last executing test programs: 9.346802887s ago: executing program 3 (id=71): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = memfd_create(&(0x7f0000005ac0)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xef-\xa6m\xa1\xc4\xb5{\xf2\\\x8d[7k~\x04\x03~K\xfbP\x84=\xfa\x81\x8c\x1et\x10', 0x0) pwrite64(r0, &(0x7f0000005b00)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) lseek(r0, 0x0, 0x4) sendfile(r0, r0, &(0x7f0000005b40), 0x7fa) symlink(&(0x7f0000005b80)='./file0\x00', &(0x7f0000005bc0)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000005c00)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) write(r1, &(0x7f0000005c40)='0', 0x1) openat(0xffffffffffffff9c, &(0x7f0000005c80)='./file0/file1\x00', 0x880cc2, 0x20) mount(&(0x7f0000005a00)=@loop={'/dev/loop', 0x0}, &(0x7f0000005a40)='.\x00', &(0x7f0000005a80)='exfat\x00', 0x401, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = memfd_create(&(0x7f00000000c0)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xef-\xa6m\xa1\xc4\xb5{\xf2\\\x8d[7k~\x04\x03~K\xfbP\x84=\xfa\x81\x8c\x1et\x10', 0x0) pwrite64(r3, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r3, 0x0) symlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) syz_usb_connect(0x3, 0x32, &(0x7f0000000340)=ANY=[@ANYBLOB="1201000200000040e6040500000101020301090220000101"], 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x3, 0x1, 0x9000, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, 0x0}], 0x1, 0x15, 0x0, 0x0) 8.354734343s ago: executing program 4 (id=80): prlimit64(0x0, 0xe, &(0x7f0000000080)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000140)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000240), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000280), 0x4000087, 0x2, 0x0) userfaultfd(0x1) lsetxattr$system_posix_acl(0x0, 0x0, 0x0, 0x0, 0x2) epoll_create1(0x80000) syz_open_procfs(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000800)={@rand_addr=' \x01\x00', 0x46, r1}) memfd_create(&(0x7f0000000840)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) r2 = fsopen(&(0x7f0000000940)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) fchdir(r3) symlinkat(&(0x7f0000000980)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000009c0)='./file0\x00') 8.163132567s ago: executing program 4 (id=82): symlink(&(0x7f0000000540)='./file0/file0\x00', &(0x7f0000000400)='./file0\x00') syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x4) openat$sysfs(0xffffffffffffff9c, 0x0, 0x129a02, 0x5) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) 6.305427663s ago: executing program 3 (id=85): umount2(&(0x7f0000000000)='./cgroup\x00', 0xe) r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d00000524060001052400ffff0d240f0100000000060000000006241a0000180905810300020000000904010009020d000009040101"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000400)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x80, 0x1c, {0x48, 0xffff, 0x5, 0x4, 0x7, 0x8, 0x16, 0x10, 0x8, 0x7, 0x5, 0xfff9}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000340)={0xa, &(0x7f00000002c0)=[{0x1, 0x2, 0xff}, {0x10, 0x5, 0x0, 0x1ff}, {0x1, 0x0, 0x9, 0x7}, {0xfffd, 0x66, 0x4, 0x9}, {0x1fc7, 0x0, 0x2, 0x7}, {0x0, 0x13, 0x6, 0xcb8b}, {0x5, 0xe0, 0x1}, {0x5, 0x3, 0x9}, {0x9c18, 0x0, 0x0, 0x7fffffff}, {0x0, 0x2, 0x0, 0x639c}]}) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000600)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000640)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x4}}, 0x10) bind$tipc(r3, &(0x7f0000000680)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f00000006c0)={0x42, 0x1}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r4, &(0x7f0000000700)={&(0x7f0000000740)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) 6.275944124s ago: executing program 4 (id=86): r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_connect$uac2(0x0, 0x96, &(0x7f0000005b80)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x499, 0x1021, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x84, 0x3, 0x1, 0x0, 0x10, 0xc, {0x8, 0xb, 0x0, 0x2, 0x1, 0x5, 0x20, 0xfa}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x0, 0xf0, 0x11, 0x58}, [@source_unit={0x8, 0x24, 0xa, 0x10, 0x4, 0xf3, 0x7, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0x1, 0x48, 0x4, 0x9}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x7, 0x2, 0x2b, 0xea, "", "c3ec"}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x4, 0x7, 0x5d, {0x8, 0x25, 0x1, 0x101, 0xc, 0xff, 0x200}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x2, 0x8, 0x8, {0x8, 0x25, 0x1, 0x81, 0x30, 0x8, 0xfff8}}}}}}}}]}}, &(0x7f0000007600)={0xa, &(0x7f0000005d00)={0xa, 0x6, 0x0, 0x2e, 0x40, 0x6, 0x60, 0x80}, 0x19, &(0x7f0000005d40)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x2, "1480aa4867df9912e49147141c5ccd77"}]}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000005b00)={0x24, 0x0, 0x0, &(0x7f0000005b40)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 5.920408233s ago: executing program 0 (id=87): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40014) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mkdir(&(0x7f0000000240)='./file0\x00', 0x97) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000040)='./bus\x00', 0x4) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r2 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r2, 0x0, 0x0) sendfile(r2, r2, &(0x7f0000000080), 0x7f03) 5.487277174s ago: executing program 1 (id=88): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdir(&(0x7f0000000240)='./file0\x00', 0x97) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000040)='./bus\x00', 0x4) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x0, 0x9, 0x20ff, 0x1, 0x89, 0xd615, 0x9, 0x7fffffff, 0x9, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0) sendfile(r1, r1, &(0x7f0000000080), 0x7f03) 5.486362064s ago: executing program 1 (id=89): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x41, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r2, &(0x7f00000003c0)={0x2, 0x1234, @local}, 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x8, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000340)='\x00'/14, 0x0, 0x3b66, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.390695426s ago: executing program 2 (id=90): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) unshare(0x600) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) fsync(r0) 5.311797428s ago: executing program 2 (id=91): prlimit64(0x0, 0xe, &(0x7f0000000080)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000140)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x4000087, 0x2, 0x0) userfaultfd(0x1) lsetxattr$system_posix_acl(0x0, 0x0, 0x0, 0x0, 0x2) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x480, 0x298, 0x5802, 0x294, 0x0, 0x294, 0x3b0, 0x325, 0x378, 0x3b0, 0x378, 0x3, 0x0, {[{{@ipv6={@loopback, @empty, [], [], 'macvtap0\x00', 'macsec0\x00'}, 0x0, 0x230, 0x298, 0x52020000, {}, [@common=@inet=@hashlimit2={{0x150}, {'gre0\x00', {0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x7fffffff}}}, @common=@unspec=@quota={{0x38}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x3, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x2, 0x0, "9b5c49840af1fa47a964238f259b3c5a1d2900368cf3205b20e30e9ab14af5e8d982e899c853fa77c236d1e982bfd274b6f14caf6af1961c67b2212bdf53463b"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4e0) epoll_create1(0x80000) memfd_create(&(0x7f0000000840)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) r4 = fsopen(&(0x7f0000000940)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) symlinkat(&(0x7f0000000980)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000009c0)='./file0\x00') mount$overlay(0x0, &(0x7f0000000a00)='./file0\x00', 0x0, 0x4008, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'dvmrp1\x00'}) 4.789811972s ago: executing program 0 (id=92): prlimit64(0x0, 0xe, &(0x7f0000000080)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000140)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x4000087, 0x2, 0x0) userfaultfd(0x1) lsetxattr$system_posix_acl(0x0, 0x0, 0x0, 0x0, 0x2) epoll_create1(0x80000) syz_open_procfs(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000800)={@rand_addr=' \x01\x00', 0x46, r3}) memfd_create(&(0x7f0000000840)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) r4 = fsopen(&(0x7f0000000940)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) symlinkat(&(0x7f0000000980)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000009c0)='./file0\x00') 4.004981061s ago: executing program 1 (id=93): mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./file0\x00', 0x3a) pipe2$9p(&(0x7f0000000c40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000cc0)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e75"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000d00)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000d40)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000d80)='./file0\x00', &(0x7f0000000dc0), 0x14000, &(0x7f0000000e00)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x200841a, &(0x7f0000000400)=ANY=[@ANYBLOB="66617374626f6f742c71756f7461000000000000003b814e50a959736d65720f73ecea54b5e5be45ace9a88f723cb005aeff24212c651baef614d442ae89412ad3dcd0b7586d02002a6d6d65cacd4fc5002207ce994dda65c4b1d23a9bd5ba0f4ce5c2b5a5718c6aa918080002223d2753a5cac974110144cd0a1e368652324a41b31e1eb3b32dccbdf8f68bd96a45a75427a5f789d267fd92f6a5540200b81d5b9fa9b40fe4d7fbd50a6afc3a989c6d60045663c59cbdc4c700000000bc7f6b22df0193acf5912afdcc1c061835177068c40f757dd123d2600b1c544f1525aa8d00000000000000000000002e8b5c733d362417bb7f527c0bfebec112d57fc69fabb9b31ef97b2147930ff60cdf666c25244218b1f1a6010000000100000020563b835d0e8e9a09070ef1691fcb2f37bda5d4e3d9d7a2d0ac82b45a53001057f321acc45d5e065a461de90100000077d200000000000040b78f0dd3836f5ab2f6a1a5b798bb7752f192c6b48e568973a59cd9c74bd9a14721856c5499cd8f93f8beaa9cf76718ce7244c8426803000000005c000208886b313bd01a22d576e414011a4f0a897515329f86d4585fa0ea17068f8af349696da4a2b3e24310ca52ec51bc23b57897cb55a2d513e6a00765ee3f58b471c54dd57f0af584afe4a21f92b515d7f2fa6fbb273ca0f751e684584320534667aea39ad7222c8ef531f514939177a47395e94c1723abb3fd44fd64fde4b45cc2f55f4ae05ff48648a4c998257856bcdcf2fa02010000001f54fb936570450e91c8d55abad76a7b7a000016f81ec9da9ccc1191c211632266d907e4d9b23496ae19bac24dc23c43f514f1b4af19988bbe61ee29a368a999435d6872d01b79c7821e875859dfbf3c57e4f1fb0be46cb5f7a0fa13516c0926d19dd2d5862085e1e4cb8279be17cba17ee4d06ad97b4ca282e73ea142b01b4a742fa11c0927ba811dd60903d575db449d775021b542db617086b3ed42e6e60fe043cff79b0c067c584bbf82657974c3736912b4b522052b9467d0da116ccc1652d861a420f09aaf67d3e9f6160100000001000000ae6335ad9896abd3cc00413638cb9bc62ab8054325d72e9144cf4f88702f586507e3147198e0bc4060a7c8f4dce73b653177ecf8228e6e6fae02510000000000000000000000000000f43739fdd2d24e50e0233acfe1c8639070fe00f40b0d01f8a0a35fcfe3ea10faf9c24b8488ed4ed83fb06a9a7c57442ede9e1fc2853b8f4d2241cff61d0125b7750e3fdae6a4ab9c776a191ed8098a780ea2bbaa64978cd3a6458fcc6b949bcbca0dceb7361f66e46731eba4f3aed335e7c8c541e82453218a19d39489e1010066ac93759787e767f601931d94c9c426489b741a6bc8abf475e4bf859e1ce7f7227069e9f51e25fa3d1b18dc565180a1af464a1dd697db85e2b27b90f6bd7cf1b6bc0bcd8ba552ced3d3cfbf9c9bc04f65b6f83cb40173b4bdc393d47e5da95b63a40ac18daf11e8d0706b47795fbe2b56d0ea7ffc5a59ede88621a08b25ca6ebe041317b62373a60951af33eb7954a9731aaa125add0913ed2435a207439e9122512d77096747a4b404459cebc8faff8f7a31758e630c75a1ff90402754d339dc21cf6b8e04e1aedf14df0b4aaf0e03194df3eb41ba066bc343b323a3162d7e7ba687633c2faa8f28b42364b72e3a457476fd6b2a54e670ba798172c44c4390f73fdab743a4cac88b2bd0545b8483f29946222a35ae3cd83332978da70e9050417087c5ae034a735e8b448dd97014043159cbaacebfc912cf05f608e6214c04099fa311b747c37af702d134fb8eec487cfaea91150d1980464ff31cf86e3f3b950b204f6f67810c0826e4e5467c1588de9816bc627fb4662ac5fc8e38f19ec065550e5f9b16f72a91144a2e52ba9f2c6a7e2afbabc533ac731bb7ec51b8c585c2749469da331006ca4d49e136189d21ae50455834b2e75efd81c9d6352e5a814cf002f294475dab27a10d87516e405eff30", @ANYRESDEC=0x0], 0x1, 0x5547, &(0x7f0000000f00)="$eJzs3E1vG1UXAOA7TtO+/XwjxIJdR6qQEqm26rSpYBegFR8iVcTHghU4tmO5tT1R7DghKyRYIhb8EwQSK5b8Bhas2SEWIHZIIM8dU0IptLITJ+3zSOMzc2d85tyRlejMWA7AU2sh/fXnJFwKZ0MIcyGEC0nI15Niya3G8FwI4XIIofSXJSnG/xw4HUI4F0K4NEoecybFrs+vDq+s/PTGL998d+bU+S++/n52swZm7fkQQncrru92Y8xaMd4txmvDdh67N4ZFjDu694rtLMbd5kaeYbc2Pq6Wx+uteHy2tdMfxc1OrT6KrfZmPr7ViyfsD1vjPPkb7ta28+1GcyOP7X6Wx9Z+rGtvP/5t2+8PYp5Gke/DPH0YDMYxjjf3mnE+W/fyWO8NivGYN2s090ZxWMTidKGedRp5HRuTXOnj7c12b2cvHTa3++2sl65Uqi9UqjfL1e2s0Rw0b5Rr3cbNG+liqzM6rDxo1rqrrSxrdZqVetZdShdb9Xq5Wk0XbzU32rVeWq1WrleulVeWirWr6at33k07jXRxFF9u93ZOtzv9dDPbTuM7ltLlyvUXl9Ir1fTttfV0/a3bt9fW33n/1nt3Xlp7/ZXioAfKSheXry0vl6vXysvVpWMw/9H/3Uec/2CS+X9SFP0Y808muzzw73zAAB7bA/1/0P8Dh++k9/9hmv3/qKXS//93/1uavP+fqP89rv3/CZ4/TET/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw1Pph/svX8pWFuH2+GL9YDD1TbCchhFII4fd/MBdOH8g5V+SZf8jx83+r4dsk5BlG5zhTLOdCCKvF8tv/D/sqAAAAwJPrq48ufxa79fiyMOuCOErxpk3pwgdTypeEEOYXfpxSttLo5dkpJcs/36fC3pSy5Tew/jelZPGW26lpZXskc+Pw8cX7g/mEkhhKR1oOAABwJOYOhId0IZtHVw8AAACH5dNZF8BsJGH8KHP8LDj/5v39R5tnD+wDAAAATqBk1gUAAAAAhy7v//3+HwAAADzZ4u//AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH+wcz+3iQNRHICfDQb2nxat9r6t7A3KSAk55hgoIE1QAmkhDVADuaWECCLsEZIjkCIxjhX0fZLHGTv6zQxweWPJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQpedqPX+8//dwac5uf5k8qwEAAABO2Vbref3HtOn/SNd/pUt/Ur+IiDIiTtXugxi1Mgcppzrz/9W7OTxF1AmHMcbp+B4R/9Px+rvrTwEAAACu12a5mjXVetNM+54Qn6nZtCl/3mTKKyKimr5kSisPzd9MYfXvexh3mdLqDaxJprBmy214+t4o1yBtg9YprWSyqL/Euld2My4AANCndiVwpgoBAADgCtz2PQH6URyb43PGcXNKDwS/tXoAAADAF1T0PQEAAACgc3X97/1/AAAAcN2a9/8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQpW21nm+Wq9m5+4sP5uz2l8m3IgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4Y3/eUSAEwiAM9q7vTOb+h5UGDY1NqkD4+BuDAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICL/XlJgRAIgiiYM/530vc/rCToGUSIgIZHFbVoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICLnfvnjaOIAgD+bu/28gcQxiAXBhQkCmiIfQkJKaEAWRR8BCTLOQfDhUDigkQWyA1UyHUaBCVCSCDT5TukjqU0oUvhwkjUoN3bvawTg0+RvXuJfz9pbt6uRztv9k6Wn2dtAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABK2+/FK0kRt7OXqWFcnruzs7aU9VsP9ZlbG3dns5bFrf0m+u7dg09+sr1aPTg1Uzn4pv5kAAAAOBraZX0frbiXbi5kUTKV1/9pOSar+X98LopRQw/X/Vs7a8eLL82W9f8fv99/aTTR1HCe7KLLK4P+/KOpdA5tkRPu+X1HdPI7n//upZ2/IcmH6y9up/n9bH1/+/b73Tw8Vke2AMDjOF32RVD+PJT1vSYTA+DI6FQK77L+b081mxMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAHbbX45kybkXEbOdBnNnaWVvaq7+1cXe2bOdv3tyoXjO7RBoRyyuDflrjWibdtes3PlscDPpXR0F2m3efOaTgVEQc8hT7Bx+PMSbi/8cUH89obhX/HbQmI41Gg6R4fyYln4MMys/ewV+5oW9IAAA8tdKiZXX9vXRzITvXmo7456fd9f8blTjGrP/vf3L+TnWuav3fq22Fk29u9fIXc9eu33hr5fLipf6l/udvn+m90zt74dy5C3PZvZqfW46kP990mgAAADzBukWr1v/J9KP7/ycrcYxZ/3/5Q+/r6lxt9f+eHmz6NZ0JAADAUdQdRS+89vdfrT1GtLrd+GpxdfVqb/g6Oj4zfK013cd0rGjV+r893XRWAAAAQB2211u79v8vVuIYc///2Z9f/rV6zXZEnIi4EhH900tXBhfrW85Eq+MPlfOJuk2vFAAAgKacKFp1/z/Nn/9PRo88JBHx5uvDuPxfV+PU/+0Pvv2lOlf1+f+z9S1xIiUzw/uR9zMRnZmmMwIAAOBpdrxoWbH/Z7q58OlvJz/qev4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoG7/BgAA//+grDSa") mount$overlay(0x0, 0x0, &(0x7f0000006600), 0x0, &(0x7f0000006640)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) umount2(&(0x7f0000000ec0)='.\x00', 0x2) 4.000648101s ago: executing program 2 (id=94): socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x80000008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000013c0)=0x5) prlimit64(0x0, 0x4, &(0x7f0000001400)={0x659e, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001440)=0x7) socket$inet6(0xa, 0x80001, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000014c0), 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001540), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001580), 0x80002c1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f00000015c0)='ext4\x00', &(0x7f0000001600)='./bus\x00', 0xe, &(0x7f0000001640)={[{}, {@oldalloc}, {@resuid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@block_validity}, {@jqfmt_vfsv1}]}, 0x3, 0x447, &(0x7f00000016c0)="$eJzs28tvG0UYAPBv10lKX8SU8ugDCBRExCNp0gI9cAGBxAEkJDiUY0jSqtRtUBMkWlW0IFSOqBJ3xIEDEn8BJ7gg4ITEFe6oUoV6aeFktPZuYjt2mocTF/z7SdvO7M5q5vPu2DM72QD61kj2TxKxKyJ+j4jhera5wEj9v1s3Lk7/fePidBLV6lt/JbVyN29cnC6KFuftzDOjaUT6aRIH2tQ7f/7C6alKZfZcnh9fOPP++Pz5C8+eOjN1cvbk7NnJY8eOHpl44fnJ57oSZ9amm/s/mju477V3rr4xffzquz9/mxTxt8TRJSMrHXyiWu1ydb21uyGdDPSwIaxJKSKyyzVY6//DUYqlizccr37S08YBm6parVZ3dj58uQr8jyXR6xYAvVH80Gfz32LboqHHHeH6S/UJUBb3rXyrHxmINC8z2DK/7aaRiDh++Z8vsy025zkEAECT77PxzzPtxn9p3N9Q7u58bagcEfdExJ6IuDci9kbEfRG1sg9ExINrrL91kWT5+Ce9tq7AVikb/72Yr201j/+K0V+US3ludy3+weTEqcrs4fwzGY3BbVl+YoU6fnjlt887HWsc/2VbVn8xFszbcW1gW/M5M1MLUxuJudH1jyP2D7SLP1lcCUgiYl9E7F9nHaee+uZgp2O3j38FXVhnqn4V8WT9+l+OlvgLycrrk+N3RWX28HhxVyz3y69X3uxU/4bi74Ls+u9oe/8vxl9OGtdr59dex5U/Pus4p1nd/V+91HhOdv8PJW/X0kP5vg+nFhbOTUQMJa/XG924f3Lp3CJflM/iHz3Uvv/viaVP4kBEZDfxQxHxcEQ8krf90Yh4LCIOrRD/Ty8//t76499cWfwza7r+S4mhaN3TPlE6/eN3TZWW1xJ/dv2P1lKj+Z7VfP+tpl3ru5sBAADgvyeNiF2RpGOL6TQdG6v/vfze2JFW5uYXnj4x98HZmfo7AuUYTIsnXcMNz0Mn8ml9kZ+M+LoxfyR/bvxFaXstPzY9V5npdfDQ53Z26P+ZP0u9bh2w6byvBf1L/4f+pf9D/9L/oX+16f/be9EOYOu1+/2/1IN2AFuvpf9b9oM+Yv4P/Uv/h/6l/0Nfmt8et39JXkJiWSLSO6IZEt1JpBHRtGf5d0W5F19QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG/RvAAAA//831udB") gettid() r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000001c40), 0x208e24b) 3.404367856s ago: executing program 2 (id=95): symlink(&(0x7f0000000540)='./file0/file0\x00', &(0x7f0000000400)='./file0\x00') syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tgkill(r3, r3, 0x34) ptrace(0x10, r3) socket$nl_generic(0x10, 0x3, 0x10) ptrace(0x6a3e9902fbb19fab, r3) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x4) openat$sysfs(0xffffffffffffff9c, 0x0, 0x129a02, 0x5) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) socket$nl_xfrm(0x10, 0x3, 0x6) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) 3.378088016s ago: executing program 0 (id=96): openat$ppp(0xffffffffffffff9c, 0x0, 0x161042, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x8919, &(0x7f0000000140)={0x0, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x24}}, {0x2, 0x4e22, @remote}, {0x2, 0x4e23, @private=0xa010101}, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x26}) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000640), 0x591c01, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000680), &(0x7f00000006c0)='./bus\x00', 0x1218088, &(0x7f0000000700)=ANY=[@ANYBLOB="7379735f696d6d757461626c652c757466383d312c696f636861727365743d61736369692c73686f72746e616d653d77696e39352c73686f77657865632c6e66732c636865636b3d7374726963742c756e695f786c6174653d302c757466383d312c73686f72746e616d653d6c6f7765722c73686f72746e616d653d6c6f7765722c726f6469722c726f6469722c64656275672c757466383d302c726f6469722c71756965742c6572726f72733d72656d6f756e742d726f2c009c8a8fc4f74784ad79ec08fb556262ebc972ef94821f3565ef5f75f11e30ef1f72a065c510b17cae356940538b7b2c5d72f4627c25306b2479725add28f511a68f5f6f47f9facdd0cc574286d00ab52d6b9374b6a58eac694336ebe971f41860d01084c1a0fa6b51d80fa9f9d2c1a2e7a5284f93296217ef8f28e0a36e573296a0bfb38b94191f4b82873563f3759b5e193ecfab6ed7892542364757e47d656ad6a0fbb6e8bf138bddae620a3602991821d4844f628e6bdd8b62cca73744332f0185a54b52a0352a82c794995bbb97c82fcde79d14fb20e5127150de"], 0x4a, 0x2e0, &(0x7f0000000d00)="$eJzs3T2LXFUcB+D/3Z29c6PFbGElQi6Ywiq46cRmlrCB4FaGKaKFLiYB2RmEBBZ8wTGVrY2FhZ9AEGz8Fmn8BoKtYGeEwJX7NnNnnEx2NRNJ9nmaPXvO+d1zzt2zM3eLOfvha5PjW3ncuf/Fr5FlSWwNYxgPk9iNrWh9FQuG3wQA8Dx7WBTxR1E7Sy6JiGxz0wIANugx7/9Lb+29efGnZzY1AGBDbtx87539w8ODd7PI4trk65NR+Zd9+bVu378TH8c4bsebMYhHEdVzQvN0UJavFUUx7eWl3bg0mZ6MyuTkgwfN9fd/j6jyezGI3Vmsetqo8tcPD/aqeN7v5KflPF5qxh+W+SsxiFdm4YX8lTqfd/MxSuON1zvzvxyD+OWj+CTGcauaRJ3fuX548OVenl8tvv3z8/fL6ZX5ZHoy6lf95ortZ/lzAQAAAAAAAAAAAAAAAAAAAADgxXY5bw/fyS/GpUlZ1Zy/s/0obfo0XXbnqbK9LiVtVed8oNK0iO/rIwV3Fsabn+/Ti1d73YMFAQAAAAAAAAAAAAAAAAAA4Py69+lnx0fj8e27T6XQngbQi4i/bkT82+sMOzUXY33nfjPm0Xi81RQX+jxIuzWx3fZJItZOo1zEU7otTypcyJbm3BZ++LFc4FkumHVq3lq9wJ0nretm/7/ujXZ3HR8lq8fqR1vTbpLv0oh5nzROOVb6uKYiuttv5ZIvzO9PunKIwZrRr65sSl+uCtNZTbK0e4tkxRbtFN7+rW6fxZd+idLqrq5c8k5T6MSX9sap9nNkdfyfrxVJdVpHfxMvQwAAAAAAAAAAAAAAAAAAwMJnvMvvfl5svL82ulX4KDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL4j5//8/Q2HahE/ROY279/7nJQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAO/B0AAP//X2NKqg==") mount(0x0, &(0x7f0000001000)='./file0\x00', 0x0, 0x40000, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = gettid() syz_genetlink_get_family_id$mptcp(&(0x7f0000001080), r0) timer_create(0x0, &(0x7f00000010c0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000001100)) timer_settime(0x0, 0x1, &(0x7f0000001140)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r5, 0x0, 0xf3a, 0x0) write$cgroup_pid(r5, &(0x7f00000011c0), 0xffffff98) splice(r4, 0x0, r1, 0x0, 0x100000006, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="030700000000000000000800000068000480"], 0x7c}}, 0x0) 3.353385457s ago: executing program 4 (id=97): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) sigaltstack(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000003c0)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000400)=0x40, 0x4) connect$inet6(r3, &(0x7f0000000440)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f00000004c0)=0x20a, 0x4) sendmmsg$inet6(r3, &(0x7f0000000500)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000001) r4 = dup(r3) syz_genetlink_get_family_id$ethtool(&(0x7f0000000640), r4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r3) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000180)={{{@in=@loopback, @in6=@dev={0xfe, 0x80, '\x00', 0x41}, 0x3, 0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2c}, {0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x0, 0x3ff}}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x6c}, 0x0, @in=@rand_addr=0x64010100, 0x3506, 0x0, 0x3, 0xd, 0x80000, 0x7, 0x3}}, 0xe4) close(0xffffffffffffffff) 3.22790842s ago: executing program 3 (id=98): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001000010028a6704cdbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1588040003"], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000340)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000380)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f00000003c0)=@arm64={0x5a, 0xf7, 0x5, '\x00', 0x2}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.754149412s ago: executing program 3 (id=99): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f00000002c0)='./file1\x00', 0x4827e, 0x1bb) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000040)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) mmap(&(0x7f00005ff000/0x4000)=nil, 0x4000, 0xc, 0x30, r0, 0xaf402000) r3 = openat(0xffffffffffffff9c, 0x0, 0x800, 0x1f5) fchown(r3, 0x0, 0xee01) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x200000, &(0x7f00000000c0)={[{@stripe={'stripe', 0x3d, 0x4}}, {}, {@block_validity}, {@norecovery}, {@dioread_nolock}, {@oldalloc}, {@oldalloc}, {@sysvgroups}, {@norecovery}]}, 0x3, 0x566, &(0x7f00000015c0)="$eJzs3V9rW+UfAPDvSdv9//3WwRjqhRR24WQuXVv/TBA2L0WHA72foc3KaLqMJh1rHWy7cDfeyBBEHIgvwHsvh2/AVyHoYMgoeuFN5aQnW9YkTZtlNvN8PnC25znnpN/z5DnPk+/JSUgAuTWR/lOIeDkivkoiDrdsG41s48TGfmuPbsymSxLr65/8kUSSrWvun2T/H8wqL0XEz19EnCy0x62trC6UKpXyUlafrC9enaytrJ66vFiaL8+Xr0zPzJx5a2b63XfeHlhbX7/w17cf3//gzJfH17758cGRu0mci0PZttZ2PINbrZWJmMiek7E4t2nHqQEEGyZJrx06nAPsvpFsnI9FOgccjpFs1AP/fTcjYh3IqcT4h5xq5gHNa/sBXQe/MB6+v3EB1N7+0Y33RmJf49rowFry1JVRer07PoD4aYyffr93N12ix/sQNwcQD6Dp1u2IOD062j7/Jdn817/T23jXb3OMvL3+wG66n+Y/b3TKfwqP85/okP8c7DB2+9F7/BceDCBMV2n+917H/Pfx1DU+ktX+18j5xpJLlyvl0xHx/4g4EWN703q/93Na8790SeM3c8HsOB6M7n36MXOleqnPcG0e3o545Un+m0Tb/L+vketu7v/0+biwzRjHyvde7batd/tbDT4DXv8h4rWO/f/kjlay9f3Jycb5MNk8K9r9eefYL93i76z9g5f2/4Gt2z+etN6vre08xvf7/i5329bv+b8n+bRR3pOtu16q15emIvYkH7Wvn37y2Ga9uX/a/hPHt57/Op3/+yPis222/87R7mnQMPT/3I76f+eFXz/8/Ltu8bfX/282SieyNduZ/7Z7gM/y3AEAAAAAAMCwKUTEoUgKxcflQqFY3Ph8x9E4UKhUa/WTl6rLV+ai8V3Z8RgrNO90H275PMRU9nnYZn16U30mIo5ExNcj+xv14my1MrfbjQcAAAAAAAAAAAAAAAAAAIAhcbDL9/9Tv43s9tEBz52f/Ib86jn+B/FLT8BQ8voP+WX8Q34Z/5Bfxj/kl/EP+WX8Q34Z/5Bfxj8AAAAAAAAAAAAAAAAAAAAAAAAAAAAM1IXz59Nlfe3Rjdm0PndtZXmheu3UXLm2UFxcni3OVpeuFuer1flKuThbXez19yrV6tWp6Vi+Plkv1+qTtZXVi4vV5Sv1i5cXS/Pli+Wxf6VVAAAAAAAAAAAAAAAAAAAA8GKprawulCqV8pJC18LZGIrD6LuQ9Orls9nJ0FeI0d1voMJzKOzyxAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALf4JAAD//5CPL9Y=") close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="17000000000000"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000240)={{r4}, 0x0, &(0x7f0000000300)}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000002b40)='./proc\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000002c00)='./proc/sys/net/ipv4/icmp_ratelimit\x00', 0x101042, 0x15) 2.577338006s ago: executing program 1 (id=100): prlimit64(0x0, 0xe, &(0x7f0000000240)={0xa, 0x400000000008d}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, 0x0, 0x0, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xf8}], 0x1}, 0x1f00) sendmsg$tipc(r3, &(0x7f0000000500)={0x0, 0xfffffff5, &(0x7f0000000540)=[{&(0x7f0000000580)="a2", 0xfffffdef}], 0x1}, 0x0) 2.536275767s ago: executing program 0 (id=101): openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/consoles\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x9, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x94) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000040)={&(0x7f0000000080)=@hci, 0x19, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1, 0x0, 0x600}, 0x1f00) sendmsg$tipc(r2, 0x0, 0x0) 2.43900479s ago: executing program 4 (id=102): r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001400)={0x2, &(0x7f00000000c0)=[{0x25, 0x0, 0x2, 0x2}, {0x3, 0x0, 0x3}]}) 2.42925578s ago: executing program 2 (id=103): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socket$inet6(0xa, 0x80002, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)) r3 = socket$nl_generic(0x10, 0x3, 0x10) gettid() ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=ANY=[@ANYBLOB="a8000000", @ANYRES16=r4, @ANYBLOB="7961fff09a5f0ec94ae41f5c000008db1193", @ANYRES32=0x0, @ANYBLOB="0c009900fdffffff6b000000080057007d0300000800a000020000000500180102000000080022013502000005001801170000000500190105000000080022018e0300000800a1000800000008002201d90100000800a100030000000800570008000000080022015b01000008009f000500000008009f00040000000800a100030000000800570009000000"], 0xa8}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054) 1.678879839s ago: executing program 0 (id=104): openat$rtc(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x202, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="f000000010000104000000000000000000000000000000000000000000000001fe8000000000000000000000000000bb12341234000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000001000004d2ff000000e0000001000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0800000000000000ffffffffffffffff00"/156], 0xf0}}, 0x4804) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f00000003c0)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000440)=[{0x6, 0x0, 0x0, 0x7fff7ffa}]}) r2 = getpid() r3 = creat(&(0x7f0000000480)='./bus\x00', 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x8, 0x8b}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x13, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000008000000000000001ada04006b11710000000000"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) sched_setscheduler(r4, 0x2, &(0x7f00000006c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000740)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000007c0), 0x651, 0x0) recvmmsg(r5, &(0x7f0000000800), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB="3c0000ff10000104e55affffffff000000000000000000", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x40c4) r7 = syz_pidfd_open(r2, 0x0) setns(r7, 0x24020000) umount2(&(0x7f0000000900)='.\x00', 0x2) 1.569484002s ago: executing program 1 (id=105): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000006980), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x0, 0x1) ppoll(&(0x7f0000006a00)=[{r1, 0x1}], 0x1, 0x0, 0x0, 0x0) writev(r1, &(0x7f0000006a40)=[{&(0x7f0000006a80)="759534ab1bbeff7f", 0x8}, {&(0x7f0000006ac0)="f51b932f8a834b7e", 0x8}], 0x2) 1.503818103s ago: executing program 2 (id=106): symlink(&(0x7f0000000540)='./file0/file0\x00', &(0x7f0000000400)='./file0\x00') syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="020000000400"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tgkill(r3, r3, 0x34) ptrace(0x10, r3) socket$nl_generic(0x10, 0x3, 0x10) ptrace(0x6a3e9902fbb19fab, r3) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x4) openat$sysfs(0xffffffffffffff9c, 0x0, 0x129a02, 0x5) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) socket$nl_xfrm(0x10, 0x3, 0x6) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) 1.472974034s ago: executing program 4 (id=107): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = memfd_create(&(0x7f0000005ac0)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xef-\xa6m\xa1\xc4\xb5{\xf2\\\x8d[7k~\x04\x03~K\xfbP\x84=\xfa\x81\x8c\x1et\x10', 0x0) pwrite64(r0, &(0x7f0000005b00)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) lseek(r0, 0x0, 0x4) sendfile(r0, r0, &(0x7f0000005b40), 0x7fa) symlink(&(0x7f0000005b80)='./file0\x00', &(0x7f0000005bc0)='./file0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000005c00)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) write(r1, &(0x7f0000005c40)='0', 0x1) openat(0xffffffffffffff9c, &(0x7f0000005c80)='./file0/file1\x00', 0x880cc2, 0x20) mount(&(0x7f0000005a00)=@loop={'/dev/loop', 0x0}, &(0x7f0000005a40)='.\x00', &(0x7f0000005a80)='exfat\x00', 0x401, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = memfd_create(&(0x7f00000000c0)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xef-\xa6m\xa1\xc4\xb5{\xf2\\\x8d[7k~\x04\x03~K\xfbP\x84=\xfa\x81\x8c\x1et\x10', 0x0) pwrite64(r3, 0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r3, 0x0) symlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) syz_usb_connect(0x3, 0x32, &(0x7f0000000340)=ANY=[@ANYBLOB="1201000200000040e6040500000101020301090220000101"], 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000100)={0x3, 0x1, 0x9000, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f000000b000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, 0x0}], 0x1, 0x15, 0x0, 0x0) 1.408539466s ago: executing program 3 (id=108): prlimit64(0x0, 0xe, &(0x7f0000000080)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000140)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000240), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000280), 0x4000087, 0x2, 0x0) userfaultfd(0x1) lsetxattr$system_posix_acl(0x0, 0x0, 0x0, 0x0, 0x2) epoll_create1(0x80000) syz_open_procfs(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000007c0)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000800)={@rand_addr=' \x01\x00', 0x46, r3}) memfd_create(&(0x7f0000000840)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) r4 = fsopen(&(0x7f0000000940)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) symlinkat(&(0x7f0000000980)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000009c0)='./file0\x00') 1.085690524s ago: executing program 1 (id=109): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r2, 0x0) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, 0x0, &(0x7f00000010c0)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000001140)={0x1, &(0x7f0000001180)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) syz_btf_id_by_name$bpf_lsm(0x0) 338.871µs ago: executing program 0 (id=110): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x0, &(0x7f0000000500), 0xfe, 0x250, &(0x7f0000000540)="$eJzs3T9oJFUcB/DvzO565m7RUxtB/AMiooFwdoLN2SgcyHGICCqciNgod8J5h11iZWOhtUoqmyB2RktJE2wUwSpqitgIGiwMFlqs7M4G8mc1ZnfdkcznA5OZybyZ3xt2vm+3ebsBGutskvNJWknmk3SSFHsb3FctZ4e7y3Prl5Ne7+lfi0G7ar+ye96ZJEtJHk2yVhZ5tZ3cWH1+6/eNJx9853rngY9Wn5ub6U0ObW9tPrXz4cW3P73wyI2vv/35YpHz6e67r+krRvyvXSS3/xfF/ieKdt094N+49OYn3/Vzf0eS+wf576RM9eK9e+2mtU4e/uDvzn3vl2/ummVfgenr9Tr998ClHtA4ZZJuinIhSbVdlgsL1Wf471uny9euXntj/pWr16+8XPdIBUxLN9l84vNTn505kP+fWlX+gZOrn/9nLq380N/eadXdG2Am7q5W/fzPv7j4UOQfGkf+obnkH5pL/qG55B+aS/6hueQfTrDOPx+Wf2gu+Yfmkn9orr35BwCapXdqnFnDt05/IjIwc3WPPwAAAAAAAAAAAAAAAAAAwGHLc+uXd5dxr1Ecs/2X7yfbjydpj6rfGvwecXLz4O/p34p+s3212uN2dOiFeye8wIQ+rnn29S0/1lv/q3vqrb94JVl6K8m5dvvw81cMn7/x3XbE8c5LExY4poP5fOzZ2dY/6M+Veutf2Ei+6I8/50aNP2XuHKxHjz/do79i+Uiv/zHhBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJiZvwIAAP//1rxsXQ==") r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000180)={0x1, &(0x7f00000001c0)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000240)) prlimit64(0x0, 0x7, &(0x7f00000002c0), 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, 0x0) 0s ago: executing program 3 (id=111): socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x80000008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000013c0)=0x5) prlimit64(0x0, 0x4, &(0x7f0000001400)={0x659e, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000001440)=0x7) socket$inet6(0xa, 0x80001, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000014c0), 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000001580), 0x80002c1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f00000015c0)='ext4\x00', &(0x7f0000001600)='./bus\x00', 0xe, &(0x7f0000001640)={[{}, {@oldalloc}, {@resuid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@block_validity}, {@jqfmt_vfsv1}]}, 0x3, 0x447, &(0x7f00000016c0)="$eJzs28tvG0UYAPBv10lKX8SU8ugDCBRExCNp0gI9cAGBxAEkJDiUY0jSqtRtUBMkWlW0IFSOqBJ3xIEDEn8BJ7gg4ITEFe6oUoV6aeFktPZuYjt2mocTF/z7SdvO7M5q5vPu2DM72QD61kj2TxKxKyJ+j4jhera5wEj9v1s3Lk7/fePidBLV6lt/JbVyN29cnC6KFuftzDOjaUT6aRIH2tQ7f/7C6alKZfZcnh9fOPP++Pz5C8+eOjN1cvbk7NnJY8eOHpl44fnJ57oSZ9amm/s/mju477V3rr4xffzquz9/mxTxt8TRJSMrHXyiWu1ydb21uyGdDPSwIaxJKSKyyzVY6//DUYqlizccr37S08YBm6parVZ3dj58uQr8jyXR6xYAvVH80Gfz32LboqHHHeH6S/UJUBb3rXyrHxmINC8z2DK/7aaRiDh++Z8vsy025zkEAECT77PxzzPtxn9p3N9Q7u58bagcEfdExJ6IuDci9kbEfRG1sg9ExINrrL91kWT5+Ce9tq7AVikb/72Yr201j/+K0V+US3ludy3+weTEqcrs4fwzGY3BbVl+YoU6fnjlt887HWsc/2VbVn8xFszbcW1gW/M5M1MLUxuJudH1jyP2D7SLP1lcCUgiYl9E7F9nHaee+uZgp2O3j38FXVhnqn4V8WT9+l+OlvgLycrrk+N3RWX28HhxVyz3y69X3uxU/4bi74Ls+u9oe/8vxl9OGtdr59dex5U/Pus4p1nd/V+91HhOdv8PJW/X0kP5vg+nFhbOTUQMJa/XG924f3Lp3CJflM/iHz3Uvv/viaVP4kBEZDfxQxHxcEQ8krf90Yh4LCIOrRD/Ty8//t76499cWfwza7r+S4mhaN3TPlE6/eN3TZWW1xJ/dv2P1lKj+Z7VfP+tpl3ru5sBAADgvyeNiF2RpGOL6TQdG6v/vfze2JFW5uYXnj4x98HZmfo7AuUYTIsnXcMNz0Mn8ml9kZ+M+LoxfyR/bvxFaXstPzY9V5npdfDQ53Z26P+ZP0u9bh2w6byvBf1L/4f+pf9D/9L/oX+16f/be9EOYOu1+/2/1IN2AFuvpf9b9oM+Yv4P/Uv/h/6l/0Nfmt8et39JXkJiWSLSO6IZEt1JpBHRtGf5d0W5F19QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG/RvAAAA//831udB") gettid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000001c40), 0x208e24b) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 8.156088][ T110] udevd (110) used greatest stack depth: 22888 bytes left [ 11.196000][ T30] kauditd_printk_skb: 48 callbacks suppressed [ 11.196013][ T30] audit: type=1400 audit(1791939351.116:59): avc: denied { transition } for pid=220 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 11.204060][ T30] audit: type=1400 audit(1791939351.116:60): avc: denied { noatsecure } for pid=220 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 11.208781][ T30] audit: type=1400 audit(1791939351.116:61): avc: denied { write } for pid=220 comm="sh" path="pipe:[363]" dev="pipefs" ino=363 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 11.215379][ T30] audit: type=1400 audit(1791939351.116:62): avc: denied { rlimitinh } for pid=220 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 11.232786][ T30] audit: type=1400 audit(1791939351.116:63): avc: denied { siginh } for pid=220 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.0.14' (ED25519) to the list of known hosts. [ 17.835292][ T30] audit: type=1400 audit(1791939357.756:64): avc: denied { mounton } for pid=263 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 17.836403][ T263] cgroup: Unknown subsys name 'net' [ 17.858137][ T30] audit: type=1400 audit(1791939357.756:65): avc: denied { mount } for pid=263 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 17.886100][ T30] audit: type=1400 audit(1791939357.776:66): avc: denied { unmount } for pid=263 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 17.886257][ T263] cgroup: Unknown subsys name 'devices' [ 18.025534][ T263] cgroup: Unknown subsys name 'hugetlb' [ 18.031182][ T263] cgroup: Unknown subsys name 'rlimit' [ 18.169621][ T30] audit: type=1400 audit(1791939358.086:67): avc: denied { setattr } for pid=263 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 18.193617][ T30] audit: type=1400 audit(1791939358.086:68): avc: denied { mounton } for pid=263 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 18.194386][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 18.219034][ T30] audit: type=1400 audit(1791939358.086:69): avc: denied { mount } for pid=263 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 18.250511][ T30] audit: type=1400 audit(1791939358.146:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.263550][ T263] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 18.276042][ T30] audit: type=1400 audit(1791939358.146:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.310266][ T30] audit: type=1400 audit(1791939358.176:72): avc: denied { read } for pid=263 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.335806][ T30] audit: type=1400 audit(1791939358.176:73): avc: denied { open } for pid=263 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 18.920583][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.927687][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.935145][ T286] device bridge_slave_0 entered promiscuous mode [ 18.948987][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 18.956098][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 18.963510][ T286] device bridge_slave_1 entered promiscuous mode [ 18.985055][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 18.992104][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 18.999772][ T285] device bridge_slave_0 entered promiscuous mode [ 19.007633][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.014822][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.022086][ T285] device bridge_slave_1 entered promiscuous mode [ 19.129497][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.136608][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.144468][ T289] device bridge_slave_0 entered promiscuous mode [ 19.152229][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.159515][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.166836][ T289] device bridge_slave_1 entered promiscuous mode [ 19.230050][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.237234][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.244693][ T287] device bridge_slave_0 entered promiscuous mode [ 19.251556][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.258849][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.266379][ T287] device bridge_slave_1 entered promiscuous mode [ 19.278390][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.285469][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.292868][ T288] device bridge_slave_0 entered promiscuous mode [ 19.299742][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.306798][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.314192][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.321206][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.336054][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.343104][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.350391][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.357433][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.365284][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.372316][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.379686][ T288] device bridge_slave_1 entered promiscuous mode [ 19.458849][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.465927][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.473184][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.480234][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.500045][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.507422][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.514688][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.522975][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.531956][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 19.539326][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 19.547454][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 19.554844][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.570643][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.578156][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.586449][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.593462][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.617375][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.625636][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.632660][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.640162][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.648526][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.668739][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.676913][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.692540][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.726266][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 19.734398][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 19.743318][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.751784][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.758870][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.766819][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.775065][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.782097][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.789581][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 19.797831][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 19.804871][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 19.812352][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 19.820536][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 19.827570][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 19.834936][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.842979][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.851112][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 19.873062][ T289] device veth0_vlan entered promiscuous mode [ 19.880374][ T286] device veth0_vlan entered promiscuous mode [ 19.893699][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 19.902905][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 19.911165][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 19.918856][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 19.926513][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 19.934936][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 19.943403][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 19.951629][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 19.959220][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 19.967345][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 19.975413][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 19.989557][ T285] device veth0_vlan entered promiscuous mode [ 19.999680][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.007763][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.016635][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.024387][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.032425][ T286] device veth1_macvtap entered promiscuous mode [ 20.042240][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.050625][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.066665][ T285] device veth1_macvtap entered promiscuous mode [ 20.075312][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.083102][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.090655][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.098440][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 20.107223][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.115525][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.122544][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.130126][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.138679][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.147153][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 20.155468][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.163582][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.170765][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.178483][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.186859][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.195106][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 20.205047][ T287] device veth0_vlan entered promiscuous mode [ 20.218228][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.226191][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.234341][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.242919][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.251562][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.260264][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.268574][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.276831][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.285634][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.294015][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.302329][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.309801][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.323299][ T289] device veth1_macvtap entered promiscuous mode [ 20.332758][ T287] device veth1_macvtap entered promiscuous mode [ 20.342618][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.350408][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.358793][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.367615][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 20.375419][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 20.383525][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.399094][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 20.408682][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.409102][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 20.442045][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.451790][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.461077][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.469629][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.478274][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.486589][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 20.495893][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 20.505130][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 20.689654][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 20.699738][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.726681][ T288] device veth0_vlan entered promiscuous mode [ 20.733709][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 20.744545][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 20.762394][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 20.765619][ T318] loop2: detected capacity change from 0 to 4096 [ 20.777559][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 20.808061][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 20.828412][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 20.843563][ T318] EXT4-fs (loop2): Test dummy encryption mode enabled [ 20.858763][ T288] device veth1_macvtap entered promiscuous mode [ 20.862924][ T318] EXT4-fs (loop2): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,usrjquota=,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 20.910053][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 20.921200][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.018227][ T318] futex_wake_op: syz.2.3 tries to shift op by 144; fix this program [ 21.026333][ T318] futex_wake_op: syz.2.3 tries to shift op by 144; fix this program [ 21.043666][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.053181][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.743247][ T338] overlayfs: failed to resolve './file2': -2 [ 22.582614][ T342] sched: RT throttling activated [ 22.756197][ T350] netlink: 148 bytes leftover after parsing attributes in process `syz.4.10'. [ 22.975296][ T354] loop1: detected capacity change from 0 to 4096 [ 23.311356][ T357] loop2: detected capacity change from 0 to 16 [ 23.344817][ T357] ======================================================= [ 23.344817][ T357] WARNING: The mand mount option has been deprecated and [ 23.344817][ T357] and is ignored by this kernel. Remove the mand [ 23.344817][ T357] option from the mount to silence this warning. [ 23.344817][ T357] ======================================================= [ 23.395162][ T30] kauditd_printk_skb: 43 callbacks suppressed [ 23.395874][ T357] erofs: (device loop2): mounted with root inode @ nid 36. [ 23.462438][ T30] audit: type=1400 audit(1791939363.266:117): avc: denied { mounton } for pid=346 comm="syz.2.8" path="/1/file0" dev="tmpfs" ino=24 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 23.504069][ T354] EXT4-fs (loop1): Test dummy encryption mode enabled [ 23.565976][ T30] audit: type=1400 audit(1791939363.306:118): avc: denied { create } for pid=351 comm="syz.0.11" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 23.588164][ T30] audit: type=1400 audit(1791939363.316:119): avc: denied { read } for pid=351 comm="syz.0.11" name="loop-control" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 23.628698][ T354] EXT4-fs (loop1): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,usrjquota=,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 23.637359][ T30] audit: type=1400 audit(1791939363.316:120): avc: denied { open } for pid=351 comm="syz.0.11" path="/dev/loop-control" dev="devtmpfs" ino=115 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 23.676240][ T30] audit: type=1400 audit(1791939363.316:121): avc: denied { ioctl } for pid=351 comm="syz.0.11" path="/dev/loop-control" dev="devtmpfs" ino=115 ioctlcmd=0x4c81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 23.817742][ T354] futex_wake_op: syz.1.12 tries to shift op by 144; fix this program [ 23.825936][ T354] futex_wake_op: syz.1.12 tries to shift op by 144; fix this program [ 24.259723][ T373] syz.1.12 (373) used greatest stack depth: 22760 bytes left [ 24.326562][ T375] netlink: 148 bytes leftover after parsing attributes in process `syz.0.15'. [ 24.669103][ T30] audit: type=1400 audit(1791939364.586:122): avc: denied { read write } for pid=368 comm="syz.2.14" name="fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 24.779533][ T30] audit: type=1400 audit(1791939364.686:123): avc: denied { open } for pid=368 comm="syz.2.14" path="/dev/fuse" dev="devtmpfs" ino=91 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 25.032628][ T30] audit: type=1400 audit(1791939364.916:124): avc: denied { name_bind } for pid=385 comm="syz.0.19" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 25.142738][ T30] audit: type=1400 audit(1791939364.916:125): avc: denied { node_bind } for pid=385 comm="syz.0.19" saddr=::1 src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 25.190673][ T30] audit: type=1400 audit(1791939365.106:126): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 25.294316][ T398] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 25.305382][ T398] exFAT-fs (loop2): unable to read boot sector [ 25.311713][ T398] exFAT-fs (loop2): failed to read boot sector [ 25.319397][ T397] overlayfs: overlapping lowerdir path [ 25.325808][ T398] exFAT-fs (loop2): failed to recognize exfat type [ 25.448432][ T379] loop1: detected capacity change from 0 to 131072 [ 25.464145][ T403] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.758988][ T379] F2FS-fs (loop1): invalid crc value [ 25.783288][ T379] F2FS-fs (loop1): Found nat_bits in checkpoint [ 25.836680][ T379] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 25.849838][ T379] F2FS-fs (loop1): Cannot turn on quotas: -2 on 2 [ 25.857319][ T379] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 25.894136][ T331] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.987644][ T420] loop3: detected capacity change from 0 to 4096 [ 27.017864][ T420] EXT4-fs (loop3): Test dummy encryption mode enabled [ 27.050020][ T420] EXT4-fs (loop3): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,usrjquota=,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 27.110293][ T418] futex_wake_op: syz.0.28 tries to shift op by 144; fix this program [ 27.118519][ T418] futex_wake_op: syz.0.28 tries to shift op by 144; fix this program [ 27.383978][ T331] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.394713][ T331] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 27.413895][ T314] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 27.574122][ T331] usb 3-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 27.583343][ T331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.592001][ T331] usb 3-1: Product: syz [ 27.596268][ T331] usb 3-1: Manufacturer: syz [ 27.600945][ T331] usb 3-1: SerialNumber: syz [ 27.653809][ T314] usb 2-1: Using ep0 maxpacket: 16 [ 27.785239][ T314] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.973235][ T314] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 28.038730][ T314] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 28.073813][ T314] usb 2-1: config 0 interface 0 has no altsetting 0 [ 28.080487][ T314] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 28.089861][ T314] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 28.100710][ T314] usb 2-1: config 0 descriptor?? [ 28.604100][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 28.604178][ T30] audit: type=1400 audit(1791939368.136:142): avc: denied { name_bind } for pid=433 comm="syz.0.32" src=20004 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 28.775520][ T60] usb 3-1: USB disconnect, device number 2 [ 29.264566][ T30] audit: type=1400 audit(1791939369.126:143): avc: denied { ioctl } for pid=439 comm="syz.3.33" path="socket:[16595]" dev="sockfs" ino=16595 ioctlcmd=0x6e8d scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 29.317966][ T447] netlink: 148 bytes leftover after parsing attributes in process `syz.4.34'. [ 29.326270][ T314] usb 2-1: USB disconnect, device number 2 [ 29.512030][ T391] syz.2.20 (391) used greatest stack depth: 21544 bytes left [ 30.993838][ T30] audit: type=1400 audit(1791939370.526:144): avc: denied { read } for pid=456 comm="syz.1.39" dev="nsfs" ino=4026532370 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 31.207760][ T30] audit: type=1400 audit(1791939370.526:145): avc: denied { open } for pid=456 comm="syz.1.39" path="net:[4026532370]" dev="nsfs" ino=4026532370 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 31.562992][ T460] futex_wake_op: syz.0.40 tries to shift op by 144; fix this program [ 31.572349][ T460] futex_wake_op: syz.0.40 tries to shift op by 144; fix this program [ 31.662162][ T470] loop2: detected capacity change from 0 to 4096 [ 31.689406][ T470] EXT4-fs (loop2): Test dummy encryption mode enabled [ 31.733057][ T470] EXT4-fs (loop2): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,usrjquota=,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 31.950721][ T470] futex_wake_op: syz.2.42 tries to shift op by 144; fix this program [ 31.958973][ T470] futex_wake_op: syz.2.42 tries to shift op by 144; fix this program [ 32.256819][ T30] audit: type=1400 audit(1791939372.176:146): avc: denied { create } for pid=477 comm="syz.1.43" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 32.309876][ T30] audit: type=1400 audit(1791939372.176:147): avc: denied { write } for pid=477 comm="syz.1.43" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 32.815212][ T490] loop3: detected capacity change from 0 to 512 [ 32.853219][ T490] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 32.867433][ T490] System zones: 1-12 [ 32.876909][ T490] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #12: comm syz.3.47: missing EA_INODE flag [ 32.897855][ T490] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.47: error while reading EA inode 12 err=-117 [ 32.914030][ T490] EXT4-fs (loop3): 1 orphan inode deleted [ 32.919958][ T490] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue. Quota mode: writeback. [ 33.573341][ T30] audit: type=1400 audit(1791939373.076:148): avc: denied { bind } for pid=489 comm="syz.3.47" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 34.050395][ T30] audit: type=1400 audit(1791939373.076:149): avc: denied { name_bind } for pid=489 comm="syz.3.47" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 34.574274][ T30] audit: type=1400 audit(1791939373.076:150): avc: denied { node_bind } for pid=489 comm="syz.3.47" saddr=ff02::1 src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=rawip_socket permissive=1 [ 35.101586][ T509] netlink: 92 bytes leftover after parsing attributes in process `syz.0.53'. [ 35.120662][ T30] audit: type=1400 audit(1791939373.096:151): avc: denied { add_name } for pid=489 comm="syz.3.47" name="config" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 35.144666][ T515] loop3: detected capacity change from 0 to 512 [ 35.196916][ T509] Zero length message leads to an empty skb [ 35.210584][ T30] audit: type=1400 audit(1791939373.096:152): avc: denied { create } for pid=489 comm="syz.3.47" name="config" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 35.232075][ T30] audit: type=1400 audit(1791939373.116:153): avc: denied { create } for pid=489 comm="syz.3.47" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 35.252271][ T30] audit: type=1400 audit(1791939373.116:154): avc: denied { read write open } for pid=489 comm="syz.3.47" path="/6/file0/file1" dev="loop3" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 35.287178][ T488] loop4: detected capacity change from 0 to 131072 [ 35.325234][ T515] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 35.333316][ T515] System zones: 1-12 [ 35.338105][ T515] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #12: comm syz.3.52: missing EA_INODE flag [ 35.350140][ T515] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.52: error while reading EA inode 12 err=-117 [ 35.364360][ T515] EXT4-fs (loop3): 1 orphan inode deleted [ 35.370186][ T515] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue. Quota mode: writeback. [ 35.395038][ T488] F2FS-fs (loop4): invalid crc value [ 35.559363][ T30] audit: type=1400 audit(1791939375.376:155): avc: denied { create } for pid=517 comm="syz.0.56" dev="anon_inodefs" ino=16050 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 35.797440][ T488] F2FS-fs (loop4): Found nat_bits in checkpoint [ 35.808675][ T30] audit: type=1400 audit(1791939375.446:156): avc: denied { mount } for pid=517 comm="syz.0.56" name="/" dev="ramfs" ino=16053 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 36.048244][ T488] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 36.242131][ T30] audit: type=1400 audit(1791939375.896:157): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 36.470732][ T488] F2FS-fs (loop4): Cannot turn on quotas: -2 on 2 [ 36.836210][ T30] audit: type=1400 audit(1791939376.756:158): avc: denied { read } for pid=532 comm="syz.0.58" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.045858][ T537] loop2: detected capacity change from 0 to 4096 [ 37.175389][ T537] EXT4-fs (loop2): Test dummy encryption mode enabled [ 37.211035][ T537] EXT4-fs (loop2): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,usrjquota=,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 37.277259][ T545] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 37.308080][ T545] exFAT-fs (loop3): unable to read boot sector [ 37.334200][ T545] exFAT-fs (loop3): failed to read boot sector [ 37.349222][ T537] futex_wake_op: syz.2.60 tries to shift op by 144; fix this program [ 37.357410][ T537] futex_wake_op: syz.2.60 tries to shift op by 144; fix this program [ 37.359158][ T545] exFAT-fs (loop3): failed to recognize exfat type [ 38.660980][ T6] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 38.692430][ T556] loop1: detected capacity change from 0 to 4096 [ 38.721578][ T556] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 39.550074][ T567] overlayfs: missing 'lowerdir' [ 39.579927][ T571] loop4: detected capacity change from 0 to 4096 [ 39.601377][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 39.601390][ T30] audit: type=1400 audit(1791939379.516:162): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 39.682191][ T575] loop2: detected capacity change from 0 to 1024 [ 39.683894][ T6] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 39.699082][ T6] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 39.708409][ T571] EXT4-fs (loop4): Test dummy encryption mode enabled [ 39.718998][ T571] EXT4-fs (loop4): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,usrjquota=,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 39.744713][ T30] audit: type=1400 audit(1791939379.666:163): avc: denied { mounton } for pid=572 comm="syz.2.70" path="/12/file1" dev="tmpfs" ino=93 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 39.748827][ T575] EXT4-fs (loop2): Ignoring removed oldalloc option [ 39.773495][ T575] EXT4-fs (loop2): Ignoring removed oldalloc option [ 39.780205][ T575] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 39.810395][ T575] EXT4-fs (loop2): mounted filesystem without journal. Opts: stripe=0x0000000000000004,bsddf,block_validity,norecovery,dioread_nolock,oldalloc,oldalloc,sysvgroups,norecovery,,errors=continue. Quota mode: none. [ 39.840344][ T571] futex_wake_op: syz.4.69 tries to shift op by 144; fix this program [ 39.908248][ T6] usb 4-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 39.922969][ T6] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 39.931924][ T6] usb 4-1: Product: syz [ 39.936417][ T6] usb 4-1: Manufacturer: syz [ 39.941964][ T6] usb 4-1: SerialNumber: syz [ 40.154697][ T541] syz.3.61 (541) used greatest stack depth: 20456 bytes left [ 40.167220][ T6] usb 4-1: USB disconnect, device number 2 [ 40.328297][ T582] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 40.339875][ T582] exFAT-fs (loop3): unable to read boot sector [ 40.346310][ T582] exFAT-fs (loop3): failed to read boot sector [ 40.352642][ T582] exFAT-fs (loop3): failed to recognize exfat type [ 40.412728][ T584] process 'syz.1.72' launched '/dev/fd/-1/./proc' with NULL argv: empty string added [ 40.557224][ T590] overlayfs: failed to resolve './file1': -2 [ 40.720607][ T595] /dev/loop0: Can't open blockdev [ 40.763861][ T6] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 41.003843][ T591] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 41.029805][ T30] audit: type=1400 audit(1791939380.946:164): avc: denied { write } for pid=598 comm="syz.2.77" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 41.029957][ T599] netlink: 68 bytes leftover after parsing attributes in process `syz.2.77'. [ 41.064853][ T30] audit: type=1400 audit(1791939380.946:165): avc: denied { nlmsg_write } for pid=598 comm="syz.2.77" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 41.072624][ T601] overlayfs: missing 'lowerdir' [ 41.143960][ T6] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 41.163881][ T6] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 41.380423][ T604] loop2: detected capacity change from 0 to 4096 [ 41.438454][ T604] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 43.194052][ T591] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 43.210866][ T591] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 43.223921][ T6] usb 4-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 43.232990][ T6] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.241248][ T6] usb 4-1: Product: syz [ 43.245785][ T6] usb 4-1: Manufacturer: syz [ 43.250486][ T6] usb 4-1: SerialNumber: syz [ 43.273988][ T6] usb 4-1: can't set config #1, error -71 [ 43.292494][ T6] usb 4-1: USB disconnect, device number 3 [ 43.301984][ T628] loop2: detected capacity change from 0 to 4096 [ 43.327116][ T628] EXT4-fs (loop2): Test dummy encryption mode enabled [ 43.337464][ T628] EXT4-fs (loop2): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000008000000,noauto_da_alloc,usrjquota=,test_dummy_encryption,block_validity,nodelalloc,minixdf,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 43.398648][ T628] futex_wake_op: syz.2.84 tries to shift op by 144; fix this program [ 43.433928][ T591] usb 1-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 43.443125][ T591] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.451305][ T591] usb 1-1: Product: syz [ 43.455519][ T591] usb 1-1: Manufacturer: syz [ 43.460378][ T591] usb 1-1: SerialNumber: syz [ 43.563888][ T60] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 43.596037][ T312] usb 1-1: USB disconnect, device number 2 [ 43.653842][ T6] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 43.813788][ T60] usb 5-1: Using ep0 maxpacket: 8 [ 44.013911][ T6] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 44.024550][ T6] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 44.035589][ T6] usb 4-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 44.116890][ T30] audit: type=1400 audit(1791939384.036:166): avc: denied { bind } for pid=637 comm="syz.1.89" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 44.153910][ T30] audit: type=1400 audit(1791939384.036:167): avc: denied { name_bind } for pid=637 comm="syz.1.89" src=4660 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 44.176622][ T30] audit: type=1400 audit(1791939384.036:168): avc: denied { node_bind } for pid=637 comm="syz.1.89" saddr=172.20.20.170 src=4660 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 44.212699][ T641] overlayfs: missing 'lowerdir' [ 44.213889][ T6] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 44.226735][ T6] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.235122][ T6] usb 4-1: Product: syz [ 44.239556][ T6] usb 4-1: Manufacturer: syz [ 44.244666][ T6] usb 4-1: SerialNumber: syz [ 44.279329][ T60] usb 5-1: New USB device found, idVendor=0499, idProduct=1021, bcdDevice= 0.40 [ 44.288514][ T60] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.296815][ T60] usb 5-1: Product: syz [ 44.301063][ T60] usb 5-1: Manufacturer: syz [ 44.306273][ T60] usb 5-1: SerialNumber: syz [ 44.344607][ T60] snd-usb-audio: probe of 5-1:1.0 failed with error -2 [ 44.352423][ T60] snd-usb-audio: probe of 5-1:1.1 failed with error -2 [ 44.360719][ T60] snd-usb-audio: probe of 5-1:1.2 failed with error -2 [ 44.712148][ T314] usb 5-1: USB disconnect, device number 2 [ 45.963306][ T654] loop2: detected capacity change from 0 to 512 [ 46.007386][ T654] EXT4-fs (loop2): Ignoring removed oldalloc option [ 46.014125][ T654] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 46.027245][ T654] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 46.054707][ T654] EXT4-fs (loop2): 1 truncate cleaned up [ 46.060430][ T654] EXT4-fs (loop2): mounted filesystem without journal. Opts: bsddf,oldalloc,resuid=0x0000000000000000,debug_want_extra_isize=0x0000000000000080,block_validity,jqfmt=vfsv1,,errors=continue. Quota mode: none. [ 46.144904][ T30] audit: type=1400 audit(1791939386.006:169): avc: denied { append } for pid=652 comm="syz.2.94" path="/19/bus/blkio.bfq.empty_time" dev="loop2" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 46.173987][ T30] audit: type=1400 audit(1791939386.086:170): avc: denied { create } for pid=657 comm="syz.0.96" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 46.232535][ T653] loop1: detected capacity change from 0 to 40427 [ 46.281660][ T30] audit: type=1400 audit(1791939386.196:171): avc: denied { mounton } for pid=651 comm="syz.1.93" path="/20/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 46.312027][ T667] netlink: 100 bytes leftover after parsing attributes in process `syz.0.96'. [ 46.327744][ T6] cdc_ncm 4-1:1.0: SET_NTB_FORMAT failed [ 46.607084][ T653] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 46.688566][ T6] cdc_ncm 4-1:1.0: bind() failure [ 46.752097][ T653] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 46.762493][ T6] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 46.769499][ T6] cdc_ncm 4-1:1.1: bind() failure [ 46.777582][ T6] usb 4-1: USB disconnect, device number 4 [ 46.795202][ T653] F2FS-fs (loop1): Found nat_bits in checkpoint [ 46.819218][ T653] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 46.826482][ T653] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 46.856258][ T680] loop3: detected capacity change from 0 to 1024 [ 46.895606][ T680] EXT4-fs (loop3): Ignoring removed oldalloc option [ 46.902245][ T680] EXT4-fs (loop3): Ignoring removed oldalloc option [ 46.909025][ T680] EXT4-fs (loop3): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 46.934979][ T680] EXT4-fs (loop3): mounted filesystem without journal. Opts: stripe=0x0000000000000004,bsddf,block_validity,norecovery,dioread_nolock,oldalloc,oldalloc,sysvgroups,norecovery,,errors=continue. Quota mode: none. [ 46.968396][ T30] audit: type=1400 audit(1791939386.886:172): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 47.289912][ T695] netlink: 148 bytes leftover after parsing attributes in process `syz.2.103'. [ 47.870560][ T30] audit: type=1400 audit(1791939387.786:173): avc: denied { read } for pid=696 comm="syz.0.104" name="rtc0" dev="devtmpfs" ino=259 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 47.893548][ T30] audit: type=1400 audit(1791939387.786:174): avc: denied { open } for pid=696 comm="syz.0.104" path="/dev/rtc0" dev="devtmpfs" ino=259 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 47.928193][ T30] audit: type=1400 audit(1791939387.846:175): avc: denied { read write } for pid=698 comm="syz.1.105" name="vhost-vsock" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 47.953164][ T30] audit: type=1400 audit(1791939387.846:176): avc: denied { open } for pid=698 comm="syz.1.105" path="/dev/vhost-vsock" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 47.977217][ T30] audit: type=1400 audit(1791939387.846:177): avc: denied { ioctl } for pid=698 comm="syz.1.105" path="/dev/vhost-vsock" dev="devtmpfs" ino=264 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 48.419857][ T30] audit: type=1400 audit(1791939388.116:178): avc: denied { unmount } for pid=696 comm="syz.0.104" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 49.558757][ T706] ================================================================== [ 49.568722][ T706] BUG: KASAN: use-after-free in unaccount_page_cache_page+0x6f1/0x760 [ 49.577495][ T706] Read of size 4 at addr ffff88811253a470 by task syz.4.107/706 [ 49.585226][ T706] [ 49.587556][ T706] CPU: 0 PID: 706 Comm: syz.4.107 Not tainted syzkaller #0 [ 49.594762][ T706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 49.605368][ T706] Call Trace: [ 49.608663][ T706] [ 49.611602][ T706] __dump_stack+0x21/0x30 [ 49.615946][ T706] dump_stack_lvl+0x110/0x170 [ 49.620633][ T706] ? show_regs_print_info+0x20/0x20 [ 49.625941][ T721] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 49.625986][ T706] ? load_image+0x3f0/0x3f0 [ 49.636988][ T721] exFAT-fs (loop4): unable to read boot sector [ 49.641326][ T706] print_address_description+0x7f/0x2c0 [ 49.648217][ T721] exFAT-fs (loop4): failed to read boot sector [ 49.653020][ T706] ? unaccount_page_cache_page+0x6f1/0x760 [ 49.653050][ T706] kasan_report+0x10f/0x150 [ 49.660069][ T721] exFAT-fs (loop4): failed to recognize exfat type [ 49.664972][ T706] ? unaccount_page_cache_page+0x6f1/0x760 [ 49.664999][ T706] __asan_report_load4_noabort+0x14/0x20 [ 49.665016][ T706] unaccount_page_cache_page+0x6f1/0x760 [ 49.693175][ T706] __delete_from_page_cache+0xbe/0x470 [ 49.698661][ T706] ? __bpf_trace_file_check_and_advance_wb_err+0x30/0x30 [ 49.705698][ T706] ? __kasan_check_write+0x14/0x20 [ 49.710815][ T706] ? __kasan_check_read+0x11/0x20 [ 49.715836][ T706] ? workingset_eviction+0x402/0x9f0 [ 49.721114][ T706] __remove_mapping+0x601/0x990 [ 49.725995][ T706] ? remove_mapping+0xa0/0xa0 [ 49.730657][ T706] ? __kasan_check_read+0x11/0x20 [ 49.735674][ T706] shrink_page_list+0x2a24/0x5800 [ 49.740689][ T706] ? shrink_page_list+0x931/0x5800 [ 49.745806][ T706] ? reclaim_clean_pages_from_list+0x7e0/0x7e0 [ 49.751969][ T706] ? __this_cpu_preempt_check+0x13/0x20 [ 49.757518][ T706] ? __mod_zone_page_state+0x8e/0xd0 [ 49.762799][ T706] ? isolate_lru_pages+0xff1/0x11f0 [ 49.767993][ T706] ? should_run_aging+0x410/0x410 [ 49.773007][ T706] ? cgroup_rstat_updated+0xa0/0x360 [ 49.778286][ T706] ? _raw_spin_lock_irq+0x95/0xf0 [ 49.783308][ T706] ? __this_cpu_preempt_check+0x13/0x20 [ 49.788850][ T706] ? __count_memcg_events+0xec/0x120 [ 49.794337][ T706] shrink_lruvec+0x11eb/0x3b00 [ 49.799118][ T706] ? release_firmware_map_entry+0x190/0x190 [ 49.805108][ T706] ? mem_cgroup_shrink_node+0x550/0x550 [ 49.810742][ T706] ? preempt_schedule_common+0xbe/0xf0 [ 49.816197][ T706] ? schedule_preempt_disabled+0x20/0x20 [ 49.821833][ T706] ? __kasan_check_write+0x14/0x20 [ 49.826954][ T706] ? _raw_spin_lock+0x94/0xf0 [ 49.831627][ T706] ? _raw_spin_trylock_bh+0x150/0x150 [ 49.836988][ T706] ? cgroup_rstat_flush_locked+0xa29/0xa70 [ 49.842789][ T706] ? inactive_is_low+0x160/0x2f0 [ 49.847717][ T706] ? css_next_descendant_pre+0x1e1/0x210 [ 49.853345][ T706] ? mem_cgroup_iter+0x465/0x6c0 [ 49.858270][ T706] shrink_node+0x11ee/0x2a40 [ 49.862859][ T706] ? allow_direct_reclaim+0x370/0x370 [ 49.868244][ T706] ? _raw_spin_lock_irq+0x95/0xf0 [ 49.873258][ T706] ? _raw_spin_lock_irqsave+0x130/0x130 [ 49.878795][ T706] do_try_to_free_pages+0x5a7/0x1580 [ 49.884073][ T706] ? _raw_spin_lock_irqsave+0x130/0x130 [ 49.889632][ T706] ? try_to_free_pages+0xc50/0xc50 [ 49.894733][ T706] try_to_free_mem_cgroup_pages+0x261/0x610 [ 49.900791][ T706] ? shrink_lruvec+0x3b00/0x3b00 [ 49.906571][ T706] ? mutex_unlock+0x8f/0x230 [ 49.911169][ T706] mem_cgroup_force_empty_write+0x130/0x170 [ 49.917057][ T706] ? memcg_stat_show+0x1360/0x1360 [ 49.922167][ T706] cgroup_file_write+0x294/0x560 [ 49.927204][ T706] ? cgroup_seqfile_stop+0xc0/0xc0 [ 49.932335][ T706] ? mutex_lock+0x9b/0x1c0 [ 49.936742][ T706] ? wait_for_completion_killable_timeout+0x10/0x10 [ 49.943423][ T706] ? __kasan_check_write+0x14/0x20 [ 49.948522][ T706] ? cgroup_seqfile_stop+0xc0/0xc0 [ 49.953617][ T706] kernfs_fop_write_iter+0x2bd/0x400 [ 49.958891][ T706] vfs_write+0x831/0xfd0 [ 49.963221][ T706] ? file_end_write+0x1b0/0x1b0 [ 49.968072][ T706] ? wait_for_completion_killable_timeout+0x10/0x10 [ 49.974656][ T706] ? __fget_files+0x2e1/0x340 [ 49.979326][ T706] ? __fdget_pos+0x2d2/0x380 [ 49.983902][ T706] ? ksys_write+0x70/0x260 [ 49.988305][ T706] ksys_write+0x14a/0x260 [ 49.992638][ T706] ? __ia32_sys_read+0x90/0x90 [ 49.997393][ T706] ? __kasan_check_write+0x14/0x20 [ 50.002498][ T706] ? switch_fpu_return+0x15d/0x2c0 [ 50.007602][ T706] __x64_sys_write+0x7b/0x90 [ 50.012182][ T706] x64_sys_call+0x8ef/0x9a0 [ 50.016760][ T706] do_syscall_64+0x4c/0xa0 [ 50.021165][ T706] ? clear_bhb_loop+0x50/0xa0 [ 50.025829][ T706] ? clear_bhb_loop+0x50/0xa0 [ 50.030501][ T706] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 50.036386][ T706] RIP: 0033:0x7fea9e4c72d9 [ 50.041048][ T706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 50.060649][ T706] RSP: 002b:00007fea9cf20028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 50.069182][ T706] RAX: ffffffffffffffda RBX: 00007fea9e74efa0 RCX: 00007fea9e4c72d9 [ 50.077153][ T706] RDX: 0000000000000001 RSI: 0000200000005c40 RDI: 0000000000000004 [ 50.085120][ T706] RBP: 00007fea9e55e888 R08: 0000000000000000 R09: 0000000000000000 [ 50.093086][ T706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.101055][ T706] R13: 00007fea9e74f038 R14: 00007fea9e74efa0 R15: 00007ffde6dbb428 [ 50.109041][ T706] [ 50.112052][ T706] [ 50.114363][ T706] Allocated by task 488: [ 50.118596][ T706] __kasan_kmalloc+0xd4/0x100 [ 50.123264][ T706] kmem_cache_alloc_trace+0x119/0x270 [ 50.128626][ T706] alloc_super+0x5e/0x840 [ 50.132965][ T706] sget+0x1e2/0x4c0 [ 50.136756][ T706] mount_bdev+0xec/0x3c0 [ 50.140990][ T706] f2fs_mount+0x34/0x40 [ 50.145129][ T706] legacy_get_tree+0xed/0x190 [ 50.149984][ T706] vfs_get_tree+0x89/0x260 [ 50.154400][ T706] do_new_mount+0x251/0xb40 [ 50.159064][ T706] path_mount+0x640/0xff0 [ 50.163573][ T706] __se_sys_mount+0x320/0x390 [ 50.168240][ T706] __x64_sys_mount+0xbf/0xd0 [ 50.172819][ T706] x64_sys_call+0x6bf/0x9a0 [ 50.177331][ T706] do_syscall_64+0x4c/0xa0 [ 50.182174][ T706] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 50.188086][ T706] [ 50.190479][ T706] Freed by task 496: [ 50.194351][ T706] kasan_set_track+0x4a/0x70 [ 50.198922][ T706] kasan_set_free_info+0x23/0x40 [ 50.203844][ T706] ____kasan_slab_free+0x125/0x160 [ 50.208939][ T706] __kasan_slab_free+0x11/0x20 [ 50.213686][ T706] slab_free_freelist_hook+0xc2/0x190 [ 50.219042][ T706] kfree+0xc4/0x270 [ 50.223204][ T706] destroy_super_work+0x40/0x50 [ 50.228041][ T706] process_one_work+0x6c8/0xbb0 [ 50.232883][ T706] worker_thread+0xaa0/0x1250 [ 50.237549][ T706] kthread+0x3f5/0x4f0 [ 50.241639][ T706] ret_from_fork+0x1f/0x30 [ 50.246043][ T706] [ 50.248357][ T706] Last potentially related work creation: [ 50.254254][ T706] kasan_save_stack+0x3a/0x60 [ 50.258931][ T706] __kasan_record_aux_stack+0xd2/0x100 [ 50.264383][ T706] kasan_record_aux_stack_noalloc+0xb/0x10 [ 50.270186][ T706] insert_work+0x51/0x310 [ 50.274534][ T706] __queue_work+0x8e1/0xc60 [ 50.279025][ T706] queue_work_on+0xde/0x150 [ 50.283514][ T706] destroy_super_rcu+0xd1/0xe0 [ 50.288268][ T706] rcu_do_batch+0x4c1/0xbf0 [ 50.292755][ T706] rcu_core+0x4a3/0xef0 [ 50.296918][ T706] rcu_core_si+0x9/0x10 [ 50.301060][ T706] handle_softirqs+0x250/0x560 [ 50.305810][ T706] __irq_exit_rcu+0x52/0xf0 [ 50.310431][ T706] irq_exit_rcu+0x9/0x10 [ 50.314682][ T706] sysvec_apic_timer_interrupt+0xa9/0xc0 [ 50.320346][ T706] asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ 50.326320][ T706] [ 50.328630][ T706] Second to last potentially related work creation: [ 50.335194][ T706] kasan_save_stack+0x3a/0x60 [ 50.339857][ T706] __kasan_record_aux_stack+0xd2/0x100 [ 50.345301][ T706] kasan_record_aux_stack_noalloc+0xb/0x10 [ 50.351106][ T706] call_rcu+0x10b/0xf60 [ 50.355247][ T706] __put_super+0x26b/0x2d0 [ 50.359651][ T706] deactivate_locked_super+0xd4/0x100 [ 50.365151][ T706] mount_bdev+0x2ab/0x3c0 [ 50.369485][ T706] f2fs_mount+0x34/0x40 [ 50.373628][ T706] legacy_get_tree+0xed/0x190 [ 50.378293][ T706] vfs_get_tree+0x89/0x260 [ 50.382696][ T706] do_new_mount+0x251/0xb40 [ 50.387186][ T706] path_mount+0x640/0xff0 [ 50.391588][ T706] __se_sys_mount+0x320/0x390 [ 50.396266][ T706] __x64_sys_mount+0xbf/0xd0 [ 50.400880][ T706] x64_sys_call+0x6bf/0x9a0 [ 50.405370][ T706] do_syscall_64+0x4c/0xa0 [ 50.409961][ T706] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 50.415844][ T706] [ 50.418263][ T706] The buggy address belongs to the object at ffff88811253a000 [ 50.418263][ T706] which belongs to the cache kmalloc-2k of size 2048 [ 50.433327][ T706] The buggy address is located 1136 bytes inside of [ 50.433327][ T706] 2048-byte region [ffff88811253a000, ffff88811253a800) [ 50.446769][ T706] The buggy address belongs to the page: [ 50.452398][ T706] page:ffffea0004494e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112538 [ 50.463400][ T706] head:ffffea0004494e00 order:3 compound_mapcount:0 compound_pincount:0 [ 50.471748][ T706] flags: 0x4000000000010200(slab|head|zone=1) [ 50.477842][ T706] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043200 [ 50.486421][ T706] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 50.494991][ T706] page dumped because: kasan: bad access detected [ 50.501469][ T706] page_owner tracks the page as allocated [ 50.507165][ T706] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 285, ts 35115217138, free_ts 35092786529 [ 50.529086][ T706] post_alloc_hook+0x192/0x1b0 [ 50.533873][ T706] prep_new_page+0x1c/0x110 [ 50.538463][ T706] get_page_from_freelist+0x2c3a/0x2cd0 [ 50.543997][ T706] __alloc_pages+0x1a2/0x460 [ 50.548595][ T706] new_slab+0xa0/0x4d0 [ 50.552649][ T706] ___slab_alloc+0x3ac/0x840 [ 50.557230][ T706] __slab_alloc+0x49/0x90 [ 50.561549][ T706] __kmalloc+0x16a/0x2c0 [ 50.565783][ T706] kvmalloc_node+0x211/0x320 [ 50.570367][ T706] alloc_fdtable+0x10b/0x2e0 [ 50.574948][ T706] dup_fd+0x896/0xad0 [ 50.578937][ T706] copy_files+0x76/0xe0 [ 50.583081][ T706] copy_process+0x1080/0x3230 [ 50.587750][ T706] kernel_clone+0x233/0x960 [ 50.592244][ T706] __x64_sys_clone+0x198/0x210 [ 50.597005][ T706] x64_sys_call+0x41f/0x9a0 [ 50.601496][ T706] page last free stack trace: [ 50.606151][ T706] free_unref_page_prepare+0x5fa/0x600 [ 50.611602][ T706] free_unref_page+0xae/0x540 [ 50.616268][ T706] __free_pages+0x6c/0x100 [ 50.620682][ T706] __free_slab+0xe5/0x1e0 [ 50.624994][ T706] __unfreeze_partials+0x15a/0x190 [ 50.630098][ T706] put_cpu_partial+0xc6/0x120 [ 50.634765][ T706] __slab_free+0x1d4/0x290 [ 50.639205][ T706] ___cache_free+0x104/0x120 [ 50.643781][ T706] qlink_free+0x4d/0x90 [ 50.647927][ T706] qlist_free_all+0x5f/0xb0 [ 50.652415][ T706] kasan_quarantine_reduce+0x14a/0x170 [ 50.657862][ T706] __kasan_slab_alloc+0x2f/0xe0 [ 50.662715][ T706] slab_post_alloc_hook+0x4f/0x2b0 [ 50.667818][ T706] kmem_cache_alloc+0xf7/0x260 [ 50.672572][ T706] jbd2__journal_start+0x13d/0x6e0 [ 50.677675][ T706] __ext4_journal_start_sb+0xfb/0x2b0 [ 50.683035][ T706] [ 50.685341][ T706] Memory state around the buggy address: [ 50.690954][ T706] ffff88811253a300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.699001][ T706] ffff88811253a380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.707047][ T706] >ffff88811253a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.715088][ T706] ^ [ 50.722793][ T706] ffff88811253a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.730842][ T706] ffff88811253a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.738892][ T706] ================================================================== [ 50.747078][ T706] Disabling lock debugging due to kernel taint [ 50.869691][ T726] loop3: detected capacity change from 0 to 512 [ 50.954204][ T726] EXT4-fs (loop3): Ignoring removed oldalloc option [ 50.960907][ T726] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 50.974750][ T724] netlink: 100 bytes leftover after parsing attributes in process `syz.0.112'. [ 50.984234][ T726] EXT4-fs (loop3): 1 truncate cleaned up [ 50.989919][ T726] EXT4-fs (loop3): mounted filesystem without journal. Opts: bsddf,oldalloc,resuid=0x0000000000000000,debug_want_extra_isize=0x0000000000000080,block_validity,jqfmt=vfsv1,,errors=continue. Quota mode: none. [ 51.273843][ T312] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 51.633918][ T312] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 51.644952][ T312] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 51.813953][ T312] usb 5-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 51.823140][ T312] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 51.831266][ T312] usb 5-1: Product: syz [ 51.835561][ T312] usb 5-1: Manufacturer: syz [ 51.840152][ T312] usb 5-1: SerialNumber: syz [ 52.089071][ T42] usb 5-1: USB disconnect, device number 3