Extracting prog: 55m47.811105539s Minimizing prog: 1h38m2.146935157s Simplifying prog options: 0s Extracting C: 33.376033486s Simplifying C: 9m23.966448934s extracting reproducer from 59 programs testing a last program of every proc single: executing 14 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-socket$nl_generic-syz_usb_connect$hid-syz_genetlink_get_family_id$tipc-syz_open_dev$midi-syz_open_procfs-socket$nl_route-sendmsg$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_team-sendmsg$nl_route-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER detailed listing: executing program 0: socket$packet(0x11, 0x2, 0x300) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) syz_open_dev$midi(&(0x7f00000001c0), 0x2, 0x40c01) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}, 0x1, 0x0, 0x0, 0x500}, 0x0) (fail_nth: 1) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$tipc(0x0, r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x20042000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-socket$nl_generic-syz_usb_connect$hid-syz_genetlink_get_family_id$tipc-syz_open_dev$midi-syz_open_procfs-socket$nl_route-sendmsg$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_team-sendmsg$nl_route-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER detailed listing: executing program 0: socket$packet(0x11, 0x2, 0x300) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) syz_open_dev$midi(&(0x7f00000001c0), 0x2, 0x40c01) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}, 0x1, 0x0, 0x0, 0x500}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$tipc(0x0, r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x20042000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-socket$nl_generic-removexattr-syz_usb_connect$hid-syz_genetlink_get_family_id$tipc-syz_open_dev$midi-syz_open_procfs-syz_usb_connect$uac2-socket$nl_route-sendmsg$nl_route-setsockopt$inet_tcp_TCP_REPAIR_WINDOW-bpf$MAP_CREATE-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_team-sendmsg$nl_route-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER detailed listing: executing program 0: socket$packet(0x11, 0x2, 0x300) socket$nl_generic(0x10, 0x3, 0x10) removexattr(&(0x7f00000002c0)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000000)=@known='security.apparmor\x00') syz_usb_connect$hid(0x2, 0x36, 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) syz_open_dev$midi(&(0x7f00000001c0), 0x2, 0x40c01) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') syz_usb_connect$uac2(0x5, 0xa0, &(0x7f0000000280)=ANY=[@ANYBLOB="12011003000000408616dd0040000102030109028e00030105b309080b00010107208c0904000000010120000924010040041500070c2403020703000400070081090401000001022000090401010101022000090501090002030b04082501000040060009040200000102200009040201010102200009240201006f0e04011024010201000400000008b80000e0020905820908"], &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}, 0x1, 0x0, 0x0, 0x500}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x8, 0x5, 0x2, 0x3ff, 0x3}, 0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xffffffff, 0x0, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x50) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000c000}, 0x0) syz_genetlink_get_family_id$tipc(0x0, r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, 0x0, 0x20046001) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$btrfs-sendmsg$TIPC_NL_MEDIA_GET-mmap-prlimit64-getsockopt$sock_cred-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-socket$inet_udp-setsockopt$IPT_SO_SET_REPLACE-socket$nl_generic-sendmsg$NL80211_CMD_SET_TID_CONFIG-getpgid-sched_setscheduler-wait4 detailed listing: executing program 0: syz_mount_image$btrfs(&(0x7f00000003c0), &(0x7f0000005600)='./bus\x00', 0x21c8814, &(0x7f0000000000)={[{@inode_cache}, {@rescue={'rescue', 0x3d, 'nologreplay'}}, {@thread_pool={'thread_pool', 0x3d, 0x7f}}, {@datasum}, {@ref_verify}, {@inode_cache}, {@check_int_print_mask={'check_int_print_mask', 0x3d, 0x9}}]}, 0x1, 0x55b4, &(0x7f0000005640)="$eJzs3X1sVWcdB/Bze7kUaNKXKctQF+Y/OEGkYmIRghZpJzAYHWgyDIzigA1hUJogbGzaMadzZNIwx1jxhYFUwNjVlxUTM0QXMc7JZHHYMCIvWURcYIURlWQ603vvudx7Lm3vcK5z+3xIe+5zf+d5znNPzh/3e+lzbgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBEBxcsfBv636w4psPXXdy6sb7zzxwou65xzdNunvu7rGHH1h1Zefp1tbEq8+fvWHxfQ9XjTixZ8GhIIgl+8XS/ed/asqsxbPnzxgUDlh/Y2pbXt7TIVNdj6UaAxNBznhBee7PgiAIEpEB4ultbUlWOxY9QNCYP2CvtleNX1WxsWb65uIpQxfFG1ryXzrdBvX3BPpL+rp68eK1VJ38XRTZI9POuvRiOZdoqn/0gntTXgQA8LpU1iU3mbej6be4mXZTtB5pV0fazZF2+A6hObtxOVLjDuxpntdE6/00z+pUVCjucZ6Revr8Z9p10f6RdiRqvI555u6ajjSDeppnQ6TeX/MEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeCu5+/gtTxdt+tH7lq0fEz8+bOQvvtq65Xu1XWVTv7ZvQ+fvO557T2tr4tXnz96w+L6Hq0ac2LPgUBCUJ/vFUt1j83Z0bPjZyqmrfz730bZz771jVzw9brgdkLVz0Bk++HhZEHw+q/JiOOyp0iCoyy0km8Gj+YUlyQdTwwIAAABvJ8OSv4sy7VQcTOS0Y8k0GUv+C6XC4vaq8asqNtZM31w8ZeiieEPL5Y9X18N41ZccL9Muv/gTywrGYfyNjnexHu7amDdO76IjRvP82BEXDh/5+ooNa1tKTu4fXBGv/dWX64ddMXfcK9dOGH/bXx/ZkZf/y3vP/+GZk/8BAAD4b8j/0XF611f+H3nk/jN3nfrpuvrPbJt3fNI36kvfVbnmT20f/tz6kdNqBhy7ckte/r8m55B5+T+ccZj/i4LLy/8AAADwVva/zv/VeeP0rq/8v3zN6L9PvzC75omJF3545s7hvzx4JNjbNPoL7bd/YP+cIaXNP8nL/5WF5f8B2dMOn3wmnPDSsiCoLPykAgAAADnC/3e/+NFCmNdTnxxE8/rc8wdrb048ePYjc64dse3o8F1d5/+xdMWmC+PaZo6q+vTT5Rvy8n91Yfk/8ea8XAAAAKAATy35xE07gxm1H6q+5/D+hdsfaVq+tnFZS3Fs2r8bO6//V9vAvPxfV1j+L+6flwMAAABcwqEvbdv92qzlHaPais9v/cNrf3786lGrD7RWHm38bUViZUf9krz8X19Y/h+S3qZXPqQ67Q//CuGhsiAY1P2gIVX4TdD8yUwBAAAAeIOEOf2fxzrH7Lyu+NdPff/lzbO/8+2he78182DLdyeX3FLz4IGZB56sz8v/Db3f/z+800G4/j/n/n956/+zCqm7/k1wYwAAAADeifLX84e3x099c0FP379f6Pr/G7/Y8dLx2xd8pevdw29a/vJtV9z6sUmn/jjjzvjOiXcVTZv20um8/N9UWP6PZ2/fyO//AwAAgMvw//b9f3PyxuldX/f/n/XYPUe7/vLCxNGzWtYuPjlp44/nb3nmsd1VV59bePPgDz67bG9e/m8uLP+H25Lsl7cvPD/3lgXBVd0P0ncT3BVOd2mk0J7IKqROfKTH7LBHutBenFVIaoj0GFsWBO/vftAUKVSEheZIoas0XdgaKTwbFtLXQ6bQFinsC6+0TaXp6UYLe8JCeoFFe7iCoiSzJCLS45WeenQXLtnjhczBAQAA3lHC8JzOsoncZhCNsu2xvnYY0tcORX3tEO9rhwGRHaI79vR8UJ9bCJ8/v+aJ31V+tOizh269Y/KoMYvW3ds84UB83uTrn9wx+NzK0+NW5+X/rYXl//BUDExtelr/H4Tr/9Pfa5hZ/18fFsojhfawUBe9Y0BdeIxU2F0fHqO8Lt2j66pMAQAAAN7Wws8F4v08DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4D/s3XucVNWdIPDTTT9oaJoWEx8RY6trKzo0DYr6CT5QM9EAaxplZ8bFRyM0iLSCCBNxjYKa3SQORlGJOjMKqzCyioMvIKsJqBFNRKNxNDPqGIJRx93xoziin1lj3E/3rVNU3eqiCwFDO9/vH12n6neetx5d595b5wIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMB/DBsev/nov7vk6dGjNs4fsOK1o/77x/VHLF/83v/6/fM33LHf/O9vWL10aeXvX9x06uTv3nRU48ZVE14KoaWzXFlSvOysJSt/uPqib3774TNvuff9feYsq8rUm4mHvh1/yjN3ro6t/q5fCKvKQqhIBwbXJoHKzP3aWN/A2hB2C1sC2RJtfZIS6YbDEzUhLApbAtmqflwTQm1OYNyvHlszvyNxY00IB4UQqtNt/HN10kZNOtBYlQT6pAPTK5LAR58msoHV5UkAtq6EF0llOu+KlvwM9dtUdWXpndulpYfXKybqi+d754Sd3KkcVekHWrbraSuojs+uV/FQwdtjrXdbD3i3FWzn6zxtuV+kMt9QPt0Sqg7lk9omT5jdPis+Uh6amoq+M3bS8/zypssmbku6x7wOYwfqd8jr8MkLB969sHHMHrc+unHym1XPL9zebhbbvDtbdci85nrM8xiN9HnSA95+Bd+SGnzpCiHcedLmd3/3ytj/++uHnx38wbeGnjvkpdeG1t36ven9/nzK/6m8bdqmgvl//dbn//HlHG/L83LHVj+uS+bm8ZHamHi3LpmbAwAAQI/RE/aavjXi0Hdr1zc8esA3Vk6+YPH8N846/w9VP+s74dBTTh/6g7tunnZmwfy/obTj//GQf23uaNeGMLIzcVX/EPbqfDwJLIvdObd/CPt3plryAyekAmtD2LszMShbVapE71iiIRV4qy4TGJkKrIuBllRgSQxclwpcHQMrUoGJMbA2FTgxBsLU/HEcWpcZR8mBmhhoTTbiingWwr/VxdZS2+qVbFUAAAA7SGZ2WJl/N+dch+3NEKeXK2q6yxDPwC6aoTpVQ3oGm51WFa2horsayrurITvuuVsffkHNZd3VXHAaRll+hg8OeWDemof+6Sc3TzjymUM/bj371Q2rHx+9uddfvTfmJ5ePWzBsfMH8v3nr8//qLjpSVnD8P4SxnX9j7vJMpD0bb23JywAAAABsh4o3lp32y3mflC39+XmbDvrTM8dd23vlAQcMWHfYA/+v4e0BJ60+qGD+P7K08//jPpFeOZnD+rgbYlr/EJrzA0m1IwoDyVHvvpkAAAAA9ATZ4/HZY+FTM7fJKdrp+XRh/pZtzB8P/I/sMv/gcdeub15z5+lTRxyxdu3ms/d4dfnGZ7580HsvHXLaWSc/OK3hvoL5f0tp5//3yb9NOrEu9uKG/iH0zgk8GXvZEejUEAMbjs8PZMa/Lm6Aa2JVmRMTslVdE0u0xkBzKrCoWInnsiX2yg9knqxs41dlxzE1UyInAAAAAJ+7uDsgHpeP5/8/e36/x/92+W2XPbx0feg7ZcUvrzhu+MAFg3u/M/25wx/7y/dPm1Yw/2/dtvP/O+fBBaf3t/cNYUhFCL3SPwxY3ydZGDAGassyiZ/0Serqla7qyj4hjOgYWLqqjZn1/yvSawy+UJNUFQN7HXDXpsaOxJ01IQzJDbw0fvHwjsTsVCDb+J/VhLBfx2jTja/snTRemW785t4hfDUnkK1qYu8QOhqrSlf1eHXmOgbpqlZUh7B7TiBb1VHVIcwJAPRU8X/ppNwHL55z6bQJ7e1tM3diIu7ErwmTp7a3NU2c3j6pukifJqX6nLeO0bzCMZV66ZtXM2sU3TOqqX8p6ewPBZtz28rsyC84czBzP34Zquwc57DKvLuHp4d8yIGFTYScr1LFhly+k4fcJ7eSLU9iQf0xf1XoG3rPvrhtZtMlE2bNmjk0+Vtq9mHJ33icKdlWQ9Pbqk9XfSvh5bGVy2/k+azbqjG3kiGzLpgx5OI5lw6eesGEKW1T2i48cviRRx897Igjhg/pGFRz8rebkTZ2VXNqpJ8uLnFYO3CkX6nIqeTz+NCQkJDoaYnV/7L3q8d9edn3V962ZOYv2o9t+8U3dt99zNKqb720+fIrDnr2f3xUMP+fsfX5f/zUiR/8mfUZih3/r4+H+ZPHtxzmb42BRUWO/09JH/+vL3Y0P3tiQEMqMDcG5jrMDwAAwBdD3B0Z92bGndKPLdjzH+4e98CYBRsOe3r9C2Ub+hz21x//a3nlFeP+y/EPNdzxvb8omP/PLe33/zto/f/s0vWjii3zPyiWaC62/n96mf/s+v9zi63/n17mP7v+/6I/wvr/s7OB1Cb5N+v/AwAAXwSf3/r/3S7vn75AQEGGbpf3T18goCBDt8v4l3qBgG1e//+xhkNH/nTNd3/buPyi6e/9tyEPjB6wT8O/PLbv1ZOmjRw9esTgfyiY/19X2vzfwv0AAACw6zh44gnPbJq03wnX/s87dtv7p63f2ePIL/9g+TFtCzZvmPgXd7x/3p8XzP8XlTb///zX/wvFzv9vKBZoKbYwoPX/AAAA6KGKrf839OZvX/n6khMfvO/K6aNaW8fPueraA9ccXH1GeGX0goY/mXn/JwXz/xWlzf/jaRflebljbz6uS9a0C+k17d6ty/5kAAAAAHqG8tDUVFli3ryFUU/47G2+nFkKdGvpXE8/fOCLD31txCkLllRd+0bZnsM+febGWYed9PUfvb5p38vuOv+CAwvm/2tLm//n/S7jyQsH3r2wccweH9/66MbJb1Y9v3DL8X8AAABg5yl1vwQAAAAAAAAAAAAAAPDHd/KjP7323YlLvz530a/2+Fmvsc+v2Dh7btOc2htf/9H1vz767kfHFfz+P4ztLFfs9//xun/x9wVfyssdW+1+/b/M/XGj753TuWTh+roQDswNTLty2m4hc23+g3MDa84atGdH4sp0iUdeO/GNjsQ56cApgwd82JE4JhVojYsk7p0OxKsqftgvFYjLK76QDsTtsSIdqMoEvt8vGUdZelu9XZtsq7L0tnq5NoT+OYHstlpVm7RRlh7gjalAdoAXpQNxgKdmAuXpXt3bN+lVDNTGorf3TXoFAMAuK34LrAyTp7a3Ncev8PH2KxX5t1HekmXzCqstK7H5VzNLk90zqql/Kele6e+iW641XhmqO4YwtODram6Wss5R7phautl0Xyoy5O5WeysvUi5tWzddVfER1SQjapo4vX1SZbcDP7z7LMMqus0ytGCyk5ulvHOTllBLCX0pYUQlbpsSuhzvl4empl6pXF+LwfqQp7tXRKm/189d56/YqyA3z9Nvtz/z1N+/uGr/J//w7JSP/mzSdy6ff+7Z7x9zXvXf/OeyZ//rwN0L5v/1pc3/q3PH9WHmYgBz45X1RvQPobXEEQEAAMAX33kXvrbge49f/9aGlsY3pg+5fs0/zrn50oq6ZVf/6cuP/OXm8dees73xt39x1/6PTp7w3JfOP3z5yW/uf9gVjee888CfzB/38DV9b/vRgrt+WDD/byht/h/3YGUOBSd7O9bG6/9f1T+Ezkvr1yeBZXG45/YPYf/OVEsskVxQf1Qs0ZwElsUdJoNiidaW/Kp6x8CKVOCtukxgbSqwLgYyeynuCpldOdfXhTC8MzU2v8SMWKI+FfhWDDSkAk0x0JwK9IuBkanAv/bLBFpSgadjIEzN31YP9MtsKwAAgG2RmWdV5t8N6XneioruMpR1l6FPdxnKu8tQ3V2GYqOI9++PGSpTJ6+U5WSqTNdak6qlIEO8GP4296sgQ3guP2e6YEHT8fyD7PkGZfkZHjrta/dds3DyoPJff7JuWesHD05cefuc41ad98hfPTXpgMX33Lhfwfy/ubT5f5/826T1dXH+v+X6f0ngydi9G+Kp4w0xsOH4/EBmx8C6ONm9JltVS6ZEZtJ+TSwxMgYaUoEZMTAyFWgdmwks2jM/kJlpZxu/Ktv41EyJnAAAAAB87uIOgribJs7//33588c+UbH4nn98ffw998995777f3bffbffP/rOzd944apL37/kk4L5/8jS5v+xvb65jV0de/O7fiGsKtvSm2xgcG0SiPsxauPP4wfWhrBbzg6ObIm2PkmJqlTD4Yma5BfqVemqflyTrDEQ74/71WNr5nckbqwJ4aCcvS/ZNv65OmmjJh1orEoCfdKB6RVJIO75yQZWlycB2G7ZvYLxBZU51SWrvutyRV5/X5RrgqaHV7APtIt8Xf3mamepTj+Q2aeatW1PW0F17BQFb4+13m098d1W792W+0Uq8w3l0y2h6lA+qW3yhNnts+Ijub9kLbCTnufcX6mWkt4Br8O5n7233atOd6A59fHR3HW5rl+HZbG6Jy8cePfCxjF73ProxslvVj2/sORuFBF/KPxc1YD63M27s1WHzGuux32etPg86Yn/Bho8bSGEjZeffMPIqhlXrRp9+DH7vnHm6dWzPpj/1w++8tD7B/ztyonDvj6gYP7fUtr8vyJ12+nf48a8uH8Ih+Rs3PVx85/UP/kczAkkn5K7FwaSQ+6v1xX95AQAAIAdLbu7I7u/YGrmNjkhPD1PLszfso354/6KkV3mL7XfPx50+r4P7nnvuOvPOPaWv//t2H6bxr+89PiVrcc2Ljvu5//pnJr5BfP/1q3P/3unuun4v+P/7CSO/3dpV98V3Tv9wNzt2hVdUB07heP/XdrV322O/3fJ8X/H/7vi+H83HP/v0q7+tBV8S5rhS1cIYdiYswfX3jP4qQ8HrvnNU89M/ad5rRPu++Y1t+3z6Xfqlyys36Nvwfx/Rmnzf+v/db1oX3b9v9Zi6//NKLb+31zr/wEAADtVkYXm0vO8gtX7CjKkV+8ryNDtAoHdLjG4k9b/K8vfDfCFWv/viWOPGb9i9JLfrN1vzMFX9J0374wvP33Lyy2zPqy546MP9/zlIaMK5v9zS5v/x5dD39zWe8r6fw1ji1R1XQzMsDAgAAAAu6JiOwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD449rrphvGH99cfepvT7q8ZvQPHll/cPV1r51x+fIJt0/66p0XDpq9cunSyt+/uOnUyd+96ajGjasmvBTC1M5yZUnxsrOWrPzh6ou++e2Hz7zl3vf3mbOsOlNvZeZ2n7zcsdWP60JYlPNIbUy8W9dxZ0tg3Oh751R0JNbXhXBgbmDaldN260gsqQvh4NzAmrMG7dmRuDJd4pHXTnyjI3FOOnDK4AEfdiSOyQTK0t39m35Jd8vS3Z3fL4T+OYFsd8/vl19Vto2TM4HydBt/V5u0UV6VaSMWvbk2aSOWaI8lpvYOYUhFCL3SVf28OqkqBrJV/e/qpKpe6aquqA5hRAihIl3Vb6qSqirSI3+uKqkqBvY64K5NjR2JxVUhDMkNvDR+8fCOxMxUINv46VUh7Nfxkkk3/kBl0nhluvGbKkP4agihKl1ic0VSoipdYmNFCLvnBLZsxIoQ5gS+GOKnz6TcBy+ec+m0Ce3tbTN3YiLzpg01YfLU9ramidPbJ1Wn+lRMWU7603mffeyvbrpsYsftPaOa+peSrsiUq+zs8rDKvLuH7+q9j/3qk1vJluejoP6Yvyr0Db1nX9w2s+mSCbNmzRya/C01+7Dkb69MNNlWQ3vKtmrMrWTIrAtmDLl4zqWDp14wYUrblLYLjxx+5NFHDzviiOFDOgbVnPzdESNd/PmP9CsVOZV8Hu9/CQmJnpYoz/t0a96+z/HuSm3/p1vBF/0tTVaG6s4P6IJpRW6Wss5R7ohBn7DNY83a5q8p3Y5oaMHEoSDLsO6zHF4wmdiSpSbJ0vm1rmBymFtTeecmjffLQ1NTr2LboT7/bu7mfWc7Nu/LmU1XahoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/swIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCwAAAAAIMzfOoyeDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACASwEAAP//VositA==") sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16, @ANYBLOB="010027bd7000fedbdf250b0000000c00058007"], 0x20}, 0x1, 0x0, 0x0, 0x20004010}, 0x8000000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x6695f000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) sched_setscheduler(r0, 0x2, &(0x7f0000000440)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000003880)=@nat={'nat\x00', 0x62, 0x5, 0x1358, 0x0, 0x1218, 0xffffffff, 0x10c8, 0x10c8, 0x12c0, 0x12c0, 0xffffffff, 0x12c0, 0x12c0, 0x5, 0x0, {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x29}, 0x0, 0x0, 'veth0_to_bond\x00', 'wg1\x00', {0xff}}, 0x0, 0x10a0, 0x10c8, 0x0, {0x22e}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x0, './cgroup.net/syz0\x00', 0x9, {0x100000001}}}]}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x3, 0x6}}}, {{@uncond, 0x0, 0x70, 0xa8}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x3dc, {0xc, @rand_addr=0x64010102, @remote, @port=0x4e21, @gre_key}}}}, {{@ip={@rand_addr=0x64010101, @rand_addr=0x64010100, 0x0, 0x0, 'veth1_to_team\x00', 'syzkaller1\x00'}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @private, @multicast2, @gre_key, @icmp_id}}}}, {{@ip={@remote, @dev, 0x0, 0x0, 'pimreg1\x00', 'netdevsim0\x00'}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x13b8) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="01e723000000ffdbdf251500000024001d81"], 0x38}}, 0x0) r6 = getpgid(0x0) sched_setscheduler(r6, 0x5, &(0x7f00000000c0)=0x8) wait4(r6, &(0x7f0000000100), 0x8, &(0x7f0000000140)) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-dup2-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$DRM_IOCTL_WAIT_VBLANK-mmap$IORING_OFF_SQES-openat$comedi-openat$comedi-ioctl$COMEDI_DEVCONFIG-ioctl$KVM_CLEAR_DIRTY_LOG-ioctl$COMEDI_INSN-read$FUSE detailed listing: executing program 0: r0 = syz_open_dev$dri(0x0, 0x1, 0x0) r1 = dup2(r0, r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=ANY=[@ANYBLOB="3801000010000100feffffbf00010000ff020000000000000000000000000001ac1414aa000000000000000000000000000107944e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff0200000000000008000000000000010000000100000000000000000000000000000009000000000000000600000000000000ffff0000000000001c250800000020000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000ff0100000000000004000000fc04f4ba00000000000000000000000000480003006465666c61744600"/216], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f00000001c0)={0x14000000}) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x40400, 0x0) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f00000000c0)={'s526\x00', [0x100, 0x5, 0x2, 0xc, 0xe, 0x5, 0x79, 0x3, 0x80008, 0x0, 0x2, 0x1, 0x7, 0x1, 0x1, 0xfd, 0xfffffffb, 0x9, 0x3, 0x7fffffff, 0x89, 0xca9f, 0x0, 0x20001e58, 0xffffffff, 0xf39e, 0x6, 0x8, 0xa6b5, 0x0, 0xfffffff8]}) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f0000000740)={0x1ff, 0x3c0, 0x0, &(0x7f0000000340)=[0x52c, 0x1, 0x9, 0x1, 0x0, 0x9, 0x7, 0x1, 0x2, 0x1, 0x10000000000000, 0x0, 0x7f, 0x1, 0x100, 0x800, 0x9, 0x0, 0x7, 0x7ff, 0x401, 0xfffffffeffffffff, 0xff, 0x10001, 0x4, 0x10001, 0x80, 0x40000000000, 0x0, 0x8cc4, 0x7b25e607, 0xf5b, 0x7fff, 0x5, 0xc, 0x6, 0x60c, 0x1000, 0x5, 0x8001, 0x0, 0x4, 0xd, 0x3d4, 0x56a0, 0x5, 0xfffffffffffffffa, 0xffffffff, 0x4, 0x8, 0x9, 0x3, 0x9, 0x0, 0x4, 0xfffffffffffffffa, 0x1, 0x6, 0x9, 0x8000, 0x7fff, 0x1, 0x3, 0x9, 0x5, 0x4, 0x800, 0x7fff, 0xfabe, 0x8, 0x6, 0x0, 0x9, 0x7, 0x80000000, 0x100000001, 0xa532, 0x400, 0x0, 0x3, 0x3, 0x0, 0xc1e4, 0x7, 0x133, 0x9, 0x7, 0x7, 0x64, 0x5, 0xb8, 0x1, 0xbac9, 0x4, 0x1, 0x4, 0x2, 0x80000000, 0x80000001, 0x5e4, 0x49f, 0x7, 0x8, 0x2, 0x1, 0x2, 0x1, 0x3d21, 0x1, 0x3, 0x6a, 0x8, 0x8, 0xffffffffffffffff, 0xfffffffffffffff7, 0x10001, 0x400, 0xfffffffffffffffc, 0x3, 0x0, 0x7ff, 0x80000001, 0xe0f, 0x7, 0x80000001, 0xcb90, 0x10001, 0x4]}) ioctl$COMEDI_INSN(r6, 0x8028640c, &(0x7f0000022a00)={0x4000000, 0x92, 0x0, 0x0, 0x2}) read$FUSE(r1, &(0x7f0000002240)={0x2020}, 0x2020) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-dup2-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$DRM_IOCTL_WAIT_VBLANK-mmap$IORING_OFF_SQES-openat$comedi-openat$comedi-ioctl$COMEDI_DEVCONFIG-ioctl$KVM_CLEAR_DIRTY_LOG-ioctl$COMEDI_INSN-read$FUSE detailed listing: executing program 0: r0 = syz_open_dev$dri(0x0, 0x1, 0x0) r1 = dup2(r0, r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=ANY=[@ANYBLOB="3801000010000100feffffbf00010000ff020000000000000000000000000001ac1414aa000000000000000000000000000107944e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff0200000000000008000000000000010000000100000000000000000000000000000009000000000000000600000000000000ffff0000000000001c250800000020000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000ff0100000000000004000000fc04f4ba00000000000000000000000000480003006465666c61744600"/216], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f00000001c0)={0x14000000}) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x40400, 0x0) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f00000000c0)={'s526\x00', [0x100, 0x5, 0x2, 0xc, 0xe, 0x5, 0x79, 0x3, 0x80008, 0x0, 0x2, 0x1, 0x7, 0x1, 0x1, 0xfd, 0xfffffffb, 0x9, 0x3, 0x7fffffff, 0x89, 0xca9f, 0x0, 0x20001e58, 0xffffffff, 0xf39e, 0x6, 0x8, 0xa6b5, 0x0, 0xfffffff8]}) ioctl$KVM_CLEAR_DIRTY_LOG(r1, 0xc018aec0, &(0x7f0000000740)={0x1ff, 0x3c0, 0x0, &(0x7f0000000340)=[0x52c, 0x1, 0x9, 0x1, 0x0, 0x9, 0x7, 0x1, 0x2, 0x1, 0x10000000000000, 0x0, 0x7f, 0x1, 0x100, 0x800, 0x9, 0x0, 0x7, 0x7ff, 0x401, 0xfffffffeffffffff, 0xff, 0x10001, 0x4, 0x10001, 0x80, 0x40000000000, 0x0, 0x8cc4, 0x7b25e607, 0xf5b, 0x7fff, 0x5, 0xc, 0x6, 0x60c, 0x1000, 0x5, 0x8001, 0x0, 0x4, 0xd, 0x3d4, 0x56a0, 0x5, 0xfffffffffffffffa, 0xffffffff, 0x4, 0x8, 0x9, 0x3, 0x9, 0x0, 0x4, 0xfffffffffffffffa, 0x1, 0x6, 0x9, 0x8000, 0x7fff, 0x1, 0x3, 0x9, 0x5, 0x4, 0x800, 0x7fff, 0xfabe, 0x8, 0x6, 0x0, 0x9, 0x7, 0x80000000, 0x100000001, 0xa532, 0x400, 0x0, 0x3, 0x3, 0x0, 0xc1e4, 0x7, 0x133, 0x9, 0x7, 0x7, 0x64, 0x5, 0xb8, 0x1, 0xbac9, 0x4, 0x1, 0x4, 0x2, 0x80000000, 0x80000001, 0x5e4, 0x49f, 0x7, 0x8, 0x2, 0x1, 0x2, 0x1, 0x3d21, 0x1, 0x3, 0x6a, 0x8, 0x8, 0xffffffffffffffff, 0xfffffffffffffff7, 0x10001, 0x400, 0xfffffffffffffffc, 0x3, 0x0, 0x7ff, 0x80000001, 0xe0f, 0x7, 0x80000001, 0xcb90, 0x10001, 0x4]}) ioctl$COMEDI_INSN(r6, 0x8028640c, &(0x7f0000022a00)={0x4000000, 0x92, 0x0, 0x0, 0x2}) read$FUSE(r1, &(0x7f0000002240)={0x2020}, 0x2020) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$ttys-writev-syz_usb_control_io-socket$nl_route-sendmsg$nl_route_sched-syz_usb_control_io$hid-syz_usb_ep_write-getsockopt$sock_cred-openat$fuse-syz_mount_image$fuse-read$FUSE-openat-write$cgroup_int-syz_mount_image$ext4-mount-syz_open_procfs-pread64-socket$netlink detailed listing: executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) writev(r0, &(0x7f0000000100)=[{0x0}, {&(0x7f0000000140)="b9ce69c0e636f8bf086f9e1102fc43f61a9f4a92182435a9a90be7895f266093f8009696f9e36d506d23d5905c9cedcf754252a634505e99f07a778fd43dec6a295eb72741aaf136cfecb1f58713cbd5fee381463adb0faf5404390fd926a883429fc509af3bd8db50fd1864bda0546e4dab5500cd61e7fe588cb833ee7b5025ba4ba435d74e18cee281cf17a1b137d585b4a7c905648e3d4bfd8fbbd1de20ad7d5057844f436e032ab0b1b5e013381b373476d68ed15d2f4ed96846bd3aefe5c0805f1791f66ea21aa2567a17b2a06d3d227e9c53054a0cebb93862a46a3cda7b14a178e535ab1b9d7223fb9b07d60ff971db51ceffb47c0065ab25509dbfba42bc20b658f34df6239a1b8c61be0ea10ec9850d7ded648163c39389a94d044cf7f7a80f9c1f7f3aa33e84ac28f90ad6634c6f049df7f6431aff1346fe46326a6e04aaf68fb337483df79405dd3ad1eeb9a96753372a3b319d8d3f76eed7415e081d6d1188e66005585bc717b2b1cfa717018729a6a43cdc2aa4c4b9fc1d8763d8dbbf706af829dc89a61408f1a6d86067f2570e1c481ca8e4aeab3d90b38a56049b010a4cf04fd77acf3b7ad97126a5046d4d142be012055b0fd1c8867000812b0ae00aaf148214d7ee84f557cfbdbd36140977f5e06c205dc4846fe8620ed781d2222a9ae93e461f43ba8d36de6b064c9b321f36c20a57f268e673e55c520d134394ff7d47ae61e577c710fb8065162b1ebb4d714f76d2af0d4c90cd075d2b4f11c62c73ad365e53062c0bdfa55fd8c19ccb91dc0950b740dfd0c663f0ada07e6a6d2221476b4e75a8eeb56bde34222b4de7b2c57d9979cf27c3cb9f90cea2bc2cb9e70c0594fb17888d55c15d7553610461632c2731f31d7d9070c1be9858073e611b21a73ad3d60e12152720f217c075c98ee5ac4bd010d905adf86c1e6735a4dfc2388c996ed5cefea0d47d6480dd1767d709103d72e8907a403ed53462cb63957e8cdb14518b5235f162a4f9828e153b285fd2666f6bd2fdf631047bc7904f638b73", 0x2e5}, {}], 0x3) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000009b40)=@newtaction={0x7c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x68, 0x1, [@m_tunnel_key={0x64, 0x1, 0x0, 0x0, {{0xf}, {0x34, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x4, 0xb, @empty}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x7c}}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="00221200000083"], 0x0}, 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x1, &(0x7f0000000140)='`') getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0), &(0x7f0000000440)=0xc) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000002340)='./cgroup.cpu/cgroup.procs\x00', 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) read$FUSE(r2, &(0x7f0000000100)={0x2020}, 0x2020) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x40) write$cgroup_int(r3, &(0x7f00000001c0)=0x8000000, 0x12) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000002300)={[{@dax_never}, {@minixdf}]}, 0xff, 0x4ac, &(0x7f00000027c0)="$eJzs3MtPXNUfAPDvHR6FXx/w01ptbRVbjY0PKLRqFy6q0cSFJia6qEsEWmunxRRM2oYoNaYuTRP3xqWJf4E7N0ZdGBO3mrg0TYiyKXWFua8ywECBAiPM55MMc87cO5zzvfecmXPvmXsDaFo96Z8kYldE/BYRXXl2/go9+dPM9MTQ7emJoSRmZ9/6K8nWuzU9MVSuWr5vZ5E5WomofJrEqWRxuWNXrp4frFZHLhX5vvELH/SNXbn67LkLg2dHzo5cHDh58sTx/heeH3huXeJM47p14KPRg/tfe+fGG0Onb7z74zdptfYdypfXxnFXt+sEVEdPutX+ns0sXPbEKuq+FeyuSSetDawIq9ISEenuasv6f1e0xNzO64pXP2lo5YANlX437Vh68eQssI0l0egaAI1RftGnx7/lY5OGHv8JUy9FtBfpmemJoZk78bdGpXi9bQPL74mI05P/fJk+YrXnIQAA1iAb2zxTb/xXiX3Zcz7XsaeYQ+mOiP9HxH0RcX9E7I2IByKydR+MiIfyN892rbD8ngX5xeOfys26dV4n6fjvxZqx30xN/MVTd0uR253F35acOVcdOVZsk6PRtiPN9y9Txnev/Pr5Ustqx3/pIy2/HAsWFbjZuuAE3fDg+OB6bYSpaxEHWuvFn9yZCUhbwP6IOLC6f72nTJx76uuDS6109/iXsQ7zTLNfRTyZ7//JWBB/KSnnJ5MkYvH8ZF9HVEeO9ZWtYrGffrn+5lLl31P862Dq8MN5Ym7/L1ijpqFVqyOXxlZfxvXfP1vymGat7b89eTubs/75vfy1y4Pj45f6I9qT17N8eUyXvT4w997Lg+Odab5cP23/R4/Mb/8debkxFfkEWbr/062UNuJDEfFIRDxa1P2xiDgcEUeWif+Hlx9/f5n4k0iicfv/WsRw3c+/O+2/O6mdr19DouX8998uNWO+sv1/Iiazz9pc9vl3Fyut4D1uPgAAANgSKhGxK5JKb57u2RWVSm9v/hv+vfG/SnV0bPzpM6MfXhzOrxHojrZKeaarq+Z8aH8yWfzHPD9QnCsulx8vzht/0dKZ5XuHRqvDDY4dmt3O+f0/yv6f+rOl0bUDNpzrtaB5Lez/lQbVA9h8K/n+dywA29P8/p/9/KmzUXUBNpfjf2he9fr/xwvyxv+wPS3u/3/UuWUdsB0Z/0Pz0v+heen/0JRWczl/nFpqUUdErOa2AOXFAmu/q0DHiq/wb5ZEeceLjSyrM66eby9eiUqDIm1ZtrG1raFhb4FE2mM2t9C5e6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABsZf8GAAD//1sM2js=") mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f00000021c0)='devtmpfs\x00', 0x22008d0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='mounts\x00') pread64(r4, &(0x7f0000002240)=""/237, 0xed, 0x4eb) socket$netlink(0x10, 0x3, 0x8000000004) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$sock_SIOCGIFINDEX-openat-madvise-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setaffinity-mkdirat-linkat detailed listing: executing program 0: r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, 0x0, 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$sock_SIOCGIFINDEX-openat-madvise-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setaffinity-mkdirat-linkat detailed listing: executing program 0: r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, 0x0, 0x1000) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat-syz_mount_image$fuse-mount$overlay-ioctl$BTRFS_IOC_GET_DEV_STATS-syz_mount_image$fuse-setresuid-capset-openat$cgroup_ro-ioctl$FS_IOC_RESVSP-syz_clone detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x81a, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000c40)={0x0, 0x5, 0x0, [0x7, 0x40, 0x4000400, 0x8, 0x100], [0x1, 0x8c0, 0x8, 0xfffffffffffffffe, 0x4, 0xfffffffffffffff9, 0x5, 0x1, 0xfffffffffffffffd, 0xc67, 0x3, 0xf, 0xfffffffffffffff8, 0x2494, 0xb, 0x7d, 0x0, 0x7faf, 0x93a, 0x200, 0x5, 0x2, 0x1, 0x4, 0x100, 0x6, 0x7, 0x3, 0x1, 0xbe, 0x0, 0x9, 0xfffffffffffffffc, 0x6, 0xffff, 0x1cf5, 0xed, 0x10000, 0x2, 0x8001, 0x4, 0x5, 0x2, 0x5, 0x92, 0x8000000000000001, 0x5fc, 0x1001, 0x3, 0xfc4, 0x7, 0xcb14, 0x4001, 0x80000005, 0x8000000000000001, 0x40000000000756, 0x3, 0x1, 0x4, 0x8, 0x28000005, 0x642, 0x80000000002, 0x9, 0xf, 0x7fff, 0x2, 0xbb, 0xfffffffffffffffd, 0x9, 0x6, 0x4, 0xfffffffffffffffb, 0x7ff, 0xffffffffffffffff, 0xffff, 0x400000000000100, 0x8, 0x638, 0x80000000, 0x3d1, 0x2000007, 0xffffffffffffffff, 0x5, 0x1000, 0x7ff, 0x7, 0xd, 0x5, 0x1, 0x0, 0x8, 0x7, 0x1d, 0x1000000000000145, 0x7, 0xe518, 0x8, 0x15, 0x2, 0x8000000400000, 0x7, 0x402, 0x2, 0x5, 0x3400000000000000, 0x5, 0x100, 0x10000038fb, 0x1, 0x19, 0x8, 0x200000000c, 0x6, 0x6530, 0x8, 0x4000000ffef, 0x400, 0xbfa, 0x2, 0x1000007ffe]}) (async) syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x480a8, &(0x7f0000000340)=ANY=[], 0x21, 0x0, 0x0) (async) setresuid(0xee01, 0xee01, 0x0) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0xffffffff}) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r7, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x5f, 0x3}) (async) syz_clone(0x20020000, 0x0, 0x0, 0x0, 0x0, 0x0) program crashed: KASAN: use-after-free Read in svc_xprt_names single: successfully extracted reproducer found reproducer with 25 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat-syz_mount_image$fuse-mount$overlay-ioctl$BTRFS_IOC_GET_DEV_STATS-syz_mount_image$fuse-setresuid-capset-openat$cgroup_ro-ioctl$FS_IOC_RESVSP detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x81a, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000c40)={0x0, 0x5, 0x0, [0x7, 0x40, 0x4000400, 0x8, 0x100], [0x1, 0x8c0, 0x8, 0xfffffffffffffffe, 0x4, 0xfffffffffffffff9, 0x5, 0x1, 0xfffffffffffffffd, 0xc67, 0x3, 0xf, 0xfffffffffffffff8, 0x2494, 0xb, 0x7d, 0x0, 0x7faf, 0x93a, 0x200, 0x5, 0x2, 0x1, 0x4, 0x100, 0x6, 0x7, 0x3, 0x1, 0xbe, 0x0, 0x9, 0xfffffffffffffffc, 0x6, 0xffff, 0x1cf5, 0xed, 0x10000, 0x2, 0x8001, 0x4, 0x5, 0x2, 0x5, 0x92, 0x8000000000000001, 0x5fc, 0x1001, 0x3, 0xfc4, 0x7, 0xcb14, 0x4001, 0x80000005, 0x8000000000000001, 0x40000000000756, 0x3, 0x1, 0x4, 0x8, 0x28000005, 0x642, 0x80000000002, 0x9, 0xf, 0x7fff, 0x2, 0xbb, 0xfffffffffffffffd, 0x9, 0x6, 0x4, 0xfffffffffffffffb, 0x7ff, 0xffffffffffffffff, 0xffff, 0x400000000000100, 0x8, 0x638, 0x80000000, 0x3d1, 0x2000007, 0xffffffffffffffff, 0x5, 0x1000, 0x7ff, 0x7, 0xd, 0x5, 0x1, 0x0, 0x8, 0x7, 0x1d, 0x1000000000000145, 0x7, 0xe518, 0x8, 0x15, 0x2, 0x8000000400000, 0x7, 0x402, 0x2, 0x5, 0x3400000000000000, 0x5, 0x100, 0x10000038fb, 0x1, 0x19, 0x8, 0x200000000c, 0x6, 0x6530, 0x8, 0x4000000ffef, 0x400, 0xbfa, 0x2, 0x1000007ffe]}) (async) syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x480a8, &(0x7f0000000340)=ANY=[], 0x21, 0x0, 0x0) (async) setresuid(0xee01, 0xee01, 0x0) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0xffffffff}) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r7, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x5f, 0x3}) (async) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat-syz_mount_image$fuse-mount$overlay-ioctl$BTRFS_IOC_GET_DEV_STATS-syz_mount_image$fuse-setresuid-capset-openat$cgroup_ro detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x81a, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000c40)={0x0, 0x5, 0x0, [0x7, 0x40, 0x4000400, 0x8, 0x100], [0x1, 0x8c0, 0x8, 0xfffffffffffffffe, 0x4, 0xfffffffffffffff9, 0x5, 0x1, 0xfffffffffffffffd, 0xc67, 0x3, 0xf, 0xfffffffffffffff8, 0x2494, 0xb, 0x7d, 0x0, 0x7faf, 0x93a, 0x200, 0x5, 0x2, 0x1, 0x4, 0x100, 0x6, 0x7, 0x3, 0x1, 0xbe, 0x0, 0x9, 0xfffffffffffffffc, 0x6, 0xffff, 0x1cf5, 0xed, 0x10000, 0x2, 0x8001, 0x4, 0x5, 0x2, 0x5, 0x92, 0x8000000000000001, 0x5fc, 0x1001, 0x3, 0xfc4, 0x7, 0xcb14, 0x4001, 0x80000005, 0x8000000000000001, 0x40000000000756, 0x3, 0x1, 0x4, 0x8, 0x28000005, 0x642, 0x80000000002, 0x9, 0xf, 0x7fff, 0x2, 0xbb, 0xfffffffffffffffd, 0x9, 0x6, 0x4, 0xfffffffffffffffb, 0x7ff, 0xffffffffffffffff, 0xffff, 0x400000000000100, 0x8, 0x638, 0x80000000, 0x3d1, 0x2000007, 0xffffffffffffffff, 0x5, 0x1000, 0x7ff, 0x7, 0xd, 0x5, 0x1, 0x0, 0x8, 0x7, 0x1d, 0x1000000000000145, 0x7, 0xe518, 0x8, 0x15, 0x2, 0x8000000400000, 0x7, 0x402, 0x2, 0x5, 0x3400000000000000, 0x5, 0x100, 0x10000038fb, 0x1, 0x19, 0x8, 0x200000000c, 0x6, 0x6530, 0x8, 0x4000000ffef, 0x400, 0xbfa, 0x2, 0x1000007ffe]}) (async) syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x480a8, &(0x7f0000000340)=ANY=[], 0x21, 0x0, 0x0) (async) setresuid(0xee01, 0xee01, 0x0) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0xffffffff}) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat-syz_mount_image$fuse-mount$overlay-ioctl$BTRFS_IOC_GET_DEV_STATS-syz_mount_image$fuse-setresuid-capset detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x81a, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000c40)={0x0, 0x5, 0x0, [0x7, 0x40, 0x4000400, 0x8, 0x100], [0x1, 0x8c0, 0x8, 0xfffffffffffffffe, 0x4, 0xfffffffffffffff9, 0x5, 0x1, 0xfffffffffffffffd, 0xc67, 0x3, 0xf, 0xfffffffffffffff8, 0x2494, 0xb, 0x7d, 0x0, 0x7faf, 0x93a, 0x200, 0x5, 0x2, 0x1, 0x4, 0x100, 0x6, 0x7, 0x3, 0x1, 0xbe, 0x0, 0x9, 0xfffffffffffffffc, 0x6, 0xffff, 0x1cf5, 0xed, 0x10000, 0x2, 0x8001, 0x4, 0x5, 0x2, 0x5, 0x92, 0x8000000000000001, 0x5fc, 0x1001, 0x3, 0xfc4, 0x7, 0xcb14, 0x4001, 0x80000005, 0x8000000000000001, 0x40000000000756, 0x3, 0x1, 0x4, 0x8, 0x28000005, 0x642, 0x80000000002, 0x9, 0xf, 0x7fff, 0x2, 0xbb, 0xfffffffffffffffd, 0x9, 0x6, 0x4, 0xfffffffffffffffb, 0x7ff, 0xffffffffffffffff, 0xffff, 0x400000000000100, 0x8, 0x638, 0x80000000, 0x3d1, 0x2000007, 0xffffffffffffffff, 0x5, 0x1000, 0x7ff, 0x7, 0xd, 0x5, 0x1, 0x0, 0x8, 0x7, 0x1d, 0x1000000000000145, 0x7, 0xe518, 0x8, 0x15, 0x2, 0x8000000400000, 0x7, 0x402, 0x2, 0x5, 0x3400000000000000, 0x5, 0x100, 0x10000038fb, 0x1, 0x19, 0x8, 0x200000000c, 0x6, 0x6530, 0x8, 0x4000000ffef, 0x400, 0xbfa, 0x2, 0x1000007ffe]}) (async) syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x480a8, &(0x7f0000000340)=ANY=[], 0x21, 0x0, 0x0) (async) setresuid(0xee01, 0xee01, 0x0) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0xffffffff}) (async) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat-syz_mount_image$fuse-mount$overlay-ioctl$BTRFS_IOC_GET_DEV_STATS-syz_mount_image$fuse-setresuid detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x81a, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000c40)={0x0, 0x5, 0x0, [0x7, 0x40, 0x4000400, 0x8, 0x100], [0x1, 0x8c0, 0x8, 0xfffffffffffffffe, 0x4, 0xfffffffffffffff9, 0x5, 0x1, 0xfffffffffffffffd, 0xc67, 0x3, 0xf, 0xfffffffffffffff8, 0x2494, 0xb, 0x7d, 0x0, 0x7faf, 0x93a, 0x200, 0x5, 0x2, 0x1, 0x4, 0x100, 0x6, 0x7, 0x3, 0x1, 0xbe, 0x0, 0x9, 0xfffffffffffffffc, 0x6, 0xffff, 0x1cf5, 0xed, 0x10000, 0x2, 0x8001, 0x4, 0x5, 0x2, 0x5, 0x92, 0x8000000000000001, 0x5fc, 0x1001, 0x3, 0xfc4, 0x7, 0xcb14, 0x4001, 0x80000005, 0x8000000000000001, 0x40000000000756, 0x3, 0x1, 0x4, 0x8, 0x28000005, 0x642, 0x80000000002, 0x9, 0xf, 0x7fff, 0x2, 0xbb, 0xfffffffffffffffd, 0x9, 0x6, 0x4, 0xfffffffffffffffb, 0x7ff, 0xffffffffffffffff, 0xffff, 0x400000000000100, 0x8, 0x638, 0x80000000, 0x3d1, 0x2000007, 0xffffffffffffffff, 0x5, 0x1000, 0x7ff, 0x7, 0xd, 0x5, 0x1, 0x0, 0x8, 0x7, 0x1d, 0x1000000000000145, 0x7, 0xe518, 0x8, 0x15, 0x2, 0x8000000400000, 0x7, 0x402, 0x2, 0x5, 0x3400000000000000, 0x5, 0x100, 0x10000038fb, 0x1, 0x19, 0x8, 0x200000000c, 0x6, 0x6530, 0x8, 0x4000000ffef, 0x400, 0xbfa, 0x2, 0x1000007ffe]}) (async) syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x480a8, &(0x7f0000000340)=ANY=[], 0x21, 0x0, 0x0) (async) setresuid(0xee01, 0xee01, 0x0) (async) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat-syz_mount_image$fuse-mount$overlay-ioctl$BTRFS_IOC_GET_DEV_STATS-syz_mount_image$fuse detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x81a, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000c40)={0x0, 0x5, 0x0, [0x7, 0x40, 0x4000400, 0x8, 0x100], [0x1, 0x8c0, 0x8, 0xfffffffffffffffe, 0x4, 0xfffffffffffffff9, 0x5, 0x1, 0xfffffffffffffffd, 0xc67, 0x3, 0xf, 0xfffffffffffffff8, 0x2494, 0xb, 0x7d, 0x0, 0x7faf, 0x93a, 0x200, 0x5, 0x2, 0x1, 0x4, 0x100, 0x6, 0x7, 0x3, 0x1, 0xbe, 0x0, 0x9, 0xfffffffffffffffc, 0x6, 0xffff, 0x1cf5, 0xed, 0x10000, 0x2, 0x8001, 0x4, 0x5, 0x2, 0x5, 0x92, 0x8000000000000001, 0x5fc, 0x1001, 0x3, 0xfc4, 0x7, 0xcb14, 0x4001, 0x80000005, 0x8000000000000001, 0x40000000000756, 0x3, 0x1, 0x4, 0x8, 0x28000005, 0x642, 0x80000000002, 0x9, 0xf, 0x7fff, 0x2, 0xbb, 0xfffffffffffffffd, 0x9, 0x6, 0x4, 0xfffffffffffffffb, 0x7ff, 0xffffffffffffffff, 0xffff, 0x400000000000100, 0x8, 0x638, 0x80000000, 0x3d1, 0x2000007, 0xffffffffffffffff, 0x5, 0x1000, 0x7ff, 0x7, 0xd, 0x5, 0x1, 0x0, 0x8, 0x7, 0x1d, 0x1000000000000145, 0x7, 0xe518, 0x8, 0x15, 0x2, 0x8000000400000, 0x7, 0x402, 0x2, 0x5, 0x3400000000000000, 0x5, 0x100, 0x10000038fb, 0x1, 0x19, 0x8, 0x200000000c, 0x6, 0x6530, 0x8, 0x4000000ffef, 0x400, 0xbfa, 0x2, 0x1000007ffe]}) (async) syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000040)='./file0\x00', 0x480a8, &(0x7f0000000340)=ANY=[], 0x21, 0x0, 0x0) (async) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat-syz_mount_image$fuse-mount$overlay-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x81a, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000c40)={0x0, 0x5, 0x0, [0x7, 0x40, 0x4000400, 0x8, 0x100], [0x1, 0x8c0, 0x8, 0xfffffffffffffffe, 0x4, 0xfffffffffffffff9, 0x5, 0x1, 0xfffffffffffffffd, 0xc67, 0x3, 0xf, 0xfffffffffffffff8, 0x2494, 0xb, 0x7d, 0x0, 0x7faf, 0x93a, 0x200, 0x5, 0x2, 0x1, 0x4, 0x100, 0x6, 0x7, 0x3, 0x1, 0xbe, 0x0, 0x9, 0xfffffffffffffffc, 0x6, 0xffff, 0x1cf5, 0xed, 0x10000, 0x2, 0x8001, 0x4, 0x5, 0x2, 0x5, 0x92, 0x8000000000000001, 0x5fc, 0x1001, 0x3, 0xfc4, 0x7, 0xcb14, 0x4001, 0x80000005, 0x8000000000000001, 0x40000000000756, 0x3, 0x1, 0x4, 0x8, 0x28000005, 0x642, 0x80000000002, 0x9, 0xf, 0x7fff, 0x2, 0xbb, 0xfffffffffffffffd, 0x9, 0x6, 0x4, 0xfffffffffffffffb, 0x7ff, 0xffffffffffffffff, 0xffff, 0x400000000000100, 0x8, 0x638, 0x80000000, 0x3d1, 0x2000007, 0xffffffffffffffff, 0x5, 0x1000, 0x7ff, 0x7, 0xd, 0x5, 0x1, 0x0, 0x8, 0x7, 0x1d, 0x1000000000000145, 0x7, 0xe518, 0x8, 0x15, 0x2, 0x8000000400000, 0x7, 0x402, 0x2, 0x5, 0x3400000000000000, 0x5, 0x100, 0x10000038fb, 0x1, 0x19, 0x8, 0x200000000c, 0x6, 0x6530, 0x8, 0x4000000ffef, 0x400, 0xbfa, 0x2, 0x1000007ffe]}) (async) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat-syz_mount_image$fuse-mount$overlay detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x81a, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat-syz_mount_image$fuse detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, 0x0) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink-mkdirat detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm-sendmsg$netlink detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) sendmsg$netlink(r6, &(0x7f0000005d80)={0x0, 0x0, &(0x7f0000005cc0)=[{&(0x7f0000001f40)=ANY=[], 0x218}], 0x1, 0x0, 0x0, 0x4000804}, 0x4000) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm-connect$can_bcm detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000040), 0x10) (async) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap-socket$can_bcm detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) socket$can_bcm(0x1d, 0x2, 0x2) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg-mmap detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) r5 = syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x180000d, 0x4000010, r5, 0xaba37000) (async) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route-syz_open_dev$sg detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) syz_open_dev$sg(&(0x7f00000002c0), 0x100000000000e5, 0x602) program crashed: KASAN: use-after-free Read in svc_xprt_names testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f0000000140), 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f00000001c0)='1\n', 0x2) (async) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="70000000140009050000000000000000020100ff", @ANYRES32=r2, @ANYBLOB="1400060006000000000000f0000000000000000008000200ac"], 0x70}}, 0x0) (async) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140), 0x0) (async) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) (async) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-openat detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140), 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write-write detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140), 0x0) (async) write(0xffffffffffffffff, &(0x7f00000001c0)='1\n', 0x2) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-openat-write detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='1\n', 0x2) (async) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-mount-openat-write detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='1\n', 0x2) (async) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mkdirat-openat-write detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='1\n', 0x2) (async) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-mount-openat-write detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) (async) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='1\n', 0x2) (async) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-mkdirat-mount-openat-write detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) (async) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-mkdirat-mount-openat-write detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) (async) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) (async) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_create_serv a never seen crash title: KASAN: use-after-free Write in nfsd_create_serv, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='1\n', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads validation run: crashed=true reproducing took 2h47m16.088196022s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:111 [inline] BUG: KASAN: use-after-free in __refcount_add include/linux/refcount.h:193 [inline] BUG: KASAN: use-after-free in __refcount_inc include/linux/refcount.h:250 [inline] BUG: KASAN: use-after-free in refcount_inc include/linux/refcount.h:267 [inline] BUG: KASAN: use-after-free in kref_get include/linux/kref.h:45 [inline] BUG: KASAN: use-after-free in svc_get include/linux/sunrpc/svc.h:108 [inline] BUG: KASAN: use-after-free in nfsd_shutdown_threads+0x89/0x1a0 fs/nfsd/nfssvc.c:641 Write of size 4 at addr ffff8880233e5850 by task syz-executor/4291 CPU: 1 PID: 4291 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x235/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:111 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] kref_get include/linux/kref.h:45 [inline] svc_get include/linux/sunrpc/svc.h:108 [inline] nfsd_shutdown_threads+0x89/0x1a0 fs/nfsd/nfssvc.c:641 nfsd_umount+0x3e/0xc0 fs/nfsd/nfsctl.c:1411 deactivate_locked_super+0x93/0xf0 fs/super.c:335 cleanup_mnt+0x426/0x4d0 fs/namespace.c:1148 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc0bd20a397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffd998414e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fc0bd29f474 RCX: 00007fc0bd20a397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd998415a0 RBP: 00007ffd998415a0 R08: 00007ffd998425a0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd99842630 R13: 00007fc0bd29f474 R14: 00000000000120d3 R15: 00007ffd99842670 Allocated by task 4316: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xaf/0xe0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:607 [inline] kzalloc include/linux/slab.h:738 [inline] __svc_create+0x60/0x9d0 net/sunrpc/svc.c:458 svc_create_pooled+0x62f/0x810 net/sunrpc/svc.c:546 nfsd_create_serv+0x2f9/0x700 fs/nfsd/nfssvc.c:668 nfsd_svc+0x132/0x9e0 fs/nfsd/nfssvc.c:798 write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:426 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4316: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1710 [inline] slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736 slab_free mm/slub.c:3504 [inline] kfree+0xef/0x2a0 mm/slub.c:4564 kref_put include/linux/kref.h:65 [inline] svc_put include/linux/sunrpc/svc.h:123 [inline] nfsd_svc+0x7cf/0x9e0 fs/nfsd/nfssvc.c:821 write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:426 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff8880233e5800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 80 bytes inside of 512-byte region [ffff8880233e5800, ffff8880233e5a00) The buggy address belongs to the page: page:ffffea00008cf900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x233e4 head:ffffea00008cf900 order:2 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888016c41c80 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1f2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_MEMALLOC|__GFP_HARDWALL), pid 20, ts 73919167289, free_ts 72831310812 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501 alloc_slab_page mm/slub.c:1780 [inline] allocate_slab mm/slub.c:1917 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1980 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013 __slab_alloc mm/slub.c:3100 [inline] slab_alloc_node mm/slub.c:3191 [inline] __kmalloc_node_track_caller+0x13d/0x3a0 mm/slub.c:4963 kmalloc_reserve net/core/skbuff.c:356 [inline] __alloc_skb+0x22c/0x750 net/core/skbuff.c:427 __netdev_alloc_skb+0x110/0x4c0 net/core/skbuff.c:494 netdev_alloc_skb include/linux/skbuff.h:3024 [inline] dev_alloc_skb include/linux/skbuff.h:3037 [inline] __ieee80211_beacon_get+0xa8f/0x1ff0 net/mac80211/tx.c:5105 ieee80211_beacon_get_tim+0x48/0x840 net/mac80211/tx.c:5219 ieee80211_beacon_get include/net/mac80211.h:4983 [inline] mac80211_hwsim_beacon_tx+0x104/0x900 drivers/net/wireless/mac80211_hwsim.c:1812 __iterate_interfaces+0x225/0x4c0 net/mac80211/util.c:793 ieee80211_iterate_active_interfaces_atomic+0xb3/0x140 net/mac80211/util.c:829 mac80211_hwsim_beacon+0x9b/0x180 drivers/net/wireless/mac80211_hwsim.c:1865 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x4ea/0xb60 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x176/0x240 kernel/time/hrtimer.c:1766 handle_softirqs+0x336/0x830 kernel/softirq.c:576 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1391 [inline] free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396 free_slab mm/slub.c:2020 [inline] discard_slab mm/slub.c:2026 [inline] __unfreeze_partials+0x188/0x1e0 mm/slub.c:2512 put_cpu_partial+0x12d/0x190 mm/slub.c:2592 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xc0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] __kmalloc+0x189/0x340 mm/slub.c:4408 kmalloc include/linux/slab.h:612 [inline] kzalloc include/linux/slab.h:738 [inline] fib_create_info+0xad1/0x2450 net/ipv4/fib_semantics.c:1509 fib_table_insert+0xe4/0x1b80 net/ipv4/fib_trie.c:1212 fib_magic+0x2ca/0x3b0 net/ipv4/fib_frontend.c:1113 fib_add_ifaddr+0x135/0x5c0 net/ipv4/fib_frontend.c:1135 fib_inetaddr_event+0x13c/0x1c0 net/ipv4/fib_frontend.c:1449 notifier_call_chain kernel/notifier.c:83 [inline] blocking_notifier_call_chain+0x103/0x1b0 kernel/notifier.c:318 __inet_insert_ifa+0x9ea/0xbd0 net/ipv4/devinet.c:567 Memory state around the buggy address: ffff8880233e5700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880233e5780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880233e5800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880233e5880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880233e5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:111 [inline] BUG: KASAN: use-after-free in __refcount_add include/linux/refcount.h:193 [inline] BUG: KASAN: use-after-free in __refcount_inc include/linux/refcount.h:250 [inline] BUG: KASAN: use-after-free in refcount_inc include/linux/refcount.h:267 [inline] BUG: KASAN: use-after-free in kref_get include/linux/kref.h:45 [inline] BUG: KASAN: use-after-free in svc_get include/linux/sunrpc/svc.h:108 [inline] BUG: KASAN: use-after-free in nfsd_shutdown_threads+0x89/0x1a0 fs/nfsd/nfssvc.c:641 Write of size 4 at addr ffff8880233e5850 by task syz-executor/4291 CPU: 1 PID: 4291 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x235/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:111 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] kref_get include/linux/kref.h:45 [inline] svc_get include/linux/sunrpc/svc.h:108 [inline] nfsd_shutdown_threads+0x89/0x1a0 fs/nfsd/nfssvc.c:641 nfsd_umount+0x3e/0xc0 fs/nfsd/nfsctl.c:1411 deactivate_locked_super+0x93/0xf0 fs/super.c:335 cleanup_mnt+0x426/0x4d0 fs/namespace.c:1148 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc0bd20a397 Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffd998414e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fc0bd29f474 RCX: 00007fc0bd20a397 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd998415a0 RBP: 00007ffd998415a0 R08: 00007ffd998425a0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd99842630 R13: 00007fc0bd29f474 R14: 00000000000120d3 R15: 00007ffd99842670 Allocated by task 4316: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xaf/0xe0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:607 [inline] kzalloc include/linux/slab.h:738 [inline] __svc_create+0x60/0x9d0 net/sunrpc/svc.c:458 svc_create_pooled+0x62f/0x810 net/sunrpc/svc.c:546 nfsd_create_serv+0x2f9/0x700 fs/nfsd/nfssvc.c:668 nfsd_svc+0x132/0x9e0 fs/nfsd/nfssvc.c:798 write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:426 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4316: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1710 [inline] slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736 slab_free mm/slub.c:3504 [inline] kfree+0xef/0x2a0 mm/slub.c:4564 kref_put include/linux/kref.h:65 [inline] svc_put include/linux/sunrpc/svc.h:123 [inline] nfsd_svc+0x7cf/0x9e0 fs/nfsd/nfssvc.c:821 write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:426 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff8880233e5800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 80 bytes inside of 512-byte region [ffff8880233e5800, ffff8880233e5a00) The buggy address belongs to the page: page:ffffea00008cf900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x233e4 head:ffffea00008cf900 order:2 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888016c41c80 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1f2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_MEMALLOC|__GFP_HARDWALL), pid 20, ts 73919167289, free_ts 72831310812 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501 alloc_slab_page mm/slub.c:1780 [inline] allocate_slab mm/slub.c:1917 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1980 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013 __slab_alloc mm/slub.c:3100 [inline] slab_alloc_node mm/slub.c:3191 [inline] __kmalloc_node_track_caller+0x13d/0x3a0 mm/slub.c:4963 kmalloc_reserve net/core/skbuff.c:356 [inline] __alloc_skb+0x22c/0x750 net/core/skbuff.c:427 __netdev_alloc_skb+0x110/0x4c0 net/core/skbuff.c:494 netdev_alloc_skb include/linux/skbuff.h:3024 [inline] dev_alloc_skb include/linux/skbuff.h:3037 [inline] __ieee80211_beacon_get+0xa8f/0x1ff0 net/mac80211/tx.c:5105 ieee80211_beacon_get_tim+0x48/0x840 net/mac80211/tx.c:5219 ieee80211_beacon_get include/net/mac80211.h:4983 [inline] mac80211_hwsim_beacon_tx+0x104/0x900 drivers/net/wireless/mac80211_hwsim.c:1812 __iterate_interfaces+0x225/0x4c0 net/mac80211/util.c:793 ieee80211_iterate_active_interfaces_atomic+0xb3/0x140 net/mac80211/util.c:829 mac80211_hwsim_beacon+0x9b/0x180 drivers/net/wireless/mac80211_hwsim.c:1865 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x4ea/0xb60 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0x176/0x240 kernel/time/hrtimer.c:1766 handle_softirqs+0x336/0x830 kernel/softirq.c:576 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1391 [inline] free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396 free_slab mm/slub.c:2020 [inline] discard_slab mm/slub.c:2026 [inline] __unfreeze_partials+0x188/0x1e0 mm/slub.c:2512 put_cpu_partial+0x12d/0x190 mm/slub.c:2592 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xc0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] __kmalloc+0x189/0x340 mm/slub.c:4408 kmalloc include/linux/slab.h:612 [inline] kzalloc include/linux/slab.h:738 [inline] fib_create_info+0xad1/0x2450 net/ipv4/fib_semantics.c:1509 fib_table_insert+0xe4/0x1b80 net/ipv4/fib_trie.c:1212 fib_magic+0x2ca/0x3b0 net/ipv4/fib_frontend.c:1113 fib_add_ifaddr+0x135/0x5c0 net/ipv4/fib_frontend.c:1135 fib_inetaddr_event+0x13c/0x1c0 net/ipv4/fib_frontend.c:1449 notifier_call_chain kernel/notifier.c:83 [inline] blocking_notifier_call_chain+0x103/0x1b0 kernel/notifier.c:318 __inet_insert_ifa+0x9ea/0xbd0 net/ipv4/devinet.c:567 Memory state around the buggy address: ffff8880233e5700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880233e5780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880233e5800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880233e5880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880233e5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================