last executing test programs: 3.866884299s ago: executing program 2 (id=7540): r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0xc8080) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r0, 0xc1105518, &(0x7f00000001c0)={{0x3, 0x5, 0x8, 0x3a, '\x00', 0x5}, 0x4, 0x3, 0x2, 0x0, 0x0, 0x2, 'syz1\x00', 0x0}) 3.630856031s ago: executing program 2 (id=7544): ioctl$vim2m_VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, &(0x7f0000000140)={0x0, 0x40, 0x4, {0x2, @raw_data="3d924b8271394fa4ec01eb92492ff84715d1a004d08b012a7cafe27a5f313d31bbdae50511ca5be6bfe92437ed0d21b5180e375be56b3b9306d7dbb26bf9f22de7ac7681cca450055250217bdf1113b4258293ba4efed33147bda8454dd115bd5ba066ba06f2854cc96db9a98055cbde9fd084a1223ada91ed2e832907a01ab5ee65f997b617f73d1aa5a6dfc47acdc5eb834f8e448469d235e4380cbcc3310200970349a3c1374ffec96177b67caa0656f9664277cadb8597e7d911ad1da457ef9744b0993c57a7"}}) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000020000402505a3a440000000010109023b000101010000090400001202eb0000052406000005240000000d240f010000000000000000000905820200020000000905"], 0x0) 2.310680554s ago: executing program 0 (id=7573): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x54, 0x10, 0x439, 0x70bd2a, 0x25dbdbfd, {0x0, 0x0, 0xe403, 0x0, 0x3, 0x610c0}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @sit={{0x8}, {0x28, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @private=0xa010100}, @IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @empty}, @IFLA_IPTUN_6RD_RELAY_PREFIX={0x8, 0xc, 0x3}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x8080}, 0x4008040) 2.157873187s ago: executing program 1 (id=7576): socket$inet_mptcp(0x2, 0x1, 0x106) syz_emit_vhci(&(0x7f0000000340)=@HCI_EVENT_PKT={0x4, @hci_ev_io_capa_request={{0x31, 0x6}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}}}, 0x9) 2.103907047s ago: executing program 2 (id=7577): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DONE(r0, 0x29, 0xd4, 0x0, 0x4) 2.012566224s ago: executing program 1 (id=7579): r0 = syz_open_dev$video(&(0x7f0000000540), 0x7, 0x0) ioctl$VIDIOC_OVERLAY(r0, 0x4004560e, &(0x7f0000000a00)) 2.011427502s ago: executing program 0 (id=7580): r0 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x7f, 0x20203843, 0x2, [0x2], [0x800], [0x1], [0x0, 0x0, 0x0, 0xfffffffffffffffc]}) 1.978003885s ago: executing program 2 (id=7581): syz_usb_connect$uac1(0x0, 0x91, &(0x7f0000000780)=ANY=[@ANYBLOB="12010003000000406b1d010140000102030109027f0003011010060904000000010100000a24010180010201020a240701000000d885700904010000010200000904010101010200000905010940001404cc07250101800400090402000001020000090402010101020000062401010500100f240202966802000221d53c71e3fa0905820908"], &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, 0x0) 1.824679894s ago: executing program 0 (id=7584): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x13, &(0x7f0000000080), 0x4) 1.823897041s ago: executing program 1 (id=7585): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@dev={0xfe, 0x80, '\x00', 0x1f}, 0xcb3d, 0x1, 0xff, 0x5, 0x400}, 0x20) 1.678011687s ago: executing program 0 (id=7587): r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r0, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:11 0', 0x1b) 1.677354553s ago: executing program 1 (id=7588): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x3c1, 0x3, 0x298, 0x0, 0x12, 0x60d, 0x0, 0x202, 0x2d8, 0x2e8, 0x2e8, 0x2d8, 0x2c0, 0x4, 0x0, {[{{@ipv6={@private1, @ipv4={'\x00', '\xff\xff', @empty}, [], [], 'ip_vti0\x00', 'macsec0\x00', {0xff}}, 0x0, 0xa8, 0xf0}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@ipv6={@mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff, 0x0, 0xffffff00, 0xff000000], [0xff, 0xff000000, 0x0, 0xff], 'ipvlan1\x00', 'erspan0\x00', {}, {0xff}, 0x2b, 0x5, 0x6}, 0x0, 0xa8, 0xd8}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f8) 1.529674173s ago: executing program 0 (id=7591): syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f00000001c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="66617374626f6f742c71756f7461000018bbdecde39739fcd1df176dde746ec834120600000000003b814e50a959736d6572462abc30ef5b65c70f73ecea54b5e5bea9836c319f653557e79a002208ce996dda659bd5ba0f4ce5c2080002223dc60000000000000044cd0a1e3686873600000000005493b4b81d5b9fa9b40fe4d76afc3a989c6d60044e89eb96e44d01a1034e3797ffa86870b82939f41ffa0f3d726f085663c29cbdc4c766a7eb77cc36160191acf5ae7469c82ab4145b595b987d75912a0fcd1c061835294cc0c618aba204f8adaa20c80108d356cd88cc86177056b06e7068c40f807d9e539f8f5b64a8ee0725aa8d00000000007cb6020d90ea79b8027cf75964dd86c2ed2b5e75779677aa8c76b848dd03dab190b5f02ec52830a17b01eaae1c3df076000000000000000000000000000083a48a6b926c668b9b90195018ea3619f9d80a0b894e212178e1a19909d764666264fa29e2c055fd7f8e67c2acfb75f0a8d41692f4542a575ee42ed94a0014fba44985cca9df12fe93bfaccf0122a6e7e593613ac0111701b125cc6799c43aa4ff708dc4a00a6decad26f0378072a571da000000b1a6bdf03fd56697e348b5b494f6fddb9f56142a47a40ef81690a7eca421bd0ad198afa58ce69d61c29deaa93c0efea0df04f20020ee84075b4e1a2ad43d1be1138de4668e7b6137545708790c501f1ed7f6a571d500000000000000"], 0x25, 0x55a8, &(0x7f00000014c0)="$eJzs3EtvG2UXAOAzTtP71y9CLNh1pAopkWqrTi+CFQVacRGtKi4LVuDYruXW9kSx64asumCJWPBPEEisWPIbWMASdogFiB1SkWcm0KQNtI3jqO3zSDNn5vj1mXdGlqUzYzmAZ9ZC+sdvSZyIIxExFxHHk8i3k3KJuBNxsRj7QkScjIjKPUtS5v9OHIyIoxFxYlK8qJmUL31xenzq/K9v//7t94cOHPvymx/29cSBffViRPRXi+3b/SJmnSLeKPONcTeP/XPjMq5uqdHPivzt9kpe4XZjc1wjj2c7xfhs9dZwEq/3Gs1J7HSv5/nVQXHA4bizWWfyhvRGYy3fb7VX8tgdZnnsbBTHXd8ovts2hqOiTqus90lePkajzVjk2+vt4nxWb+axORiV+aJu1mqvT+K4jOXhopn1Wvk8Vh7zIj8B3ukObq2n4/basJsN0vO1+ku1+oVqfS1rtUftc9VGv3XhXLrY6U2GVUftRv9iJ8s6vXatmfWX0sVOs1mt19PFS+2VbmOQ1uu1s7Uz1fNL5dbp9I2rH6S9Vro4ia91B7dG3d4wvZ6tpcU7ltLl2tmXl9JT9fS9K9fSa+9evnzl2vsfXfrw6qtX3nq9HHTftNLF5TPLy9X6mepyfekZOv9Py0k/wvknD07/9OPuLhsUdviAAbCz+/r/2N7/h/4fmLrd9P/9m+X+3vT/8TD9f0yz/5+0VPr//+5/K4/U/56YSv87H/r/PTx/2JXH6/8PTn0eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADM3M/zX72ZbywU+8fK/P/K1HPlfhIRlYi4+wBzcXBLzbmyzvwO4+e3zeG7JPIKk2McKpejEXGxXP78/15fBQAAAHh6fX3n5OdFt16sFvZ7QsxScdOmcvzjKdVLImJ+4ZcpVatMVs9PqVj++T4Q61Oqlt/AOjylYsUttwPTqvZQ5raEw/eEpAiVmU4HAACYia2dwGy7EAAAAGbps3999ZWZzYMZS2LzUebms+D8l/f/PBA8Mlnd3fbjfgAAAOBJkuz3BAAAAIA9l/f//v8PAAAAnm7F//8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBf7NzPjdpAFAfgZ4OB/FNQlHtayQ3KSAk55hgoIE1QAmkhDVADkXJICStYYc8ieRek1TLGWvR9ku2d8ernGeDyxtIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXfpbree/f375dWnObn+ZPLMBAAAATtlW63n9x7Rpv0v9H1LXp9QuIqKMiFO1+yBGrcxByqnO/H/1aAx/IuqEQ/84HW8j4ms67j52/SkAAADA7dosV7OmWm9OaQngX7+j4kqaRZvy/bdMeUVEVNP/mdLKw+lzprD69z2MH5nS6gWsSaawZsltePreKNdD2gaty8NMFvWXWLfKbp4LAAD0qV0JnKlCAAAAuAHf+x4A1/C0tC+Op+N7xnFzSS8E37RaAAAAwCtU9D0AAAAAoHN1/d/N/n+TF+3/V9j/DwAAALJr9v8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgS9tqPd8sV7Nz9xfPzNntL5NvRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9+zPOwqEQBiEwd71ncnc/7DSoKGxSRUIH39jMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABvfveX/xNT40wy99pYeh5J1k6NrVNj79w4+sP4+jUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwsT8vKRACQRAFc8b/Tvr+h5UEPYMIEdDwqKIWDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwBf97pf/E1PjTDJ32lg6HknWrhpbV429B42jB+Pt3wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwsW//vm1UcQDA3/lspylUhIAiEUAFdYCFpm5p6YoQKGLgT0CKUqcEXAptBlpFlCxsKHMXBAsSQkigsOV/6NxIXcrWIUOQmBiC7lf6nJgmpO05TT8f6fl9/Xx5P86Wla/fHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQWX83vNIo4zR7GCviqu32xuJsVq9tqzOry3cms5LFyUjVeuz1+mZ/oL0aPzk+MbyJAAAAcFgc2/WItMrvQwh3WyvTWd0Yy/P/VnVMlvP/UHaVlG3b8/61jcUj5UuTVf7/x+/3XtwaaCzNx8k6nZvvdU/tnEpz38t8wj236xHN/Mznv72k+RvS+HDphfVWfj6T727der+dhyN1zBYA2I+TVV0G1f9DWd0Z5sQAeGo0o8S7yv/TseHOCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAO60vhmSpOQgiTzftxZm1jcXZQ/c3yncnVspy7eXM57jProhVCmJvvdU/VuJaDqzqb1z+b6fW6V65eqzs4HkIY8NKNvf15Wk7/P49phxD6Wk68NKCfj/cw1rZ+dgTlxzPUew5Hs/XtenDS15LsOOHvbRaG8QGoK2iU78/jGGK09ve9P6g+e4++5//zXTLyaL6SAAA41FplyTLRu62V6awtGQ9h88f+/P+NKA59ef/mjaKleL4a5f/3Pjl3Ox4rzv87Na3vSTC1cOmLqavXrr81f2nmYvdi9/O3T3fe6Zw5f/bs+an8t5KpudDwiwkAAAAPoV2WOP8fHbD/fzSKwwP2/4st4SL///L7ztfxWKn8f6D7m37DngkAAMDTqL0VPf/a338lA45I2u3w1czCwpVO8bj1/HTxWOt092mkLHH+n44Pe1YAAABAHdaXkr79/wtRHB6w/x9f///szy//GveZFtcWXA4hdE/OXu5dqG85B1r/Tb8/pY/jRuV8oPawVwoAAMCwjJYl3v9vjWf5f2PrkodGCOHNEyH8U97DH/aY/6cffPtLPFZ8/f+ZWld58DQmivOR1xMhNCeGPSMAAAAOsyNlyZL9P1sr05/+dvSjtuv/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOr2bwAAAP//aR4tAA==") mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x181) 1.48172127s ago: executing program 1 (id=7592): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 1.317818858s ago: executing program 1 (id=7596): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x9e, 0x17, 0x36, 0x10, 0x17ef, 0x721e, 0xde06, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000400)={0x1c, &(0x7f00000001c0)=ANY=[@ANYBLOB="4017080000003ec019dd08"], 0x0, 0x0}) 1.190149078s ago: executing program 3 (id=7597): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r0, 0x1, 0x1b, &(0x7f0000000040)=0x46a0d53c, 0x4) 1.096466631s ago: executing program 3 (id=7599): r0 = socket(0x40000000015, 0x805, 0x0) getsockopt(r0, 0x114, 0x2720, 0x0, &(0x7f00000000c0)) 1.001258213s ago: executing program 4 (id=7600): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(r0, 0xc01c64ae, &(0x7f0000000040)={0x0, 0x7, 0x81, 0x8, 0x18, 0x10, 0xfffff801}) 974.705295ms ago: executing program 3 (id=7601): r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f00000000c0)={{0x1, 0x1, 0x4d}, './file0\x00'}) 834.998879ms ago: executing program 3 (id=7602): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="18020000feffffff0000000003000000850000004100000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f805ffffb702000008000006b703000003000000850000001700000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000180)="fc7da3c11f8a987f490d83586a74", 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 801.554881ms ago: executing program 4 (id=7603): setresuid(0xee01, 0xee01, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) 645.144199ms ago: executing program 4 (id=7604): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x60, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af7edbc}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x14, 0x5, 0x0, 0x1, [@IFLA_BRPORT_UNICAST_FLOOD={0x4}, @IFLA_BRPORT_MCAST_FLOOD={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 627.640088ms ago: executing program 3 (id=7605): syz_mount_image$nilfs2(&(0x7f0000003380), &(0x7f0000000f00)='./file0\x00', 0x3210052, &(0x7f0000003300)={[{}, {@errors_continue}, {@norecovery}, {@order_strict}, {@nobarrier}, {@order_strict}, {@nodiscard}, {@order_relaxed}], [], 0x2c}, 0x3, 0xed3, &(0x7f0000002400)="$eJzs3U9sHNUZAPA3a6/txCZeAwUDJaTQikDBDkmkprcgUI+IS88FhYRGGIoaeiDiT+gBUQlRJMSp4kDFhVIpRWolUKsK9dT21Kq3nlBViUpVKgX1UtTEVZz31rsvnu56bM96d38/6du3b97sfN94I2dmPPs2AGOrsfZ49OhiEcLbH7/18ItPFL+6suyO9hoH1h6L2GuFEJod/SLb3qdxwaWLL5zYqC3C4bXH1A+PXGi/djaEcC4cCJ+EVvhgeeXz99956OCHr87c9MbZp17aod1vy/cDAABG0fk/rvz1nn/84b6FL87vPx6m28vT8Xkr9mfjcf+heKCcjpcbobtfdESnqWy9iRiNbL2JbL3JLM9kSb5mtp1myXpTPfJNdCzbaD8BAABgGKXz2lYoGktd/UZjaenqef8Vn85PFUvPnF45dWZAhQIAAACV/fvltZtuhRBCCCGEELs0/rs6+BqEEEMVxUbLV+cHfQUCAAAAGDf5fGHXOLe9M3W1t9bqL/+FBxsbvx62Qd3//uUfrvzvveI3DgAA1Y3q0WTar3QcneYxyOcRnMhet9nj/0a2nclN1lk2r+CwzDdYVmf+c92tyurf7Ps4KGX15/Nh7lZl9efzdO5WZfVP11xHVWX1z9RcR1Vl9e+puY6qyurfW3MdVZXVP1tzHVWV1T9Xcx1VldV/Xc11VFVW/76a66iqrP5hua22rP5WzXVUVVb/Qs11VFVW//U111FVWf031FxHVWX131hzHYNye2zTz2F/Nt55/pyf0w3LOR4AAACMu/+Y/08IIYQQQgghhBj5eHnQFyAAAACAgUufC0ifel+N0vhEj/HJHuPNHuNTPcane4wDAAAAIfz6tVO3vFmsf85/q/PhpXmj0vxLm53HKJ+PcLP5tzrv2VbzD8u8ZQAAAIyX4lufXL734XefW/ji/P7jHWe/l+P5bpoHdDJeG/go9tN9AXNZv0jn0Me78zRK1suvD1xXtr1Ht7ijAAAAMMbS+XsrFI2ljvPuVmg0lpbWz8cXQ7M4dXrl5KHYT9/P8vv55vSV5Q/UXDcAAADQv/Xz/Y3P/9P3+C6GqWLpmdMrp85c7c+1lzcbndcF5teXF53XBVrZ8sMly4/Efvr+zu/O71lbvnTieytPbPfOAwAAwJg48/zZpx5fWTn5fU888cST9pNB/2YCAAC222efvdX8wZG53179/P/6/Hfp8/8HYr8V5/b7U1wh3SeQPgdwzef1H+vOM1+23rPd67Wy9SZiTGd1z3RsJ3TMN5het1CWr9W9namSfLNZvrksXz5PwWS2fsq3L1uez0+Y1pvPlufzME5mOYos/50BAAAAyi0/9/Szy2eeP3v/6acff/LkkyefOXL42DePHTv0wDceWF67r3+58+5+AAAAYBit3/Q76EoAAAAAAAAAAAAAAAAAAABgfNXxdWKD3kcAAAAYd/96OYRwTghREle/AnPwdQghhBBiBOLvO51jYvD7KITYvbG6mn/TPAAAAMDOunTxhROd7TXOFduar7211tXmcsyb2rn7/7JwJdJqFx7svl6yd1urYdzV/e9f/uHK/94r25t/Jj3p+/dfo3sDx6vlvXv5Z4ud+W+d7DN/vv+PVst/MMt/d+gv/+q7Wf7HquW/J8u/t8/81+z/s9Xy3xvzL8b+wbv6zd/9/k/HNu3Hnj7zfz3b/ydCv/mz/W/1mTBzX8wPAOOoMegCdkg6SkjH0bOxn/Y3Hm6G/O6HzR7/N7LtTG658u7tpuOgm2M/HS/NZXmTzdY/m23vuop15oblrpKy+rfrfdxpZfU3a66jqrL6p2quo6qy+qdrrqOqsvpnaq6jqrL6+z0PHbSy+oflunJZ/bM111FVWf1zNddRVVn9m/1/fFDK6t9Xcx1VldU/X3MdVZXVX/GyWu3K6l+ouY6qyuq/vuY6qiqr/4aa66iqrP4ba65jUG6Lbdn5cDr/nI9jqd/K+tMb/CxH9doCAAAADJt/mv9PCCGEEEIIIYS4Et/5zeBr2LFYXR30FQgGaWc/zQzAbuX3/3jz/o837/948/7z/6R7+Iusn0z0GJ/sMd7sMT6Vjef/Xqd7jN+QbXc1SuM39hj/Uo/xfT3Gb+4xvthj/JYe47f2GL+txzgAAADj4abYOj8EAACA0fXizz96/Zd3P3Zx4Yvz+4+HqWvmnT8U+9Pxb+uvxX4+733SjH/z/2Hs/zS2v4vt37L13X8CAAAAOy99T4y//wMAAMDoSt9T6vwfAAAARtdCbJ3/AwAAwOi6PrbO/wEAAGCEFTMbL45tui5wZ2z7ndcPANj9vhzb22O7P7Z3xPYrsU3HAXfF9qs11QcAbJ+ffPtHx94s1uf7P5KNX4rLU3uNc1evFBSN7pn898R2b2y/1mc9+fcB9Js/2ddnnp3KP7/F/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA6GisPR49uliE8PbHbz3846nX/3xl2R3tNQ6sPRax1wohNNuvS6Pr/V/EFS9dfOFEZ3s5tkU4HIpQtJeHRy60M82GEM6FA+GT0AofLK98/v47Dx388NWZm944+9RLO/gj6No/AAAAGEX/CwAA//96ziHH") mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='.\x00', &(0x7f00000000c0)='nilfs2\x00', 0x8008, 0x0) 480.825774ms ago: executing program 4 (id=7606): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, &(0x7f0000000100)=0xffffffffffffffff, 0x4) 393.596888ms ago: executing program 4 (id=7607): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 287.800542ms ago: executing program 2 (id=7608): r0 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)="39000000140081ae00002c000500015601618575e285af0180000000171300883795c04a31ba377a1b2cc32b38d3740000ff", 0x32}, {&(0x7f0000000380)="2e366579122caa", 0x7}], 0x2, 0x0, 0x0, 0xc00e}, 0x0) 212.351516ms ago: executing program 4 (id=7609): syz_mount_image$hfs(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x22000c0, &(0x7f0000000080)={[{@codepage={'codepage', 0x3d, 'macceltic'}}, {@iocharset={'iocharset', 0x3d, 'cp1251'}}]}, 0x4, 0x335, &(0x7f0000000880)="$eJzs3U1r1E4cB/DvJNnd7L+l/9hWCp6kWvBU2npQvFikePENeJBibbdQGitoBS2I1bOIN0Hw6M2z6FvQi/gG9NSDeNJL8WBkJpPN7DqTfehDWvb7AXdjMg+/STLJzC7bgIgG1pWFr2/O78h/ogLAB3AJ8ACEQADgJCbC+xubHQvym0sCaU7xT5rljYYtawidIy8pQIBhYx0dkCRJkm8dU/08lFioPMLswQYPqOneqbaHhx7ZwdhO2zVYjCMsdrGLBxgpMxwiIiqfqKm7g6fvEsN6/O55wJQehx/3+3/L+Ga3vDiOhOb930v/nwi5f/5Xm+R8b20zbqykUzh59L1slmgry3pOJPnuriI9s/whY8hl1GKnYvHqq2txY3pbFfAUlzUj2bh6XUHWEMUVbTV9m7TMTQsUtb3YkGpDRbZhzhH/WFGN1gnwh+94aa9u8VMXMYmP4rNYFBFeYaU5/gsSIXeO2j9RW1dJ459xl6haGaWpWlqZh39CVXIqOwLv3+atrLv2a2ifkUAfR9E+fo+yOF9U3bkwitaPFdLWzbpbp3KNAYFQswYz11wz0W9rrvH2uuqrlbgxvXwndp30+8u6/8RzcV1M4gfeYcEY/3sy9RTcPbOllwuVUp8Zhe0JVMqoi2hVB77dU88k5aqzo7g9wy1cxMi9h1vrS3HcuFv+QtZV+sx+ep/jSU9EfTrKNfLdSINQLlQA7Fulf5IksW4K0HuBPnoNo6KaeuF13uSt9SWhr3l7a6C8crZtmncnBjAPQK/Jrgj91P64mauWF9hV9l/yaKs19hMyi+oQOkhWVcsmH7Wuekq9j0qvPVpfijteQY7xVIAy+UHHxI2yg6EyyHGXSOd/xnxlRl115EtUMP9JOhVulDjrmAGNqtf/upvBNYt1jhOHsoUOc64z54CzbTV6yGp80l5spOPEUfxWsvevMsQCvuAmP/8nIiIiIiIiIiIiIiIiIiIiIiIiIjpuev01Qj8/J2itcWcA//AGEREREREREREREREREREREREREREREdHeGM//BXz1xJiq7fm/RU9qUvz0gQDh3p//i8jv4vm/YruHVhKRzd8AAAD//+GuXfk=") mkdir(&(0x7f0000000b00)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x14) 197.406664ms ago: executing program 3 (id=7610): syz_mount_image$hfs(&(0x7f0000000100), &(0x7f0000000080)='./file0\x00', 0x4000, &(0x7f0000000200)={[{@part={'part', 0x3d, 0x4}}, {@umask={'umask', 0x3d, 0x4ffff}}, {@codepage={'codepage', 0x3d, 'euc-jp'}}, {@iocharset={'iocharset', 0x3d, 'cp850'}}]}, 0x4, 0x343, &(0x7f0000000280)="$eJzs3U9r1EwcB/DvJLvb7LOlT562D4Xn9FAteCptPSgetEjx4hvwIMXabqE0VtAKWhCrZxFvguDRm2fRt6AX8Q0oHgqKJ70UD0ZmMvm3zmTT7bZp7fcD7mY38+c3yUwy01IDIjqyzs99eH5yS/4TdQAugDOAA8ADagD+xZh3a229a0FusiUQ5RS/pVlca5uyetA5NF9+qmEw+x3tjTAMw4/23Z/Oqrdv+xcQVUJkR3CGAwzAUSNR7ff2PbK9sSnbddRkzrDYxjZuY6jKcIiIqHr6/u/ou8Sgnr87DjCh5+GH/f6fm99sVxfHgZDc/53ocyjk8flb7ZLrvZX1oL0ULeHk2XfiVaKpLGOfCF009KZ6dwC3lZlyZWoxU7E4zeWVoD25qQp4gHNaJtmoel1C3BCZFLZodUTjhrVpgaK2F2upNtRlG2Ys8Y8U1WhcAL/+gifm6ubflohJvBHvxLzw8RRLyfyvFgp5cNTx8TuGShT/lL1E1Uo/SpVrZRr+P6qS/+Iz8OpF2sqm7bh6cGUsJrIU0Tl/9+M4HzfsuTCM/I8VotZN21unco0ANaE7V5prJkn0w5hrtLOu5nI9aE8uXg9snb6/jCs68UhcEuP4ipeYy8z/HZl6AvaRmRvlQqXUPaOwPTWV0nIec9QAvlZ+ZNZLp/zTXTCe6A6f8x8f4ipOY+jmnY3VhSBo36h+Ix4qPWb/v8/xRB1Rd0f5jXzPpIEnN2Qn7FulP8MwNO6qoWQ5cpD2HEY0oE49S5u8sbog9DVvdw2UV86OXbP2xABmAehv4itCL7XfS3INpAWWyv5dnm31jblDxlHtwwCJq8rtcjFQaqQ0e6j04t3VhaDnqxEdIulJx9jlqoOhKsh5l4jWf5n1ypS66sgXv2D9E3YrPFPitGUFNKxe/0pWcEqXNVfLvoJrxRtd1lzHTgDHG/kaHcQ13u8s1tdx4iD+VnLnv8oQc3iPK/z5PxERERERERERERERERERERERERHRYbPTv0bo5c8J8jVuHcH/eIOIiIiIiIiIiIiIiIiIiIiIiIiIiIiIaHfS5/8mz3dpmJ7/W/SkJsWNnhDj9eP5v26J5/+KzXINJCKrXwEAAP//HJ9f3A==") openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt', 0x0, 0x0) 159.581494ms ago: executing program 2 (id=7611): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0x40405515, &(0x7f0000000040)={{0x2000000, 0x0, 0x0, 0x0, 'syz0\x00', 0x4000}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xffffff25, 0x0, 0x0, 0xc7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8]}) 0s ago: executing program 0 (id=7612): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0x13, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b0000000180100002020784400000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000095"], &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) kernel console output (not intermixed with test programs): ock 68) failed [ 485.510880][T19293] FAT-fs (loop1): Directory bread(block 69) failed [ 485.547386][T19293] FAT-fs (loop1): Directory bread(block 70) failed [ 485.564990][T19293] FAT-fs (loop1): Directory bread(block 71) failed [ 485.581920][T19293] FAT-fs (loop1): Directory bread(block 72) failed [ 485.627351][T19293] FAT-fs (loop1): Directory bread(block 73) failed [ 485.689726][T19311] dmxdev: DVB (dvb_dmxdev_filter_start): could not set feed [ 485.733926][T19311] dvb_demux: dvb_demux_feed_del: feed not in list (type=1 state=0 pid=ffff) [ 486.042344][T19327] comedi comedi0: Minor 48 is invalid! [ 486.136728][T19333] comedi comedi2: ni_at_a2150: I/O port conflict (0xafff,28) [ 486.344391][T19342] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5860'. [ 486.947775][T19373] loop4: detected capacity change from 0 to 512 [ 487.013717][T19373] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 487.038890][T19382] loop2: detected capacity change from 0 to 64 [ 487.271958][ T5829] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 487.795788][T19412] x_tables: duplicate entry at hook 2 [ 488.386725][T19398] loop4: detected capacity change from 0 to 32768 [ 488.433146][T19398] ERROR: (device loop4): diNewExt: no free extents [ 488.433146][T19398] [ 488.477993][T19398] ERROR: (device loop4): remounting filesystem as read-only [ 488.523255][T19398] ialloc: diAlloc returned -5! [ 488.754344][T19450] overlay: Bad value for 'workdir' [ 489.155409][T19469] netlink: 'syz.3.5919': attribute type 11 has an invalid length. [ 489.173960][T19469] netlink: 228 bytes leftover after parsing attributes in process `syz.3.5919'. [ 489.464979][T19484] binder: 19483:19484 ioctl c018620b 0 returned -14 [ 489.812447][T19498] loop4: detected capacity change from 0 to 2048 [ 489.844630][T19503] loop3: detected capacity change from 0 to 512 [ 489.895016][T19503] UDF-fs: warning (device loop3): udf_load_vrs: No VRS found [ 489.898133][T19498] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 489.921293][T19503] UDF-fs: Scanning with blocksize 512 failed [ 489.967727][T19503] UDF-fs: warning (device loop3): udf_load_vrs: No VRS found [ 489.996244][T19507] netlink: 'syz.1.5938': attribute type 2 has an invalid length. [ 490.022145][T19503] UDF-fs: Scanning with blocksize 1024 failed [ 490.062310][T19503] UDF-fs: warning (device loop3): udf_load_vrs: No VRS found [ 490.077872][T19507] netlink: 'syz.1.5938': attribute type 1 has an invalid length. [ 490.086414][T19507] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5938'. [ 490.096677][T19503] UDF-fs: Scanning with blocksize 2048 failed [ 490.184262][T19503] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 490.209565][T19514] netlink: 'syz.0.5942': attribute type 2 has an invalid length. [ 490.211618][T19515] netlink: 'syz.2.5943': attribute type 19 has an invalid length. [ 490.230806][T19514] netlink: 'syz.0.5942': attribute type 11 has an invalid length. [ 490.262390][T19515] netlink: 'syz.2.5943': attribute type 28 has an invalid length. [ 490.262897][T19514] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5942'. [ 490.289914][T19503] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 490.299641][T19515] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5943'. [ 490.813478][T19540] syz_tun: entered promiscuous mode [ 490.844102][T19540] syz_tun: entered allmulticast mode [ 491.564344][T19574] netlink: 488 bytes leftover after parsing attributes in process `syz.2.5973'. [ 491.604792][T19574] netlink: 1041 bytes leftover after parsing attributes in process `syz.2.5973'. [ 491.614137][T19581] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5974'. [ 491.635364][T19579] loop3: detected capacity change from 0 to 512 [ 491.646894][T19581] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 491.712295][T19579] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 491.775294][T19579] EXT4-fs (loop3): 1 truncate cleaned up [ 491.798151][T19579] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 491.840156][T19579] EXT4-fs error (device loop3): ext4_map_blocks:776: inode #2: block 4: comm syz.3.5975: lblock 0 mapped to illegal pblock 4 (length 1) [ 491.865858][T19579] EXT4-fs (loop3): Remounting filesystem read-only [ 491.980646][ T5834] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 491.984502][T18938] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 492.153982][T18938] usb 1-1: Using ep0 maxpacket: 16 [ 492.179098][T18938] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 492.202481][T18938] usb 1-1: config 0 has no interface number 0 [ 492.225098][T18938] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 492.264607][T18938] usb 1-1: config 0 interface 34 altsetting 0 endpoint 0x82 has invalid maxpacket 1104, setting to 1024 [ 492.303970][T18938] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 492.330992][T18938] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 492.352182][T19603] loop2: detected capacity change from 0 to 1024 [ 492.355600][T18938] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.377693][T18938] usb 1-1: Product: syz [ 492.382100][T18938] usb 1-1: Manufacturer: syz [ 492.421217][T18938] usb 1-1: SerialNumber: syz [ 492.429771][T19603] hfsplus: found bad thread record in catalog [ 492.440188][T19603] hfsplus: b-tree write err: -5, ino 19 [ 492.460779][T18938] usb 1-1: config 0 descriptor?? [ 492.479940][T19588] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 492.488361][T19588] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 492.530177][T19603] EXT4-fs (loop2): VFS: Can't find ext4 filesystem [ 492.548038][T19611] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5989'. [ 492.745292][T19588] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 492.761085][T19615] bridge4: entered promiscuous mode [ 492.763042][T19588] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 492.845077][T19617] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5992'. [ 493.007465][T18938] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 493.039113][T18938] asix 1-1:0.34: probe with driver asix failed with error -71 [ 493.114305][T18938] usb 1-1: USB disconnect, device number 21 [ 493.160337][T19593] syz.4.5980 (19593): drop_caches: 2 [ 493.461027][T19639] netlink: 'syz.3.6003': attribute type 1 has an invalid length. [ 493.538913][ T29] audit: type=1326 audit(493.484:234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19640 comm="syz.1.6004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 493.543965][T19639] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6003'. [ 493.621166][ T29] audit: type=1326 audit(493.494:235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19640 comm="syz.1.6004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 493.712036][ T29] audit: type=1326 audit(493.494:236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19640 comm="syz.1.6004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=122 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 493.757663][T19650] xt_NFQUEUE: number of total queues is 0 [ 493.835137][ T29] audit: type=1326 audit(493.494:237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19640 comm="syz.1.6004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 493.923977][ T29] audit: type=1326 audit(493.494:238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19640 comm="syz.1.6004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 493.988707][T19660] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 494.226640][T19665] bridge0: port 1(bridge_slave_0) entered forwarding state [ 495.326360][T19678] loop2: detected capacity change from 0 to 32768 [ 495.621871][T19678] JBD2: Ignoring recovery information on journal [ 495.694768][T19678] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 495.810948][T19741] loop4: detected capacity change from 0 to 4096 [ 495.856169][T19678] OCFS2: ERROR (device loop2): int ocfs2_validate_gd_self(struct super_block *, struct buffer_head *, int): Group descriptor #17056 has bit count 2061 but max bitmap bits of 2048 [ 495.857774][T19741] ntfs3(loop4): Different NTFS sector size (4096) and media sector size (512). [ 495.904253][T19678] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 495.945135][T19678] OCFS2: File system is now read-only. [ 495.992279][T19678] (syz.2.6022,19678,0):ocfs2_search_chain:1888 ERROR: status = -30 [ 496.015079][T19741] ntfs3(loop4): Failed to load $Extend (-22). [ 496.034010][T19741] ntfs3(loop4): Failed to initialize $Extend. [ 496.037781][T19678] (syz.2.6022,19678,0):ocfs2_search_chain:2011 ERROR: status = -30 [ 496.089449][T19678] (syz.2.6022,19678,1):ocfs2_claim_suballoc_bits:2098 ERROR: status = -30 [ 496.122141][T19753] loop3: detected capacity change from 0 to 256 [ 496.161600][T19678] (syz.2.6022,19678,0):ocfs2_claim_suballoc_bits:2151 ERROR: status = -30 [ 496.178428][T19678] (syz.2.6022,19678,0):ocfs2_claim_new_inode:2392 ERROR: status = -30 [ 496.223299][T19678] (syz.2.6022,19678,0):ocfs2_claim_new_inode:2407 ERROR: status = -30 [ 496.267916][T19678] (syz.2.6022,19678,0):ocfs2_mknod_locked:642 ERROR: status = -30 [ 496.302166][T19678] (syz.2.6022,19678,0):ocfs2_symlink:1957 ERROR: status = -30 [ 496.332695][T19678] (syz.2.6022,19678,0):ocfs2_symlink:2081 ERROR: status = -30 [ 496.484625][ T5838] ocfs2: Unmounting device (7,2) on (node local) [ 496.542785][T19765] ubi0: attaching mtd0 [ 496.558097][T19765] ubi0: scanning is finished [ 496.575898][T19765] ubi0: empty MTD device detected [ 496.755289][T19772] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6067'. [ 496.835898][T19765] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 496.866103][T19775] geneve3: entered promiscuous mode [ 496.870191][T19765] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3774 bytes [ 496.886644][T19765] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 496.893930][T19775] geneve3: entered allmulticast mode [ 496.903143][T19779] loop4: detected capacity change from 0 to 64 [ 496.931917][T19765] ubi0: VID header offset: 258 (aligned 258), data offset: 322 [ 496.943933][T19765] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 496.953281][T19765] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 21 [ 496.962285][T19779] syz.4.6070: attempt to access beyond end of device [ 496.962285][T19779] loop4: rw=8388608, sector=268435468, nr_sectors = 2 limit=64 [ 496.979554][T19779] Buffer I/O error on dev loop4, logical block 134217734, async page read [ 496.993002][T19779] syz.4.6070: attempt to access beyond end of device [ 496.993002][T19779] loop4: rw=8388608, sector=268435468, nr_sectors = 2 limit=64 [ 497.038847][T19779] Buffer I/O error on dev loop4, logical block 134217734, async page read [ 497.039211][T19765] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1639988075 [ 497.103890][T19765] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 497.156132][T19776] ubi0: background thread "ubi_bgt0d" started, PID 19776 [ 497.510980][T19795] loop4: detected capacity change from 0 to 256 [ 497.527765][T19799] vivid-000: ================= START STATUS ================= [ 497.543932][T19799] vivid-000: Generate PTS: true [ 497.548951][T19799] vivid-000: Generate SCR: true [ 497.552837][T19795] exfat: Deprecated parameter 'namecase' [ 497.578089][T19799] tpg source WxH: 320x180 (R'G'B) [ 497.590373][T19799] tpg field: 1 [ 497.594982][T19795] exfat: Deprecated parameter 'utf8' [ 497.599324][T19799] tpg crop: (0,0)/320x180 [ 497.621734][T19799] tpg compose: (0,0)/320x180 [ 497.637303][T19795] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x5441951d, utbl_chksum : 0xe619d30d) [ 497.645826][T19799] tpg colorspace: 7 [ 497.672564][T19799] tpg transfer function: 1/0 [ 497.677935][T19799] tpg quantization: 2/0 [ 497.687619][T19799] tpg RGB range: 0/2 [ 497.704006][T19799] vivid-000: ================== END STATUS ================== [ 497.791784][T19801] loop1: detected capacity change from 0 to 2048 [ 497.839948][T19801] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 498.514213][T19830] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6094'. [ 498.834469][T19804] loop3: detected capacity change from 0 to 32768 [ 498.956867][T19804] ERROR: (device loop3): xtSearch: xt_getpage: xtree page corrupt [ 498.956867][T19804] [ 498.979218][T19804] ERROR: (device loop3): remounting filesystem as read-only [ 498.998544][T19804] xtLookup: xtSearch returned -5 [ 499.103992][ T5887] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 499.293965][ T5887] usb 1-1: Using ep0 maxpacket: 32 [ 499.314902][ T5887] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 40 [ 499.368999][T19828] loop2: detected capacity change from 0 to 32768 [ 499.370319][ T5887] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 499.411649][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 499.465216][T19828] XFS (loop2): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 499.496288][ T5887] usb 1-1: Product: syz [ 499.501836][ T5887] usb 1-1: Manufacturer: syz [ 499.510212][T19867] netlink: 'syz.1.6110': attribute type 6 has an invalid length. [ 499.550515][T19828] XFS (loop2): Ending clean mount [ 499.554543][ T5887] usb 1-1: SerialNumber: syz [ 499.563805][ T5887] usb 1-1: config 0 descriptor?? [ 499.572761][T19842] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 499.576973][T19867] netlink: 'syz.1.6110': attribute type 7 has an invalid length. [ 499.585442][ T5887] hub 1-1:0.0: bad descriptor, ignoring hub [ 499.601733][ T5887] hub 1-1:0.0: probe with driver hub failed with error -5 [ 499.613520][T19828] XFS (loop2): Quotacheck needed: Please wait. [ 499.643081][T19867] netlink: 'syz.1.6110': attribute type 8 has an invalid length. [ 499.718297][T19867] netlink: 'syz.1.6110': attribute type 15 has an invalid length. [ 499.798666][T19874] netlink: 'syz.4.6112': attribute type 1 has an invalid length. [ 499.801097][T19828] XFS (loop2): Quotacheck: Done. [ 499.813185][T19874] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6112'. [ 499.916226][T18938] usb 1-1: USB disconnect, device number 22 [ 499.969846][ T5838] XFS (loop2): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 500.088551][T19880] loop4: detected capacity change from 0 to 512 [ 500.225761][T19880] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 500.349327][T19880] EXT4-fs error (device loop4): ext4_map_blocks:776: inode #2: block 18: comm syz.4.6115: lblock 23 mapped to illegal pblock 18 (length 1) [ 500.425422][T19880] EXT4-fs (loop4): Remounting filesystem read-only [ 500.546966][ T5829] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 500.763045][ T29] audit: type=1326 audit(500.724:239): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19907 comm="syz.1.6126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 500.787073][T19908] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6127'. [ 500.825148][ T29] audit: type=1326 audit(500.754:240): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19907 comm="syz.1.6126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 500.913662][ T29] audit: type=1326 audit(500.764:241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19907 comm="syz.1.6126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 500.975041][T19915] sock: sock_timestamping_bind_phc: sock not bind to device [ 500.990392][ T29] audit: type=1326 audit(500.764:242): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19907 comm="syz.1.6126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 501.004387][T19919] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6131'. [ 501.082241][ T29] audit: type=1326 audit(500.764:243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19907 comm="syz.1.6126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdfd019c629 code=0x7ffc0000 [ 501.404419][ T5909] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 501.419564][T19936] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6142'. [ 501.469967][ T29] audit: type=1326 audit(501.434:244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19938 comm="syz.3.6143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b3cf9c629 code=0x7ffc0000 [ 501.543517][ T29] audit: type=1326 audit(501.474:245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19938 comm="syz.3.6143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b3cf9c629 code=0x7ffc0000 [ 501.549470][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.583936][ T5909] usb 2-1: Using ep0 maxpacket: 16 [ 501.618880][ T29] audit: type=1326 audit(501.484:246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19938 comm="syz.3.6143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7b3cf9c629 code=0x7ffc0000 [ 501.622159][ T5909] usb 2-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice=93.b9 [ 501.652915][ T29] audit: type=1326 audit(501.484:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19938 comm="syz.3.6143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b3cf9c629 code=0x7ffc0000 [ 501.728851][ T5909] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.732212][ T29] audit: type=1326 audit(501.484:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19938 comm="syz.3.6143" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7b3cf9c629 code=0x7ffc0000 [ 501.765563][ T5909] usb 2-1: Product: syz [ 501.771781][ T5909] usb 2-1: Manufacturer: syz [ 501.800142][T19949] netlink: 'syz.0.6158': attribute type 6 has an invalid length. [ 501.803896][ T5909] usb 2-1: SerialNumber: syz [ 501.895896][ T5909] usb 2-1: config 0 descriptor?? [ 502.113167][ T5909] speedtch 2-1:0.0: speedtch_bind: wrong device class 141 [ 502.142009][ T5909] speedtch 2-1:0.0: usbatm_usb_probe: bind failed: -19! [ 502.296417][T19961] loop3: detected capacity change from 0 to 4096 [ 502.330340][T19972] netlink: 'syz.0.6160': attribute type 1 has an invalid length. [ 502.335653][T19961] ntfs3(loop3): Different NTFS sector size (4096) and media sector size (512). [ 502.442349][ T10] usb 2-1: USB disconnect, device number 27 [ 502.466533][T19961] ntfs3(loop3): ino=19, mi_enum_attr [ 502.472292][T19961] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 502.582829][T19961] ntfs3(loop3): failed to convert "c46c" to cp865 [ 502.599631][T19961] ntfs3(loop3): ino=20, mi_enum_attr [ 503.170254][T19971] loop2: detected capacity change from 0 to 32768 [ 503.254261][T19971] __jfs_setxattr: xattr_size = 76, new_size = 12822 [ 503.408648][T19981] loop4: detected capacity change from 0 to 32768 [ 503.435179][T19981] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.6164 (19981) [ 503.487456][T19981] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 503.539209][T19981] BTRFS info (device loop4): using sha256 checksum algorithm [ 503.909829][T19981] BTRFS info (device loop4): enabling ssd optimizations [ 503.963865][T19981] BTRFS info (device loop4): turning on async discard [ 503.970726][T19981] BTRFS info (device loop4): enabling free space tree [ 504.115215][T20040] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6183'. [ 504.238280][ T5829] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 504.274308][T20042] netlink: 'syz.2.6195': attribute type 6 has an invalid length. [ 504.963748][T20032] loop1: detected capacity change from 0 to 32768 [ 505.102423][T20032] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 505.290294][T20032] XFS (loop1): Ending clean mount [ 505.539279][ T5836] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 505.566648][T20091] net_ratelimit: 5 callbacks suppressed [ 505.566671][T20091] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 506.324920][T20084] loop3: detected capacity change from 0 to 32768 [ 506.377074][T20084] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.6199 (20084) [ 506.451473][T20084] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 506.504385][T20084] BTRFS info (device loop3): using sha256 checksum algorithm [ 506.696490][T20084] BTRFS info (device loop3): enabling ssd optimizations [ 506.724014][T20084] BTRFS info (device loop3): turning on async discard [ 506.745692][T20084] BTRFS info (device loop3): enabling free space tree [ 507.020547][ T5834] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 507.146473][T20101] loop1: detected capacity change from 0 to 32768 [ 507.205365][T20101] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.6204 (20101) [ 507.274146][T20101] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 507.310034][T20101] BTRFS info (device loop1): using sha256 checksum algorithm [ 507.609351][T20101] BTRFS info (device loop1): enabling ssd optimizations [ 507.617523][T20101] BTRFS info (device loop1): turning on async discard [ 507.626031][T20101] BTRFS info (device loop1): enabling free space tree [ 507.749405][ T5836] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 509.975935][T20166] loop4: detected capacity change from 0 to 8 [ 510.116866][T20177] xt_ecn: cannot match TCP bits for non-tcp packets [ 510.447517][T20193] No such timeout policy "syz1" [ 510.582353][T20199] loop1: detected capacity change from 0 to 8 [ 510.600812][T20199] SQUASHFS error: zlib decompression failed, data probably corrupt [ 510.621839][T20199] SQUASHFS error: Failed to read block 0x9b: -5 [ 510.636413][T20199] SQUASHFS error: Unable to read metadata cache entry [99] [ 510.645063][T20199] SQUASHFS error: Unable to read inode 0x127 [ 510.696458][T20203] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 510.783164][T20208] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6241'. [ 510.793338][T20208] netlink: 88 bytes leftover after parsing attributes in process `syz.1.6241'. [ 511.277285][T20231] dlm: plock device version mismatch: kernel (1.2.0), user (1.33554432.4294901762) [ 511.519336][T20242] loop4: detected capacity change from 0 to 8 [ 511.603270][T20242] SQUASHFS error: zlib decompression failed, data probably corrupt [ 511.623980][T20242] SQUASHFS error: Failed to read block 0x9b: -5 [ 511.631156][T20242] SQUASHFS error: Unable to read metadata cache entry [99] [ 511.679241][T20242] SQUASHFS error: Unable to read inode 0x127 [ 512.138122][T20250] loop1: detected capacity change from 0 to 32768 [ 512.165264][T20250] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.6261 (20250) [ 512.255690][T20250] BTRFS info (device loop1): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 512.284630][T20250] BTRFS info (device loop1): using sha256 checksum algorithm [ 512.420984][T20250] BTRFS info (device loop1): rebuilding free space tree [ 512.464594][T20250] BTRFS info (device loop1): disabling free space tree [ 512.494028][T20250] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 512.533885][T20250] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 512.588026][T20250] BTRFS info (device loop1): enabling ssd optimizations [ 512.598435][T20250] BTRFS info (device loop1): turning on async discard [ 512.606830][T20250] BTRFS info (device loop1): force clearing of disk cache [ 512.614490][T20250] BTRFS info (device loop1): enabling auto defrag [ 512.621298][T20250] BTRFS info (device loop1): max_inline set to 4096 [ 512.656261][T20250] BTRFS info (device loop1 state M): max_inline set to 4096 [ 512.679742][T20256] loop3: detected capacity change from 0 to 32768 [ 512.686834][ T5836] BTRFS info (device loop1): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 512.726840][T20256] XFS (loop3): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 512.952062][T20256] XFS (loop3): Ending clean mount [ 512.994127][ T5887] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 513.067526][ T5834] XFS (loop3): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 513.198694][ T5887] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 513.226757][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.247589][ T5887] usb 1-1: Product: syz [ 513.251863][ T5887] usb 1-1: Manufacturer: syz [ 513.275201][ T5887] usb 1-1: SerialNumber: syz [ 513.304905][ T5887] usb 1-1: config 0 descriptor?? [ 513.507048][T20303] netlink: 'syz.1.6278': attribute type 32 has an invalid length. [ 513.564684][ T5887] hso 1-1:0.0: Can't find BULK IN endpoint [ 513.576041][ T5887] usb-storage 1-1:0.0: USB Mass Storage device detected [ 513.714292][T20296] loop4: detected capacity change from 0 to 32768 [ 513.747534][T20296] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.6285 (20296) [ 513.769612][T20313] loop2: detected capacity change from 0 to 8 [ 513.789020][ T47] usb 1-1: USB disconnect, device number 23 [ 513.814306][T20296] BTRFS info (device loop4): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 513.866278][T20296] BTRFS info (device loop4): using sha256 checksum algorithm [ 513.995673][T20296] BTRFS info (device loop4): rebuilding free space tree [ 514.067943][T20296] BTRFS info (device loop4): disabling free space tree [ 514.084188][T20296] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 514.112551][T20296] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 514.170028][T20296] BTRFS info (device loop4): enabling ssd optimizations [ 514.189135][T20296] BTRFS info (device loop4): turning on async discard [ 514.199118][T20296] BTRFS info (device loop4): force clearing of disk cache [ 514.207688][T20296] BTRFS info (device loop4): enabling auto defrag [ 514.215459][T20296] BTRFS info (device loop4): max_inline set to 4096 [ 514.256521][T20296] BTRFS info (device loop4 state M): max_inline set to 4096 [ 514.298351][ T5829] BTRFS info (device loop4): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 514.535968][T20315] loop1: detected capacity change from 0 to 40427 [ 514.546579][T20315] F2FS-fs: heap/no_heap options were deprecated [ 514.580434][T20315] F2FS-fs (loop1): Image doesn't support compression [ 514.589790][T20315] F2FS-fs (loop1): build fault injection rate: 23 [ 514.598898][T20315] F2FS-fs (loop1): build fault injection type: 0x3bfe8c [ 514.616386][T20315] F2FS-fs (loop1): invalid crc value [ 514.655247][T20315] F2FS-fs (loop1): inject page alloc in f2fs_grab_cache_folio of f2fs_build_free_nids+0x9d8/0x1810 [ 514.946690][T20315] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 515.009103][T20315] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 515.019111][T20353] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 515.035491][T20351] loop2: detected capacity change from 0 to 512 [ 515.043391][T20351] EXT4-fs: Ignoring removed orlov option [ 515.060122][T20353] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 515.095722][T20353] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 515.110337][T20353] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 515.118848][T20351] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 515.124221][T20315] F2FS-fs (loop1): inject page alloc in f2fs_grab_cache_folio of f2fs_get_read_data_folio+0xe0/0xb70 [ 515.151239][T20351] EXT4-fs (loop2): orphan cleanup on readonly fs [ 515.184016][T20351] EXT4-fs error (device loop2): ext4_validate_block_bitmap:441: comm syz.2.6289: bg 0: block 248: padding at end of block bitmap is not set [ 515.248352][T20351] loop2: lost filesystem error report for type 5 error -117 [ 515.250043][T20351] Quota error (device loop2): write_blk: dquota write failed [ 515.257591][ C1] EXT4-fs (loop2): error count since last fsck: 1 [ 515.257618][ C1] EXT4-fs (loop2): last error at time 515: ext4_validate_block_bitmap:441 [ 515.358414][T20351] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 515.413388][T20351] EXT4-fs error (device loop2): ext4_acquire_dquot:7001: comm syz.2.6289: Failed to acquire dquot type 1 [ 515.424671][T20368] JFS: discard option not supported on device [ 515.443308][T20368] Mount JFS Failure: -5 [ 515.458725][T20369] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 515.459829][T20351] loop2: lost filesystem error report for type 5 error -117 [ 515.469029][T20369] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 515.487934][T20351] EXT4-fs (loop2): 1 truncate cleaned up [ 515.501546][T20369] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 515.520989][T20351] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 515.534700][T20369] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 515.654142][T20351] EXT4-fs (loop2): warning: mounting fs with errors, running e2fsck is recommended [ 515.681490][T20373] netlink: 'syz.4.6299': attribute type 39 has an invalid length. [ 515.695943][T20351] EXT4-fs error (device loop2): __ext4_remount:6804: comm syz.2.6289: Abort forced by user [ 515.744486][T20351] EXT4-fs (loop2): Remounting filesystem read-only [ 515.761959][T20351] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 515.847139][ T5838] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 515.867278][T20379] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6294'. [ 515.876600][T20379] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6294'. [ 515.887061][T20379] netlink: 5 bytes leftover after parsing attributes in process `syz.1.6294'. [ 516.479196][T20412] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 516.493895][T20412] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 516.555149][T20412] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 516.571015][T20412] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 516.622558][T20418] loop4: detected capacity change from 0 to 512 [ 516.638151][T20418] EXT4-fs: Ignoring removed orlov option [ 516.653413][T20416] bridge4: entered promiscuous mode [ 516.684880][T20418] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 516.721964][T20418] EXT4-fs (loop4): orphan cleanup on readonly fs [ 516.732317][T20418] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.6319: bg 0: block 248: padding at end of block bitmap is not set [ 516.749403][T20418] loop4: lost filesystem error report for type 5 error -117 [ 516.750081][T20418] Quota error (device loop4): write_blk: dquota write failed [ 516.757472][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 516.757500][ C0] EXT4-fs (loop4): last error at time 516: ext4_validate_block_bitmap:441 [ 516.780852][T20418] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 516.796459][T20418] EXT4-fs error (device loop4): ext4_acquire_dquot:7001: comm syz.4.6319: Failed to acquire dquot type 1 [ 516.808338][T20418] loop4: lost filesystem error report for type 5 error -117 [ 516.828249][T20418] EXT4-fs (loop4): 1 truncate cleaned up [ 516.849516][T20418] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 516.902238][T20425] netlink: 'syz.0.6321': attribute type 1 has an invalid length. [ 516.910101][ T2348] pvrusb2: request_firmware fatal error with code=-110 [ 516.937734][T20425] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 517.004175][ T2348] pvrusb2: Failure uploading firmware1 [ 517.009901][ T2348] pvrusb2: Device initialization was not successful. [ 517.073961][ T2348] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 517.096350][T20418] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 517.109341][ T2348] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 517.150754][ T796] pvrusb2: Device being rendered inoperable [ 517.207831][T20418] EXT4-fs error (device loop4): __ext4_remount:6804: comm syz.4.6319: Abort forced by user [ 517.263899][T20418] EXT4-fs (loop4): Remounting filesystem read-only [ 517.287357][T20418] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 517.385060][T20438] bridge4: entered promiscuous mode [ 517.390564][T20438] bridge4: entered allmulticast mode [ 517.406713][ T5829] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 517.694331][ T796] usb 4-1: new low-speed USB device number 23 using dummy_hcd [ 517.723652][T20452] loop1: detected capacity change from 0 to 2048 [ 517.761233][T20452] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 517.780657][ T47] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 517.825564][ T29] audit: type=1800 audit(517.794:249): pid=20452 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.6336" name="file1" dev="loop1" ino=1367 res=0 errno=0 [ 517.878106][ T796] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 517.893883][ T796] usb 4-1: config 0 has no interface number 0 [ 517.903994][ T796] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 517.924040][ T796] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 517.980854][ T47] usb 3-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 517.993888][ T796] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 518.003936][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.024859][ T47] usb 3-1: Product: syz [ 518.029325][ T796] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.037861][ T47] usb 3-1: Manufacturer: syz [ 518.042588][ T47] usb 3-1: SerialNumber: syz [ 518.050951][ T796] usb 4-1: config 0 descriptor?? [ 518.062633][ T47] usb 3-1: config 0 descriptor?? [ 518.069592][T20442] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 518.096475][ T796] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 518.274111][ T796] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 518.288539][ T47] hso 3-1:0.0: Can't find BULK IN endpoint [ 518.295651][ T47] usb-storage 3-1:0.0: USB Mass Storage device detected [ 518.319146][ T5908] usb 4-1: USB disconnect, device number 23 [ 518.334105][T18938] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 518.443989][ T796] usb 2-1: Using ep0 maxpacket: 16 [ 518.451847][ T796] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 518.460892][ T796] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 518.471672][ T796] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 518.481244][ T796] usb 2-1: config 1 has no interface number 1 [ 518.487793][ T796] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 518.500071][ T10] usb 3-1: USB disconnect, device number 29 [ 518.501051][ T796] usb 2-1: config 1 interface 2 altsetting 1 has an endpoint descriptor with address 0x61, changing to 0x1 [ 518.522874][T18938] usb 5-1: not running at top speed; connect to a high speed hub [ 518.531789][ T796] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 518.543134][T18938] usb 5-1: config 3 has an invalid interface number: 47 but max is 1 [ 518.551830][T18938] usb 5-1: config 3 has no interface number 0 [ 518.558374][T18938] usb 5-1: config 3 interface 1 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 518.568638][T18938] usb 5-1: config 3 interface 1 has no altsetting 0 [ 518.575766][T18938] usb 5-1: config 3 interface 47 has no altsetting 0 [ 518.583367][ T796] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 518.592744][ T796] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.601505][ T796] usb 2-1: Product: syz [ 518.606044][ T796] usb 2-1: Manufacturer: syz [ 518.611061][ T796] usb 2-1: SerialNumber: syz [ 518.616218][T18938] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=43.bd [ 518.626414][T18938] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.635870][T18938] usb 5-1: Product: syz [ 518.640234][T18938] usb 5-1: Manufacturer: syz [ 518.647515][T18938] usb 5-1: SerialNumber: syz [ 518.908912][T18938] usb 5-1: selecting invalid altsetting 0 [ 518.920086][ T796] usb 2-1: USB disconnect, device number 28 [ 519.041049][T18938] usb 5-1: USB disconnect, device number 21 [ 519.167620][ T5888] udevd[5888]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:3.1/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 519.304641][T20476] loop3: detected capacity change from 0 to 512 [ 519.313006][T20476] EXT4-fs: Ignoring removed orlov option [ 519.322707][T20476] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 519.366835][T20476] EXT4-fs (loop3): orphan cleanup on readonly fs [ 519.394566][T20476] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm syz.3.6346: bg 0: block 248: padding at end of block bitmap is not set [ 519.409902][T20476] loop3: lost filesystem error report for type 5 error -117 [ 519.413834][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 519.427721][ C0] EXT4-fs (loop3): last error at time 519: ext4_validate_block_bitmap:441 [ 519.449582][T20476] Quota error (device loop3): write_blk: dquota write failed [ 519.470152][T20476] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 519.481841][T20476] EXT4-fs error (device loop3): ext4_acquire_dquot:7001: comm syz.3.6346: Failed to acquire dquot type 1 [ 519.494717][T20476] loop3: lost filesystem error report for type 5 error -117 [ 519.496853][T20476] EXT4-fs (loop3): 1 truncate cleaned up [ 519.527008][T20476] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 519.639393][T20476] EXT4-fs (loop3): warning: mounting fs with errors, running e2fsck is recommended [ 519.681595][T20476] EXT4-fs error (device loop3): __ext4_remount:6804: comm syz.3.6346: Abort forced by user [ 519.700938][T20476] EXT4-fs (loop3): Remounting filesystem read-only [ 519.725589][T20476] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 519.801499][ T5834] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 519.821012][T20498] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 520.060891][T20508] loop1: detected capacity change from 0 to 24 [ 520.098312][T20508] MTD: Attempt to mount non-MTD device "/dev/loop1" [ 520.117459][T20513] netlink: 'syz.4.6361': attribute type 32 has an invalid length. [ 520.146521][T20508] romfs: Mounting image 'rom 637cf1fa' through the block layer [ 520.194518][T20508] VFS: Lookup of 'file0' in romfs loop1 would have caused loop [ 520.504144][ T10] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 520.677290][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 520.714971][ T10] usb 3-1: config 3 has an invalid interface number: 47 but max is 1 [ 520.738942][ T10] usb 3-1: config 3 has no interface number 0 [ 520.762956][ T10] usb 3-1: config 3 interface 1 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 520.797670][ T10] usb 3-1: config 3 interface 1 has no altsetting 0 [ 520.813696][ T10] usb 3-1: config 3 interface 47 has no altsetting 0 [ 520.853579][ T10] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=43.bd [ 520.878726][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.904140][ T10] usb 3-1: Product: syz [ 520.918939][ T10] usb 3-1: Manufacturer: syz [ 520.937198][T20544] loop4: detected capacity change from 0 to 1024 [ 520.953745][ T10] usb 3-1: SerialNumber: syz [ 520.980930][T20544] syz.4.6377: attempt to access beyond end of device [ 520.980930][T20544] loop4: rw=8388608, sector=917504, nr_sectors = 2 limit=1024 [ 521.046662][T20544] Buffer I/O error on dev loop4, logical block 458752, async page read [ 521.098260][T20544] syz.4.6377: attempt to access beyond end of device [ 521.098260][T20544] loop4: rw=8388608, sector=917504, nr_sectors = 2 limit=1024 [ 521.138327][T20544] Buffer I/O error on dev loop4, logical block 458752, async page read [ 521.237528][ T10] usb 3-1: selecting invalid altsetting 0 [ 521.445810][ T10] usb 3-1: USB disconnect, device number 30 [ 521.571969][T10457] udevd[10457]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:3.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 521.741887][T20568] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6390'. [ 521.772443][T20568] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6390'. [ 521.802243][T20568] netlink: 5 bytes leftover after parsing attributes in process `syz.4.6390'. [ 522.812814][T20602] netlink: 'syz.0.6406': attribute type 10 has an invalid length. [ 522.826679][T20578] loop2: detected capacity change from 0 to 32768 [ 522.841406][T20578] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.6394 (20578) [ 522.886801][T20578] BTRFS info (device loop2): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 522.915658][T20578] BTRFS info (device loop2): using sha256 checksum algorithm [ 523.001022][T20582] loop4: detected capacity change from 0 to 32768 [ 523.010477][T20578] BTRFS info (device loop2): rebuilding free space tree [ 523.050413][T20578] BTRFS info (device loop2): disabling free space tree [ 523.070585][T20582] XFS (loop4): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 523.086827][T20578] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 523.125899][T20578] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 523.156190][T20582] XFS (loop4): Ending clean mount [ 523.181044][T20582] XFS (loop4): Quotacheck needed: Please wait. [ 523.189447][T20578] BTRFS info (device loop2): enabling ssd optimizations [ 523.229183][T20578] BTRFS info (device loop2): turning on async discard [ 523.264190][T20578] BTRFS info (device loop2): force clearing of disk cache [ 523.272346][T20578] BTRFS info (device loop2): enabling auto defrag [ 523.279966][T20582] XFS (loop4): Quotacheck: Done. [ 523.286053][T20578] BTRFS info (device loop2): max_inline set to 4096 [ 523.335607][T20578] BTRFS info (device loop2 state M): max_inline set to 4096 [ 523.359920][ T5838] BTRFS info (device loop2): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 523.371240][ T5829] XFS (loop4): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 523.845745][T20645] loop1: detected capacity change from 0 to 8 [ 525.057529][T20699] overlay: Bad value for 'workdir' [ 525.262279][T20707] bridge5: entered promiscuous mode [ 525.394287][T20715] loop3: detected capacity change from 0 to 128 [ 525.440231][T20715] FAT-fs (loop3): Directory bread(block 162) failed [ 525.454598][T20715] FAT-fs (loop3): Directory bread(block 163) failed [ 525.490592][T20715] FAT-fs (loop3): Directory bread(block 164) failed [ 525.507128][T20715] FAT-fs (loop3): Directory bread(block 165) failed [ 525.560535][T20715] FAT-fs (loop3): Directory bread(block 166) failed [ 525.579555][T20715] FAT-fs (loop3): Directory bread(block 167) failed [ 525.586845][T20715] FAT-fs (loop3): Directory bread(block 168) failed [ 525.616681][T20715] FAT-fs (loop3): Directory bread(block 169) failed [ 525.623704][T20715] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 525.664641][T20715] FAT-fs (loop3): Directory bread(block 162) failed [ 525.683976][T20715] FAT-fs (loop3): Directory bread(block 163) failed [ 525.693128][T20715] syz.3.6450: attempt to access beyond end of device [ 525.693128][T20715] loop3: rw=8388611, sector=226, nr_sectors = 6 limit=128 [ 525.723078][T20715] syz.3.6450: attempt to access beyond end of device [ 525.723078][T20715] loop3: rw=8390659, sector=232, nr_sectors = 2 limit=128 [ 525.964049][T20738] binder: 20735:20738 ioctl c018620b 0 returned -14 [ 526.358800][T20758] openvswitch: netlink: Duplicate or invalid key (type 0). [ 526.393984][T20758] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 526.661749][T20772] netlink: 'syz.1.6479': attribute type 2 has an invalid length. [ 526.712145][T20772] netlink: 'syz.1.6479': attribute type 11 has an invalid length. [ 526.727998][T20772] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6479'. [ 526.964375][T20788] openvswitch: netlink: Duplicate or invalid key (type 0). [ 526.971767][T20788] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 527.309418][T20804] loop2: detected capacity change from 0 to 1024 [ 527.357838][T20804] syz.2.6495: attempt to access beyond end of device [ 527.357838][T20804] loop2: rw=8388608, sector=917504, nr_sectors = 2 limit=1024 [ 527.381960][T20810] comedi comedi2: ni_at_a2150: I/O port conflict (0xafff,28) [ 527.407331][T20804] Buffer I/O error on dev loop2, logical block 458752, async page read [ 527.454355][T20804] syz.2.6495: attempt to access beyond end of device [ 527.454355][T20804] loop2: rw=8388608, sector=917504, nr_sectors = 2 limit=1024 [ 527.482391][T20804] Buffer I/O error on dev loop2, logical block 458752, async page read [ 527.594390][ T5908] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 527.763942][ T5908] usb 2-1: Using ep0 maxpacket: 32 [ 527.780096][ T5908] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 527.793954][ T5908] usb 2-1: config 0 has no interface number 0 [ 527.816582][ T5908] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 527.830877][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.850095][ T5908] usb 2-1: Product: syz [ 527.860220][ T5908] usb 2-1: Manufacturer: syz [ 527.883393][ T5908] usb 2-1: SerialNumber: syz [ 527.921059][ T5908] usb 2-1: config 0 descriptor?? [ 527.938436][ T5908] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 527.958681][ T5908] usb 2-1: selecting invalid altsetting 1 [ 527.969171][T20838] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6524'. [ 527.983649][ T5908] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 527.998764][T20840] comedi comedi2: ni_at_a2150: I/O port conflict (0xafff,28) [ 528.008056][ T5908] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 528.047513][ T5908] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 528.066686][ T5908] usb 2-1: media controller created [ 528.125534][ T5908] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 528.215018][ T5908] usb 2-1: DVB: registering adapter 2 frontend 0 (Zarlink ZL10353 DVB-T)... [ 528.238516][ T5908] dvbdev: dvb_create_media_entity: media entity 'Zarlink ZL10353 DVB-T' registered. [ 528.361968][ T5908] DVB: Unable to find symbol mxl5005s_attach() [ 528.437430][ T5908] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 528.622391][ T5908] usb 2-1: USB disconnect, device number 29 [ 528.930986][T20883] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6536'. [ 529.197068][T20898] netlink: 'syz.0.6552': attribute type 1 has an invalid length. [ 529.254026][T20898] netlink: 224 bytes leftover after parsing attributes in process `syz.0.6552'. [ 529.410050][T20908] comedi comedi0: Minor 48 is invalid! [ 529.432613][ T29] audit: type=1326 audit(529.384:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20910 comm="syz.0.6547" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 529.456816][ T29] audit: type=1326 audit(529.384:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20910 comm="syz.0.6547" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 529.480996][ T29] audit: type=1326 audit(529.394:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20910 comm="syz.0.6547" exe="/root/syz-executor" sig=0 arch=c000003e syscall=122 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 529.548536][ T29] audit: type=1326 audit(529.394:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20910 comm="syz.0.6547" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 529.601868][ T29] audit: type=1326 audit(529.394:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20910 comm="syz.0.6547" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 530.168908][T20945] comedi comedi0: Minor 48 is invalid! [ 530.510843][T20959] loop2: detected capacity change from 0 to 256 [ 530.601138][T20959] FAT-fs (loop2): Directory bread(block 64) failed [ 530.639494][T20959] FAT-fs (loop2): Directory bread(block 65) failed [ 530.676161][T20930] loop3: detected capacity change from 0 to 32768 [ 530.691249][T20959] FAT-fs (loop2): Directory bread(block 66) failed [ 530.721287][T20959] FAT-fs (loop2): Directory bread(block 67) failed [ 530.760087][T20959] FAT-fs (loop2): Directory bread(block 68) failed [ 530.787794][T20930] ERROR: (device loop3): diNewExt: no free extents [ 530.787794][T20930] [ 530.804475][T20959] FAT-fs (loop2): Directory bread(block 69) failed [ 530.811201][T20959] FAT-fs (loop2): Directory bread(block 70) failed [ 530.828065][T20930] ERROR: (device loop3): remounting filesystem as read-only [ 530.844374][T20959] FAT-fs (loop2): Directory bread(block 71) failed [ 530.864015][T20930] ialloc: diAlloc returned -5! [ 530.872251][T20959] FAT-fs (loop2): Directory bread(block 72) failed [ 530.900651][T20959] FAT-fs (loop2): Directory bread(block 73) failed [ 531.172723][T20980] binder: 20978:20980 ioctl c018620b 0 returned -14 [ 531.720628][T21005] loop1: detected capacity change from 0 to 2048 [ 531.749750][T21005] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 531.877115][T21010] geneve2: entered promiscuous mode [ 531.894443][T21010] geneve2: entered allmulticast mode [ 532.136498][T21018] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6602'. [ 532.560625][T21039] netlink: 'syz.1.6614': attribute type 19 has an invalid length. [ 532.580426][T21039] netlink: 'syz.1.6614': attribute type 28 has an invalid length. [ 532.581242][T21042] netlink: 'syz.2.6613': attribute type 2 has an invalid length. [ 532.592923][T21039] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6614'. [ 532.608551][T21042] netlink: 'syz.2.6613': attribute type 11 has an invalid length. [ 532.617048][T21042] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6613'. [ 532.765490][ T10] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 532.877711][T21053] syz_tun: entered promiscuous mode [ 532.883082][T21053] syz_tun: entered allmulticast mode [ 532.933889][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 532.943588][ T10] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 532.973975][ T10] usb 5-1: config 0 has no interface number 0 [ 532.992912][ T10] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 533.028299][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.049378][ T10] usb 5-1: Product: syz [ 533.053695][ T10] usb 5-1: Manufacturer: syz [ 533.066939][ T10] usb 5-1: SerialNumber: syz [ 533.084850][ T10] usb 5-1: config 0 descriptor?? [ 533.099926][T21064] ubi: mtd0 is already attached to ubi0 [ 533.105451][ T10] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 533.132837][ T10] usb 5-1: selecting invalid altsetting 1 [ 533.145461][ T10] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 533.188363][ T10] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 533.234220][ T10] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 533.243186][ T10] usb 5-1: media controller created [ 533.293359][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 533.384784][ T10] usb 5-1: DVB: registering adapter 2 frontend 0 (Zarlink ZL10353 DVB-T)... [ 533.394468][ T10] dvbdev: dvb_create_media_entity: media entity 'Zarlink ZL10353 DVB-T' registered. [ 533.412527][T21078] netlink: 'syz.3.6632': attribute type 2 has an invalid length. [ 533.431384][T21075] loop1: detected capacity change from 0 to 256 [ 533.462102][T21078] netlink: 'syz.3.6632': attribute type 1 has an invalid length. [ 533.469735][T21082] syz_tun: entered promiscuous mode [ 533.471217][T21075] exfat: Deprecated parameter 'namecase' [ 533.493928][T21078] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6632'. [ 533.510469][T21082] syz_tun: entered allmulticast mode [ 533.514167][T21075] exfat: Deprecated parameter 'utf8' [ 533.558131][ T10] DVB: Unable to find symbol mxl5005s_attach() [ 533.560214][T21075] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x5441951d, utbl_chksum : 0xe619d30d) [ 533.597115][ T10] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 533.746206][ T10] usb 5-1: USB disconnect, device number 22 [ 534.100597][T21100] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6643'. [ 534.115888][T21100] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 534.137413][T21105] netlink: 488 bytes leftover after parsing attributes in process `syz.0.6645'. [ 534.174706][T21105] netlink: 1041 bytes leftover after parsing attributes in process `syz.0.6645'. [ 534.250003][T21109] syz_tun: entered promiscuous mode [ 534.259287][T21109] syz_tun: entered allmulticast mode [ 534.486366][T21119] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6652'. [ 534.569915][T21124] loop3: detected capacity change from 0 to 1024 [ 534.661706][T21126] bridge5: entered promiscuous mode [ 534.667080][T21124] hfsplus: found bad thread record in catalog [ 534.667184][T21124] hfsplus: b-tree write err: -5, ino 19 [ 534.701804][T21124] EXT4-fs (loop3): VFS: Can't find ext4 filesystem [ 534.943476][T21134] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6657'. [ 535.305429][ T5908] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 535.473737][T21154] xt_NFQUEUE: number of total queues is 0 [ 535.480708][ T5908] usb 3-1: Using ep0 maxpacket: 32 [ 535.497312][ T5908] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 535.511167][ T5908] usb 3-1: config 0 has no interface number 0 [ 535.524303][ T5908] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 535.535362][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.546204][ T5908] usb 3-1: Product: syz [ 535.550504][ T5908] usb 3-1: Manufacturer: syz [ 535.564329][ T5908] usb 3-1: SerialNumber: syz [ 535.578735][ T5908] usb 3-1: config 0 descriptor?? [ 535.609636][ T5908] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 535.633483][ T5908] usb 3-1: selecting invalid altsetting 1 [ 535.663920][ T796] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 535.686751][ T5908] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 535.705474][ T5908] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 535.721447][ T5908] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 535.731532][ T5908] usb 3-1: media controller created [ 535.753102][ T5908] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 535.778863][T21120] syz.1.6662 (21120): drop_caches: 2 [ 535.835192][ T796] usb 5-1: Using ep0 maxpacket: 16 [ 535.841470][ T5908] usb 3-1: DVB: registering adapter 2 frontend 0 (Zarlink ZL10353 DVB-T)... [ 535.863740][ T796] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 535.879097][ T5908] dvbdev: dvb_create_media_entity: media entity 'Zarlink ZL10353 DVB-T' registered. [ 535.895062][ T796] usb 5-1: config 0 has no interface number 0 [ 535.914965][ T796] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 535.946113][ T796] usb 5-1: config 0 interface 34 altsetting 0 endpoint 0x82 has invalid maxpacket 1104, setting to 1024 [ 535.987352][ T796] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 536.016137][T21163] bridge6: entered promiscuous mode [ 536.028728][ T796] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 536.043235][ T5908] DVB: Unable to find symbol mxl5005s_attach() [ 536.059059][ T5908] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 536.066491][ T796] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.093474][ T796] usb 5-1: Product: syz [ 536.104040][ T796] usb 5-1: Manufacturer: syz [ 536.109809][ T796] usb 5-1: SerialNumber: syz [ 536.151336][ T796] usb 5-1: config 0 descriptor?? [ 536.184883][T21152] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 536.192758][T21152] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 536.212452][ T5908] usb 3-1: USB disconnect, device number 31 [ 536.408950][T21152] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 536.416459][T21152] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 536.629293][ T796] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 536.641438][ T796] asix 5-1:0.34: probe with driver asix failed with error -71 [ 536.678023][ T796] usb 5-1: USB disconnect, device number 23 [ 536.851589][T21181] xt_NFQUEUE: number of total queues is 0 [ 537.082864][T21189] netlink: 'syz.1.6684': attribute type 1 has an invalid length. [ 537.090911][T21189] netlink: 224 bytes leftover after parsing attributes in process `syz.1.6684'. [ 537.246307][T21195] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6687'. [ 537.669569][T21208] loop4: detected capacity change from 0 to 256 [ 538.024986][T21222] geneve4: entered promiscuous mode [ 538.031261][T21222] geneve4: entered allmulticast mode [ 538.342207][T21185] syz.2.6683 (21185): drop_caches: 2 [ 538.633181][T21247] loop2: detected capacity change from 0 to 256 [ 538.715664][T21253] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6717'. [ 538.888645][T21256] geneve3: entered promiscuous mode [ 538.904861][T21256] geneve3: entered allmulticast mode [ 538.989861][T21260] loop4: detected capacity change from 0 to 2048 [ 539.049618][T21260] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 539.446164][T21263] syz.3.6721 (21263): drop_caches: 2 [ 540.206216][T21297] geneve2: entered promiscuous mode [ 540.219389][T21297] geneve2: entered allmulticast mode [ 540.265131][T21269] loop2: detected capacity change from 0 to 32768 [ 540.315636][T21269] ERROR: (device loop2): xtSearch: xt_getpage: xtree page corrupt [ 540.315636][T21269] [ 540.342826][T21269] ERROR: (device loop2): remounting filesystem as read-only [ 540.351687][T21269] xtLookup: xtSearch returned -5 [ 541.278348][T21304] loop1: detected capacity change from 0 to 4096 [ 541.335095][T21304] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512). [ 541.428929][T21304] ntfs3(loop1): Mark volume as dirty due to NTFS errors [ 541.457623][T21304] ntfs3(loop1): ino=19, mi_enum_attr [ 541.516077][T21304] ntfs3(loop1): failed to convert "c46c" to cp863 [ 541.536544][T21304] ntfs3(loop1): ino=20, mi_enum_attr [ 541.723959][ T981] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 541.808202][T21335] netlink: 'syz.0.6757': attribute type 1 has an invalid length. [ 541.821607][T21335] netlink: 224 bytes leftover after parsing attributes in process `syz.0.6757'. [ 541.922433][ T981] usb 4-1: Using ep0 maxpacket: 32 [ 541.936781][ T981] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 40 [ 541.981583][ T981] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 542.001295][ T981] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 542.011400][ T981] usb 4-1: Product: syz [ 542.025336][ T981] usb 4-1: Manufacturer: syz [ 542.031635][ T981] usb 4-1: SerialNumber: syz [ 542.075235][ T981] usb 4-1: config 0 descriptor?? [ 542.081170][T21321] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 542.112538][ T981] hub 4-1:0.0: bad descriptor, ignoring hub [ 542.132873][ T981] hub 4-1:0.0: probe with driver hub failed with error -5 [ 542.280493][T21325] loop4: detected capacity change from 0 to 32768 [ 542.339038][T21325] ERROR: (device loop4): xtSearch: xt_getpage: xtree page corrupt [ 542.339038][T21325] [ 542.356665][T21325] ERROR: (device loop4): remounting filesystem as read-only [ 542.385789][T21325] xtLookup: xtSearch returned -5 [ 542.464553][ T981] usb 4-1: USB disconnect, device number 24 [ 542.600355][T21333] loop1: detected capacity change from 0 to 32768 [ 542.727679][T21333] JBD2: Ignoring recovery information on journal [ 542.774246][T21356] netlink: 'syz.2.6767': attribute type 6 has an invalid length. [ 542.782046][T21356] netlink: 'syz.2.6767': attribute type 7 has an invalid length. [ 542.854175][T21356] netlink: 'syz.2.6767': attribute type 8 has an invalid length. [ 542.862531][T21333] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 542.871794][T21356] netlink: 'syz.2.6767': attribute type 15 has an invalid length. [ 543.013654][T21333] OCFS2: ERROR (device loop1): int ocfs2_validate_gd_self(struct super_block *, struct buffer_head *, int): Group descriptor #17056 has bit count 2061 but max bitmap bits of 2048 [ 543.084024][T21333] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 543.104639][T21333] OCFS2: File system is now read-only. [ 543.137713][T21333] (syz.1.6754,21333,0):ocfs2_search_chain:1888 ERROR: status = -30 [ 543.166345][T21333] (syz.1.6754,21333,0):ocfs2_search_chain:2011 ERROR: status = -30 [ 543.184006][T21333] (syz.1.6754,21333,0):ocfs2_claim_suballoc_bits:2098 ERROR: status = -30 [ 543.192927][T21333] (syz.1.6754,21333,0):ocfs2_claim_suballoc_bits:2151 ERROR: status = -30 [ 543.247485][T21333] (syz.1.6754,21333,0):ocfs2_claim_new_inode:2392 ERROR: status = -30 [ 543.283939][T21333] (syz.1.6754,21333,0):ocfs2_claim_new_inode:2407 ERROR: status = -30 [ 543.319402][T21333] (syz.1.6754,21333,0):ocfs2_mknod_locked:642 ERROR: status = -30 [ 543.338429][T21333] (syz.1.6754,21333,0):ocfs2_symlink:1957 ERROR: status = -30 [ 543.364074][T21333] (syz.1.6754,21333,0):ocfs2_symlink:2081 ERROR: status = -30 [ 543.502816][T21379] SET target dimension over the limit! [ 543.572409][ T5836] ocfs2: Unmounting device (7,1) on (node local) [ 544.217414][T21404] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6790'. [ 544.487969][T21419] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6798'. [ 545.082314][T21439] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6808'. [ 545.235577][T21447] SET target dimension over the limit! [ 545.373737][T21453] netlink: 56 bytes leftover after parsing attributes in process `syz.0.6814'. [ 545.508250][T21424] loop3: detected capacity change from 0 to 32768 [ 545.593621][T21424] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 545.702447][T21424] XFS (loop3): Ending clean mount [ 545.749402][T21424] XFS (loop3): Quotacheck needed: Please wait. [ 545.867410][T21424] XFS (loop3): Quotacheck: Done. [ 545.986885][ T5834] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 546.184063][T21490] SET target dimension over the limit! [ 546.364624][T21496] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6828'. [ 547.051611][T21492] loop4: detected capacity change from 0 to 32768 [ 547.103565][T21492] JBD2: Ignoring recovery information on journal [ 547.187681][T21527] loop2: detected capacity change from 0 to 256 [ 547.212616][T21527] exfat: Deprecated parameter 'namecase' [ 547.220948][T21527] exfat: Deprecated parameter 'utf8' [ 547.265946][T21492] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 547.316978][T21527] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xf6e00961, utbl_chksum : 0xe619d30d) [ 547.387813][T21492] OCFS2: ERROR (device loop4): int ocfs2_validate_gd_self(struct super_block *, struct buffer_head *, int): Group descriptor #17056 has bit count 2061 but max bitmap bits of 2048 [ 547.455040][T21492] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 547.482004][T21492] OCFS2: File system is now read-only. [ 547.503309][T21492] (syz.4.6829,21492,0):ocfs2_search_chain:1888 ERROR: status = -30 [ 547.559743][T21492] (syz.4.6829,21492,0):ocfs2_search_chain:2011 ERROR: status = -30 [ 547.593651][T21492] (syz.4.6829,21492,0):ocfs2_claim_suballoc_bits:2098 ERROR: status = -30 [ 547.621526][T21492] (syz.4.6829,21492,0):ocfs2_claim_suballoc_bits:2151 ERROR: status = -30 [ 547.644348][T21492] (syz.4.6829,21492,1):ocfs2_claim_new_inode:2392 ERROR: status = -30 [ 547.664874][T21492] (syz.4.6829,21492,1):ocfs2_claim_new_inode:2407 ERROR: status = -30 [ 547.723881][T21492] (syz.4.6829,21492,1):ocfs2_mknod_locked:642 ERROR: status = -30 [ 547.731853][T21492] (syz.4.6829,21492,1):ocfs2_symlink:1957 ERROR: status = -30 [ 547.794213][T21492] (syz.4.6829,21492,1):ocfs2_symlink:2081 ERROR: status = -30 [ 547.881157][T21518] loop1: detected capacity change from 0 to 32768 [ 547.931598][ T5829] ocfs2: Unmounting device (7,4) on (node local) [ 547.946293][T21518] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 548.024149][T21555] MTD: Couldn't look up '': -22 [ 548.117854][T21518] XFS (loop1): Ending clean mount [ 548.167704][T21518] XFS (loop1): Quotacheck needed: Please wait. [ 548.272072][T21518] XFS (loop1): Quotacheck: Done. [ 548.367440][ T5836] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 548.807485][T21582] MTD: Couldn't look up '': -22 [ 549.322823][T21602] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 549.535533][T21610] MTD: Couldn't look up '': -22 [ 549.655152][T21618] loop1: detected capacity change from 0 to 256 [ 549.697730][T21621] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 549.729900][T21626] sctp: [Deprecated]: syz.4.6889 (pid 21626) Use of struct sctp_assoc_value in delayed_ack socket option. [ 549.729900][T21626] Use struct sctp_sack_info instead [ 550.244928][T21643] netlink: 'syz.0.6909': attribute type 1 has an invalid length. [ 550.471494][T21658] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6904'. [ 550.752253][T21674] loop2: detected capacity change from 0 to 512 [ 550.840392][T21674] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 550.868844][T21674] EXT4-fs error (device loop2): ext4_xattr_block_get:597: inode #15: comm syz.2.6914: corrupted xattr block 33: invalid header [ 550.934321][T21674] EXT4-fs error (device loop2): ext4_xattr_block_get:597: inode #15: comm syz.2.6914: corrupted xattr block 33: invalid header [ 550.963921][T21674] fscrypt (loop2, inode 15): Error -117 getting encryption context [ 551.013125][T21685] openvswitch: netlink: Missing key (keys=800040, expected=2000) [ 551.016280][ T5838] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 551.151383][T21689] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6921'. [ 551.284724][ T796] usb 1-1: new low-speed USB device number 24 using dummy_hcd [ 551.347474][T21695] loop1: detected capacity change from 0 to 256 [ 551.358912][T21697] loop4: detected capacity change from 0 to 256 [ 551.359268][T21695] exfat: Deprecated parameter 'namecase' [ 551.377924][T21695] exfat: Deprecated parameter 'utf8' [ 551.448336][T21695] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xf6e00961, utbl_chksum : 0xe619d30d) [ 551.481037][ T796] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 551.490841][ T796] usb 1-1: config 0 has no interface number 0 [ 551.500691][ T796] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 551.514233][ T796] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 551.534609][ T796] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 551.577046][ T796] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 551.605353][ T796] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 551.655747][ T796] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 551.714136][ T796] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 551.726855][T21681] loop3: detected capacity change from 0 to 32768 [ 551.734442][ T796] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 551.794850][ T796] usb 1-1: config 0 descriptor?? [ 551.797302][T21681] XFS (loop3): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 551.814199][T21687] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 551.822865][T21687] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 551.877467][T21708] netlink: 'syz.1.6937': attribute type 1 has an invalid length. [ 551.884937][ T796] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 551.949295][T21681] XFS (loop3): Ending clean mount [ 551.991946][T21681] XFS (loop3): Quotacheck needed: Please wait. [ 552.129372][T21681] XFS (loop3): Quotacheck: Done. [ 552.193713][ T5834] XFS (loop3): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 552.232527][ T796] usb 1-1: USB disconnect, device number 24 [ 552.311556][ T796] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 552.504763][T21699] loop2: detected capacity change from 0 to 32768 [ 552.524312][T21699] tmpfs: Unknown parameter 'seclabel' [ 552.880503][T21737] syz.1.6947: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 552.899401][T21736] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6934'. [ 552.923278][T21737] CPU: 0 UID: 0 PID: 21737 Comm: syz.1.6947 Not tainted syzkaller #0 PREEMPT(full) [ 552.923317][T21737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 552.923330][T21737] Call Trace: [ 552.923338][T21737] [ 552.923347][T21737] dump_stack_lvl+0xe8/0x150 [ 552.923390][T21737] warn_alloc+0x249/0x340 [ 552.923423][T21737] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 552.923457][T21737] ? __pfx_warn_alloc+0x10/0x10 [ 552.923487][T21737] ? kasan_save_track+0x4f/0x80 [ 552.923506][T21737] ? kasan_save_track+0x3e/0x80 [ 552.923521][T21737] ? __kasan_kmalloc+0x93/0xb0 [ 552.923539][T21737] ? __kmalloc_cache_noprof+0x31c/0x660 [ 552.923558][T21737] ? xskq_create+0x56/0x170 [ 552.923585][T21737] ? xsk_setsockopt+0x54c/0x990 [ 552.923607][T21737] ? do_sock_setsockopt+0x17c/0x1b0 [ 552.923633][T21737] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 552.923657][T21737] ? do_syscall_64+0x14d/0xf80 [ 552.923679][T21737] __vmalloc_node_range_noprof+0x132/0x1730 [ 552.923741][T21737] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 552.923768][T21737] ? __kasan_kmalloc+0x93/0xb0 [ 552.923791][T21737] vmalloc_user_noprof+0xad/0xe0 [ 552.923819][T21737] ? xskq_create+0xbf/0x170 [ 552.923846][T21737] xskq_create+0xbf/0x170 [ 552.923875][T21737] xsk_init_queue+0x8a/0xe0 [ 552.923923][T21737] xsk_setsockopt+0x54c/0x990 [ 552.923955][T21737] ? __pfx_xsk_setsockopt+0x10/0x10 [ 552.923983][T21737] ? __pfx_aa_sk_perm+0x10/0x10 [ 552.924010][T21737] ? aa_sock_opt_perm+0xff/0x1a0 [ 552.924037][T21737] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 552.924059][T21737] ? __pfx_xsk_setsockopt+0x10/0x10 [ 552.924090][T21737] do_sock_setsockopt+0x17c/0x1b0 [ 552.924125][T21737] __x64_sys_setsockopt+0x13d/0x1b0 [ 552.924163][T21737] do_syscall_64+0x14d/0xf80 [ 552.924184][T21737] ? trace_irq_disable+0x3b/0x150 [ 552.924210][T21737] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.924230][T21737] ? clear_bhb_loop+0x40/0x90 [ 552.924255][T21737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.924274][T21737] RIP: 0033:0x7fdfd019c629 [ 552.924295][T21737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 552.924313][T21737] RSP: 002b:00007fdfd0fbf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 552.924336][T21737] RAX: ffffffffffffffda RBX: 00007fdfd0415fa0 RCX: 00007fdfd019c629 [ 552.924351][T21737] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 552.924375][T21737] RBP: 00007fdfd0232b39 R08: 0000000000000004 R09: 0000000000000000 [ 552.924388][T21737] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 552.924401][T21737] R13: 00007fdfd0416038 R14: 00007fdfd0415fa0 R15: 00007ffd73445408 [ 552.924435][T21737] [ 553.243378][T21737] Mem-Info: [ 553.285764][T21737] active_anon:6806 inactive_anon:0 isolated_anon:0 [ 553.285764][T21737] active_file:3952 inactive_file:51042 isolated_file:0 [ 553.285764][T21737] unevictable:768 dirty:353 writeback:0 [ 553.285764][T21737] slab_reclaimable:7562 slab_unreclaimable:104237 [ 553.285764][T21737] mapped:30429 shmem:1373 pagetables:1471 [ 553.285764][T21737] sec_pagetables:0 bounce:0 [ 553.285764][T21737] kernel_misc_reclaimable:0 [ 553.285764][T21737] free:1304075 free_pcp:13776 free_cma:0 [ 553.338195][T21737] Node 0 active_anon:27124kB inactive_anon:0kB active_file:15808kB inactive_file:203964kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:121716kB dirty:1412kB writeback:0kB shmem:3956kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12012kB pagetables:5736kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 553.394714][T21737] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 553.487967][T21750] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6945'. [ 553.497588][T21750] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6945'. [ 553.502809][T21737] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 553.536667][T21751] netlink: 'syz.0.6942': attribute type 30 has an invalid length. [ 553.605285][T21737] lowmem_reserve[]: 0 2486 2486 2486 2486 [ 553.625762][T21737] Node 0 DMA32 free:1260056kB boost:0kB min:34148kB low:42684kB high:51220kB reserved_highatomic:0KB free_highatomic:0KB active_anon:27224kB inactive_anon:0kB active_file:15808kB inactive_file:203964kB unevictable:1536kB writepending:1412kB zspages:0kB present:3129332kB managed:2546348kB mlocked:0kB bounce:0kB free_pcp:54972kB local_pcp:22284kB free_cma:0kB [ 553.678635][T21737] lowmem_reserve[]: 0 0 0 0 0 [ 553.683741][T21737] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:80kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 553.717611][T21737] lowmem_reserve[]: 0 0 0 0 0 [ 553.725350][T21737] Node 1 Normal free:3941968kB boost:0kB min:55748kB low:69684kB high:83620kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:252kB local_pcp:0kB free_cma:0kB [ 553.761630][T21737] lowmem_reserve[]: 0 0 0 0 0 [ 553.766542][T21737] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 553.814051][T21737] Node 0 DMA32: 5114*4kB (UME) 4004*8kB (UME) 2055*16kB (UME) 314*32kB (UME) 192*64kB (UME) 167*128kB (UME) 142*256kB (UM) 102*512kB (UM) 59*1024kB (UME) 13*2048kB (UM) 233*4096kB (UM) = 1259064kB [ 553.873489][T21737] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 553.959455][T21737] Node 1 Normal: 1*4kB (U) 14*8kB (U) 19*16kB (UE) 9*32kB (UE) 9*64kB (UE) 3*128kB (U) 4*256kB (UM) 4*512kB (UM) 3*1024kB (UME) 5*2048kB (UME) 958*4096kB (M) = 3942020kB [ 554.043599][T21737] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 554.077388][T21737] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 554.123964][T21737] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 554.161330][T21737] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 554.212492][T21773] loop3: detected capacity change from 0 to 1024 [ 554.221551][T21737] 56362 total pagecache pages [ 554.228126][T21737] 0 pages in swap cache [ 554.243546][T21737] Free swap = 124996kB [ 554.253546][T21737] Total swap = 124996kB [ 554.275333][T21737] 2097051 pages RAM [ 554.279320][T21737] 0 pages HighMem/MovableOnly [ 554.326078][T21737] 428829 pages reserved [ 554.330938][T21737] 0 pages cma reserved [ 554.416267][ T1156] hfsplus: b-tree write err: -5, ino 8 [ 555.061701][T21811] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 555.111757][T21811] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 555.294182][T21821] loop1: detected capacity change from 0 to 512 [ 555.334948][T21821] EXT4-fs: Ignoring removed nomblk_io_submit option [ 555.382009][T21829] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6983'. [ 555.413917][T21829] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6983'. [ 555.501639][T21821] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 555.674487][T21821] Quota error (device loop1): find_tree_dqentry: Cycle in quota tree detected: block 4 index 0 [ 555.724814][T21821] Quota error (device loop1): qtree_read_dquot: Can't read quota structure for id 0 [ 555.784333][T21821] EXT4-fs error (device loop1): ext4_acquire_dquot:7001: comm syz.1.6980: Failed to acquire dquot type 1 [ 555.909877][ T5836] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 555.966012][T21854] netlink: 'syz.3.6995': attribute type 1 has an invalid length. [ 555.975721][T21854] netlink: 'syz.3.6995': attribute type 3 has an invalid length. [ 555.983579][T21854] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6995'. [ 556.084812][T21860] loop4: detected capacity change from 0 to 512 [ 556.096889][T21862] netlink: 'syz.2.6999': attribute type 21 has an invalid length. [ 556.126804][T21860] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 556.135867][T21862] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6999'. [ 556.213969][T21860] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=c000e128, mo2=0002] [ 556.246107][T21860] EXT4-fs (loop4): orphan cleanup on readonly fs [ 556.252661][T21860] Quota error (device loop4): v2_read_header: Failed header read: expected=8 got=0 [ 556.298822][T21860] EXT4-fs warning (device loop4): ext4_enable_quotas:7236: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 556.355555][T21860] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 556.371765][T21860] EXT4-fs (loop4): 1 truncate cleaned up [ 556.383238][T21860] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 556.448788][T21860] EXT4-fs error (device loop4): ext4_encrypted_get_link:46: inode #16: comm syz.4.6998: bad symlink. [ 556.464301][T21860] EXT4-fs (loop4): Remounting filesystem read-only [ 556.493549][T21879] loop2: detected capacity change from 0 to 64 [ 556.610905][ T5829] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 556.640274][T21872] loop1: detected capacity change from 0 to 4096 [ 556.693885][T21872] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512). [ 556.817475][T21887] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 556.832603][T21872] ntfs3(loop1): Mark volume as dirty due to NTFS errors [ 556.883498][T21872] ntfs3(loop1): ino=19, mi_enum_attr [ 556.963976][T21872] ntfs3(loop1): failed to convert "c46c" to iso8859-7 [ 557.001088][T21872] ntfs3(loop1): ino=20, mi_enum_attr [ 557.186439][T21903] binder: 21902:21903 ioctl 40046210 0 returned -14 [ 557.626644][ T29] audit: type=1326 audit(557.594:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21922 comm="syz.0.7029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 557.699601][ T29] audit: type=1326 audit(557.594:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21922 comm="syz.0.7029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 557.794079][ T29] audit: type=1326 audit(557.604:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21922 comm="syz.0.7029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=96 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 557.877475][ T29] audit: type=1326 audit(557.604:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21922 comm="syz.0.7029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 557.960352][ T29] audit: type=1326 audit(557.604:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21922 comm="syz.0.7029" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72319c629 code=0x7ffc0000 [ 558.099804][T21945] loop1: detected capacity change from 0 to 8 [ 558.127965][T21944] loop4: detected capacity change from 0 to 1024 [ 558.147158][T21945] SQUASHFS error: Unable to read inode 0x87 [ 558.233684][T21944] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 558.428610][ T5829] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 558.576844][T21969] netlink: 188 bytes leftover after parsing attributes in process `syz.2.7051'. [ 558.884026][T21982] kAFS: unable to lookup cell 'syz1' [ 559.210964][T21998] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7064'. [ 559.732582][T21984] loop2: detected capacity change from 0 to 32768 [ 559.790481][T21984] ERROR: (device loop2): xtTruncate_pmap: xt_getpage: xtree page corrupt [ 559.790481][T21984] [ 559.802938][ T981] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 559.819454][T21984] ERROR: (device loop2): remounting filesystem as read-only [ 559.843998][T21984] ERROR: (device loop2): jfs_rename: [ 559.843998][T21984] [ 559.882966][T22025] dlm: non-version read from control device 90 [ 559.901506][T22028] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7077'. [ 559.918069][ T5838] ERROR: (device loop2): xtTruncate: xt_getpage: xtree page corrupt [ 559.918069][ T5838] [ 559.974044][ T981] usb 2-1: Using ep0 maxpacket: 32 [ 559.995444][ T981] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 560.014657][ T981] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 560.061190][ T981] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 560.095318][ T981] usb 2-1: config 1 has no interface number 0 [ 560.101574][ T981] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 560.135654][ T981] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 560.154999][ T981] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 560.180305][ T981] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 560.196528][T22033] loop2: detected capacity change from 0 to 4096 [ 560.208961][ T981] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.287821][T22033] ntfs3(loop2): Mark volume as dirty due to NTFS errors [ 560.308348][ T981] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 560.521266][ T981] snd_usb_pod 2-1:1.1: cannot start listening: -90 [ 560.536413][ T981] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 560.555189][ T981] snd_usb_pod 2-1:1.1: probe with driver snd_usb_pod failed with error -90 [ 560.726597][T22056] netlink: 5 bytes leftover after parsing attributes in process `syz.0.7092'. [ 560.736550][T22055] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7093'. [ 560.746707][ T981] usb 2-1: USB disconnect, device number 30 [ 560.789810][T22055] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7093'. [ 560.822909][T22061] netlink: 'syz.4.7094': attribute type 1 has an invalid length. [ 561.339550][T22084] loop2: detected capacity change from 0 to 16 [ 561.371789][T22084] erofs (device loop2): mounted with root inode @ nid 36. [ 561.629257][T22097] loop1: detected capacity change from 0 to 512 [ 561.659430][T22097] EXT4-fs: Ignoring removed nomblk_io_submit option [ 561.724067][T22097] EXT4-fs error (device loop1): ext4_iget_extra_inode:5025: inode #15: comm syz.1.7112: corrupted in-inode xattr: e_value size too large [ 561.754006][T22097] loop1: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 561.754493][T22097] EXT4-fs (loop1): Remounting filesystem read-only [ 561.763821][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 561.763844][ C0] EXT4-fs (loop1): initial error at time 561: ext4_iget_extra_inode:5025: inode 15 [ 561.763877][ C0] EXT4-fs (loop1): last error at time 561: ext4_iget_extra_inode:5025: inode 15 [ 561.892699][T22097] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 562.101961][ T5836] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 562.323887][ T5887] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 562.483957][ T5887] usb 1-1: Using ep0 maxpacket: 8 [ 562.510062][ T5887] usb 1-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 562.538384][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.565872][ T5887] usb 1-1: Product: syz [ 562.579238][ T5887] usb 1-1: Manufacturer: syz [ 562.603818][ T5887] usb 1-1: SerialNumber: syz [ 562.660664][T22139] cgroup: Need name or subsystem set [ 563.037263][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.060822][ T5887] mxuport 1-1:254.0: mxuport_recv_ctrl_urb - usb_control_msg failed (-71) [ 563.080343][ T5887] mxuport 1-1:254.0: probe with driver mxuport failed with error -5 [ 563.118738][ T5887] usb 1-1: USB disconnect, device number 25 [ 563.591944][T22171] loop2: detected capacity change from 0 to 256 [ 563.630734][T18938] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 563.700684][T22171] FAT-fs (loop2): Directory bread(block 64) failed [ 563.713054][T22171] FAT-fs (loop2): Directory bread(block 65) failed [ 563.733991][T22171] FAT-fs (loop2): Directory bread(block 66) failed [ 563.740954][T22171] FAT-fs (loop2): Directory bread(block 67) failed [ 563.763985][T22171] FAT-fs (loop2): Directory bread(block 68) failed [ 563.771002][T22171] FAT-fs (loop2): Directory bread(block 69) failed [ 563.793883][T18938] usb 4-1: Using ep0 maxpacket: 8 [ 563.799475][T22171] FAT-fs (loop2): Directory bread(block 70) failed [ 563.807840][T22171] FAT-fs (loop2): Directory bread(block 71) failed [ 563.824671][T18938] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 563.858535][T22171] FAT-fs (loop2): Directory bread(block 72) failed [ 563.874509][T22171] FAT-fs (loop2): Directory bread(block 73) failed [ 563.875759][T18938] usb 4-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 563.911927][T18938] usb 4-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 563.936719][T18938] usb 4-1: Product: syz [ 563.941131][T18938] usb 4-1: Manufacturer: syz [ 563.966716][T18938] usb 4-1: SerialNumber: syz [ 564.190985][T18938] usb 4-1: Invalid connection information received from device [ 564.272313][T22167] loop1: detected capacity change from 0 to 32768 [ 564.336584][T22167] JBD2: Ignoring recovery information on journal [ 564.404946][T18938] usb 4-1: USB disconnect, device number 25 [ 564.494307][T22167] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 564.500482][T22175] loop4: detected capacity change from 0 to 32768 [ 564.545301][T22175] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 564.822620][T22175] XFS (loop4): Ending clean mount [ 564.837330][T22175] XFS (loop4): Quotacheck needed: Please wait. [ 564.895574][ T5836] ocfs2: Unmounting device (7,1) on (node local) [ 564.915481][T22175] XFS (loop4): Quotacheck: Done. [ 565.176003][ T5829] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 565.492986][T22219] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7169'. [ 565.663514][T22223] netlink: 'syz.3.7170': attribute type 3 has an invalid length. [ 565.790857][T22229] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7164'. [ 565.955727][T22236] loop1: detected capacity change from 0 to 512 [ 565.998900][T22236] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 566.054326][T22236] EXT4-fs error (device loop1): ext4_orphan_get:1391: inode #15: comm syz.1.7176: inode has both inline data and extents flags [ 566.085509][T22236] loop1: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 566.093532][T22236] EXT4-fs error (device loop1): ext4_orphan_get:1396: comm syz.1.7176: couldn't read orphan inode 15 (err -117) [ 566.102837][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 566.102868][ C1] EXT4-fs (loop1): initial error at time 566: ext4_orphan_get:1391: inode 15 [ 566.102904][ C1] EXT4-fs (loop1): last error at time 566: ext4_orphan_get:1391: inode 15 [ 566.185287][T22236] loop1: lost filesystem error report for type 5 error -117 [ 566.187776][T22236] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 566.251283][T22236] Quota error (device loop1): find_tree_dqentry: Cycle in quota tree detected: block 1 index 0 [ 566.276246][T22236] Quota error (device loop1): qtree_read_dquot: Can't read quota structure for id 0 [ 566.323961][T22236] EXT4-fs error (device loop1): ext4_acquire_dquot:7001: comm syz.1.7176: Failed to acquire dquot type 0 [ 566.455006][ T5836] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 566.713934][ T10] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 566.793886][ T5887] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 566.941267][ T10] usb 3-1: config 0 has an invalid interface number: 97 but max is 0 [ 566.959804][ T5887] usb 1-1: Using ep0 maxpacket: 16 [ 566.968071][ T10] usb 3-1: config 0 has no interface number 0 [ 566.986358][ T5887] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 567.006479][ T10] usb 3-1: too many endpoints for config 0 interface 97 altsetting 97: 97, using maximum allowed: 30 [ 567.024768][ T5887] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 567.043887][ T10] usb 3-1: config 0 interface 97 altsetting 97 has 0 endpoint descriptors, different from the interface descriptor's value: 97 [ 567.066968][ T5887] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 567.078871][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.087720][ T10] usb 3-1: config 0 interface 97 has no altsetting 0 [ 567.094928][ T10] usb 3-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c6.98 [ 567.104736][ T5887] usb 1-1: Product: syz [ 567.110056][ T5887] usb 1-1: Manufacturer: syz [ 567.115882][ T5887] usb 1-1: SerialNumber: syz [ 567.124573][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.176127][ T10] usb 3-1: config 0 descriptor?? [ 567.393237][ T10] usb 3-1: string descriptor 0 read error: -71 [ 567.429139][ T10] ftdi_sio 3-1:0.97: FTDI USB Serial Device converter detected [ 567.444144][ T5887] usb 1-1: 0:2 : does not exist [ 567.453899][ T5887] usb 1-1: unit 9 not found! [ 567.485825][ T10] ftdi_sio ttyUSB0: unknown device type: 0xc698 [ 567.497286][ T5887] usb 1-1: 4:0: cannot get min/max values for control 3 (id 4) [ 567.518474][ T10] usb 3-1: USB disconnect, device number 32 [ 567.531690][ T5887] usb 1-1: 4:0: cannot get min/max values for control 9 (id 4) [ 567.566008][ T10] ftdi_sio 3-1:0.97: device disconnected [ 567.657908][ T5887] usb 1-1: USB disconnect, device number 26 [ 567.859520][T22320] loop1: detected capacity change from 0 to 1024 [ 567.874770][T22320] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 567.910576][T22320] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=c841e018, mo2=0000] [ 567.932043][T22320] EXT4-fs error (device loop1): ext4_map_blocks:776: inode #3: block 2: comm syz.1.7217: lblock 2 mapped to illegal pblock 2 (length 1) [ 567.964348][T22320] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 567.972012][T22320] Quota error (device loop1): qtree_write_dquot: dquota write failed [ 567.981388][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 567.981413][ C1] EXT4-fs (loop1): initial error at time 567: ext4_map_blocks:776: inode 3: block 2 [ 567.981453][ C1] EXT4-fs (loop1): last error at time 567: ext4_map_blocks:776: inode 3: block 2 [ 568.017070][T22320] EXT4-fs error (device loop1): ext4_map_blocks:776: inode #3: block 48: comm syz.1.7217: lblock 0 mapped to illegal pblock 48 (length 1) [ 568.033868][T22320] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 568.043904][T22320] Quota error (device loop1): v2_write_file_info: Can't write info structure [ 568.093973][T22320] EXT4-fs error (device loop1): ext4_acquire_dquot:7001: comm syz.1.7217: Failed to acquire dquot type 0 [ 568.113375][T22320] loop1: lost filesystem error report for type 5 error -117 [ 568.126183][T22320] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6246: Corrupt filesystem [ 568.139390][T22320] loop1: lost filesystem error report for type 5 error -117 [ 568.139759][T22320] EXT4-fs error (device loop1): ext4_evict_inode:255: inode #11: comm syz.1.7217: mark_inode_dirty error [ 568.159308][T22320] loop1: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 568.159619][T22320] EXT4-fs warning (device loop1): ext4_evict_inode:258: couldn't mark inode dirty (err -117) [ 568.181330][T22320] EXT4-fs (loop1): 1 orphan inode deleted [ 568.193116][T22324] loop4: detected capacity change from 0 to 4096 [ 568.203901][ T1156] EXT4-fs error (device loop1): ext4_map_blocks:776: inode #3: block 1: comm kworker/u8:10: lblock 1 mapped to illegal pblock 1 (length 1) [ 568.241659][T22320] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 568.254425][ T1156] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 568.254827][ T1156] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 568.276838][T22324] ntfs3(loop4): Different NTFS sector size (4096) and media sector size (512). [ 568.283983][ T1156] EXT4-fs error (device loop1): ext4_release_dquot:7037: comm kworker/u8:10: Failed to release dquot type 0 [ 568.383912][T22324] ntfs3(loop4): Mark volume as dirty due to NTFS errors [ 568.417312][T22324] ntfs3(loop4): ino=19, mi_enum_attr [ 568.429127][ T5836] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 568.443999][ T49] EXT4-fs error (device loop1): ext4_map_blocks:776: inode #3: block 1: comm kworker/u8:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 568.512360][ T49] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 568.512685][ T49] Quota error (device loop1): remove_tree: Can't read quota data block 1 [ 568.582120][ T49] EXT4-fs error (device loop1): ext4_release_dquot:7037: comm kworker/u8:3: Failed to release dquot type 0 [ 568.591493][T22343] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7229'. [ 568.633827][ T49] loop1: lost filesystem error report for type 5 error -117 [ 568.646626][ T5836] EXT4-fs error (device loop1): __ext4_get_inode_loc:4782: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 568.723718][ T5836] loop1: lost filesystem error report for type 5 error -117 [ 568.729837][ T5836] EXT4-fs error (device loop1) in ext4_reserve_inode_write:6246: Corrupt filesystem [ 568.786520][ T5836] loop1: lost filesystem error report for type 5 error -117 [ 568.791084][ T5836] EXT4-fs error (device loop1): ext4_quota_off:7285: inode #3: comm syz-executor: mark_inode_dirty error [ 568.869064][ T5836] loop1: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 569.595737][ T29] audit: type=1326 audit(569.564:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22376 comm="syz.1.7243" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdfd019c629 code=0x0 [ 569.781098][T22383] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 569.798936][T22383] /dev/nullb0: Can't open blockdev [ 570.021023][T22355] loop4: detected capacity change from 0 to 32768 [ 570.100947][T22355] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 570.182068][T22402] Cannot find add_set index 2 as target [ 570.318595][T22407] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 570.418378][T22355] XFS (loop4): Ending clean mount [ 570.481623][T22355] XFS (loop4): Quotacheck needed: Please wait. [ 570.588991][T22379] loop2: detected capacity change from 0 to 32768 [ 570.632620][T22355] XFS (loop4): Quotacheck: Done. [ 570.632750][T22379] XFS (loop2): DAX unsupported by block device. Turning off DAX. [ 570.696048][T22379] XFS (loop2): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 570.731595][ T5829] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 571.185636][T22379] XFS (loop2): Ending clean mount [ 571.394326][ T5838] XFS (loop2): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 571.526522][T22454] loop4: detected capacity change from 0 to 4096 [ 571.563980][T22454] ntfs3(loop4): Different NTFS sector size (4096) and media sector size (512). [ 571.653182][T22459] loop1: detected capacity change from 0 to 1024 [ 571.660222][T22454] ntfs3(loop4): Mark volume as dirty due to NTFS errors [ 571.688147][T22454] ntfs3(loop4): ino=19, mi_enum_attr [ 571.768352][T22454] ntfs3(loop4): failed to convert "c46c" to iso8859-7 [ 571.790802][T22454] ntfs3(loop4): ino=20, mi_enum_attr [ 571.957069][ T49] hfsplus: b-tree write err: -5, ino 8 [ 572.100214][T22464] loop3: detected capacity change from 0 to 4096 [ 572.222055][T22473] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7283'. [ 572.269064][T22464] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 572.319694][T22464] ntfs3(loop3): ino=1a, mi_enum_attr [ 572.334572][T22464] ntfs3(loop3): ino=1a, mi_enum_attr [ 572.363974][T22464] ntfs3(loop3): Failed to initialize $Extend/$Reparse. [ 572.453960][T22464] ntfs3(loop3): ino=1a, mi_enum_attr [ 572.512649][T22479] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7286'. [ 572.540806][T22479] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7286'. [ 572.828168][T22491] netlink: 'syz.4.7293': attribute type 1 has an invalid length. [ 572.864815][T22491] netlink: 'syz.4.7293': attribute type 3 has an invalid length. [ 572.872783][T22491] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7293'. [ 573.041999][T22499] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 573.204159][T18938] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 573.377264][T18938] usb 3-1: Using ep0 maxpacket: 32 [ 573.387182][T18938] usb 3-1: config 0 has an invalid interface number: 146 but max is 0 [ 573.397210][T18938] usb 3-1: config 0 has no interface number 0 [ 573.403441][T18938] usb 3-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 573.419172][T18938] usb 3-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 573.433364][T18938] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 573.447963][T18938] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 573.479626][T18938] usb 3-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 573.493929][ T10] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 573.512281][T18938] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 573.544218][T18938] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 573.557129][T18938] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 29557, setting to 1024 [ 573.570467][T18938] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 573.581272][T22517] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 573.591304][T18938] usb 3-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 573.629661][T18938] usb 3-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 573.652441][T18938] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.666335][ T10] usb 5-1: config index 0 descriptor too short (expected 133, got 72) [ 573.676054][T18938] usb 3-1: Product: syz [ 573.677294][ T10] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 573.680267][T18938] usb 3-1: Manufacturer: syz [ 573.702668][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 573.724543][T18938] usb 3-1: SerialNumber: syz [ 573.732021][ T10] usb 5-1: Product: syz [ 573.740948][T18938] usb 3-1: config 0 descriptor?? [ 573.743074][ T10] usb 5-1: Manufacturer: syz [ 573.757887][T22497] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 573.772684][ T10] usb 5-1: SerialNumber: syz [ 573.774134][T22497] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 573.805023][ T10] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 573.807569][T18938] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 573.841239][ T5909] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 573.863587][T18938] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 573.915615][T18938] scsi host1: microtekX6 [ 574.075288][T22509] loop1: detected capacity change from 0 to 32768 [ 574.086255][ C0] usb 5-1: ath9k_htc: over RX MAX_PKT_NUM [ 574.132701][T22509] XFS (loop1): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 574.269362][T22509] XFS (loop1): Ending clean mount [ 574.283561][ T5887] usb 3-1: USB disconnect, device number 33 [ 574.368334][T22509] XFS (loop1): Quotacheck needed: Please wait. [ 574.525716][T22509] XFS (loop1): Quotacheck: Done. [ 574.749777][ T10] usb 5-1: USB disconnect, device number 24 [ 574.808733][T22547] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7314'. [ 574.829330][ T5836] XFS (loop1): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 574.904970][ T5909] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 574.954031][ T5909] ath9k_htc: Failed to initialize the device [ 574.964846][ T10] usb 5-1: ath9k_htc: USB layer deinitialized [ 575.376394][ T10] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 575.506579][T22569] loop3: detected capacity change from 0 to 128 [ 575.536967][T22569] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 575.565910][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 575.586966][T22569] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 575.598339][ T10] usb 5-1: not running at top speed; connect to a high speed hub [ 575.627132][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 575.653869][ T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 575.697917][ T10] usb 5-1: string descriptor 0 read error: -22 [ 575.711207][ T10] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 575.762017][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 575.808418][ T10] usb 5-1: 0:2 : does not exist [ 576.026165][ T10] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 576.063715][ T10] usb 5-1: 5:0: cannot get min/max values for control 2 (id 5) [ 576.113061][ T10] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 576.171389][ T10] usb 5-1: 5:0: failed to get current value for ch 1 (-22) [ 576.256340][ T10] usb 5-1: 5:0: cannot get min/max values for control 3 (id 5) [ 576.324776][ T10] usb 5-1: 5:0: cannot get min/max values for control 2 (id 5) [ 576.348437][ T5887] rtc_cmos 00:00: Alarms can be up to one day in the future [ 576.388770][ T5887] rtc_cmos 00:00: Alarms can be up to one day in the future [ 576.405815][ T5887] rtc_cmos 00:00: Alarms can be up to one day in the future [ 576.421571][ T10] usb 5-1: USB disconnect, device number 25 [ 576.438916][ T5887] rtc_cmos 00:00: Alarms can be up to one day in the future [ 576.449857][ T5887] rtc rtc0: __rtc_set_alarm: err=-22 [ 576.836459][T22610] loop4: detected capacity change from 0 to 64 [ 576.864960][T22610] hfs: unable to locate alternate MDB [ 576.887656][T22610] hfs: continuing without an alternate MDB [ 577.280242][T22600] loop2: detected capacity change from 0 to 32768 [ 577.315592][T22600] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.7341 (22600) [ 577.372401][T22600] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 577.423882][T22600] BTRFS info (device loop2): using sha256 checksum algorithm [ 577.624754][T22600] BTRFS info (device loop2): enabling ssd optimizations [ 577.644144][T22600] BTRFS info (device loop2): turning on async discard [ 577.651024][T22600] BTRFS info (device loop2): enabling free space tree [ 577.875787][ T5838] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 578.027111][T22615] loop3: detected capacity change from 0 to 32768 [ 578.072480][T22615] XFS (loop3): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 578.262045][T22615] XFS (loop3): Ending clean mount [ 578.309591][T22675] loop1: detected capacity change from 0 to 256 [ 578.316469][T22615] XFS (loop3): Quotacheck needed: Please wait. [ 578.429511][T22615] XFS (loop3): Quotacheck: Done. [ 578.445481][T22677] Cannot find del_set index 286 as target [ 578.724963][ T5834] XFS (loop3): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 579.013046][T22691] netlink: 'syz.1.7376': attribute type 309 has an invalid length. [ 579.444696][T22703] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 579.486521][T22705] loop1: detected capacity change from 0 to 2048 [ 579.584908][T22707] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 579.591923][T22708] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 580.081307][T22724] netlink: 512 bytes leftover after parsing attributes in process `syz.0.7391'. [ 580.525932][T22748] sg_write: data in/out 214457/136 bytes for SCSI command 0xf1-- guessing data in; [ 580.525932][T22748] program syz.1.7404 not setting count and/or reply_len properly [ 580.864765][T22766] loop2: detected capacity change from 0 to 512 [ 580.876384][T22760] loop3: detected capacity change from 0 to 4096 [ 580.942766][T22766] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 580.973883][ T796] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 581.150786][ T796] usb 5-1: unable to get BOS descriptor or descriptor too short [ 581.167805][ T5838] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 581.196133][ T796] usb 5-1: config 129 has an invalid interface number: 135 but max is 0 [ 581.206202][ T796] usb 5-1: config 129 has an invalid interface number: 5 but max is 0 [ 581.227490][ T796] usb 5-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 581.247144][ T796] usb 5-1: config 129 has no interface number 0 [ 581.253463][ T796] usb 5-1: config 129 has no interface number 1 [ 581.273052][ T796] usb 5-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 581.348296][ T796] usb 5-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 581.400349][ T796] usb 5-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 581.431125][T22787] netlink: zone id is out of range [ 581.444200][ T796] usb 5-1: config 129 interface 135 has no altsetting 0 [ 581.466072][ T796] usb 5-1: config 129 interface 5 has no altsetting 0 [ 581.495554][ T796] usb 5-1: string descriptor 0 read error: -22 [ 581.503751][ T796] usb 5-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 581.533879][ T796] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.629695][ T796] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 581.652874][ T796] usb 5-1: MIDIStreaming interface descriptor not found [ 581.904872][ T796] usb 5-1: USB disconnect, device number 26 [ 582.199021][T22815] loop3: detected capacity change from 0 to 512 [ 582.234318][T22815] EXT4-fs (loop3): Test dummy encryption mode enabled [ 582.274008][T22815] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 582.342591][T22815] EXT4-fs error (device loop3): ext4_orphan_get:1417: comm syz.3.7433: bad orphan inode 131083 [ 582.384076][T22815] loop3: lost filesystem error report for type 5 error -117 [ 582.386623][T22815] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 582.534318][T22806] loop1: detected capacity change from 0 to 32768 [ 582.542869][T22806] btrfs: Deprecated parameter 'usebackuproot' [ 582.567378][T22806] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 582.604108][T22806] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.7430 (22806) [ 582.651112][T22806] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 582.671704][T22806] BTRFS info (device loop1): using crc32c checksum algorithm [ 582.676387][ T5834] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 582.743084][ T1156] BTRFS warning (device loop1): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0x32b4fbab level 0 [ 582.781176][T22806] BTRFS error (device loop1): failed to load root extent [ 582.795017][T22806] BTRFS warning (device loop1): try to load backup roots slot 1 [ 582.906272][T22806] BTRFS info (device loop1): setting nodatasum [ 582.912961][T22806] BTRFS info (device loop1): disabling tree log [ 582.985038][T22806] BTRFS info (device loop1): turning on flush-on-commit [ 582.993301][T22806] BTRFS info (device loop1): turning on async discard [ 583.003956][T22806] BTRFS info (device loop1): enabling free space tree [ 583.018563][T22845] loop3: detected capacity change from 0 to 1024 [ 583.025460][T22806] BTRFS info (device loop1): force clearing of disk cache [ 583.053561][T22806] BTRFS info (device loop1): trying to use backup root at mount time [ 583.153234][T22845] hfsplus: bad catalog file entry [ 583.349873][ T5836] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 583.461111][T22858] loop3: detected capacity change from 0 to 256 [ 583.690018][T22858] FAT-fs (loop3): Directory bread(block 64) failed [ 583.718659][T22858] FAT-fs (loop3): Directory bread(block 65) failed [ 583.725538][T22858] FAT-fs (loop3): Directory bread(block 66) failed [ 583.760704][T22858] FAT-fs (loop3): Directory bread(block 67) failed [ 583.771688][T22872] usb usb8: usbfs: process 22872 (syz.0.7454) did not claim interface 0 before use [ 583.778251][T22858] FAT-fs (loop3): Directory bread(block 68) failed [ 583.789020][T22858] FAT-fs (loop3): Directory bread(block 69) failed [ 583.796136][T22858] FAT-fs (loop3): Directory bread(block 70) failed [ 583.802795][T22858] FAT-fs (loop3): Directory bread(block 71) failed [ 583.849912][T22858] FAT-fs (loop3): Directory bread(block 72) failed [ 583.857105][T22858] FAT-fs (loop3): Directory bread(block 73) failed [ 584.027054][T22879] libceph: resolve '0.' (ret=-3): failed [ 584.216454][T22888] netlink: 220 bytes leftover after parsing attributes in process `syz.0.7461'. [ 584.311274][T22891] ALSA: mixer_oss: invalid OSS volume '' [ 584.349878][T22891] ALSA: mixer_oss: invalid OSS volume '›î+]OØ“OG”§eÐÔc¦Íï¯9bx'Ä®Cú' [ 584.367905][T22891] ALSA: mixer_oss: invalid OSS volume '_ü¨²å*[bYcqî~l¬r‹=V' [ 584.841182][T22915] loop4: detected capacity change from 0 to 1024 [ 584.858382][T22891] ALSA: mixer_oss: invalid OSS volume '+ˆ®ê×Í¿èºê‰…nU<$³È^EKʘürÈ+' [ 584.880058][T22891] ALSA: mixer_oss: invalid OSS volume '+8çµiYJzËåý' [ 584.915530][T22915] hfsplus: catalog name length corrupted [ 585.053728][ T49] hfsplus: b-tree write err: -5, ino 25 [ 585.073167][ T49] hfsplus: b-tree write err: -5, ino 4 [ 585.091955][T22924] program syz.0.7479 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 585.104655][ T49] hfsplus: b-tree write err: -5, ino 2 [ 585.266139][T22931] netlink: 228 bytes leftover after parsing attributes in process `syz.4.7481'. [ 585.408750][T22935] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 585.444908][T22935] block device autoloading is deprecated and will be removed. [ 585.546076][T22945] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7489'. [ 585.810797][T22959] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7494'. [ 586.114972][T22976] netlink: 220 bytes leftover after parsing attributes in process `syz.3.7505'. [ 586.135927][T22976] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7505'. [ 586.147404][T22976] tc_dump_action: action bad kind [ 586.296332][T22984] netlink: 'syz.3.7508': attribute type 3 has an invalid length. [ 586.324378][T22987] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 586.562600][T22995] loop3: detected capacity change from 0 to 4096 [ 586.681279][T23005] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7519'. [ 586.701335][T23005] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7519'. [ 586.732256][T22966] Bluetooth: hci1: Opcode 0x080f failed: -4 [ 587.007827][T23019] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7525'. [ 587.159762][T23026] overlayfs: conflicting options: userxattr,metacopy=on [ 587.294011][T23031] loop3: detected capacity change from 0 to 764 [ 587.309215][T23034] loop1: detected capacity change from 0 to 256 [ 587.474923][T23034] FAT-fs (loop1): Directory bread(block 64) failed [ 587.481646][T23034] FAT-fs (loop1): Directory bread(block 65) failed [ 587.549011][T23034] FAT-fs (loop1): Directory bread(block 66) failed [ 587.568840][ T29] audit: type=1326 audit(587.524:266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23043 comm="syz.2.7539" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f665099c629 code=0x7ffc0000 [ 587.583828][T23034] FAT-fs (loop1): Directory bread(block 67) failed [ 587.642522][ T29] audit: type=1326 audit(587.524:267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23043 comm="syz.2.7539" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f665099c629 code=0x7ffc0000 [ 587.658666][T23034] FAT-fs (loop1): Directory bread(block 68) failed [ 587.694940][T23034] FAT-fs (loop1): Directory bread(block 69) failed [ 587.701659][T23034] FAT-fs (loop1): Directory bread(block 70) failed [ 587.711203][ T29] audit: type=1326 audit(587.534:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23043 comm="syz.2.7539" exe="/root/syz-executor" sig=0 arch=c000003e syscall=287 compat=0 ip=0x7f665099c629 code=0x7ffc0000 [ 587.739559][T23034] FAT-fs (loop1): Directory bread(block 71) failed [ 587.765525][T23034] FAT-fs (loop1): Directory bread(block 72) failed [ 587.773072][ T29] audit: type=1326 audit(587.534:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23043 comm="syz.2.7539" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f665099c629 code=0x7ffc0000 [ 587.805471][T23034] FAT-fs (loop1): Directory bread(block 73) failed [ 587.855456][ T29] audit: type=1326 audit(587.534:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23043 comm="syz.2.7539" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f665099c629 code=0x7ffc0000 [ 587.886874][T23052] xt_policy: output policy not valid in PREROUTING and INPUT [ 587.944038][ T5831] Bluetooth: hci1: command 0x0406 tx timeout [ 588.196199][T18938] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 588.366453][T18938] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xCB, changing to 0x8B [ 588.398624][T18938] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 53407, setting to 1024 [ 588.431608][T18938] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 588.448161][T18938] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 588.508020][T18938] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 588.523930][T18938] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 588.542910][T18938] usb 3-1: SerialNumber: syz [ 588.583410][T23056] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 588.803119][ T47] IPVS: starting estimator thread 0... [ 588.832607][T18938] usbtest 3-1:1.0: couldn't get endpoints, -22 [ 588.864841][T18938] usbtest 3-1:1.0: probe with driver usbtest failed with error -22 [ 588.888940][T18938] usb 3-1: USB disconnect, device number 34 [ 588.933958][T23096] IPVS: using max 30 ests per chain, 72000 per kthread [ 589.175248][T23113] loop4: detected capacity change from 0 to 64 [ 589.224682][T23113] minix_free_block (loop4:21): bit already cleared [ 589.450879][T23122] loop4: detected capacity change from 0 to 1024 [ 589.614442][ T35] hfsplus: b-tree write err: -5, ino 25 [ 589.621963][ T35] hfsplus: b-tree write err: -5, ino 4 [ 589.660346][ T35] hfsplus: b-tree write err: -5, ino 2 [ 589.894352][ T47] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 590.124185][ T47] usb 3-1: unable to get BOS descriptor or descriptor too short [ 590.146090][ T47] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 590.168421][ T47] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 590.195393][ T47] usb 3-1: config 1 has no interface number 1 [ 590.201577][ T47] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 590.246544][ T47] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 590.261538][ T47] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.295931][ T47] usb 3-1: Product: syz [ 590.300163][ T47] usb 3-1: Manufacturer: syz [ 590.323866][ T47] usb 3-1: SerialNumber: syz [ 590.524555][T18938] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 590.574256][ T47] usb 3-1: 2:1 : invalid UAC_AS_GENERAL desc [ 590.663046][ T47] usb 3-1: USB disconnect, device number 35 [ 590.722919][T18938] usb 2-1: Using ep0 maxpacket: 16 [ 590.740583][T18938] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 590.768918][T18938] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 590.785912][ T5998] udevd[5998]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 590.787536][T18938] usb 2-1: Product: syz [ 590.844386][T18938] usb 2-1: Manufacturer: syz [ 590.857815][T18938] usb 2-1: SerialNumber: syz [ 590.885374][T18938] r8152-cfgselector 2-1: Unknown version 0x0000 [ 590.891690][T18938] r8152-cfgselector 2-1: config 0 descriptor?? [ 590.987302][T23179] netlink: 'syz.4.7604': attribute type 9 has an invalid length. [ 591.077875][T23182] loop3: detected capacity change from 0 to 4096 [ 591.186823][T23185] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 591.417602][T23191] loop4: detected capacity change from 0 to 64 [ 591.430128][ T5909] r8152-cfgselector 2-1: USB disconnect, device number 31 [ 591.502741][T23191] [ 591.505136][T23191] ====================================================== [ 591.512176][T23191] WARNING: possible circular locking dependency detected [ 591.519274][T23191] syzkaller #0 Not tainted [ 591.523724][T23191] ------------------------------------------------------ [ 591.530761][T23191] syz.4.7609/23191 is trying to acquire lock: [ 591.536856][T23191] ffff88804d70a0b0 (&tree->tree_lock#2/1){+.+.}-{4:4}, at: hfs_find_init+0x18e/0x300 [ 591.546502][T23191] [ 591.546502][T23191] but task is already holding lock: [ 591.554068][T23191] ffff8880369b8df8 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf2/0x15e0 [ 591.565136][T23191] [ 591.565136][T23191] which lock already depends on the new lock. [ 591.565136][T23191] [ 591.575630][T23191] [ 591.575630][T23191] the existing dependency chain (in reverse order) is: [ 591.584639][T23191] [ 591.584639][T23191] -> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}: [ 591.593855][T23191] __mutex_lock+0x19f/0x1300 [ 591.598978][T23191] hfs_extend_file+0xf2/0x15e0 [ 591.604352][T23191] hfs_bmap_reserve+0x107/0x430 [ 591.610783][T23191] __hfs_ext_write_extent+0x1fa/0x470 [ 591.616705][T23191] hfs_ext_write_extent+0x17e/0x210 [ 591.622714][T23191] hfs_write_inode+0x117/0x960 [ 591.628010][T23191] __writeback_single_inode+0x75a/0x11a0 [ 591.634330][T23191] writeback_sb_inodes+0x992/0x1a20 [ 591.640067][T23191] wb_writeback+0x456/0xb70 [ 591.645214][T23191] wb_workfn+0x414/0xf50 [ 591.650003][T23191] process_one_work+0x949/0x1650 [ 591.655478][T23191] worker_thread+0xb46/0x1140 [ 591.660865][T23191] kthread+0x388/0x470 [ 591.665549][T23191] ret_from_fork+0x51e/0xb90 [ 591.670925][T23191] ret_from_fork_asm+0x1a/0x30 [ 591.676311][T23191] [ 591.676311][T23191] -> #0 (&tree->tree_lock#2/1){+.+.}-{4:4}: [ 591.684500][T23191] __lock_acquire+0x15a5/0x2cf0 [ 591.689873][T23191] lock_acquire+0xf0/0x2e0 [ 591.694819][T23191] __mutex_lock+0x19f/0x1300 [ 591.700020][T23191] hfs_find_init+0x18e/0x300 [ 591.705398][T23191] hfs_extend_file+0x35c/0x15e0 [ 591.710886][T23191] hfs_bmap_reserve+0x107/0x430 [ 591.716378][T23191] hfs_cat_create+0x20f/0x800 [ 591.721674][T23191] hfs_mkdir+0x79/0xe0 [ 591.726361][T23191] vfs_mkdir+0x413/0x630 [ 591.731134][T23191] filename_mkdirat+0x285/0x510 [ 591.736599][T23191] __se_sys_mkdir+0x34/0x150 [ 591.741807][T23191] do_syscall_64+0x14d/0xf80 [ 591.747003][T23191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.753421][T23191] [ 591.753421][T23191] other info that might help us debug this: [ 591.753421][T23191] [ 591.763840][T23191] Possible unsafe locking scenario: [ 591.763840][T23191] [ 591.771404][T23191] CPU0 CPU1 [ 591.776979][T23191] ---- ---- [ 591.782439][T23191] lock(&HFS_I(tree->inode)->extents_lock); [ 591.788532][T23191] lock(&tree->tree_lock#2/1); [ 591.796288][T23191] lock(&HFS_I(tree->inode)->extents_lock); [ 591.804977][T23191] lock(&tree->tree_lock#2/1); [ 591.810015][T23191] [ 591.810015][T23191] *** DEADLOCK *** [ 591.810015][T23191] [ 591.818247][T23191] 4 locks held by syz.4.7609/23191: [ 591.823444][T23191] #0: ffff88807b6cc420 (sb_writers#31){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 591.832696][T23191] #1: ffff8880369ba9a0 (&type->i_mutex_dir_key#22/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 591.843415][T23191] #2: ffff8880683f60b0 (&tree->tree_lock#2){+.+.}-{4:4}, at: hfs_find_init+0x18e/0x300 [ 591.853437][T23191] #3: ffff8880369b8df8 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf2/0x15e0 [ 591.864666][T23191] [ 591.864666][T23191] stack backtrace: [ 591.870642][T23191] CPU: 0 UID: 0 PID: 23191 Comm: syz.4.7609 Not tainted syzkaller #0 PREEMPT(full) [ 591.870662][T23191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 591.870673][T23191] Call Trace: [ 591.870680][T23191] [ 591.870688][T23191] dump_stack_lvl+0xe8/0x150 [ 591.870710][T23191] print_circular_bug+0x2e1/0x300 [ 591.870734][T23191] check_noncircular+0x12e/0x150 [ 591.870757][T23191] __lock_acquire+0x15a5/0x2cf0 [ 591.870777][T23191] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 591.870804][T23191] ? kasan_save_track+0x4f/0x80 [ 591.870819][T23191] ? kasan_save_track+0x3e/0x80 [ 591.870831][T23191] ? __kasan_kmalloc+0x93/0xb0 [ 591.870845][T23191] ? __kmalloc_noprof+0x35c/0x760 [ 591.870858][T23191] ? hfs_find_init+0xaa/0x300 [ 591.870870][T23191] ? hfs_extend_file+0x35c/0x15e0 [ 591.870892][T23191] ? hfs_bmap_reserve+0x107/0x430 [ 591.870908][T23191] lock_acquire+0xf0/0x2e0 [ 591.870925][T23191] ? hfs_find_init+0x18e/0x300 [ 591.870941][T23191] __mutex_lock+0x19f/0x1300 [ 591.870958][T23191] ? hfs_find_init+0x18e/0x300 [ 591.870975][T23191] ? hfs_find_init+0x18e/0x300 [ 591.870989][T23191] ? __pfx___mutex_lock+0x10/0x10 [ 591.871004][T23191] ? rcu_is_watching+0x15/0xb0 [ 591.871025][T23191] ? __kmalloc_noprof+0x37d/0x760 [ 591.871038][T23191] ? kasan_save_track+0x4f/0x80 [ 591.871050][T23191] ? hfs_find_init+0xaa/0x300 [ 591.871061][T23191] ? __kmalloc_noprof+0x1b8/0x760 [ 591.871076][T23191] hfs_find_init+0x18e/0x300 [ 591.871089][T23191] hfs_extend_file+0x35c/0x15e0 [ 591.871109][T23191] ? __pfx_hfs_extend_file+0x10/0x10 [ 591.871125][T23191] ? __mutex_lock+0x319/0x1300 [ 591.871147][T23191] ? __pfx___mutex_lock+0x10/0x10 [ 591.871162][T23191] ? rcu_is_watching+0x15/0xb0 [ 591.871182][T23191] hfs_bmap_reserve+0x107/0x430 [ 591.871202][T23191] hfs_cat_create+0x20f/0x800 [ 591.871219][T23191] ? __pfx_hfs_cat_create+0x10/0x10 [ 591.871240][T23191] ? hfs_new_inode+0x92d/0xc70 [ 591.871260][T23191] hfs_mkdir+0x79/0xe0 [ 591.871276][T23191] vfs_mkdir+0x413/0x630 [ 591.871294][T23191] filename_mkdirat+0x285/0x510 [ 591.871311][T23191] ? __pfx_filename_mkdirat+0x10/0x10 [ 591.871327][T23191] ? do_getname+0x151/0x250 [ 591.871344][T23191] __se_sys_mkdir+0x34/0x150 [ 591.871360][T23191] do_syscall_64+0x14d/0xf80 [ 591.871375][T23191] ? trace_irq_disable+0x3b/0x150 [ 591.871395][T23191] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.871409][T23191] ? clear_bhb_loop+0x40/0x90 [ 591.871425][T23191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.871438][T23191] RIP: 0033:0x7f3e8419c629 [ 591.871453][T23191] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 591.871465][T23191] RSP: 002b:00007f3e8506d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 591.871481][T23191] RAX: ffffffffffffffda RBX: 00007f3e84415fa0 RCX: 00007f3e8419c629 [ 591.871492][T23191] RDX: 0000000000000000 RSI: 0000000000000014 RDI: 0000200000000b00 [ 591.871502][T23191] RBP: 00007f3e84232b39 R08: 0000000000000000 R09: 0000000000000000 [ 591.871511][T23191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 591.871520][T23191] R13: 00007f3e84416038 R14: 00007f3e84415fa0 R15: 00007fffdd2cd868 [ 591.871536][T23191]