last executing test programs: 3m1.468227418s ago: executing program 5 (id=152): bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) r0 = msgget$private(0x0, 0x208) msgsnd(r0, &(0x7f0000000100)=ANY=[@ANYRES32=r0], 0x8, 0x800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) preadv2(r4, &(0x7f0000000080)=[{&(0x7f0000005a80)=""/4105, 0x1009}], 0x1, 0x3, 0x0, 0xe) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) syz_mount_image$f2fs(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x8, &(0x7f0000005880)=ANY=[@ANYBLOB="6e6f646973636172642c6e6f636865636b706f696e745f6d657267652c616c6c6f635f6d6f64653d64656661756c742c6163746976655f6c6f67733d362c666c7573685f6d657267652c6661756c745f696e6a656374696f6e3d30303030303030303030303030303030303235362c646973636172642c6e6f61636c2c6673796e635f6d6f64653d706f7369782c616c6c6f635f6d6f64653d64656661756c742c6e6f657874656e745f63616368652c6163746976655f6c6f67733d322c6661756c745f747970653d30303030303030303030303031363737373231342c0002d1c71f8348abae1fff96ec907a723dca530cf5aea9622c1169c27c91b4d703f02da55a70e4108d30dd0a1b6e467d05c6c0237e3772dfb37da0e9705c62c7f6dc21ef782f52303a65f3196af86a3d58c8bfb0ef60c974b0e0b44af5ce33f407facb3838bd4bf9b7a99d612518ac3ddddf95b10ead9f78580da79051b5011a94bc44336ebf9378b479860af435366b6d4cdb9c5ffd949b52f82ac9c92de853", @ANYRESOCT=0x0, @ANYRES64=r4, @ANYRES8=r4, @ANYRESDEC=r4, @ANYRESHEX, @ANYRES16, @ANYRES32], 0x5, 0x5505, &(0x7f0000000340)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYoIAfSQhqgBnJLCRFEeBwCEYdIHttK9H2SMxnL/HiD4DAz0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF26r9aL26vf121zdvt28owGAAAAuGRbrRf1P7PU/9rc/97c+tn0i4goI+LS3H0Un84yR01O9fL8zenz1asa7iLqhMN7TJrrS0T8aa7HH11/CgAAAPBxbZareZqtpz+zoQuiT2nRpvz2N1NeERHV7CFTWnnI+5UprP5+j+N/prR6AWuaKSwtuY1zpb1J/XM/rtpNT5oiNeXFlx2LzDZ2AACgR6Ozpt9ZCAAAAH36N3QBDKOI563M41bgJDXN9t7nsx4AAADwDhVDFwAAAAB0rp7/93T+3975fwAAADCMdP4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXdpW68VmuZq3zdnt28kzGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHhif95RIATCIAz2ru9M5v6HlQZNTU2qQPj4G4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIv9eUmBEAiCKJgz/nfS9z+sJOgZRIiAhkcVtWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIud+3mNo4oDAP5mZmdrq+IaZQ8RUfCgF7vd1tbexIMSPPgnCCHd1titP9ocbCliLt4k515EjyKCEm/9H3JOIJd4y2EPETwrMzuTnfwA118zm+TzgTfvu8Mw7/tmIeQ77yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACURm9P4iQ7dMZxXJzb3Hu4lPVbh/rM47Xt+axlcVRn0ifDi9UPUbe5RAAAADg7krK+DyHspOsLWR938vo/La/Jav5vnx7HZT1/uO4v+7L2z9ovP+8+vz9QZzxOdtOby8PBpaOptP6/Wc62Z/7yilb+5PN3L0n+hcTvrT43SvPnGX29sfFOOw/P1ZEtAPBPXCz7Iih/H8r6fpOJAXBmtCqFd1n/J51mcwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACow2g1PFnGUQhhvjWJM1t7D5eO6x+vbc+X7dqjR2vhy8k9s1ukIYSby8PBpVpnM9vu3X9we3E4HNytP3gphNDU6G8V07/9wRQXh9DI8xH8R0FcfNmzks/JCBr8oQQAwKmUFi2r63fS9YXsXDQXwh/fHaz/X63EYcr6f/fDa5vVsar1f7+2Gc6+3sqdT3v37j94ffnO4q3BrcHHb1zuv9m/cv3q1eu9/F1JzxsTAAAA/p120ar1fzx3dP3/QiUOU9b/n33T/6I6VqL+P9Zk0a/pTAAAAM62Z1/+/bfomPNRux0+X1xZudsfH/c/Xx4fG0j1bztXtGr9n8w1nRUAAABQh9FqdGD9/0YlDlOu/z/1/Qs/Vu+ZhBDOF+v/F5c+Gd6obzozrY4/J256jgAAADTrfNGq6/9pvv8/3t/yEIcQXntlHBf/BnCq+j9596sfqmNV9/9fqW+KMynujp9H3ndDaHWbzggAAIDT7ImiZcX+r+n6wkc/XXi/bf8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN3+DAAA//962D6S") r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x183341, 0x0) truncate(&(0x7f0000000940)='./file1\x00', 0x2fffffd) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xe3aa6ea) syz_clone(0x88206100, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$FIBMAP(r5, 0x1, &(0x7f0000000000)=0x9) syz_mount_image$ext4(&(0x7f0000000900)='ext2\x00', &(0x7f0000000000)='./file1\x00', 0x1000048, &(0x7f0000000240)={[{@nouid32}, {@nodioread_nolock}, {@noquota}, {@jqfmt_vfsv1}, {@journal_dev={'journal_dev', 0x3d, 0x9}}, {@commit}]}, 0x1, 0x5a3, &(0x7f00000002c0)="$eJzs3T1sG3UbAPDnznHTj7xv+krvK72gDhUgFamqk/QDClO7IipV6oDEApHjRlWcuIodaKJIpHuF6IAAdSkbDIwgBgbEwsjKwseMVNEIpKYDGDk+p2nqFCfEMcS/n3TJ/3939vP8fX7OvtOdHEDfOtr4k0Y8EREXk4jhdcsGIlt4tLneyvJi8f7yYjGJev3Sz0kkEXFvebHYWj/J/h+KiKWI+H9EfJWPOJ6uPeW+VqM6vzA1Xi6XZrP+SG366kh1fuHElenxydJkaebU8y+cOXv6zNjJsfXp3q+v7+W3NtYb3998+8Y3L92++fEnR5aK744ncS6GsmXrx7GTmq9JPs5tmH+6G8F6KOl1AmxLLqvzRin9L4Yjl1V9O/X1O4fBXUkP6KL6YER9zbom0AcSRQ99qvU9oHH825p28/vHnfPNA5BG3JXlxeJb0Yo/0Dw3EftXj00O/pI8dGTSON48vJuJsictXY+I0YGBR9//Sfb+277RnUiQrvryfHNDPbr907X9T7TZ/wy1zp3+Ra3930q2/1tpEz+3yf7vYocxfnv1xw82jX99MJ5sGz9Zi5+0iZ9GxOsdxr/1yudnN1tW/zDiWLSP35I8/vzwyOUr5dJo82/bGF8cO/Li5uOPOLhJ/OY52/2riawf/74sp7TD8X/29adPLT0m/rNPP377t3v9D0TEOx3G/8+9j17ebNmd68ndxreArW7/JPJxu8P4z507+l3WdNYQAAAAAAAAAAB2ULp6LVuSFtbaaVooNO/h/W8cTMuVau345crczETzmrfDkU9bV1oNN/tJoz+WXY/b6p/c0D+VywLmDqz2C8VKeaLHYwcAAAAAAAAAAAAAAAAAAIC/i0Mb7v//Nbd6///Gn6sG9qrNf/Ib2OvUP/Svh+s/6VkewO7z+Q99q67+oX+pf+hf6h/6l/qH/tW2/g/sfh7A7vP5D/1L/QMAAAAAAAAAAAAAAAAAAAAAAAAAQFdcvHChMdXvLy8WG/2Jgfm5qcobJyZK1anC9FyxUKzMXi1MViqT5VKhWJn+s+dLKpWrozEzd22kVqrWRqrzC69NV+ZmWr8pWsp3fUQAAAAAAAAAAAAAAAAAAADwzzO0OiVpISLf7KdpoRDxr4g4nERy+Uq5NBoR/46Ib3P5wUZ/rNdJAwAAAAAAAAAAAAAAAAAAwB5TnV+YGi+XS7PdawxkoTp71A+1ruYzsJWVI2JpZ9NoPOOWH5XPXsDubqY+aeQ6fB/2faOHOyUAAAAAAAAAAAAAAAAAAOhTD2767fQRv3c3IQAAAAAAAAAAAAAAAAAAAOhL6U9JRDSmY8PPDG1cui9Zya3+j4g3b11679p4rTY71ph/d21+7f1s/sle5A90qlWnaUQ06hgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4oDq/MDVeLpdmt9kY7GCdXo8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYDv+CAAA//9bQM66") openat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x42042, 0x138) socket$inet6(0xa, 0x800000000000002, 0x0) 2m58.276215574s ago: executing program 5 (id=158): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) r1 = msgget$private(0x0, 0x208) msgsnd(r1, &(0x7f0000000100)=ANY=[@ANYRES32=r1], 0x8, 0x800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) preadv2(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000005a80)=""/4105, 0x1009}], 0x1, 0x3, 0x0, 0xe) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, 0x0) syz_mount_image$f2fs(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x8, &(0x7f0000005880)=ANY=[@ANYBLOB="6e6f646973636172642c6e6f636865636b706f696e745f6d657267652c616c6c6f635f6d6f64653d64656661756c742c6163746976655f6c6f67733d362c666c7573685f6d657267652c6661756c745f696e6a656374696f6e3d30303030303030303030303030303030303235362c646973636172642c6e6f61636c2c6673796e635f6d6f64653d706f7369782c616c6c6f635f6d6f64653d64656661756c742c6e6f657874656e745f63616368652c6163746976655f6c6f67733d322c6661756c745f747970653d30303030303030303030303031363737373231342c0002d1c71f8348abae1fff96ec907a723dca530cf5aea9622c1169c27c91b4d703f02da55a70e4108d30dd0a1b6e467d05c6c0237e3772dfb37da0e9705c62c7f6dc21ef782f52303a65f3196af86a3d58c8bfb0ef60c974b0e0b44af5ce33f407facb3838bd4bf9b7a99d612518ac3ddddf95b10ead9f78580da79051b5011a94bc44336ebf9378b479860af435366b6d4cdb9c5ffd949b52f82ac9c92de853", @ANYRESOCT=0x0, @ANYRES64, @ANYRES8, @ANYRESDEC, @ANYRESHEX, @ANYRES16, @ANYRES32], 0x5, 0x5505, &(0x7f0000000340)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYoIAfSQhqgBnJLCRFEeBwCEYdIHttK9H2SMxnL/HiD4DAz0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF26r9aL26vf121zdvt28owGAAAAuGRbrRf1P7PU/9rc/97c+tn0i4goI+LS3H0Un84yR01O9fL8zenz1asa7iLqhMN7TJrrS0T8aa7HH11/CgAAAPBxbZareZqtpz+zoQuiT2nRpvz2N1NeERHV7CFTWnnI+5UprP5+j+N/prR6AWuaKSwtuY1zpb1J/XM/rtpNT5oiNeXFlx2LzDZ2AACgR6Ozpt9ZCAAAAH36N3QBDKOI563M41bgJDXN9t7nsx4AAADwDhVDFwAAAAB0rp7/93T+3975fwAAADCMdP4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXdpW68VmuZq3zdnt28kzGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHhif95RIATCIAz2ru9M5v6HlQZNTU2qQPj4G4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIv9eUmBEAiCKJgz/nfS9z+sJOgZRIiAhkcVtWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIud+3mNo4oDAP5mZmdrq+IaZQ8RUfCgF7vd1tbexIMSPPgnCCHd1titP9ocbCliLt4k515EjyKCEm/9H3JOIJd4y2EPETwrMzuTnfwA118zm+TzgTfvu8Mw7/tmIeQ77yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACURm9P4iQ7dMZxXJzb3Hu4lPVbh/rM47Xt+axlcVRn0ifDi9UPUbe5RAAAADg7krK+DyHspOsLWR938vo/La/Jav5vnx7HZT1/uO4v+7L2z9ovP+8+vz9QZzxOdtOby8PBpaOptP6/Wc62Z/7yilb+5PN3L0n+hcTvrT43SvPnGX29sfFOOw/P1ZEtAPBPXCz7Iih/H8r6fpOJAXBmtCqFd1n/J51mcwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACow2g1PFnGUQhhvjWJM1t7D5eO6x+vbc+X7dqjR2vhy8k9s1ukIYSby8PBpVpnM9vu3X9we3E4HNytP3gphNDU6G8V07/9wRQXh9DI8xH8R0FcfNmzks/JCBr8oQQAwKmUFi2r63fS9YXsXDQXwh/fHaz/X63EYcr6f/fDa5vVsar1f7+2Gc6+3sqdT3v37j94ffnO4q3BrcHHb1zuv9m/cv3q1eu9/F1JzxsTAAAA/p120ar1fzx3dP3/QiUOU9b/n33T/6I6VqL+P9Zk0a/pTAAAAM62Z1/+/bfomPNRux0+X1xZudsfH/c/Xx4fG0j1bztXtGr9n8w1nRUAAABQh9FqdGD9/0YlDlOu/z/1/Qs/Vu+ZhBDOF+v/F5c+Gd6obzozrY4/J256jgAAADTrfNGq6/9pvv8/3t/yEIcQXntlHBf/BnCq+j9596sfqmNV9/9fqW+KMynujp9H3ndDaHWbzggAAIDT7ImiZcX+r+n6wkc/XXi/bf8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN3+DAAA//962D6S") r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x183341, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x2a42, 0x100) sendfile(r3, r3, 0x0, 0xe3aa6ea) syz_open_procfs(0x0, 0x0) ioctl$FIBMAP(r2, 0x1, &(0x7f0000000000)=0x9) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x42042, 0x138) 2m51.119425018s ago: executing program 5 (id=176): r0 = syz_open_procfs(0x0, &(0x7f0000000e40)='mountinfo\x00') r1 = socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_int(r0, &(0x7f0000000100)='net_cls.classid\x00', 0x2, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000001c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(0xffffffffffffffff, 0xc0182101, &(0x7f00000000c0)={r2}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000003c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000080)={r3, 0x3, r1, 0x5}) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmsg(r4, &(0x7f0000002700)={0x0, 0x0, &(0x7f00000025c0)=[{0x0}, {&(0x7f00000015c0)=""/4096, 0x94}], 0x2}, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2m46.783918452s ago: executing program 5 (id=190): syz_usb_connect(0x3, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1fe) mount(0x0, &(0x7f0000000b00)='./sys\x00', &(0x7f0000000b10)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/iscsi_transport/iser/handle\x00', 0x0, 0x0) read(r0, &(0x7f0000000700), 0x64) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') pread64$ublk_ch(r1, &(0x7f0000001f80)=@buf_max_buf, 0x1000, 0x100000000801) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r2, &(0x7f0000000100)='0fc5:1227:ed', 0xc) openat$ttyprintk(0xffffffffffffff9c, &(0x7f00000000c0), 0x60000, 0x0) r3 = socket$unix(0x1, 0x0, 0x0) poll(&(0x7f0000000040)=[{r3, 0x2020}, {r0, 0x8000}, {r0, 0x1000}], 0x3, 0xa10) syz_open_dev$char_usb(0xc, 0xb4, 0x0) connect$pppl2tp(r1, &(0x7f0000000100)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x0, 0x3, 0x3, 0x1, {0xa, 0x4e21, 0x6e9, @empty, 0x2}}}, 0x3a) 2m42.893130027s ago: executing program 5 (id=199): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x12, 0x3, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000340)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1e, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x2c}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000940)="63eced8e46dc3f0adf33c9ffff000000000000cea90344b8877483329ccade00000000000006caa5b024ce6a1e7967541e73415b7d653d4eb2d05d39003a94ba5785b6e0e412b8b6654c22b8663e60929ac77771b1d597cd4a50346f66920f4903271b72df99cb9704cbf2dbde69a5296cbcb5312fa3f988e6f6eba3a526b2a1d3f324aaf340e4c3e6748779df19a5d6a35d8a3e243181432aba125573115c67b4673402688eba6de797da8d10ec62384ce29426db2308eaf3da4ce61f75aa7e25d1009ee1395b71936bb5d672b1379d09e0b73e99bf2bebdc9e0d2777b92ec32fda36c109aabaec603a116991294d1fb5e30e46ff687294f92b00dd5d4775595cdc6ecfa3525a32d9ba206677ea88290ad23b8bf514d3a3754f21f2a8563b85d741d990a9de86fd0b9b7b61a85c0e2fd39ea8a4b02c55f24fdf0206a743c7601aeb78d9b69b600e4d62d0f6038721", 0x0, 0x3800, 0x0, 0x2d, 0x0, 0x0, 0x0, 0x7}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r4 = open(&(0x7f0000000000)='.\x00', 0x101000, 0x12d) syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000240)='./file0\x00', 0x204818, &(0x7f00000001c0)={[{@utf8}, {@gid}, {@cruft}, {@map_off}, {@unhide}, {@iocharset={'iocharset', 0x3d, 'cp936'}}, {@map_off}, {@mode={'mode', 0x3d, 0x483}}]}, 0x1, 0x551, &(0x7f00000003c0)="$eJzs3V9v01YfwPGfS/sQ5dFTPRoTQlWBQ9mkIpXgJBAUceU5J+mBxI5sB7VXqKIpqkhho0xae8O4YZu0vQh2uRexd4T2EphsJ23a5s+gf1d9PxH4xD72+Z1g+acT4mMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABiuRXbzltSN15rSQ3nVgK/sfu2u/eBFXJrz2JEuyJW/EcyGbmSrrry5e7my/FfczKbvpuVTLzIyPZ/L///waXJid7+IwL+JL9/5pE2t7afr3Q67VdHFcgZdPXi8G017ZnQNw2nppUJfVUulew7i9VQVU1dh8thpBvKDbQT+YGad2+pfLlcVDq37Le8WsWp697K+7cLtl1SD3NN7QSh7915mAvdRVOvG6+W1Ik3x3XuxyfiIxOpSDsNpdbWO+1if0AX95yUqbhSflwv40qFcZUKdqGQzxcK+dK98r37tj15YIW9jxyocXQnLf6djvDqDRzORDf/S12MeNKSJVEDX65UJBBfGkO2d/Xy/9d39Mh2+/N/L8tf2d08I0n+v5a+uzYs/w+J5eRem7Il2/JcVqQjHWnLq1OP6GRfNdHiiZFQfDHSECdZo7prlJSlJCWx5YksSlVCUVIVI3XREsqyhBKJTs4oVwLR4kgkvgSiZF5cuSVK8lKWshRFiZacLIsvLfGkJhVxkqOsyXryuRdFWcNi3KmUH9qNbO+8a0th/8aPu2XyPw7vSK/fwGF8dK00/wMAAAAAgHPLSr59j8f/U3I1KVVNXdunHRYAAAAAADhCyf/8z8aLqbh0VSzG/wAAAAAAnDdWco+dJSJZuZ6W1sRKbpfiSwAAAAAAAM4JS777n1yLh/3JHCjXxdqZLoXxPwAAAAAA58TPY+fYD5sXrT//kiCYst42l76yNpK5eZ2NC+l+F/YfMarOWNPdgySLUrqYnHT1rJVJK+1Mgvmhu1gbF4e1G4CzE8CPnxLApUn5VW6kdW6spsvV3pa0lWzV1HXO9esP8uI40xORXoq+f7H+gyTd/8VrTFsZWe+0c09fdlaTWN7GR3m70Z1A8cA8iiNieZ3Mt5DcczGwx1PJjRjddrOWrK132nZ//yfS3Sf2tvhmekSb72QurTXXnfE2u7f/mbjNfG5Y77tR5A/Z83dyM61zc/5muhgQRWFcFIX+KAZ/FoePojguiuIhowCA07I2JgtZciDvfsZV7vOyu3xidn8n82md+Znkwjo5M+CKbo+7otuHzG5/HHgG0rAcG7f7276s+j7e4f3QdsN6wYo/wguvN76Vy5tb27fXN1aetZ+1XxQKxZJ917bvFWQq6UZ3Qe4BAAzQ/4wda2D+H/sUHuvumFH1Fzs/KcjJU3kpHVmVheRug+QXBwOPmu37GcLCmFFrNkmT6RNeFkaM6v6T3OXQO25hZN29MRRP4F8CAICTMzcmD/+T/L8wZty9N5ePHh1n+57WBgAAjocOPljZ6CcrCEzzSb5czjvRolaB7z5SganUtDJepAN30fFqWjUDP/Jdvx4XHpuKDlXYajb9IFJVP1BNPzRLyfSBqvvo91A3HC8ybtisayfUyvW9yHEjVTGhq5qtb+omXNRBsnPY1K6pGteJjO+p0G8Frs4pFWrdV9FUtBeZqomLnmoGpuEEGfXYr7caWlV06AamGfnpAXttGa/qB43ksLnT/rABADgjNre2n690Ou1Xx1gY2HDmxLsKAAC6xmRpAAAAAAAAAAAAAAAAAAAAAABwBpzE/X8UznmhNxX0WYmHwhEUxl463hz7xQnAsfo7AAD//4jBUFA=") ioctl$AUTOFS_IOC_PROTOSUBVER(r4, 0x40049366, 0x0) 2m41.198137782s ago: executing program 5 (id=206): syz_io_uring_setup(0xeff, &(0x7f0000000000)={0x0, 0xfffffffb, 0x8, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000180)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100fb19ffff0000000001000000000000000c410000004c0014fffffff062726f6164636173742d6c696e6b"], 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_io_uring_modify_offsets$generic(r0, r1, 0x2c, 0x1000) r4 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r4, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) add_key$user(&(0x7f00000001c0), &(0x7f00000003c0)={'syz', 0x2}, &(0x7f0000000280)="c31d1d525994a2e14dccaddc815e82cef41595f6433f3bcf32317566dd5d34302e0619a42feb394365", 0x29, 0xfffffffffffffff9) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) 2m26.149905991s ago: executing program 32 (id=206): syz_io_uring_setup(0xeff, &(0x7f0000000000)={0x0, 0xfffffffb, 0x8, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000180)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), r2) sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100fb19ffff0000000001000000000000000c410000004c0014fffffff062726f6164636173742d6c696e6b"], 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_io_uring_modify_offsets$generic(r0, r1, 0x2c, 0x1000) r4 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r4, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) add_key$user(&(0x7f00000001c0), &(0x7f00000003c0)={'syz', 0x2}, &(0x7f0000000280)="c31d1d525994a2e14dccaddc815e82cef41595f6433f3bcf32317566dd5d34302e0619a42feb394365", 0x29, 0xfffffffffffffff9) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) 1m5.452158072s ago: executing program 0 (id=515): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) fanotify_mark(0xffffffffffffffff, 0x5, 0x4800003e, r0, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x2007, @fd_index=0x5, 0xc, 0x0, 0x0, 0x4, 0x1, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x7c65, 0xa334, 0x1, 0x0, 0x0) 1m4.277010848s ago: executing program 0 (id=516): r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$rtl8150(0x4, 0x3f, &(0x7f0000003c40)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) ioctl$EVIOCRMFF(r0, 0xc0085508, &(0x7f00000000c0)=0x2000018) 1m2.319920633s ago: executing program 0 (id=522): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x100, @ipv4={'\x00', '\xff\xff', @local}, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) 1m1.845945782s ago: executing program 0 (id=526): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f0000000b80), 0xfe, 0x54d, &(0x7f0000000400)="$eJzs3d9rW1UcAPDvTdv96nQdjKE+SGEPTubStfXHBB/mo+hwoO8ztHdlNFlGk461Dtwe3IsvMgQRB+If4LuPw3/Av2KggyGj6IMvkZvedNmatFmXrZn5fOC259x703NPzv2enpOTkACG1mT2oxDxakR8m0Qcajs2GvnByfXz1h5cm8u2JBqNz/5KIsn3tc5P8t/jeeaViPjt64gThc3l1lZWF0vlcrqU56fqlctTtZXVkxcrpYV0Ib00Mzt7+p3Zmfffe7dvdX3z3D8/fHrno9PfHFv7/pd7h28lcSYO5sfa6/EUrrdnJmMyf07G4sxjJ073obBBkuz2BbAjI3mcj0XWBxyKkTzqgf+/ryKiAQypRPzDkGqNA1pz+z7Ng18Y9z9cnwBtrv/o+msjsa85NzqwljwyM8rmuxN9KD8r49c/b9/Ktujf6xAA27p+IyJOjY5u7v+SvP/buVM9nPN4Gfo/eH7uZOOftzqNfwob45/oMP4Z7xC7O7F9/Bfu9aGYrrLx3wcdx78bi1YTI3nupeaYbyy5cLGcZn3byxFxPMb2Zvmt1nNOr91tdDvWPv7Ltqz81lgwv457o3sffcx8qV56mjq3u38j4rWO499ko/2TDu2fPR/neizjaHr79W7Htq//s9X4OeKNju3/cEUr2Xp9cqp5P0y17orN/r559Pdu5e92/bP2P7B1/SeS9vXa2pOX8dO+f9Nux3Z6/+9JPm+m9+T7rpbq9aXpiD3JJ5v3zzx8bCvfOj+r//FjW/d/ne7//RHxRY/1v3nkZtdTB6H955+o/Z88cffjL3/sVn5v7f92M3U839NL/9frBT7NcwcAAAAAAACDphARByMpFDfShUKxuP7+jiNxoFCu1uonLlSXL81H87OyEzFWaK10j7e9H2I6fz9sKz/zWH42Ig5HxHcj+5v54ly1PL/blQcAAAAAAAAAAAAAAAAAAIABMd7l8/+ZP0Z2++qAZ85XfsPw2jb++/FNT8BA8v8fhpf4h+El/mF4iX8YXuIfhpf4h+El/mF4iX8AAAAAAAAAAAAAAAAAAAAAAAAAAADoq3Nnz2ZbY+3BtbksP39lZXmxeuXkfFpbLFaW54pz1aXLxYVqdaGcFueqle3+XrlavTw9E8tXp+pprT5VW1k9X6kuX6qfv1gpLaTn07HnUisAAAAAAAAAAAAAAAAAAAB4sdRWVhdL5XK6JCGxo8ToYFyGRJ8Tu90zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBD/wUAAP//y284sw==") mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000009c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000000c0)='./bus\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x1a1) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0xd2f0, 0x2000, 0x8, 0xadea}) 1m0.584129788s ago: executing program 0 (id=530): r0 = socket$kcm(0x1e, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x80, 0x0}, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r1, 0x0, 0x0, 0x400123a0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) r2 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f00000008c0), 0x43) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r3, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) 54.246535083s ago: executing program 0 (id=547): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)="306663353a313232373a620afaf66563", 0x10) 53.67363842s ago: executing program 33 (id=547): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)="306663353a313232373a620afaf66563", 0x10) 7.67887513s ago: executing program 4 (id=672): r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000080)=0x6, 0x4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) sendmsg$tipc(r0, &(0x7f0000000c80)={0x0, 0x0, 0x0}, 0x0) connect$tipc(r0, &(0x7f00000000c0)=@name, 0x10) 7.534326097s ago: executing program 4 (id=673): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000400)='.\x00', 0xa4000021) socket$inet6_udp(0xa, 0x2, 0x0) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r1 = fsopen(&(0x7f0000000040)='cifs\x00', 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) io_uring_setup(0xf08, &(0x7f0000000780)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000580)=0xfffffff9) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0xf0, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x784, 0x4e23, 0x7, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d6, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0x40}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x8005}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 7.21023263s ago: executing program 2 (id=675): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x28100, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) io_setup(0x40, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, 0x0, 0x0, 0xffffffffffffff9c) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) prlimit64(0x0, 0x5, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioprio_set$pid(0x2, 0x0, 0x2000) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x64) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r2 = open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x0, 0x5, 0x1, 0x3, 0x4, {0x1, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0x2, 0x7}}, {0x0, 0x13}}}, 0xa0) sendfile(r2, r2, &(0x7f0000000080), 0x7f03) 5.946315467s ago: executing program 4 (id=678): socket(0x2, 0xa, 0x300) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)) sendmmsg(r1, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 5.863905623s ago: executing program 2 (id=679): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a4", 0x5}], 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) close(0x4) 5.56413096s ago: executing program 4 (id=680): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x80000100008f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, 0x0) ioctl$SW_SYNC_IOC_INC(r4, 0x40045701, &(0x7f00000002c0)=0x3) 5.443828581s ago: executing program 3 (id=681): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x100, @ipv4={'\x00', '\xff\xff', @local}, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, 0x0, 0x4040) 3.658646688s ago: executing program 4 (id=682): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x200000, &(0x7f0000000380), 0x3, 0x589, &(0x7f0000001580)="$eJzs3c1rHOUfAPDvbF76+vs1hVLUgwR6sFK7aRJfKgitR9FiQe91SbahZNMt2U1pYqHtwYJ4kSKIWBD/AO8eizcv+lcUtFCkBD14icxmtt1ks9kk3bqp8/nAtM8zz2yeeeaZ59nv7MyyAeTWaPpPIeLFiPgyiTjUUjYYWeHo6nbLj65PpUsSKysf/ZFEkq1rbp9k/x/IMi9ExE+fRZwotNdbW1yaLVUq5fksP1afuzJWW1w6eWmuNFOeKV+emJw8/cbkxNtvvdmztr56/q9vPrz33ukvji1//cODw3eSOBsHs7LWdjyFm62Z0RjNjslQnF234XgPKttNku1tPvys9oPtGcjG+VCkc8ChGMhGPfDfdyMiVoCcSox/yKlmHNC8tu/RdfBz4+G7qxdA7e0fXP1sJPY2ro32LydrrozS692RHtSf1vHj73fvpEt0+RziRg/qA2i6eSsiTg0Ots9/STb/7dypxofHm1tfR97ef6Cf7qXxz2sbxT+Fx/FPbBD/HNhg7O5E9/FfeNCDajpK4793Nox/H09dIwNZ7n+NmG8ouXipUj4VEf+PiOMxtCfNb3Y/5/Ty/ZVOZa3xX7qk9TdjwWw/HgzuWfua6VK99DRtbvXwVsRLT+LfJNrm/72NWHd9/6fH43ya+OXzrnUcLd99uVNZ9/a36n0EvPJ9xCsb9v+TO1rJ5vcnxxrnw1jzrGj35+2jv3aqf3vt7720//dv3v6RpPV+bW37dXy39+9yp7Kdnv/DyceNdPNG4rVSvT4/HjGcfNC+fuLJa5v55vZp+48f23z+2+j83xcRn2yx/beP3O646W7o/+lt9f/2E/ff//TbTvVvrf9fb6SOZ2u2Mv9tdQef5tgBAAAAAADAblOIiIORFIqP04VCsbj6fMeR2F+oVGv1ExerC5eno/Fd2ZEYKjTvdB9qeR5iPHsetpmfWJefjIjDEfHVwL5GvjhVrUz3u/EAAAAAAAAAAAAAAAAAAACwSxzo8P3/1G8D/d474Jnzk9+QX13Hfy9+6QnYlbz/Q34Z/5Bfxj/kl/EP+WX8Q34Z/5Bfxj/kl/EPAAAAAAAAAAAAAAAAAAAAAAAAAAAAPXX+3Ll0WVl+dH0qzU9fXVyYrV49OV2uzRbnFqaKU9X5K8WZanWmUi5OVee6/b1KtXplfCIWro3Vy7X6WG1x6cJcdeFy/cKludJM+UJ56F9pFQAAAAAAAAAAAAAAAAAAADxfaotLs6VKpTzfj8TPhYj+1b7lxJnYFbux40TSrZfPZCfD2qLhtjVrEpElBp/VzicR0e9Dl+NEnycmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGjxTwAAAP///b4wHA==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) setpgid(r0, r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fspick(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x11, 0x4, 0x4, 0x9}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0d00000004000000040000000100000000000000", @ANYRES32=r1, @ANYRES32=0x0], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r2}, &(0x7f0000000840), &(0x7f0000000880)=r1}, 0x20) 3.320663048s ago: executing program 3 (id=684): r0 = socket$unix(0x1, 0x5, 0x0) close(r0) socket$nl_netfilter(0x10, 0x3, 0xc) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x83, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x9, 0x20002, 0x7, 0x5, 0x8006, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x4, 0x5, 0x5, 0x3e, 0x18e, 0x5, 0x0, 0x454f, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5302, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0xa, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x3, 0x7fff, 0x6, 0x400, 0x9, 0x6, 0x1, 0xff, 0xd9ef, 0xfffff57d, 0x5f31, 0xd, 0x9, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x1, 0x6, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x13, 0x3, 0x4000009, 0x6, 0x4000000, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x4, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x8002, 0x0, 0x9, 0xb, 0x4, 0x45, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0x2, 0x2, 0x400003, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa6, 0x4, 0xa9, 0xff, 0x0, 0xac8, 0xbf, 0x2000002, 0x80, 0x7ff, 0x12b, 0x1, 0xc921, 0xa, 0xffffffff, 0x4, 0x2, 0x120000, 0x807ff, 0x2006, 0x80a2ed, 0x1, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x1938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x6, 0x57, 0x0, 0x3, 0x2, 0x40, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x7, 0xffffffff, 0x80000000, 0x10000, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x961e, 0x7, 0xaf, 0x20000008, 0x3, 0x226, 0x2, 0x70d0, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0xf1, 0x803, 0xd7, 0x200, 0xfffffffa, 0xfff]}, 0x45c) syz_io_uring_setup(0xd3a, &(0x7f0000000080)={0x0, 0x2, 0x3010, 0x3, 0x3}, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000040)=0x10009, 0x4) ppoll(&(0x7f00000000c0)=[{}], 0x1, 0x0, 0x0, 0x0) 3.124463949s ago: executing program 1 (id=685): r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f00000005c0)) 2.926383284s ago: executing program 1 (id=686): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x3, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000080)={r2, 0x20005}, &(0x7f0000000100)=0x8) 2.728755925s ago: executing program 1 (id=687): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x1, 0x207a8ab9, 0x1000000000000008}) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r3, &(0x7f00000000c0)={0x2, 0x20, @remote}, 0x10) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/crypto\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x4000000000010046) 2.35317088s ago: executing program 2 (id=688): syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x20, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$PIO_UNISCRNMAP(r2, 0x4b6a, &(0x7f00000005c0)="943e047401") connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000004fa000000000000825b440018000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000018000007b8a08ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000a6000000850000000700000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.683968119s ago: executing program 3 (id=689): r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000400)='.\x00', 0xa4000021) socket$inet6_udp(0xa, 0x2, 0x0) pselect6(0x40, &(0x7f0000000000)={0xa, 0x80000001, 0x2, 0x10000000000006, 0x12, 0x8, 0x80000000, 0x8}, 0x0, 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) r1 = fsopen(&(0x7f0000000040)='cifs\x00', 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) io_uring_setup(0xf08, &(0x7f0000000780)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000580)=0xfffffff9) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0xf0, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x784, 0x4e23, 0x7, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d6, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0x40}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0) execve(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 1.533652666s ago: executing program 1 (id=690): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x6, @loopback, 0x3}, 0x1c) shutdown(r0, 0x0) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r0, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000040)}}], 0x1, 0x8015) close(0x3) 1.328188347s ago: executing program 1 (id=691): socket$nl_netfilter(0x10, 0x3, 0xc) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x1000010, &(0x7f0000002080)=ANY=[@ANYBLOB='shortname=winnt,nonumtail=0,shortname=win95,uni_xlate=1,iocharset=koi8-r\x00~tf8=1,shortname=winnt,iocharset=cp936,shortname=winy5,rodir,utf8=1,uni_xlate=1,nonumtail=0,shortname=lower,iocharset=macgreek,shortname=lower,\x00'], 0x7, 0x2a6, &(0x7f0000000740)="$eJzs3c2KI1UUAOBT+ekkukgWrkSYAl24GqZ9gm5kBLVBULJQF9o4GZBUGOhAIK0YZ+UT+AQ+jxtx6cYHUNw5C7GkUpWYzFR6TDvTPTTft+nDuffU/amia1U3n782Gd97ML3/8Otfo9tNonEUR/EoiUE0YuXbqPXz7/V5AOAF9yjP44+81ClT8+0e7R2VrcZznxwA8Fxsvv+3GrzdAeDG+ujjT94/Pjm5+2GadiMm382GSZR/y/bj+/FlZDGKO9GPvyLytTJ+592Tu9FKC4N4Y7KYDYvKyWc/Vtc//i1iWX8Y/RjU1x+mpY36xWzYjpeq8Y+yGH3wQ/TjlaLml/dWc1/Vv1VTH8ODePP1jfnfjn789EU8iCzuPVb/zWGavp1//+dXnxbZoj5ZzIaddb+qd/Oq7gkAAAAAAAAAAAAAAAAAAAAAADff7XRtsH3+zurg/wvanzwfqLc64Gexcb7PnTRN86Ts/299K15tRes61w4AAAAAAAAAAAAAAAAAAAAviun8fHya9SJiGWSjszKTzSNiO7NHsPqsv6Yp/t7OdCLiMkOUwa19q6JZTS1LiiW347+Xt6OzrHx65+aeqyi2PxudJa247IY/GSTrTK8MohFxNr0V5VhFplcGG5n/PXo3yrEq49PkaTe3W/eQPIMgr3n8mjurDh7P9KoV1HTuXTD6wcuXmnPe39GURER7vZkXX6f9bPfw6v4HAQAAAAAAAAAAAAAAAAAApen8fNxYfvRb0/jwGiYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANdgOj8fny5//3+PYFEV7+qTN4ugFVWmZtiDK14mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN9w/AQAA//8XQlpx") r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x400034f, 0x2, 0x0) ptrace$cont(0x9, r1, 0xffd3, 0x0) semget(0xffffffffffffffff, 0x8, 0x0) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) 1.144431289s ago: executing program 3 (id=692): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000700)='\x00\x00\x00\x00\x00', 0x5) 834.218468ms ago: executing program 1 (id=693): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) 772.029283ms ago: executing program 2 (id=694): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x100, @ipv4={'\x00', '\xff\xff', @local}, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4040) 509.722049ms ago: executing program 3 (id=695): r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000080)=0x6, 0x4) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) sendmsg$tipc(r0, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0) connect$tipc(r0, 0x0, 0x0) 452.672974ms ago: executing program 2 (id=696): r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f00000005c0)="943e04") 405.138176ms ago: executing program 4 (id=697): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x195d, 0xec4d2770249a3ef5) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/address_bits', 0x82803, 0x8e) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x6, 0x4000000000000ffd, 0x0, 0x0, 0x1d, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5d69098c8b534464c516bdd8a0f350000e35abdb80e38f5eb010001", "32d8cc263d9e234b30c50997d3bef4cd4a5d83cdd3dfe7800b2d7b6aa54cc5001fcaed1e831fa79a0000000200", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x8, 0x5]}}) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x9, 0x5, 0x0, 0xa, 0x4, 0x4, "04faff43988070726799ee0963f16444682397eefa4d7e888b952206c2bfc848eded6fe7d7cdd4ded4b95467b72de233256be82914dbed99d6a8ae21fb6979b2", "18eaae41e3686d89cb2f9e3e283522565d05a55e164195387d5be4e16121c07b5731cbd7b7323739a91012a92b03fe986f56ab5aa3f908e5e07c1f4461d0eea8", "c5bc3fc60633e97e9985d57ffb9811d6297f37cc866a71b5da7ece7fdd4e9ca7", [0xd38, 0x1]}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 355.966012ms ago: executing program 2 (id=698): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a4", 0x5}], 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) close(0x4) 0s ago: executing program 3 (id=699): openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x1c3040, 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r1, &(0x7f0000000c40)=ANY=[], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000140)=[0x5], 0x0, 0x0, 0x1, 0x1}}, 0x40) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x12, r0, 0x0) kernel console output (not intermixed with test programs): 86123256.130:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6749 comm="syz.0.157" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3654f9e0d9 code=0x7fc00000 [ 175.588576][ T5614] ocfs2: Unmounting device (7,4) on (node local) [ 175.680152][ T5621] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 175.764973][ T6782] bridge0: port 3(ip6gretap0) entered blocking state [ 175.810640][ T6782] bridge0: port 3(ip6gretap0) entered disabled state [ 175.851558][ T6782] ip6gretap0: entered allmulticast mode [ 175.880947][ T6782] ip6gretap0: entered promiscuous mode [ 175.903427][ T6782] bridge0: port 3(ip6gretap0) entered blocking state [ 175.911105][ T6782] bridge0: port 3(ip6gretap0) entered forwarding state [ 177.153187][ T6799] loop2: detected capacity change from 0 to 512 [ 177.196003][ T6799] EXT4-fs: Ignoring removed bh option [ 177.262286][ T6799] EXT4-fs error (device loop2): ext4_iget_extra_inode:5180: inode #15: comm syz.2.167: corrupted in-inode xattr: e_value size too large [ 177.303006][ T6799] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 177.312383][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 177.327990][ C0] EXT4-fs (loop2): initial error at time 1786123260: ext4_iget_extra_inode:5180: inode 15 [ 177.337980][ C0] EXT4-fs (loop2): last error at time 1786123260: ext4_iget_extra_inode:5180: inode 15 [ 177.424263][ T6808] netlink: 4 bytes leftover after parsing attributes in process `syz.0.169'. [ 177.462627][ T6799] EXT4-fs error (device loop2): ext4_orphan_get:1404: comm syz.2.167: couldn't read orphan inode 15 (err -117) [ 177.503449][ T6799] loop2: lost filesystem error report for type 5 error -117 [ 177.527237][ T6799] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 177.720844][ T5604] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 178.374923][ T6793] loop3: detected capacity change from 0 to 32768 [ 178.471854][ T6793] btrfs: Deprecated parameter 'usebackuproot' [ 178.542052][ T6793] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 178.873203][ T6793] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.164 (6793) [ 179.501570][ T6826] loop1: detected capacity change from 0 to 32768 [ 179.509292][ T6826] btrfs: Deprecated parameter 'usebackuproot' [ 179.515512][ T6826] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 179.586596][ T6822] loop5: detected capacity change from 0 to 40427 [ 179.597099][ T6822] F2FS-fs (loop5): build fault injection rate: 174 [ 179.603775][ T6822] F2FS-fs (loop5): build fault injection type: 0x3bfe8c [ 179.612621][ T6826] BTRFS info: device /dev/loop1 (7:1) using temp-fsid 1a51bc50-a1e0-44a4-9cfb-6a3567fd7200 [ 179.622818][ T6826] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.175 (6826) [ 179.637949][ T6822] F2FS-fs (loop5): invalid crc value [ 179.645139][ T6793] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 179.645301][ T6826] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 179.655471][ T6793] BTRFS info (device loop3): using crc32c checksum algorithm [ 179.673067][ T6826] BTRFS info (device loop1): using crc32c checksum algorithm [ 179.751878][ T6822] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 179.764914][ T6822] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 179.825761][ T6793] workqueue: Failed to create a rescuer kthread for wq "btrfs-delalloc": -EINTR [ 179.864069][ T6793] workqueue: Failed to create a rescuer kthread for wq "btrfs-flush_delalloc": -EINTR [ 179.940993][ T6793] workqueue: Failed to create a rescuer kthread for wq "btrfs-cache": -EINTR [ 179.997300][ T5606] syz-executor: attempt to access beyond end of device [ 179.997300][ T5606] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 180.023277][ T6793] workqueue: Failed to create a rescuer kthread for wq "btrfs-fixup": -EINTR [ 180.023575][ T6793] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio": -EINTR [ 180.071503][ T6848] FAULT_INJECTION: forcing a failure. [ 180.071503][ T6848] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 180.096343][ T6848] CPU: 0 UID: 0 PID: 6848 Comm: syz.2.178 Not tainted syzkaller #0 PREEMPT(full) [ 180.096376][ T6848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 180.096391][ T6848] Call Trace: [ 180.096401][ T6848] [ 180.096410][ T6848] dump_stack_lvl+0xe8/0x150 [ 180.096449][ T6848] should_fail_ex+0x40c/0x560 [ 180.096484][ T6848] _copy_from_user+0x2d/0xb0 [ 180.096522][ T6848] snd_rawmidi_kernel_write1+0x3ad/0x640 [ 180.096578][ T6848] snd_rawmidi_write+0x5b6/0xbc0 [ 180.096634][ T6848] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 180.096681][ T6848] ? __pfx_default_wake_function+0x10/0x10 [ 180.096713][ T6848] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.096741][ T6848] ? apparmor_file_permission+0x1f4/0x300 [ 180.096778][ T6848] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.096806][ T6848] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.096835][ T6848] ? security_file_permission+0x75/0x260 [ 180.096870][ T6848] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.096898][ T6848] ? rw_verify_area+0x203/0x4c0 [ 180.096938][ T6848] ? __pfx_snd_rawmidi_write+0x10/0x10 [ 180.096976][ T6848] vfs_write+0x296/0xba0 [ 180.097023][ T6848] ? __pfx_vfs_write+0x10/0x10 [ 180.097058][ T6848] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.097089][ T6848] ? __fget_files+0x2a/0x420 [ 180.097125][ T6848] ? __fget_files+0x2a/0x420 [ 180.097154][ T6848] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.097182][ T6848] ? __fget_files+0x3a2/0x420 [ 180.097214][ T6848] ? __fget_files+0x2a/0x420 [ 180.097250][ T6848] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.097289][ T6848] ksys_write+0x150/0x270 [ 180.097330][ T6848] ? __pfx_ksys_write+0x10/0x10 [ 180.097377][ T6848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.097405][ T6848] do_syscall_64+0x174/0x580 [ 180.097438][ T6848] ? trace_irq_disable+0x3b/0x140 [ 180.097474][ T6848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.097499][ T6848] RIP: 0033:0x7f4ab4d9e0d9 [ 180.097522][ T6848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 180.097542][ T6848] RSP: 002b:00007f4ab5c78028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 180.097567][ T6848] RAX: ffffffffffffffda RBX: 00007f4ab5025fa0 RCX: 00007f4ab4d9e0d9 [ 180.097586][ T6848] RDX: 00000000fffffd2c RSI: 0000200000000000 RDI: 0000000000000004 [ 180.097603][ T6848] RBP: 00007f4ab5c78090 R08: 0000000000000000 R09: 0000000000000000 [ 180.097618][ T6848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 180.097633][ T6848] R13: 00007f4ab5026038 R14: 00007f4ab5025fa0 R15: 00007ffcd6ad8fe8 [ 180.097679][ T6848] [ 180.514828][ T5606] CPU: 1 UID: 0 PID: 5606 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 180.514859][ T5606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 180.514874][ T5606] Call Trace: [ 180.514884][ T5606] [ 180.514893][ T5606] dump_stack_lvl+0xe8/0x150 [ 180.514933][ T5606] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 180.514969][ T5606] f2fs_write_end_io+0x124b/0x1710 [ 180.515027][ T5606] __submit_merged_bio+0x258/0x6a0 [ 180.515054][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515084][ T5606] ? rcu_is_watching+0x15/0xb0 [ 180.515127][ T5606] __submit_merged_write_cond+0x3c9/0x4e0 [ 180.515174][ T5606] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 180.515217][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515256][ T5606] f2fs_write_data_pages+0x2a27/0x36f0 [ 180.515289][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515318][ T5606] ? __lock_acquire+0x683/0x2cf0 [ 180.515389][ T5606] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 180.515420][ T5606] ? is_bpf_text_address+0x26/0x2b0 [ 180.515468][ T5606] ? arch_stack_walk+0xfb/0x150 [ 180.515539][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515567][ T5606] ? add_lock_to_list+0xc7/0x100 [ 180.515606][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515635][ T5606] ? __lock_acquire+0x13e8/0x2cf0 [ 180.515697][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515725][ T5606] ? do_raw_spin_lock+0x12b/0x2f0 [ 180.515758][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515791][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515820][ T5606] ? do_raw_spin_unlock+0xf5/0x210 [ 180.515847][ T5606] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 180.515882][ T5606] do_writepages+0x338/0x560 [ 180.515918][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515949][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.515982][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.516010][ T5606] ? do_raw_spin_unlock+0xf5/0x210 [ 180.516042][ T5606] filemap_fdatawrite+0x1e9/0x2f0 [ 180.516082][ T5606] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 180.516165][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.516196][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.516231][ T5606] ? do_raw_spin_unlock+0xf5/0x210 [ 180.516263][ T5606] f2fs_sync_dirty_inodes+0x30e/0x830 [ 180.516315][ T5606] f2fs_write_checkpoint+0xa3d/0x2710 [ 180.516350][ T5606] ? __lock_acquire+0x683/0x2cf0 [ 180.516417][ T5606] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 180.516449][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.516537][ T5606] kill_f2fs_super+0x2f6/0x700 [ 180.516580][ T5606] ? __pfx_kill_f2fs_super+0x10/0x10 [ 180.516629][ T5606] ? call_rcu+0x64b/0x8b0 [ 180.516664][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.516693][ T5606] ? lockdep_hardirqs_on+0x7a/0x110 [ 180.516726][ T5606] ? srso_alias_return_thunk+0x5/0xfbef5 [ 180.516769][ T5606] deactivate_locked_super+0xbc/0x130 [ 180.516807][ T5606] cleanup_mnt+0x3d3/0x460 [ 180.516850][ T5606] task_work_run+0x1d9/0x270 [ 180.516891][ T5606] ? __pfx_task_work_run+0x10/0x10 [ 180.516939][ T5606] exit_to_user_mode_loop+0x1fa/0x730 [ 180.516971][ T5606] ? rcu_is_watching+0x15/0xb0 [ 180.517009][ T5606] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.517036][ T5606] do_syscall_64+0x353/0x580 [ 180.517069][ T5606] ? trace_irq_disable+0x3b/0x140 [ 180.517106][ T5606] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 180.517131][ T5606] RIP: 0033:0x7fbdc619f317 [ 180.517157][ T5606] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 180.517178][ T5606] RSP: 002b:00007ffef98eddb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 180.517203][ T5606] RAX: 0000000000000000 RBX: 00007fbdc6234474 RCX: 00007fbdc619f317 [ 180.517220][ T5606] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffef98ede70 [ 180.517235][ T5606] RBP: 00007ffef98ede70 R08: 00007ffef98eee70 R09: 00000000ffffffff [ 180.517252][ T5606] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffef98eef00 [ 180.517267][ T5606] R13: 00007fbdc6234474 R14: 000000000002be3b R15: 00007ffef98eef40 [ 180.517304][ T5606] [ 180.519828][ T5606] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 180.705891][ T6793] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-meta": -EINTR [ 181.047658][ T6793] workqueue: Failed to create a rescuer kthread for wq "btrfs-rmw": -EINTR [ 181.130464][ T37] BTRFS warning (device loop1): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 181.150294][ T6793] workqueue: Failed to create a rescuer kthread for wq "btrfs-freespace-write": -EINTR [ 181.167159][ T6793] workqueue: Failed to create a rescuer kthread for wq "btrfs-qgroup-rescan": -EINTR [ 181.205881][ T6826] BTRFS error (device loop1): failed to load root extent [ 181.222571][ T6826] BTRFS warning (device loop1): try to load backup roots slot 1 [ 181.232955][ T5877] BTRFS warning (device loop1): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 181.261895][ T6826] BTRFS warning (device loop1): couldn't read tree root [ 181.269815][ T6826] BTRFS warning (device loop1): try to load backup roots slot 2 [ 181.290926][ T6793] BTRFS error (device loop3): open_ctree failed: -12 [ 181.302882][ T13] BTRFS error (device loop1): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 181.336704][ T6826] BTRFS warning (device loop1): couldn't read tree root [ 181.342543][ T24] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 181.343731][ T6826] BTRFS warning (device loop1): try to load backup roots slot 3 [ 181.383723][ T6826] BTRFS info (device loop1): rebuilding free space tree [ 181.409701][ T6826] BTRFS info (device loop1): checking UUID tree [ 181.416427][ T6826] BTRFS info (device loop1): enabling ssd optimizations [ 181.423433][ T6826] BTRFS info (device loop1): turning on async discard [ 181.430198][ T6826] BTRFS info (device loop1): enabling free space tree [ 181.437006][ T6826] BTRFS info (device loop1): force clearing of disk cache [ 181.444255][ T6826] BTRFS info (device loop1): enabling auto defrag [ 181.450675][ T6826] BTRFS info (device loop1): trying to use backup root at mount time [ 181.458797][ T6826] BTRFS info (device loop1): use zstd compression, level 3 [ 181.524351][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 181.547606][ T24] usb 3-1: config 16 has an invalid interface number: 113 but max is 0 [ 181.597014][ T24] usb 3-1: config 16 has no interface number 0 [ 181.623897][ T24] usb 3-1: config 16 interface 113 altsetting 9 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 182.466316][ T24] usb 3-1: config 16 interface 113 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 182.471260][ T6885] loop4: detected capacity change from 0 to 512 [ 182.477872][ T24] usb 3-1: config 16 interface 113 has no altsetting 0 [ 182.480533][ T24] usb 3-1: New USB device found, idVendor=19d2, idProduct=ff4f, bcdDevice=6b.e5 [ 182.507383][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.515470][ T24] usb 3-1: Product: syz [ 182.519639][ T24] usb 3-1: Manufacturer: syz [ 182.524324][ T24] usb 3-1: SerialNumber: syz [ 182.568270][ T6885] EXT4-fs: Ignoring removed bh option [ 182.589313][ T5605] BTRFS info (device loop1): last unmount of filesystem 1a51bc50-a1e0-44a4-9cfb-6a3567fd7200 [ 182.635408][ T6885] EXT4-fs error (device loop4): ext4_iget_extra_inode:5180: inode #15: comm syz.4.183: corrupted in-inode xattr: e_value size too large [ 182.670076][ T6885] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 182.672395][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 182.687997][ C1] EXT4-fs (loop4): initial error at time 1786123265: ext4_iget_extra_inode:5180: inode 15 [ 182.697941][ C1] EXT4-fs (loop4): last error at time 1786123265: ext4_iget_extra_inode:5180: inode 15 [ 182.715204][ T6885] EXT4-fs error (device loop4): ext4_orphan_get:1404: comm syz.4.183: couldn't read orphan inode 15 (err -117) [ 182.741135][ T6885] loop4: lost filesystem error report for type 5 error -117 [ 182.780961][ T6885] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 182.892115][ T24] option 3-1:16.113: GSM modem (1-port) converter detected [ 182.935019][ T6893] FAULT_INJECTION: forcing a failure. [ 182.935019][ T6893] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 183.027427][ T24] usb 3-1: USB disconnect, device number 2 [ 183.030067][ T5614] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 183.044120][ T6893] CPU: 1 UID: 0 PID: 6893 Comm: syz.0.186 Not tainted syzkaller #0 PREEMPT(full) [ 183.044148][ T6893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 183.044168][ T6893] Call Trace: [ 183.044178][ T6893] [ 183.044188][ T6893] dump_stack_lvl+0xe8/0x150 [ 183.044227][ T6893] should_fail_ex+0x40c/0x560 [ 183.044261][ T6893] _copy_to_user+0x31/0xb0 [ 183.044300][ T6893] copy_siginfo_to_user+0x22/0xc0 [ 183.044331][ T6893] x64_setup_rt_frame+0x764/0xc50 [ 183.044388][ T6893] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 183.044431][ T6893] arch_do_signal_or_restart+0x456/0x860 [ 183.044467][ T6893] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 183.044507][ T6893] ? ksys_read+0x242/0x270 [ 183.044554][ T6893] exit_to_user_mode_loop+0x104/0x730 [ 183.044587][ T6893] ? rcu_is_watching+0x15/0xb0 [ 183.044629][ T6893] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.044657][ T6893] do_syscall_64+0x353/0x580 [ 183.044690][ T6893] ? trace_irq_disable+0x3b/0x140 [ 183.044727][ T6893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.044752][ T6893] RIP: 0033:0x7f3654f9e0d7 [ 183.044774][ T6893] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 [ 183.044795][ T6893] RSP: 002b:00007f3655d87028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 183.044820][ T6893] RAX: 0000000000000000 RBX: 00007f3655225fa0 RCX: 00007f3654f9e0d9 [ 183.044837][ T6893] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 183.044852][ T6893] RBP: 00007f3655d87090 R08: 0000000000000000 R09: 0000000000000000 [ 183.044868][ T6893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 183.044883][ T6893] R13: 00007f3655226038 R14: 00007f3655225fa0 R15: 00007ffcd762b8e8 [ 183.044921][ T6893] [ 183.293038][ T24] option 3-1:16.113: device disconnected [ 184.036428][ T6903] loop4: detected capacity change from 0 to 40427 [ 184.072837][ T6903] F2FS-fs (loop4): build fault injection rate: 174 [ 184.080090][ T6903] F2FS-fs (loop4): build fault injection type: 0x3bfe8c [ 184.089995][ T6903] F2FS-fs (loop4): invalid crc value [ 184.093355][ T29] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 184.179033][ T6903] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 184.206026][ T6903] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 184.334675][ T6903] F2FS-fs (loop4): inject inconsistent footer in f2fs_sanity_check_node_footer of __get_node_folio+0x8c1/0xdf0 [ 184.347704][ T6903] F2FS-fs (loop4): inconsistent node block, node_type:1, nid:10, node_footer[nid:10,ino:10,ofs:0,cpver:0,blkaddr:0] [ 184.427390][ T6906] loop2: detected capacity change from 0 to 40427 [ 184.532534][ T29] usb 1-1: Using ep0 maxpacket: 16 [ 184.558114][ T6906] F2FS-fs (loop2): build fault injection rate: 174 [ 184.567773][ T6906] F2FS-fs (loop2): build fault injection type: 0x3bfe8c [ 184.583279][ T6906] F2FS-fs (loop2): invalid crc value [ 185.199266][ T29] usb 1-1: unable to get BOS descriptor or descriptor too short [ 185.229321][ T29] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 185.250093][ T29] usb 1-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 185.317243][ T5614] syz-executor: attempt to access beyond end of device [ 185.317243][ T5614] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 185.353720][ T6906] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 185.373766][ T29] usb 1-1: config 1 interface 2 has no altsetting 0 [ 185.394725][ T29] usb 1-1: New USB device found, idVendor=2a39, idProduct=3fd2, bcdDevice= 0.40 [ 185.405378][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.423007][ T6921] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 185.440921][ T6921] netlink: 8 bytes leftover after parsing attributes in process `syz.3.191'. [ 185.449846][ T6921] IPv6: NLM_F_CREATE should be specified when creating new route [ 185.536304][ T5614] CPU: 1 UID: 0 PID: 5614 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 185.536339][ T5614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 185.536355][ T5614] Call Trace: [ 185.536365][ T5614] [ 185.536375][ T5614] dump_stack_lvl+0xe8/0x150 [ 185.536418][ T5614] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 185.536454][ T5614] f2fs_write_end_io+0x124b/0x1710 [ 185.536512][ T5614] __submit_merged_bio+0x258/0x6a0 [ 185.536539][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.536569][ T5614] ? rcu_is_watching+0x15/0xb0 [ 185.536612][ T5614] __submit_merged_write_cond+0x3c9/0x4e0 [ 185.536657][ T5614] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 185.536701][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.536740][ T5614] f2fs_write_data_pages+0x2a27/0x36f0 [ 185.536772][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.536801][ T5614] ? __lock_acquire+0x683/0x2cf0 [ 185.536873][ T5614] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 185.536904][ T5614] ? is_bpf_text_address+0x26/0x2b0 [ 185.536953][ T5614] ? arch_stack_walk+0xfb/0x150 [ 185.537025][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537054][ T5614] ? add_lock_to_list+0xc7/0x100 [ 185.537094][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537122][ T5614] ? __lock_acquire+0x13e8/0x2cf0 [ 185.537185][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537213][ T5614] ? do_raw_spin_lock+0x12b/0x2f0 [ 185.537246][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537279][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537308][ T5614] ? do_raw_spin_unlock+0xf5/0x210 [ 185.537335][ T5614] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 185.537371][ T5614] do_writepages+0x338/0x560 [ 185.537407][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537438][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537471][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537499][ T5614] ? do_raw_spin_unlock+0xf5/0x210 [ 185.537530][ T5614] filemap_fdatawrite+0x1e9/0x2f0 [ 185.537570][ T5614] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 185.537651][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537682][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.537716][ T5614] ? do_raw_spin_unlock+0xf5/0x210 [ 185.537748][ T5614] f2fs_sync_dirty_inodes+0x30e/0x830 [ 185.537801][ T5614] f2fs_write_checkpoint+0xa3d/0x2710 [ 185.537836][ T5614] ? __lock_acquire+0x683/0x2cf0 [ 185.537904][ T5614] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 185.537938][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.538028][ T5614] kill_f2fs_super+0x2f6/0x700 [ 185.538070][ T5614] ? __pfx_kill_f2fs_super+0x10/0x10 [ 185.538118][ T5614] ? call_rcu+0x64b/0x8b0 [ 185.538154][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.538182][ T5614] ? lockdep_hardirqs_on+0x7a/0x110 [ 185.538215][ T5614] ? srso_alias_return_thunk+0x5/0xfbef5 [ 185.538259][ T5614] deactivate_locked_super+0xbc/0x130 [ 185.538297][ T5614] cleanup_mnt+0x3d3/0x460 [ 185.538341][ T5614] task_work_run+0x1d9/0x270 [ 185.538382][ T5614] ? __pfx_task_work_run+0x10/0x10 [ 185.538431][ T5614] exit_to_user_mode_loop+0x1fa/0x730 [ 185.538463][ T5614] ? rcu_is_watching+0x15/0xb0 [ 185.538501][ T5614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.538529][ T5614] do_syscall_64+0x353/0x580 [ 185.538561][ T5614] ? trace_irq_disable+0x3b/0x140 [ 185.538598][ T5614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.538623][ T5614] RIP: 0033:0x7f9e7539f317 [ 185.538650][ T5614] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 185.538671][ T5614] RSP: 002b:00007ffe005e8a18 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 185.538696][ T5614] RAX: 0000000000000000 RBX: 00007f9e75434474 RCX: 00007f9e7539f317 [ 185.538714][ T5614] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe005e8ad0 [ 185.538730][ T5614] RBP: 00007ffe005e8ad0 R08: 00007ffe005e9ad0 R09: 00000000ffffffff [ 185.538748][ T5614] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe005e9b60 [ 185.538764][ T5614] R13: 00007f9e75434474 R14: 000000000002d297 R15: 00007ffe005e9ba0 [ 185.538802][ T5614] [ 185.539025][ T6906] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 185.842779][ T5614] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 185.877512][ T29] usb 1-1: Product: syz [ 186.087925][ T29] usb 1-1: Manufacturer: syz [ 186.094364][ T29] usb 1-1: SerialNumber: syz [ 186.121365][ T29] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 186.142716][ T24] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 186.203413][ T5771] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 186.213035][ T5604] syz-executor: attempt to access beyond end of device [ 186.213035][ T5604] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 186.219907][ T6926] loop3: detected capacity change from 0 to 512 [ 186.292680][ T24] usb 6-1: device descriptor read/64, error -71 [ 186.308492][ T5604] CPU: 0 UID: 0 PID: 5604 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 186.308523][ T5604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 186.308538][ T5604] Call Trace: [ 186.308548][ T5604] [ 186.308558][ T5604] dump_stack_lvl+0xe8/0x150 [ 186.308597][ T5604] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 186.308634][ T5604] f2fs_write_end_io+0x124b/0x1710 [ 186.308698][ T5604] __submit_merged_bio+0x258/0x6a0 [ 186.308726][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.308755][ T5604] ? rcu_is_watching+0x15/0xb0 [ 186.308799][ T5604] __submit_merged_write_cond+0x3c9/0x4e0 [ 186.308839][ T5604] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 186.308883][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.308920][ T5604] f2fs_write_data_pages+0x2a27/0x36f0 [ 186.308953][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.308981][ T5604] ? __lock_acquire+0x683/0x2cf0 [ 186.309052][ T5604] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 186.309083][ T5604] ? is_bpf_text_address+0x26/0x2b0 [ 186.309131][ T5604] ? arch_stack_walk+0xfb/0x150 [ 186.309201][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309231][ T5604] ? add_lock_to_list+0xc7/0x100 [ 186.309270][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309305][ T5604] ? __lock_acquire+0x13e8/0x2cf0 [ 186.309368][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309415][ T5604] ? do_raw_spin_lock+0x12b/0x2f0 [ 186.309447][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309480][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309509][ T5604] ? do_raw_spin_unlock+0xf5/0x210 [ 186.309537][ T5604] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 186.309572][ T5604] do_writepages+0x338/0x560 [ 186.309608][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309646][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309680][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309709][ T5604] ? do_raw_spin_unlock+0xf5/0x210 [ 186.309742][ T5604] filemap_fdatawrite+0x1e9/0x2f0 [ 186.309782][ T5604] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 186.309858][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309891][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.309924][ T5604] ? do_raw_spin_unlock+0xf5/0x210 [ 186.309957][ T5604] f2fs_sync_dirty_inodes+0x30e/0x830 [ 186.310013][ T5604] f2fs_write_checkpoint+0xa3d/0x2710 [ 186.310047][ T5604] ? __lock_acquire+0x683/0x2cf0 [ 186.310115][ T5604] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 186.310149][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.310238][ T5604] kill_f2fs_super+0x2f6/0x700 [ 186.310280][ T5604] ? __pfx_kill_f2fs_super+0x10/0x10 [ 186.310328][ T5604] ? call_rcu+0x64b/0x8b0 [ 186.310364][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.310393][ T5604] ? lockdep_hardirqs_on+0x7a/0x110 [ 186.310426][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 186.310470][ T5604] deactivate_locked_super+0xbc/0x130 [ 186.310508][ T5604] cleanup_mnt+0x3d3/0x460 [ 186.310554][ T5604] task_work_run+0x1d9/0x270 [ 186.310593][ T5604] ? __pfx_task_work_run+0x10/0x10 [ 186.310647][ T5604] exit_to_user_mode_loop+0x1fa/0x730 [ 186.310680][ T5604] ? rcu_is_watching+0x15/0xb0 [ 186.310717][ T5604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.310742][ T5604] do_syscall_64+0x353/0x580 [ 186.310774][ T5604] ? trace_irq_disable+0x3b/0x140 [ 186.310812][ T5604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 186.310838][ T5604] RIP: 0033:0x7f4ab4d9f317 [ 186.310859][ T5604] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 186.310878][ T5604] RSP: 002b:00007ffcd6ad8258 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 186.310903][ T5604] RAX: 0000000000000000 RBX: 00007f4ab4e34474 RCX: 00007f4ab4d9f317 [ 186.310921][ T5604] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcd6ad8310 [ 186.310938][ T5604] RBP: 00007ffcd6ad8310 R08: 00007ffcd6ad9310 R09: 00000000ffffffff [ 186.310956][ T5604] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcd6ad93a0 [ 186.310973][ T5604] R13: 00007f4ab4e34474 R14: 000000000002d6a5 R15: 00007ffcd6ad93e0 [ 186.311012][ T5604] [ 186.326237][ T29] usb 1-1: selecting invalid altsetting 0 [ 186.367385][ T5604] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 186.436650][ T6926] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 186.480605][ T5771] usb 2-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 186.517632][ T6926] ext4 filesystem being mounted at /23/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 186.527098][ T5771] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.548507][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 186.550737][ T5771] usb 2-1: Product: syz [ 186.605507][ T29] usb 1-1: USB disconnect, device number 4 [ 186.611678][ T5771] usb 2-1: Manufacturer: syz [ 186.712538][ T24] usb 6-1: device descriptor read/64, error -71 [ 186.854466][ T5968] udevd[5968]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 186.874466][ T5771] usb 2-1: SerialNumber: syz [ 186.898070][ T5771] usb 2-1: config 0 descriptor?? [ 186.933587][ T24] usb usb6-port1: attempt power cycle [ 187.008546][ T5755] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 187.162662][ T5755] usb 4-1: Using ep0 maxpacket: 16 [ 187.184853][ T5755] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 187.202908][ T5755] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 187.230647][ T5755] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 187.248105][ T5755] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 187.257588][ T5755] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.273271][ T5755] usb 4-1: config 0 descriptor?? [ 187.290867][ T6931] loop0: detected capacity change from 0 to 128 [ 187.297505][ T24] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 187.315888][ T6933] netlink: 8 bytes leftover after parsing attributes in process `syz.2.195'. [ 187.325484][ T24] usb 6-1: device descriptor read/8, error -71 [ 187.330858][ T6933] netlink: 'syz.2.195': attribute type 21 has an invalid length. [ 187.404049][ T9] logitech-hidpp-device 0005:046D:B012.0001: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 187.562574][ T24] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 187.745435][ T6934] fido_id[6934]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 187.854155][ T6936] loop2: detected capacity change from 0 to 32768 [ 187.861591][ T6936] btrfs: Deprecated parameter 'usebackuproot' [ 187.867741][ T6936] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 187.867744][ T5755] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0002/input/input9 [ 187.878384][ T24] usb 6-1: device descriptor read/8, error -71 [ 187.894839][ T6936] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.197 (6936) [ 187.910457][ T6936] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 187.920614][ T6936] BTRFS info (device loop2): using crc32c checksum algorithm [ 187.997805][ T1156] BTRFS warning (device loop2): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 188.015570][ T6936] BTRFS error (device loop2): failed to load root extent [ 188.024673][ T6936] BTRFS warning (device loop2): try to load backup roots slot 1 [ 188.038894][ T5877] BTRFS warning (device loop2): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 188.061170][ T24] usb usb6-port1: unable to enumerate USB device [ 188.118643][ T6936] BTRFS warning (device loop2): couldn't read tree root [ 188.125737][ T6936] BTRFS warning (device loop2): try to load backup roots slot 2 [ 188.136792][ T136] BTRFS error (device loop2): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 188.177713][ T6936] BTRFS warning (device loop2): couldn't read tree root [ 188.184887][ T6936] BTRFS warning (device loop2): try to load backup roots slot 3 [ 188.213573][ T6936] BTRFS info (device loop2): rebuilding free space tree [ 188.231580][ T6936] BTRFS info (device loop2): checking UUID tree [ 188.240105][ T6936] BTRFS info (device loop2): enabling ssd optimizations [ 188.247136][ T6936] BTRFS info (device loop2): turning on async discard [ 188.254036][ T6936] BTRFS info (device loop2): enabling free space tree [ 188.260796][ T6936] BTRFS info (device loop2): force clearing of disk cache [ 188.267969][ T6936] BTRFS info (device loop2): enabling auto defrag [ 188.274553][ T6936] BTRFS info (device loop2): trying to use backup root at mount time [ 188.282661][ T6936] BTRFS info (device loop2): use zstd compression, level 3 [ 188.294285][ T5771] usb 2-1: f81604_read: reg: 100e failed: -EPROTO [ 188.338736][ T5755] microsoft 0003:045E:07DA.0002: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 189.362503][ T5771] usb 2-1: f81604_read: reg: 200f failed: -EPROTO [ 189.538838][ T5771] usb 2-1: USB disconnect, device number 4 [ 189.548661][ T6968] loop5: detected capacity change from 0 to 164 [ 189.593989][ T10] usb 4-1: reset high-speed USB device number 4 using dummy_hcd [ 189.709073][ T5771] usb 2-1: f81604_read: reg: 100f failed: -ENODEV [ 189.728155][ T5621] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 189.760903][ T5604] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 190.796232][ T5267] usb 2-1: f81604_read: reg: 200f failed: -ENODEV [ 190.806520][ T6982] netlink: 8 bytes leftover after parsing attributes in process `syz.3.205'. [ 190.824386][ T6982] netlink: 8 bytes leftover after parsing attributes in process `syz.3.205'. [ 190.929072][ T6982] netlink: 4 bytes leftover after parsing attributes in process `syz.3.205'. [ 190.944126][ T6987] FAULT_INJECTION: forcing a failure. [ 190.944126][ T6987] name failslab, interval 1, probability 0, space 0, times 0 [ 190.998208][ T6970] loop0: detected capacity change from 0 to 32768 [ 191.041714][ T6970] btrfs: Deprecated parameter 'usebackuproot' [ 191.062324][ T6987] CPU: 1 UID: 0 PID: 6987 Comm: syz.4.208 Not tainted syzkaller #0 PREEMPT(full) [ 191.062362][ T6987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 191.062378][ T6987] Call Trace: [ 191.062387][ T6987] [ 191.062397][ T6987] dump_stack_lvl+0xe8/0x150 [ 191.062437][ T6987] should_fail_ex+0x40c/0x560 [ 191.062472][ T6987] should_failslab+0xa8/0x100 [ 191.062511][ T6987] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 191.062541][ T6987] ? local_lock_release+0x9c/0x160 [ 191.062582][ T6987] ? __alloc_skb+0x1d7/0x7a0 [ 191.062619][ T6987] ? __alloc_skb+0x1d7/0x7a0 [ 191.062665][ T6987] __alloc_skb+0x1d7/0x7a0 [ 191.062709][ T6987] netlink_sendmsg+0x5d4/0xb40 [ 191.062750][ T6987] ? __pfx_netlink_sendmsg+0x10/0x10 [ 191.062783][ T6987] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.062813][ T6987] ? aa_sock_msg_perm+0xf1/0x1b0 [ 191.062856][ T6987] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.062888][ T6987] ? __pfx_netlink_sendmsg+0x10/0x10 [ 191.062917][ T6987] sock_sendmsg_nosec+0x13a/0x180 [ 191.062954][ T6987] ____sys_sendmsg+0x54e/0x850 [ 191.062989][ T6987] ? __pfx_____sys_sendmsg+0x10/0x10 [ 191.063019][ T6987] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.063054][ T6987] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.063083][ T6987] ? import_iovec+0x73/0xa0 [ 191.063124][ T6987] ___sys_sendmsg+0x2a5/0x360 [ 191.063155][ T6987] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.063183][ T6987] ? __lock_acquire+0x683/0x2cf0 [ 191.063223][ T6987] ? __pfx____sys_sendmsg+0x10/0x10 [ 191.063290][ T6987] ? __fget_files+0x2a/0x420 [ 191.063322][ T6987] ? srso_alias_return_thunk+0x5/0xfbef5 [ 191.063351][ T6987] ? __fget_files+0x3a2/0x420 [ 191.063395][ T6987] __x64_sys_sendmsg+0x1b1/0x290 [ 191.063427][ T6987] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 191.063475][ T6987] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.063502][ T6987] do_syscall_64+0x174/0x580 [ 191.063536][ T6987] ? trace_irq_disable+0x3b/0x140 [ 191.063573][ T6987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 191.063599][ T6987] RIP: 0033:0x7f9e7539e0d9 [ 191.063621][ T6987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 191.063642][ T6987] RSP: 002b:00007f9e76195028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 191.063668][ T6987] RAX: ffffffffffffffda RBX: 00007f9e75625fa0 RCX: 00007f9e7539e0d9 [ 191.063686][ T6987] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000006 [ 191.063702][ T6987] RBP: 00007f9e76195090 R08: 0000000000000000 R09: 0000000000000000 [ 191.063718][ T6987] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 191.063733][ T6987] R13: 00007f9e75626038 R14: 00007f9e75625fa0 R15: 00007ffe005e97a8 [ 191.063772][ T6987] [ 191.337463][ T6970] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 191.355511][ T6970] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.201 (6970) [ 191.412575][ T6985] loop1: detected capacity change from 0 to 40427 [ 191.586264][ T6985] F2FS-fs (loop1): build fault injection rate: 174 [ 191.592864][ T6985] F2FS-fs (loop1): build fault injection type: 0x3bfe8c [ 191.608095][ T6985] F2FS-fs (loop1): invalid crc value [ 191.682069][ T6985] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 192.032295][ T6985] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 192.195259][ T5755] usb 4-1: USB disconnect, device number 4 [ 192.220319][ T6970] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 192.235596][ T7001] loop4: detected capacity change from 0 to 256 [ 192.247560][ T5771] usb 2-1: f81604_read: reg: 200f failed: -ENODEV [ 192.256349][ T6970] BTRFS info (device loop0): using crc32c checksum algorithm [ 192.260012][ T6985] F2FS-fs (loop1): inject inconsistent footer in f2fs_sanity_check_node_footer of __get_node_folio+0x8c1/0xdf0 [ 192.275638][ T6985] F2FS-fs (loop1): inconsistent node block, node_type:1, nid:10, node_footer[nid:10,ino:10,ofs:0,cpver:0,blkaddr:0] [ 192.550033][ T6970] workqueue: Failed to create a rescuer kthread for wq "btrfs-delalloc": -EINTR [ 192.550409][ T6970] workqueue: Failed to create a rescuer kthread for wq "btrfs-flush_delalloc": -EINTR [ 192.581994][ T6970] workqueue: Failed to create a rescuer kthread for wq "btrfs-cache": -EINTR [ 192.672818][ T6993] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 192.720900][ T6970] workqueue: Failed to create a rescuer kthread for wq "btrfs-fixup": -EINTR [ 192.779730][ T6970] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio": -EINTR [ 192.900818][ T6970] workqueue: Failed to create a rescuer kthread for wq "btrfs-delayed-meta": -EINTR [ 192.992799][ T6970] workqueue: Failed to create a rescuer kthread for wq "btrfs-qgroup-rescan": -EINTR [ 193.030771][ T5605] syz-executor: attempt to access beyond end of device [ 193.030771][ T5605] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 193.069892][ T5605] CPU: 1 UID: 0 PID: 5605 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 193.069928][ T5605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 193.069943][ T5605] Call Trace: [ 193.069951][ T5605] [ 193.069961][ T5605] dump_stack_lvl+0xe8/0x150 [ 193.070002][ T5605] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 193.070040][ T5605] f2fs_write_end_io+0x124b/0x1710 [ 193.070104][ T5605] __submit_merged_bio+0x258/0x6a0 [ 193.070131][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.070166][ T5605] ? rcu_is_watching+0x15/0xb0 [ 193.070213][ T5605] __submit_merged_write_cond+0x3c9/0x4e0 [ 193.070255][ T5605] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 193.070304][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.070345][ T5605] f2fs_write_data_pages+0x2a27/0x36f0 [ 193.070377][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.070406][ T5605] ? __lock_acquire+0x683/0x2cf0 [ 193.070488][ T5605] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 193.070520][ T5605] ? is_bpf_text_address+0x26/0x2b0 [ 193.070572][ T5605] ? arch_stack_walk+0xfb/0x150 [ 193.070652][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.070680][ T5605] ? add_lock_to_list+0xc7/0x100 [ 193.070722][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.070751][ T5605] ? __lock_acquire+0x13e8/0x2cf0 [ 193.070821][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.070850][ T5605] ? do_raw_spin_lock+0x12b/0x2f0 [ 193.070885][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.070919][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.070947][ T5605] ? do_raw_spin_unlock+0xf5/0x210 [ 193.070975][ T5605] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 193.071011][ T5605] do_writepages+0x338/0x560 [ 193.071048][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.071079][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.071113][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.071142][ T5605] ? do_raw_spin_unlock+0xf5/0x210 [ 193.071182][ T5605] filemap_fdatawrite+0x1e9/0x2f0 [ 193.071223][ T5605] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 193.071336][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.071369][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.071405][ T5605] ? do_raw_spin_unlock+0xf5/0x210 [ 193.071438][ T5605] f2fs_sync_dirty_inodes+0x30e/0x830 [ 193.071495][ T5605] f2fs_write_checkpoint+0xa3d/0x2710 [ 193.071530][ T5605] ? __lock_acquire+0x683/0x2cf0 [ 193.071607][ T5605] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 193.071642][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.071745][ T5605] kill_f2fs_super+0x2f6/0x700 [ 193.071789][ T5605] ? __pfx_kill_f2fs_super+0x10/0x10 [ 193.071841][ T5605] ? call_rcu+0x64b/0x8b0 [ 193.071878][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.071908][ T5605] ? lockdep_hardirqs_on+0x7a/0x110 [ 193.071942][ T5605] ? srso_alias_return_thunk+0x5/0xfbef5 [ 193.071991][ T5605] deactivate_locked_super+0xbc/0x130 [ 193.072030][ T5605] cleanup_mnt+0x3d3/0x460 [ 193.072076][ T5605] task_work_run+0x1d9/0x270 [ 193.072118][ T5605] ? __pfx_task_work_run+0x10/0x10 [ 193.072176][ T5605] exit_to_user_mode_loop+0x1fa/0x730 [ 193.072208][ T5605] ? rcu_is_watching+0x15/0xb0 [ 193.072247][ T5605] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.072276][ T5605] do_syscall_64+0x353/0x580 [ 193.072309][ T5605] ? trace_irq_disable+0x3b/0x140 [ 193.072349][ T5605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 193.072375][ T5605] RIP: 0033:0x7feee919f317 [ 193.072400][ T5605] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 193.072422][ T5605] RSP: 002b:00007fff90df6a68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 193.072447][ T5605] RAX: 0000000000000000 RBX: 00007feee9234474 RCX: 00007feee919f317 [ 193.072464][ T5605] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff90df6b20 [ 193.072480][ T5605] RBP: 00007fff90df6b20 R08: 00007fff90df7b20 R09: 00000000ffffffff [ 193.072498][ T5605] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff90df7bb0 [ 193.072514][ T5605] R13: 00007feee9234474 R14: 000000000002f1be R15: 00007fff90df7bf0 [ 193.072558][ T5605] [ 193.605576][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.613986][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.705007][ T6970] BTRFS error (device loop0): open_ctree failed: -12 [ 193.727739][ T5605] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 194.014280][ T7022] loop3: detected capacity change from 0 to 32768 [ 194.021785][ T7022] btrfs: Deprecated parameter 'usebackuproot' [ 194.028007][ T7022] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 194.032009][ T7024] loop4: detected capacity change from 0 to 256 [ 194.071790][ T7022] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.213 (7022) [ 194.091876][ T5774] loop1: lost filesystem error report for type 5 error -108 [ 194.094560][ T7022] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 194.111974][ T7022] BTRFS info (device loop3): using crc32c checksum algorithm [ 194.254378][ T63] BTRFS warning (device loop3): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 194.336771][ T7022] BTRFS error (device loop3): failed to load root extent [ 194.344296][ T7022] BTRFS warning (device loop3): try to load backup roots slot 1 [ 194.352272][ T5880] BTRFS warning (device loop3): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 194.392608][ T7022] BTRFS warning (device loop3): couldn't read tree root [ 194.399874][ T7022] BTRFS warning (device loop3): try to load backup roots slot 2 [ 194.457504][ T5880] BTRFS error (device loop3): level verify failed on logical 5255168 mirror 1 wanted 0 found 1 [ 194.494990][ T7022] BTRFS warning (device loop3): couldn't read tree root [ 194.501958][ T7022] BTRFS warning (device loop3): try to load backup roots slot 3 [ 194.898669][ T7022] BTRFS info (device loop3): rebuilding free space tree [ 195.139966][ T7022] BTRFS info (device loop3): checking UUID tree [ 195.150362][ T7022] BTRFS info (device loop3): enabling ssd optimizations [ 195.157419][ T7022] BTRFS info (device loop3): turning on async discard [ 195.164209][ T7022] BTRFS info (device loop3): enabling free space tree [ 195.170965][ T7022] BTRFS info (device loop3): force clearing of disk cache [ 195.178111][ T7022] BTRFS info (device loop3): enabling auto defrag [ 195.184560][ T7022] BTRFS info (device loop3): trying to use backup root at mount time [ 195.192651][ T7022] BTRFS info (device loop3): use zstd compression, level 3 [ 195.518309][ T7052] bridge0: port 4(gretap0) entered blocking state [ 195.596067][ T7052] bridge0: port 4(gretap0) entered disabled state [ 195.633015][ T7052] gretap0: entered allmulticast mode [ 195.672776][ T7052] gretap0: entered promiscuous mode [ 195.694321][ T7052] bridge0: port 4(gretap0) entered blocking state [ 195.701494][ T7052] bridge0: port 4(gretap0) entered forwarding state [ 195.817062][ T7055] bridge0: port 5(erspan0) entered blocking state [ 195.852075][ T5621] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 195.868239][ T7055] bridge0: port 5(erspan0) entered disabled state [ 195.893267][ T7055] erspan0: entered allmulticast mode [ 195.939767][ T7055] erspan0: entered promiscuous mode [ 195.987636][ T7055] bridge0: port 5(erspan0) entered blocking state [ 195.994211][ T7055] bridge0: port 5(erspan0) entered forwarding state [ 196.513054][ T7069] loop0: detected capacity change from 0 to 8192 [ 196.531501][ T7069] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 197.135593][ T7088] loop3: detected capacity change from 0 to 8192 [ 197.161765][ T7088] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 198.671332][ T7093] loop2: detected capacity change from 0 to 1024 [ 199.648857][ T7093] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 199.799651][ T5604] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 201.158284][ T7112] loop2: detected capacity change from 0 to 8192 [ 201.172460][ T5774] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 201.318641][ T7115] netlink: 52 bytes leftover after parsing attributes in process `syz.4.243'. [ 201.592442][ T5774] usb 2-1: Using ep0 maxpacket: 16 [ 201.605735][ T5774] usb 2-1: unable to get BOS descriptor or descriptor too short [ 201.623516][ T5774] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 201.642484][ T5774] usb 2-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 201.677063][ T5774] usb 2-1: config 1 interface 2 has no altsetting 0 [ 201.705970][ T5774] usb 2-1: New USB device found, idVendor=2a39, idProduct=3fd2, bcdDevice= 0.40 [ 201.722654][ T5774] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.739748][ T5774] usb 2-1: Product: syz [ 201.751267][ T5774] usb 2-1: Manufacturer: syz [ 201.989296][ T7119] xt_HMARK: proto mask must be zero with L3 mode [ 202.018487][ T5774] usb 2-1: SerialNumber: syz [ 202.293384][ T7123] netdevsim0 speed is unknown, defaulting to 1000 [ 202.300038][ T7123] netdevsim0 speed is unknown, defaulting to 1000 [ 202.308653][ T7123] netdevsim0 speed is unknown, defaulting to 1000 [ 202.316803][ T7123] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 202.332275][ T7123] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 202.349220][ T7123] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 202.364183][ T7123] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 202.381779][ T7123] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 202.470360][ T7123] netdevsim0 speed is unknown, defaulting to 1000 [ 202.498180][ T7123] netdevsim0 speed is unknown, defaulting to 1000 [ 202.527897][ T7123] netdevsim0 speed is unknown, defaulting to 1000 [ 202.536945][ T7123] netdevsim0 speed is unknown, defaulting to 1000 [ 202.634382][ T7123] netdevsim0 speed is unknown, defaulting to 1000 [ 202.661870][ T7123] netdevsim0 speed is unknown, defaulting to 1000 [ 202.962109][ T5774] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 203.152310][ T5774] usb 2-1: selecting invalid altsetting 0 [ 203.555294][ T7140] loop3: detected capacity change from 0 to 512 [ 203.555973][ T5774] usb 2-1: USB disconnect, device number 5 [ 203.627193][ T7140] EXT4-fs error (device loop3): ext4_get_branch:178: inode #11: block 4294967295: comm syz.3.251: invalid block [ 203.642837][ T7140] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 203.645851][ T7140] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.251: invalid indirect mapped block 4294967295 (level 1) [ 203.655170][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 203.655193][ C1] EXT4-fs (loop3): initial error at time 1786123286: ext4_get_branch:178: inode 11: block 4294967295 [ 203.655241][ C1] EXT4-fs (loop3): last error at time 1786123286: ext4_get_branch:178: inode 11: block 4294967295 [ 203.704350][ T7140] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 203.713548][ T7140] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.251: invalid indirect mapped block 4294967295 (level 1) [ 203.740701][ T7151] loop4: detected capacity change from 0 to 512 [ 203.763091][ T5880] rds_connect_path_complete: Cannot transition to state UP, current state is 2 [ 203.797731][ T7140] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 203.807867][ T7140] EXT4-fs (loop3): 2 truncates cleaned up [ 203.824860][ T7154] loop2: detected capacity change from 0 to 1024 [ 203.834650][ T7154] EXT4-fs: quotafile must be on filesystem root [ 204.136998][ T5968] udevd[5968]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 204.582681][ T7159] netdevsim0 speed is unknown, defaulting to 1000 [ 204.701804][ T7140] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 205.418544][ T7171] EXT4-fs error (device loop3): ext4_validate_block_bitmap:432: comm syz.3.251: bg 0: block 5: invalid block bitmap [ 205.768832][ T7172] loop0: detected capacity change from 0 to 512 [ 206.246166][ T5624] Bluetooth: hci2: command 0x0406 tx timeout [ 206.254309][ T5624] Bluetooth: hci1: command 0x0406 tx timeout [ 206.261313][ T4921] Bluetooth: hci0: command 0x0406 tx timeout [ 206.271128][ T4921] Bluetooth: hci3: command 0x0406 tx timeout [ 206.272656][ T5624] Bluetooth: hci4: command 0x0406 tx timeout [ 206.277195][ T4921] Bluetooth: hci5: command 0x0406 tx timeout [ 207.328170][ T7175] Bluetooth: MGMT ver 1.23 [ 208.099247][ T7172] EXT4-fs warning (device loop0): ext4_multi_mount_protect:393: Unable to create kmmpd thread for loop0. [ 208.438796][ T4921] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 208.448464][ T4921] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 208.456433][ T4921] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 208.473329][ T7181] loop1: detected capacity change from 0 to 256 [ 208.480775][ T7181] vfat: Bad value for 'allow_utime' [ 208.550925][ T5612] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 208.625861][ T4921] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 208.639680][ T5621] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 208.952783][ T7187] loop0: detected capacity change from 0 to 1024 [ 209.090405][ T7187] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 209.172545][ T7196] netlink: 'syz.1.266': attribute type 39 has an invalid length. [ 210.094520][ T5603] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 210.504032][ T5880] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 210.722522][ T5613] Bluetooth: hci6: command tx timeout [ 210.897373][ T7221] syzkaller0: entered promiscuous mode [ 210.909042][ T7221] syzkaller0: entered allmulticast mode [ 211.791222][ T7244] syz.2.272 (7244): drop_caches: 2 [ 211.864252][ T7249] loop0: detected capacity change from 0 to 8192 [ 211.906912][ T7249] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 212.862866][ T5613] Bluetooth: hci6: command tx timeout [ 213.944747][ T7258] loop0: detected capacity change from 0 to 1024 [ 214.016000][ T7258] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 214.822830][ T5880] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 214.903514][ T5613] Bluetooth: hci6: command tx timeout [ 215.036672][ T5603] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 215.111533][ T5613] Bluetooth: hci1: unexpected event for opcode 0x1004 [ 215.118897][ T5613] Bluetooth: hci1: unexpected event for opcode 0x1004 [ 215.181483][ T5613] Bluetooth: hci1: unexpected event for opcode 0x0c56 [ 215.271880][ T7179] netdevsim0 speed is unknown, defaulting to 1000 [ 215.349544][ T5880] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.396782][ T7273] loop2: detected capacity change from 0 to 512 [ 215.437271][ T7273] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 215.536707][ T7273] syz.2.281: attempt to access beyond end of device [ 215.536707][ T7273] loop2: rw=8388608, sector=17179852721, nr_sectors = 1 limit=512 [ 215.554592][ T7284] loop3: detected capacity change from 0 to 1024 [ 215.587419][ T7273] FAT-fs (loop2): error, invalid access to FAT (entry 0x0fffff00) [ 215.612648][ T7273] FAT-fs (loop2): error, invalid access to FAT (entry 0x0fffff00) [ 215.651429][ T7284] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 215.738298][ T5880] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.658146][ T7299] loop2: detected capacity change from 0 to 512 [ 216.696634][ T5621] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 216.782861][ T7299] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 216.828776][ T7299] ext4 filesystem being mounted at /52/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 216.964233][ T5613] Bluetooth: hci6: command tx timeout [ 217.132212][ T7311] xt_hashlimit: size too large, truncated to 1048576 [ 217.139369][ T5604] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 217.421908][ T5880] bridge_slave_1: left allmulticast mode [ 217.456420][ T5880] bridge_slave_1: left promiscuous mode [ 217.499961][ T5880] bridge0: port 2(bridge_slave_1) entered disabled state [ 217.812693][ T5880] bridge_slave_0: left allmulticast mode [ 217.934027][ T5880] bridge_slave_0: left promiscuous mode [ 217.939869][ T5880] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.090116][ T7330] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 222.214218][ T7374] loop1: detected capacity change from 0 to 8192 [ 222.329827][ T7374] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 222.901957][ T7381] loop0: detected capacity change from 0 to 256 [ 222.934105][ T5880] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 223.015965][ T5880] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 223.096619][ T5880] bond0 (unregistering): Released all slaves [ 223.472320][ T7387] loop0: detected capacity change from 0 to 512 [ 223.572759][ T7387] EXT4-fs warning (device loop0): dx_probe:846: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 223.677988][ T7387] EXT4-fs warning (device loop0): dx_probe:849: Enable large directory feature to access it [ 223.774106][ T7387] EXT4-fs warning (device loop0): dx_probe:934: inode #2: comm syz.0.317: Corrupt directory, running e2fsck is recommended [ 223.790868][ T7387] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -117 [ 223.799509][ T7387] EXT4-fs error (device loop0): ext4_iget_extra_inode:5180: inode #15: comm syz.0.317: corrupted in-inode xattr: invalid ea_ino [ 223.827505][ T7387] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 223.827988][ T7387] EXT4-fs (loop0): Remounting filesystem read-only [ 223.837195][ C1] EXT4-fs (loop0): error count since last fsck: 1 [ 223.837217][ C1] EXT4-fs (loop0): initial error at time 1786123306: ext4_iget_extra_inode:5180: inode 15 [ 223.837256][ C1] EXT4-fs (loop0): last error at time 1786123306: ext4_iget_extra_inode:5180: inode 15 [ 223.886443][ T7387] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 224.120178][ T7387] EXT4-fs warning (device loop0): ext4_empty_dir:3094: inode #2: comm syz.0.317: directory missing '.' [ 224.253628][ T7179] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.269695][ T7179] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.292699][ T7179] bridge_slave_0: entered allmulticast mode [ 224.300684][ T7179] bridge_slave_0: entered promiscuous mode [ 224.350552][ T5603] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.418008][ T7179] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.445030][ T7179] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.490406][ T7179] bridge_slave_1: entered allmulticast mode [ 224.530932][ T7179] bridge_slave_1: entered promiscuous mode [ 227.084167][ T7437] loop3: detected capacity change from 0 to 512 [ 227.435144][ T7437] EXT4-fs error (device loop3): ext4_get_branch:178: inode #11: block 4294967295: comm syz.3.330: invalid block [ 227.447151][ T7437] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 227.452381][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 227.467948][ C1] EXT4-fs (loop3): initial error at time 1786123310: ext4_get_branch:178: inode 11: block 4294967295 [ 227.478848][ C1] EXT4-fs (loop3): last error at time 1786123310: ext4_get_branch:178: inode 11: block 4294967295 [ 227.489900][ T7437] EXT4-fs (loop3): Remounting filesystem read-only [ 227.500416][ T7437] EXT4-fs (loop3): 2 truncates cleaned up [ 227.530114][ T7437] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 228.341890][ T7439] loop2: detected capacity change from 0 to 512 [ 228.433310][ T7439] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 228.484217][ T7445] netlink: 4 bytes leftover after parsing attributes in process `syz.0.332'. [ 228.539504][ T7439] EXT4-fs error (device loop2): ext4_iget_extra_inode:5180: inode #15: comm syz.2.331: corrupted in-inode xattr: e_value size too large [ 228.614717][ T7439] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 228.622393][ C1] EXT4-fs (loop2): error count since last fsck: 1 [ 228.638091][ C1] EXT4-fs (loop2): initial error at time 1786123311: ext4_iget_extra_inode:5180: inode 15 [ 228.648038][ C1] EXT4-fs (loop2): last error at time 1786123311: ext4_iget_extra_inode:5180: inode 15 [ 228.668081][ T7439] EXT4-fs error (device loop2): ext4_orphan_get:1404: comm syz.2.331: couldn't read orphan inode 15 (err -117) [ 228.783018][ T7439] loop2: lost filesystem error report for type 5 error -117 [ 228.798710][ T7439] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 228.898603][ T7436] netdevsim0 speed is unknown, defaulting to 1000 [ 229.148295][ T7179] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 229.159871][ T7439] fuse: Unknown parameter 'fd<9Hϛ0x0000000000000009' [ 229.176846][ T7455] loop4: detected capacity change from 0 to 256 [ 229.234238][ T7179] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 229.252755][ T7455] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 229.378947][ T7460] loop1: detected capacity change from 0 to 1024 [ 229.494948][ T5880] hsr_slave_0: left promiscuous mode [ 229.510027][ T5880] hsr_slave_1: left promiscuous mode [ 229.530064][ T7460] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 229.531187][ T5880] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 229.531222][ T5880] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 229.536718][ T5880] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 229.536741][ T5880] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 229.639366][ T5604] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 229.784852][ T5880] veth1_macvtap: left promiscuous mode [ 229.785043][ T5880] veth0_macvtap: left promiscuous mode [ 229.785137][ T5880] veth1_vlan: left promiscuous mode [ 229.785210][ T5880] veth0_vlan: left promiscuous mode [ 230.454630][ T5605] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 230.504699][ T7474] loop2: detected capacity change from 0 to 512 [ 230.529993][ T7474] EXT4-fs: Ignoring removed mblk_io_submit option [ 230.592281][ T7474] EXT4-fs error (device loop2): ext4_iget_extra_inode:5180: inode #15: comm syz.2.339: corrupted in-inode xattr: e_value size too large [ 230.658313][ T7474] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 230.662373][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 230.677951][ C0] EXT4-fs (loop2): initial error at time 1786123313: ext4_iget_extra_inode:5180: inode 15 [ 230.687925][ C0] EXT4-fs (loop2): last error at time 1786123313: ext4_iget_extra_inode:5180: inode 15 [ 230.701312][ T7474] EXT4-fs error (device loop2): ext4_orphan_get:1404: comm syz.2.339: couldn't read orphan inode 15 (err -117) [ 230.747788][ T7474] loop2: lost filesystem error report for type 5 error -117 [ 230.757277][ T7474] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 231.488631][ T5604] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 231.769898][ T5880] team0 (unregistering): Port device team_slave_1 removed [ 231.792749][ T5880] team0 (unregistering): Port device team_slave_0 removed [ 232.135954][ T5267] 8021q: adding VLAN 0 to HW filter on device eth1 [ 232.761391][ T7179] team0: Port device team_slave_0 added [ 232.831437][ T7179] team0: Port device team_slave_1 added [ 232.959435][ T7500] netlink: 4 bytes leftover after parsing attributes in process `syz.4.346'. [ 233.761988][ T7500] bridge_slave_1: left allmulticast mode [ 233.767846][ T7500] bridge_slave_1: left promiscuous mode [ 233.774550][ T7500] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.771138][ T7506] binder_alloc: 7504: binder_alloc_buf, no vma [ 235.198765][ T7500] bridge_slave_0: left allmulticast mode [ 235.205187][ T7500] bridge_slave_0: left promiscuous mode [ 235.211451][ T7500] bridge0: port 1(bridge_slave_0) entered disabled state [ 235.265041][ T5621] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 235.356677][ T7179] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 235.386151][ T7179] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 235.453864][ T7179] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 235.472559][ T7179] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 235.479500][ T7179] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 235.511030][ T7508] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 235.520718][ T7508] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 235.530358][ T7508] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 235.663103][ T7518] process 'syz.0.349' launched './file0' with NULL argv: empty string added [ 235.742147][ T31] kauditd_printk_skb: 56 callbacks suppressed [ 235.742194][ T31] audit: type=1800 audit(1786123318.590:225): pid=7508 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.348" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 236.297425][ T7179] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 236.527243][ T7529] loop0: detected capacity change from 0 to 8192 [ 236.634132][ T7529] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 237.882311][ T7179] hsr_slave_0: entered promiscuous mode [ 237.916690][ T7179] hsr_slave_1: entered promiscuous mode [ 237.953886][ T7179] debugfs: 'hsr0' already exists in 'hsr' [ 237.980180][ T7179] Cannot create hsr debugfs directory [ 238.348015][ T7545] syzkaller0: entered promiscuous mode [ 238.390244][ T7545] syzkaller0: entered allmulticast mode [ 240.345054][ T7592] loop2: detected capacity change from 0 to 256 [ 240.404951][ T7593] loop0: detected capacity change from 0 to 2048 [ 240.491981][ T7593] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 240.585949][ T7593] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 240.640905][ T7593] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 240.665345][ T7593] EXT4-fs (loop0): This should not happen!! Data will be lost [ 240.665345][ T7593] [ 240.689224][ T7593] EXT4-fs (loop0): Total free blocks count 0 [ 240.720523][ T7593] EXT4-fs (loop0): Free/Dirty block details [ 240.774877][ T7593] EXT4-fs (loop0): free_blocks=2415919504 [ 240.804271][ T7593] EXT4-fs (loop0): dirty_blocks=32 [ 240.810012][ T7593] EXT4-fs (loop0): Block reservation details [ 240.819100][ T7593] EXT4-fs (loop0): i_reserved_data_blocks=2 [ 241.469628][ T5877] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 1 with error 28 [ 241.512045][ T5603] EXT4-fs warning (device loop0): ext4_evict_inode:195: inode #15: comm syz-executor: data will be lost [ 243.266072][ T5771] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 243.301513][ T7636] loop2: detected capacity change from 0 to 40427 [ 243.316457][ T7636] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 243.329071][ T7636] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 243.363866][ T7636] F2FS-fs (loop2): invalid crc value [ 243.435623][ T5771] usb 2-1: Using ep0 maxpacket: 8 [ 243.450366][ T5771] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 243.477712][ T5771] usb 2-1: New USB device found, idVendor=0bc3, idProduct=0001, bcdDevice=11.85 [ 243.501481][ T5771] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.518225][ T7636] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 243.523328][ T5771] usb 2-1: Product: syz [ 243.542075][ T5771] usb 2-1: Manufacturer: syz [ 243.547461][ T5771] usb 2-1: SerialNumber: syz [ 243.558992][ T5771] usb 2-1: config 0 descriptor?? [ 243.564970][ T7636] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 243.572287][ T7636] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 243.574905][ T5771] ipw 2-1:0.0: IPWireless converter converter detected [ 243.664444][ T5604] syz-executor: attempt to access beyond end of device [ 243.664444][ T5604] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 243.697839][ T5604] CPU: 1 UID: 0 PID: 5604 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 243.697872][ T5604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 243.697886][ T5604] Call Trace: [ 243.697896][ T5604] [ 243.697906][ T5604] dump_stack_lvl+0xe8/0x150 [ 243.697945][ T5604] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 243.697980][ T5604] f2fs_write_end_io+0x124b/0x1710 [ 243.698037][ T5604] __submit_merged_bio+0x258/0x6a0 [ 243.698064][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.698093][ T5604] ? rcu_is_watching+0x15/0xb0 [ 243.698136][ T5604] __submit_merged_write_cond+0x3c9/0x4e0 [ 243.698175][ T5604] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 243.698223][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.698261][ T5604] f2fs_write_data_pages+0x2a27/0x36f0 [ 243.698335][ T5604] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 243.698365][ T5604] ? is_bpf_text_address+0x26/0x2b0 [ 243.698414][ T5604] ? arch_stack_walk+0xfb/0x150 [ 243.698484][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.698512][ T5604] ? add_lock_to_list+0xc7/0x100 [ 243.698552][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.698580][ T5604] ? __lock_acquire+0x13e8/0x2cf0 [ 243.698648][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.698677][ T5604] ? do_raw_spin_lock+0x12b/0x2f0 [ 243.698709][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.698742][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.698769][ T5604] ? do_raw_spin_unlock+0xf5/0x210 [ 243.698796][ T5604] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 243.698830][ T5604] do_writepages+0x338/0x560 [ 243.698868][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.698896][ T5604] ? preempt_schedule_common+0x82/0xd0 [ 243.698928][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.698956][ T5604] ? preempt_schedule_thunk+0x16/0x40 [ 243.698991][ T5604] filemap_fdatawrite+0x1e9/0x2f0 [ 243.699030][ T5604] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 243.699106][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.699137][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.699170][ T5604] ? do_raw_spin_unlock+0xf5/0x210 [ 243.699202][ T5604] f2fs_sync_dirty_inodes+0x30e/0x830 [ 243.699254][ T5604] f2fs_write_checkpoint+0xa3d/0x2710 [ 243.699288][ T5604] ? __lock_acquire+0x683/0x2cf0 [ 243.699357][ T5604] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 243.699395][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.699487][ T5604] kill_f2fs_super+0x2f6/0x700 [ 243.699529][ T5604] ? __pfx_kill_f2fs_super+0x10/0x10 [ 243.699577][ T5604] ? call_rcu+0x64b/0x8b0 [ 243.699612][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.699647][ T5604] ? lockdep_hardirqs_on+0x7a/0x110 [ 243.699680][ T5604] ? srso_alias_return_thunk+0x5/0xfbef5 [ 243.699723][ T5604] deactivate_locked_super+0xbc/0x130 [ 243.699760][ T5604] cleanup_mnt+0x3d3/0x460 [ 243.699802][ T5604] task_work_run+0x1d9/0x270 [ 243.699842][ T5604] ? __pfx_task_work_run+0x10/0x10 [ 243.699891][ T5604] exit_to_user_mode_loop+0x1fa/0x730 [ 243.699921][ T5604] ? rcu_is_watching+0x15/0xb0 [ 243.699958][ T5604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.699986][ T5604] do_syscall_64+0x353/0x580 [ 243.700018][ T5604] ? trace_irq_disable+0x3b/0x140 [ 243.700054][ T5604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.700079][ T5604] RIP: 0033:0x7f4ab4d9f317 [ 243.700102][ T5604] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 243.700122][ T5604] RSP: 002b:00007ffcd6ad8258 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 243.700147][ T5604] RAX: 0000000000000000 RBX: 00007f4ab4e34474 RCX: 00007f4ab4d9f317 [ 243.700164][ T5604] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcd6ad8310 [ 243.700179][ T5604] RBP: 00007ffcd6ad8310 R08: 00007ffcd6ad9310 R09: 00000000ffffffff [ 243.700196][ T5604] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcd6ad93a0 [ 243.700212][ T5604] R13: 00007f4ab4e34474 R14: 000000000003b790 R15: 00007ffcd6ad93e0 [ 243.700251][ T5604] [ 243.701559][ T5604] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 244.795196][ T5267] 8021q: adding VLAN 0 to HW filter on device eth2 [ 244.804026][ T7643] loop2: detected capacity change from 0 to 40427 [ 244.852549][ T7643] F2FS-fs (loop2): invalid crc value [ 244.944704][ T7643] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 244.956275][ T7643] F2FS-fs (loop2): f2fs_disable_checkpoint starts, unusable: 0 [ 244.964954][ T7643] F2FS-fs (loop2): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0 [ 244.975763][ T7643] F2FS-fs (loop2): Start checkpoint disabled! [ 244.986940][ T7643] F2FS-fs (loop2): f2fs_disable_checkpoint finishes, err:0 [ 244.996516][ T7643] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 245.606644][ T7654] binder: BINDER_SET_CONTEXT_MGR already set [ 245.612713][ T7654] binder: 7653:7654 ioctl 4018620d 200000004a80 returned -16 [ 245.961129][ T5771] usb 2-1: USB disconnect, device number 6 [ 246.023389][ T5771] ipw 2-1:0.0: device disconnected [ 246.119719][ T7643] xt_ecn: cannot match TCP bits for non-tcp packets [ 246.252703][ T12] kworker/u8:0: attempt to access beyond end of device [ 246.252703][ T12] loop2: rw=2049, sector=45096, nr_sectors = 24 limit=40427 [ 246.333434][ T7661] loop0: detected capacity change from 0 to 2048 [ 246.334410][ T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) [ 246.334438][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 246.334455][ T12] Workqueue: writeback wb_workfn (flush-7:2) [ 246.334490][ T12] Call Trace: [ 246.334501][ T12] [ 246.334510][ T12] dump_stack_lvl+0xe8/0x150 [ 246.334547][ T12] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 246.334583][ T12] f2fs_write_end_io+0x124b/0x1710 [ 246.334647][ T12] __submit_merged_bio+0x258/0x6a0 [ 246.334674][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.334704][ T12] ? rcu_is_watching+0x15/0xb0 [ 246.334750][ T12] __submit_merged_write_cond+0x3c9/0x4e0 [ 246.334790][ T12] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 246.334834][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.334871][ T12] f2fs_write_data_pages+0x2a27/0x36f0 [ 246.334945][ T12] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 246.334995][ T12] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 246.335070][ T12] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 246.335120][ T12] ? __lock_acquire+0x683/0x2cf0 [ 246.335170][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.335198][ T12] ? set_raw_inline+0x28b/0x390 [ 246.335224][ T12] ? __pfx_f2fs_inode_chksum_set+0x10/0x10 [ 246.335260][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.335292][ T12] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 246.335326][ T12] do_writepages+0x338/0x560 [ 246.335367][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.335395][ T12] ? reacquire_held_locks+0x104/0x190 [ 246.335432][ T12] ? writeback_sb_inodes+0x450/0x1b00 [ 246.335471][ T12] __writeback_single_inode+0x12e/0xf90 [ 246.335513][ T12] writeback_sb_inodes+0x9de/0x1b00 [ 246.335543][ T12] ? __lock_acquire+0x683/0x2cf0 [ 246.335582][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.335615][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.335664][ T12] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 246.335742][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.335770][ T12] ? rcu_is_watching+0x15/0xb0 [ 246.335806][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.335834][ T12] ? queue_io+0x2d3/0x470 [ 246.335869][ T12] wb_writeback+0x41c/0xad0 [ 246.335903][ T12] ? queue_io+0x251/0x470 [ 246.335941][ T12] ? __pfx_wb_writeback+0x10/0x10 [ 246.335968][ T12] ? do_raw_spin_lock+0x12b/0x2f0 [ 246.336014][ T12] wb_workfn+0x431/0x10f0 [ 246.336061][ T12] ? __pfx_wb_workfn+0x10/0x10 [ 246.336100][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.336128][ T12] ? do_raw_spin_lock+0x12b/0x2f0 [ 246.336161][ T12] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 246.336191][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.336222][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.336260][ T12] ? rcu_is_watching+0x15/0xb0 [ 246.336296][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.336327][ T12] ? process_scheduled_works+0xa20/0x14e0 [ 246.336355][ T12] process_scheduled_works+0xa8e/0x14e0 [ 246.336415][ T12] ? __pfx_process_scheduled_works+0x10/0x10 [ 246.336449][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.336477][ T12] ? assign_work+0x3cf/0x5d0 [ 246.336510][ T12] worker_thread+0xa47/0xfb0 [ 246.336570][ T12] kthread+0x388/0x470 [ 246.336604][ T12] ? __pfx_worker_thread+0x10/0x10 [ 246.336630][ T12] ? __pfx_kthread+0x10/0x10 [ 246.336670][ T12] ret_from_fork+0x514/0xb70 [ 246.336709][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 246.336742][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.336770][ T12] ? __switch_to+0xc89/0x1420 [ 246.336804][ T12] ? __pfx_kthread+0x10/0x10 [ 246.336838][ T12] ret_from_fork_asm+0x1a/0x30 [ 246.336895][ T12] [ 246.353866][ T12] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 246.733780][ T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) [ 246.733814][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 246.733830][ T12] Workqueue: writeback wb_workfn (flush-7:2) [ 246.733866][ T12] Call Trace: [ 246.733876][ T12] [ 246.733887][ T12] dump_stack_lvl+0xe8/0x150 [ 246.733925][ T12] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 246.733964][ T12] f2fs_write_end_io+0x124b/0x1710 [ 246.734028][ T12] __submit_merged_bio+0x258/0x6a0 [ 246.734057][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.734087][ T12] ? rcu_is_watching+0x15/0xb0 [ 246.734134][ T12] __submit_merged_write_cond+0x3c9/0x4e0 [ 246.734177][ T12] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 246.734227][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.734269][ T12] f2fs_write_data_pages+0x2a27/0x36f0 [ 246.734355][ T12] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 246.734409][ T12] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 246.734496][ T12] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 246.734558][ T12] ? __lock_acquire+0x683/0x2cf0 [ 246.734613][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.734649][ T12] ? set_raw_inline+0x28b/0x390 [ 246.734676][ T12] ? __pfx_f2fs_inode_chksum_set+0x10/0x10 [ 246.734715][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.734748][ T12] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 246.734784][ T12] do_writepages+0x338/0x560 [ 246.734833][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.734862][ T12] ? reacquire_held_locks+0x104/0x190 [ 246.734901][ T12] ? writeback_sb_inodes+0x450/0x1b00 [ 246.734944][ T12] __writeback_single_inode+0x12e/0xf90 [ 246.734990][ T12] writeback_sb_inodes+0x9de/0x1b00 [ 246.735020][ T12] ? __lock_acquire+0x683/0x2cf0 [ 246.735063][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.735099][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.735146][ T12] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 246.735238][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.735268][ T12] ? rcu_is_watching+0x15/0xb0 [ 246.735306][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.735335][ T12] ? queue_io+0x2d3/0x470 [ 246.735371][ T12] wb_writeback+0x41c/0xad0 [ 246.735408][ T12] ? queue_io+0x251/0x470 [ 246.735449][ T12] ? __pfx_wb_writeback+0x10/0x10 [ 246.735478][ T12] ? do_raw_spin_lock+0x12b/0x2f0 [ 246.735529][ T12] wb_workfn+0x431/0x10f0 [ 246.735582][ T12] ? __pfx_wb_workfn+0x10/0x10 [ 246.735626][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.735664][ T12] ? do_raw_spin_lock+0x12b/0x2f0 [ 246.735695][ T12] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 246.735728][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.735761][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.735803][ T12] ? rcu_is_watching+0x15/0xb0 [ 246.735840][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.735874][ T12] ? process_scheduled_works+0xa20/0x14e0 [ 246.735902][ T12] process_scheduled_works+0xa8e/0x14e0 [ 246.735973][ T12] ? __pfx_process_scheduled_works+0x10/0x10 [ 246.736011][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.736040][ T12] ? assign_work+0x3cf/0x5d0 [ 246.736076][ T12] worker_thread+0xa47/0xfb0 [ 246.736145][ T12] kthread+0x388/0x470 [ 246.736182][ T12] ? __pfx_worker_thread+0x10/0x10 [ 246.736208][ T12] ? __pfx_kthread+0x10/0x10 [ 246.736246][ T12] ret_from_fork+0x514/0xb70 [ 246.736287][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 246.736322][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.736351][ T12] ? __switch_to+0xc89/0x1420 [ 246.736387][ T12] ? __pfx_kthread+0x10/0x10 [ 246.736425][ T12] ret_from_fork_asm+0x1a/0x30 [ 246.736487][ T12] [ 246.736997][ T12] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 246.920706][ T7179] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 246.974643][ T12] CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) [ 246.974676][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 246.974692][ T12] Workqueue: writeback wb_workfn (flush-7:2) [ 246.974727][ T12] Call Trace: [ 246.974737][ T12] [ 246.974748][ T12] dump_stack_lvl+0xe8/0x150 [ 246.974786][ T12] f2fs_stop_checkpoint+0x3f6/0x5d0 [ 246.974823][ T12] f2fs_write_end_io+0x124b/0x1710 [ 246.974886][ T12] __submit_merged_bio+0x258/0x6a0 [ 246.974913][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.974944][ T12] ? rcu_is_watching+0x15/0xb0 [ 246.974989][ T12] __submit_merged_write_cond+0x3c9/0x4e0 [ 246.975032][ T12] ? __pfx___submit_merged_write_cond+0x10/0x10 [ 246.975084][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.975125][ T12] f2fs_write_data_pages+0x2a27/0x36f0 [ 246.975210][ T12] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 246.975263][ T12] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 246.975348][ T12] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 246.975403][ T12] ? __lock_acquire+0x683/0x2cf0 [ 246.975458][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.975486][ T12] ? set_raw_inline+0x28b/0x390 [ 246.975513][ T12] ? __pfx_f2fs_inode_chksum_set+0x10/0x10 [ 246.975550][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.975583][ T12] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 246.975619][ T12] do_writepages+0x338/0x560 [ 246.975668][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.975697][ T12] ? reacquire_held_locks+0x104/0x190 [ 246.975734][ T12] ? writeback_sb_inodes+0x450/0x1b00 [ 246.975775][ T12] __writeback_single_inode+0x12e/0xf90 [ 246.975823][ T12] writeback_sb_inodes+0x9de/0x1b00 [ 246.975853][ T12] ? __lock_acquire+0x683/0x2cf0 [ 246.975894][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.975928][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.975977][ T12] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 246.976069][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.976098][ T12] ? rcu_is_watching+0x15/0xb0 [ 246.976134][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.976163][ T12] ? queue_io+0x2d3/0x470 [ 246.976199][ T12] wb_writeback+0x41c/0xad0 [ 246.976235][ T12] ? queue_io+0x251/0x470 [ 246.976275][ T12] ? __pfx_wb_writeback+0x10/0x10 [ 246.976303][ T12] ? do_raw_spin_lock+0x12b/0x2f0 [ 246.976355][ T12] wb_workfn+0x431/0x10f0 [ 246.976407][ T12] ? __pfx_wb_workfn+0x10/0x10 [ 246.976451][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.976478][ T12] ? do_raw_spin_lock+0x12b/0x2f0 [ 246.976510][ T12] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 246.976542][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.976574][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.976615][ T12] ? rcu_is_watching+0x15/0xb0 [ 246.976664][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.976697][ T12] ? process_scheduled_works+0xa20/0x14e0 [ 246.976725][ T12] process_scheduled_works+0xa8e/0x14e0 [ 246.976794][ T12] ? __pfx_process_scheduled_works+0x10/0x10 [ 246.976830][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.976858][ T12] ? assign_work+0x3cf/0x5d0 [ 246.976894][ T12] worker_thread+0xa47/0xfb0 [ 246.976962][ T12] kthread+0x388/0x470 [ 246.976998][ T12] ? __pfx_worker_thread+0x10/0x10 [ 246.977023][ T12] ? __pfx_kthread+0x10/0x10 [ 246.977060][ T12] ret_from_fork+0x514/0xb70 [ 246.977100][ T12] ? __pfx_ret_from_fork+0x10/0x10 [ 246.977134][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 246.977162][ T12] ? __switch_to+0xc89/0x1420 [ 246.977197][ T12] ? __pfx_kthread+0x10/0x10 [ 246.977234][ T12] ret_from_fork_asm+0x1a/0x30 [ 246.977295][ T12] [ 246.986435][ T12] F2FS-fs (loop2): Stopped filesystem due to reason: 3 [ 247.429767][ T7661] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 247.592168][ T7676] tmpfs: Bad value for 'mpol' [ 247.854882][ T7661] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 248.093871][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 248.101933][ T7179] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 248.134096][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 248.153282][ T7179] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 248.219782][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 248.254467][ T5603] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 248.257289][ T7179] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 248.795639][ T7693] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 249.118948][ T7179] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 249.457733][ T7709] loop3: detected capacity change from 0 to 512 [ 249.531908][ T7709] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 249.559499][ T7709] ext4 filesystem being mounted at /57/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 249.615712][ T7709] EXT4-fs error (device loop3): ext4_xattr_block_get:597: inode #15: comm syz.3.398: corrupted xattr block 33: invalid header [ 249.701091][ T7713] loop1: detected capacity change from 0 to 512 [ 249.703421][ T7718] binder: BINDER_SET_CONTEXT_MGR already set [ 249.767275][ T7718] binder: 7715:7718 ioctl 4018620d 200000004a80 returned -16 [ 249.771199][ T7713] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -2 [ 249.802710][ T7713] EXT4-fs error (device loop1): ext4_iget_extra_inode:5180: inode #15: comm syz.1.399: corrupted in-inode xattr: e_value size too large [ 249.901511][ T7713] loop1: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 249.902318][ T7713] EXT4-fs error (device loop1): ext4_orphan_get:1404: comm syz.1.399: couldn't read orphan inode 15 (err -117) [ 249.902416][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 249.919934][ T7179] 8021q: adding VLAN 0 to HW filter on device bond0 [ 249.923967][ C1] EXT4-fs (loop1): initial error at time 1786123332: ext4_iget_extra_inode:5180 [ 249.933446][ T7726] loop4: detected capacity change from 0 to 512 [ 249.936342][ C1] : inode 15 [ 249.954745][ C1] EXT4-fs (loop1): last error at time 1786123332: ext4_iget_extra_inode:5180: inode 15 [ 249.965864][ T7713] loop1: lost filesystem error report for type 5 error -117 [ 249.978232][ T5267] 8021q: adding VLAN 0 to HW filter on device eth3 [ 250.019714][ T7713] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 250.112319][ T7179] 8021q: adding VLAN 0 to HW filter on device team0 [ 250.182400][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 250.189688][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 250.761036][ T31] audit: type=1800 audit(1786123333.840:226): pid=7709 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.398" name="file1" dev="loop3" ino=15 res=0 errno=0 [ 250.889824][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 250.897033][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 250.929570][ T7737] netdevsim0 speed is unknown, defaulting to 1000 [ 250.981066][ T5605] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 250.991268][ T5621] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 251.290341][ T7745] loop0: detected capacity change from 0 to 8192 [ 252.157833][ T7179] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 252.168470][ T7179] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 252.181771][ T7745] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 254.898417][ T7774] binder: BINDER_SET_CONTEXT_MGR already set [ 254.921861][ T7774] binder: 7773:7774 ioctl 4018620d 200000004a80 returned -16 [ 255.062551][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.068967][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.285916][ T7786] netlink: 4 bytes leftover after parsing attributes in process `syz.4.417'. [ 256.372043][ T7802] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 256.415999][ T7805] loop0: detected capacity change from 0 to 256 [ 257.613314][ T31] audit: type=1800 audit(1786123340.470:227): pid=7805 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.424" name="file1" dev="loop0" ino=1048625 res=0 errno=0 [ 257.644031][ T7816] loop3: detected capacity change from 0 to 8192 [ 257.662190][ T7816] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 258.272134][ T7826] loop1: detected capacity change from 0 to 256 [ 260.709935][ T7846] netlink: 24 bytes leftover after parsing attributes in process `syz.0.434'. [ 260.759712][ T7179] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 260.853999][ T7853] netlink: 4 bytes leftover after parsing attributes in process `syz.3.435'. [ 261.293222][ T5267] 8021q: adding VLAN 0 to HW filter on device eth4 [ 262.636014][ T7890] ptrace attach of "ci-upstream-kasan-gce-root/syz-executor exec"[5621] was attempted by "ci-upstream-kasan-gce-root/syz-executor exec"[7890] [ 262.675515][ T7890] dlm: no local IP address has been set [ 262.682472][ T7890] dlm: cannot start dlm midcomms -107 [ 262.850696][ T7889] loop2: detected capacity change from 0 to 8192 [ 263.414380][ T7889] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 265.047913][ T7911] netlink: 164 bytes leftover after parsing attributes in process `syz.3.453'. [ 266.055861][ T7179] veth0_vlan: entered promiscuous mode [ 266.477282][ T7924] nvme_tcp: malformed address passed: %27trsvcid=8009:8009 [ 266.726933][ T4921] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 266.741202][ T4921] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 266.749465][ T4921] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 266.767391][ T4921] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 266.777518][ T4921] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 266.986551][ T7948] loop3: detected capacity change from 0 to 8192 [ 267.032312][ T7954] loop0: detected capacity change from 0 to 256 [ 267.200890][ T7959] GUP no longer grows the stack in syz.1.469 (7959): 200000005000-200000008000 (200000004000) [ 267.329857][ T7961] loop2: detected capacity change from 0 to 8192 [ 267.359330][ T7961] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 267.515542][ T7959] CPU: 0 UID: 0 PID: 7959 Comm: syz.1.469 Not tainted syzkaller #0 PREEMPT(full) [ 267.515578][ T7959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 267.515593][ T7959] Call Trace: [ 267.515603][ T7959] [ 267.515613][ T7959] dump_stack_lvl+0xe8/0x150 [ 267.515660][ T7959] fixup_user_fault+0x637/0x6f0 [ 267.515709][ T7959] fault_in_user_writeable+0x71/0xd0 [ 267.515746][ T7959] futex_lock_pi+0x7ba/0xab0 [ 267.515787][ T7959] ? __pfx_futex_lock_pi+0x10/0x10 [ 267.515840][ T7959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 267.515871][ T7959] ? futex_private_hash_put+0x14e/0x180 [ 267.515911][ T7959] ? __pfx_futex_wake_mark+0x10/0x10 [ 267.515949][ T7959] ? userfaultfd_unmap_complete+0x292/0x310 [ 267.515992][ T7959] ? __pfx_userfaultfd_unmap_complete+0x10/0x10 [ 267.516032][ T7959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 267.516067][ T7959] do_futex+0x330/0x4e0 [ 267.516111][ T7959] ? __pfx_do_futex+0x10/0x10 [ 267.516149][ T7959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 267.516179][ T7959] ? __vm_munmap+0x2fe/0x3e0 [ 267.516225][ T7959] __se_sys_futex+0x3a8/0x450 [ 267.516276][ T7959] ? __pfx___se_sys_futex+0x10/0x10 [ 267.516315][ T7959] ? rcu_is_watching+0x15/0xb0 [ 267.516361][ T7959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 267.516390][ T7959] ? __x64_sys_futex+0x21/0xf0 [ 267.516429][ T7959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.516457][ T7959] do_syscall_64+0x174/0x580 [ 267.516500][ T7959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 267.516525][ T7959] RIP: 0033:0x7feee919e0d9 [ 267.516547][ T7959] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.516567][ T7959] RSP: 002b:00007feeea059028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 267.516593][ T7959] RAX: ffffffffffffffda RBX: 00007feee9425fa0 RCX: 00007feee919e0d9 [ 267.516612][ T7959] RDX: 0000000000000001 RSI: 000000000000008d RDI: 0000200000004000 [ 267.516628][ T7959] RBP: 00007feee9235024 R08: 0000000000000000 R09: 0000000000000001 [ 267.516650][ T7959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 267.516665][ T7959] R13: 00007feee9426038 R14: 00007feee9425fa0 R15: 00007fff90df77f8 [ 267.516704][ T7959] [ 270.038914][ T4921] Bluetooth: hci3: command tx timeout [ 271.460624][ T8000] netlink: 4 bytes leftover after parsing attributes in process `syz.1.481'. [ 271.501399][ T4921] Bluetooth: hci5: unexpected event for opcode 0x2023 [ 272.094505][ T4921] Bluetooth: hci3: command tx timeout [ 272.623731][ T8015] loop2: detected capacity change from 0 to 8192 [ 272.641420][ T8015] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 274.162874][ T4921] Bluetooth: hci3: command tx timeout [ 274.800756][ T7940] netdevsim0 speed is unknown, defaulting to 1000 [ 275.528281][ T4921] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 275.539031][ T4921] Bluetooth: hci5: Injecting HCI hardware error event [ 275.572532][ T5613] Bluetooth: hci5: hardware error 0x00 [ 276.954069][ T4921] Bluetooth: hci3: command tx timeout [ 277.982651][ T5613] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 279.096075][ T8059] loop4: detected capacity change from 0 to 256 [ 279.103537][ T8059] vfat: Unknown parameter '' [ 280.085300][ T8059] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 280.093089][ T8059] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 280.288496][ T8059] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 280.296147][ T8059] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 280.349756][ T8059] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 280.401125][ T8059] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 280.408776][ T8059] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 280.556008][ T8059] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 280.563826][ T8059] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 281.097378][ T8059] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 281.682498][ T5613] Bluetooth: hci1: command 0x0406 tx timeout [ 281.805532][ T63] bridge_slave_1: left allmulticast mode [ 281.849427][ T63] bridge_slave_1: left promiscuous mode [ 282.039622][ T8084] loop1: detected capacity change from 0 to 8192 [ 282.101051][ T8084] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 282.115268][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.151671][ T63] bridge_slave_0: left allmulticast mode [ 282.172166][ T63] bridge_slave_0: left promiscuous mode [ 282.322616][ T5613] Bluetooth: hci2: command 0x0406 tx timeout [ 282.349897][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.482715][ T5613] Bluetooth: hci4: command 0x0406 tx timeout [ 283.128818][ T5613] Bluetooth: hci3: command 0x0c1a tx timeout [ 284.375116][ T5613] Bluetooth: hci1: command 0x0406 tx timeout [ 284.406047][ T5613] Bluetooth: hci2: command 0x0406 tx timeout [ 284.562465][ T5613] Bluetooth: hci4: command 0x0406 tx timeout [ 284.583031][ T8094] binder: BINDER_SET_CONTEXT_MGR already set [ 284.610102][ T8094] binder: 8093:8094 ioctl 4018620d 200000004a80 returned -16 [ 285.053095][ T8102] loop2: detected capacity change from 0 to 128 [ 285.091052][ T8102] netlink: 24 bytes leftover after parsing attributes in process `syz.2.508'. [ 285.203779][ T5613] Bluetooth: hci3: command 0x0c1a tx timeout [ 285.275808][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 285.333863][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 285.360284][ T63] bond0 (unregistering): Released all slaves [ 286.483081][ T5613] Bluetooth: hci2: command 0x0406 tx timeout [ 286.714357][ T8121] loop4: detected capacity change from 0 to 1033 [ 286.889523][ T8121] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 286.969233][ T63] hsr_slave_0: left promiscuous mode [ 287.003725][ T8121] ext4 filesystem being mounted at /95/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 287.044847][ T63] hsr_slave_1: left promiscuous mode [ 287.110531][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 287.201181][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 287.283252][ T5613] Bluetooth: hci3: command 0x0c1a tx timeout [ 288.048474][ T8136] loop1: detected capacity change from 0 to 8192 [ 288.077519][ T8136] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 288.152625][ T5614] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 288.670027][ T63] veth0_vlan: left promiscuous mode [ 289.680501][ T8164] loop0: detected capacity change from 0 to 1024 [ 289.884106][ T8164] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 290.519274][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 290.573037][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 290.631710][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 290.690355][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 290.715650][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 290.796237][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 290.829664][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 290.860186][ T8197] MTRR 1 not used [ 290.867663][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 290.896717][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 291.021415][ T5603] EXT4-fs error (device loop0): ext4_empty_dir:3082: inode #11: comm syz-executor: invalid size [ 291.776180][ T63] team0 (unregistering): Port device team_slave_1 removed [ 291.859231][ T63] team0 (unregistering): Port device team_slave_0 removed [ 291.877979][ T8200] nvme_fc: nvme_fc_create_ctrl: nn-0x3333333333333333:pn-0x4444444444444444 - nn-0x1111111111111111:pn-0x2222222222222222 combination not found [ 293.324754][ T8151] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 293.448632][ T8215] jffs2: notice: (8215) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 293.496987][ T5267] 8021q: adding VLAN 0 to HW filter on device eth5 [ 293.684038][ T8223] netlink: 'syz.3.539': attribute type 1 has an invalid length. [ 294.575165][ T8232] loop2: detected capacity change from 0 to 8192 [ 294.692769][ T8232] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 294.968829][ T5603] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 295.047922][ T8235] netlink: 28 bytes leftover after parsing attributes in process `syz.3.539'. [ 295.269107][ T8229] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 295.607711][ T8233] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 295.642872][ T37] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 295.657994][ T8235] 8021q: adding VLAN 0 to HW filter on device bond1 [ 296.716181][ T49] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 297.455595][ T7940] bridge0: port 1(bridge_slave_0) entered blocking state [ 297.499437][ T7940] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.521522][ T7940] bridge_slave_0: entered allmulticast mode [ 297.543164][ T7940] bridge_slave_0: entered promiscuous mode [ 299.914389][ T4921] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 299.926220][ T4921] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 299.940963][ T4921] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 299.968211][ T4921] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 299.977015][ T4921] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 300.031690][ T7940] bridge0: port 2(bridge_slave_1) entered blocking state [ 300.093659][ T7940] bridge0: port 2(bridge_slave_1) entered disabled state [ 300.128824][ T7940] bridge_slave_1: entered allmulticast mode [ 300.139039][ T7940] bridge_slave_1: entered promiscuous mode [ 300.207597][ T7940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 300.265318][ T7940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 300.674414][ T7940] team0: Port device team_slave_0 added [ 302.512584][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 302.922485][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 303.013482][ T5613] Bluetooth: hci0: command tx timeout [ 303.078455][ T63] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.146548][ T7940] team0: Port device team_slave_1 added [ 303.314943][ T8311] loop2: detected capacity change from 0 to 8192 [ 303.465748][ T8311] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 304.182125][ T7940] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 304.250948][ T7940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 304.457237][ T7940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 305.043126][ T5613] Bluetooth: hci0: command tx timeout [ 305.540599][ T7940] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 305.641006][ T7940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 306.045432][ T7940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 307.081545][ T63] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.124172][ T5613] Bluetooth: hci0: command tx timeout [ 307.563436][ T8344] netlink: 4 bytes leftover after parsing attributes in process `syz.3.570'. [ 308.289576][ T7940] hsr_slave_0: entered promiscuous mode [ 308.313170][ T7940] hsr_slave_1: entered promiscuous mode [ 308.334069][ T7940] debugfs: 'hsr0' already exists in 'hsr' [ 308.349909][ T7940] Cannot create hsr debugfs directory [ 308.467834][ T63] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.637188][ T8276] netdevsim0 speed is unknown, defaulting to 1000 [ 308.721318][ T8346] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 309.202555][ T5613] Bluetooth: hci0: command tx timeout [ 311.592290][ T63] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 311.661064][ T8373] loop3: detected capacity change from 0 to 128 [ 311.729561][ T8373] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 311.843460][ T8373] ext4 filesystem being mounted at /89/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 312.001642][ T5621] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 312.413891][ T8387] netlink: 12 bytes leftover after parsing attributes in process `syz.2.581'. [ 314.628818][ T8398] loop4: detected capacity change from 0 to 512 [ 314.698813][ T8398] EXT4-fs error (device loop4): ext4_orphan_get:1399: inode #15: comm syz.4.584: iget: bad i_size value: 38620345925642 [ 314.760377][ T8398] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 314.762395][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 314.778007][ C1] EXT4-fs (loop4): initial error at time 1786123397: ext4_orphan_get:1399: inode 15 [ 314.787443][ C1] EXT4-fs (loop4): last error at time 1786123397: ext4_orphan_get:1399: inode 15 [ 314.825668][ T8398] EXT4-fs error (device loop4): ext4_orphan_get:1404: comm syz.4.584: couldn't read orphan inode 15 (err -117) [ 314.907172][ T8398] loop4: lost filesystem error report for type 5 error -117 [ 314.930382][ T8398] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 315.457642][ T31] audit: type=1804 audit(1786123398.490:228): pid=8413 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.586" name="/newroot/122/file0" dev="tmpfs" ino=688 res=1 errno=0 [ 316.576460][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.584553][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 316.765995][ T63] bridge_slave_1: left allmulticast mode [ 317.071149][ T63] bridge_slave_1: left promiscuous mode [ 317.582442][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 317.623690][ T63] bridge_slave_0: left allmulticast mode [ 317.660624][ T7378] EXT4-fs error (device loop4): ext4_validate_block_bitmap:432: comm kworker/u8:16: bg 0: block 5: invalid block bitmap [ 317.684516][ T63] bridge_slave_0: left promiscuous mode [ 317.700580][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 317.719857][ T7378] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 240 with error 28 [ 317.734104][ T7378] EXT4-fs (loop4): This should not happen!! Data will be lost [ 317.734104][ T7378] [ 317.747485][ T7378] EXT4-fs (loop4): Total free blocks count 0 [ 317.754524][ T7378] EXT4-fs (loop4): Free/Dirty block details [ 317.761709][ T7378] EXT4-fs (loop4): free_blocks=0 [ 317.779017][ T7378] EXT4-fs (loop4): dirty_blocks=244 [ 317.784971][ T7378] EXT4-fs (loop4): Block reservation details [ 317.795050][ T7378] EXT4-fs (loop4): i_reserved_data_blocks=244 [ 317.845320][ T5614] EXT4-fs warning (device loop4): ext4_evict_inode:195: inode #18: comm syz-executor: data will be lost [ 317.913163][ T5614] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 319.316888][ T8452] loop4: detected capacity change from 0 to 256 [ 319.414256][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 319.430786][ T31] audit: type=1804 audit(1786123402.510:229): pid=8452 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.597" name="/newroot/111/file0/bus" dev="loop4" ino=1048635 res=1 errno=0 [ 319.476132][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 319.499094][ T63] bond0 (unregistering): Released all slaves [ 326.650382][ T8276] bridge0: port 1(bridge_slave_0) entered blocking state [ 326.713940][ T8276] bridge0: port 1(bridge_slave_0) entered disabled state [ 326.779325][ T8276] bridge_slave_0: entered allmulticast mode [ 326.872055][ T8276] bridge_slave_0: entered promiscuous mode [ 326.918308][ T8276] bridge0: port 2(bridge_slave_1) entered blocking state [ 326.958666][ T8276] bridge0: port 2(bridge_slave_1) entered disabled state [ 327.014570][ T8276] bridge_slave_1: entered allmulticast mode [ 327.050563][ T8276] bridge_slave_1: entered promiscuous mode [ 327.291507][ T4921] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 327.311617][ T4921] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 327.321705][ T4921] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 327.333929][ T4921] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 327.345897][ T4921] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 327.759564][ T8541] netlink: 12 bytes leftover after parsing attributes in process `syz.2.617'. [ 327.779610][ T63] hsr_slave_0: left promiscuous mode [ 327.802619][ T63] hsr_slave_1: left promiscuous mode [ 327.833578][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 327.862055][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 327.936591][ T63] veth1_macvtap: left promiscuous mode [ 327.962959][ T63] veth0_macvtap: left promiscuous mode [ 328.002602][ T63] veth1_vlan: left promiscuous mode [ 328.021407][ T63] veth0_vlan: left promiscuous mode [ 329.387910][ T31] audit: type=1800 audit(1786123412.470:230): pid=8563 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.622" name="c_srate" dev="configfs" ino=16189 res=0 errno=0 [ 329.446299][ T4921] Bluetooth: hci6: command tx timeout [ 329.830133][ T63] team0 (unregistering): Port device team_slave_1 removed [ 329.904621][ T63] team0 (unregistering): Port device team_slave_0 removed [ 330.354873][ T8276] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 330.574238][ T8586] ceph: No mds server is up or the cluster is laggy [ 330.940489][ T5741] libceph: connect (1)[c::]:6789 error -101 [ 331.062229][ T5741] libceph: mon0 (1)[c::]:6789 connect error [ 331.475951][ T5741] libceph: connect (1)[c::]:6789 error -101 [ 331.507456][ T5741] libceph: mon0 (1)[c::]:6789 connect error [ 331.522641][ T4921] Bluetooth: hci6: command tx timeout [ 331.669350][ T8536] tipc: Enabling of bearer rejected, failed to enable media [ 332.054298][ T5741] libceph: connect (1)[c::]:6789 error -101 [ 332.070592][ T5741] libceph: mon0 (1)[c::]:6789 connect error [ 332.089208][ T8276] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 332.592774][ T8276] team0: Port device team_slave_0 added [ 332.611128][ T8276] team0: Port device team_slave_1 added [ 334.872738][ T4921] Bluetooth: hci6: command tx timeout [ 335.162238][ T8276] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 335.307107][ T8276] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 335.467835][ T8276] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 335.539465][ T8276] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 335.595142][ T8276] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 335.668478][ T8276] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 335.990751][ T8276] hsr_slave_0: entered promiscuous mode [ 336.032023][ T8276] hsr_slave_1: entered promiscuous mode [ 336.061525][ T8276] debugfs: 'hsr0' already exists in 'hsr' [ 336.096811][ T8276] Cannot create hsr debugfs directory [ 336.268087][ T8625] : renamed from vlan0 (while UP) [ 336.419593][ T63] bridge_slave_1: left allmulticast mode [ 336.435045][ T63] bridge_slave_1: left promiscuous mode [ 336.468222][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 336.526518][ T63] bridge_slave_0: left allmulticast mode [ 336.545979][ T63] bridge_slave_0: left promiscuous mode [ 336.550486][ T8638] loop3: detected capacity change from 0 to 1024 [ 336.564556][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 336.573271][ T8640] loop2: detected capacity change from 0 to 512 [ 336.584835][ T8640] EXT4-fs: Ignoring removed bh option [ 336.656272][ T8640] EXT4-fs error (device loop2): ext4_iget_extra_inode:5180: inode #15: comm syz.2.646: corrupted in-inode xattr: e_value size too large [ 336.671013][ T8640] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 336.674132][ T8640] EXT4-fs error (device loop2): ext4_orphan_get:1404: comm syz.2.646: couldn't read orphan inode 15 (err -117) [ 336.683331][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 336.683355][ C0] EXT4-fs (loop2): initial error at time 1786123419: ext4_iget_extra_inode:5180: inode 15 [ 336.683397][ C0] EXT4-fs (loop2): last error at time 1786123419: ext4_iget_extra_inode:5180: inode 15 [ 336.695062][ T8638] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 336.697157][ T8640] loop2: lost filesystem error report for type 5 error -117 [ 336.801145][ T8640] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 336.886661][ T4921] Bluetooth: hci6: command tx timeout [ 337.072717][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 337.266133][ T8650] evm: overlay not supported [ 337.556618][ T31] audit: type=1800 audit(1786123420.350:231): pid=8650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.645" name="file1" dev="overlay" ino=15 res=0 errno=0 [ 337.671282][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 337.719483][ T63] bond0 (unregistering): Released all slaves [ 337.805267][ T8522] netdevsim0 speed is unknown, defaulting to 1000 [ 337.863767][ T5604] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 338.170281][ T5621] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 338.457161][ T8664] FAT-fs (nbd4): unable to read boot sector [ 339.338815][ T63] hsr_slave_0: left promiscuous mode [ 339.360339][ T63] hsr_slave_1: left promiscuous mode [ 339.391745][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 339.426310][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 339.489155][ T8667] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 339.669682][ T8678] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 340.401578][ T8686] jffs2: notice: (8686) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 340.481980][ T4921] Bluetooth: hci4: unexpected event for opcode 0x2023 [ 340.739821][ T8700] loop8: detected capacity change from 0 to 7 [ 340.759773][ T8700] Dev loop8: unable to read RDB block 7 [ 340.768623][ T8700] loop8: unable to read partition table [ 340.778852][ T63] team0 (unregistering): Port device team_slave_1 removed [ 340.784984][ T8700] loop8: partition table beyond EOD, truncated [ 340.803182][ T8700] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 340.830801][ T63] team0 (unregistering): Port device team_slave_0 removed [ 341.277800][ T8709] trusted_key: encrypted_key: key user:syz not found [ 341.373643][ T4921] Bluetooth: hci0: command 0x0401 tx timeout [ 341.748672][ T8709] loop3: detected capacity change from 0 to 2048 [ 341.757173][ T5267] 8021q: adding VLAN 0 to HW filter on device eth9 [ 341.871816][ T8709] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 341.896477][ T8709] ext4 filesystem being mounted at /112/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 342.083355][ T8715] loop1: detected capacity change from 0 to 256 [ 342.591620][ T8722] loop1: detected capacity change from 0 to 1024 [ 342.664412][ T8722] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 342.696705][ T5621] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 343.249371][ T5605] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 343.601539][ T8718] syz.2.666 (8718) used greatest stack depth: 17392 bytes left [ 344.553580][ T4921] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 344.566668][ T4921] Bluetooth: hci4: Injecting HCI hardware error event [ 344.575359][ T5613] Bluetooth: hci4: hardware error 0x00 [ 344.976914][ T31] audit: type=1800 audit(1786123427.820:232): pid=8762 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.675" name="file0" dev="overlay" ino=808 res=0 errno=0 [ 345.248378][ T8770] loop3: detected capacity change from 0 to 256 [ 347.409983][ T5613] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 347.439614][ T5267] 8021q: adding VLAN 0 to HW filter on device eth10 [ 347.491374][ T8276] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 347.564008][ T8276] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 347.624695][ T8276] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 347.700768][ T8276] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 347.879867][ T8276] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 347.906660][ T8276] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 347.923371][ T8276] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 347.951350][ T8276] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 348.051155][ T8522] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.070656][ T8522] bridge0: port 1(bridge_slave_0) entered disabled state [ 348.091490][ T8522] bridge_slave_0: entered allmulticast mode [ 348.115987][ T8522] bridge_slave_0: entered promiscuous mode [ 348.143600][ T8522] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.162219][ T8522] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.196144][ T8522] bridge_slave_1: entered allmulticast mode [ 348.243079][ T8522] bridge_slave_1: entered promiscuous mode [ 348.387128][ T8522] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 348.421391][ T8522] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 348.526841][ T8522] team0: Port device team_slave_0 added [ 348.547071][ T8522] team0: Port device team_slave_1 added [ 348.687053][ T8522] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 348.740111][ T8522] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 349.183296][ T8522] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 349.599703][ T8522] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 349.607082][ T8522] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 349.634408][ T8522] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 349.687046][ T5267] 8021q: adding VLAN 0 to HW filter on device eth11 [ 349.814109][ T8522] hsr_slave_0: entered promiscuous mode [ 349.828093][ T8522] hsr_slave_1: entered promiscuous mode [ 349.838934][ T8522] debugfs: 'hsr0' already exists in 'hsr' [ 349.852702][ T8522] Cannot create hsr debugfs directory [ 349.877058][ T8829] loop1: detected capacity change from 0 to 256 [ 350.040696][ T8831] loop4: detected capacity change from 0 to 1024 [ 350.171768][ T8831] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 350.266476][ T8835] jffs2: notice: (8835) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 350.688101][ T5614] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 350.897675][ T8852] loop3: detected capacity change from 0 to 7 [ 350.910337][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 350.920311][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.938758][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 350.948436][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.968617][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 350.978381][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 350.995974][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.005706][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.058497][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.068255][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.079871][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 351.089592][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 351.096092][ T8276] 8021q: adding VLAN 0 to HW filter on device bond0 [ 351.134049][ T8854] [ 351.136439][ T8854] ====================================================== [ 351.143460][ T8854] WARNING: possible circular locking dependency detected [ 351.150470][ T8854] syzkaller #0 Not tainted [ 351.154879][ T8854] ------------------------------------------------------ [ 351.161888][ T8854] syz.4.697/8854 is trying to acquire lock: [ 351.167770][ T8854] ffff88801c28d210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_iop_getattr+0x9e/0x450 [ 351.178076][ T8854] [ 351.178076][ T8854] but task is already holding lock: [ 351.185427][ T8854] ffff888025459c50 (&q->q_usage_counter(io)#20){++++}-{0:0}, at: lo_ioctl+0x1a65/0x1fc0 [ 351.195221][ T8854] [ 351.195221][ T8854] which lock already depends on the new lock. [ 351.195221][ T8854] [ 351.205621][ T8854] [ 351.205621][ T8854] the existing dependency chain (in reverse order) is: [ 351.206438][ T8522] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 351.214628][ T8854] [ 351.214628][ T8854] -> #2 (&q->q_usage_counter(io)#20){++++}-{0:0}: [ 351.214679][ T8854] blk_alloc_queue+0x544/0x690 [ 351.235269][ T8854] __blk_mq_alloc_disk+0x194/0x390 [ 351.240923][ T8854] loop_add+0x480/0xb40 [ 351.245620][ T8854] loop_init+0xd7/0x160 [ 351.250311][ T8854] do_one_initcall+0x250/0x870 [ 351.255610][ T8854] do_initcall_level+0x10a/0x1a0 [ 351.261112][ T8854] do_initcalls+0x59/0xa0 [ 351.265977][ T8854] kernel_init_freeable+0x29d/0x3e0 [ 351.271708][ T8854] kernel_init+0x1d/0x1d0 [ 351.276555][ T8854] ret_from_fork+0x514/0xb70 [ 351.281676][ T8854] ret_from_fork_asm+0x1a/0x30 [ 351.286977][ T8854] [ 351.286977][ T8854] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 351.294205][ T8854] fs_reclaim_acquire+0x71/0x100 [ 351.299675][ T8854] kmem_cache_alloc_noprof+0x64/0x5f0 [ 351.305571][ T8854] __kernfs_iattrs+0xdd/0x380 [ 351.310770][ T8854] kernfs_iop_setattr+0xe6/0x3f0 [ 351.316229][ T8854] notify_change+0xbba/0xea0 [ 351.321331][ T8854] do_truncate+0x1c2/0x250 [ 351.326267][ T8854] path_openat+0x2fed/0x3830 [ 351.331381][ T8854] do_file_open+0x23e/0x4a0 [ 351.336427][ T8854] do_sys_openat2+0x115/0x200 [ 351.341634][ T8854] __x64_sys_openat+0x138/0x170 [ 351.347003][ T8854] do_syscall_64+0x174/0x580 [ 351.352115][ T8854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 351.358522][ T8854] [ 351.358522][ T8854] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 351.367037][ T8854] __lock_acquire+0x1520/0x2cf0 [ 351.372406][ T8854] lock_acquire+0x106/0x350 [ 351.377424][ T8854] down_read+0x4a/0x330 [ 351.382096][ T8854] kernfs_iop_getattr+0x9e/0x450 [ 351.387552][ T8854] vfs_getattr_nosec+0x2e1/0x430 [ 351.393002][ T8854] loop_assign_backing_file+0x27a/0x4b0 [ 351.399067][ T8854] lo_ioctl+0x1ad6/0x1fc0 [ 351.403920][ T8854] blkdev_ioctl+0x5e3/0x740 [ 351.408944][ T8854] __se_sys_ioctl+0xfc/0x170 [ 351.414042][ T8854] do_syscall_64+0x174/0x580 [ 351.419153][ T8854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 351.425554][ T8854] [ 351.425554][ T8854] other info that might help us debug this: [ 351.425554][ T8854] [ 351.435765][ T8854] Chain exists of: [ 351.435765][ T8854] &root->kernfs_iattr_rwsem --> fs_reclaim --> &q->q_usage_counter(io)#20 [ 351.435765][ T8854] [ 351.450203][ T8854] Possible unsafe locking scenario: [ 351.450203][ T8854] [ 351.457670][ T8854] CPU0 CPU1 [ 351.463018][ T8854] ---- ---- [ 351.468364][ T8854] lock(&q->q_usage_counter(io)#20); [ 351.473735][ T8854] lock(fs_reclaim); [ 351.480225][ T8854] lock(&q->q_usage_counter(io)#20); [ 351.488117][ T8854] rlock(&root->kernfs_iattr_rwsem); [ 351.493485][ T8854] [ 351.493485][ T8854] *** DEADLOCK *** [ 351.493485][ T8854] [ 351.501609][ T8854] 3 locks held by syz.4.697/8854: [ 351.506614][ T8854] #0: ffff88802609b430 (&lo->lo_mutex){+.+.}-{4:4}, at: lo_ioctl+0x14c7/0x1fc0 [ 351.515682][ T8854] #1: ffff888025459c50 (&q->q_usage_counter(io)#20){++++}-{0:0}, at: lo_ioctl+0x1a65/0x1fc0 [ 351.525886][ T8854] #2: ffff888025459c88 (&q->q_usage_counter(queue)#4){+.+.}-{0:0}, at: lo_ioctl+0x1a65/0x1fc0 [ 351.536267][ T8854] [ 351.536267][ T8854] stack backtrace: [ 351.542146][ T8854] CPU: 0 UID: 0 PID: 8854 Comm: syz.4.697 Not tainted syzkaller #0 PREEMPT(full) [ 351.542170][ T8854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 351.542184][ T8854] Call Trace: [ 351.542194][ T8854] [ 351.542203][ T8854] dump_stack_lvl+0xe8/0x150 [ 351.542235][ T8854] print_circular_bug+0x2e1/0x300 [ 351.542273][ T8854] check_noncircular+0x12e/0x150 [ 351.542311][ T8854] __lock_acquire+0x1520/0x2cf0 [ 351.542354][ T8854] ? kernfs_iop_getattr+0x9e/0x450 [ 351.542388][ T8854] lock_acquire+0x106/0x350 [ 351.542419][ T8854] ? kernfs_iop_getattr+0x9e/0x450 [ 351.542459][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.542494][ T8854] down_read+0x4a/0x330 [ 351.542533][ T8854] ? kernfs_iop_getattr+0x9e/0x450 [ 351.542570][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.542601][ T8854] kernfs_iop_getattr+0x9e/0x450 [ 351.542634][ T8854] vfs_getattr_nosec+0x2e1/0x430 [ 351.542667][ T8854] loop_assign_backing_file+0x27a/0x4b0 [ 351.542701][ T8854] ? __pfx_loop_assign_backing_file+0x10/0x10 [ 351.542749][ T8854] lo_ioctl+0x1ad6/0x1fc0 [ 351.542782][ T8854] ? __pfx_lo_ioctl+0x10/0x10 [ 351.542808][ T8854] ? is_bpf_text_address+0x26/0x2b0 [ 351.542840][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.542865][ T8854] ? kernel_text_address+0xa5/0xe0 [ 351.542900][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.542925][ T8854] ? __lock_acquire+0x683/0x2cf0 [ 351.542956][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.542981][ T8854] ? __lock_acquire+0x683/0x2cf0 [ 351.543013][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543038][ T8854] ? __lock_acquire+0x683/0x2cf0 [ 351.543071][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543096][ T8854] ? __lock_acquire+0x683/0x2cf0 [ 351.543127][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543161][ T8854] ? __lock_acquire+0x683/0x2cf0 [ 351.543196][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543226][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543255][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543282][ T8854] ? is_bpf_text_address+0x26/0x2b0 [ 351.543313][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543338][ T8854] ? is_bpf_text_address+0x292/0x2b0 [ 351.543367][ T8854] ? is_bpf_text_address+0x26/0x2b0 [ 351.543399][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543424][ T8854] ? kernel_text_address+0xa5/0xe0 [ 351.543462][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543487][ T8854] ? __kernel_text_address+0xd/0x30 [ 351.543518][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543543][ T8854] ? unwind_get_return_address+0x4d/0x90 [ 351.543578][ T8854] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 351.543604][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543629][ T8854] ? arch_stack_walk+0xfb/0x150 [ 351.543669][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543694][ T8854] ? stack_trace_save+0xa9/0x100 [ 351.543719][ T8854] ? __pfx_stack_trace_save+0x10/0x10 [ 351.543742][ T8854] ? kasan_save_track+0x4f/0x80 [ 351.543771][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543796][ T8854] ? stack_depot_save_flags+0x33/0x800 [ 351.543821][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543845][ T8854] ? __lock_acquire+0x683/0x2cf0 [ 351.543875][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.543899][ T8854] ? kasan_save_track+0x4f/0x80 [ 351.543925][ T8854] ? kasan_save_track+0x3e/0x80 [ 351.543950][ T8854] ? kasan_save_free_info+0x40/0x50 [ 351.543970][ T8854] ? __kasan_slab_free+0x5c/0x80 [ 351.543997][ T8854] ? kfree+0x1c5/0x640 [ 351.544018][ T8854] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 351.544049][ T8854] ? security_file_ioctl+0xc3/0x2a0 [ 351.544077][ T8854] ? __se_sys_ioctl+0x47/0x170 [ 351.544096][ T8854] ? do_syscall_64+0x174/0x580 [ 351.544125][ T8854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 351.544153][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544178][ T8854] ? __asan_memset+0x22/0x50 [ 351.544201][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544226][ T8854] ? blk_get_meta_cap+0x19d/0x780 [ 351.544259][ T8854] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 351.544293][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544318][ T8854] ? blkdev_common_ioctl+0x14b7/0x3250 [ 351.544355][ T8854] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 351.544388][ T8854] ? kasan_quarantine_put+0xbb/0x1f0 [ 351.544414][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544442][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544468][ T8854] ? tomoyo_path_number_perm+0x219/0x5f0 [ 351.544500][ T8854] ? tomoyo_path_number_perm+0x219/0x5f0 [ 351.544531][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544557][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544581][ T8854] ? do_vfs_ioctl+0x116f/0x1530 [ 351.544603][ T8854] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 351.544624][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544649][ T8854] ? do_raw_spin_lock+0x12b/0x2f0 [ 351.544673][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544698][ T8854] ? hook_file_ioctl+0x1f0/0x5f0 [ 351.544740][ T8854] ? __pfx_lo_ioctl+0x10/0x10 [ 351.544769][ T8854] blkdev_ioctl+0x5e3/0x740 [ 351.544803][ T8854] ? __pfx_blkdev_ioctl+0x10/0x10 [ 351.544834][ T8854] ? __fget_files+0x2a/0x420 [ 351.544863][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544888][ T8854] ? srso_alias_return_thunk+0x5/0xfbef5 [ 351.544913][ T8854] ? __pfx_blkdev_ioctl+0x10/0x10 [ 351.544946][ T8854] __se_sys_ioctl+0xfc/0x170 [ 351.544965][ T8854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 351.544988][ T8854] do_syscall_64+0x174/0x580 [ 351.545017][ T8854] ? trace_irq_disable+0x3b/0x140 [ 351.545045][ T8854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 351.545067][ T8854] RIP: 0033:0x7f9e7539e0d9 [ 351.545087][ T8854] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 351.545105][ T8854] RSP: 002b:00007f9e735d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 351.545127][ T8854] RAX: ffffffffffffffda RBX: 00007f9e75626180 RCX: 00007f9e7539e0d9 [ 351.545149][ T8854] RDX: 0000000000000004 RSI: 0000000000004c06 RDI: 0000000000000003 [ 351.545162][ T8854] RBP: 00007f9e75435024 R08: 0000000000000000 R09: 0000000000000000 [ 351.545176][ T8854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 351.545189][ T8854] R13: 00007f9e75626218 R14: 00007f9e75626180 R15: 00007ffe005e97a8 [ 351.545215][ T8854] [ 352.161163][ T8522] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 352.169580][ T8860] 9p: Bad value for 'rfdno' [ 352.195791][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 352.205470][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 352.216049][ T8852] ldm_validate_partition_table(): Disk read failed. [ 352.226115][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 352.235864][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 352.245795][ C0] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 352.255450][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 352.258400][ T8522] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 352.276195][ C1] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 352.285853][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 352.293880][ T8852] Dev loop3: unable to read RDB block 0 [ 352.307689][ T8522] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 352.310374][ T8852] loop3: unable to read partition table [ 352.319747][ T8522] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 352.322835][ T8852] loop3: partition table beyond EOD, truncated [ 352.337836][ T8522] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 352.347454][ T8852] loop_reread_partitions: partition scan of loop3 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 352.354535][ T8276] 8021q: adding VLAN 0 to HW filter on device team0 [ 352.391956][ T8522] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 352.409019][ T8522] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 352.426490][ T8854] ldm_validate_partition_table(): Disk read failed. [ 352.435573][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.442713][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 352.460194][ T8854] Dev loop3: unable to read RDB block 0 [ 352.479582][ T31] audit: type=1804 audit(1786123435.560:233): pid=8873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.699" name="/newroot/121/file0" dev="tmpfs" ino=686 res=1 errno=0 [ 352.479863][ T8854] loop3: unable to read partition table [ 352.508561][ T8854] loop3: partition table beyond EOD, truncated [ 352.514956][ T8854] loop_reread_partitions: partition scan of loop3 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 352.554745][ T5880] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.562579][ T5880] bridge0: port 2(bridge_slave_1) entered forwarding state [ 352.682686][ T8522] 8021q: adding VLAN 0 to HW filter on device bond0 [ 352.705943][ T8522] 8021q: adding VLAN 0 to HW filter on device team0 [ 352.720737][ T3289] bridge0: port 1(bridge_slave_0) entered blocking state [ 352.727881][ T3289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 352.770489][ T3289] bridge0: port 2(bridge_slave_1) entered blocking state [ 352.777652][ T3289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 352.801146][ T5267] 8021q: adding VLAN 0 to HW filter on device eth12 [ 353.232745][ T8276] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 353.331847][ T8522] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 353.568502][ T8276] veth0_vlan: entered promiscuous mode [ 353.588626][ T8276] veth1_vlan: entered promiscuous mode [ 353.632024][ T8276] veth0_macvtap: entered promiscuous mode [ 353.641315][ T8276] veth1_macvtap: entered promiscuous mode [ 353.670388][ T8276] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 353.685400][ T8276] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 353.750063][ T8276] ieee80211 phy15: Selected rate control algorithm 'minstrel_ht' [ 353.769562][ T8522] veth0_vlan: entered promiscuous mode [ 353.794469][ T5880] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 353.804616][ T8522] veth1_vlan: entered promiscuous mode [ 353.811485][ T5880] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.822531][ T3289] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.831627][ T8276] ieee80211 phy16: Selected rate control algorithm 'minstrel_ht' [ 353.847250][ T13] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.884433][ T8522] veth0_macvtap: entered promiscuous mode [ 353.898927][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 353.902053][ T8522] veth1_macvtap: entered promiscuous mode [ 353.913672][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.918453][ T3289] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.931876][ T3289] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.966187][ T8522] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 353.979233][ T8522] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 354.045720][ T8522] ieee80211 phy17: Selected rate control algorithm 'minstrel_ht' [ 354.063567][ T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.077160][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.101178][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 354.110063][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 354.111251][ T8522] ieee80211 phy18: Selected rate control algorithm 'minstrel_ht' [ 354.148738][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 354.157969][ T3289] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.167950][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 354.180935][ T3289] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0