last executing test programs: 4m27.776426851s ago: executing program 4 (id=5): r0 = openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) write$binfmt_register(r0, &(0x7f0000000740)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0x7, 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xeahJ\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{\xc5\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xb5\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132\xf9\xbf7K\x8d\x16\xa6\xbf4\v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde\x13\xdf\xc6Z+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x89\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xd3W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a\xdd\x05\xdc\xb8\xc7\xb4v\x1f\xe3\xb6)\x1dM\x1e\xf9\x97\xffLW\x82\t\xf7\xb4\xe2fP\b\n\xdd\x03\x9d&\xd2\xce0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@cache_mmap}], [], 0x6b}}) chmod(&(0x7f0000000140)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$FUSE_BMAP(r4, &(0x7f0000000080)={0x18, 0x0, 0x0, {0x1}}, 0x18) pwritev2(r4, &(0x7f0000000200)=[{&(0x7f0000000340)="1f22daa4c0", 0x5}], 0x1, 0x8, 0x7, 0x17) 4m19.479409917s ago: executing program 5 (id=33): syz_mount_image$udf(&(0x7f0000000080), &(0x7f0000000500)='./bus\x00', 0x18410, &(0x7f0000000200)=ANY=[@ANYRES8=0x0, @ANYRES8], 0xfe, 0x4b1, &(0x7f0000001d00)="$eJzs201sVNUbx/HfM3c6TIf+/5YXCxgCTTSxgkBfsEBqYnix0YQXLVQj8SWVTrHSdkinKCUgLNWdC5Yu3bpwZdwaEpfGhcEYFibIxs2sxB3m3LlvM5TOjG1nKP1+CJx7zzx3OOc8c+ecM5kRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQjrx6uLfPWt0KAADQTCdPj/QOMP8DALCmnGH/DwAAsJaYPP0u054LJTvhn5dlj0/OXLo8emx44cvaTaaUPD/e/c329Q/sf2nwwMGwXPz65bZNp06fOdx9tDB9cTZfLObHu0dnJs8VxvN1P8NSr6+2yx+A7ukLl8YnJord/XsHKh6+3Hlv3fquzqHB945mwtjRY8PDpxMx6bb//L8/5FEr/Iw8vSDTx99/ayclpbT0sajx2llp7X4ndvmdGD027HdkanJsZs49aKkgKlU5JplwjJqQiyVJSa5dllmePVubPP0g05F9JTslyQvHYbf/wXBd7WmFtNu6SurRKsjZY2ydPH0g0619nXojGFc//xnpaqsbhxWXDu7/gpXsTf/9wN1P7m3z+Fvdr89MFBKxlgruqNU+PzTTY/7elJWnU/4dX7IR7Wx1c9Bk7fI0LVPmq0/8dYX8delTQwd27DyUXGFsqfE8LnZvcHPVMye3BUsHS7k/y98v1Cdrnv6U6f5vWf+8J5wDpBsPFrvwj6Y0DyvNPE3J9M+1klnVvtRL7O8jq33uX9n2t2ePFi7Oz06e/2huwcdz2cMfFudmx84t/HB57+ola2rtY6ulGtuS5ay84/v801J0XbAH+F/5LG7NN1fj10JPVRlKvn7qOa57F9vAOsq1yczTXZkm3t9anmeUa3hs1gKX/2GZiqWfLcx0kP90+SyR/5fj8ctaZRnxc/v/8uda4Vpi29nNj6pfify7Nrn8vyPTkb+3Bp9plPPvVcW6uC6Z3r25PYhLZVxcOuxO+RknJqfyvS72gUwbfwpj5cfmgthNcWyfiy3K9MWtytj1QezmOLbfxd6W6c6vC8c+HccOuNh5l6873WFszsXuCGK74ti95wpT47WG1eW/X6a3r79mYZ8fmf/E/X+jqow8lPPFj5cr/52JuhtBXs8G+U/XyP+XMs3/tT3stz/24ctqg/9vnH+3Vv7uZmVsuKHcGMf21dutVnP53yDTvVduR30O+hacxhlK5v+ZdGUZjWuL8r8hUdcZtCvT4FisRcX5KxfGpqbysxxwwAEH0UGr35nQDG7+H3Gz+qBn4TommP87ymfxiun+Z/H8P1RVRlo0/29M1A0Fq5a2tJSdm77YtkXKFuev7JmcHjufP5+fGdg/2Nt/aH/vwMG2TLi4i4/qHrsngcv/bpmu/fhLtI+pXP8tvP7PVZWRFuV/U7JPFeuauodiTXL575Bp8O7taL+52Po/3P/3PFtZRvdfi/K/OVHXGbSro8GxAAAAAAAAAAAAAAAAAIDVJGeenpPp8siLFv6GqJ7v/41XlZHl//5X+YfJNb7/1ZWoG2/S7xoaGmgAAAAAAAAAAIAmScnT1zI9r5JddxUd0olkiSfavwEAAP//G6xIAA==") bpf$PROG_LOAD(0x5, 0x0, 0x0) setrlimit(0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) truncate(&(0x7f0000000080)='./file1\x00', 0x400000f000) truncate(&(0x7f0000000080)='./file1\x00', 0x400000f000) 4m17.935194745s ago: executing program 4 (id=35): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x2, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x10}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000200)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x2) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000080)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000000), 0x208e24b) 4m17.168245908s ago: executing program 32 (id=35): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x2, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x10}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000200)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x2) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000080)=ANY=[]) chdir(&(0x7f0000000140)='./file0\x00') r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000000), 0x208e24b) 4m17.145759471s ago: executing program 5 (id=39): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = accept$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @dev}, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2f, &(0x7f0000000840)={0x0, {{0x2, 0x4e24, @multicast2}}, {{0x2, 0x4e21, @multicast1}}}, 0x108) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="66617374626f6f742c71756f7461000018bbdecde39739fcd1df176dde746ec834120600000000003b814e50a959736d6572462abc30ef5b65c70f73ecea54b5e5bea9836c319f653557e79a002208ce996dda659bd5ba0f4ce5c2080002223dc60000000000000044cd0a1e3686873600000000005493b4b81d5b9fa9b40fe4d76afc3a989c6d60044e89eb96e44d01a1034e3797ffa86870b82939f41ffa0f3d726f085663c29cbdc4c766a7eb77cc36160191acf5ae7469c82ab4145b595b987d75912a0fcd1c061835294cc0c618aba204f8adaa20c80108d356cd88cc86177056b06e7068c40f807d9e539f8f5b64a8ee0725aa8d00000000007cb6020d90ea79b8027cf75964dd86c2ed2b5e75779677aa8c76b848dd03dab190b5f02ec52830a17b01eaae1c3df076000000000000000000000000000083a48a6b926c668b9b90195018ea3619f9d80a0b894e212178e1a19909d764666264fa29e2c055fd7f8e67c2acfb75f0a8d41692f4542a575ee42ed94a0014fba44985cca9df12fe93bfaccf0122a6e7e593613ac0111701b125cc6799c43aa4ff708dc4a00a6decad26f0378072a571da000000b1a6bdf03fd56697e348b5b494f6fddb9f56142a47a40ef81690a7eca421bd0ad198afa58ce69d61c29deaa93c0efea0df04f20020ee84075b4e1a2ad43d1be1138de4668e7b6137545708790c501f1ed7f6a571d500000000000000"], 0x27, 0x5586, &(0x7f00000079c0)="$eJzs3EtvG2UXAOAzTtP71y9CLNh1pAopkWqrTi+CFQVacRGtKi4LVuDYruXW9kSx44SsumCJWPBPEEisWPIbWMASdogFiB0SyDMTaNoGSuM4avs80vjMHL8+874jK9KZiRzAU2sh/e2XJE7FsYiYi4iTSeT7SblF3Im4XIx9LiJOR0Tlri0p838lDkfE8Yg4NSle1EzKtz47Oz5z8ec3f/362yOHTnz+1XcHunDgQD0fEf3VYn+jX8SsU8RbZb4x7uaxf2FcxtUdNfpZkd9or+QVNhrb4xp5PN8pxmer68NJvNlrNCex072Z51cHxQmH4852nckH0luNtfy41V7JY3eY5bGzVZx3c6v427Y1HBV1WmW9j/LyMRptxyLf3mwX61m9ncfmYFTmi7pZq705ieMylqeLZtZr5fNYecSL/Bh4qztY30zH7bVhNxukF2v1F2r1S9X6WtZqj9oXqo1+69KFdLHTmwyrjtqN/uVOlnV67Voz6y+li51ms1qvp4tX2ivdxiCt12vna+eqF5fKvbPpa9ffS3utdHESX+kO1kfd3jC9ma2lxSeW0uXa+ReX0jP19J1rN9Ibb1+9eu3Gux9cef/6y9feeLUcdN+00sXlc8vL1fq56nJ96Sla/8flpP/D+pMHp3/4fm+XDQq7fMEA2N19/X/c2/+H/h+Yur30//3b5fH+9P/xMP1/TLP/n7RU+v9/738rB9D/zof+fx/XD3vyaP3/4anPAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmftx/ovX852F4vhEmf9fmXqmPE4iohIRfzzAXBzeUXOurDO/y/j5e+bwTRJ5hck5jpTb8Yi4XG6//3+/rwIAAAA8ub68c/rTolsvXhYOekLMUnHTpnLywynVSyJifuGnKVWrTF6enVKx/Pt9KDanVC2/gXV0SsWKW26HplXtocztCEfvCkkRKjOdDgAAMBM7O4HZdiEAAADM0if/+O5LM5sHM5bE9qPM7WfB+X/e//1A8NiO9wAAAIDHUHLQEwAAAAD2Xd7/+/0/AAAAeLIVv/8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAf7JzP7lpA1EcgJ8Nhv5VUdV9r9IdHKNH6LLLwgF6CY5Ar9ALcAYiZZEjRBBhT5CcgBSJMU7Q90m2M+Po5xlg88bSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXbqpVrN/f77/PTdnuztPntkAAAAAx2yq1az+Y9K0P6b+z6nra2oXEVFGxLHafRCjVuYg5VQn/r96Mob/EXXCvn+cjg8R8SMd91+6/hQAAADgeq0Xy2lTrTentARw2++ouJBm0ab89DNTXhER1eQuU1q5P33LFFb/vofxO1NavYD1LlNYs+Q2PH5vlOshbYPW5XEm8/pLrFtlN88FAAD61K4ETlQhAAAAXIFffQ+AS3he2heH0+E947i5pBeC71stAAAA4A0q+h4AAAAA0Lm6/n9N+/8V9v8DAACA7Jr9/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOjSplrN1ovl9NT9+Qtztrvz5JsRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPLA/7ygQAmEQBnvXdyZz/8NKg4bGJlUgfPyNwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJvf/eX/xNQ4k8y9NpaeR5K1U2Pr1Ng7N47+ML5+DQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAxf68pEAIBEEUzBn/O+n7H1YS9AwiREDDo4paNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwRb/75f/E1DiTzJ02lo5HkrWrxtZVY+9B4+jBePs3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAxb799EZRhgEAf3anu1DUWKtpYtVgwkEvUhYEuRqjaTz4EUyassXqIgo9CGnEXryZnrkYPRpjoqm3fgfONOGCNw491MSTh5r5V2bbFRqUmUJ/v+Td99nZ4f23E9Jn3lkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABKm+/Gq+0iTtKXiTwuj93eWp5P641ddWp99c50WtK4VfO4nwCvVd8cn2puIAAAABweSZnfR8TdztpsWrcnsvy/U56T5vw/PJfHZT6/O+/f2Fo+Wnw0Xeb/v/9276WdjiaSrJ+00YXFQf/U3qGMPaYpHnjPP/SMsWzls3svSfaFtD9ceXGzk61n67tbt97vZuGROkYLADyKk2VdBOXfQ2nda3JgABwaY5XEu8z/k4lmxwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQh82VeKaMWxExPXY/Tm1sLc+Pqr9ZvTO9XpRzN2+uVttMm+hExMLioH+qxrkcXOVqXv9sbjDoX7l6re7geESM+OjG/v55Ugz/X8/pRsTQkRMvj2jn4330taudPUFxeUa9aziezu+hJ7eGjrT2LPh727kmLoC6gnbx/TyOLsZr/96Hg/La+/9brvm/IwAAnnqdoqSZ6N3O2mx6rDUZsf3jcP7/RiWOobx/+0Z+JH+/Xsn/731y7na1r2r+36tpfk+CmaVLX8xcvXb9rcVLcxf7F/ufv326907vzPmzZ8/PZPdKZhai7Y4JAAAA/0G3KNX8vz25d///WCWOB+z/51vCef7/5fe9r6t9JfL/ke5v+jU9EgAAgMOouxO98Ppff7ZGnNHqduOruaWlK738def96fy11uE+oiNFqeb/yWTTowIAAADqsLnSGtr/v1CJ4wH7/9Xn/5/96ZVfqm0mETEecTki+ifnLw8u1DedA62OHypnHXWbnikAAABNGS9Kdf+/kz3/39555KEdEW+eiPi7+A1/7DP/Tz749udqX9Xn/8/UOsuDpz2Vr0dWT0WMTTU9IgAAAJ5mR4uSJvt/dNZmP/312Eddz/8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1O2fAAAA//+FVSwP") mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r4) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r5, 0x201, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r6 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000000000d00000000080000000850000007d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000280)='netlink_extack\x00', r8}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@newqdisc={0x9c, 0x24, 0xf0b, 0x70bd2b, 0xfff1, {0x0, 0x0, 0x12, r7, {}, {0xffff, 0xffff}, {0x2, 0x6}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x6c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x80, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}]}]}}]}, 0x9c}}, 0x0) r9 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r9}, &(0x7f0000bbdffc)) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x0) 4m14.850061244s ago: executing program 5 (id=42): syz_mount_image$ext4(&(0x7f0000000680)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0xe, &(0x7f0000000200)={[{@quota}, {@oldalloc}, {@barrier_val={'barrier', 0x3d, 0x3}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@block_validity}, {@jqfmt_vfsv1}]}, 0x3, 0x434, &(0x7f0000000940)="$eJzs289vFFUcAPDvzLZFKNiK+IOCWkVj44+WFlQOXjSaeNDERA94rG0hlYUaWhMhjVZj8GhIvBuPJv4FnvRi1JOJV70bEmJ6AT2tmd2ZdrvdLW3ZdtH9fJKB92be5n2/O/N238zrBtC1hrN/koj9EfF7RAzUqmsbDNf+u7m8OPX38uJUEpXKW38l1XY3lheniqbF6/rzykgakX6WxJEm/c5funxuslyeuZjXxxbOvz82f+nys7PnJ8/OnJ25MHHq1MkT4y88P/FcW/LMYrox9NHc0cOvvXP1janTV9/9+dukyL8hjzYZ3ujgE5VKm7vrrAN15aSng4GwJaWIyE5Xb3X8D0QpVk/eQLz6aUeDA3ZUpVKp9Lc+vFQB/seS6HQEQGcUX/TZ/W+x7dLU445w/aXaDVCW9818qx3piTRv09twf9tOwxFxeumfr7ItduY5BADAGt9n859nms3/0ri/rt3d+drQYETcExEHI+LeiDgUEfdFVNs+EBEPbrH/xkWS9fOf9Nq2EtukbP73Yr62tXb+V8z+YrCU1w5U8+9NzsyWZ47n78lI9O7J6uMb9PHDK7990epY/fwv27L+i7lgHse1nj1rXzM9uTB5OznXu/5JxFBPs/yTlZWAJCIOR8TQNvuYfeqbo62O3Tr/DbRhnanydcSTtfO/FA35F5KN1yfH7oryzPGx4qpY75dfr7zZqv/byr8NsvO/r+n1v5L/YFK/Xju/9T6u/PF5y3ua7V7/fcnb1XJfvu/DyYWFi+MRfcnrtaDr90+svraoF+2z/EeONR//B2P1nTgSEdlF/FBEPBwRj+SxPxoRj0XEsQ3y/+nlx9/bfv47K8t/ekvnf7XQF417mhdK5378bk2ng1vJPzv/J6ulkXzPZj7/NhPX9q5mAAAA+O9JI2J/JOnoSjlNR0drfy9/KPal5bn5hafPzH1wYbr2G4HB6E2LJ10Ddc9Dx/Pb+qI+0VA/kT83/rK0t1ofnZorT3c6eehy/S3Gf+bPUqejA3ac32tB9zL+oXsZ/9C9jH/oXk3G/95OxAHsvmbf/x93IA5g9zWMf8t+0EXc/0P3Mv6hexn/0JXm98atfySvoLCuEOkdEYbCDhU6/ckEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQHv8GAAD//5LX5s8=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x9, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000380)=""/141, 0x8d) 4m11.951211097s ago: executing program 5 (id=47): syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x8c0, &(0x7f0000000380)={[{@acl}, {@heartbeat_none}, {@err_ro}, {@coherency_full}, {@coherency_full}, {@localflocks}, {@intr}, {@noacl}]}, 0x1, 0x442a, &(0x7f0000008940)="$eJzs3c9PHGUfAPBnBvoW+rZ9oW8PfZM3cRObaNQQ6EmliZTSUmixptrGeNkusG3RhW1gMR56wFsTTyYejIdGE2+cGg5e65/gxWM9N9GDFxOTRszuzgIz7IaVsGDr53NgmOc3+5159pnD8MSJyp25pdzcUq6wkCvP3Fo6k/u4XFqeL4Z4nzTt/9D+9U97OnGdHPS190929fzFd2+cCeH72R+frK+vr4eq7tDU0Jbff/v13szWY0OcqVNtt3lre+WDEMLJbeOq6gohvP9dCFEI4VySNpoce0MIx0I978a9z27m9mg0Dx8Xz+afTt1fGz49ufpgrfXfHoXwVel/r92e//nFruGfXtmj7gEAAAAAAAAAAAAAAAAAeMaNX7t6/Z3BofAoCt2r0fb3dceTY6v3Y9f3zAud/2MBAAAAAAAAAAAAAAAAAADgb2rz/f9cdKLJ+/9jyXGkRf31tzo/Rjpn4u2rYxcGh5L936Nt+a8nSb+c6wr9TfZ9z+7/fi5Tv/n+79v72a3G+Br99oUoHkidx/HAQAjfJBu/n4qOxKXyUuXVW+Xlhdk9G8YzKx3/+u79qegkG/q3G//RTPud3///v9uupur5zb27xJ5r6fh3tSz37adRW/E/n6m3H/Fn99Lx766l9W4tMFKfAKrx/7x75/iPZdrvVPyPhxByUXWsudQMUF3DVNNbrVdIS8f/UC0tNXUmH2Sr+//3TPwvZNo/qPl/JftFRFPp+P+rltaTKrF5//fHO9//FzPtH0T8q+Nf8f3flnT8D9cTu1NFap9ku/P/eKb9TsX/epyM83iUugJWo3p6q/9XR1o6/j3b8jef/+K21n+XMvX36/mv0W/j+a8x/b8c1Z//aC4d/96W5dq9/ycy9To9/4/U1n/sVjr+R2pp6bVzX+1nu/GfzLTfqfjXViU9jfhvzid/HK6nf23915Z0/P9dT4y3llip/ayt/6Kd1/+XM+0fxPqvOv6VuLO9Pi/S8T/aslw1/j+08f1/JVOv8/EPYdBaf9fS8T/Wslzt/u/ZOf5TmXqdjv9LnWwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Bkwmhz7QhQPpM7jeGAghPPJ+alwJJouzOanS+WZj5ZCGEvSc+FEdLtUni6U8nML5dlivlAqlWdCuJDknww90VKpXMnPF+5e3GirN7pTLCxWpouFSghhPEn/fzjWaGt6rjJfuBtCuLSR95+4vHj3TmEhPzu3+Obg4OBgmNgYQ39U/KRSXKjUe6/nhjC5Ubcv2jK4WvbljbEcjT4sLy8uFEq19Ctb6pTKM4XSljpTSd4XoT+qLC4vzBQqxXypfLvR30EaSY5jE9feu3ZlaFv+zah+HN3fYQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwFz0afuPLEEJ3/SwOIYw0fomalX/4uHg2/3Tq/trw6cnVB2tPWpUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+JMdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7NIxSgNBFAbgN2Ohdh7DatntbFcU0cIVwRPoMTyMHsVLeIcUKdKmCIFkFsJmF7ZJqu9rHszPzHswDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHme3ruPt7qJSHG1uYz4+/pfHOYvpf7cj9+/OMOMnM7za/fwWDfl39NRfleOlm3epevV92eM1N7vYE+G+7TX97menGtq36bm6/veRMpVRLQlv005V9W8twAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgyw4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24FgAAAAAQJi/dRR9GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPArAAD///4CHxA=") openat(0xffffffffffffff9c, 0x0, 0x143042, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x141842, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./bus\x00', 0x0, 0x1000, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x40, 0x12) ioctl$LOOP_SET_STATUS64(r2, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x400, 0x0, 0x0, 0x1, 0x0, "ef35af413bb901527fe4d0ce5d29c3ee5e5c3676345a41499db7aac63a01000000000000004faa2ae2c084a0ea0000000000000000000c00002000", "036c47c67808200400000000000000335263bdbcef549ba197fce47ddfdd753abd950100002a00ffffffffffffffff00000000e8f20000000200", "b7326736181c208220000000b9000000000000000000f0fffffffff2ff00", [0x4]}) write$tcp_congestion(r0, &(0x7f00000001c0)='westwood\x00', 0x9) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) copy_file_range(r1, 0x0, r0, 0x0, 0xffffffffa003e459, 0x700000000000000) write$P9_RUNLINKAT(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f00000008c0)={0xc0}) syz_emit_vhci(0x0, 0xf8) 4m6.91605618s ago: executing program 5 (id=59): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0xc4062, &(0x7f0000000300)={[{}]}) 4m6.366735466s ago: executing program 33 (id=59): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0xc4062, &(0x7f0000000300)={[{}]}) 3m42.051773417s ago: executing program 2 (id=110): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) gettid() r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000240), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0x40045304, &(0x7f0000000100)) sendto$inet6(r0, &(0x7f0000000380)="e8b2", 0x2, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0xc000, &(0x7f0000000380), 0x2, 0x24d, &(0x7f0000000440)="$eJzs3T9oJFUcB/DvzO4ac7fIqY0g/gER0UA4O8HmbBQO5DhEBBVORGyUixAT7LJWNhZaq6SyCWJntJQ0wUYRrKKmiI2gwcJgocXK7iQSNytqNtk5Mp8PTGYm89783rDzfbvN7AZorAtJLiVpJZlL0klSHG5wb7Vc2N9dnd28lvT7T/1SDNtV+5WDfueT9JI8kmSjLPJKO1lef27nt60nHnh7qXP/h+vPzk71Ivft7mw/uffBlbc+ufzw8lff/HSlyKV0/3ZdJ68Y8792kdx2GsVuEEW77hHwX1x94+NvB7m/Pcl9w/x3UqZ68d5ZvGmjk4fe/6e+7/789Z3THCtw8vr9zuA9sNcHGqdM0k1Rzieptstyfr76DP9d61z56sLi63MvLyxdf6numQo4Kd1k+/HPZj49P5L/H1tV/oGza5D/p6+ufT/Y3muNHOzP1DMo4HTdVa0G+Z97YeXBjMs/cKbJPzSX/ENzyT80l/xDc8k/NJf8wxnWOdjojT0s/9Bc8g/NJf/QXIfzDwA0S3+m7ieQgbrUPf8AAAAAAAAAAAAAAAAAAABHrc5uXjtYplXzi/eS3ceStMfVbw1/jzi5efj33K/FoNlfiqrbRJ6/Z8ITTOijmp++vuWHeut/eXe99VeuJ703k1xst4/ef8X+/Xd8t/7L8c6LExb4n4qR/UefmW79UX+s1Vv/8lby+WD+uThu/ilzx3A9fv7pHv6K5WN67fcJTwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDU/BkAAP//d4lu0g==") mkdir(0x0, 0x0) r2 = open$dir(0x0, 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000140)=@v1={0x0, @aes256, 0x2, @desc3}) chdir(&(0x7f0000000000)='./file0\x00') add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000240)={'fscrypt:', @desc3}, &(0x7f00000002c0)={0x0, "615a091a55a8c9a640115d99d981b3886420589c6695d4982a83b71b906769e73760ebc6b7a7804454156569cb03a5be811debc957b5831b89b59d703e748c7c", 0x30}, 0x48, 0xfffffffffffffffd) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='scalable\x00', 0x9) shutdown(r0, 0x1) 3m41.157135415s ago: executing program 2 (id=114): ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000000)={0x0, 0x8542, 0x8, 0x6, 0x402, 0x4}) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000140)=0x0) syz_open_procfs(r0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local, {[@noop]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0x0, 0x0, 0x1}}}}}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r4) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16=r5, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b800800090000000000080009000000000008000a000000000008000a000000000008000a000000000008000900000000000800097c86b722735035dc0067f6b13308000a000000000008000a000000000008"], 0x184}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0xf, 0x491, 0x3, 0x0, 0x0, 0x8, 0x1}}, {0x6, 0x1b, [0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4000c00) syz_emit_ethernet(0x116b, 0x0, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, 0x0) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000200)=0xdc) syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00cd04", 0x38, 0x3a, 0x0, @private1, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "0bae2b", 0x0, 0x2f, 0x0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [@fragment={0x87, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}]}}}}}}}, 0x0) 3m39.539557644s ago: executing program 2 (id=115): r0 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 3m39.238338452s ago: executing program 2 (id=116): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = syz_open_dev$media(&(0x7f0000000080), 0x10001, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$usbfs(&(0x7f0000000140), 0x76, 0x101301) pselect6(0x40, &(0x7f00000001c0)={0x300, 0xff, 0xfffffffffffff0af, 0xffffffffffffffff, 0x0, 0x10000, 0x103, 0x3}, 0x0, &(0x7f00000002c0)={0x3fe, 0x8000000005, 0x3, 0x7, 0x9, 0x45ff, 0xd68d, 0x40000000000}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 3m38.176993889s ago: executing program 2 (id=119): r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x101202, 0x0) read$nci(r0, 0x0, 0x0) write$nci(r0, &(0x7f0000000100)=ANY=[], 0x4) write$P9_RLERRORu(r0, &(0x7f00000003c0)={0x9b, 0x7, 0x3, {{0x8e, '\x00\x98\x93\xc9\x06\x96L\x91\x97\x8e\xb9\x14x\x8d\xcba\x7f\xbc\xf2\x9c%#<\xae\x1d\xf6q\r\xae1\x1bDe\xf6KRj )\xee\xa5\x87\x9e\xe2\xd2\x90pyTY\xfc\x83\xe0*\xc7rN\xa1\xaa\xaa=s\x0eR\x1cFF@&w\x1d\xbfL\x96\xb8\xd6\xbb\x14\xbe \xfe\xa7!\xf8u\x90\x1d\xffD\xfa\xb0\xfd\x18}\xd7\x1d\a IGN\xc9b\xb5\xc3\xd2\x03~x\x19\xc0\xc9\xfd\x8eT\xc1X\x85\xfa\x8a\xaa\x91\xe2\xb2\xf6\x13&\xa9C\x0e\xf9\xff\xfbgO\x12\x19\x91\xcdj}\xa7'}, 0x7fffffff}}, 0x9b) 3m37.84771304s ago: executing program 2 (id=120): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000000)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) 3m22.417591984s ago: executing program 34 (id=120): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x7}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000000)={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) 19.009297034s ago: executing program 0 (id=381): bind$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000100)=0x4, 0x4) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x101800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r1}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(0xffffffffffffffff, 0x847ba, 0x0, 0xe, 0x0, 0x0) 17.207097161s ago: executing program 3 (id=383): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) rseq(0x0, 0xfe51, 0x0, 0x0) writev(r0, &(0x7f0000000480)=[{&(0x7f0000001340)="f7bf", 0x2}], 0x1) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r5, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[r7, r6], 0x2}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r5, 0xc05064a7, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) 15.797444369s ago: executing program 1 (id=385): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_mount_image$exfat(&(0x7f0000000000), &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f00000000c0)=ANY=[], 0x1, 0x1513, &(0x7f0000002d00)="$eJzs3Au4TlW3OPAx5pxLm9Cb5D7HHIs3uUySJJeERJIkSZJbQpIkSUhscktCEnJPcg/JLST3+y33kHySJAkJSeb/0df3d77Td0595+sc5zl7/J5nPXuOvd4x1lh77Od911rPs/c37QdWrlulYm1mhn8J/vVLKgCkAEAfALgGACIAKJGlRBbAIZBeY+q/dhDx53poypXuQFxJMv+0Teaftsn80zaZf9om80/bZP5pm8w/bZP5C5GWbZma81rZ0u72P/f8H+T5//868vn/f8jhIqO+WFfk+g7/RIrMP22T+adtMv+0Teaftsn80zaZ//9xEUCF/2S3zD9tk/kLkZZd6efPsl3Z7Ur//gkhhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGESBvOhcsMAPxtfaX7EkIIIYQQQgghxJ8nXHWlOxBCCCGEEEIIIcR/PwQFGgxEkA6ughRIDxngasgImSAzXAMJuBaywHWQFa6HbJAdckBOyAW5IQ9YIHDAEENeyAdJuAHyw41QAApCISgMHopAUbgJisHNUBxugRJwK5SE26AUlIYyUBZuh3JwB5SHClAR7oRKcBdUhipwN1SFe6Aa3AvV4T6oAfdDTXgAasGDUBsegjrwMNSFR6AePAr1oQE0hEbQ+L+U/yJ0hpegC3SFVOgG3eFl6AE9oRf0hj7wCvSFV6EfvAb9YQAMhNdhELwBg+FNGAJDYRi8BcNhBIyEUTAaxsBYeBvGwTswHt6FCTARJsFkmAJTYRq8B9NhBsyE92EWfACzYQ7MhXkwHz6EBbAQFsFHsBg+hiWwFJbBclgBK2EVrIY1sBbWwXrYABthE2yGLfAJbIVtsB12wE7YBbvhU9gDe2EffAb74fN/Mv/sv8vvgICAChUaNJgO02EKpmAGzIAZMSNmxsyYwARmwSyYFbNiNsyGOTAH5sJcmAfzICEhI2NezItJTGJ+zI8FsAAWwkLo0WNRLIrF8GYsjsWxBJbAklgSS2FpLI1lsSyWw3JYHstjRayIlbASVsbKeDfejfdgNayG1REBoAbWxJpYC2thbayNdbAO1sW6WA/rYX2sjw2xITbGxtgEm2BTbIrNsTm2wBbYEltiK2yFrbE1tsE22BbbYjtsh+2xPXbAjtgRX8QX8SV8CbtiJdUNu2N37IE9sBf2xt74CvbFV/FVfA374wAciK/j6/gGDsYzOASH4jAchuXUCByJo5DVGByLY3EcjsPxOB4n4ESciJNxCk7FaTgNp+MMnIHv4yz8AD/AOTgH5+F8nI8LcCEuwkW4GM/iElyKy3A5rsCVuAJX4xpcjetwPa7DjbgRN+Nm/AQ/wW24DXfgDtyFu/BT/BT34l7sj/txPx7AA3gQD+IhPISH8TAewSN4FI/iMTyGx/E4nsCTeApP4mk8jWfwLJ7Dc3gez+MFfD7XV3V2FVzbH9QlRhmVTqVTKSpFZVAZVEaVUWVWmVVCJVQWlUVlVVlVNpVN5VA5VC6VS+VReRQpUqxilVflVUmVVPlVflVAFVCFVCHllVdFVVFVTBVTxVVxVULdqkqq21QpVVo182VVWVVONfflVQVVUVVUldRdqrKqoqqoqqqqqqaqqeqquqqhaqia6gFVS3XDXviQujSZumoA1lMDsb5qoBqqRuoNfEw1UYOxqWqmmqsn1FAcgi1VE99KPa1aq5HYRj2rRuFzqp0ag+3VC6qD6qg6qRdVZ9XUd0n361ugmow9VE/VS/VWmeAudWlildVrqr8aoAaq19U8fEMNVm+qIWqoGqbeUsPVCDVSjVKj1Rg1Vr2txql31Hj1rpqgJqpJarKaoqaqaeo9NV3NUDPV+2qW+kDNVnPUXDVPzVcfqgVqoVqkPlKL1cdqiVqqlqnlaoVaqVap1WqNWqvWqfVqg9qoNqnNaov6RG1V29R2tUPtVLvUbvWp2qP2qn3qM7Vffa4OqL+og+oLdUh9qQ6rr9QR9bU6qr5Rx9S36rj6Tp1QJ9Up9b06rX5QZ9RZdU79qM6rn9QF9bO6qIICjVpprY2OdDp9lU7R6XUGfbXOqDPpzPoandDX6iz6Op1VX6+z6ew6h86pc+ncOo+2mrTTrGOdV+fTSX2Dzq9v1AV0QV1IF9ZeF9FF9U26mL5ZF9e36BL6Vl1S36ZL6dK6jC6rb9fl9B26vK6gK+o7dSV9l66sq+i7dVV9j66m79XV9X26hr5f19QP6Fr6QV1bP6Tr6Id1Xf2Irqcf1fV1A91QN9KN9WO6iX5cN9XNdHP9hG6hn9Qt9VO6lX5at9bP6Db6Wd1WP6fb6ed1e/2C7qA76k76Z31RB91Fd9Wpupvurl/WPXRP3Uv31n30K7qvflX306/p/nqAHqhf14P0G3qwflMP0UP1MP2WHq5H6JF6lB6tx+ix+m09Tr+jx+t39QQ9UU/Sk/UUPVX3+rXSzD+Q/84/yO/3y9E36y36E71Vb9Pb9Q69U+/Su/VuvUfv0fv0Pr1f79cH9AF9UB/Uh/QhfVgf1kf0EX1UH9XH9DF9XB/XJ/RJ/aP+Xp/WP+gz+qw+q3/U5/V5feHXnwEYNMpoY0xk0pmrTIpJbzKYq01Gk8lkNteYhLnWZDHXmazmepPNZDc5TE6Ty+Q2eYw1ZJxhE5u8Jp9JmhtMfnOjKWAKmkKmsPGmiClqbvqX83+vv8amsWlimpimpqlpbpqbFqaFaWlamlamlWltWps2po1pa9qadqadaW/amw6mg+lkOpnOprPpYrqYVJNqupuXTQ/T0/QyvU0f84rpa/qafqaf6W/6m4FmoBlkBpnBZrAZYoaYYWaYGW6Gm5FmpBltRpuxZqwZZ8aZ8Wa8mWAmmElmkplipphpZpqZbqabmWammWVmmdlmtplr5pr5Zr5ZYBaYRWaRWWwWmyVmqVlqlpvlZqVZaVab1WatWWvWm/Vmo9lolpgtZovZaraa7Wa72Wl2mt1mt9lj9ph9Zp/Zb/abA+aAOWgOmkPmkDlsDpsj5og5ao6aY+aYOW6OmxPmhDllTpnT5rQ5Y86Yc+acOW/OmwvmgrloLl667ItUpCITmShdlC5KiVKiDFGGKGOUMcocZY4SUSLKEmWJskbXR9mi7FGOKGeUK8odpYKNKHIRR3GUN8oXJaMbovzRjVGBqGBUKCoc+ahIVDS6KSoW3RwVj26JSkS3RiWj26JSUemoTFQ2uj0qF90RlY8qRBWjO6NK0V1R5ahKdHdUNbonqhbdG1WP7otqRPdHNaMHolrRg1Ht6KGoTvRwVDd6JKoXPRrVjxpEDaNGUeM/tX4IZ7I/7rvYrjbVdrPd7cu2h+1pe9neto99xfa1r9p+9jXb3w6wA+3rdpB9ww62b9ohdqgdZt+yw+0IO9KOsqPtGDvWvm3H2XfsePuunWAn2kl2sp1ip9pp9j073c6wM+37dpb9wM62c+xcO8/Otx/aBXahXWQ/sovtx3aJXWqX2eV2hV1pV9nVdo1da9fZ9XaD3Wg32c12i/3EbrXb7Ha7w+60u+xu+6ndY/faffYzu99+bg/Yv9iD9gt7yH5pD9uv7BH7tT1qv7HH7Lf2uP3OnrAn7Sn7vT1tf7Bn7Fl7zv5oz9uf7AX7s71ow6WL+0sf72TIUDpKRymUQhkoA2WkjJSZMlOCEpSFslBWykrZKBvloByUi3JRHspDlzAx5aW8lKQk5af8VIAKUCEqRJ48FaWiVIyKUXEqTiWoBJWkklSKSlEZKkO30+10B91BFagC3Ul30l10F1WhKlSVqlI1qkbVqTrVoBpUk2pSLapFtak21aE6VJfqUj2qR/WpPjWkhtSYGlMTakJNqSk1p+bUglpQS2pJragVtabW1IbaUFtqS+2oHbWn9tSBOlAn6kSdqTN1oS6USqnUnbpTD+pBvagX9aE+1Jf6Uj/qR/2pPw2kgTSIBtFgGkxDaCgNo7doOI2gkTSKRtMYGktjaRyNo/E0nibQBJpEk2gKTaFpNI2m03SaSTNpFs2i2TSb5tJcmk/zaQEtoEW0iBbTYlpCS2gZLaMVtIJW0SpaQ2toHa2jDbSBNtEm2kJbaCttpe20nXbSTtpNu2kP7aF9tI/20346QAfoIB2kQ3SIDtNhOkJH6CgdpWN0jI7TcTpBJ+gUnaLTdJrO0Bk6R+foPP1EF+hnukiBUpyCDO5ql9FlcpndNS7FpXcZ3F8vmC7FOVxOl8vldnmcddlc9r+LyTlXwBV0hVxh510RV9Td9Ju4lCvtyriy7nZXzt3hyv8mrurucdXcva66u89VcXf/XVzD3e9qukdcLfeoq+0auDqukavrHnH13KOuvmvgGrpGroV70rV0T7lW7mnX2j3zm3iBW+jWuLVunVvv9ri97pz70R1137jz7ifXxXV1fdwrrq971fVzr7n+bsBv4mHuLTfcjXAj3Sg32o35TTzJTXZT3FQ3zb3nprsZv4nnuw/dLLfIzXZz3Fw375f4Uk+L3EdusfvYLXFL3TK33K1wK90qt/r/97rcbXSb3Ga3233qtrptbrvb4Xa6Xb/El85jn/vM7XefuyPua3fQfeEOuWPusPvql/jS+R1z37rj7jt3wp10p9z37rT7wZ1xZ385/0vn/r372V10wQEjK9ZsOOJ0fBWncHrOwFdzRs7EmfkaTvC1nIWv46x8PWfj7JyDc3Iuzs152DKxY+aY83I+TvINnJ9v5AJckAtxYfZchIvyTVyMb+bifAuX4Fu5JN/Gpbg0l+GyfDuX4zu4PFfginwnVwqBK3MVvpur8j1cje/l6nwf1+D7uSY/wLX4Qa7ND3Edfpjr8iNcjx/l+tyAG3IjbsyPcRN+nJtyM27OT3ALfpJb8lPcip/m1vwMt+FnuS0/x+34eW7PL3AH7sid+EXuzC9xF+7KqdyNu/PL3IN7ci/uzX34Fe7Lr3I/fo378wAeyK/zIH6DB/ObPISH8jB+i4fzCB7Jo3g0j+Gx/DaP43d4PL/LE3giT+LJPIWn8jR+j6fzDJ7J7/Ms/oBn8xyey/N4Pn/IC3ghL+KPeDF/zEt4KS/j5byCV/IqXs1reC2v4/W8gTfyJt7MW/gT3srbeDvv4J28i3fzp7yH9/I+/oz38+d8gP/CB/kLPsRf8mH+io/w13yUv+Fj/C0f5+/4BJ/kU/w9n+Yf+Ayf5XP8I5/nn/gC/8wXOTDEGKtYxyaO4nTxVXFKnD7OEF8dZ4wzxZnja+JEfG2cJb4uzhpfH2eLs8c54pxxrjh3nCe2McUu5jiO88b54mR8Q5w/vjEuEBeMC8WFYx8XiYvGN8XF4pvj4vEtcYn41rhkfFtcKi4dP3Jf2fj2uFx8R1w+rhBXjO+MK8V3xZXjKvHdcdX4nrhafG9cPb4vLh7fH9eMH4hrxQ/GteOH4jrxw3Hd+JG4XvxoXD9uEDeMG8WN48fiJvHjcdO4Wdw8fiJuET8Zt4yfilvFT8et42d+d39q3C3uHr8cvxyHcK+em5yXnJ/8MLkguTC5KPlRcnHy4+SS5NLksuTy5IrkyuSq5OrkmuTa5Lrk+uSG5MbkpuTmZAhVrgKPXnntjY98On+VT/HpfQZ/tc/oM/nM/hqf8Nf6LP46n9Vf77P57D6Hz+lz+dw+j7eevPPsY5/X5/NJf4PP72/0BXxBX8gX9t4X8UV9I9/YN/ZN/OO+qW/mm/sn/BP+Sf+kf8o/5Z/2rf0zvo1/1rf1z/l2/nn/vH/Bd/AdfSf/ou/sX/JdfFef6lN9d9/d9/A9fC/fy/fxfXxf39f38/18f9/fD/QD/SA/yA/2g/0QP8QP88P8cD/cj/Qj/Wg/2o/1Y/04P86P9+P9BD/BT/KT/BQ/xU/z0/x0P93P9DP9rAKz/Gw/28/1c/18P98v8Av8Ir/IL/aL/RK/xC/zy/wKv8Kv8qv8Gr/Gr/Pr/Aa/wW/ym/wWv8Vv9Vv9dr/d7/Q7/W6/2+/xe/w+v8/v9/v9AX/AH/QH/SH/pT/sv/JH/Nf+qP/GH/Pf+uP+O3/Cn/Sn/Pf+tP/Bn/Fn/Tn/oz/vf/IX/M/+og9+bOLtxLjEO4nxiXcTExITE5MSkxNTElMT0xLvJaYnZiRmJt5PzEp8kJidmJOYm5iXmJ/4MLEgsTCxKPFRYnHi48SSxNLEssTyxIrEykQIubfGIW/IF5LhhpA/3BgKhIKhUCgcfCgSioabQrFwcygebgklwq2hZLgtlAqlQ5nwaKgfGoSGoVFoHB4LTcLjoWloFpqHJ0KL8GRoGZ4KrcLToXV4JrQJz4a24bnQLjwf2ocXQofQMXQKL4bO4aXQJXQNqaFb6B5eDj1Cz9Ar9A59wiuhb3g19Auvhf5hQBgYXg+DwhthcHgzDAlDw7DwVhgeRoSRYVQYHcaEseHtMC68E8aHd8OEMDFMCpPDlDA1TAvvhelhRpgZ3g+zwgdhdpgT5oZ5YX74MCwIC8Oi8FFYHD4OS8LSsCwsDyvCyrAqrA5rwtqwLqwPG8LGsClsDlvCJ2Fr2Ba2hx1hZ9gVdodPw56wN+wLn4X94fNwIPwlHAxfhEPhy3A4fBWOhK/D0fBNOBa+DcfDd+FEOBlOhe/D6fBDOBPOhnPhx3A+/BQuhJ/DRfmbNSGEEEKIP0T/zv5u/+B76QBA/bruDgCZtuU8/O9rbsj213VPlatFAgCe7tr+ob9tlSqlpqb++tolGqJ8cwAg8ff1/xYvhebwJLSCZlDsH/bXU3U8z79TP3krQIZ/k5MCl+PL9W/+D+o/9sSwBSXjc1n+k/pzAArku5yTHi7Hl+sX/w/qZ2/yO/2n/2IsQNN/k5MRLseX6xeFx+EZaPV3r/wDAxZCCCGEEEIIkSb0VGXa/t7986X781zmcs5VcDn+vftzIYQQQgghhBBCXHnPdez01GOtWjVr+8cW+OtzgX8u609b1Nq299lLh78yR5fFf3mBAPC/oA1Z/PHFFX5jEkIIIYQQQvzpLl/0X+lOhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEKItOt/4t+JXelzFEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIa60/xcAAP//daA1bQ==") mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) setuid(0xee01) ioctl$FS_IOC_RESVSP(r0, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x2, 0x3}) 15.099678712s ago: executing program 1 (id=386): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6a) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x70bd25, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x30, 0x80, 0x3c, 0x0, 0xee01}}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x2500, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000014"], 0x188}}, 0x0) 14.229993152s ago: executing program 0 (id=387): prlimit64(0x0, 0xe, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi0\x00', 0x8080, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x6, 0x100000b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmmsg$unix(r1, &(0x7f0000005100)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000100)=""/94, 0x5e}], 0x1}}], 0x1, 0x10101, 0x0) socket(0x1e, 0x4, 0x0) close(0x3) socket(0x10, 0x3, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8000) prlimit64(0x0, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, &(0x7f0000000080)={0x0, 0x1e, '\x00', [@padn={0x1, 0x1, [0x0]}, @generic={0x7, 0xc7, "4e326749493471bdd2b2613f64b5fe828b53e12a9bc13306102bc1d1d3f33138527e5326ec08c0cbdb186fa59455c3a1e9aa20ba3deaf32f7c04a77b1e8dba68faf84ae68f3230865545302fe8a9fba06661444f4fabd97f363a70ad471520dccd301eb5bfc32a81c185b628ec35497bba54b1252ac7b9944c4f9e0ed6ffa8dd18309affcff44889e8082c39b3bb1aaedc7784ac6dd2a46cd95b0d3b92afb6168fb0edca4af92bb6ab941b56317d6962a6184600842291501e55c19bac5ca89ea759528b529095"}, @enc_lim={0x4, 0x1, 0xb}, @jumbo={0xc2, 0x4, 0x3ff}, @ra={0x5, 0x2, 0x7}, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, @jumbo={0xc2, 0x4, 0xfff}, @jumbo={0xc2, 0x4, 0x1}]}, 0x100) 13.637036336s ago: executing program 1 (id=388): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb01001800000000000000300000003000000005000000000000000100000408000000000000000300000010000000000000000000000200000000030000000000000404000000000000"], 0x0, 0x4d}, 0x28) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0xc0ed0006, &(0x7f0000000240)={[{@jqfmt_vfsold}, {@resgid}, {@bh}, {@noload}, {@data_err_ignore}, {@noblock_validity}]}, 0xfe, 0x445, &(0x7f0000000900)="$eJzs3MtvG0UYAPBv7Tz6JKGUR0MLgYKIeCRN+qAHLiCQOICEBIciTiFJq1C3QU2QaBVB4BCOqBJ3xBGJv4ATXBBwQuIKd1SpQrm0cDJaezd1HTuNE6cu8e8nbTvjHXfm293xzs7YDaBrDad/JBH7IuKPiBioZm8vMFz96+bK4tQ/K4tTSZTLb/+dVMrdWFmcyovm79tbzZTLWb6/Qb3L70VMlkozl7L82MKFD8fmL195YfbC5LmZczMXJ9J/7UjfqYmTbYkzjevG0Cdzhw+9/u7VN6fOXH3/l+/SGvZl+2vjaJfh6tFt6Ol2V9Zh+2vSSU8HG0JLihGRnq7eSv8fiGLsXt03EK993tHGAduqXC6XG92fM0tlYAdLotMtADojv9Gnz7/5dpeGHveE6y9XH4DSuG9mW3VPTxSyMr11z7ftNBwRZ5b+/TrdYpvmIQAAav2Qjn+ebzT+K8RDNeXuy9ZQBiPi/og4EBEPRMTBiHgwolL24Yh4pMX661dI1o5/Ctc2FdgGpeO/l7K1rdvHf/noLwaLWW5/Jf7e5OxsaeZYdkxGorc/zY+vU8ePr/7+ZbN9teO/dEvrz8eCWTuu9dRN0E1PLkxuJeZa1z+LGOppFH8S+TJOEhGHImJok3XMPvvt4Wb77hz/OtqwzlT+JuKZ6vlfirr4c0nD9cnTp08cH3/x1MTJsV1Rmjk2ll8Va/362/JbzerfUvxtkJ7/PQ2v/9X4B5NdEfOXr5yvrNfOt17H8p9fNH2m2ez135e8U0n3Za99PLmwcGk8oi95Y+3rE7fem+fz8mn8I0cb9/8DcetIPBoR6UV8JCIei4jHs7Y/ERFPRsTRdeL/+ZWnPmg9/nVm5dsojX/6Tuc/as9/64ni+Z++bz3+XHr+T1RSI9krG/n822gDt3LsAAAA4P+iUPkOfFIYXU0XCqOj1e/wH4w9hdLc/MJzZ+c+ujhd/a78YPQW8pmugZr50PFsbjjPT9Tlj2fzxl8Vd1fyo1NzpelOBw9dbm+T/p/6q9jp1gHbzu+1oHvV9f/yp51qCHDXuf9D99L/oXvp/9C9GvV/cwDQHdz/oXvp/9C99H/oXvo/dKWmv40vbOkn/xI7PhGFe6IZOz/Rs+H/zGKTif6Guzr9yQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAe/wUAAP//ziLlLw==") r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000340)='afs_cm_no_server_u\x00', r1, 0x0, 0x106}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYBLOB="00c55345378425783138848dafb57545fb00000000000000000000000000000000000000000000000000000063c4fa0d9fafd200dee1bc53c45c4e0016eaae7dfef3a41aa49930cbf61a0320b46ac479bdbba3eabbb38d0e6f4d97206ce44ac09f762fd6f340391712c3773375abd611d36301f500000ef4ca10364e522038f0516a237dbde311ac38a41c576ce1d6272b8d3ada8be7a1de811fa56faf813d26cba3ecce440c1787fd233fcac488ed01d535c8f6f74a4d76398f2ff8dd905a74d429ab427fb30de1ad675296b3b47b834ee7d36af5"], 0x48) r7 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r5, r6, 0x4, 0x0, @void}, 0x10) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r7, r5, 0x4, r5}, 0x10) getgroups(0x2, &(0x7f0000001080)=[0xee01, 0xffffffffffffffff]) keyctl$chown(0x4, 0x0, 0xee01, r8) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r9) r10 = socket(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r11, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r10, 0x89f3, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000400)={'syztnl1\x00', r12, 0x2500, 0x2500, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x7d, 0x2f, 0x0, @empty, @private}}}}) lseek(0xffffffffffffffff, 0x1, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@bloom_filter={0x1e, 0x0, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0, 0x0, 0x1}, 0x48) 13.264297063s ago: executing program 3 (id=389): syz_mount_image$udf(&(0x7f0000000f00), &(0x7f0000000080)='./file0\x00', 0xa00004, &(0x7f0000000400)=ANY=[@ANYBLOB="6d6f64653d30303030303030303030303030303030303030303031362c696f636861727365743d6d61636963656c616e642c757466382c756e686964652c616e63686f723d30303030303030303030303030303230313436372c6c617374626c6f636b3d30303030303030303030303030303030303030322c756e686964652c696f636861727365743d6b6f69382d722c6164696e6963622c6769643d666f726765742c6c617374626c6f636b3d30303030303030303030303030303030303030352c66696c657365743d30303030303030303030303030303030303030372c616e63686f723d30303030303030303030303030303030303030322c6c6f6e6761642c616e63686f723d30303030302a30303030303030303030308b3161d1239b9b5f2496b6a25bd03030322c7530303030303030303030303030303030372c7569643d17245f5fb01261502b2366d430dc686137ba", @ANYRES32, @ANYRES16], 0x1, 0xc4d, &(0x7f0000000f40)="$eJzs3U9sHNd9B/DfGy3FldxWTJwqThoHm7ZIZcZy9S+mYhXuqqbZBpBlIhRzC8CVSKkLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBAhQwWMzsW3FJkbYskhIlfz429Z2deW/mvZn1jCzozQsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIOL3Xr546nTaZsOhh9AYAOCBuDz2tVNntnv+AwCPrSs7/f8/AAAAAAAAAAAAAABwUKQo4slIMXd5LU1Unzvql9p9t26PD49sX+1IqmoeqsqXP/XTZ86e+/LzQ+e7eak98wH199pn49WxKxcbL83enJufWliYmmyMz7SvzU5O3fMedlt/q8HqBDRuvnZr8vr1hcaZ585u2nx74L3+J44PXBh65uTT3bLjwyMjYxtF6r3la/fdkI6dRngcjiJORopnv/+z1IqIInZ/LuoP9tpvdaTqxGDVifHhkaoj0+3WzGK5cbR7IoqIRk+lZvccbX8totb3QPuws2bEUtn8ssGDZffG5lrzravTU43R1vxie7E9OzOaOq0t+9OIIs6niOWIWO2/e3d9UUQtUnz32Fq6mt/6UZ2HL1UDg3duR7GPfbwHZTsbfRHLxSNwzQ6w/ijilUjx87dPxLV8n6nuNV+MeKXMH0a8WeaLEan8YpyLeHeb7xGPploU8efl9b+wliar+0H3vnLp642vzlyf7Snbva98xOfDXXeKh/R8OLIlH4wDfm+qRxGt6o6/lu7/NzsAAAAAAAAAAAAAAAAA7LUjUcRnIsXL//ZH1bjiqMalH7sw9PsDv9w7ZvypD9lPWfa5iFgq7m1M7uE8MHA0jab0kMcSf5zVo4g/zuP/vv2wGwMAAAAAAAAAAAAAAAAAAPCxVsRPI8UL75xIy9E7p3h75kbjSuvqdGdW2O7cv90509fX19cbqZPNnBM5l3Iu51zJuZozilw/ZzPnRM6lnMs5V3Ku5oxDuX7OZs6JnEs5l3Ou5FzNGbVcP2cz50TOpZzLOVdyruaMAzJ3LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA46SIIt6PFN/55lqKFBHNiIno5Er/w24dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFDqT0X8IFI0/qB5Z10tIlL1b8eJ8pdz0Txc5iejOVTmi9G8mLNVZa357YfQfnanLxXxk0jRX3/rzgXP17+v8+nO1yDe/NbGp8/WOnmou3Hgvf4njh+7MDTy+ad2Wk7bNWDwUnvm1u3G+PDIyFjP6lo++id71g3k4xZ703UiYuH1N15rTU9Pzd//QvkVuM/q3Su5i6M/yIVUe2SaamEvFqJ2IJrxcPq+Sf1h3JzYd+Xz/91I8dvv/Hv3gd95/tfjlzqf7jzh4xd/svH8f2Hrju7x+V/bWi8//8snwXbP/yd71r2QfzfSV4uoL96c6zseUV94/Y2T7ZutG1M3pmbOnTr1laGhr5w91Xc4on69PT3Vs7QnpwsAAAAAAAAAAAAAAADgwUlF/G6kaP1kLTUi4nY1XmvgwtAzJ58+FIeq8Vabxm2/OnblYuOl2Ztz81MLC1OTjfGZ9rXZyal7PVy9Gu41PjyyL535UEf2uf1H6i/Nzr0+377xh4vbbj9av3h1YXG+dW37zXEkiohm75rBqsHjwyNVo6fbrZmq6ui2g+k/ur5UxH9EimvnGukLeV0e/791hP+m8f9LW3e0h+P/P390Y/zfJ3qKlsdMqYhfRIrf+oun4gtVO4/GXecsl/ubSDF4/nO5XBwuy3Xb0HmvQGdkYFn2fyLFP7y/uWx3POSTG2VPf6ST+wgor/+xSPGDP/te/Hpet/n9D9tf/6Nbd7RP73/4VM+6o5veV7DrrpOv/8lI8eKTb8VvVGv+7wPf/9F9Y8OJTuGN93Ps0/X/1Z51A/m4v7lXnQcAAAAAAAAAAHiE9aUi/jZS/Giklp7P6+7l7/9Nbt3RPv39r0/3rJvcm/mKPnRh1ycVAAAAAA6IvlTETyPFjcW37oyh3jz+u2f85+9sjP8cTlu2Vn/O9yvVewP28s//eg3k407svtsAAAAAAAAAAAAAAAAAAABwoKRUxPN5PvWJajz/5I7zqa9Eipf/69lcLh0vy3XngR+ofq1fnp05eXF6erYei62r01ONsbnWtamy7qcixdpffy7XLar51bvzzXfmeN+Yi30+Uoz8XbdsZy727tzknfnA6+vrEafLsp+IFP/595vL5qmp89zR1X7PlGX/KlJ845+2L3t8o+zZsuz3IsWPv9Holj1alu2+H/XTG2WfuzZb7MNVAQAAAAAAAAAAAAAAAAAA4OOmLxXxp5Hiv28u3xnLn+f/7+v5WHnzWz3z/W9xu5rnf6Ca/3+n5fuZ/796r8DSTkcFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDHU4oi3ogUc5fX0kp/+bmjfqk9c+v2+PDI9tWOpKrmoap8+VM/febsuS8/P3S+mx9cf699Jl4du3Kx8dLszbn5qYWFqcnG+Ez72uzk1D3vYbf1txqsTkDj5mu3Jq9fX2icee7sps23B97rf+L4wIWhZ04+3S07PjwyMtZTptZ330e/S9ph/eEo4i8jxbPf/1n6UX9EEbs/Fx/y3dlvR6pODFadGB8eqToy3W7NLJYbR7snooho9FRqds/RA7gWu9KMWCqbXzZ4sOze2FxrvnV1eqox2ppfbC+2Z2dGU6e1ZX8aUcT5FLEcEav9d++uL4p4LVJ899ha+uf+iEPd8/Cly2NfO3Vm53YU+9jHe1C2s9EXsVw8AtfsAOuPIv4xUvz87RPxL/0Rtej8xBcjXinzhxFvRud6p/KLcS7i3W2+RzyaalHE/5bX/8Jaeru/vB907yuXvt746sz12Z6y3fvKI/98eJAO+L2pHkX8uLrjr6V/9d81AAAAAAAAAAAAAAAAwAFSxK9FihfeOZGq8cF3xhS3Z240rrSuTneG9XXH/nXHTK+vr683UiebOSdyLuVczrmSczVnFLl+zmaZ9fX1ifx5KedyzpWcqznjUK6fs5lzIudSzuWcKzlXc0Yt18/ZzDmRcynncs6VnKs544CM3QMAAAAAAAAAAAAAAAAAAB4vRfVPiu98cy2t93fml56ITq6YD/Sx9/8BAAD//9kg9g0=") r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000066000000004b64ffec850000006d000000c50000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xfffffeb7) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x4d}, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x14) r4 = socket(0x1e, 0x4, 0x0) connect$tipc(r4, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmmsg$unix(r4, &(0x7f0000004400), 0x400000000000203, 0x0) 10.154250644s ago: executing program 0 (id=390): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$media(&(0x7f0000000080), 0x10001, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r1, 0x80047c05, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$usbfs(&(0x7f0000000140), 0x76, 0x101301) socket$xdp(0x2c, 0x3, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x300, 0xff, 0xfffffffffffff0af, 0xffffffffffffffff, 0x0, 0x10000, 0x103, 0x3}, 0x0, &(0x7f00000002c0)={0x3fe, 0x8000000005, 0x3, 0x7, 0x9, 0x45ff, 0xd68d, 0x40000000000}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 9.833211065s ago: executing program 1 (id=391): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1d1) mount$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) r3 = socket$nl_generic(0x10, 0x3, 0x10) fstat(0xffffffffffffffff, 0x0) open_by_handle_at(0xffffffffffffffff, 0x0, 0x1) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="1800000024000103000000000000000001008c000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r4 = syz_open_dev$dri(0x0, 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r4, 0xc01064d1, &(0x7f0000000040)={0x1, 0x0, &(0x7f0000000080)=[0x0]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r5, &(0x7f0000006380)=[{{&(0x7f0000002f80)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, 0x0}, 0x1}], 0x1, 0x2, 0x0) syz_io_uring_setup(0x3b, &(0x7f0000000400)={0x0, 0x2, 0x10100, 0x2, 0x2b5}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r6, 0x0, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0, 0x10, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x114, &(0x7f0000000280)=0x7, 0x0, 0x4) r9 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) close(r9) r10 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_opts(r10, 0x29, 0x4d, 0x0, 0x8) fcntl$setstatus(r9, 0x4, 0x2c00) recvmmsg(r3, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/4082, 0xff2}], 0x1}, 0x5}], 0x40000000000000d, 0x2000, 0x0) syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x700, &(0x7f0000000340)={[{@dioread_lock}, {@dax_never}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x4}}, {@init_itable}, {@noload}, {@noinit_itable}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@quota}]}, 0x1, 0x468, &(0x7f0000000400)="$eJzs3M9vFFUcAPDvTFuQn62IP0DUKjE2/mhpQeXgRaOJB4wmesBj3RZCKNTQaoQQqcbgxcSQ6Nl4NPEv0JMXo55MvOrdkBDlApqYrJnZGdguu6VLl11gP59k2vf2vZ333r55s2/m7W4AfWs0+5NEbI6I3yNiuBZdnmG09u/yxdOVfy6eriRRrb75V5Lnu3TxdKXMWj5vUxEZSyPST5KikOUWTp46Oj03N3uiiE8sHnt3YuHkqWeOHJs+PHt49vjU/v379k4+/9zUsx1pZ9auSzs/nN+149W3z71WOXjunZ+/zeq7uUivb0cr69osczRr+N/VXGPa423u61a3pS6cDPawIrRlICKy7hrKx/9wDMTVzhuOVz7uaeWAmyp7b1rfOnmpCtzBkuh1DYDeKN/os+vfcuvS1OOWcOHF2gVQ1u7LxVZLGYy0yDPUcH3bSaMRcXDp36+yLVZ5HwIAYC0+q3x5IJ5uNv9L4766fFuLNZSRiLg7IrZFxD0RsT0i7o3I894fEQ+0WX7j0tC185/0/A01bJWy+d8LxdrW8vlfOfuLkYEitiVv/1By6Mjc7J7iNRmLofVZfHKFMn54+bfPW6XVz/+yLSu/nAsW9Tg/2HCDbmZ6cTqflHbAhY8idg42a39yZSUgiYgdEbGzvV1vLQNHnvxmV6tM12//CjqwzlT9OuKJWv8vRUP7S8nK65MTd8Xc7J6J8qi41i+/nn2jVflran8HZP2/cfnx35hlJKlfr11ov4yzf3za8prmRo//dclb+fmo7KgPphcXT0xGrEsO5A+Wh0b++NTV55bxMn/W/rHdzcf/trhawIMRkR3ED0XEwxHxSFH3RyPisYjYvUL7f3qpddqt0P8zTc9/V47/hv5vPzBw9MfvWpW/uv7fl4fGikfy8991rLaCa3ntAAAA4HaR5p+BT9LxK+E0HR+vfYZ/e2z8PuYXFp86NP/e8ZnaZ+VHYigt73QN190PnUyWij3W4lPFveIyfW9x3/iLgQ15fLwyPzfT47ZDv9vUYvxn/hzode2Am67ZOtpUu992A25LjeM/XR4983o3KwN0le9rQ/+6zvhPu1UPoPtajP8N3a4H0H3Nxv+Zhri1ALgzrTD/f3+8mxUBus79P+hfxj/0L+Mf+tJavtcv0BeBavE7Gw1Jkfa6YgINgeS/2o96dmSHvT4zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMb/AQAA//86AfD3") 9.647621098s ago: executing program 0 (id=392): r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x80800, 0x0) ioctl$mixer_OSS_ALSAEMULVER(r0, 0x80044df9, 0xffffffffffffffff) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)}, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SEND={0x1a, 0x40, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5c, 0x10}) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00', 0x2}) ioctl(r4, 0x8b32, &(0x7f0000000040)) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 9.538210947s ago: executing program 3 (id=393): dup2(0xffffffffffffffff, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_mount_image$nilfs2(&(0x7f0000000dc0), &(0x7f0000000400)='./file0\x00', 0x94, &(0x7f0000003280)=ANY=[@ANYBLOB="0001def4774774366f0b8a20db13db64e85fc9322c3fe018b91ff1291b4f4c56de7e4543f49818e1307d98d09daa1e2a7dbf88003e9401dc73aad0b7dbb5685565c7825ba8340621faeae92abed19c524ab06c4303258d253722e159642af447aeb096c6a26d345d82f2925163331b0e9157441a9c61dd1051d3b970f9ac12f5975cf1ad4e45acef1a54921c492a77bcb1858b68758ed339608b8e43c733219f1f9e0b867840f821e03bc0e8a497c4d5dde436000090a397637dedb2f3"], 0x1, 0xd99, &(0x7f0000006900)="$eJzs3UtvXNUdAPBzx544LxqHmMZN09glpbiP2CRYpbsaKV2gSqgSnwClgYYa+ghdgIKUsOi2kRAfoIh9F31mgRSxSsWmVb8AYtVNipBoG1UCI9vnjMf/zOjOOLbH4/n9pDtn7v2fe88587hz575OAkZWY+1xcXG6SuntW29dvDcz/r/VKTOtHLNrj+N5bCml1GzNl9JkWN7SxHr62SfXLrWnn+e0ShdSlarW9PTs3da8R1JK19Nsup0m03Mfn7z50gfPLL934saJi2/M3dmZ1gMAwGi596N3f/m3x3947fj/f39mKU20ppft86U8fjRv9y9V6+M5af0PqNrSqm28OBDyjeehEfKNdcjXXk4z5BvvUv6BsNxml3wTNeWPtU3r1G4YZhv/46vG/KbxRmN+fv0/+aoPxw5U869cWX7h6oAqCmy7T2fyLj6DwTByw8qxQa+BANbF44b3uR73LDyY1tLGeyv/7tONzvPDNtjtz7/yh6v8d29Y47B99uunqbSrfI+O5vF4HGE8zNfv978sLx6PaPZYz27HEYbl+EK3eo7tcj22qlv94+div/paTsvrcCbE278/8T0dlvcY6Oye/f8Gw8gOK4NeAQF7VjxvbiUr8XheX4xP1MQP1sQP1cQP18SP1MRhlP3h1d+mm9XG//z4n77f/WFlP9tDOf1Sn/WJ+yP7LT+e99uvBy0/nk8Me9rcf09/+uvbf4/n/38ezv8/m39LJ/MKouwvjPvVW+f+hwuDG13yPRyq81CH/GvPpzbnq6Y2lpPa1jP31WN683zHuuU7vTnfZMh3OG+LHAz1jdsnh8N8ZfujrFfL6zUe2tsM7TgQ6lHemeM5PRjac7xbu8KO7AMhXzMPJ0K7pkK7HgnzfTm0q5re3K64/7zU52SYHo+TlHzhbbvvdym+F/G6jEdz+mZO38np+zn9qEO5o6h8Hrud/18+n9OpWb1wZfnyE3m8fE7vjDUnVqef3+V6Aw+u1+t/ptPm63+OtqY3G+3rhWMb06v29cJkmH6hy/Qn83j5Pfvp2KG16fOXfr78k+1uPIy4q6+9/rPnl5cv/8oTTzzxpPVk0GsmYKctvPryLxauvvb6uSsvP//i5Rcvv3L+ie9/78mnnlpcWNuqX2jftgf2l40f/UHXBAAAAAAAAAAAAOhZdajz5JzW3d+2XE9erk+P18czHMr7Vj4N5T4G5frPbvd1KddvHt+FOrL9duNyokG3Eejs3+7/azCM7LCy4i7+wN4w6P7/yn0PS3r03D+Prw4l292nN68v4/0L4UHs9f7nlL+/+v9r9X/V8/ov9Jg1ubVy/3jv0D/aik2nei0/tr/cB3aqv/L/lMsvrXks9Vb+yu9C+fFGpT36cyj/cI/l39f+01sr/y+5/PKyzZ3ttfz1GleNzfWI+43LfQDjfuPir6H95d5+fbd/ix213crlwygbln4m+zUs/X92U5Zb1oN59dw6Tlfuvx37O+i3/uW+3+V34JGw/Krm903/n8Otrv/P8vlb0P8n7DsfOv5nMIzssLKyMtCuT0a135W9YtCv/6C3IQdd/qBf/zqx/8/4fyn2/xnjsf/PGI/9f8Z47F8rxmP/n/H1jP1/xvjJsNzYP+h0TfwrNfFTNfGv1sRP18Tj/7cYn62Jn6mJz9TEH66JP1oTP1sT/0ZN/LGa+OM18bma+H739ZyOavthlMV+I33/YXSU4z/dvv9TNXFgeMV+neP3+5s1cWB4lfM8fL9hBFWd79gR97eX/bhv5vSdnL6f0492rILshm/l9Ns5/U5Ov5vTczmdz+lCTvUNOdx+869TZ25WG+f5HQvxXs8njdcDxPvEnO+xPvH4XL/ns57ssZydKn+Ll4MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADI3G2uPi4nSV0tu33rr4n6kf/Hh1ykwrx+za43geW0opNVNKVR4fD8u7PrGefvbJtUud0ipdWHss4+nZu615j6zOn2bT7TSZnvv45M2XPnhm+b0TN05cfGPuzs60HgAAAEbDFwEAAP//ManlwQ==") r2 = open(&(0x7f0000000240)='./file1\x00', 0x2, 0x62) r3 = open(&(0x7f0000000180)='./file1\x00', 0x185102, 0x2b) ftruncate(r3, 0x2007ffb) sendfile(r2, r3, 0x0, 0x1000000201001) pivot_root(0x0, 0x0) socket$kcm(0x21, 0x5, 0x2) sendmsg$kcm(0xffffffffffffffff, 0x0, 0xff4c) fsopen(0x0, 0x0) r4 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x109801, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000000080)=0x74000000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) write$dsp(r5, &(0x7f0000002000)='`', 0x88020) 5.116023397s ago: executing program 0 (id=394): socket$inet6_sctp(0xa, 0x1, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000102c0)={0x2020}, 0xfffffe5d) r1 = socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x2000007d, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x40, 0x24, 0xd0f, 0x50bd2f, 0xfffffffc, {0x60, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_etf={{0x8}, {0xfffffffffffffea5, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xb, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x3004408c) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r8 = shmget$private(0x0, 0x3000, 0x4, &(0x7f0000ffa000/0x3000)=nil) shmctl$IPC_STAT(r8, 0x2, &(0x7f00000000c0)=""/116) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) 4.975855151s ago: executing program 1 (id=395): openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000340)='./file1\x00', 0x0, &(0x7f0000000000)={[{@compress_algo={'compress', 0x3d, 'lzo'}}, {@clear_cache}, {@compress_algo={'compress', 0x3d, 'lzo'}}]}, 0xff, 0x50d4, &(0x7f00000051c0)="$eJzs3U+IVWUfB/Dnzjg6KDjXnbp48QW3wiQKRURDaFaYc82CosVMLYIQYVAwFy3EgpIWDgha4cJgWmR/nFVFC3GVBEEQBcEgzEKQdkIxGC6Ke8957pz7HO+5dyZ1TD+fmDnnOb/zPOeZy1nc783n3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhhJNz585V1bdemTm7Y2DP1Us3T+w8NTE6H0KtdbyW1yeeeuaFNw5MPD8cO0zuz7b1erchs67zWWN1x8Fmv86f10IIQ8kAg/l292Bp1OLu4fKAlfZfXNh25NbeXTPHxg9dOLp5qvyn0zS80hNYKfl9dW3xXhpr/R5Izmi3C7dereMWzfqnN9w9+SMAgCUZbbQ27bej+Vvcdvt4Wk/aY0l7OmnHdwjTxcZyZOOu7jbPLWl9heY5lkWFNd3mWU/q+evfbjeSekjbnVFjCfPsPDWPNMPd5jmV1FdqngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD3k6c/+eJ6VX3rlZmzOwb2XL1088TOUxOj8yHUW8drWbn2xMLcwqa3dj/63e4vP/6zPn5yMO8Xt6sKJ4ff4s5jIyG8Xqhci8P+vj6ERmeh1QwflQtvtnaejQUAAAAeJJtavwfa7SwODnW0a600WWv9F2Vhcf/FhW1Hbu3dNXNs/NCFo5unlj9eo8t4Y7cdr92uL/7UCsE4xt90vMV6PPVwaZxq6Yhpnn959MPtVf1L+b9enf/jKyf/AwAA8G/I/+k41Xrl//nPX91X1b+U/7d0XLKU/+OMY/4fCMvL/wAAAHA/u9v5f6w0TrVe+f/r9/edrupfyv+j/eX/VcVpx4M/xgkfHAlhtNfUAQAAgC7i/3df/Ggh5vXsk4M0r7+49fpQ1Xil/D/WX/6vHBQAAAC4p34488jfVfVS/m/0l//X3NVZAwAAAEvxv/cmD1TVS/l/sr/8vzbf5isfsk7fx3+FcHokhOHmzlRWuBKmn2wXAAAAgDsk5vSXvt18tOq8Uv6fqn7+f3zSQVz/3/H8v9L6/0Ihe+rf4x4MAAAAwMOovJ4/Ph4/++aCbt+/3+/6/09//nVD1fVL+f94f/l/sLi9k9//BwAAAMvwX/v+v1dK41Tr9fz/t9/dsLT8P91f/o/bdcU/73J8fd4ZCWFjcyd/muBn8XIHk8LsUKHQ0kh6HIg98sLsmkKhZSrpsX0khP83d44nhQ2xMJ0UbqzPC+eTwk+xkN8P7cJXSeFyvNPOrM+nmxa+iYV8gcVsXEGxrr0kIunxR7cezcJte8y1Lw4AAPBQieE5z7JDnc2QRtnZWq8T1vY6YaDXCYO9TliVnJCe2O14mOwsxON//TL+XKhQyv/n+8v/8aVYnW26rf8Pcf1//r2G7fX/k7FQTwqzsdBInxjQiNfIwu4H8Rr1Rt7jxsZ2AQAAAB5o8XOBwRWeBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAPe/ceY8dVHw787PN61+vdDUHKQxYxL0N+ktdrOw7WLyCcVBEIpGQtov6DQtbYm9TxBhs/Co4s1RhUlCKEC66IQh+2RFSnEsgqbXmEEosqQVUtGoU2fziPpgWEKkGjFNclSiRX986c2bln9j78WNsbPh/Je8+933POzDn33vGcmblnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgt8PV373hy+3i7/jR1796U+8HXvjBbw6u/9I9ky+FMNV4vScL97zvzHNnrvvU7Ru+d/s3Hjk9fudDg3m5PB6W1v/05k8+F2v92bIQvt0TQn8aWDWSBQby5yOxvuUjIVwV5gJFiZnhrES64PDkUAhHwlygqOq7QyGMlAJ3PfPDJ75YTxweCuGdIYRauowXatkyhtLAysEsMJwGdvRngf89mykC3+nNAnDB4peh+NAfn2rOMD5/uRafv4GLtmKXV9q8vpgYb53vV7cu8EqVDKYvTF3Q21apjgVR+Xqc8G1bBN+2Sj8f8raVd6TyPZSzc6Fa6N06c+/mvbN74iu9YWKir1VNC/Q+n3pl/5ZzSS+az2FcgfGL8jm8//DNzw5+7I4XH3n98f2na19bfqGr2ap7F1ot5J+5RfM+RhttTxbB16+yl7TCTlcI4fSJk/vbxSvj//H24//4cY6PvU25Y62vjWZj8/jKSEy8PJqNzQEAAGDRWAxHTQdX/OtP29VXGf+v6O78fzzlnw/ms9aeCGFjI/HZsRCubbyeBR6Li/v4WAhvbaSmmgO3JoETIVzXSNxYVJWUWBJLrEgCvxjNAxuTwFMxMJUEHo2BQ0ngczFwPAlsiYETSeC2GAjbmtvx/0bzdnQdGIqB6awTj8erEH49GpeW9NVzRVUAAAAXST46HGh+WrrW4UIzxOHl8aFOGeIV2C0z1JIa0hFsMaxqWUN/pxp6O9VQtPtA++ZXau7pVHPlMoye5gz/c+qaHaGNyvh/sv34vzbPivRUzv+HyU2Nh5i7N4/MFhmmp5oyAAAAABfg9948vbldvDL+39jd9f/xmEhfKXM4GQ9DbB8LYbI5kFV7SzWQnfVemgcAAABgMSjOxxfnwrflj9kl2ul4upp/6hzzxxP/G+fNv+PH//J4u/WtjP+nurv+f7j5MVuJp+JafGUshCWlwI/iWtYDDSti4KX3Nwfy9j8VO+ALsar8woSiqi/EEtMxMJkEjrQq8XRR4trmQP5mFQv/bNGObXmJUgAAAAAuuXg4IJ6Xj9f/r/nbP3yyXbnK+H/63K7/b4yDK5f3zy4NYXV/CH3pDwNODmcTA8bASE+e+PvhrK6+tKqDwyHcUm9YWtV/5PP/96dzDP5kKKsqBq5927FXVtYTXx8KYXU58OxHj66vJ/YmgWLhvzsUwg311qYL/7sl2cIH0oU/vCSEt5QCRVVbloRQX9hgWtU/1PL7GKRVHa+FcHUpUFT1nloI+wIAi1X8v3Rr+cXd+x7cvnl2dmbXAibiQfyhcO+22ZmJLTtmt9ZarNPWZJ2b5jH6TLVN3d765vk4R9Hdx8a6SRc/FJwsLys/kF+5cjB/HneGBhrtXDvQ9HRd2uR3v726iFDalWrV5N4FbvJwuZK5N7FSf8w/GJaGJXt3z+ya+PTmPXt2rcn+dpt9bfY3nmfK+mpN2lfD861bFx+PltNlJc63r1aWK1m954Gdq3fve3DVtgc23zdz38wnNkyuW7vh5sn171ldb9Rk9rdDS1fOV3PS0rNHu2zWRWzp9f2lSi7FRkNCQmKxJQYH7jzVbvNTGf/vbD/+j1uduOHP52dodf5/PJ7mz16fO80/HQNHuj3/P97qbH5xYcCKJHAgBg44zQ8AAMAbQzwcGY9mxoPSB971wvvalauM/w909/v/izT/fzF1/YdaTfN/Yywx2Wr+/3Sa/2L+/wOt5v9Pp/kv5v8/chnm/99bBJIu+bX5/wEAgDeCSzf/f8fp/dMbBFQydJzeP71BQCVDx2n8u71BwDnP//83v1yzPrRRGf8f6m78b+J+AAAAuHJcc9sNP24Xr4z/j3Q3/r/08/+FVtf/r2gVmGo1MaD5/wAAAFikWs3/98xHdr6/XbnK+P94d+P/eNlFb1PuWOtro9mcdiGd0+7l0eInAwAAALA49IaJiYEu8zZNjHrr+S/zVJwKtE267NDnj53b7/9PdDf+b/pdxv2Hb3528GN3vPjaI68/vv907WvL587/AwAAAAun2+MSAAAAAAAAAAAAAADA5ffo1d+ad16AqPL7/7Cp8Xqr3//H+/413TTxTD4Z4IE4s/6XxkzzBwAAAAvroVtffTj+u+/Lf/Rf7fJWxv/j3Y3/4/0F8vvgZbfeOxHv//fZsRAat9YbzwKPxcV9fCyEtzZSU7FEdkO9D8USk1ngsThh4o2xxPRUc1VLYuB4EvjFaB44kQSeioH8KMWxeGPAPx4NYX0jtam5xM5YYjwJ3BkDK5LARAxMJoFlMbAxCfxyWR6YSgL/FAP5zQeLvvrWsryvAAAAzkU+zhpofhrScd7x/k4Zejpl6LiI4U4ZejtlqLXIEJ//dVyHgfJ8/HmG+NJAWutQUkslQ7wZ3vk3vZiu7+nmnGnByqL7YsHx5pwxw85/vukroY3K+H9Fd+P/y3j///Ru/htjYEUS2BkDG5PA9KY8cOSa5oD7/wMAAHBla3X//9G3/NWhduUq4//J7sb/8UDEm5tyx1o73/8/f37Xh7+5r7HKJ0dDeHs5sP3g9qvqiUdHQ3hXOfDE3Tc2Ru0H0xLff/G2n9cT96SBD65605l64r1JYDp20nVpIB5VObMsCcTu/UkaiP1xPA0M5oGHlmXt6En76j9Hsr7qSfvq1Eh2eUVP2lffHsmW0ZM28HASKBr4yTQQG3hHHuhN1+qbS7O1ioGRWPQvlhYXfQAAcGWKe4ED4d5tszOT6U94r+9vfoyabln+mWq1PV0u/vl4a/K7j411k+5L90VrRVUDoVZvwprK7mo5S0+jlRenlg5d9+YWTe50t/feFuVS59p1g61bNJS1aGLLjtmtAx0bvq5zlrX9HbOsqQx2yll6G13aRS1drEsXLeqyb7pY5fi8N0xM9CW5/n8MjocmnT4R3d6vr3yf/1afgnKeo5//91fb1VcZ/2/sbvwf27M0lD7On4u1/mxZCN/umTsaUQRWjWSB2NyRODxePhLCVaV+KErMDGclBpMFhyeHshHqYFrVd4eyYwzx+V3P/PCJL9YTh4dCeGfpvSqW8UItW8ZQGlg5mAWG08CO/iwQr/woAt/pzQJwwYqNQvxA5T91KYzPX67F5++Nck/QtHmVa6DmyTffNneh1NIX8muqCuf2tlWqY0FUvh4nfNsW47ct+LaVd6TyPZSzc6Fa6N06c+/mvbN74ivlPdmKBXqfy3up3aQvwufwwPmvbWe1dAUmk83H5Pzl5v8c9sTq7j9887ODH7vjxUdef3z/6drXlne9Gi3EgcKT//2mq8rdu9BqIf/MLbrtyZTtyWL8b2Dc2xZCOPTnQ59sF6+M/6e6G//3J48Nr8bO3D0WwrtLnXsydv/vjGXbwVIg20peXQ1kl9z/dLTllhMAAAAutuJwR3G8YFv+mP0gPB0nV/NPnWP+eLxi47z5u13v/U/+/mPt4pXx/3T78f+SZDWd/3f+nwXi/P+8rvRD0UvSFw5c0KHoSnUsCOf/53Wlf9uc/5+X8//O/8/H+f8OnP+f15X+tlX2knba6QohnL1+4OF28cr4f2d34//fsvn/09n8i/n/00n7i/n/p1vN/7+z1fz/B8z/DwAALKgWE82n47zK5PyVDOnk/JUMPUmGc7/FQMdp9M3/n87/f/DPbtkT2qiM/w90N/6PH4eR8tIXy/z/45talNi4qXl1i8ChGNjpjgEAAABcRvEAQbzovdsZJgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFhYd7x6ZnO7+Dt+9PWv3tT7gRd+8JuD6790z+RLIWxrvN6ThXved+a5M9d96vYN37v9G4+cHr/zoVpebiB/XN6UO9b62mgIR0qvjMTEy6P1J3OBuz78zX399cTJ0RDeXg5sP7j9qnri0dEQ3lUOPHH3jdfUEwfTEt9/8baf1xP3pIEPrnrTmXrivXmgJ13dP12WrW5PurpfXBbCWClQrO79y5qrKpbxgTzQmy7jL0eyZcTASCz68Ei2jBiYjSW2LQlhdX8IfWlV/1jLqupLq/peLauqL63qD2oh3BJC6E+r+rfBrKr+tOVPD2ZVxcC1bzv2ysp64uhgCKvLgWc/enR9PbErCRQL/8hgCDfUPzLpwr81kC18IF34nwyE8JZSoKhqeiCE+sIG06pO9GdVDaZVfaM/hKtLgaKqm/pD2Be4XOKGZGv5xd37Hty+eXZ2ZtcCJgbzZQ2Fe7fNzkxs2TG7tZasUys9pfTZz5x/259/Zf+WRuLuY2PdpIv1miyvy9NTlRfLz/vzpwONdq4daHq6brE0ebhcydybWKk/5h8MS8OSvbtndk18evOePbvWZH+7zb42+9uXR7O+WrNY+mpluZLVex7YuXr3vgdXbXtg830z9818YsPkurUbbp5c/57V9UZNZn8vRkuPXvqWXt9fquRSbDQkJCQWW6K3aes2eaVvxys7+nMrOhBqjQ10ZVhRztLTaOXFaPSt59Ha3Lk2ujIkqbRoTWXgUMmytnOWdZUxw1yWoSxLY1+wMjgs19Tb6NL4vDdMTPS16ofx5qfl7v3VBXTvqdh1XaYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4P3bgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwAwcCAAAAAED+r41QVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhR04FgAAAAAQ5m8dRs8GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXAoAAP//Qczu7Q==") r0 = open(&(0x7f0000000000)='./bus\x00', 0x60142, 0x10) r1 = open(&(0x7f00000001c0)='./file0/file0\x00', 0x0, 0x81) copy_file_range(r1, 0x0, r0, 0x0, 0x400000, 0x0) 3.571505886s ago: executing program 3 (id=396): bind$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000100)=0x4, 0x4) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x101800, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)={0x0, 0x1, r1}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(0xffffffffffffffff, 0x847ba, 0x0, 0xe, 0x0, 0x0) 3.267698674s ago: executing program 0 (id=397): write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000600)=@IORING_OP_RECVMSG={0xa, 0x40, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x40000103}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000200000c12000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000ffff00000000020000000900020073797a31000000000500010006000000280007800c00018008000140ffffffff0500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0xc4) 410.877231ms ago: executing program 1 (id=398): syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000000100)='./file1\x00', 0x4, &(0x7f0000000340)={[{@part={'part', 0x3d, 0x3}}, {@nodecompose}, {@umask={'umask', 0x3d, 0x1}}, {@barrier}, {@gid={'gid', 0x3d, 0xee00}}, {@force}, {@gid}, {@nls={'nls', 0x3d, 'iso8859-7'}}, {@umask={'umask', 0x3d, 0x5}}, {@creator={'creator', 0x3d, "ef6a7405"}}]}, 0xfc, 0x6f4, &(0x7f0000000c80)="$eJzs3c1vHGcdB/Dv7K7fEpE4bdIWVImoEQURkfhFKQQJJSCEfKhQBAckbiZxGitOWtkuuBGC8H7toX9Ae8iNExL3oHKGC4KjxakSohdOvhnN7Ox6nd111nlzDJ9PNJ5n5pnn7bfPzO6sY02A/1sLZ9O6nyILZ9/cKLc3782vbN6bn6izV5KU6UbSaq9S3E6Kj5PLaS/5bLmzPr4Y1s4Hyxe/9/f/bH7S3mrVS3V8o7/cz7eTfGH0Udytl5xO0qzX/cYe2J5IJh9e39Wh9XVr6Ro8/qKbUwbsTCdwcNC2+9zdT/Gh5ztweBT5xmcG7Z9OjqT9Nlm9z9VXh8az7d2Tt6+rHAAAABywhX+fmtvP8VP1+vhWtrJx6G/jAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4JkqkmZ7VS2NTvp0is7z/8frfanTh9r9g+4AAAAAAAAAAPQZ27U1nmSis3FpcInPb2UrGznW2d4uqt/5v1ZtnKx3vZu1LGU157KRxaxnPauZTTLd29jG4vr66uyukkczqOTcwJJzu/vVHG3Ak6MdBgAAAAAAAAD/836ZhZ3f/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPOgSJrtVbWc7KSn02glmUwyXh53N/lrJ31IFIN23n/2/QAAAIDHMvkIZY5vZSsbOdbZ3i6qe/6Xqvvlybyb21nPctazkqVcq++hy7v+xua9+ZXNe/O3ymVo9aN+P1DVmPZ3D4NbfqU6YirXs1ztOZerVWeupVGVLP0zya1On/r79YtPy7ovtf1kxJ5dq9dlY+93vkWYGLHwUzWdtBoZ60ZkpupbexKc6I1CfyS++emwSi+3V60HW0pvS7NpdF/Zk+0WyuRDY35pxJEdqdfleH477JubJ21yp9G7Qw/qRqKRKhJzPbPvpb1jnnzxj79//8bK7Zs3rq+dfSZDepoenBPzPZF4eYRI/OC5jURr7+zGgztmqp2nOpsfHU3y/ZzN6VzJapbz4yxmPUsp6pEu1vO5/Dm9d6Qu79q6MqQDXeP169Ksj+v2KQv5zsA+nc63q9RiXqvKHstyiryda1nKG9W/uczmq7mQC7nY8wqfGtrvamzVWd/Y31l/5kt1x6eS/K5eH7T2RaGM64meuPZec6ervJ09Yz1RemHvV7f/2vjwIbc+VyfKNn6152x41h6MxGxPJF7cOxIfbZc/11Zu31y9sfjOgHfX7WKsWv/tTLK93d73ep1XzrjfPPzjz58ed3wP0XMdK+fLC5msryQnMtbuWrOT92L3KlPFa7y33Mlu3u533PFMludzo91S+0z97tAzdbz+DNdf01yV9/LAvPkq75WevN7PW8nbWel+HgLgOXbky0fGp/419ZepD6d+PXVj6s3Jb018beLV8Yz9eezrrZnm641Xiz/kw/xs5/4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4dGvv3bm5uLKytDo40WgOzRqSyPadm4udJ/mMWiprRf0knX219SiJo+2HOeVx6uk+8ufpdvVgE0XfnnLET6aJzpOP9ldqpn9GXT7IQP1j72PG++ZYJnuG3Bxa85E6sX28nqr76Fj1NK5dM3PoVJ9oB7M55DytX6JHebgocCicX7/1zvm19+58ZfnW4ltLby3dHrtw4eLMxQtvzJ+/vryyNNP+edC9BJ6Gnc/tAAAAAAAAAAAAwGEx4t8VXPnhj6r/IfhIfy9x0GMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADreFs2ndT5HZmXMz5fbmvfmVcumkd45sJWk0kuKnSfFxcjntJdM91RXD2vlg+WIzySc7dbU6xzf2KLc9MdIo7tZLTidp1uvHsKu+q49dX9EdYRmwM53AwUH7bwAAAP//i/TmyA==") llistxattr(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) 271.905344ms ago: executing program 3 (id=399): truncate(&(0x7f0000000080)='./file1\x00', 0x400000f000) truncate(&(0x7f0000000080)='./file1\x00', 0x400000f000) 0s ago: executing program 3 (id=400): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000050000000000000001000004080000000000000003000000100000000000000000000002000000000300000000000004040000000000002e"], 0x0, 0x4d}, 0x20) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0xc0ed0006, &(0x7f0000000240)={[{@jqfmt_vfsold}, {@resgid}, {@bh}, {@noload}, {@data_err_ignore}, {@noblock_validity}]}, 0xfe, 0x445, &(0x7f0000000900)="$eJzs3MtvG0UYAPBv7Tz6JKGUR0MLgYKIeCRN+qAHLiCQOICEBIciTiFJq1C3QU2QaBVB4BCOqBJ3xBGJv4ATXBBwQuIKd1SpQrm0cDJaezd1HTuNE6cu8e8nbTvjHXfm293xzs7YDaBrDad/JBH7IuKPiBioZm8vMFz96+bK4tQ/K4tTSZTLb/+dVMrdWFmcyovm79tbzZTLWb6/Qb3L70VMlkozl7L82MKFD8fmL195YfbC5LmZczMXJ9J/7UjfqYmTbYkzjevG0Cdzhw+9/u7VN6fOXH3/l+/SGvZl+2vjaJfh6tFt6Ol2V9Zh+2vSSU8HG0JLihGRnq7eSv8fiGLsXt03EK993tHGAduqXC6XG92fM0tlYAdLotMtADojv9Gnz7/5dpeGHveE6y9XH4DSuG9mW3VPTxSyMr11z7ftNBwRZ5b+/TrdYpvmIQAAav2Qjn+ebzT+K8RDNeXuy9ZQBiPi/og4EBEPRMTBiHgwolL24Yh4pMX661dI1o5/Ctc2FdgGpeO/l7K1rdvHf/noLwaLWW5/Jf7e5OxsaeZYdkxGorc/zY+vU8ePr/7+ZbN9teO/dEvrz8eCWTuu9dRN0E1PLkxuJeZa1z+LGOppFH8S+TJOEhGHImJok3XMPvvt4Wb77hz/OtqwzlT+JuKZ6vlfirr4c0nD9cnTp08cH3/x1MTJsV1Rmjk2ll8Va/362/JbzerfUvxtkJ7/PQ2v/9X4B5NdEfOXr5yvrNfOt17H8p9fNH2m2ez135e8U0n3Za99PLmwcGk8oi95Y+3rE7fem+fz8mn8I0cb9/8DcetIPBoR6UV8JCIei4jHs7Y/ERFPRsTRdeL/+ZWnPmg9/nVm5dsojX/6Tuc/as9/64ni+Z++bz3+XHr+T1RSI9krG/n822gDt3LsAAAA4P+iUPkOfFIYXU0XCqOj1e/wH4w9hdLc/MJzZ+c+ujhd/a78YPQW8pmugZr50PFsbjjPT9Tlj2fzxl8Vd1fyo1NzpelOBw9dbm+T/p/6q9jp1gHbzu+1oHvV9f/yp51qCHDXuf9D99L/oXvp/9C9GvV/cwDQHdz/oXvp/9C99H/oXvo/dKWmv40vbOkn/xI7PhGFe6IZOz/Rs+H/zGKTif6Guzr9yQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAe/wUAAP//ziLlLw==") r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000340)='afs_cm_no_server_u\x00', r1, 0x0, 0x106}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYBLOB="00c55345378425783138848dafb57545fb00000000000000000000000000000000000000000000000000000063c4fa0d9fafd200dee1bc53c45c4e0016eaae7dfef3a41aa49930cbf61a0320b46ac479bdbba3eabbb38d0e6f4d97206ce44ac09f762fd6f340391712c3773375abd611d36301f500000ef4ca10364e522038f0516a237dbde311ac38a41c576ce1d6272b8d3ada8be7a1de811fa56faf813d26cba3ecce440c1787fd233fcac488ed01d535c8f6f74a4d76398f2ff8dd905a74d429ab427fb30de1ad675296b3b47b834ee7d36af5"], 0x48) r7 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r5, r6, 0x4, 0x0, @void}, 0x10) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r7, r5, 0x4, r5}, 0x10) getgroups(0x2, &(0x7f0000001080)=[0xee01, 0xffffffffffffffff]) keyctl$chown(0x4, 0x0, 0xee01, r8) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r9) r10 = socket(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r11, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r10, 0x89f3, &(0x7f0000000500)={'gre0\x00', &(0x7f0000000400)={'syztnl1\x00', r12, 0x2500, 0x2500, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x7d, 0x2f, 0x0, @empty, @private}}}}) lseek(0xffffffffffffffff, 0x1, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@bloom_filter={0x1e, 0x0, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r0, 0x0, 0x1}, 0x48) kernel console output (not intermixed with test programs): 2!!! [ 121.877300][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 121.921744][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 122.452443][ T6043] loop3: detected capacity change from 0 to 4096 [ 122.490123][ T6043] ntfs3(loop3): Different NTFS sector size (4096) and media sector size (512). [ 122.635274][ T6043] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 122.692321][ T6043] ntfs3(loop3): Failed to load $Extend (-22). [ 122.699798][ T6043] ntfs3(loop3): Failed to initialize $Extend. [ 122.762676][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.780938][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.000621][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.063162][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.467738][ T6071] loop0: detected capacity change from 0 to 512 [ 124.537955][ T6071] EXT4-fs: Ignoring removed bh option [ 124.631461][ T6071] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 125.560865][ T6081] tmpfs: Unknown parameter '@' [ 125.975552][ T6071] EXT4-fs (loop0): 1 truncate cleaned up [ 126.050787][ T6071] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 126.568809][ T6087] loop4: detected capacity change from 0 to 512 [ 126.823082][ T6087] EXT4-fs: Ignoring removed oldalloc option [ 127.138846][ T6087] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 127.219471][ T6087] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 127.269112][ T6092] loop3: detected capacity change from 0 to 47 [ 127.398575][ T6092] ======================================================= [ 127.398575][ T6092] WARNING: The mand mount option has been deprecated and [ 127.398575][ T6092] and is ignored by this kernel. Remove the mand [ 127.398575][ T6092] option from the mount to silence this warning. [ 127.398575][ T6092] ======================================================= [ 127.437445][ T6087] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2847: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 127.568645][ T6087] EXT4-fs (loop4): 1 truncate cleaned up [ 127.605297][ T6087] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 127.626412][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 130.748677][ T5874] EXT4-fs error (device loop4): ext4_lookup:1787: inode #14: comm syz-executor: invalid fast symlink length 39 [ 130.996615][ T5874] EXT4-fs error (device loop4): ext4_lookup:1787: inode #14: comm syz-executor: invalid fast symlink length 39 [ 131.759486][ T6117] loop5: detected capacity change from 0 to 128 [ 131.795936][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 131.867095][ T6117] UDF-fs: error (device loop5): udf_read_tagged: read failed, block=256, location=256 [ 131.984619][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 132.001573][ T5874] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.010589][ T6110] loop3: detected capacity change from 0 to 32768 [ 133.051423][ T10] usb 1-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 133.090120][ T6120] UDF-fs: error (device loop5): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 133.104867][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.130235][ T10] usb 1-1: Product: syz [ 133.191454][ T10] usb 1-1: Manufacturer: syz [ 133.244775][ T10] usb 1-1: SerialNumber: syz [ 133.270583][ T6117] UDF-fs: error (device loop5): udf_bitmap_new_block: bitmap for partition 0 corrupted (block 264 marked as free, partition length is 40) [ 133.372318][ T10] usb 1-1: config 0 descriptor?? [ 133.392183][ T6110] workqueue: Failed to create a rescuer kthread for wq "bcachefs": -EINTR [ 133.392302][ T6110] bcachefs (loop3): shutdown complete [ 133.434191][ T10] gspca_main: sq905-2.14.0 probing 2770:9120 [ 133.603395][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 133.854562][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.032808][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 134.247865][ T6132] loop1: detected capacity change from 0 to 512 [ 134.262156][ T10] gspca_sq905: sq905_command: usb_control_msg failed 2 (-71) [ 134.285006][ T10] sq905 1-1:0.0: probe with driver sq905 failed with error -71 [ 134.315190][ T6132] EXT4-fs: Ignoring removed bh option [ 134.354642][ T10] usb 1-1: USB disconnect, device number 2 [ 134.367865][ T6132] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 134.437220][ T6132] EXT4-fs (loop1): 1 truncate cleaned up [ 134.490839][ T6132] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 134.504417][ T6131] loop5: detected capacity change from 0 to 40427 [ 134.535487][ T6131] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 134.543538][ T6131] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 134.584715][ T6131] F2FS-fs (loop5): invalid crc value [ 134.701088][ T6131] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 134.836599][ T6131] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 134.843932][ T6131] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 136.004528][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 136.303423][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 137.195926][ T13] bridge_slave_1: left allmulticast mode [ 137.237388][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 137.394150][ T13] bridge_slave_1: left promiscuous mode [ 137.401194][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.442068][ T0] NOHZ tick-stop error: local softirq work is pending, handler #2c2!!! [ 137.502077][ T5876] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 137.551834][ T5876] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 137.560028][ T5876] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 137.574224][ T5876] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 137.587491][ T5876] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 137.761502][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 137.791619][ T13] bridge_slave_0: left allmulticast mode [ 137.797324][ T13] bridge_slave_0: left promiscuous mode [ 137.861151][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.964263][ T6110] bcachefs: bch2_fs_get_tree() error: ENOMEM_fs_other_alloc [ 138.716990][ T6179] loop5: detected capacity change from 0 to 512 [ 138.755672][ T6179] EXT4-fs: Ignoring removed oldalloc option [ 138.814373][ T6179] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 138.922526][ T6179] EXT4-fs (loop5): 1 truncate cleaned up [ 138.954668][ T6179] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 140.311003][ T5179] Bluetooth: hci5: command tx timeout [ 140.426501][ T5867] EXT4-fs error (device loop5): ext4_lookup:1787: inode #14: comm syz-executor: invalid fast symlink length 39 [ 140.480876][ T5867] EXT4-fs error (device loop5): ext4_lookup:1787: inode #14: comm syz-executor: invalid fast symlink length 39 [ 141.161538][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 141.180632][ T6202] loop1: detected capacity change from 0 to 512 [ 141.233771][ T6202] EXT4-fs: Ignoring removed bh option [ 141.451652][ T6202] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 141.907395][ T6202] EXT4-fs (loop1): 1 truncate cleaned up [ 141.922767][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 141.938879][ T6202] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 141.960391][ T13] bond0 (unregistering): Released all slaves [ 142.900749][ T5179] Bluetooth: hci5: command tx timeout [ 142.901544][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 143.139298][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 143.936645][ T6223] loop0: detected capacity change from 0 to 64 [ 144.087212][ T30] audit: type=1800 audit(1757134379.365:2): pid=6223 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.56" name=30303030303030322C747970653D6EDC3F232C66696C655F756D61736B3D30303030303030303030303030303030303030303030332C dev="loop0" ino=21 res=0 errno=0 [ 144.165851][ T5867] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.220183][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.973227][ T5179] Bluetooth: hci5: command tx timeout [ 145.051797][ T13] hsr_slave_0: left promiscuous mode [ 145.317754][ T6238] loop2: detected capacity change from 0 to 40427 [ 145.372434][ T6238] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 145.380320][ T6238] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 145.381305][ T13] hsr_slave_1: left promiscuous mode [ 145.408498][ T6238] F2FS-fs (loop2): invalid crc value [ 145.413172][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 145.421196][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 146.017655][ T6238] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 146.073998][ T6238] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 146.081085][ T6238] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 146.368366][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 147.016365][ T6243] svc: failed to register nfsdv3 RPC service (errno 512). [ 147.046546][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 147.061489][ T5876] Bluetooth: hci5: command tx timeout [ 147.074330][ T6243] svc: failed to register nfsaclv3 RPC service (errno 512). [ 147.377002][ T13] veth1_macvtap: left promiscuous mode [ 147.383265][ T13] veth0_macvtap: left promiscuous mode [ 147.389063][ T13] veth1_vlan: left promiscuous mode [ 147.398397][ T13] veth0_vlan: left promiscuous mode [ 148.652107][ T5179] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 148.684230][ T5179] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 148.692259][ T5179] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 148.700714][ T5179] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 148.712474][ T5179] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 149.521332][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 149.694110][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 149.719000][ T9] usb 4-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 149.738273][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.746758][ T9] usb 4-1: Product: syz [ 149.750973][ T9] usb 4-1: Manufacturer: syz [ 149.761322][ T9] usb 4-1: SerialNumber: syz [ 149.785077][ T9] usb 4-1: config 0 descriptor?? [ 149.806753][ T9] gspca_main: sq905-2.14.0 probing 2770:9120 [ 149.882254][ T13] team0 (unregistering): Port device team_slave_1 removed [ 149.913115][ T13] team0 (unregistering): Port device team_slave_0 removed [ 150.627481][ T9] gspca_sq905: sq905_command: usb_control_msg failed 2 (-71) [ 150.652829][ T9] sq905 4-1:0.0: probe with driver sq905 failed with error -71 [ 150.700770][ T9] usb 4-1: USB disconnect, device number 2 [ 150.817736][ T5179] Bluetooth: hci1: command tx timeout [ 151.414959][ T6302] loop3: detected capacity change from 0 to 47 [ 151.740595][ T6165] chnl_net:caif_netlink_parms(): no params data found [ 153.123058][ T5179] Bluetooth: hci1: command tx timeout [ 153.229501][ T5961] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 153.961302][ T5961] usb 3-1: Using ep0 maxpacket: 32 [ 154.018722][ T5961] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 154.087009][ T5961] usb 3-1: config 0 has no interface number 0 [ 154.124776][ T5961] usb 3-1: config 0 interface 12 has no altsetting 0 [ 154.224437][ T5961] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 154.274661][ T5961] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.356175][ T5961] usb 3-1: Product: syz [ 154.407042][ T5961] usb 3-1: Manufacturer: syz [ 154.427262][ T5961] usb 3-1: SerialNumber: syz [ 154.435885][ T5961] usb 3-1: config 0 descriptor?? [ 154.792923][ T6337] loop3: detected capacity change from 0 to 40427 [ 154.959156][ T6337] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 154.967084][ T6337] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 154.983364][ T6337] F2FS-fs (loop3): invalid crc value [ 155.131891][ T5179] Bluetooth: hci1: command tx timeout [ 155.165814][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.385857][ T6337] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 155.483618][ T5961] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 155.502048][ T6337] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 155.509121][ T6337] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 155.730440][ T5961] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 155.737978][ T5961] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 155.746670][ T5961] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 155.763065][ T5961] usb 3-1: USB disconnect, device number 2 [ 156.988317][ T6270] chnl_net:caif_netlink_parms(): no params data found [ 157.211413][ T5179] Bluetooth: hci1: command tx timeout [ 157.375006][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 157.516440][ T6165] bridge0: port 1(bridge_slave_0) entered blocking state [ 157.552597][ T6165] bridge0: port 1(bridge_slave_0) entered disabled state [ 157.581566][ T6165] bridge_slave_0: entered allmulticast mode [ 157.609232][ T6165] bridge_slave_0: entered promiscuous mode [ 157.663920][ T6165] bridge0: port 2(bridge_slave_1) entered blocking state [ 157.681967][ T6165] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.699424][ T6165] bridge_slave_1: entered allmulticast mode [ 157.733694][ T6165] bridge_slave_1: entered promiscuous mode [ 158.035748][ T6364] loop1: detected capacity change from 0 to 47 [ 158.264255][ T6362] loop2: detected capacity change from 0 to 40427 [ 158.273511][ T6362] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 158.281288][ T6362] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 158.334390][ T6362] F2FS-fs (loop2): invalid crc value [ 158.472426][ T6362] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 158.499243][ T6362] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 158.506722][ T6362] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 158.517166][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.509830][ T6376] loop1: detected capacity change from 0 to 8 [ 159.565233][ T6376] unable to read inode lookup table [ 159.639614][ T5179] Bluetooth: hci4: unexpected subevent 0x0e length: 30 > 15 [ 159.647142][ T5179] Bluetooth: hci4: Unable to find connection for dst 00:00:00:00:00:00 sid 0x00 [ 160.223125][ T13] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.450200][ T6383] loop0: detected capacity change from 0 to 32768 [ 160.457875][ T6383] XFS: ikeep mount option is deprecated. [ 161.133881][ T6383] XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 161.248436][ T6165] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 161.287730][ T6383] XFS (loop0): Ending clean mount [ 161.313830][ T6383] XFS (loop0): Quotacheck needed: Please wait. [ 161.328062][ T6165] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 161.414680][ T6383] XFS (loop0): Quotacheck: Done. [ 162.512357][ T6165] team0: Port device team_slave_0 added [ 162.574916][ T6165] team0: Port device team_slave_1 added [ 162.625470][ T6270] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.655539][ T6270] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.711750][ T6270] bridge_slave_0: entered allmulticast mode [ 162.741709][ T6270] bridge_slave_0: entered promiscuous mode [ 162.790448][ T6270] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.829324][ T6270] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.870038][ T6270] bridge_slave_1: entered allmulticast mode [ 162.942221][ T6270] bridge_slave_1: entered promiscuous mode [ 163.592131][ T6165] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 163.599148][ T6165] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 163.733945][ T6165] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 163.797168][ T6165] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 163.830801][ T5866] XFS (loop0): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 163.858376][ T6165] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 163.935683][ T6409] loop3: detected capacity change from 0 to 32768 [ 163.998429][ T6165] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 164.064453][ T6270] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 164.176657][ T6270] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 164.225555][ T6409] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 164.541823][ T5875] (syz-executor,5875,0):ocfs2_inode_is_valid_to_delete:947 ERROR: Skipping delete of system file 72 [ 164.654404][ T5875] ocfs2: Unmounting device (7,3) on (node local) [ 164.945220][ T6270] team0: Port device team_slave_0 added [ 165.066497][ T6165] hsr_slave_0: entered promiscuous mode [ 165.074368][ T6435] netlink: 248 bytes leftover after parsing attributes in process `syz.3.100'. [ 165.083918][ T6435] netlink: 24 bytes leftover after parsing attributes in process `syz.3.100'. [ 165.099833][ T6435] netlink: 'syz.3.100': attribute type 27 has an invalid length. [ 165.175464][ T6165] hsr_slave_1: entered promiscuous mode [ 165.249236][ T6165] debugfs: 'hsr0' already exists in 'hsr' [ 165.302164][ T6165] Cannot create hsr debugfs directory [ 165.701272][ T6270] team0: Port device team_slave_1 added [ 166.155458][ T13] bridge_slave_1: left allmulticast mode [ 166.226715][ T13] bridge_slave_1: left promiscuous mode [ 166.367982][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 166.830801][ T13] bridge_slave_0: left allmulticast mode [ 166.888462][ T13] bridge_slave_0: left promiscuous mode [ 166.922750][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.312920][ T6466] loop2: detected capacity change from 0 to 128 [ 169.526133][ T6466] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 169.733207][ T6466] ext4 filesystem being mounted at /21/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 170.119946][ T5873] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 170.405894][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 170.467961][ T6483] netlink: 248 bytes leftover after parsing attributes in process `syz.2.114'. [ 170.477182][ T6483] netlink: 24 bytes leftover after parsing attributes in process `syz.2.114'. [ 170.490730][ T6483] netlink: 'syz.2.114': attribute type 27 has an invalid length. [ 171.299461][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 171.439607][ T13] bond0 (unregistering): Released all slaves [ 171.896395][ T6270] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 171.941369][ T6270] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 172.021594][ T6270] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 173.082086][ T6270] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 173.089164][ T6270] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 173.522970][ T6270] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 175.397494][ T6270] hsr_slave_0: entered promiscuous mode [ 175.479455][ T6270] hsr_slave_1: entered promiscuous mode [ 175.513699][ T6270] debugfs: 'hsr0' already exists in 'hsr' [ 175.556744][ T6270] Cannot create hsr debugfs directory [ 176.021392][ T13] hsr_slave_0: left promiscuous mode [ 176.131385][ T13] hsr_slave_1: left promiscuous mode [ 176.142213][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 176.182334][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 176.224677][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 176.268918][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 176.407728][ T13] veth1_macvtap: left promiscuous mode [ 176.765425][ T6515] loop3: detected capacity change from 0 to 40427 [ 176.778435][ T13] veth0_macvtap: left promiscuous mode [ 176.784879][ T13] veth1_vlan: left promiscuous mode [ 176.791180][ T13] veth0_vlan: left promiscuous mode [ 176.811879][ T6515] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 176.819704][ T6515] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 176.847446][ T6515] F2FS-fs (loop3): invalid crc value [ 176.933994][ T6515] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 176.990494][ T6515] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 176.997619][ T6515] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 179.889367][ T13] team0 (unregistering): Port device team_slave_1 removed [ 179.932626][ T13] team0 (unregistering): Port device team_slave_0 removed [ 184.006790][ T5179] Bluetooth: hci0: unexpected subevent 0x0e length: 30 > 15 [ 184.018607][ T5179] Bluetooth: hci0: Unable to find connection for dst 00:00:00:00:00:00 sid 0x00 [ 186.132675][ T6165] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 186.260024][ T6564] loop1: detected capacity change from 0 to 4096 [ 186.265299][ T6165] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 187.306996][ T6564] ntfs3(loop1): ino=3, ntfs_set_state failed, -22. [ 187.366337][ T6564] ntfs3(loop1): Failed to initialize $Extend/$ObjId. [ 188.623620][ T6564] ntfs3(loop1): ino=1e, "file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" attr_set_size [ 188.705864][ T6165] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 189.039775][ T6165] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 189.875036][ T6560] ntfs3(loop1): ino=1e, "file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" attr_set_size [ 190.489823][ T6270] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 191.863472][ T6270] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 192.160782][ T6270] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 192.279952][ T6270] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 192.491779][ T6034] ntfs3(loop1): ino=3, ntfs3_write_inode failed, -22. [ 192.501438][ T5869] ntfs3(loop1): ino=3, ntfs_set_state failed, -22. [ 192.551200][ T5869] ntfs3(loop1): Mark volume as dirty due to NTFS errors [ 192.558551][ T5869] ntfs3(loop1): ino=3, ntfs_set_state failed, -22. [ 192.652096][ T6034] ntfs3(loop1): ino=3, ntfs3_write_inode failed, -22. [ 193.888006][ T5876] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 193.897742][ T5876] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 193.905797][ T5876] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 193.960519][ T5876] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 193.972425][ T5876] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 194.169674][ T6165] 8021q: adding VLAN 0 to HW filter on device bond0 [ 194.997168][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 195.225044][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 195.290727][ T6637] loop0: detected capacity change from 0 to 256 [ 195.337112][ T9] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 195.391536][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.421138][ T9] usb 2-1: Product: syz [ 195.442691][ T9] usb 2-1: Manufacturer: syz [ 195.445443][ T6034] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.447305][ T9] usb 2-1: SerialNumber: syz [ 195.554132][ T9] usb 2-1: config 0 descriptor?? [ 195.746613][ T6637] FAT-fs (loop0): Directory bread(block 64) failed [ 195.764939][ T6637] FAT-fs (loop0): Directory bread(block 65) failed [ 195.834207][ T6637] FAT-fs (loop0): Directory bread(block 66) failed [ 195.851588][ T6637] FAT-fs (loop0): Directory bread(block 67) failed [ 195.871065][ T6637] FAT-fs (loop0): Directory bread(block 68) failed [ 196.462585][ T6637] FAT-fs (loop0): Directory bread(block 69) failed [ 196.469281][ T6637] FAT-fs (loop0): Directory bread(block 70) failed [ 196.501712][ T6270] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.551451][ T6637] FAT-fs (loop0): Directory bread(block 71) failed [ 196.591473][ T6637] FAT-fs (loop0): Directory bread(block 72) failed [ 196.636718][ T6637] FAT-fs (loop0): Directory bread(block 73) failed [ 196.661547][ T5876] Bluetooth: hci3: command tx timeout [ 196.734724][ T9] usb 2-1: USB disconnect, device number 2 [ 196.839303][ T5891] udevd[5891]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 196.916346][ T6034] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.163442][ T6034] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 198.048029][ T5179] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 198.056950][ T5179] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 198.066849][ T5179] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 198.078808][ T5179] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 198.087105][ T5179] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 198.105078][ T6270] 8021q: adding VLAN 0 to HW filter on device team0 [ 198.221091][ T6270] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 198.286103][ T6270] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 198.363971][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.371150][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 198.504660][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.511927][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 198.605532][ T6664] loop1: detected capacity change from 0 to 512 [ 198.640968][ T6664] EXT4-fs: Ignoring removed bh option [ 198.685707][ T6664] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 198.733851][ T5179] Bluetooth: hci3: command tx timeout [ 198.763971][ T6664] EXT4-fs (loop1): 1 truncate cleaned up [ 198.784577][ T6664] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 199.855040][ T6034] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 200.241555][ T5179] Bluetooth: hci6: command tx timeout [ 200.541380][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 202.051853][ T5179] Bluetooth: hci3: command tx timeout [ 202.251396][ T5179] Bluetooth: hci6: command tx timeout [ 203.902430][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 203.908918][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 204.091430][ T5179] Bluetooth: hci3: command tx timeout [ 204.331387][ T5179] Bluetooth: hci6: command tx timeout [ 204.444176][ T6700] netlink: 248 bytes leftover after parsing attributes in process `syz.1.163'. [ 204.453337][ T6700] netlink: 24 bytes leftover after parsing attributes in process `syz.1.163'. [ 204.481604][ T6700] netlink: 'syz.1.163': attribute type 27 has an invalid length. [ 204.733935][ T6700] mkiss: ax0: crc mode is auto. [ 205.829311][ T6714] loop0: detected capacity change from 0 to 512 [ 205.874829][ T6714] EXT4-fs: Ignoring removed bh option [ 205.949407][ T6714] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 206.111826][ T6714] EXT4-fs (loop0): 1 truncate cleaned up [ 206.119763][ T6714] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 206.421455][ T5179] Bluetooth: hci6: command tx timeout [ 207.218477][ T6618] chnl_net:caif_netlink_parms(): no params data found [ 207.288029][ T6034] bridge_slave_1: left allmulticast mode [ 207.332448][ T6034] bridge_slave_1: left promiscuous mode [ 207.338261][ T6034] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.431839][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.706991][ T6034] bridge_slave_0: left allmulticast mode [ 207.735264][ T5876] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 207.746099][ T5876] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 207.756192][ T5876] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 207.766668][ T5876] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 207.777353][ T5876] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 207.795957][ T6034] bridge_slave_0: left promiscuous mode [ 207.821790][ T6034] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.976639][ T6742] loop0: detected capacity change from 0 to 512 [ 207.998506][ T6742] EXT4-fs: Ignoring removed bh option [ 208.081835][ T6744] netlink: 277 bytes leftover after parsing attributes in process `syz.1.170'. [ 208.141410][ T6742] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 208.188071][ T6742] EXT4-fs (loop0): 1 truncate cleaned up [ 208.201528][ T6742] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 208.844918][ T6747] loop3: detected capacity change from 0 to 32768 [ 209.364803][ T6747] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 209.364842][ T6747] allowing incompatible features above 0.0: (unknown version) [ 209.364863][ T6747] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 209.403451][ T6747] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0 [ 209.411757][ T6747] bcachefs (loop3): initializing new filesystem [ 209.427115][ T6747] bcachefs (loop3): going read-write [ 209.448886][ T6747] bcachefs (loop3): marking superblocks [ 209.469036][ T6747] bcachefs (loop3): initializing freespace [ 209.480895][ T6747] bcachefs (loop3): done initializing freespace [ 209.490885][ T6747] bcachefs (loop3): reading snapshots table [ 209.496867][ T6747] bcachefs (loop3): reading snapshots done [ 209.565301][ T6747] bcachefs (loop3): done starting filesystem [ 209.842390][ T6747] syz.3.173 (6747) used greatest stack depth: 17688 bytes left [ 209.852519][ T5876] Bluetooth: hci5: command tx timeout [ 209.879458][ T6034] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 209.905196][ T6034] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 209.919299][ T6034] bond0 (unregistering): Released all slaves [ 210.355750][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 210.492588][ T5875] bcachefs (loop3): shutting down [ 210.497849][ T5875] bcachefs (loop3): going read-only [ 210.556759][ T5875] bcachefs (loop3): finished waiting for writes to stop [ 210.676217][ T5875] bcachefs (loop3): flushing journal and stopping allocators, journal seq 3 [ 210.895972][ T5875] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 3 [ 210.896584][ T6768] loop0: detected capacity change from 0 to 32768 [ 210.972124][ T5875] bcachefs (loop3): clean shutdown complete, journal seq 4 [ 210.990929][ T5875] bcachefs (loop3): marking filesystem clean [ 211.092137][ T6768] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 211.092178][ T6768] allowing incompatible features above 0.0: (unknown version) [ 211.092199][ T6768] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 211.130728][ T6768] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0 [ 211.138987][ T6768] bcachefs (loop0): initializing new filesystem [ 211.153218][ T6768] bcachefs (loop0): going read-write [ 211.193546][ T6649] chnl_net:caif_netlink_parms(): no params data found [ 211.242216][ T6768] bcachefs (loop0): marking superblocks [ 211.257900][ T6768] bcachefs (loop0): initializing freespace [ 211.268284][ T6768] bcachefs (loop0): done initializing freespace [ 211.278956][ T6768] bcachefs (loop0): reading snapshots table [ 211.284948][ T6768] bcachefs (loop0): reading snapshots done [ 211.344042][ T5875] bcachefs (loop3): shutdown complete [ 211.349634][ T6768] bcachefs (loop0): done starting filesystem [ 212.568097][ T5876] Bluetooth: hci5: command tx timeout [ 212.903101][ T6034] hsr_slave_0: left promiscuous mode [ 212.989068][ T6796] netlink: 248 bytes leftover after parsing attributes in process `syz.1.178'. [ 212.998210][ T6796] netlink: 24 bytes leftover after parsing attributes in process `syz.1.178'. [ 213.018010][ T6796] netlink: 'syz.1.178': attribute type 27 has an invalid length. [ 213.781569][ T6034] hsr_slave_1: left promiscuous mode [ 213.819048][ T6796] Falling back ldisc for ttyS3. [ 213.822475][ T6034] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 213.832664][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 213.843345][ T6034] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 213.863071][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 213.923034][ T6034] veth1_macvtap: left promiscuous mode [ 213.943409][ T6034] veth0_macvtap: left promiscuous mode [ 213.961843][ T6034] veth1_vlan: left promiscuous mode [ 213.967187][ T6034] veth0_vlan: left promiscuous mode [ 214.651482][ T5876] Bluetooth: hci5: command tx timeout [ 215.826030][ T6818] loop1: detected capacity change from 0 to 512 [ 215.844990][ T6818] EXT4-fs: Ignoring removed bh option [ 215.860010][ T6818] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 215.910920][ T6818] EXT4-fs (loop1): 1 truncate cleaned up [ 215.926587][ T6818] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 216.761971][ T5179] Bluetooth: hci5: command tx timeout [ 216.813123][ T6034] team0 (unregistering): Port device team_slave_1 removed [ 216.845679][ T6034] team0 (unregistering): Port device team_slave_0 removed [ 217.196352][ T5866] bcachefs (loop0): shutting down [ 217.208892][ T5866] bcachefs (loop0): going read-only [ 217.226245][ T5866] bcachefs (loop0): finished waiting for writes to stop [ 217.237082][ T5866] bcachefs (loop0): flushing journal and stopping allocators, journal seq 7 [ 217.261452][ T5866] bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 8 [ 217.272562][ T5866] bcachefs (loop0): clean shutdown complete, journal seq 9 [ 217.280802][ T5866] bcachefs (loop0): marking filesystem clean [ 217.343570][ T5866] bcachefs (loop0): shutdown complete [ 217.486805][ T6618] bridge0: port 1(bridge_slave_0) entered blocking state [ 217.513839][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 217.531624][ T6618] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.538875][ T6618] bridge_slave_0: entered allmulticast mode [ 217.566696][ T6618] bridge_slave_0: entered promiscuous mode [ 217.584253][ T6618] bridge0: port 2(bridge_slave_1) entered blocking state [ 217.601400][ T6618] bridge0: port 2(bridge_slave_1) entered disabled state [ 217.608642][ T6618] bridge_slave_1: entered allmulticast mode [ 217.643937][ T6618] bridge_slave_1: entered promiscuous mode [ 217.699470][ T6828] loop1: detected capacity change from 0 to 512 [ 217.707505][ T6828] EXT4-fs: Ignoring removed bh option [ 217.741659][ T6828] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 217.811621][ T6828] EXT4-fs (loop1): 1 truncate cleaned up [ 217.819357][ T6828] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 219.028020][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.087288][ T6618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 219.265293][ T6618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 219.842020][ T6849] loop3: detected capacity change from 0 to 32768 [ 220.737693][ T6849] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 220.737733][ T6849] allowing incompatible features above 0.0: (unknown version) [ 220.737754][ T6849] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 220.750573][ T6649] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.754471][ T6849] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0 [ 220.754525][ T6849] bcachefs (loop3): initializing new filesystem [ 220.762606][ T6849] bcachefs (loop3): going read-write [ 220.851479][ T6849] bcachefs (loop3): marking superblocks [ 220.870408][ T6849] bcachefs (loop3): initializing freespace [ 220.880648][ T6849] bcachefs (loop3): done initializing freespace [ 220.891084][ T6849] bcachefs (loop3): reading snapshots table [ 220.898081][ T6849] bcachefs (loop3): reading snapshots done [ 220.934744][ T6849] bcachefs (loop3): done starting filesystem [ 221.188222][ T6649] bridge0: port 1(bridge_slave_0) entered disabled state [ 221.211852][ T6649] bridge_slave_0: entered allmulticast mode [ 221.254629][ T6649] bridge_slave_0: entered promiscuous mode [ 221.505873][ T6618] team0: Port device team_slave_0 added [ 221.569201][ T6649] bridge0: port 2(bridge_slave_1) entered blocking state [ 221.612894][ T6649] bridge0: port 2(bridge_slave_1) entered disabled state [ 221.641875][ T6649] bridge_slave_1: entered allmulticast mode [ 221.649943][ T6649] bridge_slave_1: entered promiscuous mode [ 221.680109][ T5875] bcachefs (loop3): shutting down [ 221.711865][ T5875] bcachefs (loop3): going read-only [ 221.741432][ T5875] bcachefs (loop3): finished waiting for writes to stop [ 221.849368][ T6618] team0: Port device team_slave_1 added [ 221.856037][ T5875] bcachefs (loop3): flushing journal and stopping allocators, journal seq 3 [ 221.940626][ T5875] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 3 [ 221.968157][ T6738] chnl_net:caif_netlink_parms(): no params data found [ 221.983640][ T5875] bcachefs (loop3): clean shutdown complete, journal seq 4 [ 222.013258][ T5875] bcachefs (loop3): marking filesystem clean [ 222.088150][ T5875] bcachefs (loop3): shutdown complete [ 222.099047][ T6618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 222.109349][ T6618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 222.152633][ T6874] netlink: 277 bytes leftover after parsing attributes in process `syz.1.186'. [ 222.171305][ T6618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 222.204047][ T6618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 222.211004][ T6618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 222.255667][ T6618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 222.270666][ T6649] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 222.284972][ T6649] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 222.470686][ T6649] team0: Port device team_slave_0 added [ 222.550492][ T6649] team0: Port device team_slave_1 added [ 224.493469][ T6618] hsr_slave_0: entered promiscuous mode [ 224.502928][ T6618] hsr_slave_1: entered promiscuous mode [ 225.746545][ T6892] loop1: detected capacity change from 0 to 512 [ 225.792188][ T6892] EXT4-fs: Ignoring removed bh option [ 225.900661][ T6649] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 225.908099][ T6649] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 225.936126][ T6892] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 225.982236][ T6892] EXT4-fs (loop1): 1 truncate cleaned up [ 225.989914][ T6892] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 225.993064][ T6649] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 226.014173][ T6738] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.042063][ T6738] bridge0: port 1(bridge_slave_0) entered disabled state [ 226.049327][ T6738] bridge_slave_0: entered allmulticast mode [ 226.338449][ T6738] bridge_slave_0: entered promiscuous mode [ 227.125648][ T6649] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 227.151068][ T6649] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 227.223336][ T6649] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 227.428259][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 227.438878][ T6738] bridge0: port 2(bridge_slave_1) entered blocking state [ 227.448442][ T6738] bridge0: port 2(bridge_slave_1) entered disabled state [ 227.484045][ T6738] bridge_slave_1: entered allmulticast mode [ 227.494219][ T6738] bridge_slave_1: entered promiscuous mode [ 227.624537][ T6909] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 229.207785][ T6649] hsr_slave_0: entered promiscuous mode [ 229.222952][ T6649] hsr_slave_1: entered promiscuous mode [ 229.239571][ T6649] debugfs: 'hsr0' already exists in 'hsr' [ 229.248851][ T6649] Cannot create hsr debugfs directory [ 229.669493][ T6738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 229.801555][ T6738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 230.352179][ T6929] netlink: 277 bytes leftover after parsing attributes in process `syz.0.198'. [ 230.904218][ T6738] team0: Port device team_slave_0 added [ 230.980732][ T6935] loop0: detected capacity change from 0 to 512 [ 231.038744][ T6935] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #15: comm syz.0.200: casefold flag without casefold feature [ 231.053501][ T6738] team0: Port device team_slave_1 added [ 231.087488][ T6935] EXT4-fs error (device loop0): ext4_orphan_get:1395: comm syz.0.200: couldn't read orphan inode 15 (err -117) [ 231.220638][ T6935] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 231.561352][ T5884] Bluetooth: hci0: command 0x0406 tx timeout [ 231.567420][ T5884] Bluetooth: hci4: command 0x0406 tx timeout [ 231.576545][ T5872] Bluetooth: hci2: command 0x0406 tx timeout [ 232.530859][ T6951] loop1: detected capacity change from 0 to 40427 [ 232.540233][ T6951] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 232.548037][ T6951] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 232.579713][ T6951] F2FS-fs (loop1): invalid crc value [ 232.691097][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.696659][ T6951] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 232.724569][ T6951] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 232.733394][ T6951] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 233.681921][ T6738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 233.811438][ T6738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 233.911524][ T6738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 234.990757][ T6738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 235.030920][ T6738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 235.114546][ T6738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 236.074546][ T6618] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 236.115689][ T6618] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 236.262558][ T6738] hsr_slave_0: entered promiscuous mode [ 236.272772][ T6738] hsr_slave_1: entered promiscuous mode [ 236.279823][ T6738] debugfs: 'hsr0' already exists in 'hsr' [ 236.288465][ T6738] Cannot create hsr debugfs directory [ 236.596360][ T6984] loop3: detected capacity change from 0 to 32768 [ 236.659102][ T6618] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 236.700873][ T6989] loop1: detected capacity change from 0 to 512 [ 236.717938][ T6989] EXT4-fs: Ignoring removed bh option [ 236.743859][ T6989] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 236.815781][ T6984] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 236.815819][ T6984] allowing incompatible features above 0.0: (unknown version) [ 236.815841][ T6984] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 236.852679][ T6989] EXT4-fs (loop1): 1 truncate cleaned up [ 236.854479][ T6984] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0 [ 236.870573][ T6984] bcachefs (loop3): initializing new filesystem [ 236.877260][ T6618] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 236.893189][ T6984] bcachefs (loop3): going read-write [ 236.897315][ T6989] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 236.932531][ T6984] bcachefs (loop3): marking superblocks [ 236.949332][ T6984] bcachefs (loop3): initializing freespace [ 236.959986][ T6984] bcachefs (loop3): done initializing freespace [ 236.969194][ T6984] bcachefs (loop3): reading snapshots table [ 236.976661][ T6984] bcachefs (loop3): reading snapshots done [ 237.019016][ T6984] bcachefs (loop3): done starting filesystem [ 238.402540][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 238.488635][ T5875] bcachefs (loop3): shutting down [ 238.532393][ T5875] bcachefs (loop3): going read-only [ 238.537637][ T5875] bcachefs (loop3): finished waiting for writes to stop [ 238.606783][ T5875] bcachefs (loop3): flushing journal and stopping allocators, journal seq 4 [ 238.717436][ T5875] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 4 [ 238.745836][ T7024] loop0: detected capacity change from 0 to 512 [ 238.777288][ T5875] bcachefs (loop3): clean shutdown complete, journal seq 5 [ 238.804971][ T5875] bcachefs (loop3): marking filesystem clean [ 238.841835][ T7024] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #15: comm syz.0.212: casefold flag without casefold feature [ 238.897771][ T7024] EXT4-fs error (device loop0): ext4_orphan_get:1395: comm syz.0.212: couldn't read orphan inode 15 (err -117) [ 238.967472][ T7024] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 239.017216][ T5875] bcachefs (loop3): shutdown complete [ 239.043014][ T6034] bridge_slave_1: left allmulticast mode [ 239.049089][ T6034] bridge_slave_1: left promiscuous mode [ 239.056879][ T6034] bridge0: port 2(bridge_slave_1) entered disabled state [ 239.083523][ T6034] bridge_slave_0: left allmulticast mode [ 239.359237][ T6034] bridge_slave_0: left promiscuous mode [ 239.365637][ T6034] bridge0: port 1(bridge_slave_0) entered disabled state [ 239.388948][ T6034] bridge_slave_1: left allmulticast mode [ 240.166192][ T6034] bridge_slave_1: left promiscuous mode [ 240.178361][ T6034] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.188428][ T6034] bridge_slave_0: left allmulticast mode [ 240.194145][ T6034] bridge_slave_0: left promiscuous mode [ 240.199982][ T6034] bridge0: port 1(bridge_slave_0) entered disabled state [ 240.326241][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 240.795478][ T7040] loop1: detected capacity change from 0 to 40427 [ 240.840925][ T7040] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 240.848750][ T7040] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 240.945189][ T7040] F2FS-fs (loop1): invalid crc value [ 241.116072][ T7040] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 241.205593][ T7040] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 241.213122][ T7040] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 242.983276][ T7060] netlink: 'syz.0.216': attribute type 27 has an invalid length. [ 243.617204][ T6034] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 243.633149][ T7060] Falling back ldisc for ttyS3. [ 243.648526][ T6034] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 243.660365][ T6034] bond0 (unregistering): Released all slaves [ 243.907247][ T6034] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 243.921125][ T6034] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 243.932474][ T6034] bond0 (unregistering): Released all slaves [ 243.980559][ T6618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 244.505439][ T6618] 8021q: adding VLAN 0 to HW filter on device team0 [ 245.465900][ T6034] hsr_slave_0: left promiscuous mode [ 245.478213][ T6034] hsr_slave_1: left promiscuous mode [ 245.490764][ T7068] loop0: detected capacity change from 0 to 512 [ 245.499133][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 245.517883][ T7068] EXT4-fs: Ignoring removed bh option [ 245.527765][ T7068] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 245.552814][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 245.560320][ T7068] EXT4-fs (loop0): 1 truncate cleaned up [ 245.572294][ T7068] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 245.641575][ T6034] hsr_slave_0: left promiscuous mode [ 245.649305][ T6034] hsr_slave_1: left promiscuous mode [ 245.692068][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 245.738528][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 245.933141][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 247.011492][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 247.689365][ T10] usb 4-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 247.706791][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.716947][ T10] usb 4-1: Product: syz [ 247.721123][ T10] usb 4-1: Manufacturer: syz [ 247.734946][ T10] usb 4-1: SerialNumber: syz [ 247.743275][ T10] usb 4-1: config 0 descriptor?? [ 247.756523][ T10] gspca_main: sq905-2.14.0 probing 2770:9120 [ 247.799964][ T6034] team0 (unregistering): Port device team_slave_1 removed [ 247.841825][ T6034] team0 (unregistering): Port device team_slave_0 removed [ 248.118034][ T7083] loop1: detected capacity change from 0 to 32768 [ 248.170312][ T10] gspca_sq905: sq905_command: usb_control_msg failed 2 (-32) [ 248.180159][ T10] sq905 4-1:0.0: probe with driver sq905 failed with error -32 [ 248.278373][ T7083] bcachefs (loop1): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 248.278413][ T7083] allowing incompatible features above 0.0: (unknown version) [ 248.278434][ T7083] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 248.317250][ T7083] bcachefs (loop1): Using encoding defined by superblock: utf8-12.1.0 [ 248.325566][ T7083] bcachefs (loop1): initializing new filesystem [ 248.340069][ T7083] bcachefs (loop1): going read-write [ 248.375251][ T7083] bcachefs (loop1): marking superblocks [ 248.390588][ T7083] bcachefs (loop1): initializing freespace [ 248.400807][ T7083] bcachefs (loop1): done initializing freespace [ 248.410056][ T7083] bcachefs (loop1): reading snapshots table [ 248.416639][ T7083] bcachefs (loop1): reading snapshots done [ 248.453550][ T7083] bcachefs (loop1): done starting filesystem [ 248.760140][ T5869] bcachefs (loop1): shutting down [ 248.766048][ T5869] bcachefs (loop1): going read-only [ 248.772010][ T5869] bcachefs (loop1): finished waiting for writes to stop [ 248.787222][ T5869] bcachefs (loop1): flushing journal and stopping allocators, journal seq 2 [ 248.857263][ T5869] bcachefs (loop1): flushing journal and stopping allocators complete, journal seq 3 [ 248.875961][ T5869] bcachefs (loop1): clean shutdown complete, journal seq 4 [ 248.888582][ T5869] bcachefs (loop1): marking filesystem clean [ 248.966197][ T5869] bcachefs (loop1): shutdown complete [ 249.244260][ T1214] usb 4-1: USB disconnect, device number 3 [ 249.491764][ T6034] team0 (unregistering): Port device team_slave_1 removed [ 249.568221][ T5876] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 249.580643][ T5876] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 249.593590][ T5876] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 249.625592][ T5876] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 249.625969][ T6034] team0 (unregistering): Port device team_slave_0 removed [ 249.636495][ T5876] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 250.066999][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 250.443083][ T7103] loop0: detected capacity change from 0 to 512 [ 250.683610][ T7103] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #15: comm syz.0.224: casefold flag without casefold feature [ 250.758852][ T7103] EXT4-fs error (device loop0): ext4_orphan_get:1395: comm syz.0.224: couldn't read orphan inode 15 (err -117) [ 250.831460][ T7106] loop3: detected capacity change from 0 to 32768 [ 250.861668][ T7103] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 251.722605][ T5876] Bluetooth: hci1: command tx timeout [ 251.833329][ T7106] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 251.833370][ T7106] allowing incompatible features above 0.0: (unknown version) [ 251.833391][ T7106] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 251.876194][ T7106] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0 [ 251.884415][ T7106] bcachefs (loop3): initializing new filesystem [ 251.898607][ T7106] bcachefs (loop3): going read-write [ 252.000341][ T7106] bcachefs (loop3): marking superblocks [ 252.025917][ T7106] bcachefs (loop3): initializing freespace [ 252.037363][ T7106] bcachefs (loop3): done initializing freespace [ 252.048236][ T7106] bcachefs (loop3): reading snapshots table [ 252.054264][ T7106] bcachefs (loop3): reading snapshots done [ 252.099973][ T7106] bcachefs (loop3): done starting filesystem [ 252.673883][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 252.789951][ T5875] bcachefs (loop3): shutting down [ 252.852120][ T5875] bcachefs (loop3): going read-only [ 252.857383][ T5875] bcachefs (loop3): finished waiting for writes to stop [ 253.201742][ T5875] bcachefs (loop3): flushing journal and stopping allocators, journal seq 3 [ 253.288831][ T7142] loop0: detected capacity change from 0 to 40427 [ 253.313389][ T7142] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 253.321474][ T7142] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 253.336213][ T7142] F2FS-fs (loop0): invalid crc value [ 253.443663][ T7142] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 253.467990][ T7142] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 253.475232][ T7142] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 253.771447][ T5179] Bluetooth: hci1: command tx timeout [ 253.857245][ T5875] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 3 [ 253.996341][ T5875] bcachefs (loop3): clean shutdown complete, journal seq 4 [ 254.327696][ T5875] bcachefs (loop3): marking filesystem clean [ 255.198583][ T5875] bcachefs (loop3): shutdown complete [ 255.862061][ T5179] Bluetooth: hci1: command tx timeout [ 255.911900][ T7098] chnl_net:caif_netlink_parms(): no params data found [ 257.222383][ T5876] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 257.311676][ T5876] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 257.320328][ T5876] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 257.329527][ T5876] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 257.337834][ T5876] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 257.402765][ T6738] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 258.075618][ T5179] Bluetooth: hci1: command tx timeout [ 258.162830][ T6738] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 258.231648][ T6738] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 258.806778][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 259.062034][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 259.348972][ T9] usb 2-1: New USB device found, idVendor=2770, idProduct=9120, bcdDevice=6c.77 [ 259.372420][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.380427][ T9] usb 2-1: Product: syz [ 259.408890][ T9] usb 2-1: Manufacturer: syz [ 259.413893][ T9] usb 2-1: SerialNumber: syz [ 259.439178][ T9] usb 2-1: config 0 descriptor?? [ 259.448481][ T9] gspca_main: sq905-2.14.0 probing 2770:9120 [ 259.461451][ T5179] Bluetooth: hci3: command tx timeout [ 259.521339][ T6738] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 259.612599][ T7198] loop0: detected capacity change from 0 to 512 [ 259.624737][ T7098] bridge0: port 1(bridge_slave_0) entered blocking state [ 259.632412][ T7098] bridge0: port 1(bridge_slave_0) entered disabled state [ 259.639718][ T7098] bridge_slave_0: entered allmulticast mode [ 259.652752][ T7198] EXT4-fs: Ignoring removed bh option [ 259.656578][ T7098] bridge_slave_0: entered promiscuous mode [ 259.673268][ T7198] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 259.767684][ T7198] EXT4-fs (loop0): 1 truncate cleaned up [ 259.794923][ T7198] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 259.796764][ T7098] bridge0: port 2(bridge_slave_1) entered blocking state [ 259.820442][ T7098] bridge0: port 2(bridge_slave_1) entered disabled state [ 259.828184][ T7098] bridge_slave_1: entered allmulticast mode [ 259.836705][ T7098] bridge_slave_1: entered promiscuous mode [ 259.854698][ T9] gspca_sq905: sq905_command: usb_control_msg failed 2 (-32) [ 259.868716][ T9] sq905 2-1:0.0: probe with driver sq905 failed with error -32 [ 259.958849][ T7098] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 260.127448][ T7098] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 261.105316][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 261.195763][ T7098] team0: Port device team_slave_0 added [ 261.365704][ T7098] team0: Port device team_slave_1 added [ 261.531375][ T5179] Bluetooth: hci3: command tx timeout [ 262.898591][ T5941] usb 2-1: USB disconnect, device number 3 [ 263.611346][ T5179] Bluetooth: hci3: command tx timeout [ 263.984199][ T7098] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 263.991161][ T7098] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 264.055028][ T7098] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 264.121953][ T7222] netlink: 277 bytes leftover after parsing attributes in process `syz.0.236'. [ 264.156560][ T7098] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 264.204350][ T7098] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 264.333955][ T7098] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 264.730685][ T6034] bridge_slave_1: left allmulticast mode [ 264.738102][ T6034] bridge_slave_1: left promiscuous mode [ 264.764042][ T6034] bridge0: port 2(bridge_slave_1) entered disabled state [ 264.811029][ T6034] bridge_slave_0: left allmulticast mode [ 264.849911][ T6034] bridge_slave_0: left promiscuous mode [ 264.876363][ T6034] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.000042][ T7230] netlink: 248 bytes leftover after parsing attributes in process `syz.3.239'. [ 265.010695][ T7230] netlink: 24 bytes leftover after parsing attributes in process `syz.3.239'. [ 265.024562][ T7230] netlink: 'syz.3.239': attribute type 27 has an invalid length. [ 265.473581][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 265.479941][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 265.691570][ T5179] Bluetooth: hci3: command tx timeout [ 266.382354][ T7230] Falling back ldisc for ttyS3. [ 267.869773][ T7245] loop3: detected capacity change from 0 to 512 [ 267.888956][ T7245] EXT4-fs: Ignoring removed bh option [ 267.929719][ T7245] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 267.988563][ T7245] EXT4-fs (loop3): 1 truncate cleaned up [ 268.005300][ T7245] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 268.140464][ T5876] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 268.149529][ T5876] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 268.157377][ T5876] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 268.166293][ T5876] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 268.174082][ T5876] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 268.389962][ T6034] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 268.409023][ T6034] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 268.425444][ T6034] bond0 (unregistering): Released all slaves [ 269.268412][ T5875] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 269.375351][ T7098] hsr_slave_0: entered promiscuous mode [ 269.384277][ T7098] hsr_slave_1: entered promiscuous mode [ 269.391756][ T7098] debugfs: 'hsr0' already exists in 'hsr' [ 269.397492][ T7098] Cannot create hsr debugfs directory [ 269.449872][ T6034] hsr_slave_0: left promiscuous mode [ 269.477949][ T6034] hsr_slave_1: left promiscuous mode [ 269.555078][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 269.632903][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 270.370704][ T5876] Bluetooth: hci6: command tx timeout [ 272.462096][ T5876] Bluetooth: hci6: command tx timeout [ 274.359453][ T6034] team0 (unregistering): Port device team_slave_1 removed [ 274.491366][ T5876] Bluetooth: hci6: command tx timeout [ 274.545339][ T6034] team0 (unregistering): Port device team_slave_0 removed [ 275.116068][ T7294] netlink: 277 bytes leftover after parsing attributes in process `syz.3.255'. [ 275.893617][ T7168] chnl_net:caif_netlink_parms(): no params data found [ 276.571480][ T5876] Bluetooth: hci6: command tx timeout [ 276.786201][ T7320] loop1: detected capacity change from 0 to 512 [ 276.870417][ T7320] EXT4-fs: Ignoring removed bh option [ 276.929942][ T7320] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 277.004035][ T7320] EXT4-fs (loop1): 1 truncate cleaned up [ 277.036658][ T7168] bridge0: port 1(bridge_slave_0) entered blocking state [ 277.044326][ T7168] bridge0: port 1(bridge_slave_0) entered disabled state [ 277.046300][ T7320] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 277.051665][ T7168] bridge_slave_0: entered allmulticast mode [ 277.390892][ T7168] bridge_slave_0: entered promiscuous mode [ 278.120043][ T7168] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.137785][ T7168] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.662630][ T7168] bridge_slave_1: entered allmulticast mode [ 278.670729][ T7168] bridge_slave_1: entered promiscuous mode [ 278.678894][ T7250] chnl_net:caif_netlink_parms(): no params data found [ 278.857589][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 279.429664][ T7350] loop3: detected capacity change from 0 to 32768 [ 280.372465][ T7350] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 280.372505][ T7350] allowing incompatible features above 0.0: (unknown version) [ 280.372525][ T7350] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 280.412229][ T7350] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0 [ 280.420409][ T7350] bcachefs (loop3): initializing new filesystem [ 280.434898][ T7350] bcachefs (loop3): going read-write [ 280.447131][ T7168] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 280.503668][ T7350] bcachefs (loop3): marking superblocks [ 280.519088][ T7350] bcachefs (loop3): initializing freespace [ 280.529959][ T7350] bcachefs (loop3): done initializing freespace [ 280.539169][ T7350] bcachefs (loop3): reading snapshots table [ 280.545171][ T7350] bcachefs (loop3): reading snapshots done [ 280.587159][ T7168] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 280.637985][ T7350] bcachefs (loop3): done starting filesystem [ 280.649741][ T7344] loop0: detected capacity change from 0 to 32768 [ 280.680431][ T7344] [ 280.680431][ T7344] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 280.680431][ T7344] [ 281.042916][ T7344] [ 281.042916][ T7344] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.042916][ T7344] [ 281.054635][ T7344] [ 281.054635][ T7344] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.054635][ T7344] [ 281.065854][ T7344] [ 281.065854][ T7344] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.065854][ T7344] [ 281.078979][ T7344] [ 281.078979][ T7344] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.078979][ T7344] [ 281.089657][ T7344] [ 281.089657][ T7344] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.089657][ T7344] [ 281.174383][ T112] [ 281.174383][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.174383][ T112] [ 281.185202][ T5875] bcachefs (loop3): shutting down [ 281.190235][ T5875] bcachefs (loop3): going read-only [ 281.225940][ T5875] bcachefs (loop3): finished waiting for writes to stop [ 281.301315][ T5875] bcachefs (loop3): flushing journal and stopping allocators, journal seq 3 [ 281.434853][ T13] [ 281.434853][ T13] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.434853][ T13] [ 281.468045][ T13] [ 281.468045][ T13] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.468045][ T13] [ 281.490875][ T5875] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 3 [ 281.526374][ T5875] bcachefs (loop3): clean shutdown complete, journal seq 4 [ 281.538952][ T112] [ 281.538952][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.538952][ T112] [ 281.559233][ T5875] bcachefs (loop3): marking filesystem clean [ 281.581580][ T5866] [ 281.581580][ T5866] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.581580][ T5866] [ 281.603879][ T5866] [ 281.603879][ T5866] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 281.603879][ T5866] [ 281.702564][ T5875] bcachefs (loop3): shutdown complete [ 282.264717][ T7168] team0: Port device team_slave_0 added [ 282.292941][ T7168] team0: Port device team_slave_1 added [ 282.321150][ T7250] bridge0: port 1(bridge_slave_0) entered blocking state [ 282.338177][ T7250] bridge0: port 1(bridge_slave_0) entered disabled state [ 282.351524][ T7250] bridge_slave_0: entered allmulticast mode [ 282.359548][ T7250] bridge_slave_0: entered promiscuous mode [ 282.386299][ T7250] bridge0: port 2(bridge_slave_1) entered blocking state [ 282.561511][ T7250] bridge0: port 2(bridge_slave_1) entered disabled state [ 282.569559][ T7250] bridge_slave_1: entered allmulticast mode [ 282.605348][ T7250] bridge_slave_1: entered promiscuous mode [ 282.948224][ T7250] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 282.977658][ T7168] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 282.987833][ T7168] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 283.047219][ T7168] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 283.066445][ T7250] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 283.109881][ T7168] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 283.120196][ T7168] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 283.148838][ T7168] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 283.220351][ T7250] team0: Port device team_slave_0 added [ 283.279943][ T7250] team0: Port device team_slave_1 added [ 283.338300][ T7168] hsr_slave_0: entered promiscuous mode [ 283.345257][ T7168] hsr_slave_1: entered promiscuous mode [ 283.374891][ T7250] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 283.384651][ T7250] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 283.411310][ T7250] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 283.426389][ T7250] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 283.434139][ T7250] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 283.460100][ C0] vkms_vblank_simulate: vblank timer overrun [ 283.470678][ T7250] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 283.853757][ T7098] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 284.143309][ T7098] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 284.222294][ T7250] hsr_slave_0: entered promiscuous mode [ 284.243998][ T7250] hsr_slave_1: entered promiscuous mode [ 284.357800][ T7389] loop0: detected capacity change from 0 to 32768 [ 284.367570][ T7250] debugfs: 'hsr0' already exists in 'hsr' [ 284.382465][ T7250] Cannot create hsr debugfs directory [ 284.469565][ T7098] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 285.503399][ T7389] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 285.503439][ T7389] allowing incompatible features above 0.0: (unknown version) [ 285.503461][ T7389] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 285.601677][ T7389] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0 [ 285.609925][ T7389] bcachefs (loop0): initializing new filesystem [ 285.625718][ T7389] bcachefs (loop0): going read-write [ 285.763604][ T7389] bcachefs (loop0): marking superblocks [ 285.778673][ T7389] bcachefs (loop0): initializing freespace [ 285.788879][ T7389] bcachefs (loop0): done initializing freespace [ 285.798189][ T7389] bcachefs (loop0): reading snapshots table [ 285.804252][ T7389] bcachefs (loop0): reading snapshots done [ 285.854753][ T7098] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 285.869105][ T7389] bcachefs (loop0): done starting filesystem [ 285.879970][ T7408] loop1: detected capacity change from 0 to 512 [ 285.951204][ T7408] EXT4-fs: Ignoring removed bh option [ 285.991594][ T7408] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 286.231022][ T7408] EXT4-fs (loop1): 1 truncate cleaned up [ 286.293446][ T7408] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 286.304651][ T7415] loop3: detected capacity change from 0 to 512 [ 286.334125][ T5866] bcachefs (loop0): shutting down [ 286.374173][ T5866] bcachefs (loop0): going read-only [ 286.379492][ T5866] bcachefs (loop0): finished waiting for writes to stop [ 286.422029][ T5866] bcachefs (loop0): flushing journal and stopping allocators, journal seq 3 [ 286.512347][ T7415] EXT4-fs error (device loop3): ext4_orphan_get:1392: inode #15: comm syz.3.275: casefold flag without casefold feature [ 286.547216][ T5866] bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 4 [ 286.588751][ T7415] EXT4-fs error (device loop3): ext4_orphan_get:1395: comm syz.3.275: couldn't read orphan inode 15 (err -117) [ 286.625395][ T5866] bcachefs (loop0): clean shutdown complete, journal seq 5 [ 286.633254][ T7415] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 286.635616][ T5866] bcachefs (loop0): marking filesystem clean [ 288.068256][ T5866] bcachefs (loop0): shutdown complete [ 288.096574][ T5875] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 288.124808][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 290.477861][ T6034] bridge_slave_1: left allmulticast mode [ 290.490730][ T6034] bridge_slave_1: left promiscuous mode [ 290.547419][ T6034] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.765714][ T6034] bridge_slave_0: left allmulticast mode [ 290.840725][ T6034] bridge_slave_0: left promiscuous mode [ 290.906986][ T6034] bridge0: port 1(bridge_slave_0) entered disabled state [ 292.123659][ T6034] bridge_slave_1: left allmulticast mode [ 292.216437][ T6034] bridge_slave_1: left promiscuous mode [ 292.241582][ T6034] bridge0: port 2(bridge_slave_1) entered disabled state [ 292.254569][ T6034] bridge_slave_0: left allmulticast mode [ 292.260256][ T6034] bridge_slave_0: left promiscuous mode [ 292.546625][ T6034] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.529190][ T6034] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 293.541145][ T6034] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 293.560377][ T6034] bond0 (unregistering): Released all slaves [ 293.720229][ T6034] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 293.800676][ T6034] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 293.822218][ T6034] bond0 (unregistering): Released all slaves [ 294.301005][ T7098] 8021q: adding VLAN 0 to HW filter on device bond0 [ 295.466428][ T6034] hsr_slave_0: left promiscuous mode [ 295.516445][ T7471] loop1: detected capacity change from 0 to 512 [ 295.531588][ T6034] hsr_slave_1: left promiscuous mode [ 295.537699][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 295.546391][ T7471] EXT4-fs: Ignoring removed bh option [ 295.569053][ T7471] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 295.598419][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 295.643162][ T7471] EXT4-fs (loop1): 1 truncate cleaned up [ 295.669674][ T7471] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 295.930891][ T7475] loop3: detected capacity change from 0 to 32768 [ 296.045471][ T6034] hsr_slave_0: left promiscuous mode [ 296.055567][ T6034] hsr_slave_1: left promiscuous mode [ 296.063832][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 296.669125][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 296.757878][ T7475] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 296.757916][ T7475] allowing incompatible features above 0.0: (unknown version) [ 296.757936][ T7475] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 296.798493][ T7475] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0 [ 296.806836][ T7475] bcachefs (loop3): initializing new filesystem [ 296.819700][ T7475] bcachefs (loop3): going read-write [ 297.461510][ T7475] bcachefs (loop3): marking superblocks [ 297.666514][ T7475] bcachefs (loop3): initializing freespace [ 297.676394][ T7475] bcachefs (loop3): done initializing freespace [ 297.684932][ T7475] bcachefs (loop3): reading snapshots table [ 297.690868][ T7475] bcachefs (loop3): reading snapshots done [ 297.733992][ T7475] bcachefs (loop3): done starting filesystem [ 297.842777][ T5875] bcachefs (loop3): shutting down [ 297.847845][ T5875] bcachefs (loop3): going read-only [ 297.855551][ T5875] bcachefs (loop3): finished waiting for writes to stop [ 297.873505][ T5875] bcachefs (loop3): flushing journal and stopping allocators, journal seq 3 [ 297.927675][ T5875] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 3 [ 297.938917][ T5875] bcachefs (loop3): clean shutdown complete, journal seq 4 [ 297.947967][ T5875] bcachefs (loop3): marking filesystem clean [ 297.987196][ T5875] bcachefs (loop3): shutdown complete [ 298.078475][ T6034] team0 (unregistering): Port device team_slave_1 removed [ 298.110694][ T6034] team0 (unregistering): Port device team_slave_0 removed [ 298.470381][ T6034] team0 (unregistering): Port device team_slave_1 removed [ 298.500994][ T6034] team0 (unregistering): Port device team_slave_0 removed [ 298.858519][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 298.990388][ T7098] 8021q: adding VLAN 0 to HW filter on device team0 [ 299.247172][ T6040] bridge0: port 1(bridge_slave_0) entered blocking state [ 299.254350][ T6040] bridge0: port 1(bridge_slave_0) entered forwarding state [ 299.888792][ T6692] bridge0: port 2(bridge_slave_1) entered blocking state [ 299.896006][ T6692] bridge0: port 2(bridge_slave_1) entered forwarding state [ 301.131101][ T7168] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 301.390197][ T7168] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 301.537732][ T7168] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 301.730745][ T7511] loop1: detected capacity change from 0 to 32768 [ 301.774172][ T7250] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 301.840741][ T7511] [ 301.840741][ T7511] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 301.840741][ T7511] [ 301.885770][ T7168] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 303.419398][ T7511] read_mapping_page failed! [ 303.451656][ T7511] diRead: read_metapage failed [ 303.572571][ T7250] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 303.980209][ T7546] netlink: 277 bytes leftover after parsing attributes in process `syz.1.298'. [ 304.468658][ T7550] loop3: detected capacity change from 0 to 512 [ 304.496611][ T7550] EXT4-fs: Ignoring removed bh option [ 305.288055][ T7250] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 305.343876][ T7550] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 305.536594][ T7550] EXT4-fs (loop3): 1 truncate cleaned up [ 305.562583][ T7550] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 305.676932][ T7250] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 305.928490][ T7572] loop0: detected capacity change from 0 to 512 [ 305.960403][ T7572] EXT4-fs: Ignoring removed bh option [ 305.966649][ T7572] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 305.999806][ T7098] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 306.615590][ T7572] EXT4-fs (loop0): 1 truncate cleaned up [ 306.653350][ T7572] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 307.141052][ T5875] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 307.739928][ T7168] 8021q: adding VLAN 0 to HW filter on device bond0 [ 308.110207][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 308.450967][ T7250] 8021q: adding VLAN 0 to HW filter on device bond0 [ 308.515628][ T7250] 8021q: adding VLAN 0 to HW filter on device team0 [ 308.543833][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 308.551003][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 308.746824][ T7168] 8021q: adding VLAN 0 to HW filter on device team0 [ 308.815112][ T6034] bridge0: port 2(bridge_slave_1) entered blocking state [ 308.822352][ T6034] bridge0: port 2(bridge_slave_1) entered forwarding state [ 309.579306][ T6040] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.586536][ T6040] bridge0: port 1(bridge_slave_0) entered forwarding state [ 310.054505][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.061707][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 312.080526][ T5876] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 312.093390][ T5876] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 312.101168][ T5876] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 312.121996][ T5876] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 312.136937][ T5876] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 314.251560][ T5179] Bluetooth: hci5: command tx timeout [ 316.333210][ T5179] Bluetooth: hci5: command tx timeout [ 316.477222][ T7656] loop1: detected capacity change from 0 to 512 [ 316.513442][ T7656] EXT4-fs: Ignoring removed bh option [ 316.549230][ T7656] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 316.664272][ T7656] EXT4-fs (loop1): 1 truncate cleaned up [ 316.686922][ T7656] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 316.881864][ T7658] loop0: detected capacity change from 0 to 32768 [ 317.741157][ T7658] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 317.741198][ T7658] allowing incompatible features above 0.0: (unknown version) [ 317.741224][ T7658] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 317.780635][ T7658] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0 [ 317.788863][ T7658] bcachefs (loop0): initializing new filesystem [ 317.803703][ T7658] bcachefs (loop0): going read-write [ 317.871616][ T7658] bcachefs (loop0): marking superblocks [ 317.885462][ T7658] bcachefs (loop0): initializing freespace [ 317.894678][ T7658] bcachefs (loop0): done initializing freespace [ 317.903286][ T7658] bcachefs (loop0): reading snapshots table [ 317.909203][ T7658] bcachefs (loop0): reading snapshots done [ 317.958665][ T7658] bcachefs (loop0): done starting filesystem [ 317.995275][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 318.415092][ T5876] Bluetooth: hci5: command tx timeout [ 318.510266][ T7250] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 318.582562][ T5179] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 318.595964][ T7678] loop1: detected capacity change from 0 to 512 [ 318.607625][ T5179] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 318.617386][ T5179] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 318.631826][ T5179] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 318.643069][ T5179] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 318.661829][ T7678] EXT4-fs error (device loop1): ext4_orphan_get:1392: inode #15: comm syz.1.316: casefold flag without casefold feature [ 318.751530][ T7678] EXT4-fs error (device loop1): ext4_orphan_get:1395: comm syz.1.316: couldn't read orphan inode 15 (err -117) [ 318.776767][ T7678] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 319.180753][ T7686] loop3: detected capacity change from 0 to 40427 [ 319.371006][ T7686] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 319.379151][ T7686] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 319.539225][ T7686] F2FS-fs (loop3): invalid crc value [ 319.907244][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 319.910817][ T7686] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 319.965512][ T7686] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 319.973214][ T7686] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 320.501463][ T5876] Bluetooth: hci5: command tx timeout [ 320.741461][ T5876] Bluetooth: hci1: command tx timeout [ 320.862768][ T5866] bcachefs (loop0): shutting down [ 320.867832][ T5866] bcachefs (loop0): going read-only [ 320.902401][ T5866] bcachefs (loop0): finished waiting for writes to stop [ 321.035097][ T5866] bcachefs (loop0): flushing journal and stopping allocators, journal seq 4 [ 321.220435][ T5866] bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 4 [ 321.234430][ T5866] bcachefs (loop0): clean shutdown complete, journal seq 5 [ 321.254693][ T5866] bcachefs (loop0): marking filesystem clean [ 321.368641][ T5866] bcachefs (loop0): shutdown complete [ 322.188238][ T7630] chnl_net:caif_netlink_parms(): no params data found [ 322.915245][ T5878] Bluetooth: hci1: command tx timeout [ 323.196453][ T13] bridge_slave_1: left allmulticast mode [ 323.224082][ T13] bridge_slave_1: left promiscuous mode [ 323.229866][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 323.240613][ T13] bridge_slave_0: left allmulticast mode [ 323.246639][ T13] bridge_slave_0: left promiscuous mode [ 323.252764][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 324.984721][ T5878] Bluetooth: hci1: command tx timeout [ 325.000110][ T7725] loop3: detected capacity change from 0 to 32768 [ 325.021458][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 325.112112][ T7725] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 325.112151][ T7725] allowing incompatible features above 0.0: (unknown version) [ 325.112172][ T7725] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 325.153051][ T7725] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0 [ 325.161340][ T7725] bcachefs (loop3): initializing new filesystem [ 325.177271][ T7725] bcachefs (loop3): going read-write [ 325.184053][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 325.231833][ T7725] bcachefs (loop3): marking superblocks [ 325.248778][ T7725] bcachefs (loop3): initializing freespace [ 325.260388][ T7725] bcachefs (loop3): done initializing freespace [ 325.270021][ T7725] bcachefs (loop3): reading snapshots table [ 325.273603][ T13] bond0 (unregistering): Released all slaves [ 325.276370][ T7725] bcachefs (loop3): reading snapshots done [ 325.332177][ T7725] bcachefs (loop3): done starting filesystem [ 325.439897][ T7679] chnl_net:caif_netlink_parms(): no params data found [ 325.551011][ T5875] bcachefs (loop3): shutting down [ 325.556802][ T5875] bcachefs (loop3): going read-only [ 325.563132][ T5875] bcachefs (loop3): finished waiting for writes to stop [ 325.579413][ T5875] bcachefs (loop3): flushing journal and stopping allocators, journal seq 3 [ 325.689067][ T5875] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 3 [ 325.725814][ T5875] bcachefs (loop3): clean shutdown complete, journal seq 4 [ 325.737925][ T13] hsr_slave_0: left promiscuous mode [ 325.738363][ T5875] bcachefs (loop3): marking filesystem clean [ 325.750146][ T7727] loop1: detected capacity change from 0 to 32768 [ 325.757857][ T13] hsr_slave_1: left promiscuous mode [ 325.784993][ T7727] [ 325.784993][ T7727] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 325.784993][ T7727] [ 325.802777][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 325.818749][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 325.956315][ T5875] bcachefs (loop3): shutdown complete [ 326.061473][ T5869] [ 326.061473][ T5869] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 326.061473][ T5869] [ 326.095994][ T5869] [ 326.095994][ T5869] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 326.095994][ T5869] [ 326.781104][ T13] team0 (unregistering): Port device team_slave_1 removed [ 326.797412][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 326.805143][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 327.123135][ T5878] Bluetooth: hci1: command tx timeout [ 327.820838][ T13] team0 (unregistering): Port device team_slave_0 removed [ 328.041106][ T7750] fuse: Invalid rootmode [ 330.176321][ T5876] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 330.185930][ T5876] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 330.193985][ T5876] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 330.212031][ T5876] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 330.220301][ T5876] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 330.422966][ T7756] loop0: detected capacity change from 0 to 32768 [ 330.737177][ T7756] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 330.737216][ T7756] allowing incompatible features above 0.0: (unknown version) [ 330.737237][ T7756] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 330.778130][ T7756] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0 [ 330.786368][ T7756] bcachefs (loop0): initializing new filesystem [ 330.801066][ T7756] bcachefs (loop0): going read-write [ 330.856900][ T7752] netlink: 20 bytes leftover after parsing attributes in process `syz.1.328'. [ 330.872799][ T7756] bcachefs (loop0): marking superblocks [ 330.889050][ T7756] bcachefs (loop0): initializing freespace [ 330.899239][ T7756] bcachefs (loop0): done initializing freespace [ 330.908468][ T7756] bcachefs (loop0): reading snapshots table [ 330.914530][ T7756] bcachefs (loop0): reading snapshots done [ 331.022254][ T7630] bridge0: port 1(bridge_slave_0) entered blocking state [ 331.029436][ T7630] bridge0: port 1(bridge_slave_0) entered disabled state [ 331.119986][ T7630] bridge_slave_0: entered allmulticast mode [ 331.164359][ T7756] bcachefs (loop0): done starting filesystem [ 331.183203][ T7630] bridge_slave_0: entered promiscuous mode [ 331.499746][ T7630] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.519716][ T7630] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.527777][ T7630] bridge_slave_1: entered allmulticast mode [ 331.536322][ T7630] bridge_slave_1: entered promiscuous mode [ 331.812108][ T5866] bcachefs (loop0): shutting down [ 331.817198][ T5866] bcachefs (loop0): going read-only [ 331.834526][ T5866] bcachefs (loop0): finished waiting for writes to stop [ 331.848821][ T43] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 331.869093][ T5866] bcachefs (loop0): flushing journal and stopping allocators, journal seq 2 [ 331.896066][ T7630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 331.963878][ T5866] bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 3 [ 332.007937][ T5866] bcachefs (loop0): clean shutdown complete, journal seq 4 [ 332.026720][ T5866] bcachefs (loop0): marking filesystem clean [ 332.121788][ T5866] bcachefs (loop0): shutdown complete [ 332.170273][ T7630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 332.239253][ T7679] bridge0: port 1(bridge_slave_0) entered blocking state [ 332.246568][ T43] usb 2-1: device descriptor read/64, error -71 [ 332.249449][ T7679] bridge0: port 1(bridge_slave_0) entered disabled state [ 332.270533][ T7679] bridge_slave_0: entered allmulticast mode [ 332.301658][ T7679] bridge_slave_0: entered promiscuous mode [ 332.341852][ T5878] Bluetooth: hci3: command tx timeout [ 332.365397][ T7679] bridge0: port 2(bridge_slave_1) entered blocking state [ 332.460656][ T7679] bridge0: port 2(bridge_slave_1) entered disabled state [ 332.477029][ T7679] bridge_slave_1: entered allmulticast mode [ 332.518665][ T7679] bridge_slave_1: entered promiscuous mode [ 332.596815][ T43] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 332.901380][ T43] usb 2-1: device descriptor read/64, error -71 [ 332.927711][ T7630] team0: Port device team_slave_0 added [ 332.976437][ T7630] team0: Port device team_slave_1 added [ 333.023572][ T43] usb usb2-port1: attempt power cycle [ 333.070113][ T7679] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 333.093779][ T7679] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 333.221757][ T7630] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 333.239009][ T7630] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 333.275035][ T7630] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 333.351891][ T7679] team0: Port device team_slave_0 added [ 333.370552][ T7679] team0: Port device team_slave_1 added [ 333.379035][ T7630] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 333.398043][ T7630] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 333.424426][ T43] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 333.473524][ T43] usb 2-1: device descriptor read/8, error -71 [ 333.497124][ T7630] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 333.699592][ T7679] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 333.707472][ T7679] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 333.735332][ T43] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 333.758055][ T7679] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 333.785917][ T43] usb 2-1: device descriptor read/8, error -71 [ 333.834591][ T7679] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 333.861546][ T7679] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 333.900060][ T7679] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 333.918568][ T43] usb usb2-port1: unable to enumerate USB device [ 333.941083][ T7630] hsr_slave_0: entered promiscuous mode [ 333.950179][ T7630] hsr_slave_1: entered promiscuous mode [ 333.966221][ T7630] debugfs: 'hsr0' already exists in 'hsr' [ 333.976802][ T7630] Cannot create hsr debugfs directory [ 334.184117][ T7679] hsr_slave_0: entered promiscuous mode [ 334.199698][ T7679] hsr_slave_1: entered promiscuous mode [ 334.206370][ T7679] debugfs: 'hsr0' already exists in 'hsr' [ 334.218953][ T7679] Cannot create hsr debugfs directory [ 334.413335][ T5878] Bluetooth: hci3: command tx timeout [ 334.728318][ T7790] loop3: detected capacity change from 0 to 32768 [ 334.942752][ T7790] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 334.942792][ T7790] allowing incompatible features above 0.0: (unknown version) [ 334.942813][ T7790] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 334.982388][ T7790] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0 [ 334.990752][ T7790] bcachefs (loop3): initializing new filesystem [ 335.005670][ T7790] bcachefs (loop3): going read-write [ 335.056088][ T7790] bcachefs (loop3): marking superblocks [ 335.071133][ T7790] bcachefs (loop3): initializing freespace [ 335.082109][ T7790] bcachefs (loop3): done initializing freespace [ 335.091350][ T7790] bcachefs (loop3): reading snapshots table [ 335.097292][ T7790] bcachefs (loop3): reading snapshots done [ 335.223914][ T7790] bcachefs (loop3): done starting filesystem [ 335.367935][ T5875] bcachefs (loop3): shutting down [ 335.390126][ T5875] bcachefs (loop3): going read-only [ 335.411550][ T5875] bcachefs (loop3): finished waiting for writes to stop [ 335.447563][ T5875] bcachefs (loop3): flushing journal and stopping allocators, journal seq 3 [ 335.561524][ T5875] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 3 [ 335.615829][ T5875] bcachefs (loop3): clean shutdown complete, journal seq 4 [ 335.628661][ T5875] bcachefs (loop3): marking filesystem clean [ 335.740150][ T7793] loop1: detected capacity change from 0 to 32768 [ 335.787648][ T7793] [ 335.787648][ T7793] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 335.787648][ T7793] [ 335.808281][ T5875] bcachefs (loop3): shutdown complete [ 335.852406][ T7793] [ 335.852406][ T7793] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 335.852406][ T7793] [ 335.908312][ T7793] [ 335.908312][ T7793] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 335.908312][ T7793] [ 335.993459][ T7793] [ 335.993459][ T7793] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 335.993459][ T7793] [ 336.094426][ T7793] [ 336.094426][ T7793] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 336.094426][ T7793] [ 336.191505][ T7793] [ 336.191505][ T7793] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 336.191505][ T7793] [ 336.265278][ T111] [ 336.265278][ T111] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 336.265278][ T111] [ 336.436272][ T59] [ 336.436272][ T59] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 336.436272][ T59] [ 336.477565][ T59] [ 336.477565][ T59] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 336.477565][ T59] [ 336.499174][ T5878] Bluetooth: hci3: command tx timeout [ 336.520866][ T5869] [ 336.520866][ T5869] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 336.520866][ T5869] [ 336.540398][ T112] [ 336.540398][ T112] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 336.540398][ T112] [ 336.556565][ T5869] [ 336.556565][ T5869] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 336.556565][ T5869] [ 336.602299][ T7757] chnl_net:caif_netlink_parms(): no params data found [ 337.284044][ T7630] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 337.325570][ T7630] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 337.400072][ T7630] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 337.423014][ T7630] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 338.595351][ T5878] Bluetooth: hci3: command tx timeout [ 338.841061][ T7757] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.963290][ T7757] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.092615][ T7757] bridge_slave_0: entered allmulticast mode [ 340.100684][ T7757] bridge_slave_0: entered promiscuous mode [ 340.169301][ T7757] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.180110][ T7757] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.190421][ T7757] bridge_slave_1: entered allmulticast mode [ 340.200776][ T7757] bridge_slave_1: entered promiscuous mode [ 340.527985][ T7757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 340.587544][ T7757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 340.705846][ T7839] loop1: detected capacity change from 0 to 512 [ 340.742244][ T7839] EXT4-fs error (device loop1): ext4_orphan_get:1392: inode #15: comm syz.1.344: casefold flag without casefold feature [ 340.793903][ T7839] EXT4-fs error (device loop1): ext4_orphan_get:1395: comm syz.1.344: couldn't read orphan inode 15 (err -117) [ 340.847147][ T7839] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 340.865214][ T7757] team0: Port device team_slave_0 added [ 340.889079][ T7843] loop0: detected capacity change from 0 to 512 [ 340.942523][ T7843] EXT4-fs: Ignoring removed bh option [ 340.989331][ T7843] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 341.039691][ T7757] team0: Port device team_slave_1 added [ 341.103182][ T7843] EXT4-fs (loop0): 1 truncate cleaned up [ 341.147685][ T7843] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 342.779197][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 342.789149][ T7757] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 342.816794][ T7757] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 342.912278][ T7757] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 342.964549][ T7757] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 343.002490][ T7757] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 343.094859][ T7757] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 343.119707][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 343.167780][ T7630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 343.221348][ T10] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 343.361537][ T10] usb 2-1: device descriptor read/64, error -71 [ 343.621722][ T10] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 343.653881][ T7860] loop0: detected capacity change from 0 to 40427 [ 343.664399][ T7860] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 343.673858][ T7860] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 343.676238][ T13] bridge_slave_1: left allmulticast mode [ 343.698832][ T7860] F2FS-fs (loop0): invalid crc value [ 343.704566][ T13] bridge_slave_1: left promiscuous mode [ 343.727890][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.771452][ T10] usb 2-1: device descriptor read/64, error -71 [ 343.821684][ T7860] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 343.833970][ T13] bridge_slave_0: left allmulticast mode [ 343.858574][ T7860] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 343.865675][ T7860] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 343.891406][ T13] bridge_slave_0: left promiscuous mode [ 343.897209][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.913375][ T10] usb usb2-port1: attempt power cycle [ 343.939274][ T13] bridge_slave_1: left allmulticast mode [ 343.965940][ T13] bridge_slave_1: left promiscuous mode [ 343.991035][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.032422][ T13] bridge_slave_0: left allmulticast mode [ 344.038085][ T13] bridge_slave_0: left promiscuous mode [ 344.077446][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.811879][ T10] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 344.844924][ T10] usb 2-1: device descriptor read/8, error -71 [ 345.081753][ T10] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 345.118234][ T10] usb 2-1: device descriptor read/8, error -71 [ 345.967605][ T10] usb usb2-port1: unable to enumerate USB device [ 347.647186][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 347.715285][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 347.736762][ T13] bond0 (unregistering): Released all slaves [ 347.955503][ T7881] loop3: detected capacity change from 0 to 512 [ 347.983649][ T7881] EXT4-fs: Ignoring removed bh option [ 347.989757][ T7881] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 348.034524][ T7881] EXT4-fs (loop3): 1 truncate cleaned up [ 348.081620][ T7881] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 348.204123][ T7887] fuse: Invalid rootmode [ 350.072828][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 350.085305][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 350.096843][ T13] bond0 (unregistering): Released all slaves [ 350.185914][ T7889] netlink: 20 bytes leftover after parsing attributes in process `syz.1.353'. [ 350.378948][ T7630] 8021q: adding VLAN 0 to HW filter on device team0 [ 350.385321][ T5875] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 350.424182][ T7757] hsr_slave_0: entered promiscuous mode [ 350.444738][ T7757] hsr_slave_1: entered promiscuous mode [ 350.451082][ T7757] debugfs: 'hsr0' already exists in 'hsr' [ 350.499885][ T7757] Cannot create hsr debugfs directory [ 350.671627][ T7896] loop3: detected capacity change from 0 to 512 [ 350.685387][ T7896] EXT4-fs: Ignoring removed bh option [ 350.732833][ T7896] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 350.785425][ T7896] EXT4-fs (loop3): 1 truncate cleaned up [ 350.803448][ T7896] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 351.751388][ T13] hsr_slave_0: left promiscuous mode [ 351.759788][ T13] hsr_slave_1: left promiscuous mode [ 351.766458][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 351.776132][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 351.996169][ T13] hsr_slave_0: left promiscuous mode [ 352.008091][ T13] hsr_slave_1: left promiscuous mode [ 352.014371][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 352.023841][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 355.877957][ T13] team0 (unregistering): Port device team_slave_1 removed [ 356.263468][ T13] team0 (unregistering): Port device team_slave_0 removed [ 356.972357][ T5935] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 357.119726][ T13] team0 (unregistering): Port device team_slave_1 removed [ 357.127786][ T5935] usb 2-1: device descriptor read/64, error -71 [ 357.159533][ T13] team0 (unregistering): Port device team_slave_0 removed [ 357.403942][ T5935] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 357.480824][ T6207] bridge0: port 1(bridge_slave_0) entered blocking state [ 357.487986][ T6207] bridge0: port 1(bridge_slave_0) entered forwarding state [ 357.651600][ T5935] usb 2-1: device descriptor read/64, error -71 [ 357.688383][ T5875] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 357.707793][ T2946] bridge0: port 2(bridge_slave_1) entered blocking state [ 357.715019][ T2946] bridge0: port 2(bridge_slave_1) entered forwarding state [ 357.764199][ T5935] usb usb2-port1: attempt power cycle [ 358.265613][ T5935] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 358.328685][ T5935] usb 2-1: device descriptor read/8, error -71 [ 358.701679][ T5935] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 358.806010][ T5935] usb 2-1: device descriptor read/8, error -71 [ 358.934142][ T5935] usb usb2-port1: unable to enumerate USB device [ 360.466942][ T7679] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 360.698243][ T7679] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 361.546265][ T7937] loop1: detected capacity change from 0 to 512 [ 361.569705][ T7937] EXT4-fs: Ignoring removed bh option [ 361.586458][ T7937] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 361.625154][ T7937] EXT4-fs (loop1): 1 truncate cleaned up [ 361.634040][ T7679] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 361.645129][ T7937] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 361.741059][ T7935] loop3: detected capacity change from 0 to 40427 [ 361.752834][ T7935] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 361.760596][ T7935] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 361.771656][ T7935] F2FS-fs (loop3): invalid crc value [ 361.936058][ T7679] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 362.617179][ T7935] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 362.658478][ T7935] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 362.665648][ T7935] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 362.917961][ T7630] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 362.960329][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 364.114999][ T7966] loop0: detected capacity change from 0 to 512 [ 364.173699][ T7966] EXT4-fs: Ignoring removed bh option [ 364.228895][ T7966] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 364.381095][ T7966] EXT4-fs (loop0): 1 truncate cleaned up [ 364.457483][ T7966] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 364.709742][ T7679] 8021q: adding VLAN 0 to HW filter on device bond0 [ 364.796877][ T7630] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 365.615743][ T5866] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 365.787633][ T7679] 8021q: adding VLAN 0 to HW filter on device team0 [ 365.826830][ T7981] loop3: detected capacity change from 0 to 128 [ 366.092476][ T7981] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 366.308753][ T7981] ext4 filesystem being mounted at /95/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 366.469541][ T1102] bridge0: port 1(bridge_slave_0) entered blocking state [ 366.476782][ T1102] bridge0: port 1(bridge_slave_0) entered forwarding state [ 366.776800][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.784111][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 367.884406][ T7757] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 367.936803][ T5875] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 367.980095][ T7757] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 368.808144][ T7995] netlink: 'syz.1.374': attribute type 1 has an invalid length. [ 368.846988][ T7995] netlink: 232 bytes leftover after parsing attributes in process `syz.1.374'. [ 368.900469][ T7757] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 368.977812][ T7757] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 369.049651][ T7999] fuse: Invalid rootmode [ 369.357256][ T43] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 370.078927][ T8002] netlink: 20 bytes leftover after parsing attributes in process `syz.0.375'. [ 370.134700][ T43] usb 4-1: device descriptor read/64, error -71 [ 370.387110][ T43] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 370.571750][ T43] usb 4-1: device descriptor read/64, error -71 [ 370.589264][ T8014] loop1: detected capacity change from 0 to 512 [ 370.627783][ T8014] EXT4-fs: Ignoring removed bh option [ 370.692721][ T8014] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 370.711819][ T43] usb usb4-port1: attempt power cycle [ 370.768059][ T8014] EXT4-fs (loop1): 1 truncate cleaned up [ 370.824985][ T5876] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 370.834330][ T7757] 8021q: adding VLAN 0 to HW filter on device bond0 [ 370.836093][ T8014] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 370.856149][ T7757] 8021q: adding VLAN 0 to HW filter on device team0 [ 370.863759][ T5876] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 370.872918][ T5876] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 371.032868][ T5876] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 371.040901][ T5876] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 371.117088][ T6693] bridge0: port 1(bridge_slave_0) entered blocking state [ 371.124327][ T6693] bridge0: port 1(bridge_slave_0) entered forwarding state [ 371.199924][ T6693] bridge0: port 2(bridge_slave_1) entered blocking state [ 371.207131][ T6693] bridge0: port 2(bridge_slave_1) entered forwarding state [ 371.222659][ T43] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 371.341312][ T43] usb 4-1: device descriptor read/8, error -71 [ 371.628362][ T43] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 371.733521][ T43] usb 4-1: device descriptor read/8, error -71 [ 371.929470][ T43] usb usb4-port1: unable to enumerate USB device [ 371.978537][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 372.366294][ T8032] loop3: detected capacity change from 0 to 512 [ 372.427754][ T8032] EXT4-fs: Ignoring removed bh option [ 372.639739][ T8032] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 372.695169][ T8032] EXT4-fs (loop3): 1 truncate cleaned up [ 372.721114][ T8032] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 373.611874][ T5876] Bluetooth: hci6: command tx timeout [ 373.660724][ T7679] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 373.976553][ T5875] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 375.628990][ T8067] loop1: detected capacity change from 0 to 256 [ 375.656193][ T8067] exfat: Unknown parameter '/dev/ptmx' [ 375.701518][ T5876] Bluetooth: hci6: command tx timeout [ 376.578820][ T7757] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 376.599234][ T8079] netlink: 277 bytes leftover after parsing attributes in process `syz.1.386'. [ 376.917305][ T8018] chnl_net:caif_netlink_parms(): no params data found [ 377.034586][ T6034] bridge_slave_1: left allmulticast mode [ 377.040978][ T6034] bridge_slave_1: left promiscuous mode [ 377.061818][ T6034] bridge0: port 2(bridge_slave_1) entered disabled state [ 377.082675][ T6034] bridge_slave_0: left allmulticast mode [ 377.088343][ T6034] bridge_slave_0: left promiscuous mode [ 377.427576][ T6034] bridge0: port 1(bridge_slave_0) entered disabled state [ 377.706588][ T8092] loop1: detected capacity change from 0 to 512 [ 377.771951][ T5876] Bluetooth: hci6: command tx timeout [ 377.782406][ T8092] EXT4-fs: Ignoring removed bh option [ 377.798831][ T8092] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 377.873791][ T8092] EXT4-fs (loop1): 1 truncate cleaned up [ 377.951639][ T8092] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 378.586428][ T8096] loop3: detected capacity change from 0 to 2048 [ 378.940723][ T8096] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=66359, location=66359 [ 379.007648][ T8096] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 379.182327][ T5878] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 379.200365][ T5878] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 379.210811][ T5878] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 379.227553][ T5878] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 379.235574][ T5878] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 379.949238][ T5876] Bluetooth: hci6: command tx timeout [ 380.868515][ T6034] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 380.922094][ T6034] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 380.937555][ T6034] bond0 (unregistering): Released all slaves [ 381.291481][ T5876] Bluetooth: hci5: command tx timeout [ 381.372064][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 381.551426][ T6034] hsr_slave_0: left promiscuous mode [ 381.607349][ T6034] hsr_slave_1: left promiscuous mode [ 381.613697][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 381.695253][ T6034] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 383.299074][ T8123] loop3: detected capacity change from 0 to 4096 [ 383.371363][ T5876] Bluetooth: hci5: command tx timeout [ 383.784823][ T8125] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 384.084640][ T8126] loop1: detected capacity change from 0 to 512 [ 384.375797][ T8126] EXT4-fs error (device loop1): ext4_xattr_inode_iget:432: comm syz.1.391: Parent and EA inode have the same ino 15 [ 384.496086][ T8126] EXT4-fs (loop1): 1 orphan inode deleted [ 384.562274][ T8126] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 385.074621][ T6034] team0 (unregistering): Port device team_slave_1 removed [ 385.219027][ T6034] team0 (unregistering): Port device team_slave_0 removed [ 385.451404][ T5876] Bluetooth: hci5: command tx timeout [ 386.227339][ T5869] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 386.338545][ T8138] fuse: Invalid rootmode [ 387.533898][ T5876] Bluetooth: hci5: command tx timeout [ 387.553344][ T8143] netlink: 20 bytes leftover after parsing attributes in process `syz.0.394'. [ 387.582764][ T8018] bridge0: port 1(bridge_slave_0) entered blocking state [ 387.610304][ T8018] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.630624][ T8018] bridge_slave_0: entered allmulticast mode [ 387.661630][ T8018] bridge_slave_0: entered promiscuous mode [ 387.680771][ T8018] bridge0: port 2(bridge_slave_1) entered blocking state [ 387.851206][ T8018] bridge0: port 2(bridge_slave_1) entered disabled state [ 387.861736][ T8018] bridge_slave_1: entered allmulticast mode [ 387.869781][ T8018] bridge_slave_1: entered promiscuous mode [ 388.179011][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 388.221391][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 388.752486][ T8018] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 388.879741][ T8018] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 389.197719][ T8100] chnl_net:caif_netlink_parms(): no params data found [ 389.303966][ T8146] loop1: detected capacity change from 0 to 32768 [ 389.320194][ T8018] team0: Port device team_slave_0 added [ 389.373963][ T8146] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.395 (8146) [ 389.377115][ T8018] team0: Port device team_slave_1 added [ 389.666681][ T8146] BTRFS info (device loop1): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 389.758496][ T8146] BTRFS info (device loop1): using crc32c (crc32c-lib) checksum algorithm [ 390.152731][ T8146] BTRFS info (device loop1): rebuilding free space tree [ 390.291620][ T5878] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 390.315684][ T5878] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 390.328381][ T5878] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 390.349121][ T5878] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 390.353159][ T8146] BTRFS info (device loop1): enabling ssd optimizations [ 390.372176][ T5878] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 390.411750][ T8146] BTRFS info (device loop1): enabling free space tree [ 390.430689][ T8146] BTRFS info (device loop1): force clearing of disk cache [ 390.478658][ T8146] BTRFS info (device loop1): use lzo compression, level 0 [ 390.835039][ T5869] BTRFS info (device loop1): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0 [ 390.903880][ T8018] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 390.915795][ T8018] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 391.004594][ T8018] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 391.119395][ T8018] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 391.206927][ T8018] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 391.335454][ T8190] loop3: detected capacity change from 0 to 512 [ 391.337002][ T8191] loop1: detected capacity change from 0 to 1024 [ 391.365288][ T8018] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 391.408102][ T8190] EXT4-fs: Ignoring removed bh option [ 391.444630][ T8190] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 391.642856][ T8190] EXT4-fs (loop3): 1 truncate cleaned up [ 391.650075][ T8190] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 391.680442][ T8191] ================================================================== [ 391.688529][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 391.696189][ T8191] Read of size 2 at addr ffff888034360a18 by task syz.1.398/8191 [ 391.703924][ T8191] [ 391.706253][ T8191] CPU: 1 UID: 0 PID: 8191 Comm: syz.1.398 Not tainted syzkaller #0 PREEMPT(full) [ 391.706299][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 391.706322][ T8191] Call Trace: [ 391.706334][ T8191] [ 391.706347][ T8191] dump_stack_lvl+0x116/0x1f0 [ 391.706407][ T8191] print_report+0xcd/0x630 [ 391.706441][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 391.706486][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 391.706531][ T8191] ? __phys_addr+0xe8/0x180 [ 391.706583][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 391.706624][ T8191] kasan_report+0xe0/0x110 [ 391.706657][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 391.706705][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 391.706753][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 391.706806][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 391.706861][ T8191] ? __pfx___up_read+0x10/0x10 [ 391.706907][ T8191] ? mntput+0x10/0x90 [ 391.706960][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 391.707005][ T8191] ? terminate_walk+0x31c/0x680 [ 391.707096][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 391.707146][ T8191] vfs_listxattr+0xba/0x140 [ 391.707204][ T8191] listxattr+0x102/0x1a0 [ 391.707260][ T8191] path_listxattrat+0x151/0x370 [ 391.707319][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 391.707380][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 391.707430][ T8191] do_syscall_64+0xcd/0x4c0 [ 391.707465][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.707502][ T8191] RIP: 0033:0x7f60f158ebe9 [ 391.707529][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 391.707566][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 391.707601][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 391.707626][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 391.707650][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 391.707673][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 391.707697][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 391.707737][ T8191] [ 391.707749][ T8191] [ 391.923856][ T8191] Allocated by task 8191: [ 391.928175][ T8191] kasan_save_stack+0x33/0x60 [ 391.932881][ T8191] kasan_save_track+0x14/0x30 [ 391.937580][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 391.942187][ T8191] __kmalloc_noprof+0x223/0x510 [ 391.947056][ T8191] hfsplus_find_init+0x95/0x1f0 [ 391.951913][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 391.956862][ T8191] vfs_listxattr+0xba/0x140 [ 391.961389][ T8191] listxattr+0x102/0x1a0 [ 391.965647][ T8191] path_listxattrat+0x151/0x370 [ 391.970522][ T8191] do_syscall_64+0xcd/0x4c0 [ 391.975030][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.980931][ T8191] [ 391.983252][ T8191] The buggy address belongs to the object at ffff888034360800 [ 391.983252][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 391.997331][ T8191] The buggy address is located 0 bytes to the right of [ 391.997331][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 392.011933][ T8191] [ 392.014249][ T8191] The buggy address belongs to the physical page: [ 392.020645][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 392.029405][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 392.037903][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 392.045878][ T8191] page_type: f5(slab) [ 392.049856][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 392.058439][ T8191] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 392.067025][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 392.075694][ T8191] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 392.084364][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 392.093036][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 392.101695][ T8191] page dumped because: kasan: bad access detected [ 392.108094][ T8191] page_owner tracks the page as allocated [ 392.113793][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 392.132908][ T8191] post_alloc_hook+0x1c0/0x230 [ 392.137689][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 392.143253][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 392.149164][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 392.154009][ T8191] new_slab+0x247/0x330 [ 392.158177][ T8191] ___slab_alloc+0xcf2/0x1750 [ 392.162862][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 392.168244][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 392.173110][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 392.179016][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 392.185089][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 392.190412][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 392.195542][ T8191] process_one_work+0x9cf/0x1b70 [ 392.200482][ T8191] worker_thread+0x6c8/0xf10 [ 392.205073][ T8191] kthread+0x3c5/0x780 [ 392.209142][ T8191] ret_from_fork+0x5d7/0x6f0 [ 392.213731][ T8191] page last free pid 13 tgid 13 stack trace: [ 392.219697][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 392.224912][ T8191] qlist_free_all+0x4d/0x120 [ 392.229516][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 392.234991][ T8191] __kasan_slab_alloc+0x69/0x90 [ 392.239863][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 392.246297][ T8191] kmalloc_reserve+0xef/0x2c0 [ 392.250978][ T8191] __alloc_skb+0x166/0x380 [ 392.255406][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 392.260695][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 392.265110][ T8191] netif_close_many+0x2fc/0x630 [ 392.269965][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 392.276293][ T8191] ops_undo_list+0x8fc/0xab0 [ 392.280908][ T8191] cleanup_net+0x408/0x890 [ 392.285321][ T8191] process_one_work+0x9cf/0x1b70 [ 392.290260][ T8191] worker_thread+0x6c8/0xf10 [ 392.294854][ T8191] kthread+0x3c5/0x780 [ 392.298926][ T8191] [ 392.301261][ T8191] Memory state around the buggy address: [ 392.306884][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 392.314943][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 392.323004][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 392.331056][ T8191] ^ [ 392.335894][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 392.343950][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 392.352002][ T8191] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 392.505981][ T5876] Bluetooth: hci1: command tx timeout [ 392.515942][ T8191] Disabling lock debugging due to kernel taint [ 392.523646][ T8191] ================================================================== [ 392.531717][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 392.539361][ T8191] Read of size 2 at addr ffff888034360a1a by task syz.1.398/8191 [ 392.547073][ T8191] [ 392.549396][ T8191] CPU: 0 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 392.549443][ T8191] Tainted: [B]=BAD_PAGE [ 392.549454][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 392.549475][ T8191] Call Trace: [ 392.549485][ T8191] [ 392.549497][ T8191] dump_stack_lvl+0x116/0x1f0 [ 392.549549][ T8191] print_report+0xcd/0x630 [ 392.549579][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 392.549620][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 392.549664][ T8191] ? __phys_addr+0xe8/0x180 [ 392.549710][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 392.549747][ T8191] kasan_report+0xe0/0x110 [ 392.549777][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 392.549817][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 392.549859][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 392.549907][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 392.549955][ T8191] ? __pfx___up_read+0x10/0x10 [ 392.549991][ T8191] ? mntput+0x10/0x90 [ 392.550038][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 392.550078][ T8191] ? terminate_walk+0x31c/0x680 [ 392.550152][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 392.550196][ T8191] vfs_listxattr+0xba/0x140 [ 392.550246][ T8191] listxattr+0x102/0x1a0 [ 392.550295][ T8191] path_listxattrat+0x151/0x370 [ 392.550346][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 392.550398][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 392.550443][ T8191] do_syscall_64+0xcd/0x4c0 [ 392.550473][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.550506][ T8191] RIP: 0033:0x7f60f158ebe9 [ 392.550531][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 392.550564][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 392.550594][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 392.550617][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 392.550637][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 392.550665][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 392.550686][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 392.550718][ T8191] [ 392.550729][ T8191] [ 392.772574][ T8191] Allocated by task 8191: [ 392.776895][ T8191] kasan_save_stack+0x33/0x60 [ 392.781593][ T8191] kasan_save_track+0x14/0x30 [ 392.786293][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 392.790984][ T8191] __kmalloc_noprof+0x223/0x510 [ 392.795856][ T8191] hfsplus_find_init+0x95/0x1f0 [ 392.800737][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 392.805683][ T8191] vfs_listxattr+0xba/0x140 [ 392.810201][ T8191] listxattr+0x102/0x1a0 [ 392.814458][ T8191] path_listxattrat+0x151/0x370 [ 392.819327][ T8191] do_syscall_64+0xcd/0x4c0 [ 392.823826][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.829730][ T8191] [ 392.832134][ T8191] The buggy address belongs to the object at ffff888034360800 [ 392.832134][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 392.846274][ T8191] The buggy address is located 2 bytes to the right of [ 392.846274][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 392.860768][ T8191] [ 392.863079][ T8191] The buggy address belongs to the physical page: [ 392.869474][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 392.878232][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 392.886729][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 392.894741][ T8191] page_type: f5(slab) [ 392.898722][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 392.907304][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 392.915889][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 392.924564][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 392.933407][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 392.942080][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 392.950737][ T8191] page dumped because: kasan: bad access detected [ 392.957137][ T8191] page_owner tracks the page as allocated [ 392.962836][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 392.981956][ T8191] post_alloc_hook+0x1c0/0x230 [ 392.986737][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 392.992297][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 392.998211][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 393.003060][ T8191] new_slab+0x247/0x330 [ 393.007224][ T8191] ___slab_alloc+0xcf2/0x1750 [ 393.011906][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 393.017287][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 393.022155][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 393.028058][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 393.034132][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 393.039425][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 393.044553][ T8191] process_one_work+0x9cf/0x1b70 [ 393.049496][ T8191] worker_thread+0x6c8/0xf10 [ 393.054089][ T8191] kthread+0x3c5/0x780 [ 393.058157][ T8191] ret_from_fork+0x5d7/0x6f0 [ 393.062742][ T8191] page last free pid 13 tgid 13 stack trace: [ 393.068706][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 393.073915][ T8191] qlist_free_all+0x4d/0x120 [ 393.078603][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 393.084082][ T8191] __kasan_slab_alloc+0x69/0x90 [ 393.088955][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 393.095391][ T8191] kmalloc_reserve+0xef/0x2c0 [ 393.100092][ T8191] __alloc_skb+0x166/0x380 [ 393.104519][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 393.109805][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 393.114218][ T8191] netif_close_many+0x2fc/0x630 [ 393.119069][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 393.125393][ T8191] ops_undo_list+0x8fc/0xab0 [ 393.130003][ T8191] cleanup_net+0x408/0x890 [ 393.134415][ T8191] process_one_work+0x9cf/0x1b70 [ 393.139358][ T8191] worker_thread+0x6c8/0xf10 [ 393.143954][ T8191] kthread+0x3c5/0x780 [ 393.148026][ T8191] [ 393.150335][ T8191] Memory state around the buggy address: [ 393.155956][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 393.164011][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 393.172068][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 393.180116][ T8191] ^ [ 393.184953][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 393.193008][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 393.201059][ T8191] ================================================================== [ 393.366152][ T8191] ================================================================== [ 393.374258][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 393.381918][ T8191] Read of size 2 at addr ffff888034360a1c by task syz.1.398/8191 [ 393.389651][ T8191] [ 393.391977][ T8191] CPU: 1 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 393.392026][ T8191] Tainted: [B]=BAD_PAGE [ 393.392038][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 393.392058][ T8191] Call Trace: [ 393.392069][ T8191] [ 393.392081][ T8191] dump_stack_lvl+0x116/0x1f0 [ 393.392135][ T8191] print_report+0xcd/0x630 [ 393.392165][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 393.392205][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 393.392245][ T8191] ? __phys_addr+0xe8/0x180 [ 393.392291][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 393.392327][ T8191] kasan_report+0xe0/0x110 [ 393.392358][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 393.392398][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 393.392441][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 393.392488][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 393.392537][ T8191] ? __pfx___up_read+0x10/0x10 [ 393.392573][ T8191] ? mntput+0x10/0x90 [ 393.392621][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 393.392661][ T8191] ? terminate_walk+0x31c/0x680 [ 393.392736][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 393.392780][ T8191] vfs_listxattr+0xba/0x140 [ 393.392831][ T8191] listxattr+0x102/0x1a0 [ 393.392879][ T8191] path_listxattrat+0x151/0x370 [ 393.392937][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 393.392990][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 393.393033][ T8191] do_syscall_64+0xcd/0x4c0 [ 393.393065][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.393098][ T8191] RIP: 0033:0x7f60f158ebe9 [ 393.393123][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 393.393156][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 393.393187][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 393.393209][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 393.393230][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 393.393251][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 393.393272][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 393.393304][ T8191] [ 393.393315][ T8191] [ 393.614943][ T8191] Allocated by task 8191: [ 393.619260][ T8191] kasan_save_stack+0x33/0x60 [ 393.623959][ T8191] kasan_save_track+0x14/0x30 [ 393.628655][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 393.633263][ T8191] __kmalloc_noprof+0x223/0x510 [ 393.638132][ T8191] hfsplus_find_init+0x95/0x1f0 [ 393.642986][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 393.647937][ T8191] vfs_listxattr+0xba/0x140 [ 393.652459][ T8191] listxattr+0x102/0x1a0 [ 393.656721][ T8191] path_listxattrat+0x151/0x370 [ 393.661632][ T8191] do_syscall_64+0xcd/0x4c0 [ 393.666136][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.672033][ T8191] [ 393.674346][ T8191] The buggy address belongs to the object at ffff888034360800 [ 393.674346][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 393.688396][ T8191] The buggy address is located 4 bytes to the right of [ 393.688396][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 393.702889][ T8191] [ 393.705205][ T8191] The buggy address belongs to the physical page: [ 393.711598][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 393.720351][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 393.728842][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 393.736818][ T8191] page_type: f5(slab) [ 393.740798][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 393.749380][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 393.757968][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 393.766637][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 393.775307][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 393.783979][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 393.792638][ T8191] page dumped because: kasan: bad access detected [ 393.799037][ T8191] page_owner tracks the page as allocated [ 393.804735][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 393.823848][ T8191] post_alloc_hook+0x1c0/0x230 [ 393.828630][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 393.834192][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 393.840104][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 393.844953][ T8191] new_slab+0x247/0x330 [ 393.849116][ T8191] ___slab_alloc+0xcf2/0x1750 [ 393.853800][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 393.859183][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 393.864047][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 393.869951][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 393.876026][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 393.881319][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 393.886447][ T8191] process_one_work+0x9cf/0x1b70 [ 393.891474][ T8191] worker_thread+0x6c8/0xf10 [ 393.896067][ T8191] kthread+0x3c5/0x780 [ 393.900133][ T8191] ret_from_fork+0x5d7/0x6f0 [ 393.904722][ T8191] page last free pid 13 tgid 13 stack trace: [ 393.910687][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 393.915895][ T8191] qlist_free_all+0x4d/0x120 [ 393.920504][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 393.925980][ T8191] __kasan_slab_alloc+0x69/0x90 [ 393.930853][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 393.937291][ T8191] kmalloc_reserve+0xef/0x2c0 [ 393.941970][ T8191] __alloc_skb+0x166/0x380 [ 393.946396][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 393.951704][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 393.956120][ T8191] netif_close_many+0x2fc/0x630 [ 393.960976][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 393.967302][ T8191] ops_undo_list+0x8fc/0xab0 [ 393.971915][ T8191] cleanup_net+0x408/0x890 [ 393.976330][ T8191] process_one_work+0x9cf/0x1b70 [ 393.981295][ T8191] worker_thread+0x6c8/0xf10 [ 393.985891][ T8191] kthread+0x3c5/0x780 [ 393.989964][ T8191] [ 393.992272][ T8191] Memory state around the buggy address: [ 393.997893][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 394.005950][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 394.014094][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 394.022145][ T8191] ^ [ 394.026982][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 394.035036][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 394.043084][ T8191] ================================================================== [ 394.059545][ T8100] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wg2": -EINTR [ 394.104929][ T8191] ================================================================== [ 394.121834][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 394.129475][ T8191] Read of size 2 at addr ffff888034360a1e by task syz.1.398/8191 [ 394.137185][ T8191] [ 394.139511][ T8191] CPU: 0 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 394.139558][ T8191] Tainted: [B]=BAD_PAGE [ 394.139569][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 394.139589][ T8191] Call Trace: [ 394.139599][ T8191] [ 394.139611][ T8191] dump_stack_lvl+0x116/0x1f0 [ 394.139670][ T8191] print_report+0xcd/0x630 [ 394.139699][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 394.139740][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 394.139779][ T8191] ? __phys_addr+0xe8/0x180 [ 394.139825][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 394.139861][ T8191] kasan_report+0xe0/0x110 [ 394.139891][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 394.139932][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 394.139974][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 394.140022][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 394.140070][ T8191] ? __pfx___up_read+0x10/0x10 [ 394.140105][ T8191] ? mntput+0x10/0x90 [ 394.140153][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 394.140192][ T8191] ? terminate_walk+0x31c/0x680 [ 394.140266][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 394.140310][ T8191] vfs_listxattr+0xba/0x140 [ 394.140360][ T8191] listxattr+0x102/0x1a0 [ 394.140409][ T8191] path_listxattrat+0x151/0x370 [ 394.140460][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 394.140513][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 394.140556][ T8191] do_syscall_64+0xcd/0x4c0 [ 394.140587][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.140620][ T8191] RIP: 0033:0x7f60f158ebe9 [ 394.140644][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 394.140683][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 394.140714][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 394.140736][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 394.140758][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 394.140778][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 394.140799][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 394.140830][ T8191] [ 394.140841][ T8191] [ 394.362532][ T8191] Allocated by task 8191: [ 394.366852][ T8191] kasan_save_stack+0x33/0x60 [ 394.371553][ T8191] kasan_save_track+0x14/0x30 [ 394.376260][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 394.380866][ T8191] __kmalloc_noprof+0x223/0x510 [ 394.385734][ T8191] hfsplus_find_init+0x95/0x1f0 [ 394.390585][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 394.395532][ T8191] vfs_listxattr+0xba/0x140 [ 394.400050][ T8191] listxattr+0x102/0x1a0 [ 394.404307][ T8191] path_listxattrat+0x151/0x370 [ 394.409176][ T8191] do_syscall_64+0xcd/0x4c0 [ 394.413679][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.419575][ T8191] [ 394.421885][ T8191] The buggy address belongs to the object at ffff888034360800 [ 394.421885][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 394.435932][ T8191] The buggy address is located 6 bytes to the right of [ 394.435932][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 394.450424][ T8191] [ 394.452735][ T8191] The buggy address belongs to the physical page: [ 394.459129][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 394.467884][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 394.476378][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 394.484351][ T8191] page_type: f5(slab) [ 394.488329][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 394.496915][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 394.505499][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 394.514171][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 394.522843][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 394.531513][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 394.540172][ T8191] page dumped because: kasan: bad access detected [ 394.546658][ T8191] page_owner tracks the page as allocated [ 394.552377][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 394.571492][ T8191] post_alloc_hook+0x1c0/0x230 [ 394.576281][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 394.581847][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 394.587761][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 394.592606][ T8191] new_slab+0x247/0x330 [ 394.596773][ T8191] ___slab_alloc+0xcf2/0x1750 [ 394.601455][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 394.606836][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 394.611701][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 394.617605][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 394.623680][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 394.628974][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 394.634107][ T8191] process_one_work+0x9cf/0x1b70 [ 394.639052][ T8191] worker_thread+0x6c8/0xf10 [ 394.643644][ T8191] kthread+0x3c5/0x780 [ 394.647716][ T8191] ret_from_fork+0x5d7/0x6f0 [ 394.652301][ T8191] page last free pid 13 tgid 13 stack trace: [ 394.658267][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 394.663473][ T8191] qlist_free_all+0x4d/0x120 [ 394.668077][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 394.673550][ T8191] __kasan_slab_alloc+0x69/0x90 [ 394.678424][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 394.684858][ T8191] kmalloc_reserve+0xef/0x2c0 [ 394.689536][ T8191] __alloc_skb+0x166/0x380 [ 394.693962][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 394.699246][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 394.703658][ T8191] netif_close_many+0x2fc/0x630 [ 394.708515][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 394.714840][ T8191] ops_undo_list+0x8fc/0xab0 [ 394.719449][ T8191] cleanup_net+0x408/0x890 [ 394.723863][ T8191] process_one_work+0x9cf/0x1b70 [ 394.728812][ T8191] worker_thread+0x6c8/0xf10 [ 394.733402][ T8191] kthread+0x3c5/0x780 [ 394.737467][ T8191] [ 394.739775][ T8191] Memory state around the buggy address: [ 394.745391][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 394.753445][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 394.761501][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 394.769550][ T8191] ^ [ 394.774414][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 394.782472][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 394.790521][ T8191] ================================================================== [ 394.827516][ T8191] ================================================================== [ 394.835627][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 394.843284][ T8191] Read of size 2 at addr ffff888034360a20 by task syz.1.398/8191 [ 394.851011][ T8191] [ 394.853341][ T8191] CPU: 1 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 394.853396][ T8191] Tainted: [B]=BAD_PAGE [ 394.853409][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 394.853432][ T8191] Call Trace: [ 394.853444][ T8191] [ 394.853457][ T8191] dump_stack_lvl+0x116/0x1f0 [ 394.853518][ T8191] print_report+0xcd/0x630 [ 394.853551][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 394.853597][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 394.853642][ T8191] ? __phys_addr+0xe8/0x180 [ 394.853707][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 394.853747][ T8191] kasan_report+0xe0/0x110 [ 394.853781][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 394.853827][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 394.853873][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 394.853937][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 394.853993][ T8191] ? __pfx___up_read+0x10/0x10 [ 394.854034][ T8191] ? mntput+0x10/0x90 [ 394.854087][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 394.854133][ T8191] ? terminate_walk+0x31c/0x680 [ 394.854217][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 394.854267][ T8191] vfs_listxattr+0xba/0x140 [ 394.854325][ T8191] listxattr+0x102/0x1a0 [ 394.854381][ T8191] path_listxattrat+0x151/0x370 [ 394.854440][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 394.854500][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 394.854550][ T8191] do_syscall_64+0xcd/0x4c0 [ 394.854584][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.854621][ T8191] RIP: 0033:0x7f60f158ebe9 [ 394.854650][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 394.854687][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 394.854721][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 394.854747][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 394.854771][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 394.854795][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 394.854818][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 394.854855][ T8191] [ 394.854868][ T8191] [ 395.076606][ T8191] Allocated by task 8191: [ 395.080918][ T8191] kasan_save_stack+0x33/0x60 [ 395.085603][ T8191] kasan_save_track+0x14/0x30 [ 395.090284][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 395.094874][ T8191] __kmalloc_noprof+0x223/0x510 [ 395.099740][ T8191] hfsplus_find_init+0x95/0x1f0 [ 395.104583][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 395.109516][ T8191] vfs_listxattr+0xba/0x140 [ 395.114024][ T8191] listxattr+0x102/0x1a0 [ 395.118269][ T8191] path_listxattrat+0x151/0x370 [ 395.123124][ T8191] do_syscall_64+0xcd/0x4c0 [ 395.127613][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.133499][ T8191] [ 395.135815][ T8191] The buggy address belongs to the object at ffff888034360800 [ 395.135815][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 395.149871][ T8191] The buggy address is located 8 bytes to the right of [ 395.149871][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 395.164354][ T8191] [ 395.166657][ T8191] The buggy address belongs to the physical page: [ 395.173047][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 395.181795][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 395.190294][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 395.198279][ T8191] page_type: f5(slab) [ 395.202270][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 395.209893][ T5878] Bluetooth: hci1: command tx timeout [ 395.210860][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 395.224776][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 395.233454][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 395.242127][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 395.250801][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 395.259472][ T8191] page dumped because: kasan: bad access detected [ 395.265865][ T8191] page_owner tracks the page as allocated [ 395.271558][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 395.290660][ T8191] post_alloc_hook+0x1c0/0x230 [ 395.295432][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 395.300985][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 395.306885][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 395.311731][ T8191] new_slab+0x247/0x330 [ 395.315885][ T8191] ___slab_alloc+0xcf2/0x1750 [ 395.320563][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 395.325933][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 395.330789][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 395.336680][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 395.342744][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 395.348043][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 395.353161][ T8191] process_one_work+0x9cf/0x1b70 [ 395.358134][ T8191] worker_thread+0x6c8/0xf10 [ 395.362719][ T8191] kthread+0x3c5/0x780 [ 395.366793][ T8191] ret_from_fork+0x5d7/0x6f0 [ 395.371376][ T8191] page last free pid 13 tgid 13 stack trace: [ 395.377350][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 395.382549][ T8191] qlist_free_all+0x4d/0x120 [ 395.387144][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 395.392633][ T8191] __kasan_slab_alloc+0x69/0x90 [ 395.397494][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 395.403916][ T8191] kmalloc_reserve+0xef/0x2c0 [ 395.408584][ T8191] __alloc_skb+0x166/0x380 [ 395.413001][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 395.418291][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 395.422695][ T8191] netif_close_many+0x2fc/0x630 [ 395.427536][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 395.433851][ T8191] ops_undo_list+0x8fc/0xab0 [ 395.438447][ T8191] cleanup_net+0x408/0x890 [ 395.442853][ T8191] process_one_work+0x9cf/0x1b70 [ 395.447781][ T8191] worker_thread+0x6c8/0xf10 [ 395.452365][ T8191] kthread+0x3c5/0x780 [ 395.456422][ T8191] [ 395.458724][ T8191] Memory state around the buggy address: [ 395.464332][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 395.472379][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 395.480429][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 395.488472][ T8191] ^ [ 395.493564][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 395.501700][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 395.509741][ T8191] ================================================================== [ 395.641308][ T8191] ================================================================== [ 395.649411][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 395.657092][ T8191] Read of size 2 at addr ffff888034360a22 by task syz.1.398/8191 [ 395.664797][ T8191] [ 395.667111][ T8191] CPU: 0 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 395.667151][ T8191] Tainted: [B]=BAD_PAGE [ 395.667161][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 395.667177][ T8191] Call Trace: [ 395.667187][ T8191] [ 395.667197][ T8191] dump_stack_lvl+0x116/0x1f0 [ 395.667242][ T8191] print_report+0xcd/0x630 [ 395.667267][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 395.667301][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 395.667334][ T8191] ? __phys_addr+0xe8/0x180 [ 395.667372][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 395.667402][ T8191] kasan_report+0xe0/0x110 [ 395.667428][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 395.667462][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 395.667498][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 395.667537][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 395.667578][ T8191] ? __pfx___up_read+0x10/0x10 [ 395.667609][ T8191] ? mntput+0x10/0x90 [ 395.667648][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 395.667681][ T8191] ? terminate_walk+0x31c/0x680 [ 395.667742][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 395.667779][ T8191] vfs_listxattr+0xba/0x140 [ 395.667821][ T8191] listxattr+0x102/0x1a0 [ 395.667862][ T8191] path_listxattrat+0x151/0x370 [ 395.667910][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 395.667954][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 395.667991][ T8191] do_syscall_64+0xcd/0x4c0 [ 395.668017][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.668045][ T8191] RIP: 0033:0x7f60f158ebe9 [ 395.668066][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 395.668093][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 395.668119][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 395.668138][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 395.668155][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 395.668173][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 395.668190][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 395.668216][ T8191] [ 395.668225][ T8191] [ 395.889885][ T8191] Allocated by task 8191: [ 395.894233][ T8191] kasan_save_stack+0x33/0x60 [ 395.898935][ T8191] kasan_save_track+0x14/0x30 [ 395.903630][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 395.908238][ T8191] __kmalloc_noprof+0x223/0x510 [ 395.913103][ T8191] hfsplus_find_init+0x95/0x1f0 [ 395.917955][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 395.922906][ T8191] vfs_listxattr+0xba/0x140 [ 395.927423][ T8191] listxattr+0x102/0x1a0 [ 395.931683][ T8191] path_listxattrat+0x151/0x370 [ 395.936551][ T8191] do_syscall_64+0xcd/0x4c0 [ 395.941050][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.946940][ T8191] [ 395.949251][ T8191] The buggy address belongs to the object at ffff888034360800 [ 395.949251][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 395.963297][ T8191] The buggy address is located 10 bytes to the right of [ 395.963297][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 395.977874][ T8191] [ 395.980187][ T8191] The buggy address belongs to the physical page: [ 395.986582][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 395.995337][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 396.003831][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 396.011837][ T8191] page_type: f5(slab) [ 396.015818][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 396.024402][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 396.032989][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 396.041656][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 396.050324][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 396.058993][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 396.067652][ T8191] page dumped because: kasan: bad access detected [ 396.074051][ T8191] page_owner tracks the page as allocated [ 396.079750][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 396.098864][ T8191] post_alloc_hook+0x1c0/0x230 [ 396.103648][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 396.109224][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 396.115138][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 396.119993][ T8191] new_slab+0x247/0x330 [ 396.124329][ T8191] ___slab_alloc+0xcf2/0x1750 [ 396.129014][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 396.134395][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 396.139260][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 396.145513][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 396.151589][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 396.156889][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 396.162025][ T8191] process_one_work+0x9cf/0x1b70 [ 396.166965][ T8191] worker_thread+0x6c8/0xf10 [ 396.171556][ T8191] kthread+0x3c5/0x780 [ 396.175624][ T8191] ret_from_fork+0x5d7/0x6f0 [ 396.180210][ T8191] page last free pid 13 tgid 13 stack trace: [ 396.186174][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 396.191382][ T8191] qlist_free_all+0x4d/0x120 [ 396.195990][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 396.201465][ T8191] __kasan_slab_alloc+0x69/0x90 [ 396.206340][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 396.212780][ T8191] kmalloc_reserve+0xef/0x2c0 [ 396.217460][ T8191] __alloc_skb+0x166/0x380 [ 396.221893][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 396.227326][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 396.231748][ T8191] netif_close_many+0x2fc/0x630 [ 396.236603][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 396.242930][ T8191] ops_undo_list+0x8fc/0xab0 [ 396.247538][ T8191] cleanup_net+0x408/0x890 [ 396.251953][ T8191] process_one_work+0x9cf/0x1b70 [ 396.256896][ T8191] worker_thread+0x6c8/0xf10 [ 396.261488][ T8191] kthread+0x3c5/0x780 [ 396.265554][ T8191] [ 396.267862][ T8191] Memory state around the buggy address: [ 396.273479][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 396.281534][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 396.289589][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 396.297637][ T8191] ^ [ 396.302742][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 396.310834][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 396.318895][ T8191] ================================================================== [ 396.483854][ T8191] ================================================================== [ 396.491959][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 396.499615][ T8191] Read of size 2 at addr ffff888034360a24 by task syz.1.398/8191 [ 396.507368][ T8191] [ 396.509697][ T8191] CPU: 0 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 396.509751][ T8191] Tainted: [B]=BAD_PAGE [ 396.509764][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 396.509786][ T8191] Call Trace: [ 396.509797][ T8191] [ 396.509809][ T8191] dump_stack_lvl+0x116/0x1f0 [ 396.509868][ T8191] print_report+0xcd/0x630 [ 396.509901][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 396.509945][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 396.509990][ T8191] ? __phys_addr+0xe8/0x180 [ 396.510040][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 396.510081][ T8191] kasan_report+0xe0/0x110 [ 396.510116][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 396.510161][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 396.510208][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 396.510261][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 396.510314][ T8191] ? __pfx___up_read+0x10/0x10 [ 396.510354][ T8191] ? mntput+0x10/0x90 [ 396.510406][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 396.510449][ T8191] ? terminate_walk+0x31c/0x680 [ 396.510531][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 396.510580][ T8191] vfs_listxattr+0xba/0x140 [ 396.510636][ T8191] listxattr+0x102/0x1a0 [ 396.510695][ T8191] path_listxattrat+0x151/0x370 [ 396.510752][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 396.510811][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 396.510860][ T8191] do_syscall_64+0xcd/0x4c0 [ 396.510893][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.510930][ T8191] RIP: 0033:0x7f60f158ebe9 [ 396.510957][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 396.510993][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 396.511027][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 396.511052][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 396.511076][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 396.511099][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 396.511123][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 396.511158][ T8191] [ 396.511170][ T8191] [ 396.732908][ T8191] Allocated by task 8191: [ 396.737245][ T8191] kasan_save_stack+0x33/0x60 [ 396.741947][ T8191] kasan_save_track+0x14/0x30 [ 396.746639][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 396.751243][ T8191] __kmalloc_noprof+0x223/0x510 [ 396.756112][ T8191] hfsplus_find_init+0x95/0x1f0 [ 396.760966][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 396.765913][ T8191] vfs_listxattr+0xba/0x140 [ 396.770432][ T8191] listxattr+0x102/0x1a0 [ 396.774689][ T8191] path_listxattrat+0x151/0x370 [ 396.779561][ T8191] do_syscall_64+0xcd/0x4c0 [ 396.784060][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.789951][ T8191] [ 396.792260][ T8191] The buggy address belongs to the object at ffff888034360800 [ 396.792260][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 396.806312][ T8191] The buggy address is located 12 bytes to the right of [ 396.806312][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 396.820892][ T8191] [ 396.823207][ T8191] The buggy address belongs to the physical page: [ 396.829606][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 396.838360][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 396.846854][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 396.854828][ T8191] page_type: f5(slab) [ 396.858807][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 396.867479][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 396.876064][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 396.884734][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 396.893406][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 396.902075][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 396.910732][ T8191] page dumped because: kasan: bad access detected [ 396.917130][ T8191] page_owner tracks the page as allocated [ 396.922830][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 396.941953][ T8191] post_alloc_hook+0x1c0/0x230 [ 396.946735][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 396.952295][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 396.958209][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 396.963058][ T8191] new_slab+0x247/0x330 [ 396.967254][ T8191] ___slab_alloc+0xcf2/0x1750 [ 396.971939][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 396.977325][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 396.982189][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 396.988095][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 396.994171][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 396.999463][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 397.004590][ T8191] process_one_work+0x9cf/0x1b70 [ 397.009532][ T8191] worker_thread+0x6c8/0xf10 [ 397.014122][ T8191] kthread+0x3c5/0x780 [ 397.018188][ T8191] ret_from_fork+0x5d7/0x6f0 [ 397.022775][ T8191] page last free pid 13 tgid 13 stack trace: [ 397.028741][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 397.033955][ T8191] qlist_free_all+0x4d/0x120 [ 397.038558][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 397.044033][ T8191] __kasan_slab_alloc+0x69/0x90 [ 397.048902][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 397.055336][ T8191] kmalloc_reserve+0xef/0x2c0 [ 397.060014][ T8191] __alloc_skb+0x166/0x380 [ 397.064439][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 397.069723][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 397.074136][ T8191] netif_close_many+0x2fc/0x630 [ 397.078988][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 397.085312][ T8191] ops_undo_list+0x8fc/0xab0 [ 397.089921][ T8191] cleanup_net+0x408/0x890 [ 397.094333][ T8191] process_one_work+0x9cf/0x1b70 [ 397.099275][ T8191] worker_thread+0x6c8/0xf10 [ 397.103957][ T8191] kthread+0x3c5/0x780 [ 397.108027][ T8191] [ 397.110335][ T8191] Memory state around the buggy address: [ 397.115951][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 397.124006][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 397.132152][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 397.140203][ T8191] ^ [ 397.145299][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 397.153354][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 397.161403][ T8191] ================================================================== [ 397.172487][ T8191] ================================================================== [ 397.180558][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 397.188198][ T8191] Read of size 2 at addr ffff888034360a26 by task syz.1.398/8191 [ 397.195912][ T8191] [ 397.198253][ T8191] CPU: 1 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 397.198293][ T8191] Tainted: [B]=BAD_PAGE [ 397.198303][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 397.198320][ T8191] Call Trace: [ 397.198331][ T8191] [ 397.198342][ T8191] dump_stack_lvl+0x116/0x1f0 [ 397.198388][ T8191] print_report+0xcd/0x630 [ 397.198413][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 397.198447][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 397.198480][ T8191] ? __phys_addr+0xe8/0x180 [ 397.198519][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 397.198549][ T8191] kasan_report+0xe0/0x110 [ 397.198575][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 397.198609][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 397.198645][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 397.198692][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 397.198732][ T8191] ? __pfx___up_read+0x10/0x10 [ 397.198762][ T8191] ? mntput+0x10/0x90 [ 397.198802][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 397.198835][ T8191] ? terminate_walk+0x31c/0x680 [ 397.198897][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 397.198934][ T8191] vfs_listxattr+0xba/0x140 [ 397.198976][ T8191] listxattr+0x102/0x1a0 [ 397.199017][ T8191] path_listxattrat+0x151/0x370 [ 397.199060][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 397.199104][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 397.199141][ T8191] do_syscall_64+0xcd/0x4c0 [ 397.199168][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.199196][ T8191] RIP: 0033:0x7f60f158ebe9 [ 397.199217][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 397.199244][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 397.199271][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 397.199289][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 397.199307][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 397.199325][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 397.199342][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 397.199368][ T8191] [ 397.199377][ T8191] [ 397.420972][ T8191] Allocated by task 8191: [ 397.425290][ T8191] kasan_save_stack+0x33/0x60 [ 397.429990][ T8191] kasan_save_track+0x14/0x30 [ 397.434684][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 397.439300][ T8191] __kmalloc_noprof+0x223/0x510 [ 397.444167][ T8191] hfsplus_find_init+0x95/0x1f0 [ 397.449026][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 397.453973][ T8191] vfs_listxattr+0xba/0x140 [ 397.458498][ T8191] listxattr+0x102/0x1a0 [ 397.462755][ T8191] path_listxattrat+0x151/0x370 [ 397.467624][ T8191] do_syscall_64+0xcd/0x4c0 [ 397.472125][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.478021][ T8191] [ 397.480357][ T8191] The buggy address belongs to the object at ffff888034360800 [ 397.480357][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 397.494492][ T8191] The buggy address is located 14 bytes to the right of [ 397.494492][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 397.509073][ T8191] [ 397.511384][ T8191] The buggy address belongs to the physical page: [ 397.517803][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 397.526557][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 397.535051][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 397.543026][ T8191] page_type: f5(slab) [ 397.547007][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 397.555589][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 397.564173][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 397.572869][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 397.581539][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 397.590206][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 397.598867][ T8191] page dumped because: kasan: bad access detected [ 397.605269][ T8191] page_owner tracks the page as allocated [ 397.610967][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 397.630080][ T8191] post_alloc_hook+0x1c0/0x230 [ 397.634862][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 397.640427][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 397.646343][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 397.651194][ T8191] new_slab+0x247/0x330 [ 397.655357][ T8191] ___slab_alloc+0xcf2/0x1750 [ 397.660044][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 397.665427][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 397.670293][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 397.676200][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 397.682275][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 397.687568][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 397.692699][ T8191] process_one_work+0x9cf/0x1b70 [ 397.697638][ T8191] worker_thread+0x6c8/0xf10 [ 397.702231][ T8191] kthread+0x3c5/0x780 [ 397.706296][ T8191] ret_from_fork+0x5d7/0x6f0 [ 397.710910][ T8191] page last free pid 13 tgid 13 stack trace: [ 397.716876][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 397.722085][ T8191] qlist_free_all+0x4d/0x120 [ 397.726689][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 397.732162][ T8191] __kasan_slab_alloc+0x69/0x90 [ 397.737031][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 397.743467][ T8191] kmalloc_reserve+0xef/0x2c0 [ 397.748146][ T8191] __alloc_skb+0x166/0x380 [ 397.752571][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 397.757859][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 397.762276][ T8191] netif_close_many+0x2fc/0x630 [ 397.767133][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 397.773460][ T8191] ops_undo_list+0x8fc/0xab0 [ 397.778077][ T8191] cleanup_net+0x408/0x890 [ 397.782491][ T8191] process_one_work+0x9cf/0x1b70 [ 397.787430][ T8191] worker_thread+0x6c8/0xf10 [ 397.792021][ T8191] kthread+0x3c5/0x780 [ 397.796090][ T8191] [ 397.798396][ T8191] Memory state around the buggy address: [ 397.804014][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 397.812072][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 397.820216][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 397.828278][ T8191] ^ [ 397.833392][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 397.841449][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 397.849501][ T8191] ================================================================== [ 397.872967][ T8191] ================================================================== [ 397.881063][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 397.888718][ T8191] Read of size 2 at addr ffff888034360a28 by task syz.1.398/8191 [ 397.896440][ T8191] [ 397.898770][ T8191] CPU: 0 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 397.898823][ T8191] Tainted: [B]=BAD_PAGE [ 397.898837][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 397.898858][ T8191] Call Trace: [ 397.898869][ T8191] [ 397.898882][ T8191] dump_stack_lvl+0x116/0x1f0 [ 397.898941][ T8191] print_report+0xcd/0x630 [ 397.898973][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 397.899017][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 397.899061][ T8191] ? __phys_addr+0xe8/0x180 [ 397.899112][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 397.899151][ T8191] kasan_report+0xe0/0x110 [ 397.899185][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 397.899230][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 397.899277][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 397.899329][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 397.899382][ T8191] ? __pfx___up_read+0x10/0x10 [ 397.899422][ T8191] ? mntput+0x10/0x90 [ 397.899473][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 397.899516][ T8191] ? terminate_walk+0x31c/0x680 [ 397.899598][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 397.899647][ T8191] vfs_listxattr+0xba/0x140 [ 397.899708][ T8191] listxattr+0x102/0x1a0 [ 397.899762][ T8191] path_listxattrat+0x151/0x370 [ 397.899820][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 397.899878][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 397.899926][ T8191] do_syscall_64+0xcd/0x4c0 [ 397.899960][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.899996][ T8191] RIP: 0033:0x7f60f158ebe9 [ 397.900024][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 397.900061][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 397.900096][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 397.900121][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 397.900145][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 397.900168][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 397.900190][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 397.900225][ T8191] [ 397.900238][ T8191] [ 397.932199][ T5878] Bluetooth: hci1: command tx timeout [ 397.935939][ T8191] Allocated by task 8191: [ 398.131586][ T8191] kasan_save_stack+0x33/0x60 [ 398.136292][ T8191] kasan_save_track+0x14/0x30 [ 398.141049][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 398.145675][ T8191] __kmalloc_noprof+0x223/0x510 [ 398.150544][ T8191] hfsplus_find_init+0x95/0x1f0 [ 398.155401][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 398.160357][ T8191] vfs_listxattr+0xba/0x140 [ 398.164880][ T8191] listxattr+0x102/0x1a0 [ 398.169139][ T8191] path_listxattrat+0x151/0x370 [ 398.174439][ T8191] do_syscall_64+0xcd/0x4c0 [ 398.178940][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.184835][ T8191] [ 398.187149][ T8191] The buggy address belongs to the object at ffff888034360800 [ 398.187149][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 398.201197][ T8191] The buggy address is located 16 bytes to the right of [ 398.201197][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 398.216065][ T8191] [ 398.218382][ T8191] The buggy address belongs to the physical page: [ 398.224779][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 398.233535][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 398.242028][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 398.250002][ T8191] page_type: f5(slab) [ 398.253981][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 398.262572][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 398.271154][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 398.279823][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 398.288494][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 398.297164][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 398.305821][ T8191] page dumped because: kasan: bad access detected [ 398.312218][ T8191] page_owner tracks the page as allocated [ 398.317915][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 398.337030][ T8191] post_alloc_hook+0x1c0/0x230 [ 398.341815][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 398.347463][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 398.353372][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 398.358219][ T8191] new_slab+0x247/0x330 [ 398.362384][ T8191] ___slab_alloc+0xcf2/0x1750 [ 398.367071][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 398.372462][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 398.377331][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 398.383232][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 398.389304][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 398.394596][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 398.399760][ T8191] process_one_work+0x9cf/0x1b70 [ 398.404707][ T8191] worker_thread+0x6c8/0xf10 [ 398.409298][ T8191] kthread+0x3c5/0x780 [ 398.413361][ T8191] ret_from_fork+0x5d7/0x6f0 [ 398.417964][ T8191] page last free pid 13 tgid 13 stack trace: [ 398.423928][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 398.429137][ T8191] qlist_free_all+0x4d/0x120 [ 398.433741][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 398.439216][ T8191] __kasan_slab_alloc+0x69/0x90 [ 398.444087][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 398.450522][ T8191] kmalloc_reserve+0xef/0x2c0 [ 398.455196][ T8191] __alloc_skb+0x166/0x380 [ 398.459624][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 398.464917][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 398.469331][ T8191] netif_close_many+0x2fc/0x630 [ 398.474179][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 398.480501][ T8191] ops_undo_list+0x8fc/0xab0 [ 398.485106][ T8191] cleanup_net+0x408/0x890 [ 398.489516][ T8191] process_one_work+0x9cf/0x1b70 [ 398.494453][ T8191] worker_thread+0x6c8/0xf10 [ 398.499041][ T8191] kthread+0x3c5/0x780 [ 398.503105][ T8191] [ 398.505408][ T8191] Memory state around the buggy address: [ 398.511022][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 398.519076][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 398.527129][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 398.535186][ T8191] ^ [ 398.540540][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 398.548591][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 398.556641][ T8191] ================================================================== [ 398.804462][ T8191] ================================================================== [ 398.812559][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 398.820211][ T8191] Read of size 2 at addr ffff888034360a2a by task syz.1.398/8191 [ 398.827933][ T8191] [ 398.830258][ T8191] CPU: 0 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 398.830311][ T8191] Tainted: [B]=BAD_PAGE [ 398.830324][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 398.830347][ T8191] Call Trace: [ 398.830357][ T8191] [ 398.830370][ T8191] dump_stack_lvl+0x116/0x1f0 [ 398.830429][ T8191] print_report+0xcd/0x630 [ 398.830462][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 398.830507][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 398.830550][ T8191] ? __phys_addr+0xe8/0x180 [ 398.830601][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 398.830642][ T8191] kasan_report+0xe0/0x110 [ 398.830681][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 398.830726][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 398.830774][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 398.830827][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 398.830880][ T8191] ? __pfx___up_read+0x10/0x10 [ 398.830921][ T8191] ? mntput+0x10/0x90 [ 398.830973][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 398.831017][ T8191] ? terminate_walk+0x31c/0x680 [ 398.831099][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 398.831148][ T8191] vfs_listxattr+0xba/0x140 [ 398.831204][ T8191] listxattr+0x102/0x1a0 [ 398.831259][ T8191] path_listxattrat+0x151/0x370 [ 398.831317][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 398.831375][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 398.831425][ T8191] do_syscall_64+0xcd/0x4c0 [ 398.831459][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.831496][ T8191] RIP: 0033:0x7f60f158ebe9 [ 398.831523][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 398.831560][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 398.831594][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 398.831619][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 398.831643][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 398.831666][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 398.831695][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 398.831730][ T8191] [ 398.831742][ T8191] [ 399.053285][ T8191] Allocated by task 8191: [ 399.057596][ T8191] kasan_save_stack+0x33/0x60 [ 399.062297][ T8191] kasan_save_track+0x14/0x30 [ 399.066991][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 399.071592][ T8191] __kmalloc_noprof+0x223/0x510 [ 399.076457][ T8191] hfsplus_find_init+0x95/0x1f0 [ 399.081310][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 399.086262][ T8191] vfs_listxattr+0xba/0x140 [ 399.090779][ T8191] listxattr+0x102/0x1a0 [ 399.095205][ T8191] path_listxattrat+0x151/0x370 [ 399.100078][ T8191] do_syscall_64+0xcd/0x4c0 [ 399.104579][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 399.110470][ T8191] [ 399.112793][ T8191] The buggy address belongs to the object at ffff888034360800 [ 399.112793][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 399.126839][ T8191] The buggy address is located 18 bytes to the right of [ 399.126839][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 399.141429][ T8191] [ 399.143738][ T8191] The buggy address belongs to the physical page: [ 399.150132][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 399.158883][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 399.167652][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 399.175645][ T8191] page_type: f5(slab) [ 399.179639][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 399.188229][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 399.196815][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 399.205483][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 399.214152][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 399.222823][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 399.231481][ T8191] page dumped because: kasan: bad access detected [ 399.237881][ T8191] page_owner tracks the page as allocated [ 399.243578][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 399.262692][ T8191] post_alloc_hook+0x1c0/0x230 [ 399.267473][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 399.273032][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 399.278942][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 399.283790][ T8191] new_slab+0x247/0x330 [ 399.287951][ T8191] ___slab_alloc+0xcf2/0x1750 [ 399.292632][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 399.298017][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 399.302879][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 399.308782][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 399.314853][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 399.320145][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 399.325272][ T8191] process_one_work+0x9cf/0x1b70 [ 399.330213][ T8191] worker_thread+0x6c8/0xf10 [ 399.334804][ T8191] kthread+0x3c5/0x780 [ 399.338869][ T8191] ret_from_fork+0x5d7/0x6f0 [ 399.343457][ T8191] page last free pid 13 tgid 13 stack trace: [ 399.349422][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 399.354631][ T8191] qlist_free_all+0x4d/0x120 [ 399.359239][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 399.364710][ T8191] __kasan_slab_alloc+0x69/0x90 [ 399.369576][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 399.376013][ T8191] kmalloc_reserve+0xef/0x2c0 [ 399.380688][ T8191] __alloc_skb+0x166/0x380 [ 399.385116][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 399.390401][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 399.394814][ T8191] netif_close_many+0x2fc/0x630 [ 399.399667][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 399.405989][ T8191] ops_undo_list+0x8fc/0xab0 [ 399.410598][ T8191] cleanup_net+0x408/0x890 [ 399.415012][ T8191] process_one_work+0x9cf/0x1b70 [ 399.419955][ T8191] worker_thread+0x6c8/0xf10 [ 399.424577][ T8191] kthread+0x3c5/0x780 [ 399.428643][ T8191] [ 399.430956][ T8191] Memory state around the buggy address: [ 399.436572][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 399.444625][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 399.452682][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 399.460729][ T8191] ^ [ 399.466086][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 399.474140][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 399.482186][ T8191] ================================================================== [ 399.529258][ T8191] ================================================================== [ 399.537346][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 399.545000][ T8191] Read of size 2 at addr ffff888034360a2c by task syz.1.398/8191 [ 399.552722][ T8191] [ 399.555044][ T8191] CPU: 1 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 399.555093][ T8191] Tainted: [B]=BAD_PAGE [ 399.555105][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 399.555125][ T8191] Call Trace: [ 399.555136][ T8191] [ 399.555147][ T8191] dump_stack_lvl+0x116/0x1f0 [ 399.555201][ T8191] print_report+0xcd/0x630 [ 399.555231][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 399.555272][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 399.555312][ T8191] ? __phys_addr+0xe8/0x180 [ 399.555358][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 399.555394][ T8191] kasan_report+0xe0/0x110 [ 399.555425][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 399.555467][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 399.555510][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 399.555558][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 399.555607][ T8191] ? __pfx___up_read+0x10/0x10 [ 399.555644][ T8191] ? mntput+0x10/0x90 [ 399.555692][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 399.555731][ T8191] ? terminate_walk+0x31c/0x680 [ 399.555806][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 399.555851][ T8191] vfs_listxattr+0xba/0x140 [ 399.555902][ T8191] listxattr+0x102/0x1a0 [ 399.555956][ T8191] path_listxattrat+0x151/0x370 [ 399.556008][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 399.556061][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 399.556105][ T8191] do_syscall_64+0xcd/0x4c0 [ 399.556136][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 399.556170][ T8191] RIP: 0033:0x7f60f158ebe9 [ 399.556195][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 399.556228][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 399.556259][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 399.556281][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 399.556303][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 399.556324][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 399.556344][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 399.556376][ T8191] [ 399.556387][ T8191] [ 399.778729][ T8191] Allocated by task 8191: [ 399.783052][ T8191] kasan_save_stack+0x33/0x60 [ 399.787757][ T8191] kasan_save_track+0x14/0x30 [ 399.792454][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 399.797062][ T8191] __kmalloc_noprof+0x223/0x510 [ 399.801931][ T8191] hfsplus_find_init+0x95/0x1f0 [ 399.806790][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 399.811741][ T8191] vfs_listxattr+0xba/0x140 [ 399.816262][ T8191] listxattr+0x102/0x1a0 [ 399.820517][ T8191] path_listxattrat+0x151/0x370 [ 399.825420][ T8191] do_syscall_64+0xcd/0x4c0 [ 399.829919][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 399.835812][ T8191] [ 399.838122][ T8191] The buggy address belongs to the object at ffff888034360800 [ 399.838122][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 399.852171][ T8191] The buggy address is located 20 bytes to the right of [ 399.852171][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 399.866748][ T8191] [ 399.869059][ T8191] The buggy address belongs to the physical page: [ 399.875453][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 399.884213][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 399.892708][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 399.900680][ T8191] page_type: f5(slab) [ 399.904668][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 399.913254][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 399.921834][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 399.930501][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 399.939431][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 399.948101][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 399.956756][ T8191] page dumped because: kasan: bad access detected [ 399.963150][ T8191] page_owner tracks the page as allocated [ 399.968846][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 399.987958][ T8191] post_alloc_hook+0x1c0/0x230 [ 399.992738][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 399.998300][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 400.004214][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 400.009067][ T8191] new_slab+0x247/0x330 [ 400.013226][ T8191] ___slab_alloc+0xcf2/0x1750 [ 400.017919][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 400.023300][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 400.028180][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 400.034083][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 400.040153][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 400.045441][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 400.050577][ T8191] process_one_work+0x9cf/0x1b70 [ 400.055514][ T8191] worker_thread+0x6c8/0xf10 [ 400.060106][ T8191] kthread+0x3c5/0x780 [ 400.064170][ T8191] ret_from_fork+0x5d7/0x6f0 [ 400.068757][ T8191] page last free pid 13 tgid 13 stack trace: [ 400.074723][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 400.079929][ T8191] qlist_free_all+0x4d/0x120 [ 400.084529][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 400.090002][ T8191] __kasan_slab_alloc+0x69/0x90 [ 400.094871][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 400.101307][ T8191] kmalloc_reserve+0xef/0x2c0 [ 400.105991][ T8191] __alloc_skb+0x166/0x380 [ 400.110417][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 400.115707][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 400.120205][ T8191] netif_close_many+0x2fc/0x630 [ 400.125078][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 400.131402][ T8191] ops_undo_list+0x8fc/0xab0 [ 400.136012][ T8191] cleanup_net+0x408/0x890 [ 400.140425][ T8191] process_one_work+0x9cf/0x1b70 [ 400.145362][ T8191] worker_thread+0x6c8/0xf10 [ 400.149950][ T8191] kthread+0x3c5/0x780 [ 400.154013][ T8191] [ 400.156320][ T8191] Memory state around the buggy address: [ 400.161956][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 400.170010][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 400.178063][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 400.186112][ T8191] ^ [ 400.191473][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 400.199537][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 400.207685][ T8191] ================================================================== [ 400.279351][ T5878] Bluetooth: hci1: command tx timeout [ 400.286660][ T8191] ================================================================== [ 400.294707][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 400.302339][ T8191] Read of size 2 at addr ffff888034360a2e by task syz.1.398/8191 [ 400.310060][ T8191] [ 400.312389][ T8191] CPU: 0 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 400.312445][ T8191] Tainted: [B]=BAD_PAGE [ 400.312458][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 400.312481][ T8191] Call Trace: [ 400.312492][ T8191] [ 400.312505][ T8191] dump_stack_lvl+0x116/0x1f0 [ 400.312565][ T8191] print_report+0xcd/0x630 [ 400.312597][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 400.312643][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 400.312687][ T8191] ? __phys_addr+0xe8/0x180 [ 400.312739][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 400.312779][ T8191] kasan_report+0xe0/0x110 [ 400.312814][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 400.312860][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 400.312913][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 400.312967][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 400.313021][ T8191] ? __pfx___up_read+0x10/0x10 [ 400.313063][ T8191] ? mntput+0x10/0x90 [ 400.313115][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 400.313161][ T8191] ? terminate_walk+0x31c/0x680 [ 400.313246][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 400.313296][ T8191] vfs_listxattr+0xba/0x140 [ 400.313353][ T8191] listxattr+0x102/0x1a0 [ 400.313408][ T8191] path_listxattrat+0x151/0x370 [ 400.313466][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 400.313526][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 400.313578][ T8191] do_syscall_64+0xcd/0x4c0 [ 400.313612][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.313668][ T8191] RIP: 0033:0x7f60f158ebe9 [ 400.313696][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 400.313733][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 400.313768][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 400.313793][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 400.313816][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 400.313841][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 400.313864][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 400.313906][ T8191] [ 400.313918][ T8191] [ 400.535423][ T8191] Allocated by task 8191: [ 400.539739][ T8191] kasan_save_stack+0x33/0x60 [ 400.544439][ T8191] kasan_save_track+0x14/0x30 [ 400.549134][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 400.553739][ T8191] __kmalloc_noprof+0x223/0x510 [ 400.558606][ T8191] hfsplus_find_init+0x95/0x1f0 [ 400.563459][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 400.568406][ T8191] vfs_listxattr+0xba/0x140 [ 400.573101][ T8191] listxattr+0x102/0x1a0 [ 400.577384][ T8191] path_listxattrat+0x151/0x370 [ 400.582252][ T8191] do_syscall_64+0xcd/0x4c0 [ 400.586752][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 400.592643][ T8191] [ 400.594958][ T8191] The buggy address belongs to the object at ffff888034360800 [ 400.594958][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 400.609007][ T8191] The buggy address is located 22 bytes to the right of [ 400.609007][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 400.623590][ T8191] [ 400.625988][ T8191] The buggy address belongs to the physical page: [ 400.632384][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 400.641225][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 400.649723][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 400.657699][ T8191] page_type: f5(slab) [ 400.661678][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 400.670262][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 400.678844][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 400.687512][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 400.696184][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 400.704855][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 400.713523][ T8191] page dumped because: kasan: bad access detected [ 400.719928][ T8191] page_owner tracks the page as allocated [ 400.725627][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 400.744742][ T8191] post_alloc_hook+0x1c0/0x230 [ 400.749546][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 400.755108][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 400.761030][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 400.765880][ T8191] new_slab+0x247/0x330 [ 400.770484][ T8191] ___slab_alloc+0xcf2/0x1750 [ 400.775168][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 400.780549][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 400.785420][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 400.791329][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 400.797427][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 400.802720][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 400.807858][ T8191] process_one_work+0x9cf/0x1b70 [ 400.812812][ T8191] worker_thread+0x6c8/0xf10 [ 400.817405][ T8191] kthread+0x3c5/0x780 [ 400.821478][ T8191] ret_from_fork+0x5d7/0x6f0 [ 400.826079][ T8191] page last free pid 13 tgid 13 stack trace: [ 400.832047][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 400.837256][ T8191] qlist_free_all+0x4d/0x120 [ 400.841858][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 400.847335][ T8191] __kasan_slab_alloc+0x69/0x90 [ 400.852206][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 400.858640][ T8191] kmalloc_reserve+0xef/0x2c0 [ 400.863318][ T8191] __alloc_skb+0x166/0x380 [ 400.867746][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 400.873033][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 400.877451][ T8191] netif_close_many+0x2fc/0x630 [ 400.882304][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 400.888630][ T8191] ops_undo_list+0x8fc/0xab0 [ 400.893241][ T8191] cleanup_net+0x408/0x890 [ 400.897656][ T8191] process_one_work+0x9cf/0x1b70 [ 400.902594][ T8191] worker_thread+0x6c8/0xf10 [ 400.907186][ T8191] kthread+0x3c5/0x780 [ 400.911264][ T8191] [ 400.913572][ T8191] Memory state around the buggy address: [ 400.919188][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 400.927244][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 400.935300][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 400.943374][ T8191] ^ [ 400.948733][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 400.956786][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 400.964832][ T8191] ================================================================== [ 400.998745][ T8191] ================================================================== [ 401.006828][ T8191] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa09/0xb30 [ 401.014482][ T8191] Read of size 2 at addr ffff888034360a30 by task syz.1.398/8191 [ 401.022206][ T8191] [ 401.024537][ T8191] CPU: 1 UID: 0 PID: 8191 Comm: syz.1.398 Tainted: G B syzkaller #0 PREEMPT(full) [ 401.024591][ T8191] Tainted: [B]=BAD_PAGE [ 401.024604][ T8191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 401.024627][ T8191] Call Trace: [ 401.024638][ T8191] [ 401.024651][ T8191] dump_stack_lvl+0x116/0x1f0 [ 401.024719][ T8191] print_report+0xcd/0x630 [ 401.024752][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 401.024798][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 401.024842][ T8191] ? __phys_addr+0xe8/0x180 [ 401.024893][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 401.024935][ T8191] kasan_report+0xe0/0x110 [ 401.024968][ T8191] ? hfsplus_uni2asc+0xa09/0xb30 [ 401.025015][ T8191] hfsplus_uni2asc+0xa09/0xb30 [ 401.025063][ T8191] hfsplus_listxattr+0x6f6/0xe30 [ 401.025116][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 401.025170][ T8191] ? __pfx___up_read+0x10/0x10 [ 401.025210][ T8191] ? mntput+0x10/0x90 [ 401.025262][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 401.025306][ T8191] ? terminate_walk+0x31c/0x680 [ 401.025388][ T8191] ? __pfx_hfsplus_listxattr+0x10/0x10 [ 401.025437][ T8191] vfs_listxattr+0xba/0x140 [ 401.025493][ T8191] listxattr+0x102/0x1a0 [ 401.025548][ T8191] path_listxattrat+0x151/0x370 [ 401.025606][ T8191] ? __pfx_path_listxattrat+0x10/0x10 [ 401.025672][ T8191] ? srso_alias_return_thunk+0x5/0xfbef5 [ 401.025722][ T8191] do_syscall_64+0xcd/0x4c0 [ 401.025757][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.025794][ T8191] RIP: 0033:0x7f60f158ebe9 [ 401.025822][ T8191] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 401.025859][ T8191] RSP: 002b:00007f60f2378038 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3 [ 401.025894][ T8191] RAX: ffffffffffffffda RBX: 00007f60f17c5fa0 RCX: 00007f60f158ebe9 [ 401.025919][ T8191] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 401.025943][ T8191] RBP: 00007f60f1611e19 R08: 0000000000000000 R09: 0000000000000000 [ 401.025967][ T8191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 401.025990][ T8191] R13: 00007f60f17c6038 R14: 00007f60f17c5fa0 R15: 00007ffd2ff99e88 [ 401.026026][ T8191] [ 401.026039][ T8191] [ 401.247705][ T8191] Allocated by task 8191: [ 401.252021][ T8191] kasan_save_stack+0x33/0x60 [ 401.256721][ T8191] kasan_save_track+0x14/0x30 [ 401.261413][ T8191] __kasan_kmalloc+0xaa/0xb0 [ 401.266018][ T8191] __kmalloc_noprof+0x223/0x510 [ 401.270882][ T8191] hfsplus_find_init+0x95/0x1f0 [ 401.275735][ T8191] hfsplus_listxattr+0x46b/0xe30 [ 401.280690][ T8191] vfs_listxattr+0xba/0x140 [ 401.285209][ T8191] listxattr+0x102/0x1a0 [ 401.289478][ T8191] path_listxattrat+0x151/0x370 [ 401.294345][ T8191] do_syscall_64+0xcd/0x4c0 [ 401.298846][ T8191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.304739][ T8191] [ 401.307049][ T8191] The buggy address belongs to the object at ffff888034360800 [ 401.307049][ T8191] which belongs to the cache kmalloc-1k of size 1024 [ 401.321095][ T8191] The buggy address is located 24 bytes to the right of [ 401.321095][ T8191] allocated 536-byte region [ffff888034360800, ffff888034360a18) [ 401.335673][ T8191] [ 401.337984][ T8191] The buggy address belongs to the physical page: [ 401.344378][ T8191] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34360 [ 401.353130][ T8191] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 401.361624][ T8191] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 401.369601][ T8191] page_type: f5(slab) [ 401.373577][ T8191] raw: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 401.382161][ T8191] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 401.390754][ T8191] head: 00fff00000000040 ffff88801b841dc0 0000000000000000 dead000000000001 [ 401.399430][ T8191] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 401.408107][ T8191] head: 00fff00000000003 ffffea0000d0d801 00000000ffffffff 00000000ffffffff [ 401.416782][ T8191] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 401.425440][ T8191] page dumped because: kasan: bad access detected [ 401.431839][ T8191] page_owner tracks the page as allocated [ 401.437538][ T8191] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 59, tgid 59 (kworker/u8:4), ts 140421042345, free_ts 138358071745 [ 401.456648][ T8191] post_alloc_hook+0x1c0/0x230 [ 401.461429][ T8191] get_page_from_freelist+0x132b/0x38e0 [ 401.466991][ T8191] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 401.472901][ T8191] alloc_pages_mpol+0x1fb/0x550 [ 401.477752][ T8191] new_slab+0x247/0x330 [ 401.481917][ T8191] ___slab_alloc+0xcf2/0x1750 [ 401.486601][ T8191] __slab_alloc.constprop.0+0x56/0xb0 [ 401.491981][ T8191] __kmalloc_noprof+0x2f2/0x510 [ 401.496848][ T8191] ieee802_11_parse_elems_full+0x1db/0x3780 [ 401.502756][ T8191] ieee80211_ibss_rx_queued_mgmt+0xc69/0x2fd0 [ 401.508834][ T8191] ieee80211_iface_work+0xe2e/0x1360 [ 401.514130][ T8191] cfg80211_wiphy_work+0x2c7/0x580 [ 401.519260][ T8191] process_one_work+0x9cf/0x1b70 [ 401.524197][ T8191] worker_thread+0x6c8/0xf10 [ 401.528786][ T8191] kthread+0x3c5/0x780 [ 401.532853][ T8191] ret_from_fork+0x5d7/0x6f0 [ 401.537448][ T8191] page last free pid 13 tgid 13 stack trace: [ 401.543414][ T8191] __free_frozen_pages+0x7d5/0x10f0 [ 401.548620][ T8191] qlist_free_all+0x4d/0x120 [ 401.553220][ T8191] kasan_quarantine_reduce+0x195/0x1e0 [ 401.558693][ T8191] __kasan_slab_alloc+0x69/0x90 [ 401.563559][ T8191] __kmalloc_node_track_caller_noprof+0x1d3/0x510 [ 401.569996][ T8191] kmalloc_reserve+0xef/0x2c0 [ 401.574673][ T8191] __alloc_skb+0x166/0x380 [ 401.579102][ T8191] rtmsg_ifinfo_build_skb+0x81/0x280 [ 401.584384][ T8191] rtmsg_ifinfo+0x9f/0x1a0 [ 401.588800][ T8191] netif_close_many+0x2fc/0x630 [ 401.593664][ T8191] unregister_netdevice_many_notify+0x563/0x24c0 [ 401.599990][ T8191] ops_undo_list+0x8fc/0xab0 [ 401.604596][ T8191] cleanup_net+0x408/0x890 [ 401.609006][ T8191] process_one_work+0x9cf/0x1b70 [ 401.613949][ T8191] worker_thread+0x6c8/0xf10 [ 401.618560][ T8191] kthread+0x3c5/0x780 [ 401.622626][ T8191] [ 401.624937][ T8191] Memory state around the buggy address: [ 401.630552][ T8191] ffff888034360900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 401.638605][ T8191] ffff888034360980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 401.646662][ T8191] >ffff888034360a00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 401.654713][ T8191] ^ [ 401.660329][ T8191] ffff888034360a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 401.668380][ T8191] ffff888034360b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 401.676428][ T8191] ==================================================================