145146][ T6888]  should_fail+0x383/0x4b0
[  292.149619][ T6888]  prepare_alloc_pages+0x1e3/0x5b0
[  292.155162][ T6888]  __alloc_pages+0x11b/0x480
[  292.159795][ T6888]  ? zone_statistics+0x170/0x170
[  292.164784][ T6888]  ? alloc_pages+0x452/0x560
[  292.169457][ T6888]  __get_free_pages+0x8/0x30
[  292.174101][ T6888]  kasan_populate_vmalloc_pte+0x21/0xc0
[  292.179774][ T6888]  __apply_to_page_range+0x987/0xd10
[  292.185182][ T6888]  ? kasan_populate_vmalloc+0x70/0x70
[  292.190711][ T6888]  alloc_vmap_area+0x19e8/0x1b30
[  292.195740][ T6888]  ? vm_map_ram+0xba0/0xba0
[  292.200341][ T6888]  __get_vm_area_node+0x14f/0x2d0
[  292.205510][ T6888]  __vmalloc_node_range+0xef/0x8b0
[  292.210660][ T6888]  ? bpf_prog_alloc_no_stats+0x36/0x2c0
[  292.216356][ T6888]  ? end_current_label_crit_section+0x170/0x170
[  292.222726][ T6888]  ? __lock_acquire+0x7b50/0x7b50
[  292.227800][ T6888]  ? __lock_acquire+0x13dc/0x7b50
[  292.232872][ T6888]  ? bpf_prog_alloc_no_stats+0x36/0x2c0
[  292.238478][ T6888]  __vmalloc+0x76/0x80
[  292.242605][ T6888]  ? bpf_prog_alloc_no_stats+0x36/0x2c0
[  292.248199][ T6888]  bpf_prog_alloc_no_stats+0x36/0x2c0
[  292.253636][ T6888]  bpf_prog_alloc+0x1a/0x1e0
[  292.258294][ T6888]  bpf_prog_load+0x7d1/0x14e0
[  292.263087][ T6888]  ? map_freeze+0x360/0x360
[  292.267632][ T6888]  ? __might_fault+0xb7/0x110
[  292.272364][ T6888]  ? __might_fault+0xb3/0x110
[  292.277078][ T6888]  ? bpf_lsm_bpf+0x5/0x10
[  292.281524][ T6888]  ? security_bpf+0x7a/0xa0
[  292.286178][ T6888]  __sys_bpf+0x532/0x6f0
[  292.290500][ T6888]  ? bpf_link_show_fdinfo+0x380/0x380
[  292.293721][ T6191] usb 3-1: config 0 has an invalid interface number: 2 but max is 0
[  292.296099][ T6888]  __x64_sys_bpf+0x78/0x90
[  292.309108][ T6888]  do_syscall_64+0x4c/0xa0
[  292.313659][ T6888]  ? clear_bhb_loop+0x30/0x80
[  292.318375][ T6888]  ? clear_bhb_loop+0x30/0x80
[  292.322269][ T6191] usb 3-1: config 0 has no interface number 0
[  292.323090][ T6888]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  292.335353][ T6888] RIP: 0033:0x7f162f1a4159
[  292.339807][ T6888] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  292.359694][ T6888] RSP: 002b:00007f162d3fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  292.368186][ T6888] RAX: ffffffffffffffda RBX: 00007f162f42bfa0 RCX: 00007f162f1a4159
[  292.376403][ T6888] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005
[  292.385345][ T6888] RBP: 00007f162f23b03b R08: 0000000000000000 R09: 0000000000000000
[  292.393381][ T6888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  292.401396][ T6888] R13: 00007f162f42c038 R14: 00007f162f42bfa0 R15: 00007ffc6939e5a8
[  292.409424][ T6888]  </TASK>
[  292.462676][ T6191] usb 3-1: config 0 has an invalid interface number: 2 but max is 0
[  292.486645][ T6191] usb 3-1: config 0 has no interface number 0
[  292.542802][ T6888] syz.0.786: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=syz0,mems_allowed=0-1
[  292.578106][ T6888] CPU: 1 PID: 6888 Comm: syz.0.786 Not tainted syzkaller #0
[  292.585639][ T6888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  292.595781][ T6888] Call Trace:
[  292.599101][ T6888]  <TASK>
[  292.602065][ T6888]  dump_stack_lvl+0x188/0x250
[  292.606790][ T6888]  ? rcu_lock_release+0x5/0x20
[  292.611682][ T6888]  ? show_regs_print_info+0x20/0x20
[  292.616930][ T6888]  ? load_image+0x410/0x410
[  292.621520][ T6888]  warn_alloc+0x245/0x320
[  292.625899][ T6888]  ? slab_free_freelist_hook+0xec/0x170
[  292.631589][ T6888]  ? zone_watermark_ok_safe+0x250/0x250
[  292.637175][ T6888]  ? __get_vm_area_node+0x164/0x2d0
[  292.642424][ T6888]  ? __get_vm_area_node+0x164/0x2d0
[  292.647760][ T6888]  __vmalloc_node_range+0x2b1/0x8b0
[  292.653006][ T6888]  ? end_current_label_crit_section+0x170/0x170
[  292.659290][ T6888]  ? __lock_acquire+0x7b50/0x7b50
[  292.664375][ T6888]  ? __lock_acquire+0x13dc/0x7b50
[  292.669733][ T6888]  ? bpf_prog_alloc_no_stats+0x36/0x2c0
[  292.676047][ T6888]  __vmalloc+0x76/0x80
[  292.680169][ T6888]  ? bpf_prog_alloc_no_stats+0x36/0x2c0
[  292.685804][ T6888]  bpf_prog_alloc_no_stats+0x36/0x2c0
[  292.691454][ T6888]  bpf_prog_alloc+0x1a/0x1e0
[  292.696098][ T6888]  bpf_prog_load+0x7d1/0x14e0
[  292.700831][ T6888]  ? map_freeze+0x360/0x360
[  292.705371][ T6888]  ? __might_fault+0xb7/0x110
[  292.710104][ T6888]  ? __might_fault+0xb3/0x110
[  292.714823][ T6888]  ? bpf_lsm_bpf+0x5/0x10
[  292.719192][ T6888]  ? security_bpf+0x7a/0xa0
[  292.723732][ T6888]  __sys_bpf+0x532/0x6f0
[  292.728034][ T6888]  ? bpf_link_show_fdinfo+0x380/0x380
[  292.733657][ T6888]  __x64_sys_bpf+0x78/0x90
[  292.738209][ T6888]  do_syscall_64+0x4c/0xa0
[  292.742665][ T6888]  ? clear_bhb_loop+0x30/0x80
[  292.747389][ T6888]  ? clear_bhb_loop+0x30/0x80
[  292.752269][ T6888]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  292.758210][ T6888] RIP: 0033:0x7f162f1a4159
[  292.762663][ T6888] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  292.782391][ T6888] RSP: 002b:00007f162d3fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  292.790848][ T6888] RAX: ffffffffffffffda RBX: 00007f162f42bfa0 RCX: 00007f162f1a4159
[  292.798866][ T6888] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005
[  292.806880][ T6888] RBP: 00007f162f23b03b R08: 0000000000000000 R09: 0000000000000000
[  292.814919][ T6888] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  292.823588][ T6888] R13: 00007f162f42c038 R14: 00007f162f42bfa0 R15: 00007ffc6939e5a8
[  292.831884][ T6888]  </TASK>
[  292.836262][   T13] usb 2-1: new high-speed USB device number 8 using dummy_hcd
[  292.885680][ T6888] Mem-Info:
[  292.889180][ T6888] active_anon:1343 inactive_anon:28775 isolated_anon:0
[  292.889180][ T6888]  active_file:25425 inactive_file:35763 isolated_file:0
[  292.889180][ T6888]  unevictable:769 dirty:174 writeback:3
[  292.889180][ T6888]  slab_reclaimable:21237 slab_unreclaimable:96666
[  292.889180][ T6888]  mapped:33143 shmem:25377 pagetables:727 bounce:0
[  292.889180][ T6888]  kernel_misc_reclaimable:0
[  292.889180][ T6888]  free:1338759 free_pcp:9601 free_cma:0
[  292.980614][ T6191] usb 3-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=84.b2
[  293.000097][ T6191] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  293.004551][ T6888] Node 0 active_anon:5344kB inactive_anon:114724kB active_file:101496kB inactive_file:143052kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:132596kB dirty:724kB writeback:0kB shmem:99432kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:11116kB pagetables:3000kB all_unreclaimable? no
[  293.019880][ T6191] usb 3-1: Product: syz
[  293.083140][ T6191] usb 3-1: Manufacturer: syz
[  293.092389][ T6191] usb 3-1: SerialNumber: syz
[  293.104002][ T6191] usb 3-1: config 0 descriptor??
[  293.122322][ T6888] Node 1 active_anon:32kB inactive_anon:512kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:2080kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB all_unreclaimable? no
[  293.193483][ T6191] etas_es58x 3-1:0.2: Starting syz syz (Serial Number syz) driver version 1.00
[  293.207014][ T6888] Node 0 DMA free:15360kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  293.252371][   T13] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7
[  293.276931][   T13] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  293.316947][   T13] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7
[  293.336601][ T6888] lowmem_reserve[]: 0 2539 2540 2540 2540
[  293.359023][ T6888] Node 0 DMA32 free:1426996kB min:34784kB low:43480kB high:52176kB reserved_highatomic:0KB active_anon:5344kB inactive_anon:114924kB active_file:101496kB inactive_file:143052kB unevictable:1536kB writepending:724kB present:3129332kB managed:2606512kB mlocked:0kB bounce:0kB free_pcp:25772kB local_pcp:12580kB free_cma:0kB
[  293.498632][ T6888] lowmem_reserve[]: 0 0 0 0 0
[  293.522513][ T6888] Node 0 Normal free:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:660kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  293.582406][   T13] usb 2-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13
[  293.622630][   T13] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  293.661420][   T13] usb 2-1: Product: syz
[  293.692015][   T13] usb 2-1: Manufacturer: syz
[  293.708683][   T13] usb 2-1: SerialNumber: syz
[  293.725557][ T6888] lowmem_reserve[]: 0 0 0 0 0
[  293.730359][ T6888] Node 1 Normal free:3912732kB min:55108kB low:68884kB high:82660kB reserved_highatomic:0KB active_anon:32kB inactive_anon:512kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194304kB managed:4119672kB mlocked:0kB bounce:0kB free_pcp:11884kB local_pcp:972kB free_cma:0kB
[  293.853554][   T13] usb 2-1: config 0 descriptor??
[  293.951578][ T6888] lowmem_reserve[]: 0 0 0 0 0
[  293.986506][ T6888] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  294.123084][   T13] adutux 2-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0
[  294.462450][ T6191] etas_es58x 3-1:0.2: es58x_get_product_info: Could not read the product info: -EPROTO
[  294.477698][ T6888] Node 0 DMA32: 1038*4kB (UME) 659*8kB (UME) 599*16kB (UME) 602*32kB (UME) 240*64kB (UME) 99*128kB (UME) 9*256kB (UM) 16*512kB (UME) 9*1024kB (UME) 3*2048kB (M) 326*4096kB (UM) = 1427456kB
[  294.550787][ T6191] etas_es58x: probe of 3-1:0.2 failed with error -71
[  294.558361][ T6888] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[  294.682529][ T6888] Node 1 Normal: 162*4kB (UME) 31*8kB (UME) 32*16kB (UME) 183*32kB (UME) 83*64kB (UME) 20*128kB (UE) 8*256kB (UM) 7*512kB (UME) 3*1024kB (UME) 1*2048kB (M) 949*4096kB (M) = 3912992kB
[  294.708106][   T13] usb 2-1: USB disconnect, device number 8
[  294.729263][ T6888] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  294.759465][ T6191] usb 3-1: USB disconnect, device number 5
[  294.797304][ T6888] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  294.863896][ T6888] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  294.912240][ T6888] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB
[  294.928030][ T6888] 83688 total pagecache pages
[  294.933350][ T6888] 0 pages in swap cache
[  294.937650][ T6888] Swap cache stats: add 117, delete 117, find 1/4
[  294.947199][ T6888] Free swap  = 124728kB
[  294.951531][ T6888] Total swap = 124996kB
[  294.956466][ T6888] 2097051 pages RAM
[  294.960415][ T6888] 0 pages HighMem/MovableOnly
[  294.992363][ T6928] overlayfs: failed to clone upperpath
[  295.562075][ T6888] 411500 pages reserved
[  296.563805][ T6888] 0 pages cma reserved
[  297.435885][ T4174] usb 2-1: new high-speed USB device number 9 using dummy_hcd
[  297.684987][ T6964] loop2: detected capacity change from 0 to 40427
[  297.730021][ T4174] usb 2-1: Using ep0 maxpacket: 32
[  297.737059][ T6964] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12
[  297.752477][ T6964] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock
[  297.777057][ T6964] F2FS-fs (loop2): Found nat_bits in checkpoint
[  297.890993][ T6964] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0
[  297.899452][ T6964] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5
[  298.052633][ T4174] usb 2-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22
[  298.077737][ T4174] usb 2-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3
[  298.108171][ T6985] FAULT_INJECTION: forcing a failure.
[  298.108171][ T6985] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  298.122806][ T6985] CPU: 1 PID: 6985 Comm: syz.0.817 Not tainted syzkaller #0
[  298.130161][ T6985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  298.140271][ T6985] Call Trace:
[  298.140279][ T4174] usb 2-1: Product: syz
[  298.143586][ T6985]  <TASK>
[  298.143599][ T6985]  dump_stack_lvl+0x188/0x250
[  298.143635][ T6985]  ? show_regs_print_info+0x20/0x20
[  298.161052][ T6985]  ? load_image+0x410/0x410
[  298.165610][ T6985]  ? __lock_acquire+0x7b50/0x7b50
[  298.170671][ T6985]  should_fail+0x383/0x4b0
[  298.175284][ T6985]  prepare_alloc_pages+0x1e3/0x5b0
[  298.180430][ T6985]  __alloc_pages+0x11b/0x480
[  298.185038][ T6985]  ? zone_statistics+0x170/0x170
[  298.190031][ T6985]  ? alloc_pages+0x452/0x560
[  298.194672][ T6985]  __vmalloc_node_range+0x4b1/0x8b0
[  298.199905][ T6985]  bpf_map_area_mmapable_alloc+0xad/0xd0
[  298.205645][ T6985]  ? array_map_alloc+0x428/0x6f0
[  298.210762][ T6985]  array_map_alloc+0x428/0x6f0
[  298.215543][ T6985]  map_create+0x481/0x2330
[  298.219976][ T6985]  ? bpf_lsm_bpf+0x5/0x10
[  298.224328][ T6985]  __sys_bpf+0x30a/0x6f0
[  298.228599][ T6985]  ? bpf_link_show_fdinfo+0x380/0x380
[  298.233997][ T6985]  __x64_sys_bpf+0x78/0x90
[  298.238534][ T6985]  do_syscall_64+0x4c/0xa0
[  298.243010][ T6985]  ? clear_bhb_loop+0x30/0x80
[  298.247702][ T6985]  ? clear_bhb_loop+0x30/0x80
[  298.252397][ T6985]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  298.258515][ T6985] RIP: 0033:0x7f162f1a4159
[  298.262943][ T6985] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  298.282735][ T6985] RSP: 002b:00007f162d3fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  298.291304][ T6985] RAX: ffffffffffffffda RBX: 00007f162f42bfa0 RCX: 00007f162f1a4159
[  298.299621][ T6985] RDX: 0000000000000048 RSI: 0000200000000000 RDI: 0000000000000000
[  298.308033][ T6985] RBP: 00007f162f23b03b R08: 0000000000000000 R09: 0000000000000000
[  298.316028][ T6985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  298.324030][ T6985] R13: 00007f162f42c038 R14: 00007f162f42bfa0 R15: 00007ffc6939e5a8
[  298.332031][ T6985]  </TASK>
[  298.340277][ T4174] usb 2-1: Manufacturer: syz
[  298.346410][ T4174] usb 2-1: SerialNumber: syz
[  298.372580][ T4174] usb 2-1: config 0 descriptor??
[  298.486223][ T4174] usb 2-1: selecting invalid altsetting 3
[  298.504319][ T4174] comedi comedi4: could not set alternate setting 3 in high speed
[  298.519643][ T6990] loop5: detected capacity change from 0 to 7
[  298.527395][ T4174] usbdux 2-1:0.0: driver 'usbdux' failed to auto-configure device.
[  298.540707][ T4303] Dev loop5: unable to read RDB block 7
[  298.547540][ T4303]  loop5: unable to read partition table
[  298.562426][ T4303] loop5: partition table beyond EOD, truncated
[  298.571882][ T4174] usbdux: probe of 2-1:0.0 failed with error -22
[  298.612828][ T6990] Dev loop5: unable to read RDB block 7
[  298.622400][ T6990]  loop5: unable to read partition table
[  298.693351][ T6191] usb 2-1: USB disconnect, device number 9
[  298.792948][ T6990] loop5: partition table beyond EOD, truncated
[  298.799362][ T6990] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5)
[  298.841115][ T4185] F2FS-fs (loop2): invalid namelen(0), ino:0, run fsck to fix.
[  298.841182][ T4185] F2FS-fs (loop2): invalid namelen(0), ino:0, run fsck to fix.
[  298.885111][ T4185] F2FS-fs (loop2): invalid namelen(0), ino:0, run fsck to fix.
[  298.902187][ T4185] F2FS-fs (loop2): invalid namelen(0), ino:0, run fsck to fix.
[  298.909949][ T4185] F2FS-fs (loop2): invalid namelen(0), ino:0, run fsck to fix.
[  298.920326][ T4185] F2FS-fs (loop2): invalid namelen(0), ino:0, run fsck to fix.
[  298.940140][ T4185] F2FS-fs (loop2): invalid namelen(0), ino:0, run fsck to fix.
[  299.782051][ T7000] loop0: detected capacity change from 0 to 32768
[  299.979854][ T7000] XFS (loop0): Mounting V5 Filesystem
[  300.106168][ T7000] XFS (loop0): Ending clean mount
[  300.253189][ T7037] FAULT_INJECTION: forcing a failure.
[  300.253189][ T7037] name failslab, interval 1, probability 0, space 0, times 0
[  300.266947][ T7037] CPU: 1 PID: 7037 Comm: syz.1.834 Not tainted syzkaller #0
[  300.274303][ T7037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  300.284493][ T7037] Call Trace:
[  300.287810][ T7037]  <TASK>
[  300.290783][ T7037]  dump_stack_lvl+0x188/0x250
[  300.295509][ T7037]  ? show_regs_print_info+0x20/0x20
[  300.301046][ T7037]  ? load_image+0x410/0x410
[  300.305628][ T7037]  should_fail+0x383/0x4b0
[  300.310106][ T7037]  should_failslab+0x5/0x20
[  300.314756][ T7037]  slab_pre_alloc_hook+0x51/0xc0
[  300.319921][ T7037]  ? dst_alloc+0x101/0x160
[  300.324497][ T7037]  kmem_cache_alloc+0x3d/0x280
[  300.329386][ T7037]  ? ipv6_sysctl_rtcache_flush+0xf0/0xf0
[  300.335155][ T7037]  dst_alloc+0x101/0x160
[  300.339459][ T7037]  ip6_pol_route+0x911/0x12d0
[  300.344238][ T7037]  ? trace_fib6_table_lookup+0x1b0/0x1b0
[  300.349931][ T7037]  ? rcu_lock_release+0x9/0x20
[  300.354813][ T7037]  fib6_rule_lookup+0x222/0x5e0
[  300.360704][ T7037]  ? ip6_route_output_flags_noref+0x390/0x390
[  300.366832][ T7037]  ? fib6_lookup+0x2d0/0x2d0
[  300.371492][ T7037]  ? __ipv6_addr_type+0xff/0x2e0
[  300.376703][ T7037]  ? ip6_route_output_flags_noref+0x230/0x390
[  300.382869][ T7037]  ip6_route_output_flags+0xbf/0x300
[  300.388214][ T7037]  icmpv6_rt_has_prefsrc+0x4f/0x390
[  300.393552][ T7037]  icmp6_send+0xcbc/0x19a0
[  300.398048][ T7037]  ? icmpv6_push_pending_frames+0x440/0x440
[  300.404176][ T7037]  ? ip6_route_input+0x79b/0xaa0
[  300.409218][ T7037]  ip6_pkt_drop+0x55a/0x690
[  300.413785][ T7037]  ? refcount_add+0x80/0x80
[  300.418490][ T7037]  ip6_pkt_discard+0x18/0x20
[  300.423145][ T7037]  NF_HOOK+0x303/0x390
[  300.427279][ T7037]  ? refcount_add+0x80/0x80
[  300.431848][ T7037]  ? ip6_rcv_core+0x1600/0x1600
[  300.436764][ T7037]  ? refcount_add+0x80/0x80
[  300.441349][ T7037]  ? ip6_rcv_finish_core+0x420/0x420
[  300.446814][ T7037]  __netif_receive_skb+0xcc/0x290
[  300.452152][ T7037]  ? ktime_get_with_offset+0x2d7/0x320
[  300.457769][ T7037]  netif_receive_skb+0x19e/0x700
[  300.462762][ T7037]  ? __bpf_trace_softirq+0x10/0x10
[  300.468116][ T7037]  ? netif_receive_skb_core+0x210/0x210
[  300.473813][ T7037]  tun_rx_batched+0x606/0x760
[  300.478654][ T7037]  ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0
[  300.484896][ T7037]  ? local_bh_enable+0x20/0x20
[  300.489817][ T7037]  ? __local_bh_enable_ip+0x136/0x1c0
[  300.495260][ T7037]  ? read_lock_is_recursive+0x10/0x10
[  300.500839][ T7037]  ? __local_bh_enable_ip+0x136/0x1c0
[  300.501150][   T26] audit: type=1800 audit(1789142697.008:101): pid=7000 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.822" name="file1" dev="loop0" ino=6150 res=0 errno=0
[  300.506368][ T7037]  ? _local_bh_enable+0xa0/0xa0
[  300.532117][ T7037]  ? skb_set_owner_w+0x213/0x340
[  300.537162][ T7037]  tun_get_user+0x25bf/0x3b60
[  300.541998][ T7037]  ? tun_ring_recv+0xc90/0xc90
[  300.546854][ T7037]  ? rcu_lock_release+0x5/0x20
[  300.551894][ T7037]  ? __lock_acquire+0x7b50/0x7b50
[  300.557086][ T7037]  tun_chr_write_iter+0x112/0x1e0
[  300.562168][ T7037]  vfs_write+0x748/0xd70
[  300.566675][ T7037]  ? file_end_write+0x250/0x250
[  300.571697][ T7037]  ? __fget_files+0x402/0x470
[  300.576469][ T7037]  ? __fdget_pos+0x1e2/0x370
[  300.581102][ T7037]  ? ksys_write+0x70/0x260
[  300.585571][ T7037]  ksys_write+0x153/0x260
[  300.589961][ T7037]  ? __ia32_sys_read+0x80/0x80
[  300.594813][ T7037]  ? lockdep_hardirqs_on+0x94/0x140
[  300.600078][ T7037]  do_syscall_64+0x4c/0xa0
[  300.604553][ T7037]  ? clear_bhb_loop+0x30/0x80
[  300.609358][ T7037]  ? clear_bhb_loop+0x30/0x80
[  300.614282][ T7037]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  300.620241][ T7037] RIP: 0033:0x7fd324fe998e
[  300.624717][ T7037] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  300.644766][ T7037] RSP: 002b:00007fd323280fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  300.653231][ T7037] RAX: ffffffffffffffda RBX: 00007fd3232816c0 RCX: 00007fd324fe998e
[  300.661434][ T7037] RDX: 000000000000007a RSI: 0000200000000040 RDI: 00000000000000c8
[  300.669445][ T7037] RBP: 00007fd3250c003b R08: 0000000000000000 R09: 0000000000000000
[  300.677505][ T7037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  300.685533][ T7037] R13: 00007fd3252b1038 R14: 00007fd3252b0fa0 R15: 00007ffd8e8d31d8
[  300.693622][ T7037]  </TASK>
[  301.085736][ T4188] XFS (loop0): Unmounting Filesystem
[  301.130593][ T7045] loop2: detected capacity change from 0 to 512
[  301.472212][ T7045] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback.
[  301.502351][ T7045] ext4 filesystem being mounted at /139/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  303.644335][ T7067] loop1: detected capacity change from 0 to 1024
[  303.701027][ T7071] netlink: 104 bytes leftover after parsing attributes in process `syz.0.844'.
[  303.730164][ T7067] EXT4-fs (loop1): Ignoring removed oldalloc option
[  303.757805][ T7067] EXT4-fs (loop1): Ignoring removed orlov option
[  303.820336][ T7076] loop2: detected capacity change from 0 to 512
[  303.856682][ T7067] EXT4-fs (loop1): mounted filesystem without journal. Opts: block_validity,bsddf,nombcache,oldalloc,debug_want_extra_isize=0x0000000000000080,orlov,nogrpid,noauto_da_alloc,grpjquota=,,errors=continue. Quota mode: none.
[  303.878773][ T7076] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[  304.028672][ T7076] EXT4-fs (loop2): 1 truncate cleaned up
[  304.104025][ T7076] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none.
[  304.701108][ T7090] loop2: detected capacity change from 0 to 2048
[  304.818087][ T7090] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found!
[  305.452828][ T7090] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  306.014819][ T7103] using random self ethernet address
[  306.112342][ T7103] using random host ethernet address
[  306.480654][ T7115] printk: console [ttyGS0] disabled
[  306.862283][ T7117] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store
[  308.767267][ T7126] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
[  308.789233][ T7110] loop1: detected capacity change from 0 to 32768
[  308.808664][ T7110] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.856 (7110)
[  308.839309][ T7110] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm
[  308.855808][ T7110] BTRFS info (device loop1): using free space tree
[  308.862924][ T7110] BTRFS info (device loop1): has skinny extents
[  309.069244][ T7146] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  309.214718][ T3244] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  309.244076][ T7110] BTRFS error (device loop1): open_ctree failed: -12
[  309.244547][ T4265] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by udevd (4265)
[  310.066137][ T7175] loop0: detected capacity change from 0 to 8192
[  310.382307][ T7155] usb 3-1: new high-speed USB device number 6 using dummy_hcd
[  310.435899][ T7154] usb 2-1: new high-speed USB device number 10 using dummy_hcd
[  310.499111][ T7188] capability: warning: `syz.3.879' uses deprecated v2 capabilities in a way that may be insecure
[  310.693108][ T7154] usb 2-1: Using ep0 maxpacket: 32
[  310.812664][ T7155] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  310.838217][ T7155] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  310.848886][ T7154] usb 2-1: config 0 has an invalid interface number: 67 but max is 0
[  310.864209][ T7154] usb 2-1: config 0 has no interface number 0
[  310.884607][ T7155] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  310.929469][ T7155] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  310.956936][ T7155] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  310.974468][ T7155] usb 3-1: config 0 descriptor??
[  311.073369][ T7154] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  311.089311][ T7154] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  311.106666][ T7154] usb 2-1: Product: syz
[  311.117664][ T7154] usb 2-1: Manufacturer: syz
[  311.128096][ T7154] usb 2-1: SerialNumber: syz
[  311.148060][ T7154] usb 2-1: config 0 descriptor??
[  311.223638][ T7154] smsc95xx v2.0.0
[  311.336818][ T7217] netlink: 'syz.4.889': attribute type 4 has an invalid length.
[  311.361648][ T7217] netlink: 'syz.4.889': attribute type 4 has an invalid length.
[  311.485540][ T7155] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving
[  311.579308][ T7155] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0
[  311.730154][ T7224] ip_tables: iptables: counters copy to user failed while replacing table
[  312.132487][ T7154] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): EEPROM read operation timeout
[  312.362523][ T7154] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71
[  312.381287][ T7154] smsc95xx: probe of 2-1:0.67 failed with error -71
[  312.416848][ T7154] usb 2-1: USB disconnect, device number 10
[  313.152545][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  313.305847][    C0] plantronics 0003:047F:FFFF.0004: usb_submit_urb(ctrl) failed: -1
[  313.672760][ T7264] FAULT_INJECTION: forcing a failure.
[  313.672760][ T7264] name fail_usercopy, interval 1, probability 0, space 0, times 1
[  313.702263][ T7264] CPU: 0 PID: 7264 Comm: syz.1.908 Not tainted syzkaller #0
[  313.709650][ T7264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  313.720398][ T7264] Call Trace:
[  313.723871][ T7264]  <TASK>
[  313.727069][ T7264]  dump_stack_lvl+0x188/0x250
[  313.732108][ T7264]  ? show_regs_print_info+0x20/0x20
[  313.737363][ T7264]  ? load_image+0x410/0x410
[  313.741970][ T7264]  ? __lock_acquire+0x7b50/0x7b50
[  313.747165][ T7264]  ? mutex_unlock+0x10/0x10
[  313.751834][ T7264]  should_fail+0x383/0x4b0
[  313.756593][ T7264]  _copy_to_user+0x2e/0x130
[  313.761269][ T7264]  rng_dev_read+0x3b6/0x700
[  313.765895][ T7264]  ? devm_hwrng_match+0x60/0x60
[  313.770805][ T7264]  ? common_file_perm+0x171/0x1c0
[  313.775882][ T7264]  ? fsnotify_perm+0x3a7/0x560
[  313.780697][ T7264]  do_iter_read+0x505/0x7c0
[  313.785261][ T7264]  do_preadv+0x236/0x390
[  313.789617][ T7264]  ? do_writev+0x480/0x480
[  313.794100][ T7264]  ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[  313.800138][ T7264]  ? lock_chain_count+0x20/0x20
[  313.805051][ T7264]  ? lockdep_hardirqs_on+0x94/0x140
[  313.810305][ T7264]  do_syscall_64+0x4c/0xa0
[  313.814767][ T7264]  ? clear_bhb_loop+0x30/0x80
[  313.819488][ T7264]  ? clear_bhb_loop+0x30/0x80
[  313.824219][ T7264]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  313.830246][ T7264] RIP: 0033:0x7fd325029159
[  313.834704][ T7264] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  313.854352][ T7264] RSP: 002b:00007fd323281028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
[  313.862819][ T7264] RAX: ffffffffffffffda RBX: 00007fd3252b0fa0 RCX: 00007fd325029159
[  313.870840][ T7264] RDX: 0000000000000001 RSI: 00002000000001c0 RDI: 0000000000000004
[  313.878850][ T7264] RBP: 00007fd3250c003b R08: 0000000000000005 R09: 0000000000000000
[  313.886951][ T7264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  313.894976][ T7264] R13: 00007fd3252b1038 R14: 00007fd3252b0fa0 R15: 00007ffd8e8d31d8
[  313.903596][ T7264]  </TASK>
[  314.251995][ T7254] loop2: detected capacity change from 0 to 32768
[  314.365269][ T7160] usb 3-1: USB disconnect, device number 6
[  314.534205][ T7254] JBD2: Ignoring recovery information on journal
[  314.591505][ T7283] loop1: detected capacity change from 0 to 512
[  314.721451][ T7283] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[  314.783597][ T7254] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode.
[  314.992444][ T7283] FAULT_INJECTION: forcing a failure.
[  314.992444][ T7283] name failslab, interval 1, probability 0, space 0, times 0
[  315.079335][ T7283] CPU: 0 PID: 7283 Comm: syz.1.917 Not tainted syzkaller #0
[  315.086720][ T7283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  315.096817][ T7283] Call Trace:
[  315.100111][ T7283]  <TASK>
[  315.103056][ T7283]  dump_stack_lvl+0x188/0x250
[  315.107754][ T7283]  ? show_regs_print_info+0x20/0x20
[  315.113223][ T7283]  ? load_image+0x410/0x410
[  315.117829][ T7283]  ? __might_sleep+0xf0/0xf0
[  315.122432][ T7283]  ? __lock_acquire+0x7b50/0x7b50
[  315.127489][ T7283]  should_fail+0x383/0x4b0
[  315.131939][ T7283]  should_failslab+0x5/0x20
[  315.136450][ T7283]  slab_pre_alloc_hook+0x51/0xc0
[  315.141559][ T7283]  ? fat_get_block_bmap+0x450/0x450
[  315.147038][ T7283]  ? fat_alloc_inode+0x19/0xa0
[  315.151849][ T7283]  kmem_cache_alloc+0x3d/0x280
[  315.156647][ T7283]  ? fat_get_block_bmap+0x450/0x450
[  315.161862][ T7283]  fat_alloc_inode+0x19/0xa0
[  315.166460][ T7283]  ? fat_get_block_bmap+0x450/0x450
[  315.171671][ T7283]  new_inode_pseudo+0x5f/0x210
[  315.176519][ T7283]  new_inode+0x25/0x1d0
[  315.180692][ T7283]  fat_build_inode+0x1fa/0x3d0
[  315.185508][ T7283]  vfat_lookup+0x2c5/0x510
[  315.189981][ T7283]  ? setup+0xe0/0xe0
[  315.194351][ T7283]  ? do_raw_spin_unlock+0x11d/0x230
[  315.199573][ T7283]  ? _raw_spin_unlock+0x24/0x40
[  315.204433][ T7283]  ? d_alloc+0x1e7/0x250
[  315.208719][ T7283]  lookup_one_qstr_excl+0x10e/0x240
[  315.213943][ T7283]  filename_create+0x242/0x450
[  315.218771][ T7283]  ? kern_path_create+0x190/0x190
[  315.224272][ T7283]  do_mkdirat+0xa5/0x5c0
[  315.228537][ T7283]  ? vfs_mkdir+0x570/0x570
[  315.233022][ T7283]  __x64_sys_mkdirat+0x85/0x90
[  315.237833][ T7283]  do_syscall_64+0x4c/0xa0
[  315.242297][ T7283]  ? clear_bhb_loop+0x30/0x80
[  315.247029][ T7283]  ? clear_bhb_loop+0x30/0x80
[  315.251785][ T7283]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  315.257727][ T7283] RIP: 0033:0x7fd325029159
[  315.262162][ T7283] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  315.282362][ T7283] RSP: 002b:00007fd323281028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[  315.290840][ T7283] RAX: ffffffffffffffda RBX: 00007fd3252b0fa0 RCX: 00007fd325029159
[  315.298887][ T7283] RDX: 00000000000001c0 RSI: 0000200000000040 RDI: ffffffffffffff9c
[  315.306886][ T7283] RBP: 00007fd3250c003b R08: 0000000000000000 R09: 0000000000000000
[  315.314889][ T7283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  315.322971][ T7283] R13: 00007fd3252b1038 R14: 00007fd3252b0fa0 R15: 00007ffd8e8d31d8
[  315.330989][ T7283]  </TASK>
[  315.445444][   T26] audit: type=1800 audit(1789142711.978:102): pid=7292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.906" name="file1" dev="loop2" ino=17058 res=0 errno=0
[  315.510637][   T26] audit: type=1800 audit(1789142711.998:103): pid=7254 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.906" name="file1" dev="loop2" ino=17058 res=0 errno=0
[  315.675993][ T4186] FAT-fs (loop1): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003)
[  315.693630][ T4186] FAT-fs (loop1): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003)
[  315.742251][ T4185] ocfs2: Unmounting device (7,2) on (node local)
[  316.104633][ T7311] loop2: detected capacity change from 0 to 512
[  316.197931][ T7311] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[  316.228319][ T7311] EXT4-fs error (device loop2): ext4_orphan_get:1436: comm syz.2.923: bad orphan inode 131083
[  316.240336][ T7311] EXT4-fs (loop2): mounted filesystem without journal. Opts: jqfmt=vfsv0,dioread_lock,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none.
[  316.312924][ T7311] loop_set_status: loop2 () has still dirty pages (nrpages=1)
[  316.457540][    T9] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  316.469485][ T4185] EXT4-fs error (device loop2): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0
[  316.511495][ T7321] netlink: 24 bytes leftover after parsing attributes in process `syz.4.932'.
[  316.575923][ T7322] netlink: 8 bytes leftover after parsing attributes in process `syz.4.932'.
[  316.628082][    T9] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  316.809506][    T9] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  316.923214][ T7333] fuse: Bad value for 'fd'
[  317.019715][ T7335] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  317.052895][ T7335] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  317.124382][    T9] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  317.161019][ T1421] ieee802154 phy0 wpan0: encryption failed: -22
[  317.169082][ T1421] ieee802154 phy1 wpan1: encryption failed: -22
[  317.702689][    T9] tipc: Left network mode
[  318.727450][ T7353] chnl_net:caif_netlink_parms(): no params data found
[  318.882517][    T9] device hsr_slave_0 left promiscuous mode
[  318.893491][    T9] device hsr_slave_1 left promiscuous mode
[  318.917634][    T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  318.935460][    T9] batman_adv: batadv0: Removing interface: batadv_slave_0
[  318.954079][    T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  318.992105][    T9] batman_adv: batadv0: Removing interface: batadv_slave_1
[  319.023042][    T9] device bridge_slave_1 left promiscuous mode
[  319.032434][    T9] bridge0: port 2(bridge_slave_1) entered disabled state
[  319.114373][    T9] device bridge_slave_0 left promiscuous mode
[  319.120670][    T9] bridge0: port 1(bridge_slave_0) entered disabled state
[  319.163980][    T9] device veth1_macvtap left promiscuous mode
[  319.179451][    T9] device veth0_macvtap left promiscuous mode
[  319.194964][    T9] device veth1_vlan left promiscuous mode
[  319.208879][    T9] device veth0_vlan left promiscuous mode
[  319.654157][    T9] team0 (unregistering): Port device team_slave_1 removed
[  319.676696][    T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  319.728802][    T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  319.874368][    T9] bond0 (unregistering): Released all slaves
[  320.041609][ T7353] bridge0: port 1(bridge_slave_0) entered blocking state
[  320.060116][ T7353] bridge0: port 1(bridge_slave_0) entered disabled state
[  320.089913][ T7353] device bridge_slave_0 entered promiscuous mode
[  320.112322][ T7353] bridge0: port 2(bridge_slave_1) entered blocking state
[  320.119864][ T7353] bridge0: port 2(bridge_slave_1) entered disabled state
[  320.128893][ T7353] device bridge_slave_1 entered promiscuous mode
[  320.141483][ T7361] chnl_net:caif_netlink_parms(): no params data found
[  320.192353][ T4243] Bluetooth: hci1: command 0x0409 tx timeout
[  320.265563][ T7353] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  320.329281][ T7413] netlink: 'syz.0.954': attribute type 2 has an invalid length.
[  320.350533][ T7353] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  320.541839][   T23] Bluetooth: hci3: command 0x0409 tx timeout
[  320.570320][ T7424] loop0: detected capacity change from 0 to 512
[  320.585045][ T7353] team0: Port device team_slave_0 added
[  320.611269][ T7361] bridge0: port 1(bridge_slave_0) entered blocking state
[  320.633544][ T7361] bridge0: port 1(bridge_slave_0) entered disabled state
[  320.641845][ T7361] device bridge_slave_0 entered promiscuous mode
[  320.669121][ T7361] bridge0: port 2(bridge_slave_1) entered blocking state
[  320.690963][ T7424] EXT4-fs (loop0): Ignoring removed oldalloc option
[  320.712533][ T7361] bridge0: port 2(bridge_slave_1) entered disabled state
[  320.727440][ T7424] EXT4-fs (loop0): Ignoring removed bh option
[  320.742996][ T7361] device bridge_slave_1 entered promiscuous mode
[  320.752495][ T7353] team0: Port device team_slave_1 added
[  320.849832][ T7361] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  320.866544][ T7361] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  320.883618][ T7424] EXT4-fs (loop0): 1 truncate cleaned up
[  320.893732][ T7424] EXT4-fs (loop0): mounted filesystem without journal. Opts: oldalloc,mb_optimize_scan=0x0000000000000000,bh,noload,data_err=ignore,usrjquota=,min_batch_time=0x000000000000ccff,,errors=continue. Quota mode: none.
[  320.926387][ T7361] team0: Port device team_slave_0 added
[  320.934981][ T7361] team0: Port device team_slave_1 added
[  320.985287][ T7361] batman_adv: batadv0: Adding interface: batadv_slave_0
[  321.005218][ T7361] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  321.073739][ T7361] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  321.110025][ T7353] batman_adv: batadv0: Adding interface: batadv_slave_0
[  321.118763][ T7424] EXT4-fs error (device loop0): ext4_lookup:1858: inode #12: comm syz.0.957: unexpected EA_INODE flag
[  321.140010][ T7353] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  321.178180][ T7353] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  321.217611][ T7361] batman_adv: batadv0: Adding interface: batadv_slave_1
[  321.242283][ T7361] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  321.330119][ T7361] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  321.391007][ T7353] batman_adv: batadv0: Adding interface: batadv_slave_1
[  321.411019][ T7353] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  321.465970][ T7353] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  321.484344][ T7446] loop0: detected capacity change from 0 to 1024
[  321.572652][ T7446] EXT4-fs (loop0): Ignoring removed mblk_io_submit option
[  321.592282][ T7446] EXT4-fs (loop0): Ignoring removed oldalloc option
[  321.646136][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  321.658013][ T7361] device hsr_slave_0 entered promiscuous mode
[  321.683827][ T7361] device hsr_slave_1 entered promiscuous mode
[  321.694202][ T7446] EXT4-fs (loop0): mounted filesystem without journal. Opts: mblk_io_submit,nodioread_nolock,oldalloc,inode_readahead_blks=0x0000000000800000,delalloc,grpjquota=,,errors=continue. Quota mode: none.
[  321.722590][ T7446] ext4 filesystem being mounted at /185/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  321.756445][ T7361] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  321.782284][ T7361] Cannot create hsr debugfs directory
[  321.805792][ T7353] device hsr_slave_0 entered promiscuous mode
[  321.822508][ T7353] device hsr_slave_1 entered promiscuous mode
[  321.830171][ T7353] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  321.870291][ T7353] Cannot create hsr debugfs directory
[  322.274808][ T4243] Bluetooth: hci1: command 0x041b tx timeout
[  322.530330][ T7353] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  322.579338][ T7353] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  322.604485][   T23] Bluetooth: hci3: command 0x041b tx timeout
[  322.611761][ T7353] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  322.641953][ T7361] netdevsim netdevsim6 netdevsim0: renamed from eth0
[  322.678640][ T7361] netdevsim netdevsim6 netdevsim1: renamed from eth1
[  322.735076][ T7353] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  322.807475][ T7361] netdevsim netdevsim6 netdevsim2: renamed from eth2
[  322.835008][ T7361] netdevsim netdevsim6 netdevsim3: renamed from eth3
[  323.050796][ T7353] 8021q: adding VLAN 0 to HW filter on device bond0
[  323.110193][ T4377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  323.129651][ T4377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  323.212771][ T7361] 8021q: adding VLAN 0 to HW filter on device bond0
[  323.263445][ T7353] 8021q: adding VLAN 0 to HW filter on device team0
[  323.322836][ T7361] 8021q: adding VLAN 0 to HW filter on device team0
[  323.340326][ T4377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  323.353020][ T4377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  323.396511][ T4377] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  323.418703][ T4377] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  323.452869][ T4377] bridge0: port 1(bridge_slave_0) entered blocking state
[  323.460682][ T4377] bridge0: port 1(bridge_slave_0) entered forwarding state
[  323.570416][ T4377] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  323.618653][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  323.655783][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  323.694665][ T4555] bridge0: port 1(bridge_slave_0) entered blocking state
[  323.701934][ T4555] bridge0: port 1(bridge_slave_0) entered forwarding state
[  323.755940][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  323.791700][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  323.814723][ T7479] loop0: detected capacity change from 0 to 8
[  323.842782][ T4555] bridge0: port 2(bridge_slave_1) entered blocking state
[  323.849919][ T4555] bridge0: port 2(bridge_slave_1) entered forwarding state
[  323.893763][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  323.915804][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  323.939799][ T4555] bridge0: port 2(bridge_slave_1) entered blocking state
[  323.947176][ T4555] bridge0: port 2(bridge_slave_1) entered forwarding state
[  323.963355][ T7479] SQUASHFS error: lzo decompression failed, data probably corrupt
[  323.986002][ T7479] SQUASHFS error: Failed to read block 0x91: -5
[  324.001097][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  324.009301][ T7479] SQUASHFS error: Unable to read metadata cache entry [8f]
[  324.045053][ T7479] SQUASHFS error: Unable to read inode 0x11f
[  324.077099][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  324.093211][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  324.111910][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  324.140521][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  324.152357][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  324.222827][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  324.254279][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  324.314247][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  324.352557][ T4243] Bluetooth: hci1: command 0x040f tx timeout
[  324.373743][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  324.396347][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  324.429968][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  324.488195][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  324.525664][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  324.565344][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  324.593507][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  324.611070][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  324.629533][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  324.660110][ T7353] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  324.672354][ T4229] Bluetooth: hci3: command 0x040f tx timeout
[  324.709326][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  324.718488][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  324.748857][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  324.778656][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  324.807564][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  324.839129][ T7361] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  324.939325][ T7503] overlayfs: failed to clone upperpath
[  324.974432][ T7505] bridge0: port 2(bridge_slave_1) entered blocking state
[  324.981614][ T7505] bridge0: port 2(bridge_slave_1) entered listening state
[  324.989021][ T7505] bridge0: port 1(bridge_slave_0) entered blocking state
[  324.996286][ T7505] bridge0: port 1(bridge_slave_0) entered listening state
[  325.098248][ T7505] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  325.140213][ T7505] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  325.352572][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  325.371192][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  325.417457][ T7353] 8021q: adding VLAN 0 to HW filter on device batadv0
[  325.493553][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  325.501271][ T4555] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  325.552461][ T7361] 8021q: adding VLAN 0 to HW filter on device batadv0
[  326.432517][ T6191] Bluetooth: hci1: command 0x0419 tx timeout
[  326.759747][ T6191] Bluetooth: hci3: command 0x0419 tx timeout
[  327.784577][  T450] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  327.852532][  T450] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  327.896001][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  327.923342][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  327.970706][ T7353] device veth0_vlan entered promiscuous mode
[  327.988965][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  328.014040][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  328.060259][ T7353] device veth1_vlan entered promiscuous mode
[  328.124695][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  328.143295][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  328.175547][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  328.254873][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  328.312780][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  328.344543][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  328.378191][ T7580] loop0: detected capacity change from 0 to 256
[  328.394323][ T7361] device veth0_vlan entered promiscuous mode
[  328.406600][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  328.427436][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  328.458495][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  328.498081][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  328.555575][ T7353] device veth0_macvtap entered promiscuous mode
[  328.567342][ T7361] device veth1_vlan entered promiscuous mode
[  328.586746][ T7353] device veth1_macvtap entered promiscuous mode
[  328.665891][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  328.689969][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  328.717295][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  328.767135][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  328.799380][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  328.818500][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  328.836044][ T7353] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  328.847210][ T7353] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  328.857532][ T7353] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  328.870542][ T7353] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  328.880926][ T7353] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  328.893210][ T7353] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  328.903536][ T7353] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  328.917502][ T7353] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  328.938950][ T7353] batman_adv: batadv0: Interface activated: batadv_slave_0
[  328.951522][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  328.961957][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  328.973921][ T7361] device veth0_macvtap entered promiscuous mode
[  328.993011][ T7353] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  329.004423][ T7353] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.015512][ T7353] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  329.026649][ T7353] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.040584][ T7353] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  329.053137][ T7353] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.063582][ T7353] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  329.075607][ T7353] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.100058][ T7353] batman_adv: batadv0: Interface activated: batadv_slave_1
[  329.120833][ T7361] device veth1_macvtap entered promiscuous mode
[  329.135028][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  329.154683][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  329.170105][ T7353] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  329.187343][ T7353] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  329.199566][ T7353] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  329.218964][ T7353] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  329.279606][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  329.301446][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.331772][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  329.352020][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.381959][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  329.397350][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.408196][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  329.419172][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.429300][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  329.440169][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.455257][ T7361] batman_adv: batadv0: Interface activated: batadv_slave_0
[  329.476176][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  329.485388][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  329.545856][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  329.564406][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.575275][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  329.586080][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.597025][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  329.609797][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.620054][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  329.630883][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.642217][ T7361] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  329.774018][ T7361] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  329.822617][ T7361] batman_adv: batadv0: Interface activated: batadv_slave_1
[  329.847412][ T7361] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  329.867655][ T7361] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  329.885088][ T7361] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  329.908097][ T7361] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  330.096249][ T1236] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  330.119544][ T1236] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  330.188780][ T4568] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  330.215041][ T4568] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  330.225818][ T4568] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  330.253879][ T4376] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  330.268652][ T4376] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  330.296469][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  330.342392][ T7154] usb 1-1: new high-speed USB device number 5 using dummy_hcd
[  330.351740][ T4568] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  330.372737][ T4568] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  330.406764][ T1236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  330.476767][    T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  330.492534][    T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  330.522679][    T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  330.733116][ T7154] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  330.772615][ T7154] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  331.663213][ T7625] loop5: detected capacity change from 0 to 131072
[  331.672743][ T7154] usb 1-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00
[  331.682014][ T7154] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  331.714438][ T7625] F2FS-fs (loop5): invalid crc value
[  331.775240][ T7618] loop6: detected capacity change from 0 to 32768
[  331.862429][ T7625] F2FS-fs (loop5): Found nat_bits in checkpoint
[  331.892955][ T7625] F2FS-fs (loop5): Cannot turn on quotas: -2 on 2
[  331.971918][ T7625] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e4
[  332.003294][ T7618] find_entry called with index = 0
[  332.023028][ T7618] read_mapping_page failed!
[  332.030930][ T7618] ERROR: (device loop6): txCommit: 
[  332.030930][ T7618] 
[  332.083211][ T7618] read_mapping_page failed!
[  332.087802][ T7618] ERROR: (device loop6): txCommit: 
[  332.087802][ T7618] 
[  332.176531][ T7154] wacom 0003:056A:033B.0005: Unknown device_type for 'HID 056a:033b'. Assuming pen.
[  332.206431][ T4376] read_mapping_page failed!
[  332.212937][ T4376] ERROR: (device loop6): txCommit: 
[  332.212937][ T4376] 
[  332.237194][ T7154] wacom 0003:056A:033B.0005: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.0-1/input0
[  332.241462][ T4376] jfs_write_inode: jfs_commit_inode failed!
[  332.292779][ T7154] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/0003:056A:033B.0005/input/input10
[  332.559607][ T7158] usb 1-1: USB disconnect, device number 5
[  332.733949][ T7666] fido_id[7666]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory
[  333.985044][ T7704] loop6: detected capacity change from 0 to 764
[  334.188821][ T7704] overlayfs: failed to decode file handle (len=6, type=248, flags=0, err=-61)
[  334.657912][ T7710] loop0: detected capacity change from 0 to 512
[  334.886793][ T7710] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: inode #2: comm syz.0.1022: missing EA_INODE flag
[  334.992772][ T7710] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.1022: error while reading EA inode 2 err=-117
[  335.102815][ T7710] EXT4-fs (loop0): 1 orphan inode deleted
[  335.129694][ T7710] EXT4-fs (loop0): mounted filesystem without journal. Opts: nombcache,nogrpid,,errors=continue. Quota mode: writeback.
[  335.478902][ T7702] loop5: detected capacity change from 0 to 32768
[  336.337814][ T7702] BTRFS info (device loop5): using sha256 (sha256-avx2) checksum algorithm
[  336.379816][ T7749] o2cb: This node has not been configured.
[  336.391750][ T7749] o2cb: Cluster check failed. Fix errors before retrying.
[  336.401491][ T7749] (syz.0.1027,7749,1):user_dlm_register:675 ERROR: status = -22
[  336.403714][ T7702] BTRFS info (device loop5): using free space tree
[  336.418301][ T7749] (syz.0.1027,7749,1):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "domain1"
[  336.468776][ T7702] BTRFS info (device loop5): has skinny extents
[  336.610792][ T7702] BTRFS info (device loop5): enabling ssd optimizations
[  336.832554][ T5772] usb 1-1: new full-speed USB device number 6 using dummy_hcd
[  336.847935][ T7789] overlayfs: failed to clone upperpath
[  337.175941][ T5772] usb 1-1: not running at top speed; connect to a high speed hub
[  337.262417][ T5772] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64
[  337.273792][ T4229] usb 7-1: new high-speed USB device number 2 using dummy_hcd
[  337.300721][ T5772] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00
[  337.342840][ T5772] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  337.435265][ T5772] usb 1-1: Found UVC 1.00 device <unnamed> (0000:0000)
[  337.532310][ T4229] usb 7-1: Using ep0 maxpacket: 8
[  337.607261][ T7765] raw-gadget.0 gadget: fail, usb_ep_enable returned -22
[  337.639993][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  337.692803][ T7809] overlayfs: failed to clone upperpath
[  338.697771][ T4229] usb 7-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4
[  338.726731][ T4229] usb 7-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3
[  338.735236][ T5772] usb 1-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround.
[  338.744892][ T4229] usb 7-1: Product: syz
[  338.749176][ T4229] usb 7-1: Manufacturer: syz
[  338.802575][ T4229] usb 7-1: SerialNumber: syz
[  338.809254][ T4229] usb 7-1: config 0 descriptor??
[  338.822647][ T5772] uvcvideo 1-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26).
[  338.925364][ T4229] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd
[  338.932265][ T5772] uvcvideo 1-1:1.1: Failed to initialize the device (-5).
[  338.942450][ T5772] gspca_main: spca501-2.14.0 probing 0000:0000
[  338.966235][ T5772] gspca_spca501: reg write: error -71
[  338.971685][ T5772] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05
[  338.979056][ T5772] spca501: probe of 1-1:1.0 failed with error -22
[  339.061407][ T5772] usb 1-1: USB disconnect, device number 6
[  339.122312][ T4229] gspca_zc3xx: reg_w_i err -71
[  339.127288][ T4229] gspca_zc3xx: probe of 7-1:0.0 failed with error -71
[  339.179882][ T4229] usb 7-1: USB disconnect, device number 2
[  340.397995][    C0] vcan0: j1939_tp_rxtimer: 0xffff88802b318000: rx timeout, send abort
[  340.772684][ T7876] HTB: quantum of class FFF10001 is small. Consider r2q change.
[  340.908843][    C0] vcan0: j1939_tp_rxtimer: 0xffff88802b318000: abort rx timeout. Force session deactivation
[  341.039494][ T7894] overlayfs: failed to clone upperpath
[  341.128792][ T7896] loop6: detected capacity change from 0 to 1024
[  341.172058][ T7896] EXT4-fs (loop6): inline encryption not supported
[  341.266862][ T7896] EXT4-fs error (device loop6): ext4_map_blocks:631: inode #3: block 2: comm syz.6.1088: lblock 2 mapped to illegal pblock 2 (length 1)
[  341.314938][ T7896] EXT4-fs (loop6): Remounting filesystem read-only
[  341.321541][ T7896] Quota error (device loop6): qtree_write_dquot: dquota write failed
[  341.359900][ T7896] EXT4-fs error (device loop6): __ext4_get_inode_loc:4334: comm syz.6.1088: Invalid inode table block 1 in block_group 0
[  341.378998][ T7908] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1081'.
[  341.555503][ T7896] EXT4-fs (loop6): Remounting filesystem read-only
[  341.687727][ T7896] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5873: Corrupt filesystem
[  342.004993][ T7896] EXT4-fs (loop6): Remounting filesystem read-only
[  342.066766][ T7896] EXT4-fs error (device loop6): __ext4_ext_dirty:183: inode #3: comm syz.6.1088: mark_inode_dirty error
[  342.140316][ T7896] EXT4-fs (loop6): Remounting filesystem read-only
[  342.147041][ T7896] Quota error (device loop6): v2_write_file_info: Can't write info structure
[  342.157072][ T7896] EXT4-fs error (device loop6): ext4_acquire_dquot:6236: comm syz.6.1088: Failed to acquire dquot type 0
[  342.170991][ T7896] EXT4-fs (loop6): Remounting filesystem read-only
[  342.178398][ T7896] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5873: Corrupt filesystem
[  342.208736][ T7896] EXT4-fs (loop6): Remounting filesystem read-only
[  342.216741][ T7914] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
[  342.242509][ T7896] EXT4-fs error (device loop6): ext4_evict_inode:284: inode #11: comm syz.6.1088: mark_inode_dirty error
[  342.268074][ T7896] EXT4-fs (loop6): Remounting filesystem read-only
[  342.290248][ T7896] EXT4-fs warning (device loop6): ext4_evict_inode:287: couldn't mark inode dirty (err -117)
[  342.313817][ T7921] o2cb: This node has not been configured.
[  342.319924][ T7896] EXT4-fs (loop6): 1 orphan inode deleted
[  342.327174][ T7921] o2cb: Cluster check failed. Fix errors before retrying.
[  342.334582][ T4376] EXT4-fs error (device loop6): ext4_map_blocks:631: inode #3: block 1: comm kworker/u4:10: lblock 1 mapped to illegal pblock 1 (length 1)
[  342.335019][ T7896] EXT4-fs (loop6): mounted filesystem without journal. Opts: acl,noblock_validity,journal_dev=0x000000000000000f,max_batch_time=0x00000000000008c9,inlinecrypt,errors=remount-ro,. Quota mode: none.
[  342.378677][ T7921] (syz.0.1084,7921,0):user_dlm_register:675 ERROR: status = -22
[  342.387437][ T7921] (syz.0.1084,7921,0):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "domain1"
[  342.474028][ T4376] EXT4-fs (loop6): Remounting filesystem read-only
[  342.505519][ T4376] Quota error (device loop6): remove_tree: Can't read quota data block 1
[  342.526824][ T7927] loop0: detected capacity change from 0 to 512
[  342.535313][ T4376] EXT4-fs error (device loop6): ext4_release_dquot:6272: comm kworker/u4:10: Failed to release dquot type 0
[  342.629612][ T4376] EXT4-fs (loop6): Remounting filesystem read-only
[  342.646461][ T7361] EXT4-fs error (device loop6): __ext4_get_inode_loc:4334: comm syz-executor: Invalid inode table block 1 in block_group 0
[  342.701546][ T7361] EXT4-fs (loop6): Remounting filesystem read-only
[  342.720863][ T7361] EXT4-fs error (device loop6) in ext4_reserve_inode_write:5873: Corrupt filesystem
[  342.740204][ T7361] EXT4-fs (loop6): Remounting filesystem read-only
[  342.747000][ T7361] EXT4-fs error (device loop6): ext4_quota_off:6542: inode #3: comm syz-executor: mark_inode_dirty error
[  342.787160][ T7361] EXT4-fs (loop6): Remounting filesystem read-only
[  342.922003][ T7936] loop6: detected capacity change from 0 to 1024
[  342.995591][ T7936] EXT4-fs (loop6): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  343.192534][ T7936] EXT4-fs (loop6): mounted filesystem without journal. Opts: discard,journal_dev=0x0000000000000002,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue. Quota mode: writeback.
[  343.941363][ T7946] FAULT_INJECTION: forcing a failure.
[  343.941363][ T7946] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  344.016572][ T7946] CPU: 1 PID: 7946 Comm: syz.5.1097 Not tainted syzkaller #0
[  344.024036][ T7946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  344.034142][ T7946] Call Trace:
[  344.037437][ T7946]  <TASK>
[  344.040489][ T7946]  dump_stack_lvl+0x188/0x250
[  344.045285][ T7946]  ? show_regs_print_info+0x20/0x20
[  344.051217][ T7946]  ? load_image+0x410/0x410
[  344.055805][ T7946]  ? __lock_acquire+0x7b50/0x7b50
[  344.061038][ T7946]  ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[  344.067053][ T7946]  should_fail+0x383/0x4b0
[  344.071505][ T7946]  fpu__restore_sig+0x254/0x10a0
[  344.076596][ T7946]  ? copy_fpstate_to_sigframe+0xba0/0xba0
[  344.082375][ T7946]  ? __lock_acquire+0x7b50/0x7b50
[  344.087458][ T7946]  ? __might_fault+0xb3/0x110
[  344.092188][ T7946]  ? _copy_from_user+0x111/0x170
[  344.097182][ T7946]  __ia32_sys_rt_sigreturn+0x5ef/0x750
[  344.102749][ T7946]  ? load_gs_index+0x130/0x130
[  344.107591][ T7946]  ? lock_chain_count+0x20/0x20
[  344.113103][ T7946]  ? lockdep_hardirqs_on+0x94/0x140
[  344.118357][ T7946]  do_syscall_64+0x4c/0xa0
[  344.122823][ T7946]  ? clear_bhb_loop+0x30/0x80
[  344.127546][ T7946]  ? clear_bhb_loop+0x30/0x80
[  344.132273][ T7946]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  344.138208][ T7946] RIP: 0033:0x7f20d4975159
[  344.142665][ T7946] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  344.162642][ T7946] RSP: 002b:00007f20d2bcd028 EFLAGS: 00000246
[  344.169801][ T7946] RAX: fffffffffffffffc RBX: 00007f20d4bfcfa0 RCX: 00007f20d4975159
[  344.178052][ T7946] RDX: 0000000000000000 RSI: 000000004004550c RDI: 0000000000000004
[  344.187134][ T7946] RBP: 00007f20d4a0c03b R08: 0000000000000000 R09: 0000000000000000
[  344.195638][ T7946] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  344.203848][ T7946] R13: 00007f20d4bfd038 R14: 00007f20d4bfcfa0 R15: 00007ffe4b67d058
[  344.212263][ T7946]  </TASK>
[  344.463047][ T7966] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1101'.
[  344.672655][ T7982] netlink: 'syz.0.1105': attribute type 1 has an invalid length.
[  344.724131][ T7984] loop6: detected capacity change from 0 to 512
[  344.819786][ T7982] 8021q: adding VLAN 0 to HW filter on device bond1
[  344.997037][ T7985] bond1: (slave dummy0): Enslaving as a backup interface with an up link
[  345.027051][ T7988] netlink: 'syz.0.1105': attribute type 10 has an invalid length.
[  345.047341][ T7988] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1105'.
[  345.065999][ T8001] netlink: 100 bytes leftover after parsing attributes in process `syz.5.1108'.
[  345.074057][ T4704] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  345.193144][ T7988] device dummy0 entered promiscuous mode
[  345.212455][ T4313] bond1: (slave dummy0): link status up again after 0 ms
[  345.259957][ T4313] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  345.324167][ T7988] bond1: (slave dummy0): Removing an active aggregator
[  345.343023][ T7988] bond1: (slave dummy0): Releasing backup interface
[  345.582324][ T4229] usb 7-1: new high-speed USB device number 3 using dummy_hcd
[  346.082656][ T4229] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  346.140623][ T4229] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  346.262581][ T4229] usb 7-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40
[  346.289728][ T8025] kvm: emulating exchange as write
[  346.299225][ T4229] usb 7-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0
[  346.338146][ T4229] usb 7-1: Manufacturer: syz
[  346.369575][ T4229] usb 7-1: config 0 descriptor??
[  346.394397][ T8015] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability
[  346.452650][ T8015] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16
[  346.555528][ T8032] loop0: detected capacity change from 0 to 2048
[  346.733936][ T8032] EXT4-fs (loop0): mounted filesystem without journal. Opts: init_itable,,errors=continue. Quota mode: none.
[  346.759355][   T26] audit: type=1800 audit(1789142743.288:104): pid=8032 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1118" name="file1" dev="loop0" ino=15 res=0 errno=0
[  346.798459][ T8032] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters
[  346.883347][ T8032] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 2 with error 28
[  346.912713][ T8032] EXT4-fs (loop0): This should not happen!! Data will be lost
[  346.912713][ T8032] 
[  346.938522][ T8032] EXT4-fs (loop0): Total free blocks count 0
[  346.965011][ T8032] EXT4-fs (loop0): Free/Dirty block details
[  346.991946][ T8032] EXT4-fs (loop0): free_blocks=2415919504
[  347.002952][ T8032] EXT4-fs (loop0): dirty_blocks=16
[  347.008159][ T8032] EXT4-fs (loop0): Block reservation details
[  347.180541][ T8032] EXT4-fs (loop0): i_reserved_data_blocks=1
[  348.321570][ T4229] usb 7-1: USB disconnect, device number 3
[  348.438901][ T8073] o2cb: This node has not been configured.
[  348.472865][ T8073] o2cb: Cluster check failed. Fix errors before retrying.
[  348.513050][ T8073] (syz.0.1126,8073,1):user_dlm_register:675 ERROR: status = -22
[  348.564448][ T8073] (syz.0.1126,8073,1):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "domain1"
[  348.872288][ T4229] usb 7-1: new high-speed USB device number 4 using dummy_hcd
[  349.112369][ T4229] usb 7-1: Using ep0 maxpacket: 32
[  349.383275][ T4229] usb 7-1: config 0 has no interfaces?
[  350.302622][ T4229] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  350.332165][ T4229] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  350.360791][ T4229] usb 7-1: Product: syz
[  350.388453][ T4229] usb 7-1: Manufacturer: syz
[  350.394153][ T4229] usb 7-1: SerialNumber: syz
[  350.418767][ T4229] usb 7-1: config 0 descriptor??
[  350.594313][ T8133] overlayfs: failed to clone upperpath
[  350.682458][ T4229] usb 7-1: USB disconnect, device number 4
[  350.722301][ T6191] usb 6-1: new full-speed USB device number 2 using dummy_hcd
[  351.212755][ T6191] usb 6-1: not running at top speed; connect to a high speed hub
[  351.823145][ T8164] overlayfs: failed to clone upperpath
[  352.057680][ T6191] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64
[  352.068724][ T6191] usb 6-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00
[  352.077983][ T6191] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  352.145368][ T6191] usb 6-1: Found UVC 1.00 device <unnamed> (0000:0000)
[  352.347053][ T8127] raw-gadget.1 gadget: fail, usb_ep_enable returned -22
[  352.367033][ T8183] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1158'.
[  352.460161][ T8187] gadgetfs: bound to dummy_udc driver
[  352.742611][ T4229] usb 1-1: new high-speed USB device number 7 using dummy_hcd
[  352.792857][    C1] gadgetfs: connected
[  352.804544][ T4229] gadgetfs: disconnected
[  352.931408][ T8206] loop0: detected capacity change from 0 to 2048
[  353.029091][ T8211] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead.
[  353.073530][ T8206] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpquota,,errors=continue. Quota mode: writeback.
[  353.322744][ T8219] o2cb: This node has not been configured.
[  353.342332][ T8219] o2cb: Cluster check failed. Fix errors before retrying.
[  353.420722][ T8219] (syz.6.1165,8219,0):user_dlm_register:675 ERROR: status = -22
[  353.438686][ T8219] (syz.6.1165,8219,0):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "domain1"
[  353.672228][ T6191] usb 6-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround.
[  353.702353][ T6191] uvcvideo 6-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26).
[  353.721494][ T6191] uvcvideo 6-1:1.1: Failed to initialize the device (-5).
[  353.733016][ T6191] gspca_main: spca501-2.14.0 probing 0000:0000
[  354.532457][ T6191] gspca_spca501: reg write: error -71
[  354.538033][ T6191] spca501 6-1:1.0: Reg write failed for 0x02,0x0f,0x05
[  354.545118][ T6191] spca501: probe of 6-1:1.0 failed with error -22
[  354.556669][ T6191] usb 6-1: USB disconnect, device number 2
[  355.553807][    C1] bridge0: port 1(bridge_slave_0) entered learning state
[  355.561605][    C1] bridge0: port 2(bridge_slave_1) entered learning state
[  355.567578][ T8256] o2cb: This node has not been configured.
[  355.616416][ T8256] o2cb: Cluster check failed. Fix errors before retrying.
[  355.662354][ T8256] (syz.5.1183,8256,0):user_dlm_register:675 ERROR: status = -22
[  355.682265][ T8256] (syz.5.1183,8256,0):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "domain1"
[  356.290733][ T8276] loop5: detected capacity change from 0 to 4096
[  356.581374][ T8276] ntfs3: loop5: Mark volume as dirty due to NTFS errors
[  358.558345][ T8310] ip_tables: iptables: counters copy to user failed while replacing table
[  358.710756][ T8320] CIFS: Attempting to mount \\127.0.0.1\share
[  358.787514][ T8320] CIFS: VFS: challenge blob len 0 too small
[  358.821599][ T8320] CIFS: VFS: \\127.0.0.1 Send error in SessSetup = -22
[  358.847002][ T8320] CIFS: VFS: cifs_mount failed w/return code = -22
[  358.875911][ T7353] ntfs3: loop5: ntfs_evict_inode r=5 failed, -22.
[  358.888933][ T8329] FAULT_INJECTION: forcing a failure.
[  358.888933][ T8329] name failslab, interval 1, probability 0, space 0, times 0
[  358.937038][ T8329] CPU: 0 PID: 8329 Comm: syz.0.1189 Not tainted syzkaller #0
[  358.944510][ T8329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  358.954691][ T8329] Call Trace:
[  358.958044][ T8329]  <TASK>
[  358.961011][ T8329]  dump_stack_lvl+0x188/0x250
[  358.965743][ T8329]  ? show_regs_print_info+0x20/0x20
[  358.970995][ T8329]  ? load_image+0x410/0x410
[  358.975547][ T8329]  ? __might_sleep+0xf0/0xf0
[  358.980183][ T8329]  ? __lock_acquire+0x7b50/0x7b50
[  358.985251][ T8329]  should_fail+0x383/0x4b0
[  358.989711][ T8329]  should_failslab+0x5/0x20
[  358.994344][ T8329]  slab_pre_alloc_hook+0x51/0xc0
[  358.999327][ T8329]  ? __proc_create+0x36f/0x8b0
[  359.004278][ T8329]  kmem_cache_alloc+0x3d/0x280
[  359.009092][ T8329]  __proc_create+0x36f/0x8b0
[  359.013729][ T8329]  ? proc_symlink+0x210/0x210
[  359.018444][ T8329]  ? make_kgid+0x1c4/0x650
[  359.023417][ T8329]  ? from_kuid_munged+0x6e0/0x6e0
[  359.028482][ T8329]  _proc_mkdir+0x5f/0x160
[  359.032860][ T8329]  proc_net_ns_init+0x287/0x380
[  359.037840][ T8329]  ops_init+0x360/0x5f0
[  359.042043][ T8329]  setup_net+0x39e/0xa10
[  359.046330][ T8329]  ? copy_net_ns+0x5b0/0x5b0
[  359.051049][ T8329]  ? copy_net_ns+0x324/0x5b0
[  359.055674][ T8329]  ? down_read_killable+0x1ce/0x340
[  359.060922][ T8329]  copy_net_ns+0x33e/0x5b0
[  359.065391][ T8329]  create_new_namespaces+0x3ce/0x700
[  359.070734][ T8329]  unshare_nsproxy_namespaces+0x116/0x160
[  359.076502][ T8329]  ksys_unshare+0x4f6/0x8e0
[  359.081132][ T8329]  ? __lock_acquire+0x7b50/0x7b50
[  359.086221][ T8329]  ? sighand_ctor+0x40/0x40
[  359.090849][ T8329]  ? lock_chain_count+0x20/0x20
[  359.095742][ T8329]  ? syscall_enter_from_user_mode+0x21/0x70
[  359.101695][ T8329]  __x64_sys_unshare+0x34/0x40
[  359.106514][ T8329]  do_syscall_64+0x4c/0xa0
[  359.110971][ T8329]  ? clear_bhb_loop+0x30/0x80
[  359.115775][ T8329]  ? clear_bhb_loop+0x30/0x80
[  359.120506][ T8329]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  359.126487][ T8329] RIP: 0033:0x7f162f1a4159
[  359.131205][ T8329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  359.151159][ T8329] RSP: 002b:00007f162d3fc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
[  359.159750][ T8329] RAX: ffffffffffffffda RBX: 00007f162f42bfa0 RCX: 00007f162f1a4159
[  359.167776][ T8329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062000000
[  359.175799][ T8329] RBP: 00007f162f23b03b R08: 0000000000000000 R09: 0000000000000000
[  359.183828][ T8329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  359.191961][ T8329] R13: 00007f162f42c038 R14: 00007f162f42bfa0 R15: 00007ffc6939e5a8
[  359.200077][ T8329]  </TASK>
[  359.251481][ T8332] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1191'.
[  359.480987][ T8342] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue
[  359.546507][ T8346] overlayfs: failed to set xattr on upper
[  359.572272][ T8346] overlayfs: ...falling back to index=off,metacopy=off.
[  360.515567][ T8360] netlink: 'syz.4.1202': attribute type 1 has an invalid length.
[  360.621025][ T8360] 8021q: adding VLAN 0 to HW filter on device bond1
[  360.768748][ T8372] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1204'.
[  360.794122][ T8371] device syzkaller1 entered promiscuous mode
[  361.299566][ T8384] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1208'.
[  361.828101][ T8395] loop6: detected capacity change from 0 to 1024
[  362.693063][ T8395] loop6: detected capacity change from 0 to 1024
[  362.848658][ T8411] tipc: Started in network mode
[  362.877949][ T8411] tipc: Node identity 4, cluster identity 4711
[  362.901511][ T8411] tipc: Node number set to 4
[  362.936384][ T8411] tipc: Enabled bearer <eth:syz_tun>, priority 0
[  362.994715][ T8411] tipc: Resetting bearer <eth:syz_tun>
[  363.063001][ T8411] tipc: Disabling bearer <eth:syz_tun>
[  363.866491][ T8427] netlink: 168 bytes leftover after parsing attributes in process `syz.5.1220'.
[  364.003142][ T8431] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1222'.
[  364.337230][   T26] audit: type=1326 audit(1789142760.868:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8443 comm="syz.5.1227" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20d4975159 code=0x7fc00000
[  364.422228][   T26] audit: type=1326 audit(1789142760.898:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8443 comm="syz.5.1227" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f20d4975159 code=0x7fc00000
[  365.470659][ T8470] o2cb: This node has not been configured.
[  365.484662][ T8470] o2cb: Cluster check failed. Fix errors before retrying.
[  365.499698][ T8470] (syz.6.1237,8470,0):user_dlm_register:675 ERROR: status = -22
[  365.520837][ T8470] (syz.6.1237,8470,0):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "domain1"
[  366.018545][ T8480] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer.
[  366.403709][ T8500] usb usb8: usbfs: interface 0 claimed by hub while 'syz.5.1245' resets device
[  367.376740][ T8518] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1249'.
[  367.452529][ T8518] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1249'.
[  367.487691][ T8517] CIFS: Attempting to mount \\127.0.0.1\share
[  367.617440][ T8517] CIFS: VFS: challenge blob len 0 too small
[  367.677495][ T8517] CIFS: VFS: \\127.0.0.1 Send error in SessSetup = -22
[  367.742137][ T8529] o2cb: This node has not been configured.
[  367.749920][ T8517] CIFS: VFS: cifs_mount failed w/return code = -22
[  367.756761][ T8529] o2cb: Cluster check failed. Fix errors before retrying.
[  367.792512][ T8529] (syz.0.1252,8529,1):user_dlm_register:675 ERROR: status = -22
[  367.845256][ T8529] (syz.0.1252,8529,1):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "domain1"
[  368.011330][ T8540] overlayfs: failed to set xattr on upper
[  368.042709][ T8540] overlayfs: ...falling back to index=off,metacopy=off.
[  368.312284][ T8548] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  368.479646][ T8548] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  368.495605][ T8555] CIFS: Attempting to mount \\127.0.0.1\share
[  368.614726][ T8548] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  369.294080][ T8555] CIFS: VFS: cifs_mount failed w/return code = -512
[  369.520739][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  369.586139][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  369.616851][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  369.632376][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  369.653861][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  369.715427][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  369.760382][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  369.774761][ T8588] CIFS: Attempting to mount \\127.0.0.1\share
[  369.792351][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  369.822368][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  369.837606][ T8588] CIFS: VFS: challenge blob len 0 too small
[  369.847268][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  369.859305][ T8588] CIFS: VFS: \\127.0.0.1 Send error in SessSetup = -22
[  369.878916][ T8588] CIFS: VFS: cifs_mount failed w/return code = -22
[  369.879342][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  369.925658][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  369.953452][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  369.975079][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  369.998173][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  370.032235][ T4243] usb 1-1: new full-speed USB device number 8 using dummy_hcd
[  370.042937][ T8595] overlayfs: failed to clone upperpath
[  370.051094][ T8597] netlink: 'syz.6.1272': attribute type 2 has an invalid length.
[  370.053002][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  370.074003][ T8597] netlink: 212408 bytes leftover after parsing attributes in process `syz.6.1272'.
[  370.088080][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  370.102910][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  370.121203][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  370.132823][ T8548] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  370.150538][ T8548] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  370.432440][ T4243] usb 1-1: unable to get BOS descriptor or descriptor too short
[  370.472555][ T4243] usb 1-1: not running at top speed; connect to a high speed hub
[  370.636408][ T4243] usb 1-1: config 1 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  370.702455][ T4243] usb 1-1: config 1 interface 0 has no altsetting 0
[  370.872630][ T4243] usb 1-1: New USB device found, idVendor=05ac, idProduct=030a, bcdDevice= 0.40
[  370.958973][ T4243] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  371.114949][ T4243] usb 1-1: Product: syz
[  371.206560][ T4243] usb 1-1: Manufacturer: syz
[  371.293988][ T4243] usb 1-1: SerialNumber: syz
[  371.664997][ T4243] input: appletouch as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input13
[  371.757813][ T4243] usb 1-1: USB disconnect, device number 8
[  371.772163][    C1] appletouch 1-1:1.0: atp_complete: usb_submit_urb failed with result -19
[  371.961678][ T4243] appletouch 1-1:1.0: input: appletouch disconnected
[  372.194589][ T8641] o2cb: This node has not been configured.
[  372.219561][ T8641] o2cb: Cluster check failed. Fix errors before retrying.
[  372.235747][ T8641] (syz.6.1281,8641,1):user_dlm_register:675 ERROR: status = -22
[  372.272200][ T8641] (syz.6.1281,8641,1):dlmfs_mkdir:430 ERROR: Error -22 could not register domain "domain1"
[  372.288078][ T8643] loop0: detected capacity change from 0 to 512
[  372.418827][ T8643] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[  372.442529][ T8608] bridge0: port 2(bridge_slave_1) entered disabled state
[  372.450392][ T8608] bridge0: port 1(bridge_slave_0) entered disabled state
[  372.551739][ T8643] EXT4-fs (loop0): 1 truncate cleaned up
[  372.562165][ T8643] EXT4-fs (loop0): mounted filesystem without journal. Opts: dioread_lock,nombcache,max_batch_time=0x0000000000000006,nouid32,noinit_itable,auto_da_alloc,,errors=continue. Quota mode: none.
[  372.806010][ T8649] loop6: detected capacity change from 0 to 1024
[  372.933565][ T8649] EXT4-fs (loop6): mounted filesystem without journal. Opts: user_xattr,noquota,barrier=0x0000000000000002,jqfmt=vfsv1,block_validity,max_dir_size_kb=0x00000000000007b1,stripe=0x0000000000000020,bsdgroups,max_batch_time=0x0000000000000000,user_xattr,quota,,errors=continue. Quota mode: writeback.
[  373.029619][ T8649] FAULT_INJECTION: forcing a failure.
[  373.029619][ T8649] name failslab, interval 1, probability 0, space 0, times 0
[  373.123481][ T8649] CPU: 1 PID: 8649 Comm: syz.6.1284 Not tainted syzkaller #0
[  373.131295][ T8649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  373.141692][ T8649] Call Trace:
[  373.145067][ T8649]  <TASK>
[  373.148168][ T8649]  dump_stack_lvl+0x188/0x250
[  373.153092][ T8649]  ? show_regs_print_info+0x20/0x20
[  373.158361][ T8649]  ? load_image+0x410/0x410
[  373.163027][ T8649]  ? __might_sleep+0xf0/0xf0
[  373.167663][ T8649]  ? __lock_acquire+0x7b50/0x7b50
[  373.173893][ T8649]  ? lockdep_hardirqs_on_prepare+0x448/0x7c0
[  373.180290][ T8649]  should_fail+0x383/0x4b0
[  373.184786][ T8649]  should_failslab+0x5/0x20
[  373.189370][ T8649]  slab_pre_alloc_hook+0x51/0xc0
[  373.194372][ T8649]  __kmalloc+0x6b/0x340
[  373.198583][ T8649]  ? ext4_find_extent+0x372/0xde0
[  373.203773][ T8649]  ext4_find_extent+0x372/0xde0
[  373.208706][ T8649]  ext4_ext_map_blocks+0x283/0x63d0
[  373.214156][ T8649]  ? verify_lock_unused+0x140/0x140
[  373.219480][ T8649]  ? mark_lock+0x94/0x320
[  373.223910][ T8649]  ? ext4_ext_release+0x10/0x10
[  373.228827][ T8649]  ? rwsem_write_trylock+0x135/0x1c0
[  373.234309][ T8649]  ext4_map_blocks+0x97f/0x1a50
[  373.239312][ T8649]  ? ext4_issue_zeroout+0x250/0x250
[  373.244591][ T8649]  _ext4_get_block+0x1e7/0x540
[  373.249937][ T8649]  ? ext4_get_block+0x40/0x40
[  373.254679][ T8649]  ? create_page_buffers+0x238/0x320
[  373.260108][ T8649]  __block_write_begin_int+0x565/0x15d0
[  373.265737][ T8649]  ? ext4_es_is_delayed+0x40/0x40
[  373.270844][ T8649]  ? page_zero_new_buffers+0x490/0x490
[  373.276368][ T8649]  ext4_try_to_write_inline_data+0x86f/0x1520
[  373.282803][ T8649]  ? zero_user_segment+0x460/0x460
[  373.287986][ T8649]  ? ext4_inode_journal_mode+0x189/0x460
[  373.293754][ T8649]  ? ext4_writepage_trans_blocks+0x270/0x310
[  373.299794][ T8649]  ? ext4_writepage_trans_blocks+0x297/0x310
[  373.305916][ T8649]  ext4_write_begin+0x26e/0x15d0
[  373.310918][ T8649]  ? ext4_mark_iloc_dirty+0x1ed7/0x42b0
[  373.316646][ T8649]  ? __ext4_handle_dirty_metadata+0x2dd/0x7e0
[  373.322817][ T8649]  ? ext4_readahead+0x110/0x110
[  373.327747][ T8649]  ext4_da_write_begin+0x442/0xb20
[  373.333035][ T8649]  ? __ext4_mark_inode_dirty+0x4b4/0x6c0
[  373.338734][ T8649]  ? ext4_set_page_dirty+0x320/0x320
[  373.344265][ T8649]  generic_perform_write+0x2b6/0x550
[  373.349647][ T8649]  ? grab_cache_page_write_begin+0xa0/0xa0
[  373.355593][ T8649]  ? rwsem_write_trylock+0x135/0x1c0
[  373.361033][ T8649]  ? clear_nonspinnable+0x60/0x60
[  373.366123][ T8649]  ? ext4_write_checks+0x246/0x2c0
[  373.371290][ T8649]  ext4_buffered_write_iter+0x24e/0x3a0
[  373.376898][ T8649]  ext4_file_write_iter+0x73f/0x1720
[  373.382252][ T8649]  ? rcu_read_lock_any_held+0xb0/0x130
[  373.387873][ T8649]  ? ext4_file_read_iter+0x6f0/0x6f0
[  373.393219][ T8649]  ? end_current_label_crit_section+0x14b/0x170
[  373.399565][ T8649]  ? memset+0x1e/0x40
[  373.403596][ T8649]  ? iov_iter_init+0xb4/0x170
[  373.408322][ T8649]  vfs_write+0x748/0xd70
[  373.412708][ T8649]  ? file_end_write+0x250/0x250
[  373.417612][ T8649]  ? __fget_files+0x402/0x470
[  373.422347][ T8649]  ? __fdget+0x18b/0x210
[  373.426630][ T8649]  ? __x64_sys_pwrite64+0xf3/0x220
[  373.431785][ T8649]  __x64_sys_pwrite64+0x197/0x220
[  373.436870][ T8649]  ? ksys_pwrite64+0x1c0/0x1c0
[  373.441684][ T8649]  ? lockdep_hardirqs_on+0x94/0x140
[  373.447105][ T8649]  do_syscall_64+0x4c/0xa0
[  373.451566][ T8649]  ? clear_bhb_loop+0x30/0x80
[  373.456276][ T8649]  ? clear_bhb_loop+0x30/0x80
[  373.460989][ T8649]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  373.466924][ T8649] RIP: 0033:0x7fb1b6668159
[  373.471383][ T8649] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  373.491115][ T8649] RSP: 002b:00007fb1b48c0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
[  373.499566][ T8649] RAX: ffffffffffffffda RBX: 00007fb1b68effa0 RCX: 00007fb1b6668159
[  373.507573][ T8649] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000004
[  373.515584][ T8649] RBP: 00007fb1b66ff03b R08: 0000000000000000 R09: 0000000000000000
[  373.523673][ T8649] R10: 0000000000000e7c R11: 0000000000000246 R12: 0000000000000000
[  373.531695][ T8649] R13: 00007fb1b68f0038 R14: 00007fb1b68effa0 R15: 00007ffd10c18f18
[  373.539862][ T8649]  </TASK>
[  373.832940][ T8657] EXT4-fs (sda1): shut down requested (1)
[  373.895575][ T8657] Aborting journal on device sda1-8.
[  374.357745][ T8608] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  374.466961][ T8608] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  374.983229][ T8674] loop0: detected capacity change from 0 to 128
[  375.392516][ T8608] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  375.401493][ T8608] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  375.411110][ T8608] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  375.420487][ T8608] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  375.716407][ T8661] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
[  375.759739][ T8661] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  375.791607][ T8661] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  375.871484][ T8661] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  375.902331][ T8661] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  375.928497][ T8661] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  375.940647][ T8661] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  375.951280][ T8661] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  375.970919][ T8661] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  375.986537][ T8661] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  376.008192][ T8661] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  376.030558][ T8661] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  376.092837][ T8661] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  376.103918][ T8661] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  376.115592][ T8661] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  376.126282][ T8661] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  376.137280][ T8661] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  376.151691][ T8661] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  376.191188][ T8661] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  376.321587][ T8676] netlink: 'syz.0.1291': attribute type 39 has an invalid length.
[  376.599709][ T8705] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1302'.
[  376.847317][ T8718] loop5: detected capacity change from 0 to 256
[  376.874314][ T8714] loop0: detected capacity change from 0 to 4096
[  376.935066][ T8718] exFAT-fs (loop5): failed to load upcase table (idx : 0x00011e7e, chksum : 0x06bedb5d, utbl_chksum : 0xe619d30d)
[  377.004369][ T8714] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback.
[  377.541186][ T8735] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  377.597380][ T8735] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  377.668380][ T8735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  377.679090][ T8735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  377.689613][ T8735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  377.704315][ T8735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  377.714807][ T8735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  377.736044][ T8735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  377.750999][ T8735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  377.772605][ T8735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  377.824311][ T8735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  377.857354][ T8735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  377.903483][ T8735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  377.946588][ T8735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  377.969402][ T8735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  378.001831][ T8735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  378.045764][ T8735] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  378.075082][ T8735] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  378.165975][ T8739] svc: failed to register nfsdv3 RPC service (errno 111).
[  378.195558][ T8739] svc: failed to register nfsaclv3 RPC service (errno 111).
[  378.314548][ T8744] md: md0 stopped.
[  378.563112][ T8754] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1320'.
[  378.595513][ T1421] ieee802154 phy0 wpan0: encryption failed: -22
[  378.601901][ T1421] ieee802154 phy1 wpan1: encryption failed: -22
[  378.645382][ T8755] kvm: pic: non byte write
[  379.400863][ T8754] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  379.443443][ T4188] ==================================================================
[  379.452305][ T4188] BUG: KASAN: use-after-free in nfsd_shutdown_threads+0x89/0x1a0
[  379.460430][ T4188] Write of size 4 at addr ffff88805fe89450 by task syz-executor/4188
[  379.468807][ T4188] 
[  379.471209][ T4188] CPU: 1 PID: 4188 Comm: syz-executor Not tainted syzkaller #0
[  379.478940][ T4188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  379.489319][ T4188] Call Trace:
[  379.492870][ T4188]  <TASK>
[  379.495850][ T4188]  dump_stack_lvl+0x188/0x250
[  379.500643][ T4188]  ? show_regs_print_info+0x20/0x20
[  379.506113][ T4188]  ? load_image+0x410/0x410
[  379.510759][ T4188]  ? _raw_spin_lock_irqsave+0xbc/0x100
[  379.516282][ T4188]  ? rcu_lock_release+0x5/0x20
[  379.521099][ T4188]  print_address_description+0x60/0x2d0
[  379.526692][ T4188]  ? nfsd_shutdown_threads+0x89/0x1a0
[  379.532268][ T4188]  kasan_report+0xdf/0x130
[  379.536885][ T4188]  ? nfsd_shutdown_threads+0x89/0x1a0
[  379.542495][ T4188]  kasan_check_range+0x235/0x290
[  379.547488][ T4188]  nfsd_shutdown_threads+0x89/0x1a0
[  379.553175][ T4188]  nfsd_umount+0x3e/0xc0
[  379.557468][ T4188]  deactivate_locked_super+0x93/0xf0
[  379.562841][ T4188]  cleanup_mnt+0x426/0x4d0
[  379.567324][ T4188]  task_work_run+0x125/0x1a0
[  379.572462][ T4188]  exit_to_user_mode_loop+0x10f/0x130
[  379.577981][ T4188]  exit_to_user_mode_prepare+0xee/0x180
[  379.583628][ T4188]  syscall_exit_to_user_mode+0x16/0x40
[  379.589143][ T4188]  do_syscall_64+0x58/0xa0
[  379.594077][ T4188]  ? clear_bhb_loop+0x30/0x80
[  379.598812][ T4188]  ? clear_bhb_loop+0x30/0x80
[  379.603531][ T4188]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  379.609476][ T4188] RIP: 0033:0x7f162f1a5397
[  379.613946][ T4188] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
[  379.634251][ T4188] RSP: 002b:00007ffc6939d818 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  379.642816][ T4188] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f162f1a5397
[  379.650847][ T4188] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc6939d8d0
[  379.659091][ T4188] RBP: 00007ffc6939d8d0 R08: 00007ffc6939e8d0 R09: 00000000ffffffff
[  379.667123][ T4188] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc6939e960
[  379.675318][ T4188] R13: 00007f162f23a48b R14: 000000000005c787 R15: 00007ffc6939e9a0
[  379.683484][ T4188]  </TASK>
[  379.686552][ T4188] 
[  379.688986][ T4188] Allocated by task 8739:
[  379.693470][ T4188]  __kasan_kmalloc+0xaf/0xe0
[  379.698109][ T4188]  __svc_create+0x60/0x9d0
[  379.702620][ T4188]  svc_create_pooled+0x62f/0x810
[  379.707583][ T4188]  nfsd_create_serv+0x2f9/0x700
[  379.712451][ T4188]  nfsd_svc+0x132/0x9e0
[  379.716624][ T4188]  write_threads+0x2ea/0x350
[  379.721375][ T4188]  nfsctl_transaction_write+0x105/0x150
[  379.726979][ T4188]  vfs_write+0x304/0xd70
[  379.731261][ T4188]  ksys_write+0x153/0x260
[  379.735611][ T4188]  do_syscall_64+0x4c/0xa0
[  379.740052][ T4188]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  379.745968][ T4188] 
[  379.748393][ T4188] Freed by task 8739:
[  379.752390][ T4188]  kasan_set_track+0x4b/0x70
[  379.757000][ T4188]  kasan_set_free_info+0x1f/0x40
[  379.761962][ T4188]  ____kasan_slab_free+0xd5/0x110
[  379.767005][ T4188]  slab_free_freelist_hook+0xec/0x170
[  379.772489][ T4188]  kfree+0xef/0x2a0
[  379.776316][ T4188]  nfsd_svc+0x7cf/0x9e0
[  379.780575][ T4188]  write_threads+0x2ea/0x350
[  379.785187][ T4188]  nfsctl_transaction_write+0x105/0x150
[  379.790854][ T4188]  vfs_write+0x304/0xd70
[  379.795115][ T4188]  ksys_write+0x153/0x260
[  379.799466][ T4188]  do_syscall_64+0x4c/0xa0
[  379.803898][ T4188]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  379.809816][ T4188] 
[  379.812159][ T4188] The buggy address belongs to the object at ffff88805fe89400
[  379.812159][ T4188]  which belongs to the cache kmalloc-512 of size 512
[  379.826228][ T4188] The buggy address is located 80 bytes inside of
[  379.826228][ T4188]  512-byte region [ffff88805fe89400, ffff88805fe89600)
[  379.840448][ T4188] The buggy address belongs to the page:
[  379.846111][ T4188] page:ffffea00017fa200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5fe88
[  379.856289][ T4188] head:ffffea00017fa200 order:2 compound_mapcount:0 compound_pincount:0
[  379.864632][ T4188] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[  379.872641][ T4188] raw: 00fff00000010200 ffffea0001834500 0000000300000003 ffff888016c41c80
[  379.881246][ T4188] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[  379.890010][ T4188] page dumped because: kasan: bad access detected
[  379.896596][ T4188] page_owner tracks the page as allocated
[  379.902335][ T4188] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4186, ts 69861200088, free_ts 24519206903
[  379.921678][ T4188]  get_page_from_freelist+0x24f6/0x2670
[  379.927273][ T4188]  __alloc_pages+0x1ee/0x480
[  379.931883][ T4188]  new_slab+0xc0/0x4b0
[  379.935980][ T4188]  ___slab_alloc+0x807/0xdd0
[  379.940591][ T4188]  __kmalloc_node_track_caller+0x13d/0x3a0
[  379.946413][ T4188]  __alloc_skb+0x22c/0x750
[  379.950856][ T4188]  netlink_ack+0x35c/0xb10
[  379.955496][ T4188]  netlink_rcv_skb+0x267/0x430
[  379.960291][ T4188]  netlink_unicast+0x78f/0x940
[  379.965069][ T4188]  netlink_sendmsg+0x8ba/0xbe0
[  379.969949][ T4188]  __sys_sendto+0x46d/0x620
[  379.974471][ T4188]  __x64_sys_sendto+0xda/0xf0
[  379.979282][ T4188]  do_syscall_64+0x4c/0xa0
[  379.983723][ T4188]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  379.989656][ T4188] page last free stack trace:
[  379.994342][ T4188]  free_unref_page_prepare+0x637/0x6c0
[  379.999829][ T4188]  free_unref_page+0x8f/0x2a0
[  380.004558][ T4188]  free_contig_range+0x96/0xf0
[  380.009347][ T4188]  destroy_args+0xef/0xa00
[  380.013953][ T4188]  debug_vm_pgtable+0x321/0x380
[  380.018937][ T4188]  do_one_initcall+0x272/0x730
[  380.023995][ T4188]  do_initcall_level+0x13d/0x1f0
[  380.028982][ T4188]  do_initcalls+0x4b/0x90
[  380.033412][ T4188]  kernel_init_freeable+0x3d5/0x560
[  380.038625][ T4188]  kernel_init+0x19/0x1b0
[  380.043066][ T4188]  ret_from_fork+0x1f/0x30
[  380.047500][ T4188] 
[  380.049839][ T4188] Memory state around the buggy address:
[  380.055479][ T4188]  ffff88805fe89300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  380.063710][ T4188]  ffff88805fe89380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  380.071818][ T4188] >ffff88805fe89400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  380.079917][ T4188]                                                  ^
[  380.086622][ T4188]  ffff88805fe89480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  380.094733][ T4188]  ffff88805fe89500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  380.102825][ T4188] ==================================================================
[  380.111029][ T4188] Disabling lock debugging due to kernel taint
[  380.164517][ T8754] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  380.170351][ T4188] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  380.180632][ T4188] CPU: 1 PID: 4188 Comm: syz-executor Tainted: G    B             syzkaller #0
[  380.189618][ T4188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  380.199721][ T4188] Call Trace:
[  380.203288][ T4188]  <TASK>
[  380.206259][ T4188]  dump_stack_lvl+0x188/0x250
[  380.210987][ T4188]  ? show_regs_print_info+0x20/0x20
[  380.216332][ T4188]  ? load_image+0x410/0x410
[  380.220933][ T4188]  panic+0x2f8/0x850
[  380.224888][ T4188]  ? bpf_jit_dump+0xd0/0xd0
[  380.229422][ T4188]  ? _raw_spin_unlock_irqrestore+0x10d/0x120
[  380.235426][ T4188]  ? _raw_spin_unlock+0x40/0x40
[  380.240292][ T4188]  ? nfsd_shutdown_threads+0x89/0x1a0
[  380.245701][ T4188]  check_panic_on_warn+0x80/0xa0
[  380.250679][ T4188]  ? nfsd_shutdown_threads+0x89/0x1a0
[  380.256074][ T4188]  end_report+0x6d/0xf0
[  380.260258][ T4188]  kasan_report+0x102/0x130
[  380.264775][ T4188]  ? nfsd_shutdown_threads+0x89/0x1a0
[  380.270163][ T4188]  kasan_check_range+0x235/0x290
[  380.275126][ T4188]  nfsd_shutdown_threads+0x89/0x1a0
[  380.280357][ T4188]  nfsd_umount+0x3e/0xc0
[  380.284724][ T4188]  deactivate_locked_super+0x93/0xf0
[  380.290026][ T4188]  cleanup_mnt+0x426/0x4d0
[  380.294609][ T4188]  task_work_run+0x125/0x1a0
[  380.299236][ T4188]  exit_to_user_mode_loop+0x10f/0x130
[  380.304622][ T4188]  exit_to_user_mode_prepare+0xee/0x180
[  380.310186][ T4188]  syscall_exit_to_user_mode+0x16/0x40
[  380.315721][ T4188]  do_syscall_64+0x58/0xa0
[  380.320156][ T4188]  ? clear_bhb_loop+0x30/0x80
[  380.324878][ T4188]  ? clear_bhb_loop+0x30/0x80
[  380.329632][ T4188]  entry_SYSCALL_64_after_hwframe+0x66/0xd0
[  380.335571][ T4188] RIP: 0033:0x7f162f1a5397
[  380.340105][ T4188] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
[  380.360257][ T4188] RSP: 002b:00007ffc6939d818 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  380.369149][ T4188] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f162f1a5397
[  380.377294][ T4188] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc6939d8d0
[  380.385469][ T4188] RBP: 00007ffc6939d8d0 R08: 00007ffc6939e8d0 R09: 00000000ffffffff
[  380.393850][ T4188] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc6939e960
[  380.401838][ T4188] R13: 00007f162f23a48b R14: 000000000005c787 R15: 00007ffc6939e9a0
[  380.409911][ T4188]  </TASK>
[  380.413302][ T4188] Kernel Offset: disabled
[  380.417733][ T4188] Rebooting in 86400 seconds..