last executing test programs: 21.518519937s ago: executing program 2 (id=37): syz_mount_image$f2fs(&(0x7f0000000040), &(0x7f0000000280)='./file0\x00', 0x200841a, &(0x7f0000000f40)=ANY=[@ANYBLOB="66617374626f6f742c71756f7461000000000000003b814e50a959736d65720f73ecea54b5e5be45ace9a88f723cb005aeff24212c651baef614d442ae89412ad3dcd0b7586d02002a6d6d65cacd4fc5002207ce994dda65c4b1d23a9bd5ba0f4ce5c2b5a5718c6aa918080002223d2753a5cac974110144cd0a1e368652324a41b31e1eb3b32dccbdf8f68bd96a45a75427a5f789d267fd92f6a5540200b81d5b9fa9b40fe4d7fbd50a6afc3a989c6d60045663c59cbdc4c700000000bc7f6b22df0193acf5912afdcc1c061835177068c40f757dd123d2600b1c544f1525aa8d00000000000000000000002e8b5c733d362417bb7f527c0bfebec112d57fc69fabb9b31ef97b2147930ff60cdf666c25244218b1f1a6010000000100000020563b835d0e8e9a09070ef1691fcb2f37bda5d4e3d9d7a2d0ac82b45a53001057f321acc45d5e065a461de90100000077d200000000000040b78f0dd3836f5ab2f6a1a5b798bb7752f192c6b48e568973a59cd9c74bd9a14721856c5499cd8f93f8beaa9cf76718ce7244c8426803000000005c000208886b313bd01a22d576e414011a4f0a897515329f86d4585fa0ea17068f8af349696da4a2b3e24310ca52ec51bc23b57897cb55a2d513e6a00765ee3f58b471c54dd57f0af584afe4a21f92b515d7f2fa6fbb273ca0f751e684584320534667aea39ad7222c8ef531f514939177a47395e94c1723abb3fd44fd64fde4b45cc2f55f4ae05ff48648a4c998257856bcdcf2fa02010000001f54fb936570450e91c8d55abad76a7b7a000016f81ec9da9ccc1191c211632266d907e4d9b23496ae19bac24dc23c43f514f1b4af19988bbe61ee29a368a999435d6872d01b79c7821e875859dfbf3c57e4f1fb0be46cb5f7a0fa13516c0926d19dd2d5862085e1e4cb8279be17cba17ee4d06ad97b4ca282e73ea142b01b4a742fa11c0927ba811dd60903d575db449d775021b542db617086b3ed42e6e60fe043cff79b0c067c584bbf82657974c3736912b4b522052b9467d0da116ccc1652d861a420f09aaf67d3e9f6160100000001000000ae6335ad9896abd3cc00413638cb9bc62ab8054325d72e9144cf4f88702f586507e3147198e0bc4060a7c8f4dce73b653177ecf8228e6e6fae02510000000000000000000000000000f43739fdd2d24e50e0233acfe1c8639070fe00f40b0d01f8a0a35fcfe3ea10faf9c24b8488ed4ed83fb06a9a7c57442ede9e1fc2853b8f4d2241cff61d0125b7750e3fdae6a4ab9c776a191ed8098a780ea2bbaa64978cd3a6458fcc6b949bcbca0dceb7361f66e46731eba4f3aed335e7c8c541e82453218a19d39489e1525466ac93759787e767f601931d94c9c426489b741a6bc8abf475e4bf859e1ce7f7227069e9f51e25fa3d1b18dc565180a1af464a1dd697db85e2b27b90f6bd7cf1b6bc0bcd8ba552ced3d3cfbf9c9bc04f65b6f83cb40173b4bdc393d47e5da95b63a40ac18daf11e8d0706b47795fbe2b56d0ea7ffc5a59ede88621a08b25ca6ebe041317b62373a60951af33eb7954a9731aaa125add0913ed2435a207439e9122512d77096747a4b404459cebc8faff8f7a31758e630c75a1ff90402754d339dc21cf6b8e04e1aedf14df0b4aaf0e03194df3eb41ba066bc343b323a3162d7e7ba687633c2faa8f28b42364b72e3a457476fd6b2a54e670ba798172c44c4390f73fdab743a4cac88b2bd0545b8483f2e2f9846b138a4d8a3332978da70e9050417087c5ae034a735e8b448dd97014043159cbaacebfc912cf05f608e6214c04099fa311b747c37af702d134fb8eec487cfaea91150d1980464ff31cf86e3f3b950b204f6f67810c0826e4e5467c1588de9816bc627fb4662ac5fc8e38f19ec065550e5f9b16f72a91144a2e52ba9f2c6a7e2afbabc533ac731bb7ec51b8c585c2749469da331006ca4d49e136189d21ae50455834b2e75efd81c9d6352e5a814cf002f294475dab27a10d87516e405eff30", @ANYRESOCT], 0x1, 0x553b, &(0x7f00000024c0)="$eJzs3EtvG1UUAOA7TtPSJxFiwa4jVUiJVFt12lSwC9CKh0gV8ViwAsd2LLe2J4odJ2SFBEvEgn+CQGLFkt/AgjU7xALEDgnkuWNKKI9WduKk/T5pfGbujM+cO7ISnRnLAXhiLaS//pyES+FsCGEuhHAhCfl6Uiy51RieCyFcDiGU/rIkxfifA6dDCOdCCJdGyWPOpNj1+dXhlZWf3vjlm+/OnDr/xdffz27WwKw9H0LobsX13W6MWSvGu8V4bdjOY/fGsIhxR/desZ3FuNvcyDPs1sbH1fJ4vRWPz7Z2+qO42anVR7HV3szHt3rxhP1ha5wnf8Pd2na+3Whu5LHdz/LY2o917e3Hv237/UHM0yjyfZinD4PBOMbx5l4zzmfrXh7rvUExHvNmjebeKA6LWJwu1LNOI69jY5Irfby92e7t7KXD5na/nfXSlUr1hUr1Zrm6nTWag+aNcq3buHkjXWx1RoeVB81ad7WVZa1Os1LPukvpYqteL1er6eKt5ka71kur1cr1yrXyylKxdjV99c67aaeRLo7iy+3ezul2p59uZttpfMdSuly5/uJSeqWavr22nq6/dfv22vo77996785La6+/Uhz0QFnp4vK15eVy9Vp5ubp0DOY/+r/7kPMfTDL/T4qiH2H+yWSXB/6bDxjAI3ug/w/6f+DwnfT+P0yz/x+1VPr//+9/S5P3/xP1v8e1/z/B84eJ6P8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ5YP8x/+Vq+shC3zxfjF4uhZ4rtJIRQCiH8/g/mwukDOeeKPPP/cvz832r4Ngl5htE5zhTLuRDCarH89vRhXwUAAAB4fH310eXPYrceXxZmXRBHKd60KV34YEr5khDC/MKPU8pWGr08O6Vk+ef7VNibUrb8BtZTU0oWb7mdmla2hzI3Dh9fvD+YTyiJoXSk5QAAAEdi7kA42i4EAACAo/TprAtgNpIwfpQ5fhacf/P+/qPNswf2AQAAACdQMusCAAAAgEOX9/9+/w8AAAAeb/H3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4g537uU0ciOIA/GwwsP+0aLX3bWVvUEZKyDHHQAFpghJIC2mAGsgtJUQQYY+QHIEUiXGsoO+TPM7Y0W9mgMsbSwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6NJztZ4/3v97uDRnt79MntUAAAAAp2yr9bz+Y9r0f6Trv9KlP6lfREQZEadq90GMWpmDlFOd+f/q3RyeIuqEwxjjdHyPiP/peP3d9acAAAAA12uzXM2aar1ppn1PiM/UbNqUP28y5RURUU1fMqWVh+ZvprD69z2Mu0xp9QbWJFNYs+U2PH1vlGuQtkHrlFYyWdRfYt0ruxkXAADoU7sSOFOFAAAAcAVu+54A/SiOzfE547g5pQeC31o9AAAA4Asq+p4AAAAA0Lm6/vf+PwAAALhuzfv/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6NK2Ws83y9Xs3P3FB3N2+8vkWxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwBv7844CIRAGYbB3fWcy9z+sNGhobFIFwsffGAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAm9/95f/E1DiTzL02lp5HkrVTY+vU2Ds3jv4wvn4NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXOzPSwqEQBBEwZzxv5O+/2ElQc8gQgQ0PKqoRQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBFv/vl/8TUOJPMnTaWjkeStavG1lVj70Hj6MF4+zcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXOzcP28cRRQA8Hd7t5c/gDAGuTCgIFFAQ+xLSEgJBcii4CMgWc45GC4EEhckskBuoEKu0yAoEUICmS7fIXUspQldChdGogbt3u5lkxhyiszuEv9+0uy8Pa9m3uydLD/P2gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAafedeCkp4m52mBnH5Wu39jZWsn7ngT5zY+v2fNayuPOoib55++CTb7eXqycn5ionX9WfDAAAAIdDt6zvI+JOur2U9clMXv+n5TVZzf/9M+O4rOcfrPt39jaOFl+aL+v/3369+8JkopnxPNmgq2uj4eLDqfT+oyW23rOPvKKX3/n8dy/d/A1J3t98fjfN72fn25s33+3n4ZE6sgUAHsfJsi+C8uehrB80mRgAh0avUniX9X93ptmcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOqwuxlPlXEnIuZ79+LMzt7Gyn79ja3b82U7e/36VnXMbIg0IlbXRsO0xrW03ZWr1z5ZHo2Gl+sPTkREc7MXwYdTXBPx79cUH89obhX/HHTakUajQVK8P23J5yCD8rN38CM39A0JAIAnVlq0rK6/k24vZa91ZiP++uH++v+1ShxT1v93Pzp7qzpXtf4f1LbC9ltYv/jZwpWr195Yu7h8YXhh+OmbpwZvDU6fO3Pm3EJ2rxYXViMZLjadJgAAAP9j/aJV6/9k9uH9/+OVOKas/z//bvBlda6u+n9f9zb9ms4EAADgMOpPoude+fOPzj5XdPr9+GJ5ff3yYHycnJ8aH2tN9zEdKVq1/u/ONp0VAAAAUIfdzc59+//nK3FMuf//9I8v/lwdsxsRxyIuRcTw5Mql0fn6ltNqdfyhcj5Rv+mVAgAA0JRjRavu/6f58//J5JGHJCJef3Ucl//rapr6v/ve1z9V56o+/3+6viW2UjI3vh95PxfRm2s6IwAAAJ5kR4uWFfu/p9tLH/9y/IO+5/8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6vZ3AAAA//+pzDYD") syz_mount_image$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x14a0, 0x0, 0x1, 0x0, 0x0) (async) syz_mount_image$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x14a0, 0x0, 0x1, 0x0, 0x0) creat(&(0x7f0000000400)='./file0/file0\x00', 0x0) (async) r0 = creat(&(0x7f0000000400)='./file0/file0\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1840, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1402, 0x1) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) (async) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_getaddr={0x18, 0x16, 0x3c2be10bca706f15}, 0x18}}, 0x0) write(r2, &(0x7f0000000200)='\x00', 0x1) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r4, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) (async) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r4, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f000000e280)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000100)={0x50, 0x0, r5}, 0x50) (async) write$FUSE_INIT(r4, &(0x7f0000000100)={0x50, 0x0, r5}, 0x50) write$FUSE_INIT(r0, &(0x7f0000000340)={0x50, 0x0, r5, {0x7, 0x2d, 0x2, 0xffe4f764e3d640b0, 0x4, 0x2, 0xfea, 0x7, 0x0, 0x0, 0x40, 0x2}}, 0x50) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f00000002c0)=0xc) quotactl_fd$Q_GETFMT(r1, 0xffffffff80000400, r6, &(0x7f0000000300)) sendfile(r2, r1, 0x0, 0x40001) (async) sendfile(r2, r1, 0x0, 0x40001) fallocate(r0, 0x0, 0x0, 0x1000f4) shutdown(r2, 0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = socket$inet6(0xa, 0x2, 0x3a) r8 = dup(r7) bind$unix(r8, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x18) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x1}}, [@mark={0xc, 0x15, {0x35075a, 0x81}}]}, 0xc4}}, 0x2c000010) (async) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000, 0x1}}, [@mark={0xc, 0x15, {0x35075a, 0x81}}]}, 0xc4}}, 0x2c000010) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000180)={0x0, 0xfffffffffffffe4b, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {}, 0x2}}, 0xb8}}, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='veno', 0x4) 20.359862277s ago: executing program 2 (id=45): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x402580, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) (async, rerun: 32) ioctl$KVM_CAP_EXCEPTION_PAYLOAD(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000200)) (rerun: 32) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000001c0)={0x0, 0x0}) (async, rerun: 32) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 32) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000340)={0x4, 0x5}) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x9) (async) syz_emit_ethernet(0x4a, &(0x7f00000003c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x2f, 0x0, @remote, @local, {[], {{0x3c01, 0x22eb, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) (async) r5 = open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0xa, 0x13, r5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000600851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) (async) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) (async, rerun: 64) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, 0x0, 0x0) (async, rerun: 64) setsockopt$inet_tcp_int(r6, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) (async, rerun: 64) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) (async) r7 = socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xa, 0x16, &(0x7f0000000a00)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf6700000000000026060800010400074507000002000000240600000ee60000bf050000000000000f630000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ff2d350100000000009500000000000000050000000000000095000000000000001f1bd182bd43cb58074e0a16289328452c0880fe4b3af9c97925711095cc7d3ebcd8418ffdc4a1da470a14e4391c3fb6915cbff2a4911fe82664d775cdb9dfc83fa32db39b636c1866b526185f4ab35172a74e9afe751664f575306ebb2c2890a4fa79303101a652776cc2fb4f01e79cd10215d917a116350d60f27fdc244bdab56ee3ad8f5fdf82027a1215bc54045d6b9f30bdebcf053aa120397695ffd0f6e5fe24ce4b"], 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x58, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}]}}]}, 0x58}}, 0x44080) (async, rerun: 64) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000140)={0x1, 0x0, [{0x40000001, 0x7fff, 0x4, 0x31237648, 0x6, 0x2, 0x480}]}) (async, rerun: 64) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r3, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) syz_kvm_setup_syzos_vm$x86(r5, &(0x7f000024c000/0x400000)=nil) 20.029883008s ago: executing program 2 (id=47): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) gettid() futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xb0090199) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r4 = epoll_create(0x7) keyctl$clear(0x3, 0xfffffffffffffffd) keyctl$set_reqkey_keyring(0xe, 0x3) request_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)='q\xa9', 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000200)={0x90000009}) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0x4, 0x0, 0x81, 0xb, "0062ba7d82070000000000efffffffff086304"}) r5 = syz_open_pts(r3, 0x80) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x2, 0xa08b}) dup3(r5, r3, 0x80000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x1, 0x7fff0000}]}) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r6) 19.137803859s ago: executing program 2 (id=55): r0 = syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@nombcache}, {@nogrpid}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt/bmd33vjPv7b6Z15kA2tZA+ieJ2BYRv0dEX5a9fYWB7Gl+bmbs5tzMWBILC2//nVTWuzE3M1asWrxva545VIoofZbE8WRpuVMXL50ZLZcnzuf5oemzHw5NXbz03Omzo6cmTk2cGzl27OiR4RdfGHl+TeJM47qx9+PJfXtef/fqm2Mnrr7307dptXbvz5ZXx3FHN+sEVMdAutX+WaioXfZkE3W/F2yvSiedLawITemIiHR3dVX6f190xOLO64vXPm1p5YB1lf42bWm8eHYB2MSSaHUNgNYofujT49/isUFDj/+F6y9HdOfp+bmZsflb8XdGKX+9ax3LH4iIE7P/fpU+otnzEAAAq1AZ2zxbb/xXit2V52yuY0c+h9IfEfdHxM6IeCAidkXEgxGVdR+KiIezNy/0rbD8gZr80vFP6VrdOq+RdPz3UtXYb74q/vypvyPPba/E35WcPF2eOJxvk0PRtSXNDy9Txvev/vZFo2XV47/0kZZfjAXzClzrrDlBNz46PbpWG+H65Yi9nfXiT27NBKQtYE9E7G3uo3cUidNPf7Ov0Up3jn8ZazDPtPB1xFPZ/p+NmvgLyfLzk0M9UZ44PFS0iqV+/vXKW43Kv6v418D1A49kicX9X7NGVUMrlyfOTzVfxpU/Pm94TLPa9t+dvFOZs/7l/ey1C6PT0+eHI7qTNyr54piu8vrI4nsvjE73pvli/bT9HzpYv//vzN+T7v90K6WNeH9EPBoRj+V1fzwiDkTEwWXi//GVJz5YJv4kkmjd/r8cMV73++9W++9PqufrV5HoOPPDd41mzFe2/4/GbOW7NlP5/ruDlVbwLjcfAAAA3BNKEbEtktJglh7YFqXS4GD2P/y74r5SeXJq+pmTkx+dG8+uEeiPrlJxpquv6nzocDKbf2KWH8nPFRfLj+Tnjb/s6K3kB8cmy+Mtjh3a3dbb+38U/T/1V0erawesO9drQfuq7f+lFtUD2Hgr+f13LACb0+39vyf909uqugAby/E/tK96/f+TmrzxP2xOS/v/n3VuWQdsRsb/0L70f2hf+j+0pWYu54/jjRb1REQztwUoLhZY/V0FelZ8hX+7JIo7XqxnWb1x6Ux3/kqUWhRpR5ONbVMk0h6zsYUu3kMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgXvZfAAAA//8hId5P") mkdir(&(0x7f0000000040)='./file0\x00', 0x28) r1 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x81, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r4, 0x4068aea3, &(0x7f0000000000)={0xc0, 0x0, 0x4000}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x2}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r7}, 0xc) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000007, 0x2010, r5, 0x40000) r8 = getpid() fcntl$setownex(r2, 0xf, &(0x7f0000000100)={0x2, r8}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000001c0)) r9 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r9, &(0x7f0000002200)=0x20, r10, 0x0, 0xffffffff00000001, 0xd) pidfd_getfd(r10, r0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x660c, 0x0) 18.827306489s ago: executing program 2 (id=56): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000002100)=0x7, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r5 = socket$packet(0x11, 0x3, 0x300) recvfrom(r5, &(0x7f0000001080)=""/4096, 0x1000, 0x40002060, &(0x7f0000002080)=@rc={0x1f, @none, 0xa4}, 0x80) sendto$packet(r5, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r4, 0x1, 0xd8, 0x6, @multicast}, 0x14) socket$inet6(0xa, 0x800000000000002, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) syz_emit_ethernet(0x42, &(0x7f0000000180)={@local, @remote, @void, {@ipv4={0x800, @dccp={{0x9, 0x4, 0x0, 0x1, 0x34, 0x65, 0x0, 0x4, 0x21, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0xc}, {[@generic={0x83, 0x8, "a464e654cfb7"}, @cipso={0x86, 0x6, 0x2}]}}, {{0x4e21, 0x4e22, 0x4, 0x1, 0x5, 0x0, 0x0, 0x4, 0x0, "b40240", 0x3, "94125f"}}}}}}, 0x0) socket(0x11, 0x80803, 0x0) r8 = socket$inet(0x2, 0x1, 0x0) r9 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000200)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="7c0000001000010400"/20, @ANYRES32=r11, @ANYBLOB="00000000000000005c001280110001006272696467655f736c61766500000000440005800500050000000000050020000100000005000800000000000600", @ANYRES16=r8], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmmsg(r9, &(0x7f0000000000), 0x400000000000235, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x28, 0x14, 0x1, 0x70bd2b, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, r7}, [@IFA_BROADCAST={0x8, 0x4, @broadcast}, @IFA_LOCAL={0x8, 0x2, @private=0xa010100}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x40010) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x57) 18.427978902s ago: executing program 2 (id=57): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file2\x00', 0x0, &(0x7f0000000540), 0x1, 0x7a1, &(0x7f0000000f80)="$eJzs3c9rHGUfAPDvbJKmSfu+yQsvvG89BQQNlG5Mja2Ch4oHESwU9GwbNttQs8mW7KY0IWCLCF4EFQ+CXnr2R7159cdV/wsP0lI1LVY8SGQ2s+222U1322Q3ms8HJvs8M7N5nu8+M888szPsBLBnjaV/chGHIuK9JGIkm59ExEAt1R9xYmO922urhXRKYn391V+S2jq31lYL0fCe1IEs8/+I+PbtiMO5zeVWllfmpkul4mKWn6jOn5+oLK8cOTc/PVucLS4cm5yaOnr8mePHti/W335YOXj9/Zee/OLEH2/97+q73yVxIg5myxrj2C5jMZZ9JgPpR3iPF7e7sB5Lms4d7no96Ey6a/Zt7OVxKEair5ZqYaibNQMAdso6ALAHJZ2OAd40aACAv7f69wC31lYL9am330h0140XImL/Rvz165sbS/qza3b7a9dBh28l91wZSSJidBvKH4uIT756/bN0iqwdml9LA9hely5HxJnRsc39f7LpnoVOPbXVwvXB2svYfbP32vEHeunrdPzzbLPxX+7O+CeajH8Gm+y7D+PB+3/uWpbo24biNknHf8833Nt2uyH+zGhflvtXbcw3kJw9Vyqmfdu/I2I8BgbT/GRt1eYjt/Gbf95sVX7j+O/XD974NC0/fb27Ru5a/+C975mZrk4/atx1Ny5HPNbfLP7kTvsnLca/p9os4+Xn3vm41bI0/jTe+rQ5/p21fiXiiabtf7ctky3vT5yobQ4T9Y3iPul28+WPH7W8Ea6x/dMpLb9+LtANafsPbx3/aNJ4v2al8zK+vzLyTatlD46/+fa/L3mtlt6Xzbs4Xa0uTkbsS17ZPP/o3ffW8/X10/jHH2++/28U23z7T88Jz7QZf//1nz9/+Ph3Vhr/TEft33ni6u25ln13e+0/VUuNZ3Pa6f/areCjfHYAAAAAAAAAAAAAAAAAAAAAAAAA0K5cRByMJJe/k87l8vmNZ3j/N4ZzpXKlevhseWlhJmrPyh6NgVz9py5HGn4PdTL7Pfx6/uh9+acj4j8R8eHgUC2fL5RLM70OHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyB1o8/z/102CvawcA7Jj9va4AANB1jv8AsPd0dvwf2rF6AADd4/wfAPaeto//Z3a2HgBA93R6/t+3Q/UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgH+vUyZPptP772mohzc9cWF6aK184MlOszOXnlwr5QnnxfH62XJ4tFfOF8nzLf3Rp46VULp+fioWlixPVYqU6UVleOT1fXlqonj43Pz1bPF0c6FpkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANC+yvLK3HSpVFyU2DIxtDuqsWsS/fHAdSIuxW6oqsRDJRp7iaHedVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAu9xfAQAA//9Tfytg") creat(&(0x7f0000000080)='./file2\x00', 0x108) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="13000000100000000200"/20, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000d0e22e560444369e4bea926a5ed07d32409aa0059bc6752439927a3a5d1f9ef34936bcf71526aae6fcbf7aa6117228f425f0db9e21fb7d39856c32fc3b84f51b2fe35ec774e4a6bf56520b8ae08cf4f901d1388d60c336af65a4f29f8e5a3326fef04efdd81739fdc3dd16134889fbd59bb3830271c63a12de1671ad4bb6e9612027d0e5c7708281a62f08db48eaa475008f67ca101755b2c127bd62f80bf5cb5cf124b284a3692ed5f325cfc12a6d51cd0d36f4373b5564335855371e43a6f4b2c48ae225d937037e464903c6e4626e06ba1b3ab31cd55d4613035396032771d717c0cc99993f6ba36837c6fbc0b87e8641d803c95f19bb1e201c2005ab08231962df417d8ccaf861413f283787716d8961a0e8b975940ec4f30a20d2f5eb3859390506107e48d7b7a411b765337e1db0742672a3b1e5ec0a99b548922009a580d53a0c38de63a89a50310b036c01a793368ebc294ac7c63c002731f5293f39719f75c279841d4b89418c86eae6e08e40d7c13648ae89a4d44a5982bad691f597", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x85}, @generic={0x2f}, @map_fd={0x18, 0x0, 0x1, 0x0, r0}, @exit={0x95, 0x0, 0xc00}], {0x95, 0x0, 0x7000}}, &(0x7f0000000000)='GPL\x00', 0x4, 0xee, &(0x7f0000000340)=""/238}, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) pwritev2(r1, &(0x7f0000000100)=[{&(0x7f0000000040)="ff", 0x1}], 0x1, 0x5405, 0x0, 0x0) (async) write$FUSE_NOTIFY_STORE(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="2800000004000000000000000000000006000000040000000800"/39], 0x28) ioctl$PTP_PEROUT_REQUEST2(r1, 0x40383d0c, &(0x7f00000000c0)={{0x4, 0x1ff}, {0x101, 0xfffffff7}, 0x4, 0x1}) 18.405234183s ago: executing program 32 (id=57): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file2\x00', 0x0, &(0x7f0000000540), 0x1, 0x7a1, &(0x7f0000000f80)="$eJzs3c9rHGUfAPDvbJKmSfu+yQsvvG89BQQNlG5Mja2Ch4oHESwU9GwbNttQs8mW7KY0IWCLCF4EFQ+CXnr2R7159cdV/wsP0lI1LVY8SGQ2s+222U1322Q3ms8HJvs8M7N5nu8+M888szPsBLBnjaV/chGHIuK9JGIkm59ExEAt1R9xYmO922urhXRKYn391V+S2jq31lYL0fCe1IEs8/+I+PbtiMO5zeVWllfmpkul4mKWn6jOn5+oLK8cOTc/PVucLS4cm5yaOnr8mePHti/W335YOXj9/Zee/OLEH2/97+q73yVxIg5myxrj2C5jMZZ9JgPpR3iPF7e7sB5Lms4d7no96Ey6a/Zt7OVxKEair5ZqYaibNQMAdso6ALAHJZ2OAd40aACAv7f69wC31lYL9am330h0140XImL/Rvz165sbS/qza3b7a9dBh28l91wZSSJidBvKH4uIT756/bN0iqwdml9LA9hely5HxJnRsc39f7LpnoVOPbXVwvXB2svYfbP32vEHeunrdPzzbLPxX+7O+CeajH8Gm+y7D+PB+3/uWpbo24biNknHf8833Nt2uyH+zGhflvtXbcw3kJw9Vyqmfdu/I2I8BgbT/GRt1eYjt/Gbf95sVX7j+O/XD974NC0/fb27Ru5a/+C975mZrk4/atx1Ny5HPNbfLP7kTvsnLca/p9os4+Xn3vm41bI0/jTe+rQ5/p21fiXiiabtf7ctky3vT5yobQ4T9Y3iPul28+WPH7W8Ea6x/dMpLb9+LtANafsPbx3/aNJ4v2al8zK+vzLyTatlD46/+fa/L3mtlt6Xzbs4Xa0uTkbsS17ZPP/o3ffW8/X10/jHH2++/28U23z7T88Jz7QZf//1nz9/+Ph3Vhr/TEft33ni6u25ln13e+0/VUuNZ3Pa6f/areCjfHYAAAAAAAAAAAAAAAAAAAAAAAAA0K5cRByMJJe/k87l8vmNZ3j/N4ZzpXKlevhseWlhJmrPyh6NgVz9py5HGn4PdTL7Pfx6/uh9+acj4j8R8eHgUC2fL5RLM70OHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyB1o8/z/102CvawcA7Jj9va4AANB1jv8AsPd0dvwf2rF6AADd4/wfAPaeto//Z3a2HgBA93R6/t+3Q/UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgH+vUyZPptP772mohzc9cWF6aK184MlOszOXnlwr5QnnxfH62XJ4tFfOF8nzLf3Rp46VULp+fioWlixPVYqU6UVleOT1fXlqonj43Pz1bPF0c6FpkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANC+yvLK3HSpVFyU2DIxtDuqsWsS/fHAdSIuxW6oqsRDJRp7iaHedVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAu9xfAQAA//9Tfytg") creat(&(0x7f0000000080)='./file2\x00', 0x108) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="13000000100000000200"/20, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000d0e22e560444369e4bea926a5ed07d32409aa0059bc6752439927a3a5d1f9ef34936bcf71526aae6fcbf7aa6117228f425f0db9e21fb7d39856c32fc3b84f51b2fe35ec774e4a6bf56520b8ae08cf4f901d1388d60c336af65a4f29f8e5a3326fef04efdd81739fdc3dd16134889fbd59bb3830271c63a12de1671ad4bb6e9612027d0e5c7708281a62f08db48eaa475008f67ca101755b2c127bd62f80bf5cb5cf124b284a3692ed5f325cfc12a6d51cd0d36f4373b5564335855371e43a6f4b2c48ae225d937037e464903c6e4626e06ba1b3ab31cd55d4613035396032771d717c0cc99993f6ba36837c6fbc0b87e8641d803c95f19bb1e201c2005ab08231962df417d8ccaf861413f283787716d8961a0e8b975940ec4f30a20d2f5eb3859390506107e48d7b7a411b765337e1db0742672a3b1e5ec0a99b548922009a580d53a0c38de63a89a50310b036c01a793368ebc294ac7c63c002731f5293f39719f75c279841d4b89418c86eae6e08e40d7c13648ae89a4d44a5982bad691f597", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x85}, @generic={0x2f}, @map_fd={0x18, 0x0, 0x1, 0x0, r0}, @exit={0x95, 0x0, 0xc00}], {0x95, 0x0, 0x7000}}, &(0x7f0000000000)='GPL\x00', 0x4, 0xee, &(0x7f0000000340)=""/238}, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) pwritev2(r1, &(0x7f0000000100)=[{&(0x7f0000000040)="ff", 0x1}], 0x1, 0x5405, 0x0, 0x0) (async) write$FUSE_NOTIFY_STORE(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="2800000004000000000000000000000006000000040000000800"/39], 0x28) ioctl$PTP_PEROUT_REQUEST2(r1, 0x40383d0c, &(0x7f00000000c0)={{0x4, 0x1ff}, {0x101, 0xfffffff7}, 0x4, 0x1}) 5.834048821s ago: executing program 3 (id=364): pipe2(&(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4080) vmsplice(r0, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x7ffff000}], 0x1, 0x0) 5.739378465s ago: executing program 3 (id=368): fcntl$lock(0xffffffffffffffff, 0x22, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) unshare(0x24020400) r0 = socket$unix(0x1, 0x2, 0x0) connect$unix(r0, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 5.739090875s ago: executing program 3 (id=369): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000400)=0x6, 0x4) recvmmsg(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}, 0x32}], 0x1, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 5.678345606s ago: executing program 3 (id=370): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x18, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x20040080}, 0x8004) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x33, &(0x7f0000000000)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) write$binfmt_elf32(r4, &(0x7f0000000540)=ANY=[], 0x78) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f0000000080)=[{&(0x7f00000000c0)="480000001500257f09004b01fcfc8c860a881300f217e0060000e3323909b8f8896e33719fe3bb036e0bc90900000000000000000000ffff5bf1090000d0bd5e000000006203005b", 0x48}], 0x1) close(r4) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="120a0000010902240001f8fa000c0904000000034f6c83010000002100000001220000090581030089001e85ce1d00003b5600000000000000000000000000000000d06607a1a61d04e9c6ebfaa80318e482bcdc53bcf6a59a28c94f824c604adfbf08ff06fea7739dfecb6a766f820c2c94262f17fdc00118f7166088202df8b9c54fab048856f2b78d3c99fd3718b90188e84779cca1b8fd08ecaf4787e2f283ba214350f9f1b41bc58b6bcdd74a6bec3e05ad120918a28a6f"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) 2.583504272s ago: executing program 3 (id=397): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x14, &(0x7f0000000080)={0x40, 0xb, 0x16, {0x16, 0x5, "fcedfa253d9043e925819d25a1c62b23c6980000"}}, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f0000000040)={0x1, 0x100, 0x619, 0x1, 0xc, 0x5}) 1.972131703s ago: executing program 0 (id=405): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x8, &(0x7f0000000340)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) getresgid(&(0x7f0000000180), &(0x7f0000000140), &(0x7f00000000c0)) 1.703668302s ago: executing program 0 (id=406): ioctl$TCSETSW(0xffffffffffffffff, 0x5403, 0x0) getsockname$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @broadcast}, &(0x7f0000001500)=0x10) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x10, r0) ptrace$peeksig(0x4212, r0, &(0x7f0000000140)={0x0, 0x0, 0x4}, &(0x7f0000001500)) 1.451449101s ago: executing program 4 (id=410): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0x101, 0x0, 0x2, 0x0, 0x4002004c4, 0x1008, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x8000000b3, 0x8d], 0xeeee8000, 0x14d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.441004891s ago: executing program 4 (id=411): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2], 0x6f4}}, 0x0) 1.413108442s ago: executing program 4 (id=412): sendmmsg$unix(0xffffffffffffffff, &(0x7f00000048c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000600)="a77d3bfd0076835da70208c17cabe1d9611287dfac03d6c07688931bcb2a8c726be5602934304eeb1d03bb3b81c6b7d213b307a94e30008e4fb415bc2e63655deb810b30b0e8d6147b95956fb95c9ceaa1b13d05c39e2db35d78756634cbce35094d5ebfce7a195ebf907885ea1d6f9721b03b1ae6c568779f3bfbfe2a466fb8ea35867583ff602779eaa9030f249eb3e413da8156554e793e3441771a4817bf57b2a99a7e90a47bc8bba01497b17512f9c32fb7549d257236eac0721b598a40acff49701b9cae0adb56f93c5d0ade4a80230b30fdc82c32c56e9249e60ec1edc6ffa38e643b70e67701081320db9a0b3d7a00f14feb4cd6c76bef0ccaf9a1c682ebdcb0fb5cd8eed36da32b5437c0d2785338bf0748aeee43268816705fc79d65594e15700c92a67d32236e7489d60f6cc9f274a9a7f711fe25ed07c3431af287480828ed752be3f890ab910eeac672facce33a5b", 0x155}], 0x1}}], 0x1, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb4, 0x19, 0x3500551f17a01b35, 0x70bd26, 0x10000, {{@in=@multicast2, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x8, 0x2, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0xe, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0xb4}}, 0x4094) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb4, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000, 0x2}, 0x2}}, 0xb4}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 1.351741394s ago: executing program 4 (id=413): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$pokeuser(0x6, r0, 0x107, 0x4) ptrace$pokeuser(0x6, r0, 0x118, 0x1ffffffd) 1.351524184s ago: executing program 4 (id=414): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000002700)=""/79, 0x0, 0x10000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000380)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000000400)=""/198, 0x0, 0xffff1000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000340)={0x0, 0x1, 0x0, 0x0, 0x0, 0xeeee8000}) 1.351447524s ago: executing program 4 (id=415): syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100153a42908f00a71729188010203010902240001060000000904020002ff"], 0x0) io_setup(0x6, 0x0) 900.67009ms ago: executing program 0 (id=419): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x6, 0x4, 0x7900, 0x8a}, 0x50) 873.344451ms ago: executing program 0 (id=420): r0 = syz_clone(0x80, 0x0, 0x0, 0x0, 0x0, 0x0) get_robust_list(r0, &(0x7f00000006c0)=0x0, &(0x7f0000000700)) 815.555142ms ago: executing program 0 (id=421): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b) 395.682066ms ago: executing program 5 (id=424): bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000001c0)={@map, 0xffffffffffffffff, 0x1e, 0x4010}, 0x20) 395.248327ms ago: executing program 5 (id=425): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x8001, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x0, 0x800, 0x7}, {0x0, 0x0, 0xe6}, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in=@remote, 0x404d3, 0x2b}, 0x0, @in=@empty}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) close(r0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x1d, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0) 395.106967ms ago: executing program 5 (id=426): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x50032, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) syz_io_uring_setup(0x2b26, &(0x7f0000000040)={0x0, 0xacff, 0x40, 0x0, 0x22}, &(0x7f0000ffd000), 0x0, &(0x7f0000000000)) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 385.925357ms ago: executing program 5 (id=427): r0 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x9}, 0x1c) setsockopt$inet_tcp_int(r0, 0x6, 0x8, &(0x7f0000000340)=0x8009, 0x4) 375.200607ms ago: executing program 5 (id=428): mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000003, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000003c0)=[{&(0x7f0000001800)='\x00', 0x1}], 0x1, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0) write$cgroup_freezer_state(r1, &(0x7f0000000140)='FREEZING\x00', 0x9) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x25a5, 0x4) 299.54266ms ago: executing program 3 (id=429): r0 = socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) modify_ldt$write(0x1, &(0x7f0000000000)={0x80, 0x0, 0x400}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newtfilter={0x2c, 0x2c, 0x100, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0x3}, {0x0, 0x7}, {0x1, 0xfff1}}, [@TCA_CHAIN={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r3, 0x0, 0x4000000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x24, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_USERDATA={0x4}]}], {0x14, 0x11, 0x1, 0x4}}, 0x94}, 0x1, 0x0, 0x0, 0x2004c899}, 0x0) recvmmsg(r5, &(0x7f000000c2c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) setsockopt$SO_BINDTODEVICE_wg(r0, 0x1, 0x19, &(0x7f0000000180)='wg2\x00', 0x4) socket$netlink(0x10, 0x3, 0x4) 289.42393ms ago: executing program 1 (id=431): mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) unshare(0x40400) r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0xb, 0x0, &(0x7f0000000040)=0x5f) 256.028951ms ago: executing program 1 (id=432): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x0) 187.568254ms ago: executing program 1 (id=433): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000014800)={0x0, 0x0, &(0x7f00000147c0)={&(0x7f0000000000)=@allocspi={0x100, 0x16, 0x1, 0x70bd25, 0x25dfdbff, {{{@in6=@dev={0xfe, 0x80, '\x00', 0x14}, @in=@broadcast, 0x4e23, 0x0, 0x4e22, 0x3, 0x2, 0x20, 0x110, 0x6}, {@in=@loopback, 0x4d2, 0x33}, @in=@local, {0x7, 0x10, 0x7f, 0x8001, 0x8, 0x7, 0xaaf0, 0x1}, {0x500002, 0x4, 0x4, 0xffffffffffffffff}, {0x6, 0x2127268a, 0x8}, 0x703d29, 0x350a, 0xa, 0x0, 0x0, 0x10}, 0x0, 0x80000002}, [@sec_ctx={0xc, 0x8, {0x8, 0x29, 0x1, 0x4}}]}, 0x100}, 0x1, 0x0, 0x0, 0x800}, 0x48080) 187.186954ms ago: executing program 5 (id=434): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x80002, 0x88) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000002c0)={'dummy0\x00', &(0x7f0000000340)=@ethtool_rxnfc={0x2f, 0xd, 0xff, {0x3, @usr_ip4_spec={@broadcast, @local, 0x400, 0x7, 0x1, 0x22}, {0x0, @multicast, 0x404, 0xd6c0, [0x9, 0x100]}, @esp_ip4_spec={@multicast1, @broadcast, 0x8, 0x4}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0xc929, 0x5800, [0x3fdb178a, 0x6]}, 0x400, 0x4}}}) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='d=\x00', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',']) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x10400}}, 0x50) syz_fuse_handle_req(r1, &(0x7f0000008380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x0, 0x88, {0x0, 0x1b}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) ppoll(&(0x7f0000000140)=[{r3}], 0x1, 0x0, 0x0, 0x0) write$FUSE_NOTIFY_POLL(r1, &(0x7f0000000300)={0x18, 0x1, 0x0, {0x1}}, 0x18) getsockopt$inet6_buf(r0, 0x29, 0x14, &(0x7f0000000080)=""/193, &(0x7f00000001c0)=0xc1) fcntl$getownex(r0, 0x10, &(0x7f0000000200)) syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x1, 0xc0, 0x5, {0x8, 0xb, 0x0, 0x3, 0x1, 0x1, 0x30, 0x4}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xe, 0xa, 0x40000000}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x9, 0x10, 0x7, {0xa, 0x25, 0x25, 0x0, 0x7, 0x9f59}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x8, 0x5, 0x1, {0xa, 0x25, 0x25, 0xfffffff8, 0x6, 0x6}}}}}}}}]}}, 0x0) 180.129544ms ago: executing program 1 (id=435): syz_mount_image$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x10084, 0x0, 0x0, 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000002240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, {{&(0x7f0000001a00)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x20000081}}], 0x2, 0x20000000) 155.864995ms ago: executing program 1 (id=436): r0 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfc, 0x20}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f0000000240)={0x10, 0x0, 0xa03, 0x2}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x810000}, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x1}, 0xc) r7 = socket$netlink(0x10, 0x3, 0x2) bind$netlink(r7, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) r8 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x400}, 0xc) r9 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r9, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbff, 0x200000}, 0xc) r10 = socket$netlink(0x10, 0x3, 0x8) bind$netlink(r10, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x22ffffffff}, 0xc) r11 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r11, &(0x7f0000000340)={0x10, 0x0, 0x25dfdbfb, 0x200}, 0xc) r12 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r12, &(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc) r13 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r13, &(0x7f0000000280)={0x10, 0x0, 0x25dfdbfe, 0x80000}, 0xc) bind$netlink(r1, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc) r14 = socket$netlink(0x10, 0x3, 0x4) writev(r14, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff", 0x58}], 0x1) 63.578438ms ago: executing program 1 (id=437): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmmsg(r0, &(0x7f0000004c80)=[{{0x0, 0x0, &(0x7f0000002a40)=[{&(0x7f0000000580)=""/95, 0x5f}, {&(0x7f0000000940)=""/4093, 0xffd}, {&(0x7f0000000600)=""/166, 0xa6}, {&(0x7f00000006c0)=""/92, 0x5c}, {&(0x7f0000000740)=""/198, 0xc6}, {&(0x7f0000000440)=""/220, 0xdc}, {&(0x7f0000000240)=""/106, 0x6a}, {&(0x7f0000001a40)=""/4084, 0xff4}], 0x8}, 0x80000001}, {{0x0, 0x0, 0x0}, 0x4}], 0x2, 0x100, 0x0) 0s ago: executing program 0 (id=438): syz_io_uring_setup(0x5d99, 0x0, &(0x7f0000000140), &(0x7f00000003c0), &(0x7f0000000000)) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x8001, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x0, 0x800, 0x7}, {0x0, 0x0, 0xe6}, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in=@remote, 0x404d3, 0x2b}, 0x0, @in=@empty}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) close(r0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@multicast1, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x25dfdbfc, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.37' (ED25519) to the list of known hosts. [ 22.470752][ T30] audit: type=1400 audit(1774783853.485:64): avc: denied { mounton } for pid=273 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.474364][ T273] cgroup: Unknown subsys name 'net' [ 22.493521][ T30] audit: type=1400 audit(1774783853.485:65): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.520773][ T30] audit: type=1400 audit(1774783853.505:66): avc: denied { unmount } for pid=273 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.521214][ T273] cgroup: Unknown subsys name 'devices' [ 22.721665][ T273] cgroup: Unknown subsys name 'hugetlb' [ 22.727553][ T273] cgroup: Unknown subsys name 'rlimit' [ 22.869309][ T30] audit: type=1400 audit(1774783853.875:67): avc: denied { setattr } for pid=273 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.892525][ T30] audit: type=1400 audit(1774783853.885:68): avc: denied { mounton } for pid=273 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.917388][ T30] audit: type=1400 audit(1774783853.885:69): avc: denied { mount } for pid=273 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.938601][ T275] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 22.949792][ T30] audit: type=1400 audit(1774783853.965:70): avc: denied { relabelto } for pid=275 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.975358][ T30] audit: type=1400 audit(1774783853.965:71): avc: denied { write } for pid=275 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.012113][ T30] audit: type=1400 audit(1774783854.025:72): avc: denied { read } for pid=273 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.038080][ T30] audit: type=1400 audit(1774783854.025:73): avc: denied { open } for pid=273 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 23.038167][ T273] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.954032][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.961177][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.968856][ T284] device bridge_slave_0 entered promiscuous mode [ 23.976135][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.983377][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.990987][ T284] device bridge_slave_1 entered promiscuous mode [ 24.048690][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.055923][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.063423][ T283] device bridge_slave_0 entered promiscuous mode [ 24.070531][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.077593][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.085281][ T283] device bridge_slave_1 entered promiscuous mode [ 24.092248][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.099446][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.106996][ T282] device bridge_slave_0 entered promiscuous mode [ 24.124545][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.131844][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.139391][ T282] device bridge_slave_1 entered promiscuous mode [ 24.176758][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.183987][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.191567][ T285] device bridge_slave_0 entered promiscuous mode [ 24.210746][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.217819][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.225390][ T285] device bridge_slave_1 entered promiscuous mode [ 24.232161][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.239312][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.246682][ T281] device bridge_slave_0 entered promiscuous mode [ 24.255343][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.262479][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.269875][ T281] device bridge_slave_1 entered promiscuous mode [ 24.422472][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.429569][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.436876][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.443939][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.458810][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.466077][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.473405][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.480463][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.489780][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.496815][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.504166][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.511750][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.554020][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.561113][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.568405][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.575465][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.585492][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.592678][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.599975][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.607010][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.631019][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.639714][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.649804][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.657375][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.664986][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.672433][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.680788][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.688127][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.695457][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.702927][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.710179][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.718352][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.725910][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.759685][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.767969][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.776446][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.783499][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.791064][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.799128][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.807639][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.816031][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.823131][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.830642][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.838980][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.846051][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.863582][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.871842][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.879984][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.902961][ T284] device veth0_vlan entered promiscuous mode [ 24.909806][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.918382][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.926575][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.934508][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.942445][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.950570][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.970592][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.978170][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.985892][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.994463][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.002948][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.011577][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.020005][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.027036][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.034571][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.043032][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.051462][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.058599][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.066057][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.074147][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.090403][ T285] device veth0_vlan entered promiscuous mode [ 25.099627][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.107165][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.114983][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.123595][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.131992][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.139067][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.146545][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.155066][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.163496][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.170666][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.178082][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.186270][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.198438][ T284] device veth1_macvtap entered promiscuous mode [ 25.209341][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.217619][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.226115][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.234000][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.242303][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.251318][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.259741][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.275767][ T285] device veth1_macvtap entered promiscuous mode [ 25.284640][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.292960][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.301274][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.308854][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.317674][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.334519][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.342996][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.351507][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.360442][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.368751][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.377275][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.395941][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.403750][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.411473][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.420185][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.428180][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.436518][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.445203][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.453714][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.462778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.470945][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.485310][ T282] device veth0_vlan entered promiscuous mode [ 25.493022][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.500683][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.508153][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.516954][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.525751][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.534527][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.550938][ T283] device veth0_vlan entered promiscuous mode [ 25.562014][ T284] request_module fs-gadgetfs succeeded, but still no fs? [ 25.573810][ T281] device veth0_vlan entered promiscuous mode [ 25.580768][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 25.588685][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.596868][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.605763][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.614694][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.622246][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.631886][ T282] device veth1_macvtap entered promiscuous mode [ 25.647921][ T281] device veth1_macvtap entered promiscuous mode [ 25.666527][ T283] device veth1_macvtap entered promiscuous mode [ 25.673932][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.690033][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.704349][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.713129][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.721550][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.730102][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.738408][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.747241][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.755764][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.764621][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 25.797047][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.810509][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.818954][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 25.828598][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 25.837349][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.846610][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.855594][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 25.864643][ T10] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 25.952788][ T317] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 25.978546][ T305] loop3: detected capacity change from 0 to 40427 [ 25.986374][ T319] syz.2.6 uses obsolete (PF_INET,SOCK_PACKET) [ 26.080220][ T305] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 26.091856][ T305] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 26.113993][ T305] F2FS-fs (loop3): invalid crc value [ 26.141624][ T305] F2FS-fs (loop3): Found nat_bits in checkpoint [ 26.157037][ T313] loop4: detected capacity change from 0 to 40427 [ 26.212903][ T305] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 26.220771][ T305] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 26.244357][ T313] F2FS-fs (loop4): invalid crc value [ 26.266210][ T313] F2FS-fs (loop4): Found nat_bits in checkpoint [ 26.336812][ T313] F2FS-fs (loop4): Start checkpoint disabled! [ 26.343115][ T39] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.365309][ T313] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 26.394007][ T334] 9pnet: Insufficient options for proto=fd [ 26.479671][ T313] 9pnet: p9_errstr2errno: server reported unknown error e [ 26.869259][ T56] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 26.959419][ T39] usb 3-1: Using ep0 maxpacket: 32 [ 27.079377][ T6] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 27.119404][ T39] usb 3-1: unable to get BOS descriptor or descriptor too short [ 27.200127][ T39] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 27.210452][ T39] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 27.219610][ T39] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 27.239375][ T56] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 27.247972][ T56] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 27.258520][ T56] usb 5-1: config 220 has no interface number 2 [ 27.264871][ T56] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 27.278655][ T56] usb 5-1: config 220 interface 0 has no altsetting 0 [ 27.285658][ T56] usb 5-1: config 220 interface 76 has no altsetting 0 [ 27.292705][ T56] usb 5-1: config 220 interface 1 has no altsetting 0 [ 27.354511][ T349] loop3: detected capacity change from 0 to 8192 [ 27.399702][ T303] loop3: p1 < > p4 < > [ 27.403972][ T303] loop3: partition table partially beyond EOD, truncated [ 27.411527][ T303] loop3: p1 start 655360 is beyond EOD, truncated [ 27.423844][ T349] loop3: p1 < > p4 < > [ 27.428134][ T349] loop3: partition table partially beyond EOD, truncated [ 27.436410][ T349] loop3: p1 start 655360 is beyond EOD, truncated [ 27.449321][ T39] usb 3-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 27.459365][ T6] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 27.470514][ T56] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 27.479082][ T39] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.483034][ T56] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 27.488400][ T39] usb 3-1: Product: syz [ 27.498113][ T6] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 27.519777][ T39] usb 3-1: Manufacturer: syz [ 27.520682][ T56] usb 5-1: Product: syz [ 27.524616][ T39] usb 3-1: SerialNumber: syz [ 27.539249][ T6] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 27.548350][ T6] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.556584][ T56] usb 5-1: Manufacturer: syz [ 27.561313][ T56] usb 5-1: SerialNumber: syz [ 27.568037][ T6] usb 1-1: config 0 descriptor?? [ 27.625079][ T353] loop1: detected capacity change from 0 to 512 [ 27.632988][ T349] loop3: detected capacity change from 0 to 8187 [ 27.659461][ T353] ======================================================= [ 27.659461][ T353] WARNING: The mand mount option has been deprecated and [ 27.659461][ T353] and is ignored by this kernel. Remove the mand [ 27.659461][ T353] option from the mount to silence this warning. [ 27.659461][ T353] ======================================================= [ 27.699800][ T349] loop3: p1 < > p4 < > [ 27.704016][ T349] loop3: partition table partially beyond EOD, truncated [ 27.711200][ T349] loop3: p1 start 655360 is beyond EOD, truncated [ 27.731627][ T353] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 27.742543][ T353] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=c802e02c, mo2=0002] [ 27.753101][ T353] EXT4-fs (loop1): orphan cleanup on readonly fs [ 27.760251][ T353] EXT4-fs error (device loop1): ext4_clear_blocks:883: inode #11: comm syz.1.14: attempt to clear invalid blocks 1024 len 1 [ 27.774101][ T101] loop3: p1 < > p4 < > [ 27.774523][ T353] EXT4-fs (loop1): Remounting filesystem read-only [ 27.778354][ T101] loop3: partition table partially beyond EOD, [ 27.784987][ T353] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.14: bg 0: block 361: padding at end of block bitmap is not set [ 27.795464][ T101] truncated [ 27.806381][ T353] EXT4-fs (loop1): Remounting filesystem read-only [ 27.815585][ T353] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6192: Corrupt filesystem [ 27.824711][ T353] EXT4-fs (loop1): Remounting filesystem read-only [ 27.832467][ T353] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.14: invalid indirect mapped block 1811939328 (level 0) [ 27.840503][ T101] loop3: p1 start 655360 is beyond EOD, [ 27.847637][ T353] EXT4-fs (loop1): Remounting filesystem read-only [ 27.860430][ T353] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.14: invalid indirect mapped block 2185560079 (level 1) [ 27.860993][ T101] truncated [ 27.874962][ T353] EXT4-fs (loop1): Remounting filesystem read-only [ 27.887135][ T39] usb 3-1: USB disconnect, device number 2 [ 27.893687][ T353] EXT4-fs (loop1): 1 truncate cleaned up [ 27.902085][ T353] EXT4-fs (loop1): mounted filesystem without journal. Opts: jqfmt=vfsold,noblock_validity,discard,errors=remount-ro,sb=0x0000000000000009. Quota mode: none. [ 27.929414][ T56] usb 5-1: selecting invalid altsetting 0 [ 27.935363][ T56] usb 5-1: Found UVC 7.01 device syz (8086:0b07) [ 27.948576][ T56] usb 5-1: No valid video chain found. [ 27.995781][ T303] udevd[303]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 28.015454][ T349] loop3: detected capacity change from 0 to 8187 [ 28.032155][ T56] usb 5-1: USB disconnect, device number 2 [ 28.043280][ T365] netlink: 20 bytes leftover after parsing attributes in process `syz.1.15'. [ 28.059799][ T303] loop3: p1 < > p4 < > [ 28.064050][ T303] loop3: partition table partially beyond EOD, truncated [ 28.074120][ T303] loop3: p1 start 655360 is beyond EOD, truncated [ 28.082982][ T349] loop3: p1 < > p4 < > [ 28.087267][ T349] loop3: partition table partially beyond EOD, truncated [ 28.099956][ T349] loop3: p1 start 655360 is beyond EOD, truncated [ 28.108947][ T30] kauditd_printk_skb: 67 callbacks suppressed [ 28.108961][ T30] audit: type=1326 audit(1774783859.115:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe65d07a819 code=0x7ffc0000 [ 28.144463][ T325] udevd[325]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 28.151312][ T371] loop1: detected capacity change from 0 to 128 [ 28.170256][ T30] audit: type=1326 audit(1774783859.155:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7fe65d07a819 code=0x7ffc0000 [ 28.195181][ T30] audit: type=1326 audit(1774783859.155:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe65d07a819 code=0x7ffc0000 [ 28.219322][ T30] audit: type=1326 audit(1774783859.155:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7fe65d07a819 code=0x7ffc0000 [ 28.243590][ T30] audit: type=1326 audit(1774783859.155:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fe65d07a582 code=0x7ffc0000 [ 28.267072][ T30] audit: type=1326 audit(1774783859.155:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fe65d03b04e code=0x7ffc0000 [ 28.290997][ T30] audit: type=1326 audit(1774783859.165:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7fe65d07a647 code=0x7ffc0000 [ 28.321171][ T6] playstation 0003:054C:0DF2.0001: item fetching failed at offset 0/5 [ 28.336903][ T30] audit: type=1326 audit(1774783859.165:148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe65d03b04e code=0x7ffc0000 [ 28.369400][ T6] playstation 0003:054C:0DF2.0001: Parse failed [ 28.378374][ T6] playstation: probe of 0003:054C:0DF2.0001 failed with error -22 [ 28.393878][ T30] audit: type=1326 audit(1774783859.165:149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe65d07a4ab code=0x7ffc0000 [ 28.417632][ T30] audit: type=1326 audit(1774783859.185:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=370 comm="syz.1.16" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fe65d03b04e code=0x7ffc0000 [ 29.845117][ T381] loop3: detected capacity change from 0 to 40427 [ 29.860498][ T380] futex_wake_op: syz.2.18 tries to shift op by 144; fix this program [ 29.880305][ T381] F2FS-fs (loop3): Corrupted extension count (64 + 1 > 64) [ 29.887712][ T381] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 29.896763][ T381] F2FS-fs (loop3): Unrecognized mount option "checkpoint=enabºlS2le" or missing value [ 29.993890][ T383] usb 1-1: USB disconnect, device number 2 [ 30.000150][ T45] attempt to access beyond end of device [ 30.000150][ T45] loop4: rw=2049, want=40968, limit=40427 [ 30.042154][ T45] attempt to access beyond end of device [ 30.042154][ T45] loop4: rw=2049, want=40984, limit=40427 [ 30.210535][ T354] udevd[354]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 30.272366][ T399] netlink: 'syz.0.24': attribute type 1 has an invalid length. [ 30.305068][ T354] udevd[354]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 30.523554][ T354] udevd[354]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 30.678864][ T354] udevd[354]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 30.695656][ T354] udevd[354]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 30.790973][ T421] loop0: detected capacity change from 0 to 1024 [ 30.839041][ T421] EXT4-fs (loop0): Ignoring removed bh option [ 30.845272][ T421] EXT4-fs (loop0): Ignoring removed oldalloc option [ 30.852076][ T421] EXT4-fs (loop0): Ignoring removed nomblk_io_submit option [ 30.859547][ T421] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 30.914781][ T421] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e841c01c, mo2=0003] [ 30.923225][ T421] System zones: 0-1, 3-36 [ 31.193620][ T421] EXT4-fs (loop0): mounted filesystem without journal. Opts: bh,delalloc,oldalloc,debug,dioread_nolock,bsddf,nomblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: writeback. [ 31.413292][ T421] overlayfs: missing 'lowerdir' [ 31.596008][ T421] syz.0.28 (421) used greatest stack depth: 21184 bytes left [ 31.747929][ T417] loop1: detected capacity change from 0 to 40427 [ 31.844501][ T436] futex_wake_op: syz.3.32 tries to shift op by 144; fix this program [ 31.866257][ T417] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 31.919808][ T417] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 31.946742][ T417] F2FS-fs (loop1): invalid crc value [ 32.066493][ T417] F2FS-fs (loop1): Found nat_bits in checkpoint [ 32.319001][ T417] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 32.328656][ T417] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 32.563922][ T452] loop2: detected capacity change from 0 to 256 [ 32.661927][ T452] FAT-fs (loop2): Unrecognized mount option "iocgarset=cp862" or missing value [ 32.694315][ T454] loop3: detected capacity change from 0 to 512 [ 32.741991][ T454] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 32.789663][ T454] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 32.819800][ T454] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2807: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 32.833372][ T454] EXT4-fs (loop3): 1 truncate cleaned up [ 32.839041][ T454] EXT4-fs (loop3): mounted filesystem without journal. Opts: journal_ioprio=0x0000000000000001,auto_da_alloc=0x0000000000000eb0,debug_want_extra_isize=0x0000000000000068,lazytime,nombcache,inode_readahead_blks=0x0000000004000000,noquota,,errors=continue. Quota mode: none. [ 33.087780][ T462] loop3: detected capacity change from 0 to 8192 [ 33.109643][ T462] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 33.204313][ T458] loop2: detected capacity change from 0 to 40427 [ 33.224061][ T458] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 33.268185][ T458] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 33.322776][ T458] F2FS-fs (loop2): Found nat_bits in checkpoint [ 33.355886][ T475] xt_hashlimit: size too large, truncated to 1048576 [ 33.421523][ T30] kauditd_printk_skb: 65 callbacks suppressed [ 33.421537][ T30] audit: type=1400 audit(1774783864.435:216): avc: denied { create } for pid=474 comm="syz.0.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 33.459630][ T458] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 33.469940][ T464] loop1: detected capacity change from 0 to 40427 [ 33.477014][ T458] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 33.577255][ T30] audit: type=1400 audit(1774783864.585:217): avc: denied { write } for pid=457 comm="syz.2.37" name="file0" dev="loop2" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 33.809700][ T30] audit: type=1400 audit(1774783864.585:218): avc: denied { add_name } for pid=457 comm="syz.2.37" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 33.953037][ T490] loop1: detected capacity change from 0 to 512 [ 34.050828][ T490] EXT4-fs (loop1): mounted filesystem without journal. Opts: errors=remount-ro,sb=0x0000000000000001,. Quota mode: writeback. [ 34.065281][ T30] audit: type=1400 audit(1774783865.075:219): avc: denied { unmount } for pid=285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 34.129366][ T490] ext4 filesystem being mounted at /11/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 34.194797][ T30] audit: type=1400 audit(1774783865.205:220): avc: denied { rmdir } for pid=489 comm="syz.1.44" name="file0" dev="loop1" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 34.228982][ T490] EXT4-fs warning (device loop1): ext4_empty_dir:3147: inode #12: comm syz.1.44: directory missing '.' [ 34.438924][ T503] futex_wake_op: syz.2.47 tries to shift op by 144; fix this program [ 34.524803][ T510] loop1: detected capacity change from 0 to 16 [ 34.574696][ T510] erofs: Unknown parameter '0xffffffffffffffffÿÿ' [ 34.797152][ T508] loop3: detected capacity change from 0 to 40427 [ 34.817931][ T508] F2FS-fs (loop3): Invalid SB checksum offset: 0 [ 34.845070][ T508] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 34.861202][ T501] loop4: detected capacity change from 0 to 40427 [ 34.867979][ T508] F2FS-fs (loop3): invalid crc value [ 34.890401][ T501] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 34.903778][ T508] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 34.908514][ T501] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 34.935362][ T508] F2FS-fs (loop3): NAT is corrupt, run fsck to fix it [ 34.942678][ T501] F2FS-fs (loop4): invalid crc value [ 34.950679][ T508] F2FS-fs (loop3): Failed to initialize F2FS node manager (-22) [ 34.969368][ T501] F2FS-fs (loop4): Found nat_bits in checkpoint [ 35.024109][ T523] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 35.040289][ T501] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 35.047396][ T501] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 35.171019][ T527] syz.3.53 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 35.241999][ T529] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: inode #12: comm syz.2.55: missing EA_INODE flag [ 35.259427][ T529] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.55: error while reading EA inode 12 err=-117 [ 35.290925][ T529] EXT4-fs (loop2): 1 orphan inode deleted [ 35.296722][ T529] EXT4-fs (loop2): mounted filesystem without journal. Opts: nombcache,nogrpid,,errors=continue. Quota mode: writeback. [ 35.309273][ T56] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 35.447494][ T30] audit: type=1400 audit(1774783866.455:221): avc: denied { rmdir } for pid=282 comm="syz-executor" name="file0" dev="loop2" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 35.709335][ T286] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 35.921878][ T512] F2FS-fs (loop0): invalid crc value [ 35.953836][ T512] F2FS-fs (loop0): Found nat_bits in checkpoint [ 35.960243][ T56] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 35.992368][ T30] audit: type=1400 audit(1774783867.005:222): avc: denied { mounton } for pid=544 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 36.016957][ T512] F2FS-fs (loop0): Cannot turn on quotas: -2 on 2 [ 36.049758][ T512] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 [ 36.089290][ T56] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 36.106882][ T56] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 36.113555][ T286] usb 5-1: Using ep0 maxpacket: 8 [ 36.115795][ T56] usb 2-1: SerialNumber: syz [ 36.135745][ T30] audit: type=1400 audit(1774783867.145:223): avc: denied { create } for pid=550 comm="syz.3.59" dev="anon_inodefs" ino=16722 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 36.158317][ T30] audit: type=1400 audit(1774783867.145:224): avc: denied { ioctl } for pid=550 comm="syz.3.59" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=16722 ioctlcmd=0xaa3f scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 36.197035][ T549] xt_hashlimit: size too large, truncated to 1048576 [ 36.198852][ T544] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.210979][ T544] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.218911][ T544] device bridge_slave_0 entered promiscuous mode [ 36.231142][ T544] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.239340][ T30] audit: type=1400 audit(1774783867.245:225): avc: denied { append } for pid=511 comm="syz.0.51" name="file1" dev="loop0" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 36.300137][ T544] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.483635][ T559] F2FS-fs (loop3): Wrong NAT boundary, start(2560) end(3584) blocks(83968) [ 36.492332][ T559] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 36.501791][ T559] F2FS-fs (loop3): Fix alignment : done, start(4096) end(16896) block(12288) [ 36.511596][ T559] F2FS-fs (loop3): invalid crc value [ 36.533252][ T544] device bridge_slave_1 entered promiscuous mode [ 36.549776][ T559] F2FS-fs (loop3): Found nat_bits in checkpoint [ 36.590861][ T559] F2FS-fs (loop3): Start checkpoint disabled! [ 36.603818][ T559] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 36.610926][ T559] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 36.629097][ T286] usb 5-1: config 1 interface 0 altsetting 137 endpoint 0x81 has an invalid bInterval 129, changing to 11 [ 36.649160][ T286] usb 5-1: config 1 interface 0 has no altsetting 0 [ 36.718849][ T544] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.725950][ T544] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.733299][ T544] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.740368][ T544] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.769818][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 36.777892][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.785619][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.803387][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 36.811837][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.820008][ T286] usb 5-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.40 [ 36.829069][ T286] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.837613][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.844690][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 36.852065][ T286] usb 5-1: Product: syz [ 36.856247][ T286] usb 5-1: Manufacturer: syz [ 36.861205][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 36.869330][ T286] usb 5-1: SerialNumber: syz [ 36.875138][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.887945][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.895040][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 36.914559][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 36.922968][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 36.931574][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 36.939498][ T56] cdc_ether: probe of 2-1:1.0 failed with error -22 [ 36.940631][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 36.958538][ T379] device bridge_slave_1 left promiscuous mode [ 36.965530][ T379] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.976966][ T379] device bridge_slave_0 left promiscuous mode [ 36.984471][ T379] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.993800][ T379] device veth1_macvtap left promiscuous mode [ 37.000371][ T379] device veth0_vlan left promiscuous mode [ 37.092262][ T544] device veth0_vlan entered promiscuous mode [ 37.109296][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 37.124395][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 37.139685][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 37.159743][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 37.176011][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 37.193386][ T384] usb 2-1: USB disconnect, device number 2 [ 37.200892][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 37.213788][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 37.229902][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 37.246592][ T544] device veth1_macvtap entered promiscuous mode [ 37.270472][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 37.283224][ T570] netlink: 4 bytes leftover after parsing attributes in process `syz.1.64'. [ 37.292982][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 37.301459][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 37.345497][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 37.371857][ T309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 37.389283][ T286] usbhid 5-1:1.0: can't add hid device: -71 [ 37.406278][ T286] usbhid: probe of 5-1:1.0 failed with error -71 [ 37.424030][ T286] usb 5-1: USB disconnect, device number 3 [ 37.507445][ T583] set_capacity_and_notify: 3 callbacks suppressed [ 37.507462][ T583] loop5: detected capacity change from 0 to 512 [ 37.522779][ T586] futex_wake_op: syz.1.65 tries to shift op by 144; fix this program [ 37.640998][ T583] EXT4-fs (loop5): Quota format mount options ignored when QUOTA feature is enabled [ 37.689775][ T583] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #11: comm syz.5.66: invalid indirect mapped block 256 (level 2) [ 37.703987][ T583] EXT4-fs (loop5): 2 truncates cleaned up [ 37.710542][ T583] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpid,auto_da_alloc,jqfmt=vfsold,journal_dev=0x0000000000000006,,errors=continue. Quota mode: writeback. [ 37.744456][ T582] EXT4-fs error (device loop5): ext4_validate_block_bitmap:429: comm syz.5.66: bg 0: block 5: invalid block bitmap [ 37.990396][ T631] netlink: 'syz.4.84': attribute type 1 has an invalid length. [ 38.026189][ T638] capability: warning: `syz.4.87' uses deprecated v2 capabilities in a way that may be insecure [ 38.184526][ T662] netlink: 12 bytes leftover after parsing attributes in process `syz.3.98'. [ 38.295318][ T676] 9pnet: Insufficient options for proto=fd [ 38.402177][ T696] fuse: Invalid rootmode [ 38.462878][ T700] xt_hashlimit: size too large, truncated to 1048576 [ 38.471712][ T702] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 38.530731][ T706] overlayfs: overlapping lowerdir path [ 38.655209][ T723] loop4: detected capacity change from 0 to 256 [ 38.703109][ T730] netlink: 24 bytes leftover after parsing attributes in process `syz.0.131'. [ 38.820198][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 38.820213][ T30] audit: type=1400 audit(1774783869.835:251): avc: denied { write } for pid=741 comm="syz.3.137" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 38.863946][ T748] netlink: 4 bytes leftover after parsing attributes in process `syz.4.139'. [ 38.897942][ T752] xt_hashlimit: size too large, truncated to 1048576 [ 39.006161][ T759] loop0: detected capacity change from 0 to 512 [ 39.169340][ T30] audit: type=1400 audit(1774783870.155:252): avc: denied { ioctl } for pid=751 comm="syz.5.142" path="socket:[17966]" dev="sockfs" ino=17966 ioctlcmd=0x8954 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 39.244640][ T764] loop4: detected capacity change from 0 to 16 [ 39.283019][ T759] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 39.323440][ T30] audit: type=1400 audit(1774783870.225:253): avc: denied { create } for pid=751 comm="syz.5.142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 39.399523][ T764] erofs: Unknown parameter '¸ÊÏ!' [ 39.448344][ T767] cgroup: none used incorrectly [ 39.559382][ T772] af_packet: tpacket_rcv: packet too big, clamped from 240 to 4294967272. macoff=96 [ 39.606734][ T30] audit: type=1400 audit(1774783870.615:254): avc: denied { ioctl } for pid=771 comm="syz.4.147" path="socket:[17354]" dev="sockfs" ino=17354 ioctlcmd=0xf509 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 39.684507][ T30] audit: type=1400 audit(1774783870.695:255): avc: denied { lock } for pid=780 comm="syz.5.149" path="socket:[17991]" dev="sockfs" ino=17991 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 39.778580][ T770] loop1: detected capacity change from 0 to 40427 [ 39.792509][ T30] audit: type=1400 audit(1774783870.805:256): avc: denied { connect } for pid=791 comm="syz.4.154" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 39.904060][ T30] audit: type=1400 audit(1774783870.915:257): avc: denied { name_bind } for pid=797 comm="syz.0.157" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 40.058419][ T819] netlink: 128 bytes leftover after parsing attributes in process `syz.5.166'. [ 40.093849][ T30] audit: type=1400 audit(1774783871.105:258): avc: denied { read } for pid=821 comm="syz.5.167" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 40.145241][ T30] audit: type=1400 audit(1774783871.135:259): avc: denied { read } for pid=824 comm="syz.0.168" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 40.202111][ T833] netlink: 4 bytes leftover after parsing attributes in process `syz.0.172'. [ 40.211290][ T833] device bridge_slave_1 left promiscuous mode [ 40.217548][ T833] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.230587][ T833] device bridge_slave_0 left promiscuous mode [ 40.240096][ T833] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.436209][ T30] audit: type=1400 audit(1774783871.445:260): avc: denied { setopt } for pid=842 comm="syz.0.175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 40.596790][ T770] loop1: detected capacity change from 0 to 40427 [ 41.099213][ T384] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 41.370991][ T883] netlink: 4 bytes leftover after parsing attributes in process `syz.5.194'. [ 41.469318][ T384] usb 2-1: config 0 has an invalid interface number: 92 but max is 0 [ 41.477908][ T384] usb 2-1: config 0 has no interface number 0 [ 41.484564][ T384] usb 2-1: config 0 interface 92 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 41.495272][ T384] usb 2-1: config 0 interface 92 altsetting 0 has an invalid endpoint with address 0x94, skipping [ 41.506426][ T384] usb 2-1: config 0 interface 92 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 41.519689][ T384] usb 2-1: New USB device found, idVendor=093b, idProduct=a005, bcdDevice= 9.81 [ 41.528905][ T384] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 41.537664][ T384] usb 2-1: config 0 descriptor?? [ 41.567633][ T863] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 41.781292][ T384] usb 2-1: USB disconnect, device number 3 [ 42.569236][ T324] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 42.890112][ T961] device batadv_slave_0 entered promiscuous mode [ 42.929366][ T324] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 42.940542][ T324] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 42.950458][ T324] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 42.963654][ T324] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 42.972755][ T324] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.981445][ T324] usb 1-1: config 0 descriptor?? [ 43.509340][ T324] usbhid 1-1:0.0: can't add hid device: -71 [ 43.515760][ T324] usbhid: probe of 1-1:0.0 failed with error -71 [ 43.524712][ T324] usb 1-1: USB disconnect, device number 3 [ 44.343626][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 44.343642][ T30] audit: type=1400 audit(1774783875.355:275): avc: denied { create } for pid=997 comm="syz.4.242" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 44.382691][ T30] audit: type=1326 audit(1774783875.395:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=997 comm="syz.4.242" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d383c2819 code=0x7ffc0000 [ 44.406050][ T30] audit: type=1326 audit(1774783875.395:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=997 comm="syz.4.242" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d383c2819 code=0x7ffc0000 [ 44.429370][ T30] audit: type=1326 audit(1774783875.415:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=997 comm="syz.4.242" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0d383c24ab code=0x7ffc0000 [ 44.452742][ T30] audit: type=1326 audit(1774783875.415:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=997 comm="syz.4.242" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0d383c24ab code=0x7ffc0000 [ 44.475936][ T30] audit: type=1326 audit(1774783875.415:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=997 comm="syz.4.242" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0d383c24ab code=0x7ffc0000 [ 44.499313][ T30] audit: type=1326 audit(1774783875.415:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=997 comm="syz.4.242" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0d383c24ab code=0x7ffc0000 [ 44.522931][ T30] audit: type=1326 audit(1774783875.415:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=997 comm="syz.4.242" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0d383c24ab code=0x7ffc0000 [ 44.546175][ T30] audit: type=1326 audit(1774783875.415:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=997 comm="syz.4.242" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0d383c24ab code=0x7ffc0000 [ 44.569566][ T30] audit: type=1326 audit(1774783875.415:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=997 comm="syz.4.242" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0d383c24ab code=0x7ffc0000 [ 44.669225][ T384] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 44.795153][ T1009] device bridge0 entered promiscuous mode [ 44.801237][ T1009] device vlan3 entered promiscuous mode [ 44.909218][ T384] usb 5-1: Using ep0 maxpacket: 16 [ 45.029327][ T384] usb 5-1: config 3 has an invalid interface number: 155 but max is 0 [ 45.037701][ T384] usb 5-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 45.048018][ T384] usb 5-1: config 3 has no interface number 0 [ 45.054308][ T384] usb 5-1: config 3 interface 155 has no altsetting 0 [ 45.219371][ T384] usb 5-1: New USB device found, idVendor=05a9, idProduct=264a, bcdDevice=e5.4c [ 45.228529][ T384] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.236618][ T384] usb 5-1: Product: syz [ 45.240831][ T384] usb 5-1: Manufacturer: syz [ 45.245436][ T384] usb 5-1: SerialNumber: syz [ 45.453086][ T1034] netlink: 12 bytes leftover after parsing attributes in process `syz.1.259'. [ 45.463888][ T1034] device vlan2 entered promiscuous mode [ 45.469872][ T1034] device bridge0 entered promiscuous mode [ 45.874502][ T1049] netlink: 164 bytes leftover after parsing attributes in process `syz.0.266'. [ 46.088146][ T1068] netlink: 'syz.0.275': attribute type 4 has an invalid length. [ 46.136900][ T1071] netlink: 20 bytes leftover after parsing attributes in process `syz.0.277'. [ 46.179939][ T384] usb 5-1: USB disconnect, device number 4 [ 46.229241][ T6] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 46.344632][ T1096] netlink: 72 bytes leftover after parsing attributes in process `syz.5.288'. [ 46.367580][ T1098] netlink: 16 bytes leftover after parsing attributes in process `syz.5.289'. [ 46.589267][ T6] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 46.597947][ T6] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 46.608082][ T6] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 46.617084][ T6] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 46.708027][ T1110] device syzkaller0 entered promiscuous mode [ 46.715537][ T1110] tipc: Started in network mode [ 46.720502][ T1110] tipc: Node identity 927bacdfd561, cluster identity 4711 [ 46.727795][ T1110] tipc: Enabled bearer , priority 0 [ 46.734624][ T384] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 46.743057][ T1109] tipc: Resetting bearer [ 46.752539][ T6] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 46.765810][ T1109] tipc: Disabling bearer [ 46.771643][ T6] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 46.779943][ T6] usb 4-1: Product: syz [ 46.785459][ T6] usb 4-1: Manufacturer: syz [ 46.829796][ T6] cdc_wdm 4-1:1.0: skipping garbage [ 46.837224][ T6] cdc_wdm 4-1:1.0: skipping garbage [ 46.842557][ T6] cdc_wdm: probe of 4-1:1.0 failed with error -22 [ 46.879575][ T1120] netlink: 164 bytes leftover after parsing attributes in process `syz.4.300'. [ 46.979280][ T384] usb 6-1: Using ep0 maxpacket: 8 [ 47.031320][ T6] usb 4-1: USB disconnect, device number 2 [ 47.049996][ T1143] netlink: 8 bytes leftover after parsing attributes in process `syz.1.310'. [ 47.099354][ T384] usb 6-1: config 6 has an invalid interface number: 2 but max is 0 [ 47.107720][ T384] usb 6-1: config 6 has no interface number 0 [ 47.114150][ T384] usb 6-1: config 6 interface 2 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 47.124001][ T384] usb 6-1: config 6 interface 2 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 47.299302][ T384] usb 6-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 47.308690][ T384] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.316998][ T384] usb 6-1: Product: syz [ 47.321377][ T384] usb 6-1: Manufacturer: syz [ 47.326063][ T384] usb 6-1: SerialNumber: syz [ 47.571610][ T6] usb 6-1: USB disconnect, device number 2 [ 48.088482][ T1214] netlink: 8 bytes leftover after parsing attributes in process `syz.0.342'. [ 48.417979][ T1257] netlink: 36 bytes leftover after parsing attributes in process `syz.3.360'. [ 48.427392][ T1257] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.434697][ T1257] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.750594][ T1282] loop5: detected capacity change from 0 to 7 [ 49.001819][ T1290] netlink: 4 bytes leftover after parsing attributes in process `syz.5.375'. [ 49.148909][ T1282] process 'syz.3.370' launched './file0' with NULL argv: empty string added [ 49.449242][ T286] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 49.479277][ T324] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 49.537280][ T1318] device syzkaller0 entered promiscuous mode [ 49.719304][ T286] usb 4-1: device descriptor read/64, error -71 [ 49.839437][ T324] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 49.850157][ T324] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 49.863315][ T324] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 49.872425][ T324] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.881582][ T324] usb 2-1: config 0 descriptor?? [ 49.919908][ T324] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 50.119330][ T286] usb 4-1: device descriptor read/64, error -71 [ 50.324133][ T1332] tipc: Started in network mode [ 50.329023][ T1332] tipc: Node identity 0a9a8578001d, cluster identity 4711 [ 50.336301][ T1332] tipc: Enabled bearer , priority 0 [ 50.343487][ T1332] device syzkaller0 entered promiscuous mode [ 50.357098][ T1332] tipc: Resetting bearer [ 50.363641][ T1331] tipc: Resetting bearer [ 50.373505][ T1331] tipc: Disabling bearer [ 50.389340][ T286] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 50.429257][ T6] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 50.659304][ T286] usb 4-1: device descriptor read/64, error -71 [ 50.669309][ T6] usb 1-1: Using ep0 maxpacket: 8 [ 50.829345][ T6] usb 1-1: unable to get BOS descriptor or descriptor too short [ 50.909300][ T6] usb 1-1: config 8 has an invalid interface number: 255 but max is 0 [ 50.918579][ T6] usb 1-1: config 8 has no interface number 0 [ 50.924748][ T6] usb 1-1: config 8 interface 255 has no altsetting 0 [ 51.049409][ T286] usb 4-1: device descriptor read/64, error -71 [ 51.089293][ T6] usb 1-1: New USB device found, idVendor=0423, idProduct=000a, bcdDevice= 0.00 [ 51.098376][ T6] usb 1-1: New USB device strings: Mfr=229, Product=1, SerialNumber=3 [ 51.106631][ T6] usb 1-1: Product: syz [ 51.110929][ T6] usb 1-1: Manufacturer: syz [ 51.115540][ T6] usb 1-1: SerialNumber: syz [ 51.124151][ T30] kauditd_printk_skb: 114 callbacks suppressed [ 51.124165][ T30] audit: type=1400 audit(1774783882.135:399): avc: denied { create } for pid=1344 comm="syz.4.396" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 51.151727][ T30] audit: type=1400 audit(1774783882.165:400): avc: denied { setopt } for pid=1344 comm="syz.4.396" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 51.179290][ T286] usb usb4-port1: attempt power cycle [ 51.470220][ T6] usb 1-1: USB disconnect, device number 4 [ 51.599236][ T286] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 51.709283][ T286] usb 4-1: device descriptor read/8, error -71 [ 51.920514][ T286] usb 4-1: device descriptor read/8, error -71 [ 52.217300][ T6] usb 2-1: USB disconnect, device number 4 [ 52.409212][ T286] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 52.584382][ T30] audit: type=1326 audit(1774783883.595:401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1373 comm="syz.0.406" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc4cb2ae819 code=0x0 [ 52.639269][ T286] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 52.650309][ T286] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 52.660390][ T286] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 52.673948][ T286] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 52.683043][ T286] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 52.695905][ T286] usb 4-1: config 0 descriptor?? [ 52.792323][ T30] audit: type=1400 audit(1774783883.805:402): avc: denied { create } for pid=1379 comm="syz.4.408" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 52.887624][ T1387] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.411'. [ 53.146294][ T30] audit: type=1326 audit(1774783884.155:403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1400 comm="syz.1.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe65d07a819 code=0x7ffc0000 [ 53.174905][ T30] audit: type=1326 audit(1774783884.155:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1400 comm="syz.1.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe65d07a819 code=0x7ffc0000 [ 53.198965][ T30] audit: type=1326 audit(1774783884.155:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1400 comm="syz.1.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe65d07a819 code=0x7ffc0000 [ 53.203307][ T286] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x4 [ 53.225715][ T30] audit: type=1326 audit(1774783884.155:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1400 comm="syz.1.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fe65d07a819 code=0x7ffc0000 [ 53.232189][ T286] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 53.254396][ T30] audit: type=1326 audit(1774783884.155:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1400 comm="syz.1.417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe65d07a819 code=0x7ffc0000 [ 53.260970][ T39] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 53.293818][ T286] plantronics 0003:047F:FFFF.0002: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 53.470192][ T6] usb 4-1: USB disconnect, device number 6 [ 53.529223][ T39] usb 5-1: Using ep0 maxpacket: 8 [ 53.649384][ T39] usb 5-1: config 6 has an invalid interface number: 2 but max is 0 [ 53.658613][ T39] usb 5-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 53.672598][ T39] usb 5-1: config 6 has no interface number 0 [ 53.680957][ T39] usb 5-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 53.849387][ T39] usb 5-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 53.858564][ T39] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.866779][ T39] usb 5-1: Product: syz [ 53.871184][ T39] usb 5-1: Manufacturer: syz [ 53.875852][ T39] usb 5-1: SerialNumber: syz [ 53.898544][ T1423] netlink: 168 bytes leftover after parsing attributes in process `syz.5.425'. [ 54.035025][ T30] audit: type=1400 audit(1774783885.045:408): avc: denied { getopt } for pid=1435 comm="syz.1.431" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 54.104318][ T1441] netlink: 8 bytes leftover after parsing attributes in process `syz.1.433'. [ 54.122875][ T324] usb 5-1: USB disconnect, device number 5 [ 54.361187][ T1453] ================================================================== [ 54.369284][ T1453] BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x606/0x6c0 [ 54.378495][ T1453] Read of size 1 at addr ffff88812896a3f8 by task syz.0.438/1453 [ 54.386226][ T1453] [ 54.388573][ T1453] CPU: 1 PID: 1453 Comm: syz.0.438 Not tainted syzkaller #0 [ 54.395857][ T1453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 54.405932][ T1453] Call Trace: [ 54.409247][ T1453] [ 54.412183][ T1453] __dump_stack+0x21/0x30 [ 54.416670][ T1453] dump_stack_lvl+0x110/0x170 [ 54.421366][ T1453] ? show_regs_print_info+0x20/0x20 [ 54.426583][ T1453] ? load_image+0x3e0/0x3e0 [ 54.431103][ T1453] ? unwind_get_return_address+0x4d/0x90 [ 54.436744][ T1453] print_address_description+0x7f/0x2c0 [ 54.442298][ T1453] ? xfrm_policy_inexact_list_reinsert+0x606/0x6c0 [ 54.448810][ T1453] kasan_report+0xf1/0x140 [ 54.453263][ T1453] ? xfrm_policy_inexact_list_reinsert+0x606/0x6c0 [ 54.459784][ T1453] __asan_report_load1_noabort+0x14/0x20 [ 54.465425][ T1453] xfrm_policy_inexact_list_reinsert+0x606/0x6c0 [ 54.471752][ T1453] xfrm_policy_inexact_insert_node+0x938/0xb50 [ 54.477903][ T1453] ? xfrm_netlink_rcv+0x72/0x90 [ 54.482763][ T1453] ? netlink_unicast+0x876/0xa40 [ 54.487714][ T1453] ? netlink_sendmsg+0x879/0xb80 [ 54.492646][ T1453] ? ____sys_sendmsg+0x5b7/0x8f0 [ 54.497583][ T1453] ? ___sys_sendmsg+0x236/0x2e0 [ 54.502435][ T1453] ? x64_sys_call+0x4b/0x9a0 [ 54.507024][ T1453] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 54.513113][ T1453] xfrm_policy_inexact_alloc_chain+0x53d/0xb30 [ 54.519390][ T1453] xfrm_policy_inexact_insert+0x70/0x1130 [ 54.525117][ T1453] ? __kasan_check_write+0x14/0x20 [ 54.530245][ T1453] ? _raw_spin_lock_bh+0x94/0xf0 [ 54.535215][ T1453] ? policy_hash_bysel+0x13f/0x6f0 [ 54.540383][ T1453] xfrm_policy_insert+0x126/0x9a0 [ 54.545444][ T1453] ? xfrm_policy_construct+0x54f/0x1f00 [ 54.551000][ T1453] xfrm_add_policy+0x4ed/0x850 [ 54.555780][ T1453] ? xfrm_dump_sa_done+0xc0/0xc0 [ 54.560732][ T1453] xfrm_user_rcv_msg+0x4dc/0x7b0 [ 54.565689][ T1453] ? xfrm_netlink_rcv+0x90/0x90 [ 54.570552][ T1453] ? avc_has_perm_noaudit+0x490/0x490 [ 54.575939][ T1453] ? x64_sys_call+0x4b/0x9a0 [ 54.580547][ T1453] ? selinux_nlmsg_lookup+0x237/0x4c0 [ 54.585930][ T1453] netlink_rcv_skb+0x1f5/0x440 [ 54.590723][ T1453] ? xfrm_netlink_rcv+0x90/0x90 [ 54.595582][ T1453] ? netlink_ack+0xb50/0xb50 [ 54.600175][ T1453] ? wait_for_completion_killable_timeout+0x10/0x10 [ 54.606765][ T1453] ? __netlink_lookup+0x387/0x3b0 [ 54.611817][ T1453] xfrm_netlink_rcv+0x72/0x90 [ 54.616572][ T1453] netlink_unicast+0x876/0xa40 [ 54.621352][ T1453] netlink_sendmsg+0x879/0xb80 [ 54.626128][ T1453] ? netlink_getsockopt+0x530/0x530 [ 54.631356][ T1453] ? do_futex+0xde8/0x2800 [ 54.635836][ T1453] ? security_socket_sendmsg+0x82/0xa0 [ 54.641328][ T1453] ? netlink_getsockopt+0x530/0x530 [ 54.646669][ T1453] ____sys_sendmsg+0x5b7/0x8f0 [ 54.651473][ T1453] ? __sys_sendmsg_sock+0x40/0x40 [ 54.656551][ T1453] ? import_iovec+0x7c/0xb0 [ 54.661087][ T1453] ___sys_sendmsg+0x236/0x2e0 [ 54.665801][ T1453] ? __sys_sendmsg+0x280/0x280 [ 54.670609][ T1453] ? __fdget+0x1a1/0x230 [ 54.674884][ T1453] __x64_sys_sendmsg+0x206/0x2f0 [ 54.679865][ T1453] ? ___sys_sendmsg+0x2e0/0x2e0 [ 54.684757][ T1453] ? __kasan_check_write+0x14/0x20 [ 54.689903][ T1453] ? switch_fpu_return+0x15d/0x2c0 [ 54.695060][ T1453] x64_sys_call+0x4b/0x9a0 [ 54.699569][ T1453] do_syscall_64+0x4c/0xa0 [ 54.704035][ T1453] ? clear_bhb_loop+0x50/0xa0 [ 54.708751][ T1453] ? clear_bhb_loop+0x50/0xa0 [ 54.713462][ T1453] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 54.719395][ T1453] RIP: 0033:0x7fc4cb2ae819 [ 54.723843][ T1453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 54.743757][ T1453] RSP: 002b:00007fc4c9d09028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 54.752217][ T1453] RAX: ffffffffffffffda RBX: 00007fc4cb527fa0 RCX: 00007fc4cb2ae819 [ 54.760475][ T1453] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 54.768500][ T1453] RBP: 00007fc4cb344c91 R08: 0000000000000000 R09: 0000000000000000 [ 54.776507][ T1453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 54.784514][ T1453] R13: 00007fc4cb528038 R14: 00007fc4cb527fa0 R15: 00007ffea0c8cf88 [ 54.792520][ T1453] [ 54.795583][ T1453] [ 54.797931][ T1453] Allocated by task 1453: [ 54.802277][ T1453] __kasan_kmalloc+0xda/0x110 [ 54.807002][ T1453] __kmalloc+0x13d/0x2c0 [ 54.811289][ T1453] sk_prot_alloc+0xed/0x320 [ 54.815842][ T1453] sk_alloc+0x38/0x430 [ 54.820154][ T1453] pfkey_create+0x12a/0x660 [ 54.824694][ T1453] __sock_create+0x38d/0x7a0 [ 54.829322][ T1453] __sys_socket+0xec/0x190 [ 54.833783][ T1453] __x64_sys_socket+0x7a/0x90 [ 54.838491][ T1453] x64_sys_call+0x8c5/0x9a0 [ 54.843030][ T1453] do_syscall_64+0x4c/0xa0 [ 54.847481][ T1453] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 54.853413][ T1453] [ 54.855781][ T1453] The buggy address belongs to the object at ffff88812896a000 [ 54.855781][ T1453] which belongs to the cache kmalloc-1k of size 1024 [ 54.870141][ T1453] The buggy address is located 1016 bytes inside of [ 54.870141][ T1453] 1024-byte region [ffff88812896a000, ffff88812896a400) [ 54.883622][ T1453] The buggy address belongs to the page: [ 54.889291][ T1453] page:ffffea0004a25a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x128968 [ 54.899565][ T1453] head:ffffea0004a25a00 order:3 compound_mapcount:0 compound_pincount:0 [ 54.907918][ T1453] flags: 0x4000000000010200(slab|head|zone=1) [ 54.914035][ T1453] raw: 4000000000010200 ffffea00044cc000 0000000400000004 ffff888100043080 [ 54.922648][ T1453] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 54.931244][ T1453] page dumped because: kasan: bad access detected [ 54.937674][ T1453] page_owner tracks the page as allocated [ 54.943408][ T1453] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 285, ts 24320964543, free_ts 0 [ 54.961589][ T1453] post_alloc_hook+0x192/0x1b0 [ 54.966393][ T1453] prep_new_page+0x1c/0x110 [ 54.971101][ T1453] get_page_from_freelist+0x2d3a/0x2dc0 [ 54.977114][ T1453] __alloc_pages+0x1a2/0x460 [ 54.981727][ T1453] new_slab+0xa1/0x4d0 [ 54.985831][ T1453] ___slab_alloc+0x381/0x810 [ 54.990453][ T1453] __slab_alloc+0x49/0x90 [ 54.994815][ T1453] __kmalloc+0x16a/0x2c0 [ 54.999186][ T1453] __register_sysctl_table+0xeb/0x1250 [ 55.004678][ T1453] register_net_sysctl+0x238/0x250 [ 55.009860][ T1453] neigh_sysctl_register+0x9a7/0xa90 [ 55.015189][ T1453] addrconf_sysctl_register+0xb3/0x1a0 [ 55.020681][ T1453] ipv6_add_dev+0xc03/0x1150 [ 55.025301][ T1453] addrconf_notify+0x582/0xde0 [ 55.030096][ T1453] raw_notifier_call_chain+0x90/0x100 [ 55.035572][ T1453] call_netdevice_notifiers+0x119/0x190 [ 55.041150][ T1453] page_owner free stack trace missing [ 55.046552][ T1453] [ 55.048897][ T1453] Memory state around the buggy address: [ 55.054560][ T1453] ffff88812896a280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.062648][ T1453] ffff88812896a300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 55.070749][ T1453] >ffff88812896a380: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 55.078847][ T1453] ^ [ 55.087223][ T1453] ffff88812896a400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.095869][ T1453] ffff88812896a480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 55.103966][ T1453] ================================================================== [ 55.112056][ T1453] Disabling lock debugging due to kernel taint [ 55.189265][ T39] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 55.709391][ T39] usb 6-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 55.718459][ T39] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.726504][ T39] usb 6-1: Product: syz [ 55.730729][ T39] usb 6-1: Manufacturer: syz [ 55.735330][ T39] usb 6-1: SerialNumber: syz [ 57.339362][ T39] usb 6-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 57.359304][ T39] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 57.382351][ T39] usb 6-1: USB disconnect, device number 3 [ 57.589905][ T368] udevd[368]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory