last executing test programs: 6m16.230172972s ago: executing program 1 (id=29): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000bd000), 0x318, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x2, 0x89, 0x2, 0xb319, 0x3}, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x6000) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x2, @empty, 0x8ac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) r2 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000200)={{0x84, @empty, 0x4e21, 0x3, 'lc\x00', 0xc, 0x9, 0x63}, {@private=0xa010102, 0x4623, 0x4, 0x100000cd, 0x12d5f, 0x3}}, 0x44) sendmmsg$sock(r1, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=[@mark={{0x10, 0x1, 0x24, 0x3}}], 0x10}}], 0x1, 0x20000000) 6m14.798408276s ago: executing program 1 (id=36): r0 = syz_open_dev$admmidi(&(0x7f0000000080), 0x16, 0x109000) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000100)) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x2000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(0xffffffffffffffff, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, 0xfff}}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000180)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'wlc\x00', 0x11, 0x80006, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e22, 0x3, 'lc\x00', 0x4, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) getsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, 0x0, 0x0) socket(0x2, 0x4, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/wireless\x00') preadv(r4, &(0x7f00000026c0)=[{&(0x7f0000002700)=""/4088, 0xff8}], 0x1, 0xc, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x80000000, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) io_setup(0xc, &(0x7f0000000100)=0x0) r6 = timerfd_create(0x0, 0x0) io_submit(r5, 0x1, &(0x7f00000009c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, r6, 0x0}]) 6m13.682074002s ago: executing program 1 (id=41): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0x64, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast1}}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x64}}, 0x0) 6m13.578619585s ago: executing program 1 (id=43): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000340)='./file0\x00', 0x210000, &(0x7f0000000380)={[{@nodelalloc}, {@dioread_lock}, {@bsdgroups}, {@nombcache}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0xc}}, {@data_err_ignore}, {@noblock_validity}, {@stripe={'stripe', 0x3d, 0x2}}, {@errors_remount}, {@auto_da_alloc}]}, 0x1, 0x59b, &(0x7f0000000440)="$eJzs3V1rHNUbAPBnNpv09f9vCqWoFxLohZXaTZP4UkGwXooWC3pfl2QbSjbdkt2UJhZsLuyNCFIEEQviBxBvvSx+AT9FQQtFStALEVZmM5tuN7t5bzft/n4w7Tk7Mznz7JlncubMhg2gb42k/+QiXoyIr5OIIy3r8pGtHFnZbvnhjcl0SaJe//jPJJLsteb2Sfb/oazyQkT8+kXEqdzadqsLizPFcrk0l9VHa7NXR6sLi6cvzxanS9OlK+MTE2ffmBh/+603dxpivll49cLf33109/2zX55Y/van+0dvJ3EuDmfrGnEc2GlTcbO1MlL8NysNxrm2Dcd23NTekvT6ANiWgSxBBiO9BhyJgUfpAjznPo+IOtCnEvkPfaoxCMgPrN7bt97P94MH763cADViH2qNP78yNxL7G/dGB5eTx+6M0vvd4V1oP23jlz/u3E6XaJtPadM+O7Hz2Qqgr91ciogz+fza63+SXf/Wn9tbb7boTGPyeH0jbfV++/0DvXQ3Hf+8Fh3Gf7nV8U90GP8c6pC727Fx/ufu70IzXaXjv3eic/yZ4YGs9r/GmG8wuXS5XDoTEf+PiJNR3/DRx9nle/Vu61rHf+mStt8cC2bHcT+/7/F9poq1YkQMbTPkxzxYingp3yn+ZLX/kw79n74fFzbZxvHSnZe7rds4/ier/mPEKx37/1G3Jus/nxxtnA+jzbNirb9uHf+tW/u9jj/t/4Prxz+ctD6vrW69jR/2/1Pqtm675/9Q8kmj3EyC68VabW4sYij5cO3r44/2bdab26fxnzyx/vWv0/mf3nx9usn4bx27tbJphyvFXuj/qS31/9YL9z747Ptu7W+u/19vlE5mr2TXv86yc2WzB7jT9w8AAAAAAAD2klxEHI4kV1gt53KFwsrnO47FwVy5Uq2dulSZvzIVjb+VHY7BXPNJ95GWz0OMZZ+HbdbH2+oTEXE0Ir4ZONCoFyYr5aleBw8AAAAAAAAAAAAAAAAAAAB7xKEuf/+f+n2g10cHPHGNLzbYt7ltl57wsQBP14Zf+b8b3/QE7Ekb5j/w3JL/0L/kP/Qv+Q/9S/5D/5L/0L/kP/Qv+Q8AAAAAAAAAAAAAAAAAAAAAAAAAAAC76sL58+lSX354YzKtT11bmJ+pXDs9VarOFGbnJwuTlbmrhelKZbpcKkxWZjf6eeVK5erYeMxfH62VqrXR6sLixdnK/JXaxcuzxenSxdLgU4kKAAAAAAAAAAAAAAAAAAAAni3VhcWZYrlcmttSYX9sZ69ntfBu7InD2OXCz1+1BLhiWz8nv4PDyPf6TehF4UBEPNVGl7Lu3dpePbwoAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAECb/wIAAP//cHUvhA==") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000001100)='./file0\x00', 0x3000082, &(0x7f0000000d40)={[{@lazytime}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x6}}, {@errors_remount}, {@norecovery}, {@auto_da_alloc}, {@mblk_io_submit}, {@noquota}, {@barrier_val}, {@grpjquota}, {}]}, 0x44, 0x7b1, &(0x7f00000012c0)="$eJzs3c9rHNcdAPDvrFY/7VYqFFr3JCi0BuNV5ap2C4Wq9FAKNRjaUw+1xWotHK20RrsylhCJTQjkEkhCbsnF5/y8hFzz45BL8n8EGyeRTRxyCAqzP6SVtCvvOtKuHX8+MNZ7M2/2ve+82TfPmtFuAE+tyfSfTMSJiHg5iRivr08iYrCaykbM1so92NzIp0sSW1v/+Sqplrm/uZGPpn1Sx+qZX0fExy9EnMrsr7e8tr44VywWVur5qcrS1any2vrpK0tzC4WFwvLZ6ZmZM+f+dO7s4cX6zefrx++88s/fvzP73fO/evelT5KYjeP1bc1xHJbJmKwfk8H0EO7yj8OurG/ef7aDQk1nQPYoG0OX0o4ZqPfKiRiPgYP6Z7SXLQMAjspzEbHVzkDbLQDAEy2pXf//1u92AAC90vg9wP3NjXxj6e9vJHrr7t8jYqQWf+P+Zm1Ltn7PbqR6H3TsfrLrzkgSEROHUP9kRLzxwf/fSpc4ovuQAK3cuBkRlyYm94//yb5nFrr1h9arF5ozk3s2Gv+gdz5M5z9/bjX/y2zPf6LF/Ge4xXv3UTz8/Z+5fQjVtJXO//7a9Gzbg6b46yYG6rmfVed8g8nlK8VCOrb9PCJOxuBwmp8+oI6T976/125b8/zv61efeTOtP/25UyJzOzu8e5/5ucrcj4m52d2bEb/Jtoo/Hf+Hq/2ftJn/Xuiwjn/95cXX221L40/jbSz74z9aW7ciftey/5PtMsmBzydOVU+HqcZJ0cJ7szHWrv7J7E7/p0taf+P/Ar2Q9v/YwfFPJM3Pa5Y7funtp8U+uzX+UbtCzed/6/hbn/9DyX+r6aH6uutzlcrKdMRQ8u/968/s7NvIN8qn8Z/8bev3f2P8a3H+/y99/UsdHojsnS/ffvT4j1Ya/3xX/d91IkYeLA60q7+z/p/ZtU8n41+nDXzU4wYAAAAAAAAAAAAAAAAAAAAAAAAA3chExPFIMrntdCaTy9W+w/uXMZYplsqVU5dLq8vzUf2u7IkYzDQ+6nK86fNQp+ufh9/In9mT/2NE/CIiXhsereZz+VJxvt/BAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDdsTbf/5/6YnhP4YF+tBAAOBIjLuwA8LRJstl+NwEA6LWRrkqPHlk7AIDe6e76DwD8FLj+A8DT5yHX/71/BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADdunD+fLpsfbu5kU/z89fWVhdL107PF8qLuaXVfC5fWrmaWyiVFoqFXL601PaFbtR+FEulqzOxvHp9qlIoV6bKa+sXl0qry5WLV5bmFgoXC4M9iwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOldeW1+cKxYLKxJ9SSx+WuuHx6U9Et0l4kat/x6X9hxeIoZ2RonR/gxOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE+AHwIAAP//4VQjgA==") r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000e00)='./file0\x00', 0x9001) renameat2(r0, &(0x7f0000000480)='./file0\x00', r0, &(0x7f0000000040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x4) 6m13.061236422s ago: executing program 1 (id=45): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) gettid() r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0xf) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000047c0)={0x0, 0xfffffffffffffffc, &(0x7f0000000300)=[{&(0x7f0000000080)={0x18, 0x7a, 0x601, 0x4000000, 0x25dfdbfd, "", [@typed={0x7, 0x0, 0x0, 0x0, @u64=0x1}]}, 0x18}], 0x1, 0x0, 0x0, 0x40000}, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @local, 0x9}, 0x1c) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x44004) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000040)=0x56c, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$kcm(r0, &(0x7f0000000040)={&(0x7f0000000280)=@can={0x1d, r2}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000300)="62042700920101000001ad2f1eafbcf7", 0x10}], 0x1}, 0x0) syz_emit_ethernet(0x436, &(0x7f0000000d40)=ANY=[], &(0x7f00000000c0)={0x1, 0x2, [0xf3c, 0x822, 0x408, 0x32]}) syz_emit_ethernet(0x46, &(0x7f0000000e80)=ANY=[@ANYBLOB="8ad2c9a1a77cd4248559aaaaaaaaaaaaaabbbbbbbbbbbb49000038000000000006907864010100ac1e00018907dfdcd0000186060000000000000000000000fb20935681f63a693276a8bdc35d61e70bf8cb1d5c5cfbf50da2f880ade048dfb810deeb24c1e53e944565626104bdf6d4eec5a542a59b4afdcf", @ANYRES32=0x41424344, @ANYRES32], 0x0) openat$tun(0xffffff9c, &(0x7f00000005c0), 0x201, 0x0) 6m10.87818875s ago: executing program 1 (id=52): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$kcm(0xa, 0x3, 0x73) sendmsg$kcm(r0, &(0x7f0000000100)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xfd, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="18"], 0x18}, 0x0) close(0x4) 6m10.627066248s ago: executing program 32 (id=52): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$kcm(0xa, 0x3, 0x73) sendmsg$kcm(r0, &(0x7f0000000100)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xfd, @remote}, 0x80, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="18"], 0x18}, 0x0) close(0x4) 2m48.278626681s ago: executing program 2 (id=673): r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r4, &(0x7f0000000980)={0x2, 0x0, {0x0, 0x4b, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r4, &(0x7f0000002080)={0x2, 0x0, {&(0x7f0000001f80)=""/152, 0x98, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r4, &(0x7f0000001f00)={0x2, 0x0, {&(0x7f0000000440)=""/112, 0x70, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r4, &(0x7f00000003c0)={0x2, 0x0, {&(0x7f0000000c00)=""/135, 0xfca2, 0x0, 0x0, 0x3}}, 0x36) socket$alg(0x26, 0x5, 0x0) mount(&(0x7f0000000900)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='squashfs\x00', 0x1408009, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) r5 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x5) fchdir(r6) r7 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r8, 0x40505330, &(0x7f0000000040)={{}, {0x18}, 0x0, 0x7}) getdents(r7, &(0x7f0000000100)=""/155, 0x9b) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000004, 0x7, &(0x7f0000006680)) 2m46.879087035s ago: executing program 2 (id=677): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x80, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000000)={0x7, 0x1, 0x1, 0x0, 0x7f}) 2m45.907168606s ago: executing program 2 (id=679): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet(0x2, 0x3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r0, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x2) 2m44.699578974s ago: executing program 2 (id=683): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$dri(&(0x7f0000000300), 0x40100001, 0x189002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000003c0)=@abs, 0x76) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) connect$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x80, 0x3, @local}, 0x10) r5 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r5, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) r6 = socket$inet_udp(0x2, 0x2, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000680)={&(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000180), 0x4}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), 0xffffffffffffffff) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x2f, 0xf3, 0x2, 0x8, 0x722, 0x6, 0x7, 0x7f, 0x27, 0x20, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) 2m43.510462271s ago: executing program 2 (id=685): sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x2) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x12a, 0x80004100008a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e20, 0x5, @loopback, 0x5}, 0x1c) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffff0000, 0x0, 0x0, 0x0, 0x81}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x8}, 0x94) 2m42.621927748s ago: executing program 2 (id=689): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000180)={[{@delalloc}, {@noload}, {@acl}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x783, &(0x7f00000017c0)="$eJzs3c9rHFUcAPDvbJKmSauJIGg9BQQNlG5Mja2Ch4oHESwU9Gy7bLahZpMt2U1pQg4tIngRVDwIeunZH/Xm1R9X/S88SEvVtFjxIJHZH+222U03bXY3kM8HXva9mdm89903P97sDDsB7FkT6Z9MxKGI+DiJGKtPTyJiqJobjDhRW+72+lo+TUlsbLz9Z1Jd5tb6Wj6a3pM6UC88HRE/fRBxOLO53vLK6nyuWCws1ctTlYXzU+WV1SPnFnJzhbnC4rHpmZmjx186fmznYv3719WD1z954/lvT/z7/lNXP/o5iRNxsD6vOY6dMhET9c9kKP0I7/H6TlfWZ0m/G8BDSTfNgdpWHodiLAaquTZGetkyAKBbNgCAPSgxBgCAPabxPcCt9bV8I/X3G4neuvFaROyvxd+4vlmbM1i/Zre/eh109FZyz5WRJCLGd6D+iYj48vt3v05T1PvBtTSgFy5djogz4xOb9//JpnsWtuuFrWZuDFdfJu6bvNeOP9BPP6Tjn5dbjf8yd8Y/0WL8M9xi230YD97+M9d2oJq20vHfq033tt1uir9ufKBeeqw65htKzp4rFtJ92+MRMRlDw2l5urpo65Hb5M3/brarv3n899en732V1p++3l0ic21w+N73zOYquUeNu+HG5YhnBlvFn9zp/6TN+PdUh3W8+cqHX7Sbl8afxttIm+Pvro0rEc+17P+7fZlseX/iVHV1mGqsFC1899vno+3qb+7/NKX1N84FeiHt/9Gt4x9Pmu/XLG+/jl+ujP3Ybt6D42+9/u9L3qnm99WnXcxVKkvTEfuStzZPP3r3vY1yY/k0/slnW2//tWpbr//pOeGZDuMfvP7HNw8ff3el8c9uq/+3n7l6e36gXf2d9f9MNTdZn9LJ/q/TBj7KZwcAAAAAAAAAAAAAAAAAAAAAAAAAncpExMFIMtk7+Uwmm609w/vJGM0US+XK4bOl5cXZqD4rezyGMo2fuhxr+j3U6frv4TfKR+8rvxgRT0TEZ8Mj1XI2XyrO9jt4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKg70Ob5/6nfh/vdOgCga/b3uwEAQM85/gPA3rO94/9I19oBAPSO838A2Hs6Pv6f6W47AIDecf4PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAl506eTJNG/+sr+XT8uyFleX50oUjs4XyfHZhOZ/Nl5bOZ+dKpbliIZsvLbT9R5dqL8VS6fxMLC5fnKoUypWp8srq6YXS8mLl9LmF3FzhdGGoZ5EBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQOfKK6vzuWKxsCSzZWZkdzRj12QGY1c0Q6Zrmea9xEj/dlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAu9z/AQAA//+MoS4e") sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8042, 0x60) pwrite64(r3, &(0x7f0000000040)="10", 0xffffffb7, 0x8080c61) openat(0xffffffffffffff9c, 0x0, 0x341142, 0x0) 2m29.738785899s ago: executing program 3 (id=708): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x5, 0x180) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000040)={&(0x7f0000000040), 0x0, 0x5}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f00000000c0)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(0xffffffffffffffff, 0x4020aed2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80e40, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r3, 0x40045569, 0xa) sendmsg$unix(0xffffffffffffffff, 0x0, 0x4) ioctl$PTP_SYS_OFFSET_PRECISE(r2, 0xc0403d08, &(0x7f0000000040)) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000100)={{0x100, 0x0, 0x0, 0x1}, 'syz1\x00', 0x1a}) ioctl$UI_DEV_CREATE(r3, 0x5501) 2m27.657939436s ago: executing program 3 (id=712): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="66617374626f6f742c71756f7461000018bbdecde39739fcd1df176dde746ec834120600000000003b814e50a959736d6572462abc30ef5b65c70f73ecea54b5e5bea9836c319f653557e79a002208ce996dda659bd5ba0f4ce5c2080002223dc60000000000000044cd0a1e3686873600000000005493b4d11d5b9fa9b40fe4d76afc3a989c6d60044e89eb96e44d01a1034e3797ffa86870b82939f41ffa0f3d726f085663c29cbdc4c766a7eb77cc36160191acf5ae7469c82ab4145b595b987d75912a0fcd1c061835294cc0c618aba204f8adaa20c80108d356cd88cc86177056b06e7068c40f807d9e539f8f5b64a8ee0725aa8d00000000007cb6020d90ea79b8027cf75964dd86c2ed2b5e75779677aa8c76b848dd03dab190b5f02ec52830a17b01eaae1c3df076000000000000000000000000000083a48a6b926c628b9b90195024ea3619f9d80a0b894e212178e1a19909d764666264fa29e2c055fd4c9a6e94acfb75f0a8d41692f4542a575ee42ed94a0014fba44985cca9df12fe93bfaccf0122a6e7e593613ac0111701b125cc6799c43aa4ff708dc4a00a6decad26f0378072a571da000000b1a6bdf03fd56697e348b5b494f6fddb9f56142a47a40ef81690a7eca421bd0ad198afa58ce69d61c29deaa93c0efea0df04f20020ee84075b4e1a2ad43d1be1138de4668e7b6137545708790c501f1ed7f6a571d500000000000000"], 0x27, 0x558d, &(0x7f00000014c0)="$eJzs3L1vG2UYAPDnnKbflAgxsPWkCimRaqtOPwQTBVrxIVpVfAxM4Niu5db2RbHrhi50YEQM/CcIJCZG/gYGGGFDDCA2pCLfXaBpGwiN45T295POz93j18+978mK9NxFDuCJtZD+/msSx+JQRMxFxNEk8v2k3CJuR5wvxj4XEccjonLXlpT5vxL7I+JwRBybFC9qJuVbn58cnzj7y5u/ffPdgX1Hvvj6+z1dOLCnno+I/mqxf7NfxKxTxGtlvjHu5rF/ZlzG1U01+lmRv9leySvcbGyMa+TxdKcYn63eGE7i1V6jOYmd7tU8vzooTjgcdzbqTD6QXmus5cet9koeu8Msj51bxXnXbxV/224NR0WdVlnvo7x8jEYbsci319vFelav57E5GJX5om7Waq9P4riM5emimfVa+TxWHvIi/w+81R3cWE/H7bVhNxukZ2v1F2r1c9X6WtZqj9pnqo1+69yZdLHTmwyrjtqN/vlOlnV67Voz6y+li51ms1qvp4sX2ivdxiCt12una6eqZ5fKvZPpa5ffS3utdHESX+kOboy6vWF6NVtLi08spcu10y8upSfq6TuXrqRX3r548dKVdz+48P7lly+98Wo56L5ppYvLp5aXq/VT1eX60hO0/k/KSf+H9ScPTv/4w84uGxS2+IIBsLX7+v+4t/8P/T8wdTvp//vXy+Pd6f9jO/1/TLP/n7RU+v9/738re9D/zof+fxfXDzvycP3//qnPAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAmftp/svX852F4vhImX+qTD1THicRUYmIOw8wF/s31Zwr68xvMX7+njl8m0ReYXKOA+V2OCLOl9sfT+/2VQAAAIDH11e3j39WdOvFy8JeT4hZKm7aVI5+OKV6SUTML/w8pWqVycuzUyqWf7/3xfqUquU3sA5OqVhxy23ftKpty9ymcPCukBShMtPpAAAAM7G5E5htFwIAAMAsffqP7740s3kwY0lsPMrceBac/+f93w8ED216DwAAAHhE3Pl4+2OT3ZwIAAAA8EjI+3+//wcAAACPt+L3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD/ZuZvbxIEwDMCfDYb91aLV3reG7WBvUMaWsMc9LhSQJiiBtJAGqIFIOaSECCJsg+IEpEiMcYKeR/LPjNHrGeDyjSUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAm26LxeT6/8+rU3PWm9OkmQ0AAABwyKpYTMqTUdX+XPd/rbu+1+0sIvKIOFS792LQyOzVOcWRzxfPxnATUSZs+4f19ikiftfbw7e2vwUAAAC4WL+enG9L9t0SwF1H4+G8qkWb/MufRHlZRBSj+0Rp+Xb3I1FY+f/ux79EaeUC1odEYdWSW//wtUGqmzT1GofdTKblj1i28nbuCwAAdKlZCRypQgAAALgAf7seAOfwsrTP9rv9c8ZhdagfCH5stAAAAIB3KOt6AAAAAEDryvr/Lb3/L/P+PwAAAEhuOZuPux4DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADApVsVi8lyNh8fuz59Zc56c5p0MwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB7Zn3cUCIEwCIO96zuTuf9hpUFDY5MqED7+xmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB487u//J+YGmeSudfG0vNIsnZqbJ0ae+fG0R/G168BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4GJ/XlIgBIIgCuaM/530/Q8rCXoGESKg4VFFLRoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL7od7/8n5gaZ5K508bS8UiydtXYumrsPWgcPRhv/wYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4GLffnqjKMMAgD+7010oaqzVNLFqMOGgFykLglyN0TQe/AgmTdlidRGFHoQ0Yi/eTM9cjB6NMdHUW78DZ5pwwRuHHmriyUPN/Cuz7QoNykyhv1/y7vvs7PD+2wnpM+8sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQGnz3Xi1XcRJ+jKRx+Wx21vL82m9satOra/emU5LGrdqHvcT4LXqm+NTzQ0EAACAwyMp8/uIuNtZm03r9kSW/3fKc9Kc/4fn8rjM53fn/Rtby0eLj6bL/P/33+69tNPRRJL1kza6sDjon9o7lLHHNMUD7/mHnjGWrXx27yXJvpD2hysvbnay9Wx9d+vW+90sPFLHaAGAR3GyrIug/HsorXtNDgyAQ2OskniX+X8y0eyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOqwuRLPlHErIqbH7sepja3l+VH1N6t3pteLcu7mzdVqm2kTnYhYWBz0T9U4l4OrXM3rn80NBv0rV6/VHRyPiBEf3djfP0+K4f/rOd2IGDpy4uUR7Xy8j752tbMnKC7PqHcNx9P5PfTk1tCR1p4Ff28718QFUFfQLr6fx9HFeO3f+3BQXnv/f8s1/3cEAMBTr1OUNBO921mbTY+1JiO2fxzO/9+oxDGU92/fyI/k79cr+f+9T87drvZVzf97Nc3vSTCzdOmLmavXrr+1eGnuYv9i//O3T/fe6Z05f/bs+ZnsXsnMQrTdMQEAAOA/6Balmv+3J/fu/x+rxPGA/f98SzjP/7/8vvd1ta9E/j/S/U2/pkcCAABwGHV3ohde/+vP1ogzWt1ufDW3tHSll7/uvD+dv9Y63Ed0pCjV/D+ZbHpUAAAAQB02V1pD+/8XKnE8YP+/+vz/sz+98ku1zSQixiMuR0T/5PzlwYX6pnOg1fFD5ayjbtMzBQAAoCnjRanu/3ey5//bO488tCPizRMRfxe/4Y995v/JB9/+XO2r+vz/mVpnefC0p/L1yOqpiLGppkcEAADA0+xoUdJk/4/O2uynvx77qOv5fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC6/RMAAP//gBsrfQ==") socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) landlock_restrict_self(0xffffffffffffffff, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) renameat2(r4, &(0x7f00000001c0)='./file0\x00', r4, &(0x7f0000000200)='.\x02\x00', 0x4) renameat2(r4, &(0x7f0000000100)='.\x02\x00', r4, 0x0, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) 2m27.182300011s ago: executing program 33 (id=689): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000180)={[{@delalloc}, {@noload}, {@acl}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x1, 0x783, &(0x7f00000017c0)="$eJzs3c9rHFUcAPDvbJKmSauJIGg9BQQNlG5Mja2Ch4oHESwU9Gy7bLahZpMt2U1pQg4tIngRVDwIeunZH/Xm1R9X/S88SEvVtFjxIJHZH+222U03bXY3kM8HXva9mdm89903P97sDDsB7FkT6Z9MxKGI+DiJGKtPTyJiqJobjDhRW+72+lo+TUlsbLz9Z1Jd5tb6Wj6a3pM6UC88HRE/fRBxOLO53vLK6nyuWCws1ctTlYXzU+WV1SPnFnJzhbnC4rHpmZmjx186fmznYv3719WD1z954/lvT/z7/lNXP/o5iRNxsD6vOY6dMhET9c9kKP0I7/H6TlfWZ0m/G8BDSTfNgdpWHodiLAaquTZGetkyAKBbNgCAPSgxBgCAPabxPcCt9bV8I/X3G4neuvFaROyvxd+4vlmbM1i/Zre/eh109FZyz5WRJCLGd6D+iYj48vt3v05T1PvBtTSgFy5djogz4xOb9//JpnsWtuuFrWZuDFdfJu6bvNeOP9BPP6Tjn5dbjf8yd8Y/0WL8M9xi230YD97+M9d2oJq20vHfq033tt1uir9ufKBeeqw65htKzp4rFtJ92+MRMRlDw2l5urpo65Hb5M3/brarv3n899en732V1p++3l0ic21w+N73zOYquUeNu+HG5YhnBlvFn9zp/6TN+PdUh3W8+cqHX7Sbl8afxttIm+Pvro0rEc+17P+7fZlseX/iVHV1mGqsFC1899vno+3qb+7/NKX1N84FeiHt/9Gt4x9Pmu/XLG+/jl+ujP3Ybt6D42+9/u9L3qnm99WnXcxVKkvTEfuStzZPP3r3vY1yY/k0/slnW2//tWpbr//pOeGZDuMfvP7HNw8ff3el8c9uq/+3n7l6e36gXf2d9f9MNTdZn9LJ/q/TBj7KZwcAAAAAAAAAAAAAAAAAAAAAAAAAncpExMFIMtk7+Uwmm609w/vJGM0US+XK4bOl5cXZqD4rezyGMo2fuhxr+j3U6frv4TfKR+8rvxgRT0TEZ8Mj1XI2XyrO9jt4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKg70Ob5/6nfh/vdOgCga/b3uwEAQM85/gPA3rO94/9I19oBAPSO838A2Hs6Pv6f6W47AIDecf4PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAl506eTJNG/+sr+XT8uyFleX50oUjs4XyfHZhOZ/Nl5bOZ+dKpbliIZsvLbT9R5dqL8VS6fxMLC5fnKoUypWp8srq6YXS8mLl9LmF3FzhdGGoZ5EBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQOfKK6vzuWKxsCSzZWZkdzRj12QGY1c0Q6Zrmea9xEj/dlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAu9z/AQAA//+MoS4e") sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8042, 0x60) pwrite64(r3, &(0x7f0000000040)="10", 0xffffffb7, 0x8080c61) openat(0xffffffffffffff9c, 0x0, 0x341142, 0x0) 2m25.226320433s ago: executing program 3 (id=720): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x5, 0x180) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000040)={&(0x7f0000000040), 0x0, 0x5}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f00000000c0)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(0xffffffffffffffff, 0x4020aed2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80e40, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r3, 0x40045569, 0xa) sendmsg$unix(0xffffffffffffffff, 0x0, 0x4) ioctl$PTP_SYS_OFFSET_PRECISE(r2, 0xc0403d08, &(0x7f0000000040)) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000100)={{0x100, 0x0, 0x0, 0x1}, 'syz1\x00', 0x1a}) ioctl$UI_DEV_CREATE(r3, 0x5501) socket$inet_smc(0x2b, 0x1, 0x0) fsopen(&(0x7f0000000080)='qnx6\x00', 0x1) socket$nl_route(0x10, 0x3, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) 2m23.636721932s ago: executing program 3 (id=721): syz_open_dev$I2C(&(0x7f00000000c0), 0x0, 0x0) getdents64(0xffffffffffffffff, 0xffffffffffffffff, 0x43) write$UHID_INPUT2(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x61, 0x8e}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xfffffffffffffffe, 0x0, {{0x6, 0x0, 0x5, 0x81, 0x1, 0x1, {0x6, 0xff, 0x5, 0x8, 0xe, 0xd615, 0x9, 0x1, 0xfffffffe, 0x2000, 0x3ffffff, 0x0, 0xffffffffffffffff, 0x5, 0x2000000}}, {0x0, 0x19}}}, 0xa0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_buf(r3, 0x29, 0x1a, 0x0, 0x0) 2m21.336880455s ago: executing program 3 (id=726): syz_io_uring_setup(0x3ec3, &(0x7f0000010400)={0x0, 0x86e1, 0x1, 0x8, 0x7b}, 0x0, &(0x7f0000000000), 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) r2 = socket$key(0xf, 0x3, 0x2) setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001280)=@nat={'nat\x00', 0x1b, 0x5, 0x510, 0x0, 0x158, 0xffffffff, 0x380, 0x0, 0x46c, 0x46c, 0xffffffff, 0x46c, 0x46c, 0x5, &(0x7f0000000080), {[{{@uncond, 0x0, 0xec, 0x134, 0x0, {}, [@common=@hbh={{0x48}, {0x9, 0x4, 0x1, [0x6, 0xd3e, 0x228, 0x80, 0x7, 0x400, 0xff, 0x5, 0x7, 0x7f, 0xff, 0x9, 0x3a, 0x101, 0x3, 0xb63e], 0x8}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x1, @ipv6=@mcast2, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, @port=0x4e23, @port=0x4e23}}}, {{@uncond, 0x0, 0xa4, 0xec}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x16, @ipv6=@empty, @ipv4=@remote, @icmp_id=0x66, @gre_key=0x6}}}, {{@uncond, 0x0, 0xf4, 0x13c, 0x0, {}, [@common=@srh={{0x2c}, {0x3b, 0x4, 0x80, 0x4, 0x5f02, 0x64a, 0x2802}}, @common=@mh={{0x24}, {"a210"}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x12, @ipv4=@loopback, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, @port=0x4e22, @icmp_id=0x68}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2c}, @loopback, [0xffffffff, 0xffffffff], [0xffffff00, 0xff, 0xff000000, 0xff0000ff], 'veth0\x00', 'macvlan1\x00', {0xff}, {}, 0x6, 0xff, 0x0, 0x26}, 0x0, 0xa4, 0xec}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x4, @ipv6=@local, @ipv4=@rand_addr=0x64010102, @icmp_id=0x66, @icmp_id=0x68}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x56c) sendmsg$key(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f00000002c0)={0xffffffee, "368cf99a33ad8127d00c36b713bcfe591cc43d00", 0x0, 0x800, 0x20007, 0x4, 0x10, 0x0, 0xc8, 0x8fd}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r3 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0xfe33) syz_ublk_setup_io_uring(0x77e9, &(0x7f0000000180)={0x0, 0xe6, 0x0, 0x3, 0x3b9}, &(0x7f0000000480), &(0x7f0000000240), &(0x7f0000000280)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp384-generic\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f00000047c0)=[{{0x0, 0x0, &(0x7f0000002ac0)=[{&(0x7f0000000340)=""/1, 0x30}], 0x1}, 0xe75}], 0x3aa0, 0x60002000, 0x0) 2m18.31873397s ago: executing program 3 (id=730): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x244}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) prlimit64(0x0, 0xb, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e22, 0x0, @empty, 0x5}, 0xfffffffffffffdc6) socket$inet6(0xa, 0x2, 0x0) r3 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r3, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$MEDIA_REQUEST_IOC_QUEUE(r4, 0x7c80, 0x0) 2m2.096281179s ago: executing program 34 (id=730): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x244}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) prlimit64(0x0, 0xb, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e22, 0x0, @empty, 0x5}, 0xfffffffffffffdc6) socket$inet6(0xa, 0x2, 0x0) r3 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r3, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$MEDIA_REQUEST_IOC_QUEUE(r4, 0x7c80, 0x0) 24.633320965s ago: executing program 5 (id=929): sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$afs(0x0, &(0x7f00000000c0)='.\x00', 0x0, 0x4, &(0x7f0000000040)) 16.326706046s ago: executing program 0 (id=946): r0 = socket$xdp(0x2c, 0x3, 0x0) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000f40)={0x1c, 0x3, &(0x7f0000000cc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2560, 0x0, 0x0, 0x0, 0x5}}, &(0x7f0000000dc0)='syzkaller\x00', 0x10, 0xa, &(0x7f0000000e00)=""/10, 0x41100, 0x11, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000e80)={0x3, 0x9, 0x9, 0x6}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x3, &(0x7f0000000ec0)=[0x1, 0x1], &(0x7f0000000f00)=[{0x4, 0x1, 0xf, 0x9}, {0x3, 0x3, 0x10, 0x6}, {0x1, 0x2, 0x3, 0xb}], 0x10, 0x1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xe0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000000)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080), 0x0, 0xb2, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000100), &(0x7f0000000140), 0x8, 0x20, 0x8, 0x8, &(0x7f0000000180)}}, 0x10) bind$xdp(r0, &(0x7f0000000300)={0x2c, 0x0, r2, 0xa}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x1c, &(0x7f0000000040), 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000580)=@o_path={&(0x7f0000000540)='./file0\x00', 0x0, 0x4018, r0}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000540)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_DATA={0x4}]}, 0x54}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r6 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f00000002c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) 16.294715857s ago: executing program 4 (id=947): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000000)=0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x50}}, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000300), 0x40100001, 0x189002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000003c0)=@abs, 0x76) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r7, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) connect$llc(r7, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x80, 0x3, @local}, 0x10) r8 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r8, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) r9 = socket$inet_udp(0x2, 0x2, 0x0) close_range(r9, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r1) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x20004000) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x2f, 0xf3, 0x2, 0x8, 0x722, 0x6, 0x7, 0x7f, 0x27, 0x20, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) 14.741808266s ago: executing program 0 (id=949): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xa, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = io_uring_setup(0x77d0, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x200040b4) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040057}, 0x240008c4) 14.017883499s ago: executing program 5 (id=951): socket$nl_generic(0x10, 0x3, 0x10) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) process_vm_readv(r2, &(0x7f0000000400)=[{&(0x7f0000000300)=""/55, 0x37}], 0x1, &(0x7f0000000580)=[{&(0x7f0000000440)=""/209, 0xd1}], 0x1, 0x0) 13.770904147s ago: executing program 0 (id=952): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x5, 0x180) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000040)={&(0x7f0000000040), 0x0, 0x5}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f00000000c0)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(0xffffffffffffffff, 0x4020aed2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80e40, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r3, 0x40045569, 0xa) sendmsg$unix(0xffffffffffffffff, 0x0, 0x4) ioctl$PTP_SYS_OFFSET_PRECISE(r2, 0xc0403d08, &(0x7f0000000040)) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f0000000100)={{0x100, 0x0, 0x0, 0x1}, 'syz1\x00', 0x1a}) ioctl$UI_DEV_CREATE(r3, 0x5501) socket$inet_smc(0x2b, 0x1, 0x0) fsopen(&(0x7f0000000080)='qnx6\x00', 0x1) r4 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000000)=0x20) 13.764411397s ago: executing program 4 (id=953): r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x5, 0x180) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000040)={&(0x7f0000000040), 0x0, 0x5}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(0xffffffffffffffff, 0x4020aed2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80e40, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0xa) sendmsg$unix(0xffffffffffffffff, 0x0, 0x4) ioctl$PTP_SYS_OFFSET_PRECISE(r1, 0xc0403d08, &(0x7f0000000040)) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{0x100, 0x0, 0x0, 0x1}, 'syz1\x00', 0x1a}) ioctl$UI_DEV_CREATE(r2, 0x5501) socket$inet_smc(0x2b, 0x1, 0x0) fsopen(&(0x7f0000000080)='qnx6\x00', 0x1) r3 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000000)=0x20) 10.15102201s ago: executing program 7 (id=957): socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = io_uring_setup(0x5f4f, &(0x7f00000003c0)={0x0, 0x804, 0x2, 0x1000000}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0xf, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x2d, 0xc, &(0x7f00000002c0)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 10.130392561s ago: executing program 5 (id=958): syz_open_dev$usbmon(&(0x7f0000000000), 0x5, 0x180) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(0xffffffffffffffff, 0x4020aed2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80e40, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0xa) sendmsg$unix(0xffffffffffffffff, 0x0, 0x4) ioctl$PTP_SYS_OFFSET_PRECISE(r1, 0xc0403d08, &(0x7f0000000040)) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{0x100, 0x0, 0x0, 0x1}, 'syz1\x00', 0x1a}) ioctl$UI_DEV_CREATE(r2, 0x5501) socket$inet_smc(0x2b, 0x1, 0x0) fsopen(&(0x7f0000000080)='qnx6\x00', 0x1) r3 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000000)=0x20) 10.034842874s ago: executing program 6 (id=959): r0 = socket$xdp(0x2c, 0x3, 0x0) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000f40)={0x1c, 0x3, &(0x7f0000000cc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2560, 0x0, 0x0, 0x0, 0x5}}, &(0x7f0000000dc0)='syzkaller\x00', 0x10, 0xa, &(0x7f0000000e00)=""/10, 0x41100, 0x11, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000e80)={0x3, 0x9, 0x9, 0x6}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x3, &(0x7f0000000ec0)=[0x1, 0x1], &(0x7f0000000f00)=[{0x4, 0x1, 0xf, 0x9}, {0x3, 0x3, 0x10, 0x6}, {0x1, 0x2, 0x3, 0xb}], 0x10, 0x1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xe0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000000)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080), 0x0, 0xb2, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000100), &(0x7f0000000140), 0x8, 0x20, 0x8, 0x8, &(0x7f0000000180)}}, 0x10) bind$xdp(r0, &(0x7f0000000300)={0x2c, 0x0, r2, 0xa}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x1c, &(0x7f0000000040), 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000580)=@o_path={&(0x7f0000000540)='./file0\x00', 0x0, 0x4018, r0}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000540)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}]}, 0x44}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r6 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f00000002c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) 10.002579735s ago: executing program 0 (id=960): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r0, 0xc0305302, &(0x7f0000000100)={0xf, 0x20000, 0x2, 0xcbc, 0x1, 0x8}) syz_usb_connect$cdc_ecm(0x2, 0x5c, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000090000202505a1a440000000010109024a000101000000090400001702020000052406000005240000000d240f010000000006000000200624070407000905810340000000000905820210000000000905030240db256c011c167adc0e975ea705b2ab8f92340f597e616e05690a25eb06c882fed51b70610245bab04b16205b7076cf5ba6a4fec5600d80281b1f773d8323ab8c1f856250d877a3a1c297e2352cb6c0c0525b427f34d39937545c6e11aed5089366e9073c83fb92972bc822f9", @ANYRES8, @ANYRESHEX=r0], 0x0) prlimit64(0x0, 0x3, &(0x7f00000000c0)={0x84eeeea, 0xd}, &(0x7f0000000140)) gettid() syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$sock_linger(r1, 0x1, 0x48, &(0x7f00000000c0)={0x4000, 0xffffff7d}, 0x8) r2 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$FE_SET_FRONTEND(0xffffffffffffffff, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x4, 0xe, 0xd}}) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x8, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x7, 0x0, 0x1000004, 0x1, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ef, 0x200009ea, 0x20000010, 0x55, 0x8, 0x4008, 0x746f, 0x8, 0x6, 0x4, 0xee, 0x4, 0x7ffd]}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003580)=ANY=[@ANYRES64=r3], 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) r6 = socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000580)={@map=r2, 0x28, 0x1, 0xfffffffe, &(0x7f0000000340)=[0x0], 0x1, 0x0, &(0x7f0000000480), &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x810) sendmsg$RDMA_NLDEV_CMD_DELLINK(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800", @ANYRESOCT], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a0b7a964}, 0x0) 9.977741366s ago: executing program 4 (id=961): syz_io_uring_setup(0x3ec3, 0x0, 0x0, &(0x7f0000000000), 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) r2 = socket$key(0xf, 0x3, 0x2) setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001280)=@nat={'nat\x00', 0x1b, 0x5, 0x510, 0x0, 0x158, 0xffffffff, 0x380, 0x0, 0x46c, 0x46c, 0xffffffff, 0x46c, 0x46c, 0x5, &(0x7f0000000080), {[{{@uncond, 0x0, 0xec, 0x134, 0x0, {}, [@common=@hbh={{0x48}, {0x9, 0x4, 0x1, [0x6, 0xd3e, 0x228, 0x80, 0x7, 0x400, 0xff, 0x5, 0x7, 0x7f, 0xff, 0x9, 0x3a, 0x101, 0x3, 0xb63e], 0x8}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x1, @ipv6=@mcast2, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, @port=0x4e23, @port=0x4e23}}}, {{@uncond, 0x0, 0xa4, 0xec}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x16, @ipv6=@empty, @ipv4=@remote, @icmp_id=0x66, @gre_key=0x6}}}, {{@uncond, 0x0, 0xf4, 0x13c, 0x0, {}, [@common=@srh={{0x2c}, {0x3b, 0x4, 0x80, 0x4, 0x5f02, 0x64a, 0x2802}}, @common=@mh={{0x24}, {"a210"}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x12, @ipv4=@loopback, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, @port=0x4e22, @icmp_id=0x68}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2c}, @loopback, [0xffffffff, 0xffffffff], [0xffffff00, 0xff, 0xff000000, 0xff0000ff], 'veth0\x00', 'macvlan1\x00', {0xff}, {}, 0x6, 0xff, 0x0, 0x26}, 0x0, 0xa4, 0xec}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x4, @ipv6=@local, @ipv4=@rand_addr=0x64010102, @icmp_id=0x66, @icmp_id=0x68}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x56c) sendmsg$key(r2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VIDIOC_G_TUNER(0xffffffffffffffff, 0xc054561d, &(0x7f00000002c0)={0xffffffee, "368cf99a33ad8127d00c36b713bcfe591cc43d00", 0x0, 0x800, 0x20007, 0x4, 0x10, 0x0, 0xc8, 0x8fd}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r3 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0xfe33) syz_ublk_setup_io_uring(0x77e9, &(0x7f0000000180)={0x0, 0xe6, 0x0, 0x3, 0x3b9}, &(0x7f0000000480), &(0x7f0000000240), &(0x7f0000000280)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp384-generic\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f00000047c0)=[{{0x0, 0x0, &(0x7f0000002ac0)=[{&(0x7f0000000340)=""/1, 0x30}], 0x1}, 0xe75}], 0x3aa0, 0x60002000, 0x0) 8.839865032s ago: executing program 7 (id=962): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xa, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = io_uring_setup(0x77d0, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x200040b4) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040057}, 0x240008c4) 7.718331667s ago: executing program 6 (id=963): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x2f, 0xf3, 0x2, 0x8, 0x722, 0x6, 0x7, 0x7f, 0x27, 0x20, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) 7.697553598s ago: executing program 6 (id=964): socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000080)='./file1/file0\x00', 0x0, 0x1085408, 0x0) r3 = io_uring_setup(0x5f4f, &(0x7f00000003c0)={0x0, 0x804, 0x2, 0x1000000}) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r3, 0xf, &(0x7f0000000540)={0x1002, 0x0, 0x0, 0x0, 0x28}, 0x20) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x40, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x2d, 0xc, &(0x7f00000002c0)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 6.398710019s ago: executing program 5 (id=965): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_emit_ethernet(0x4c8, &(0x7f0000000500)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x2f, 0x4ba, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x4a6, 0x0, @gue={{0x2, 0x0, 0x0, 0x1, 0x100, @val=0x80}, "2b47019676fb912bfb3979bb82d94c42da0498ad601e4b92fe2c62ba4d6bdd44d280dada5a5650e1edaecb4fd923a6ded85d084df9d5e7bffddda34d04e5cdb51ef2fe8703b3988bb47989823d53b49308c5d2977c173d08535eaf56e740391766d74589e9806165ef3d4085755bbaa162e74e4dc541aa6004761f6a43e20556918bb04da9070b3cc89472820459902b3342031e1571d32a8b78f2da2a8e73e26af9389dced48cdcaf0a714363789e4acd9373813e2729986552c1cdbeabd3a03d7684ead62926c387b1552066f9751c9f0fa935afda36cf2fb30bba0cb8007f3bd1fea86ef3b7f8434e250f2a09e6a3b569c8c0519adc93f8b909470f39920551618ecfe04ff0cc4b1ed29eee56dcd976a79181e4d3218b51150ce595c25371293ec4d05e4aa411ef3b190554c6a2e06ee6374d80a3c511603a8a20b75f8075d0d83d31b86be7d2d785e6d60c07b515fe04bd55e20bcfe799a3e66c93744c52d0d34880ab42354859d5d1a9d0d65b52a0819b19c2d7f7a285d401825bf40ccc355b1aecb100c3f86c71607b00c59c7a8c0d8ae35a0a0e20f189568cb1a386c9d799f2c5ba6cce4e6ae0dce69f7391a4f4b011b27ad89ecaca95b90be9e517d39fa47ab5d08fd75233c1b0b604c169ebdc29efe713e9ecd551fc383be78cc5afccee1d8bb067e64054734b61c99f1055748b335ea261b9a6ccd1b3362a0c9d26c74bcda8e4d1efca7f614a61b8dfa2508a39f78901cf7ab2f15409f1da06432db0b50f00e16a77ceece0e315fc63c46cd418a1d259ba713bc5a26a49bdc202cf04e02149cf29c1f617f0898321ecf9d395f349e276480b42147d4dc1af6491e05cff9a33517437cb21125f6945e0b727576880a89ef6d53375bb901e14ae1a2dd27a5bf67012b8e4515023dba602d2e5293da914c199c0c0d610bf6461cd7bba6c8b948e96f395c39a7a0b93df65368f8eaa306fdcf87522ac1a36c427d98af77c3a3afa33dc3e8e070a1a2f66a4877abbeef23ff67befdcc9532cf3990918fb778d7799ee1f26b469c37f3c9578b8f8f2d00d32fc839171b9474e76f03d827a4eac2802322f3d68b03d1516aec9566bba3acc0bcf0d6a551c412f080d8c7fe0c60e23cdb328920263477470ea4f23e23d5aebbfda173aa781f89bf0cdfce2003ed3c010c511b3b489eab29453a365b839cca172e3abbcbab0203899bdb4f14a3423c2293166145760e61c3c188c3e0888ee817f0772ff89e02df8f42b9951e1661b39def34308c46e8ec1e4e5b68e88140ac7dc993523191fdb71db3a2677a3bd666e6180a96c9846bce6cb6c16e379bf29e1769a66da2f6781e79f082cb80662d72adbb21240cef87dc3079a822b2a791753fcd12a7ec362088d76237370bcd5d5daa440ba735b4e29cf2cb93583a5080270d1a3fd40183dc04f30e01c428f92e595c89fcbd1fc52962eedea82e2772b5f5fa3dad0f908fe6a48fffcc69df60f34ef9d9ba7609d16cdf733ca77785c0ab6f536b79ffde4ff9b835bfcaffef0d15ae69c26c0588f1acd5a648fde52568c713163717eb77f863d20dda0f1ca2c0306748544d3763c1cfa82f1785f047c842cadc4f8ac1906ab6ad8f6425bb9efbe97ee62ea7e40ec6ac342f457f00626f907ed939864"}}}}}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r2, &(0x7f0000000480)=[{{&(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x80020}, 0x1c, &(0x7f0000000300)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000009c0)=ANY=[], 0x1000f) 6.03377288s ago: executing program 6 (id=966): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000099dc320d112f37e685401020301090224000100001010090459e102ff063d0009050b0200020500ff0905"], 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) mknod$loop(0x0, 0xc000, 0x1) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_mptcp(0xa, 0x1, 0x106) 5.828615426s ago: executing program 7 (id=967): syz_mount_image$vfat(&(0x7f0000000300), &(0x7f00000001c0)='./file2\x00', 0x800082, &(0x7f0000000380)=ANY=[], 0x1, 0x373, &(0x7f00000006c0)="$eJzs3U9rXFUUAPDTsfmr6WQhgop4qRvdDEn8Ag3SghhQYkeqC+HVTHTINBPmDZEpot259XMUl+4E8QtkoXt37rJx2UXpk8yfJpOOKSVOHtXfD8I9yT0nc+883uNuHufw1g93drbz2nbWjcq1FJWIqDyIWO5HA5eGY6Ufz8ZJ9+Kd6q0/3vj4088+WN/YuL6Z0o31m++upZSuvPnL19/8ePXX7ouf/HTl57k4WP788K+1Pw9eOXj18NHNr5p5auZpt91NWbrdbnez261G2mrmO7WUPmo1sryRmrt5ozM2v91q7+31Ura7tbS412nkecp2e2mn0Uvddup2ein7MmvuplqtlpYWg6ep39/czNYH8fwZedcuakFMQaeznh3dw3NPzNTvl7IgAKBU5z3/z/6r5/+ZcP6/SCfP//xXHZ3/Z4f37zjnfwAAAAAAAAAAAAAAeB48KIpqURTV0ViMXhIe/l7y8piyJ67/qZ+y18d0nXhxbz6i9f1+fb8+GAfz69vRjFY0YiWq8fDosTAyiG+8v3F9JfUtx9Kd7/r1V3+LqL8wXr8a1VieXL86qE+P6+NonInFk/VrUY2XJ9evTayfjbffOlFfi2r8/kW0oxVb/cfbcf23qym99+HGqfq5fh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/w+1NPJ6DPre79cjFmJ/2L+/dpywPN4ff1D/uL/+SlTj4eT+/CsT+/Nfjtcul7t3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjJe3d3slar0bmoYNTzv/+X2VHwz1WXBun3Tk0txHjy3NP+zzmDyjNVLQw3OWHqUVEU01rq/MVeyvMEMxFxRk4x/ALP/1kvRcQZOXMRMf0tV8r/wp85KONpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOU6bvpd9koAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoU967u5O1Wo3OFIOy9wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA8+TsAAP//S+oM3w==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x143841, 0x1b0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo\x00') fchdir(r1) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10003, 0x7, r2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = open(&(0x7f0000000140)='.\x00', 0x0, 0x112) getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCXONC(r4, 0x540a, 0x0) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0x4, 0x14a}}) ioctl$TIOCL_PASTESEL(r4, 0x541c, &(0x7f0000000000)) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000003c0)={0x0, 0x2, 0x7fff, 0xffff}) 5.639130732s ago: executing program 4 (id=968): syz_mount_image$vfat(&(0x7f0000000300), &(0x7f00000001c0)='./file2\x00', 0x800082, &(0x7f0000000380)=ANY=[], 0x1, 0x373, &(0x7f00000006c0)="$eJzs3U9rXFUUAPDTsfmr6WQhgop4qRvdDEn8Ag3SghhQYkeqC+HVTHTINBPmDZEpot259XMUl+4E8QtkoXt37rJx2UXpk8yfJpOOKSVOHtXfD8I9yT0nc+883uNuHufw1g93drbz2nbWjcq1FJWIqDyIWO5HA5eGY6Ufz8ZJ9+Kd6q0/3vj4088+WN/YuL6Z0o31m++upZSuvPnL19/8ePXX7ouf/HTl57k4WP788K+1Pw9eOXj18NHNr5p5auZpt91NWbrdbnez261G2mrmO7WUPmo1sryRmrt5ozM2v91q7+31Ura7tbS412nkecp2e2mn0Uvddup2ein7MmvuplqtlpYWg6ep39/czNYH8fwZedcuakFMQaeznh3dw3NPzNTvl7IgAKBU5z3/z/6r5/+ZcP6/SCfP//xXHZ3/Z4f37zjnfwAAAAAAAAAAAAAAeB48KIpqURTV0ViMXhIe/l7y8piyJ67/qZ+y18d0nXhxbz6i9f1+fb8+GAfz69vRjFY0YiWq8fDosTAyiG+8v3F9JfUtx9Kd7/r1V3+LqL8wXr8a1VieXL86qE+P6+NonInFk/VrUY2XJ9evTayfjbffOlFfi2r8/kW0oxVb/cfbcf23qym99+HGqfq5fh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/w+1NPJ6DPre79cjFmJ/2L+/dpywPN4ff1D/uL/+SlTj4eT+/CsT+/Nfjtcul7t3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjJe3d3slar0bmoYNTzv/+X2VHwz1WXBun3Tk0txHjy3NP+zzmDyjNVLQw3OWHqUVEU01rq/MVeyvMEMxFxRk4x/ALP/1kvRcQZOXMRMf0tV8r/wp85KONpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOU6bvpd9koAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoU967u5O1Wo3OFIOy9wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA8+TsAAP//S+oM3w==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x143841, 0x1b0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo\x00') fchdir(r1) r2 = gettid() fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10003, 0x7, r2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = open(&(0x7f0000000140)='.\x00', 0x0, 0x112) getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCXONC(r4, 0x540a, 0x0) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0x4, 0x14a}}) ioctl$TCSETS2(r4, 0x402c542b, &(0x7f0000000040)={0x4, 0x211000, 0xefcb, 0x7ea, 0xb2, "35969809006e24a75f6d80732e5e6c31c267a0", 0x5, 0x200008}) ioctl$TIOCL_PASTESEL(r4, 0x541c, &(0x7f0000000000)) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000003c0)={0x0, 0x2, 0x7fff, 0xffff}) 4.785306769s ago: executing program 5 (id=969): syz_open_dev$usbmon(&(0x7f0000000000), 0x5, 0x180) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(0xffffffffffffffff, 0x4020aed2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80e40, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r2, 0x40045569, 0xa) sendmsg$unix(0xffffffffffffffff, 0x0, 0x4) ioctl$PTP_SYS_OFFSET_PRECISE(r1, 0xc0403d08, &(0x7f0000000040)) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000100)={{0x100, 0x0, 0x0, 0x1}, 'syz1\x00', 0x1a}) ioctl$UI_DEV_CREATE(r2, 0x5501) socket$inet_smc(0x2b, 0x1, 0x0) fsopen(&(0x7f0000000080)='qnx6\x00', 0x1) r3 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000000)=0x20) 3.419434102s ago: executing program 0 (id=970): syz_mount_image$vfat(&(0x7f0000000300), &(0x7f00000001c0)='./file2\x00', 0x800082, &(0x7f0000000380)=ANY=[], 0x1, 0x373, &(0x7f00000006c0)="$eJzs3U9rXFUUAPDTsfmr6WQhgop4qRvdDEn8Ag3SghhQYkeqC+HVTHTINBPmDZEpot259XMUl+4E8QtkoXt37rJx2UXpk8yfJpOOKSVOHtXfD8I9yT0nc+883uNuHufw1g93drbz2nbWjcq1FJWIqDyIWO5HA5eGY6Ufz8ZJ9+Kd6q0/3vj4088+WN/YuL6Z0o31m++upZSuvPnL19/8ePXX7ouf/HTl57k4WP788K+1Pw9eOXj18NHNr5p5auZpt91NWbrdbnez261G2mrmO7WUPmo1sryRmrt5ozM2v91q7+31Ura7tbS412nkecp2e2mn0Uvddup2ein7MmvuplqtlpYWg6ep39/czNYH8fwZedcuakFMQaeznh3dw3NPzNTvl7IgAKBU5z3/z/6r5/+ZcP6/SCfP//xXHZ3/Z4f37zjnfwAAAAAAAAAAAAAAeB48KIpqURTV0ViMXhIe/l7y8piyJ67/qZ+y18d0nXhxbz6i9f1+fb8+GAfz69vRjFY0YiWq8fDosTAyiG+8v3F9JfUtx9Kd7/r1V3+LqL8wXr8a1VieXL86qE+P6+NonInFk/VrUY2XJ9evTayfjbffOlFfi2r8/kW0oxVb/cfbcf23qym99+HGqfq5fh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/w+1NPJ6DPre79cjFmJ/2L+/dpywPN4ff1D/uL/+SlTj4eT+/CsT+/Nfjtcul7t3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjJe3d3slar0bmoYNTzv/+X2VHwz1WXBun3Tk0txHjy3NP+zzmDyjNVLQw3OWHqUVEU01rq/MVeyvMEMxFxRk4x/ALP/1kvRcQZOXMRMf0tV8r/wp85KONpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOU6bvpd9koAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoU967u5O1Wo3OFIOy9wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA8+TsAAP//S+oM3w==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x143841, 0x1b0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo\x00') fchdir(r1) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10003, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = open(&(0x7f0000000140)='.\x00', 0x0, 0x112) getdents(r2, &(0x7f0000001fc0)=""/184, 0xb8) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCXONC(r3, 0x540a, 0x0) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0x4, 0x14a}}) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000040)={0x4, 0x211000, 0xefcb, 0x7ea, 0xb2, "35969809006e24a75f6d80732e5e6c31c267a0", 0x5, 0x200008}) ioctl$TIOCL_PASTESEL(r3, 0x541c, &(0x7f0000000000)) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) mount$9p_fd(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000003c0)={0x0, 0x2, 0x7fff, 0xffff}) 3.16949901s ago: executing program 6 (id=971): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, 0x0, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r4, &(0x7f0000000140)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4db, @local, 0x3}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) 2.900059889s ago: executing program 5 (id=972): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) 2.838362381s ago: executing program 7 (id=973): r0 = socket$xdp(0x2c, 0x3, 0x0) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000f40)={0x1c, 0x3, &(0x7f0000000cc0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2560, 0x0, 0x0, 0x0, 0x5}}, &(0x7f0000000dc0)='syzkaller\x00', 0x10, 0xa, &(0x7f0000000e00)=""/10, 0x41100, 0x11, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000e80)={0x3, 0x9, 0x9, 0x6}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x3, &(0x7f0000000ec0)=[0x1, 0x1], &(0x7f0000000f00)=[{0x4, 0x1, 0xf, 0x9}, {0x3, 0x3, 0x10, 0x6}, {0x1, 0x2, 0x3, 0xb}], 0x10, 0x1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xe0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000000)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080), 0x0, 0xb2, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000100), &(0x7f0000000140), 0x8, 0x20, 0x8, 0x8, &(0x7f0000000180)}}, 0x10) bind$xdp(r0, &(0x7f0000000300)={0x2c, 0x0, r2, 0xa}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x1c, &(0x7f0000000040), 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000580)=@o_path={&(0x7f0000000540)='./file0\x00', 0x0, 0x4018, r0}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000540)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}]}, 0x44}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r6 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f00000002c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) 2.822519941s ago: executing program 4 (id=974): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f0000000000)=0x1) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)=ANY=[@ANYBLOB], 0x50}}, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000300), 0x40100001, 0x189002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000003c0)=@abs, 0x76) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r6, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) connect$llc(r6, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x80, 0x3, @local}, 0x10) r7 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r7, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) r8 = socket$inet_udp(0x2, 0x2, 0x0) close_range(r8, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000680)={&(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000180), 0x4}) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x2f, 0xf3, 0x2, 0x8, 0x722, 0x6, 0x7, 0x7f, 0x27, 0x20, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) 1.88942179s ago: executing program 6 (id=975): accept4(0xffffffffffffffff, 0x0, 0x0, 0x40000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_script(r1, 0x0, 0xb) splice(r3, 0x0, r1, 0x0, 0x1000, 0x0) splice(r0, 0x0, r4, 0x0, 0x80, 0x0) 1.882797581s ago: executing program 7 (id=976): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet(0x2, 0x3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf5c5d000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000400)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r0, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1.748216065s ago: executing program 4 (id=977): openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$ptp0(0xffffff9c, 0x0, 0x200, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000840)='./file0\x00', 0x2, &(0x7f0000000180)={[{@jqfmt_vfsold}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x4000000}}, {@orlov}, {@noload}, {@delalloc}, {@mblk_io_submit}, {@commit}, {@grpquota}, {@nogrpid}, {@init_itable_val={'init_itable', 0x3d, 0xfff}}]}, 0xfa, 0x477, &(0x7f0000001380)="$eJzs3M9vFFUcAPDvTH/w21bEHyBIFY3EHy0tP+TgRaMJB01M9IDxVNtCKgs1tCZCiFYPeDQk3o3/hfGkF6NeNPGqd0NCDBdQL2tmZwaWZbfd0m0X2M8nme57M6/73ndm3u6bebsbQM8ayf4kEVsj4o+IGMqztxYYyR+uX70w9c/VC1NJVKtv/53Uyl27emGqLFr+35Y8U60W+Q1N6r34XsRkpTJztsiPLZz+cGz+3PkXZ09Pnpw5OXNm4ujRQwf3DB6ZONyROLO4ru36ZG73zmPvXnpz6vil939O0sjjjoY4OmUk37tNPdPpyrpsW1066a/fsvfXm+lmZwLd1BcR2eEaqPX/oeiLTTe2DcXrn3e1ccCaqlar1SVelRerwH0siW63AOiO8o0+u/4tl3UaetwVrrySXwBlcV8vlnxLf6R5Yu9Aw/Xt1g7WPxIRxxf//TpbYo3uQwAA1Ps+G/+80Gz8l8YjeWIw+/NAMYcyHBEPRsT2iHgoInZExMMRtbKPRsRjK6y/cYbk9vFPevmOg2tDNv57uZjbunX8l5ZFhvuK3LZa/APJidnKzIFin+yPgQ0nZpOZ8SXq+OG1379sta1+/JctWf3lWLBox+X+hht005MLk6uJud6VzyJ29TeLP4lyGieJiJ0RsesO65h9rr/ltuXjX0Lrp21b9ZuIZ/PjvxgN8ZeSlvOT4y8dmTg8tjEqMwfGyrPidr/8dvGtVvWvKv4OyI7/5qbn/434h5ONEfPnzp+qzdfOr+jps64TF//8ouU1TRF/1r3aOf+PbSvO/8HkndqKwWLDx5MLC2fHIwaTN25fP3Hz2cp8WT6Lf/++5v1/e9zcE49HxO6I2BMRT2QXhUXbn4yIpyJi3xI74adXn/5gmfibHP/1mSvN4p9e7vhH/fFfeaLv1I/fLR//xohodfwP1VL7izXtvP6128DV7DsAAAC4V+SfgU/S0RvpNB0dzT/DvyM2p5W5+YXnT8x9dGY6n/cejoG0vNM1VHc/dLy4N1zmJxryB4v7xl/1barlR6fmKtPdDh563JYW/T/zV1+3WwesuQ7MowH3KP0fepf+D70p0f+hp+n/0Lua9f9PW5Ye/XZNGwOsK+//0Lva6P+L+UPrUQFwb/L+D71L/4ee1PK78emqvvK/7on/it8zvFvac/8nIr0rmnH/J/rb/jGLFSSqQ3n/z9ZsaFqm269MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnfF/AAAA//8Qi+Nc") symlinkat(&(0x7f0000000140)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f00000000c0)=ANY=[], 0x1, 0x25e, &(0x7f0000000540)="$eJzs2s9rHGUYB/BnktTUlHQj/mxBfNGDelmanD00SArigqCNUAXp1Ex0ybgbMktgRWxOCp569uRZPHoTpEcvufgXeNBTLjn2II4km7RpTI0Sshv087nsA+98ed935mV4WGbrtTufrCxPxHLei7Esi7GrsRH3spiJsdi3Ea++fOOn59+58d6b863WwtspXZu/PjuXUrr4wo/vf/bdi3d7F979/uIPk7E588HW9tyvm89sXtr64/rH7Sq1q9Tp9lKebnW7vfxWWaSlx6qVZkp3yiKvitTuVMXaQ+PLZXd1tZ/yztL01OpaUVUp7/TTStFPvW7qrfVT/lHe7qRms5mmp4KTWPz2Xl3Hdn3uZtR1/fg3ceFuTP8SjcieSNmTV7Onb2bPbmSXtuu6Meqlcio8//+3ybj/Uj8fUX65vri+OPgdjM8vRzvKKOJKRPweO8dkz6C+9kZr4UraNRNflLf38rfXF8d381/t52ejETNH52cH+fRwfjKmDs4/F4146q/538ZbC3NH5s/HKy8dyDejET9/GN0oYyl2sg/m/3w2pdffah3KX969DgDgv6aZ7juyf2s2HzU+yB/oDxvH9IeH+quJuDwx2r0TUfU/XcnLslgbSrFzpoY11zFFtncDjr/4ubGTzbX/R9rIt/yo4uuzsYxTKsb3bv9ZWc/fFef+0YEcTjGiFxJD9eChj3olAAAAAAAAAAAA/BuHPvprnMZnkqPeIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLb9GQAA//9gLMXu") r1 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000080)={r2, 0x0, {0x0, 0x0, 0x0, 0x4000040000004, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xa]}}) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}}, @NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x378b5ec3}]}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_FLAGS={0x6, 0x3, 0x1, 0x0, 0x1}, @NFTA_QUEUE_NUM={0x6, 0x1, 0x1, 0x0, 0x17}]}}}]}]}], {0x14}}, 0xc0}}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) rename(&(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001900)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000006280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newtaction={0x68, 0x30, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x0, 0x2, 0x0, 0xfffffffe}, 0x2}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) 420.942257ms ago: executing program 7 (id=978): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xa, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = io_uring_setup(0x77d0, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x200040b4) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040057}, 0x240008c4) 0s ago: executing program 0 (id=979): accept4(0xffffffffffffffff, 0x0, 0x0, 0x40000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_script(r1, 0x0, 0xb) splice(r3, 0x0, r1, 0x0, 0x1000, 0x0) splice(r0, 0x0, r4, 0x0, 0x80, 0x0) kernel console output (not intermixed with test programs): e from 0 to 40427 [ 97.678616][ T5020] F2FS-fs (loop4): Unrecognized mount option "age_extent_cache" or missing value [ 98.292516][ T154] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 98.492248][ T154] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 98.504642][ T154] EXT4-fs (loop0): This should not happen!! Data will be lost [ 98.504642][ T154] [ 98.515449][ T154] EXT4-fs (loop0): Total free blocks count 0 [ 98.521581][ T154] EXT4-fs (loop0): Free/Dirty block details [ 98.527657][ T154] EXT4-fs (loop0): free_blocks=2415919504 [ 98.533470][ T154] EXT4-fs (loop0): dirty_blocks=3856 [ 98.547416][ T154] EXT4-fs (loop0): Block reservation details [ 98.553804][ T154] EXT4-fs (loop0): i_reserved_data_blocks=241 [ 98.610964][ T9] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 2048 with error 28 [ 98.641780][ T9] EXT4-fs (loop0): This should not happen!! Data will be lost [ 98.641780][ T9] [ 100.519054][ T5056] loop5: detected capacity change from 0 to 7 [ 100.555596][ T5056] Dev loop5: unable to read RDB block 7 [ 100.561226][ T5056] loop5: unable to read partition table [ 100.566915][ T5056] loop5: partition table beyond EOD, truncated [ 100.573117][ T5056] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 100.949924][ T5074] bond0: option mode: unable to set because the bond device has slaves [ 100.964828][ T5071] loop0: detected capacity change from 0 to 2048 [ 100.982876][ T5074] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 100.991343][ T5039] loop4: detected capacity change from 0 to 40427 [ 101.069766][ T5039] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 101.090473][ T5039] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 101.107887][ T5071] EXT4-fs (loop0): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 101.240573][ T5039] F2FS-fs (loop4): invalid crc value [ 101.554603][ T5039] F2FS-fs (loop4): Found nat_bits in checkpoint [ 101.794942][ T4362] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 101.961090][ T5094] loop5: detected capacity change from 0 to 40427 [ 101.972254][ T4362] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 101.984826][ T4362] EXT4-fs (loop0): This should not happen!! Data will be lost [ 101.984826][ T4362] [ 101.994577][ T5094] F2FS-fs (loop5): Unrecognized mount option "age_extent_cache" or missing value [ 102.013750][ T4362] EXT4-fs (loop0): Total free blocks count 0 [ 102.036187][ T4362] EXT4-fs (loop0): Free/Dirty block details [ 102.052084][ T4362] EXT4-fs (loop0): free_blocks=2415919504 [ 102.064609][ T4362] EXT4-fs (loop0): dirty_blocks=3856 [ 102.180112][ T4362] EXT4-fs (loop0): Block reservation details [ 102.269114][ T4362] EXT4-fs (loop0): i_reserved_data_blocks=241 [ 102.291531][ T4241] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 2048 with error 28 [ 102.356814][ T4241] EXT4-fs (loop0): This should not happen!! Data will be lost [ 102.356814][ T4241] [ 102.909926][ T4203] Bluetooth: hci4: hcon ffff88807ad8e000 sent 1 < count 10 [ 102.918527][ T4203] Bluetooth: hci4: hcon ffff88807ad8a000 sent 1 < count 16 [ 102.925768][ T4203] Bluetooth: hci4: hcon ffff88807ad8a000 sent 0 < count 5 [ 102.933642][ T4203] Bluetooth: hci4: hcon ffff88807ad8a000 sent 0 < count 23552 [ 102.956149][ T5120] qnx6: unable to read the first superblock [ 105.205522][ T5144] loop5: detected capacity change from 0 to 2048 [ 105.251077][ T5144] EXT4-fs (loop5): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 105.257187][ T4265] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 105.547167][ T4265] usb 3-1: Using ep0 maxpacket: 16 [ 105.667236][ T4265] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 105.675202][ T4265] usb 3-1: can't read configurations, error -71 [ 106.376556][ T5175] loop4: detected capacity change from 0 to 40427 [ 106.401161][ T5175] F2FS-fs (loop4): Unrecognized mount option "age_extent_cache" or missing value [ 106.807259][ T4363] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 106.842803][ T5143] loop0: detected capacity change from 0 to 40427 [ 106.870950][ T4272] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 106.976764][ T4272] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 106.992103][ T5143] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 107.000007][ T4272] EXT4-fs (loop5): This should not happen!! Data will be lost [ 107.000007][ T4272] [ 107.000032][ T4272] EXT4-fs (loop5): Total free blocks count 0 [ 107.000047][ T4272] EXT4-fs (loop5): Free/Dirty block details [ 107.000059][ T4272] EXT4-fs (loop5): free_blocks=2415919504 [ 107.000074][ T4272] EXT4-fs (loop5): dirty_blocks=3264 [ 107.000094][ T4272] EXT4-fs (loop5): Block reservation details [ 107.000105][ T4272] EXT4-fs (loop5): i_reserved_data_blocks=204 [ 107.025248][ T4272] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 2048 with error 28 [ 107.176793][ T5143] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 107.668584][ T4272] EXT4-fs (loop5): This should not happen!! Data will be lost [ 107.668584][ T4272] [ 107.689347][ T5143] F2FS-fs (loop0): invalid crc value [ 107.726364][ T5143] F2FS-fs (loop0): Found nat_bits in checkpoint [ 107.738407][ T4363] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 107.768390][ T4363] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.800404][ T4363] usb 4-1: config 0 descriptor?? [ 107.855348][ T4363] pwc: Samsung MPC-C10 USB webcam detected. [ 107.936931][ T5143] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 107.996939][ T5143] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 108.059405][ T4363] pwc: send_video_command error -71 [ 108.066265][ T5219] bond1: option mode: unable to set because the bond device has slaves [ 108.074600][ T4363] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 108.104233][ T4363] Philips webcam: probe of 4-1:0.0 failed with error -71 [ 108.124872][ T4363] usb 4-1: USB disconnect, device number 6 [ 108.170627][ T5219] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 108.227262][ T4195] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 108.497281][ T4195] usb 5-1: Using ep0 maxpacket: 16 [ 108.629974][ T4195] usb 5-1: config index 0 descriptor too short (expected 37359, got 202) [ 108.642088][ T4195] usb 5-1: config 33 has too many interfaces: 95, using maximum allowed: 32 [ 108.661166][ T4195] usb 5-1: config 33 has an invalid descriptor of length 0, skipping remainder of the config [ 108.683000][ T4195] usb 5-1: config 33 has 1 interface, different from the descriptor's value: 95 [ 108.693192][ T4363] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 108.877292][ T4195] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 108.891758][ T4195] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.912117][ T4195] usb 5-1: Product: syz [ 108.924788][ T4195] usb 5-1: Manufacturer: syz [ 108.936678][ T4195] usb 5-1: SerialNumber: syz [ 109.089142][ T4363] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 109.106306][ T4363] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.141365][ T4363] usb 4-1: config 0 descriptor?? [ 109.212693][ T4363] pwc: Samsung MPC-C10 USB webcam detected. [ 109.287361][ T4195] usb 5-1: 0:2 : does not exist [ 109.358712][ T4195] usb 5-1: USB disconnect, device number 8 [ 109.727513][ T4363] pwc: recv_control_msg error -32 req 02 val 2b00 [ 109.777155][ T4363] pwc: recv_control_msg error -32 req 02 val 2700 [ 109.787573][ T5275] loop2: detected capacity change from 0 to 2048 [ 109.817412][ T4363] pwc: recv_control_msg error -32 req 04 val 1700 [ 109.852640][ T5275] EXT4-fs (loop2): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 109.868536][ T4363] pwc: recv_control_msg error -32 req 02 val 2c00 [ 109.971823][ T4363] pwc: recv_control_msg error -32 req 04 val 1000 [ 110.109899][ T4363] pwc: recv_control_msg error -32 req 04 val 1300 [ 110.157216][ T4363] pwc: recv_control_msg error -32 req 04 val 1400 [ 110.165476][ T4241] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 110.215033][ T4241] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 110.228448][ T4241] EXT4-fs (loop2): This should not happen!! Data will be lost [ 110.228448][ T4241] [ 110.237392][ T4363] pwc: recv_control_msg error -32 req 02 val 2000 [ 110.246142][ T4241] EXT4-fs (loop2): Total free blocks count 0 [ 110.255804][ T4241] EXT4-fs (loop2): Free/Dirty block details [ 110.266357][ T4241] EXT4-fs (loop2): free_blocks=2415919504 [ 110.276093][ T4241] EXT4-fs (loop2): dirty_blocks=3856 [ 110.286216][ T4241] EXT4-fs (loop2): Block reservation details [ 110.287186][ T4363] pwc: recv_control_msg error -71 req 02 val 2100 [ 110.296475][ T4241] EXT4-fs (loop2): i_reserved_data_blocks=241 [ 110.333644][ T4241] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 2048 with error 28 [ 110.347268][ T4363] pwc: recv_control_msg error -71 req 02 val 2200 [ 110.367676][ T4363] pwc: recv_control_msg error -71 req 06 val 0600 [ 110.376747][ T5282] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 110.390543][ T4241] EXT4-fs (loop2): This should not happen!! Data will be lost [ 110.390543][ T4241] [ 110.403683][ T5282] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 110.492349][ T4363] pwc: recv_control_msg error -71 req 04 val 1500 [ 110.520787][ T4363] pwc: recv_control_msg error -71 req 02 val 2500 [ 111.627030][ C0] sched: RT throttling activated [ 111.661939][ T4363] pwc: recv_control_msg error -71 req 02 val 2400 [ 111.714704][ T4363] pwc: recv_control_msg error -71 req 02 val 2600 [ 111.999529][ T5297] fuse: Unknown parameter 'grou00000000000000000000' [ 112.036117][ T4363] pwc: recv_control_msg error -71 req 02 val 2900 [ 112.087222][ T4363] pwc: recv_control_msg error -71 req 02 val 2800 [ 112.107605][ T4363] pwc: recv_control_msg error -71 req 04 val 1100 [ 112.157216][ T4363] pwc: recv_control_msg error -71 req 04 val 1200 [ 112.205507][ T4363] pwc: Registered as video103. [ 112.453993][ T5314] loop2: detected capacity change from 0 to 40427 [ 112.654553][ T4363] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input8 [ 112.677233][ T5314] F2FS-fs (loop2): Unrecognized mount option "age_extent_cache" or missing value [ 113.131342][ T4363] usb 4-1: USB disconnect, device number 7 [ 113.296656][ T5332] loop3: detected capacity change from 0 to 2048 [ 113.525460][ T5332] EXT4-fs (loop3): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 113.839858][ T4265] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 114.051282][ T5344] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 114.059248][ T5344] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 114.268200][ T4284] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 114.303496][ T4284] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 114.316338][ T4284] EXT4-fs (loop3): This should not happen!! Data will be lost [ 114.316338][ T4284] [ 114.842412][ T4284] EXT4-fs (loop3): Total free blocks count 0 [ 114.882438][ T4284] EXT4-fs (loop3): Free/Dirty block details [ 115.619227][ T4284] EXT4-fs (loop3): free_blocks=2415919504 [ 115.625001][ T4284] EXT4-fs (loop3): dirty_blocks=3856 [ 115.647297][ T4284] EXT4-fs (loop3): Block reservation details [ 115.672328][ T4265] usb 5-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 115.684150][ T4284] EXT4-fs (loop3): i_reserved_data_blocks=241 [ 115.690646][ T4265] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.707592][ T4265] usb 5-1: config 0 descriptor?? [ 115.749311][ T4241] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 2048 with error 28 [ 115.776547][ T4265] pwc: Samsung MPC-C10 USB webcam detected. [ 115.846308][ T5372] loop2: detected capacity change from 0 to 40427 [ 115.854641][ T4241] EXT4-fs (loop3): This should not happen!! Data will be lost [ 115.854641][ T4241] [ 115.905811][ T5372] F2FS-fs (loop2): Unrecognized mount option "age_extent_cache" or missing value [ 115.992527][ T4265] pwc: send_video_command error -71 [ 116.541296][ T4265] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 116.557183][ T4265] Philips webcam: probe of 5-1:0.0 failed with error -71 [ 116.568139][ T4265] usb 5-1: USB disconnect, device number 9 [ 116.771790][ T5387] loop5: detected capacity change from 0 to 7 [ 116.780852][ T5387] Dev loop5: unable to read RDB block 7 [ 116.786425][ T5387] loop5: unable to read partition table [ 116.793258][ T5387] loop5: partition table beyond EOD, truncated [ 116.799475][ T5387] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 116.906686][ T5397] loop0: detected capacity change from 0 to 2048 [ 116.957090][ T4265] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 117.096608][ T5397] EXT4-fs (loop0): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 117.590525][ T154] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 117.997317][ T154] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 118.038078][ T154] EXT4-fs (loop0): This should not happen!! Data will be lost [ 118.038078][ T154] [ 118.123720][ T154] EXT4-fs (loop0): Total free blocks count 0 [ 118.156402][ T154] EXT4-fs (loop0): Free/Dirty block details [ 118.213277][ T154] EXT4-fs (loop0): free_blocks=2415919504 [ 118.251025][ T154] EXT4-fs (loop0): dirty_blocks=3856 [ 118.287054][ T154] EXT4-fs (loop0): Block reservation details [ 118.313461][ T154] EXT4-fs (loop0): i_reserved_data_blocks=241 [ 118.388561][ T154] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 2048 with error 28 [ 118.442195][ T154] EXT4-fs (loop0): This should not happen!! Data will be lost [ 118.442195][ T154] [ 119.021021][ T5423] loop5: detected capacity change from 0 to 40427 [ 119.135033][ T5423] F2FS-fs (loop5): Unrecognized mount option "age_extent_cache" or missing value [ 119.759516][ T5432] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 119.848349][ T5432] bond1: (slave lo): Enslaving as an active interface with an up link [ 119.873624][ T5432] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 120.279881][ T5452] loop2: detected capacity change from 0 to 2048 [ 120.574042][ T5452] EXT4-fs (loop2): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 120.748322][ T154] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 120.770249][ T154] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 120.783093][ T154] EXT4-fs (loop2): This should not happen!! Data will be lost [ 120.783093][ T154] [ 120.793517][ T154] EXT4-fs (loop2): Total free blocks count 0 [ 120.800018][ T154] EXT4-fs (loop2): Free/Dirty block details [ 120.806900][ T154] EXT4-fs (loop2): free_blocks=2415919504 [ 120.813171][ T154] EXT4-fs (loop2): dirty_blocks=3856 [ 120.818769][ T154] EXT4-fs (loop2): Block reservation details [ 120.824921][ T154] EXT4-fs (loop2): i_reserved_data_blocks=241 [ 120.836704][ T4284] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 2048 with error 28 [ 120.853479][ T4284] EXT4-fs (loop2): This should not happen!! Data will be lost [ 120.853479][ T4284] [ 122.633166][ T5467] loop3: detected capacity change from 0 to 40427 [ 122.667361][ T5467] F2FS-fs (loop3): Unrecognized mount option "age_extent_cache" or missing value [ 123.505204][ T5489] loop3: detected capacity change from 0 to 2048 [ 124.306255][ T5491] Set syz1 is full, maxelem 65536 reached [ 124.358034][ T5489] EXT4-fs (loop3): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 124.641210][ T9] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 124.684180][ T9] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 124.727367][ T9] EXT4-fs (loop3): This should not happen!! Data will be lost [ 124.727367][ T9] [ 124.766496][ T9] EXT4-fs (loop3): Total free blocks count 0 [ 124.790367][ T9] EXT4-fs (loop3): Free/Dirty block details [ 124.796400][ T9] EXT4-fs (loop3): free_blocks=2415919504 [ 124.832460][ T9] EXT4-fs (loop3): dirty_blocks=3424 [ 124.852984][ T9] EXT4-fs (loop3): Block reservation details [ 124.874784][ T9] EXT4-fs (loop3): i_reserved_data_blocks=214 [ 124.902180][ T9] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 2048 with error 28 [ 124.951144][ T9] EXT4-fs (loop3): This should not happen!! Data will be lost [ 124.951144][ T9] [ 125.833125][ T5513] loop3: detected capacity change from 0 to 40427 [ 126.017636][ T5513] F2FS-fs (loop3): Unrecognized mount option "age_extent_cache" or missing value [ 127.486393][ T5535] loop3: detected capacity change from 0 to 2048 [ 127.664343][ T5535] EXT4-fs (loop3): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 127.867163][ T4195] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 128.143566][ T4195] usb 3-1: Using ep0 maxpacket: 16 [ 128.277380][ T4195] usb 3-1: config index 0 descriptor too short (expected 37359, got 202) [ 128.297572][ T4195] usb 3-1: config 33 has too many interfaces: 95, using maximum allowed: 32 [ 128.320368][ T4195] usb 3-1: config 33 has an invalid descriptor of length 0, skipping remainder of the config [ 128.341088][ T4195] usb 3-1: config 33 has 1 interface, different from the descriptor's value: 95 [ 128.567303][ T4195] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 128.585220][ T4195] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.611026][ T4195] usb 3-1: Product: syz [ 128.620622][ T4195] usb 3-1: Manufacturer: syz [ 128.635693][ T4195] usb 3-1: SerialNumber: syz [ 128.998443][ T4195] usb 3-1: 0:2 : does not exist [ 129.035538][ T4195] usb 3-1: USB disconnect, device number 8 [ 129.055256][ T4273] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 129.079991][ T4180] udevd[4180]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:33.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 129.099827][ T4273] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 129.106773][ T5563] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 129.120713][ T4273] EXT4-fs (loop3): This should not happen!! Data will be lost [ 129.120713][ T4273] [ 129.137129][ T5563] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 129.145164][ T4273] EXT4-fs (loop3): Total free blocks count 0 [ 129.163049][ T4273] EXT4-fs (loop3): Free/Dirty block details [ 129.175531][ T4273] EXT4-fs (loop3): free_blocks=2415919504 [ 129.181808][ T4273] EXT4-fs (loop3): dirty_blocks=688 [ 129.192632][ T4273] EXT4-fs (loop3): Block reservation details [ 129.199547][ T4273] EXT4-fs (loop3): i_reserved_data_blocks=43 [ 129.207284][ T4273] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 663 with error 28 [ 129.229000][ T4273] EXT4-fs (loop3): This should not happen!! Data will be lost [ 129.229000][ T4273] [ 129.537888][ T5567] loop4: detected capacity change from 0 to 40427 [ 129.677186][ T5567] F2FS-fs (loop4): Unrecognized mount option "age_extent_cache" or missing value [ 132.534607][ T5595] loop2: detected capacity change from 0 to 2048 [ 132.583940][ T5593] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 132.638406][ T5593] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 132.689296][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.695762][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.022468][ T5595] EXT4-fs (loop2): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 133.259086][ T5610] loop3: detected capacity change from 0 to 40427 [ 133.364652][ T5608] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 133.400336][ T5610] F2FS-fs (loop3): Unrecognized mount option "age_extent_cache" or missing value [ 133.946844][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.954290][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.300959][ T5596] device bridge_slave_0 left promiscuous mode [ 134.327099][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.287426][ T5596] device bridge_slave_1 left promiscuous mode [ 135.293684][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.360993][ T5596] bond0: (slave bond_slave_0): Releasing backup interface [ 135.396233][ T5596] bond0: (slave bond_slave_1): Releasing backup interface [ 135.443017][ T5596] team0: Port device team_slave_0 removed [ 135.482792][ T5596] team0: Port device team_slave_1 removed [ 135.513485][ T5596] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 135.532652][ T5596] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 135.556476][ T5596] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 135.596039][ T5596] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 137.590833][ T5596] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.596453][ T1170] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 137.616147][ T5596] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.625168][ T1170] EXT4-fs (loop2): This should not happen!! Data will be lost [ 137.625168][ T1170] [ 137.639048][ T5596] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.648853][ T5596] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.658019][ T1170] EXT4-fs (loop2): Total free blocks count 0 [ 137.664117][ T1170] EXT4-fs (loop2): Free/Dirty block details [ 137.675023][ T1170] EXT4-fs (loop2): free_blocks=2415919504 [ 137.684986][ T1170] EXT4-fs (loop2): dirty_blocks=592 [ 137.690303][ T1170] EXT4-fs (loop2): Block reservation details [ 137.696303][ T1170] EXT4-fs (loop2): i_reserved_data_blocks=37 [ 137.709389][ T154] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 561 with error 28 [ 137.743507][ T154] EXT4-fs (loop2): This should not happen!! Data will be lost [ 137.743507][ T154] [ 137.878191][ T5641] Zero length message leads to an empty skb [ 138.174818][ T5647] loop5: detected capacity change from 0 to 40427 [ 138.409804][ T5647] F2FS-fs (loop5): Unrecognized mount option "age_extent_cache" or missing value [ 138.531538][ T5663] fuse: Bad value for 'user_id' [ 141.109198][ T5694] loop4: detected capacity change from 0 to 40427 [ 141.236175][ T5694] F2FS-fs (loop4): Unrecognized mount option "age_extent_cache" or missing value [ 141.660073][ T4203] Bluetooth: hci0: hcon ffff888019dd6000 sent 1 < count 10 [ 141.667782][ T4203] Bluetooth: hci0: hcon ffff8880197d0000 sent 1 < count 16 [ 141.675112][ T4203] Bluetooth: hci0: hcon ffff8880197d0000 sent 0 < count 5 [ 141.682949][ T4203] Bluetooth: hci0: hcon ffff8880197d0000 sent 0 < count 23552 [ 141.696897][ T5705] qnx6: unable to read the first superblock [ 142.588398][ T5707] fuse: Bad value for 'fd' [ 145.796780][ T5722] fuse: Bad value for 'fd' [ 145.846208][ T5686] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.854034][ T5686] bridge0: port 1(bridge_slave_0) entered disabled state [ 146.103804][ T5732] loop5: detected capacity change from 0 to 512 [ 146.358146][ T5732] EXT4-fs (loop5): Ignoring removed orlov option [ 146.364737][ T5732] EXT4-fs (loop5): Ignoring removed mblk_io_submit option [ 146.434447][ T5732] EXT4-fs error (device loop5): ext4_iget_extra_inode:4573: inode #15: comm syz.5.337: corrupted in-inode xattr [ 147.638083][ T5686] device bridge_slave_0 left promiscuous mode [ 147.647239][ T5686] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.862201][ T5686] device bridge_slave_1 left promiscuous mode [ 147.870155][ T5686] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.089536][ T5686] bond0: (slave bond_slave_0): Releasing backup interface [ 148.261245][ T5686] bond0: (slave bond_slave_1): Releasing backup interface [ 148.528320][ T5686] team0: Port device team_slave_0 removed [ 148.753978][ T5686] team0: Port device team_slave_1 removed [ 148.771931][ T5686] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 148.893251][ T5686] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 149.034067][ T5686] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 149.061136][ T5732] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz.5.337: couldn't read orphan inode 15 (err -117) [ 149.087754][ T5732] EXT4-fs (loop5): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 149.120146][ T5686] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 149.549944][ T5686] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.564379][ T5686] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.575456][ T5686] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.589855][ T5686] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.028343][ T5750] loop0: detected capacity change from 0 to 40427 [ 150.182928][ T5750] F2FS-fs (loop0): Unrecognized mount option "age_extent_cache" or missing value [ 150.288571][ T5762] loop5: detected capacity change from 0 to 8 [ 150.353131][ T5762] MTD: Attempt to mount non-MTD device "/dev/loop5" [ 150.386156][ T5762] cramfs: empty filesystem [ 150.929284][ T4330] udevd[4330]: incorrect cramfs checksum on /dev/loop5 [ 151.156980][ T5774] loop5: detected capacity change from 0 to 512 [ 151.613458][ T5774] EXT4-fs (loop5): Ignoring removed orlov option [ 151.620112][ T5774] EXT4-fs (loop5): Ignoring removed mblk_io_submit option [ 151.838334][ T4236] usb 1-1: new full-speed USB device number 5 using dummy_hcd [ 152.775894][ T5781] bond0: (slave lo): Releasing backup interface [ 153.426117][ T5781] bond0: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 153.465228][ T5774] EXT4-fs error (device loop5): ext4_iget_extra_inode:4573: inode #15: comm syz.5.348: corrupted in-inode xattr [ 153.478237][ T4236] usb 1-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 153.488019][ T5774] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz.5.348: couldn't read orphan inode 15 (err -117) [ 153.502254][ T4236] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.577770][ T5774] EXT4-fs (loop5): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 153.631055][ T4236] usb 1-1: config 0 descriptor?? [ 153.688880][ T4236] pwc: Samsung MPC-C10 USB webcam detected. [ 153.897209][ T4236] pwc: send_video_command error -71 [ 153.903692][ T4236] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 153.918212][ T4236] Philips webcam: probe of 1-1:0.0 failed with error -71 [ 153.938849][ T4236] usb 1-1: USB disconnect, device number 5 [ 154.447167][ T4236] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 154.508574][ T5781] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.517599][ T5781] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.526497][ T5781] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.536178][ T5781] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 154.894151][ T5803] loop4: detected capacity change from 0 to 40427 [ 154.947878][ T4236] usb 1-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 155.453425][ T4236] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.483697][ T4236] usb 1-1: config 0 descriptor?? [ 155.491629][ T5803] F2FS-fs (loop4): Unrecognized mount option "age_extent_cache" or missing value [ 155.610165][ T4236] usb 1-1: can't set config #0, error -71 [ 156.056532][ T4236] usb 1-1: USB disconnect, device number 6 [ 156.113995][ T5815] loop2: detected capacity change from 0 to 2048 [ 156.186332][ T5815] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 158.541642][ T5845] binder: 5840:5845 ioctl f507 0 returned -22 [ 159.744746][ T5859] loop2: detected capacity change from 0 to 40427 [ 159.752491][ T4275] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 159.796029][ T5859] F2FS-fs (loop2): Unrecognized mount option "age_extent_cache" or missing value [ 160.107221][ T4275] usb 6-1: Using ep0 maxpacket: 16 [ 160.227865][ T4275] usb 6-1: config index 0 descriptor too short (expected 37359, got 202) [ 160.569792][ T4236] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 160.577129][ T4275] usb 6-1: config 33 has too many interfaces: 95, using maximum allowed: 32 [ 160.711722][ T4275] usb 6-1: config 33 has an invalid descriptor of length 0, skipping remainder of the config [ 160.817609][ T4275] usb 6-1: config 33 has 1 interface, different from the descriptor's value: 95 [ 160.835637][ T5869] loop3: detected capacity change from 0 to 2048 [ 160.899172][ T5869] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 162.836045][ T4275] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 162.846764][ T4275] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.854872][ T4275] usb 6-1: Product: syz [ 162.859537][ T4275] usb 6-1: Manufacturer: syz [ 162.865046][ T4275] usb 6-1: SerialNumber: syz [ 162.977212][ T4236] usb 1-1: device descriptor read/all, error -71 [ 163.237754][ T4275] usb 6-1: 0:2 : does not exist [ 163.267132][ T5621] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 163.306459][ T4275] usb 6-1: USB disconnect, device number 2 [ 163.637288][ T5621] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 163.740747][ T5899] loop0: detected capacity change from 0 to 512 [ 163.796945][ T5899] EXT4-fs (loop0): Ignoring removed orlov option [ 163.803549][ T5899] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 165.031294][ T5899] EXT4-fs error (device loop0): ext4_iget_extra_inode:4573: inode #15: comm syz.0.383: corrupted in-inode xattr [ 165.044727][ T5899] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.383: couldn't read orphan inode 15 (err -117) [ 165.058891][ T5899] EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 165.072536][ T5621] usb 4-1: config 0 has no interface number 0 [ 165.521690][ T5910] loop4: detected capacity change from 0 to 2364 [ 165.914341][ T5621] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 165.925561][ T5621] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.933739][ T5621] usb 4-1: Product: syz [ 165.937959][ T5621] usb 4-1: Manufacturer: syz [ 165.942554][ T5621] usb 4-1: SerialNumber: syz [ 165.950143][ T5621] usb 4-1: config 0 descriptor?? [ 165.994564][ T5621] usb 4-1: can't set config #0, error -71 [ 166.007287][ T5621] usb 4-1: USB disconnect, device number 8 [ 166.671431][ T4236] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 167.477339][ T4236] usb 3-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 167.491479][ T4236] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.546120][ T5939] loop3: detected capacity change from 0 to 512 [ 167.608575][ T5939] EXT4-fs (loop3): Ignoring removed orlov option [ 167.615160][ T5939] EXT4-fs (loop3): Ignoring removed mblk_io_submit option [ 167.829057][ T5939] EXT4-fs error (device loop3): ext4_iget_extra_inode:4573: inode #15: comm syz.3.396: corrupted in-inode xattr [ 167.843705][ T5939] EXT4-fs error (device loop3): ext4_orphan_get:1411: comm syz.3.396: couldn't read orphan inode 15 (err -117) [ 167.857693][ T5939] EXT4-fs (loop3): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 167.993453][ T4236] usb 3-1: config 0 descriptor?? [ 168.137345][ T4236] pwc: Samsung MPC-C10 USB webcam detected. [ 168.327711][ T4236] pwc: send_video_command error -71 [ 168.333655][ T4236] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 168.406929][ T4236] Philips webcam: probe of 3-1:0.0 failed with error -71 [ 168.460115][ T4236] usb 3-1: USB disconnect, device number 9 [ 168.942286][ T4236] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 169.330362][ T5962] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.339176][ T5962] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.390664][ T5962] loop0: detected capacity change from 0 to 2364 [ 169.627142][ T4236] usb 3-1: unable to read config index 0 descriptor/all [ 169.634195][ T21] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 169.644347][ T4236] usb 3-1: can't read configurations, error -71 [ 169.697072][ T4232] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 170.567226][ T21] usb 4-1: config 0 has an invalid interface number: 147 but max is 0 [ 170.577397][ T4232] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 170.582199][ T21] usb 4-1: config 0 has no interface number 0 [ 170.601859][ T21] usb 4-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 170.612687][ T4232] usb 6-1: config 0 has no interface number 0 [ 170.759627][ T5977] loop0: detected capacity change from 0 to 512 [ 170.797174][ T4232] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 170.817462][ T21] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 170.837809][ T5977] EXT4-fs (loop0): Ignoring removed orlov option [ 170.844345][ T5977] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 171.343205][ T5977] EXT4-fs error (device loop0): ext4_iget_extra_inode:4573: inode #15: comm syz.0.407: corrupted in-inode xattr [ 171.356648][ T5977] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.407: couldn't read orphan inode 15 (err -117) [ 171.371051][ T5977] EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 171.683376][ T4232] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.691625][ T4232] usb 6-1: Product: syz [ 171.695896][ T4232] usb 6-1: Manufacturer: syz [ 171.700544][ T4232] usb 6-1: SerialNumber: syz [ 171.706311][ T21] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.708730][ T4232] usb 6-1: config 0 descriptor?? [ 171.854613][ T21] usb 4-1: Product: syz [ 171.862637][ T21] usb 4-1: Manufacturer: syz [ 171.869881][ T21] usb 4-1: SerialNumber: syz [ 171.876706][ T21] usb 4-1: config 0 descriptor?? [ 171.919813][ T5958] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 172.000594][ T21] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 172.399265][ T4232] usb 6-1: dvb_usb_v2: found a 'E3C EC168 reference design' in cold state [ 172.474302][ T4232] usb 6-1: Direct firmware load for dvb-usb-ec168.fw failed with error -2 [ 172.497185][ T154] usb 4-1: Failed to submit usb control message: -71 [ 172.504348][ T154] usb 4-1: unable to send the bmi data to the device: -71 [ 172.528176][ T4232] usb 6-1: Falling back to sysfs fallback for: dvb-usb-ec168.fw [ 172.541993][ T154] usb 4-1: unable to get target info from device [ 172.589772][ T154] usb 4-1: could not get target info (-71) [ 172.596056][ T154] usb 4-1: could not probe fw (-71) [ 172.606508][ T5621] usb 4-1: USB disconnect, device number 9 [ 173.097583][ T6007] loop5: detected capacity change from 0 to 7 [ 173.112545][ T6007] Dev loop5: unable to read RDB block 7 [ 173.118450][ T6007] loop5: unable to read partition table [ 173.124649][ T6007] loop5: partition table beyond EOD, truncated [ 173.131098][ T6007] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 174.773042][ T6009] bond1: (slave lo): Releasing backup interface [ 174.820263][ T6009] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 174.950786][ T6023] loop2: detected capacity change from 0 to 512 [ 175.008273][ T6023] EXT4-fs (loop2): Ignoring removed orlov option [ 175.014812][ T6023] EXT4-fs (loop2): Ignoring removed mblk_io_submit option [ 175.737139][ T5621] Bluetooth: hci0: command 0x0406 tx timeout [ 176.089031][ T21] Bluetooth: hci2: command 0x0406 tx timeout [ 176.110721][ T6023] EXT4-fs error (device loop2): ext4_iget_extra_inode:4573: inode #15: comm syz.2.420: corrupted in-inode xattr [ 176.124013][ T6023] EXT4-fs error (device loop2): ext4_orphan_get:1411: comm syz.2.420: couldn't read orphan inode 15 (err -117) [ 176.139058][ T6023] EXT4-fs (loop2): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 176.260024][ T21] Bluetooth: hci1: command 0x0406 tx timeout [ 176.493677][ T5621] Bluetooth: hci3: command 0x0406 tx timeout [ 177.263850][ T6009] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.271300][ T6009] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.458635][ T1325] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 178.595351][ T6009] device bridge_slave_0 left promiscuous mode [ 178.603445][ T6009] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.663643][ T6009] device bridge_slave_1 left promiscuous mode [ 178.687648][ T6009] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.728084][ T6009] bond0: (slave bond_slave_0): Releasing backup interface [ 178.767241][ T6009] bond0: (slave bond_slave_1): Releasing backup interface [ 178.830481][ T6009] team0: Port device team_slave_0 removed [ 178.869007][ T6009] team0: Port device team_slave_1 removed [ 178.895882][ T6009] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 178.897399][ T1325] usb 5-1: config 0 has an invalid interface number: 147 but max is 0 [ 178.922315][ T1325] usb 5-1: config 0 has no interface number 0 [ 178.929949][ T6009] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 178.942619][ T1325] usb 5-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 178.955603][ T6009] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 178.985552][ T6009] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 179.137281][ T1325] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 179.154053][ T1325] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.162885][ T1325] usb 5-1: Product: syz [ 179.167696][ T1325] usb 5-1: Manufacturer: syz [ 179.172390][ T1325] usb 5-1: SerialNumber: syz [ 179.189859][ T1325] usb 5-1: config 0 descriptor?? [ 179.213706][ T6036] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 179.267807][ T1325] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 179.340853][ T6009] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.349980][ T6009] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.360000][ T6009] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.369175][ T6009] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 179.502178][ T6045] device syzkaller1 entered promiscuous mode [ 179.716183][ T4193] Bluetooth: hci0: hcon ffff888019dd6000 sent 0 < count 10 [ 179.723950][ T4193] Bluetooth: hci0: hcon ffff8880197d0000 sent 0 < count 16 [ 179.731602][ T4193] Bluetooth: hci0: hcon ffff8880197d0000 sent 0 < count 5 [ 179.739067][ T4193] Bluetooth: hci0: hcon ffff8880197d0000 sent 0 < count 23552 [ 179.758652][ T6054] qnx6: unable to read the first superblock [ 180.308672][ T154] usb 5-1: Failed to submit usb control message: -110 [ 180.621819][ T154] usb 5-1: unable to send the bmi data to the device: -110 [ 180.684309][ T154] usb 5-1: unable to get target info from device [ 180.710564][ T154] usb 5-1: could not get target info (-110) [ 180.735222][ T154] usb 5-1: could not probe fw (-110) [ 180.937602][ T4275] usb 5-1: USB disconnect, device number 11 [ 181.695543][ T6078] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 181.849236][ T6082] loop3: detected capacity change from 0 to 512 [ 182.010708][ T6082] EXT4-fs (loop3): Ignoring removed orlov option [ 182.017363][ T6082] EXT4-fs (loop3): Ignoring removed mblk_io_submit option [ 182.384403][ T6082] EXT4-fs error (device loop3): ext4_iget_extra_inode:4573: inode #15: comm syz.3.437: corrupted in-inode xattr [ 182.399851][ T6082] EXT4-fs error (device loop3): ext4_orphan_get:1411: comm syz.3.437: couldn't read orphan inode 15 (err -117) [ 182.413021][ T6082] EXT4-fs (loop3): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 183.632860][ T6095] loop2: detected capacity change from 0 to 2364 [ 188.426084][ T6118] loop0: detected capacity change from 0 to 512 [ 188.524780][ T6118] EXT4-fs (loop0): Ignoring removed orlov option [ 188.532456][ T6118] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 188.606463][ T6118] EXT4-fs error (device loop0): ext4_iget_extra_inode:4573: inode #15: comm syz.0.448: corrupted in-inode xattr [ 188.621791][ T6118] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.448: couldn't read orphan inode 15 (err -117) [ 188.636035][ T6118] EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 191.559918][ T1202] block nbd0: Attempted send on invalid socket [ 191.566727][ T1202] blk_update_request: I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 191.581510][ T6144] SQUASHFS error: Failed to read block 0x0: -5 [ 191.588168][ T6144] unable to read squashfs_super_block [ 191.830545][ T6146] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 191.868926][ T6146] bond0: (slave lo): Enslaving as an active interface with an up link [ 191.927123][ T4275] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 191.975825][ T6146] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 192.607769][ T4275] usb 3-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 192.630646][ T4275] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 192.985071][ T4275] usb 3-1: config 0 descriptor?? [ 193.069191][ T4275] pwc: Samsung MPC-C10 USB webcam detected. [ 193.677131][ T4275] pwc: send_video_command error -71 [ 193.697972][ T6169] loop5: detected capacity change from 0 to 512 [ 193.878941][ T6169] EXT4-fs (loop5): Ignoring removed orlov option [ 193.885496][ T6169] EXT4-fs (loop5): Ignoring removed mblk_io_submit option [ 194.719047][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.729465][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.957167][ T4275] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 195.076668][ T6178] device syzkaller0 entered promiscuous mode [ 195.422736][ T4275] Philips webcam: probe of 3-1:0.0 failed with error -71 [ 195.431917][ T4275] usb 3-1: USB disconnect, device number 12 [ 195.455531][ T6169] EXT4-fs error (device loop5): ext4_iget_extra_inode:4573: inode #15: comm syz.5.460: corrupted in-inode xattr [ 195.499026][ T6169] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz.5.460: couldn't read orphan inode 15 (err -117) [ 195.511927][ T6169] EXT4-fs (loop5): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 196.767141][ T4275] Bluetooth: hci4: command 0x0406 tx timeout [ 197.539015][ T6223] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 198.035473][ T1202] block nbd3: Attempted send on invalid socket [ 198.041788][ T1202] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 198.055363][ T6234] SQUASHFS error: Failed to read block 0x0: -5 [ 198.062068][ T6234] unable to read squashfs_super_block [ 198.595517][ T6229] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 198.607762][ T6229] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 199.019207][ T6240] loop3: detected capacity change from 0 to 512 [ 201.419022][ T6240] EXT4-fs (loop3): Ignoring removed orlov option [ 201.460202][ T6240] EXT4-fs (loop3): Ignoring removed mblk_io_submit option [ 201.537027][ T6240] EXT4-fs error (device loop3): ext4_iget_extra_inode:4573: inode #15: comm syz.3.481: corrupted in-inode xattr [ 201.601506][ T6240] EXT4-fs error (device loop3): ext4_orphan_get:1411: comm syz.3.481: couldn't read orphan inode 15 (err -117) [ 201.677662][ T6240] EXT4-fs (loop3): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 201.702904][ C0] vkms_vblank_simulate: vblank timer overrun [ 205.578064][ T150] block nbd2: Attempted send on invalid socket [ 205.584390][ T150] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 205.595707][ T6299] SQUASHFS error: Failed to read block 0x0: -5 [ 205.846086][ T6299] unable to read squashfs_super_block [ 206.071152][ T6304] loop5: detected capacity change from 0 to 512 [ 206.129780][ T6304] EXT4-fs (loop5): Ignoring removed orlov option [ 206.136362][ T6304] EXT4-fs (loop5): Ignoring removed mblk_io_submit option [ 206.186347][ T6304] EXT4-fs error (device loop5): ext4_iget_extra_inode:4573: inode #15: comm syz.5.498: corrupted in-inode xattr [ 206.200115][ T6304] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz.5.498: couldn't read orphan inode 15 (err -117) [ 206.213732][ T6304] EXT4-fs (loop5): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 206.239208][ C0] vkms_vblank_simulate: vblank timer overrun [ 206.916572][ T1202] block nbd4: Attempted send on invalid socket [ 206.922928][ T1202] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 206.934230][ T6314] SQUASHFS error: Failed to read block 0x0: -5 [ 206.940763][ T6314] unable to read squashfs_super_block [ 211.891696][ T6359] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 211.915521][ T6359] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 214.241733][ T6379] loop2: detected capacity change from 0 to 40427 [ 214.329079][ T6379] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 214.337035][ T6379] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 214.427833][ T6379] F2FS-fs (loop2): invalid crc value [ 214.447340][ T6379] F2FS-fs (loop2): Found nat_bits in checkpoint [ 215.280660][ T6379] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 215.287835][ T6379] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 218.893155][ T6415] fuse: Unknown parameter 'user_i00000000000000000000' [ 222.723417][ T150] block nbd5: Attempted send on invalid socket [ 222.731641][ T150] blk_update_request: I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 222.745022][ T6456] SQUASHFS error: Failed to read block 0x0: -5 [ 222.751437][ T6456] unable to read squashfs_super_block [ 223.581945][ T6467] fuse: Unknown parameter 'user_i00000000000000000000' [ 224.784174][ T6483] loop0: detected capacity change from 0 to 2364 [ 226.056072][ T6486] loop2: detected capacity change from 0 to 40427 [ 226.102738][ T6486] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 226.110832][ T6486] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 226.127661][ T6486] F2FS-fs (loop2): invalid crc value [ 226.377722][ T150] block nbd4: Attempted send on invalid socket [ 226.384020][ T150] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 226.396708][ T6494] SQUASHFS error: Failed to read block 0x0: -5 [ 226.403064][ T6494] unable to read squashfs_super_block [ 226.966988][ T6486] F2FS-fs (loop2): Found nat_bits in checkpoint [ 227.091606][ T6486] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 227.098760][ T6486] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 227.252622][ T6496] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 227.317264][ T6496] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 229.314431][ T6507] netlink: 28 bytes leftover after parsing attributes in process `syz.4.549'. [ 229.513189][ T6514] fuse: Unknown parameter 'user_id00000000000000000000' [ 229.596220][ T6517] binder: 6516:6517 ioctl f507 0 returned -22 [ 229.825911][ T6525] loop5: detected capacity change from 0 to 7 [ 229.834623][ T6525] Dev loop5: unable to read RDB block 7 [ 229.840672][ T6525] loop5: unable to read partition table [ 229.846429][ T6525] loop5: partition table beyond EOD, truncated [ 229.852637][ T6525] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 229.929457][ T1202] block nbd5: Attempted send on invalid socket [ 229.935750][ T1202] blk_update_request: I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 229.949179][ T6529] SQUASHFS error: Failed to read block 0x0: -5 [ 229.955451][ T6529] unable to read squashfs_super_block [ 231.255112][ T6536] loop4: detected capacity change from 0 to 40427 [ 231.309695][ T6536] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 231.318021][ T6536] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 231.336876][ T6536] F2FS-fs (loop4): invalid crc value [ 231.535932][ T6536] F2FS-fs (loop4): Found nat_bits in checkpoint [ 231.632499][ T1202] block nbd0: Attempted send on invalid socket [ 231.639605][ T1202] blk_update_request: I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 231.651879][ T6557] SQUASHFS error: Failed to read block 0x0: -5 [ 231.658311][ T6557] unable to read squashfs_super_block [ 232.013337][ T6536] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 232.020533][ T6536] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 232.254087][ T1202] block nbd2: Attempted send on invalid socket [ 232.260581][ T1202] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 232.272954][ T6560] SQUASHFS error: Failed to read block 0x0: -5 [ 232.304459][ T6560] unable to read squashfs_super_block [ 233.651663][ T6572] fuse: Unknown parameter 'user_id00000000000000000000' [ 233.941273][ T6576] binder: 6574:6576 ioctl f507 0 returned -22 [ 234.900859][ T6602] netlink: 28 bytes leftover after parsing attributes in process `syz.3.573'. [ 235.097752][ T4232] usb 6-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-ec168.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 236.604353][ T6607] loop5: detected capacity change from 0 to 7 [ 236.614637][ T6607] Dev loop5: unable to read RDB block 7 [ 236.620339][ T6607] loop5: unable to read partition table [ 236.626023][ T6607] loop5: partition table beyond EOD, truncated [ 236.632553][ T6607] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 236.688083][ T4232] dvb_usb_ec168: probe of 6-1:0.1 failed with error -110 [ 236.856097][ T4232] usb 6-1: USB disconnect, device number 3 [ 237.409554][ T6620] loop0: detected capacity change from 0 to 40427 [ 237.777778][ T6628] Cannot find map_set index 135 as target [ 237.909134][ T6620] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 237.917187][ T6620] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 237.948503][ T6620] F2FS-fs (loop0): invalid crc value [ 238.012878][ T6620] F2FS-fs (loop0): Found nat_bits in checkpoint [ 238.057453][ T6620] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 238.064726][ T6620] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 238.193030][ T6634] fuse: Unknown parameter 'user_id00000000000000000000' [ 239.883346][ T6654] binder: 6653:6654 ioctl f507 0 returned -22 [ 240.186252][ T6660] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 240.432345][ T6660] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 241.825479][ T6677] loop2: detected capacity change from 0 to 40427 [ 241.850027][ T6682] loop3: detected capacity change from 0 to 2364 [ 242.433701][ T6684] fuse: Bad value for 'fd' [ 242.506262][ T6677] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 242.514218][ T6677] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 242.532504][ T6677] F2FS-fs (loop2): invalid crc value [ 243.044260][ T6677] F2FS-fs (loop2): Found nat_bits in checkpoint [ 243.113233][ T6677] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 243.120551][ T6677] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 245.622239][ T6716] loop5: detected capacity change from 0 to 7 [ 245.649456][ T6716] Dev loop5: unable to read RDB block 7 [ 245.655210][ T6716] loop5: unable to read partition table [ 245.661057][ T6716] loop5: partition table beyond EOD, truncated [ 245.667777][ T6716] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 249.003425][ T6733] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 249.048891][ T6733] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 249.313895][ T6737] loop4: detected capacity change from 0 to 40427 [ 249.380700][ T6737] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 249.388780][ T6737] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 249.400198][ T6737] F2FS-fs (loop4): invalid crc value [ 249.474828][ T6737] F2FS-fs (loop4): Found nat_bits in checkpoint [ 249.563797][ T6737] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 249.571161][ T6737] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 249.747200][ T1325] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 251.113761][ T1325] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 251.149399][ T1325] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 56128, setting to 64 [ 251.160874][ T1325] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 23 [ 251.247258][ T1325] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 251.261530][ T1325] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 251.292420][ T1325] usb 3-1: SerialNumber: syz [ 251.317872][ T6743] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 251.337820][ T1325] hub 3-1:1.0: bad descriptor, ignoring hub [ 251.355407][ T1325] hub: probe of 3-1:1.0 failed with error -5 [ 251.362242][ T1325] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 251.814703][ T6762] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 252.903870][ T6779] loop5: detected capacity change from 0 to 7 [ 252.911325][ T1325] cdc_acm 3-1:1.0: ttyACM0: USB ACM device [ 252.923228][ T6779] Dev loop5: unable to read RDB block 7 [ 252.928903][ T6779] loop5: unable to read partition table [ 252.934687][ T6779] loop5: partition table beyond EOD, truncated [ 252.940869][ T6779] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 253.673883][ T1325] usb 3-1: USB disconnect, device number 13 [ 253.930618][ T150] block nbd4: Attempted send on invalid socket [ 253.937089][ T150] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 253.948956][ T6789] SQUASHFS error: Failed to read block 0x0: -5 [ 253.955255][ T6789] unable to read squashfs_super_block [ 254.519976][ T6790] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 254.651131][ T6790] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 254.666035][ T6796] fuse: Bad value for 'fd' [ 255.593288][ T6802] loop2: detected capacity change from 0 to 40427 [ 255.600960][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.607322][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.809039][ T150] block nbd4: Attempted send on invalid socket [ 255.815244][ T150] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 255.826435][ T6804] SQUASHFS error: Failed to read block 0x0: -5 [ 255.832676][ T6804] unable to read squashfs_super_block [ 255.950078][ T6802] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 255.957935][ T6802] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 255.977413][ T6802] F2FS-fs (loop2): invalid crc value [ 256.025572][ T6802] F2FS-fs (loop2): Found nat_bits in checkpoint [ 256.073315][ T6802] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 256.080572][ T6802] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 257.577245][ T1325] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 258.100404][ T6831] netlink: 28 bytes leftover after parsing attributes in process `syz.0.629'. [ 258.317272][ T1325] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 258.328615][ T1325] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 56128, setting to 64 [ 258.345631][ T1325] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 23 [ 258.465836][ T6841] fuse: Unknown parameter '0x0000000000000003' [ 258.652987][ T1325] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 258.662829][ T1325] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 258.709132][ T1325] usb 5-1: SerialNumber: syz [ 258.740985][ T6824] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 259.019645][ T1325] hub 5-1:1.0: bad descriptor, ignoring hub [ 259.025694][ T1325] hub: probe of 5-1:1.0 failed with error -5 [ 259.032345][ T1325] cdc_acm 5-1:1.0: Control and data interfaces are not separated! [ 259.696696][ T6856] netlink: 28 bytes leftover after parsing attributes in process `syz.4.626'. [ 261.906155][ T6863] loop5: detected capacity change from 0 to 40427 [ 261.989159][ T6863] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 261.997376][ T6863] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 262.007281][ T6863] F2FS-fs (loop5): invalid crc value [ 262.038135][ T1325] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 262.073172][ T6863] F2FS-fs (loop5): Found nat_bits in checkpoint [ 262.103973][ T6863] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 262.111109][ T6863] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 262.204789][ T1325] usb 5-1: USB disconnect, device number 12 [ 264.264956][ T6891] fuse: Unknown parameter '0x0000000000000003' [ 266.798298][ T6921] loop4: detected capacity change from 0 to 40427 [ 266.870168][ T6921] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 266.878007][ T6921] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 266.899398][ T6921] F2FS-fs (loop4): invalid crc value [ 266.946272][ T6925] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 266.970956][ T6921] F2FS-fs (loop4): Found nat_bits in checkpoint [ 267.011311][ T6929] loop3: detected capacity change from 0 to 2364 [ 267.021614][ T6925] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 267.039424][ T6921] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 267.046535][ T6921] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 268.553846][ T6943] fuse: Unknown parameter '0x0000000000000003' [ 268.787035][ T1325] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 269.957353][ T1325] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 270.348943][ T1325] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 270.507262][ T1325] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 271.595666][ T1325] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 271.634936][ T1325] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 271.677916][ T1325] usb 3-1: config 0 descriptor?? [ 271.698593][ T1325] usb 3-1: can't set config #0, error -71 [ 271.717783][ T1325] usb 3-1: USB disconnect, device number 14 [ 271.846387][ T4195] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 272.320595][ T6968] loop0: detected capacity change from 0 to 40427 [ 272.381416][ T6968] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 272.390178][ T6968] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 272.409227][ T6968] F2FS-fs (loop0): invalid crc value [ 272.423542][ T6973] netlink: 28 bytes leftover after parsing attributes in process `syz.3.666'. [ 272.447437][ T4195] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 272.462417][ T4195] usb 6-1: config 0 has no interface number 0 [ 272.481011][ T6968] F2FS-fs (loop0): Found nat_bits in checkpoint [ 272.543747][ T6968] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 272.550983][ T6968] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 272.702002][ T6985] fuse: Unknown parameter '0x0000000000000003' [ 272.757387][ T4195] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 272.781992][ T4195] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.870727][ T4195] usb 6-1: Product: syz [ 272.894923][ T4195] usb 6-1: Manufacturer: syz [ 272.922854][ T4195] usb 6-1: SerialNumber: syz [ 273.137104][ T4195] usb 6-1: config 0 descriptor?? [ 273.429216][ T6989] binder: 6987:6989 ioctl f507 0 returned -22 [ 273.457213][ T4195] usb 6-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 273.527678][ T4195] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 273.593224][ T4195] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 273.602825][ T4195] usb 6-1: media controller created [ 273.619553][ T4195] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 274.082647][ T1202] block nbd2: Attempted send on invalid socket [ 274.089344][ T1202] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 274.305330][ T6997] SQUASHFS error: Failed to read block 0x0: -5 [ 274.311818][ T6997] unable to read squashfs_super_block [ 275.308871][ T4195] usb 6-1: USB disconnect, device number 4 [ 276.855356][ T4237] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 276.896296][ T7021] fuse: Unknown parameter '0x0000000000000003' [ 277.113959][ T7022] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 277.214059][ T7025] loop5: detected capacity change from 0 to 40427 [ 277.261804][ T7025] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 277.269755][ T7025] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 277.280179][ T7025] F2FS-fs (loop5): invalid crc value [ 277.298121][ T7022] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 277.378991][ T4237] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 277.383269][ T7025] F2FS-fs (loop5): Found nat_bits in checkpoint [ 277.390346][ T4237] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 277.439983][ T4237] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 277.480691][ T7025] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 277.488025][ T7025] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 278.687362][ T4237] usb 4-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 279.148985][ T7042] binder: 7041:7042 ioctl f507 0 returned -22 [ 279.157166][ T4237] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 279.205810][ T4237] usb 4-1: Product: syz [ 279.210360][ T4237] usb 4-1: Manufacturer: syz [ 279.214969][ T4237] usb 4-1: SerialNumber: syz [ 279.225114][ T7047] Cannot find map_set index 135 as target [ 279.239997][ T4237] usb 4-1: config 0 descriptor?? [ 279.257180][ T4237] usb 4-1: can't set config #0, error -71 [ 279.288719][ T4237] usb 4-1: USB disconnect, device number 10 [ 283.922468][ T7084] loop3: detected capacity change from 0 to 40427 [ 284.020751][ T7084] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 284.028595][ T7084] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 284.039846][ T7084] F2FS-fs (loop3): invalid crc value [ 284.127890][ T7084] F2FS-fs (loop3): Found nat_bits in checkpoint [ 284.340539][ T150] block nbd0: Attempted send on invalid socket [ 284.346842][ T150] blk_update_request: I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 284.358611][ T7095] SQUASHFS error: Failed to read block 0x0: -5 [ 284.364803][ T7095] unable to read squashfs_super_block [ 284.399462][ T7084] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 284.406529][ T7084] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 287.279804][ T7111] loop2: detected capacity change from 0 to 2048 [ 287.307362][ T7112] binder: 7109:7112 ioctl f507 0 returned -22 [ 287.567744][ T7111] EXT4-fs (loop2): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 289.162193][ T4232] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 292.107093][ T4232] usb 1-1: device descriptor read/all, error -71 [ 292.166220][ T7148] input: syz1 as /devices/virtual/input/input9 [ 293.637440][ T4274] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 294.576436][ T4274] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 294.832423][ T7159] loop3: detected capacity change from 0 to 40427 [ 294.976071][ T7162] binder: 7155:7162 ioctl f507 0 returned -22 [ 294.992168][ T4274] EXT4-fs (loop2): This should not happen!! Data will be lost [ 294.992168][ T4274] [ 295.057050][ T7159] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12 [ 295.065076][ T7159] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 295.074749][ T7159] F2FS-fs (loop3): invalid crc value [ 295.105007][ T4274] EXT4-fs (loop2): Total free blocks count 0 [ 295.151276][ T4274] EXT4-fs (loop2): Free/Dirty block details [ 295.194713][ T7159] F2FS-fs (loop3): Found nat_bits in checkpoint [ 295.228478][ T4274] EXT4-fs (loop2): free_blocks=2415919504 [ 295.229091][ T7159] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0 [ 295.241639][ T7159] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 295.288054][ T4274] EXT4-fs (loop2): dirty_blocks=3856 [ 295.293483][ T4274] EXT4-fs (loop2): Block reservation details [ 296.323609][ T4274] EXT4-fs (loop2): i_reserved_data_blocks=241 [ 296.382275][ T4274] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 65793 with max blocks 2048 with error 28 [ 296.466917][ T4274] EXT4-fs (loop2): This should not happen!! Data will be lost [ 296.466917][ T4274] [ 296.597108][ T4232] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 296.630079][ T7157] chnl_net:caif_netlink_parms(): no params data found [ 296.667297][ T4195] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 296.788160][ T7191] input: syz1 as /devices/virtual/input/input10 [ 297.027179][ T4232] usb 1-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 297.036378][ T4232] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.077702][ T4195] usb 5-1: unable to get BOS descriptor or descriptor too short [ 297.122585][ T1325] Bluetooth: hci5: command 0x0409 tx timeout [ 297.157841][ T4195] usb 5-1: not running at top speed; connect to a high speed hub [ 297.367982][ T4195] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 120, changing to 4 [ 297.493423][ T7157] bridge0: port 1(bridge_slave_0) entered blocking state [ 297.588014][ T7157] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.657930][ T4195] usb 5-1: New USB device found, idVendor=0b05, idProduct=1743, bcdDevice= 0.40 [ 297.710236][ T4195] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.731317][ T7157] device bridge_slave_0 entered promiscuous mode [ 297.806099][ T4195] usb 5-1: Product: syz [ 297.852661][ T7157] bridge0: port 2(bridge_slave_1) entered blocking state [ 297.865914][ T4195] usb 5-1: Manufacturer: syz [ 297.904501][ T4195] usb 5-1: SerialNumber: syz [ 297.921228][ T7157] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.064343][ T4232] usb 1-1: config 0 descriptor?? [ 298.077768][ T7157] device bridge_slave_1 entered promiscuous mode [ 298.119027][ T4232] pwc: Samsung MPC-C10 USB webcam detected. [ 298.175902][ T7157] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 298.279635][ T4195] usb 5-1: 1:1 : unknown format tag 0x5 is detected. processed as MPEG. [ 299.661927][ T4195] usb 5-1: found format II with max.bitrate = 512, frame size=4095 [ 299.670254][ T4195] usb 5-1: 1:1 : unknown format tag 0x5 is detected. processed as MPEG. [ 299.678798][ T4195] usb 5-1: found format II with max.bitrate = 512, frame size=4095 [ 299.691656][ T21] Bluetooth: hci5: command 0x041b tx timeout [ 299.747104][ T4195] usb 5-1: 2:1 : format type 65 is not supported yet [ 299.790730][ T7157] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 299.795857][ T4195] usb 5-1: USB disconnect, device number 13 [ 299.817279][ T4232] pwc: send_video_command error -71 [ 299.822886][ T4232] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 299.832823][ T4232] Philips webcam: probe of 1-1:0.0 failed with error -71 [ 299.908343][ T4232] usb 1-1: USB disconnect, device number 11 [ 300.515153][ T7157] team0: Port device team_slave_0 added [ 300.631643][ T4182] udevd[4182]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 300.886559][ T7215] input: syz1 as /devices/virtual/input/input11 [ 302.897781][ T7217] binder: 7207:7217 ioctl f507 0 returned -22 [ 302.978363][ T4236] Bluetooth: hci5: command 0x040f tx timeout [ 303.068831][ T7157] team0: Port device team_slave_1 added [ 303.209808][ T7157] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 303.218448][ T7157] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 303.245376][ T7157] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 303.346603][ T7157] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 303.373084][ T7157] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 303.646581][ T7225] loop4: detected capacity change from 0 to 40427 [ 303.696292][ T7157] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 303.750028][ T7225] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 303.758167][ T7225] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 303.774922][ T7225] F2FS-fs (loop4): invalid crc value [ 303.830636][ T7157] device hsr_slave_0 entered promiscuous mode [ 303.845086][ T7225] F2FS-fs (loop4): Found nat_bits in checkpoint [ 303.884011][ T7225] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 303.891419][ T7225] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 303.999253][ T7157] device hsr_slave_1 entered promiscuous mode [ 304.006194][ T7157] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 304.034040][ T7157] Cannot create hsr debugfs directory [ 305.116849][ T1325] Bluetooth: hci5: command 0x0419 tx timeout [ 305.311734][ T7157] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 305.351591][ T7157] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 305.399145][ T7157] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 305.441317][ T7157] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 305.568520][ T7247] loop5: detected capacity change from 0 to 7 [ 305.578764][ T7247] Dev loop5: unable to read RDB block 7 [ 305.584340][ T7247] loop5: unable to read partition table [ 305.590234][ T7247] loop5: partition table beyond EOD, truncated [ 305.596404][ T7247] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 305.693951][ T7157] 8021q: adding VLAN 0 to HW filter on device bond0 [ 305.801728][ T7157] 8021q: adding VLAN 0 to HW filter on device team0 [ 305.835995][ T7253] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 305.842973][ T7253] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 305.864700][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 305.957153][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 305.973621][ T7253] vhci_hcd vhci_hcd.0: Device attached [ 306.000074][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 306.032760][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 306.100613][ T4284] bridge0: port 1(bridge_slave_0) entered blocking state [ 306.107791][ T4284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 306.126000][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 306.156588][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 306.193006][ T4284] bridge0: port 2(bridge_slave_1) entered blocking state [ 306.200180][ T4284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 306.207711][ T7256] vhci_hcd: connection closed [ 306.214827][ T4274] vhci_hcd: stop threads [ 306.224141][ T4235] usb 42-1: SetAddress Request (2) to port 0 [ 306.225974][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 306.247465][ T4274] vhci_hcd: release socket [ 306.258807][ T4235] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 306.278732][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 306.302668][ T4274] vhci_hcd: disconnect device [ 306.503371][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 306.522480][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 306.618332][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 306.652119][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 307.312651][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 307.329094][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 307.358941][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 307.479674][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 307.491962][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 307.501498][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 308.318519][ T7157] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 308.567321][ T154] device hsr_slave_0 left promiscuous mode [ 308.576159][ T154] device hsr_slave_1 left promiscuous mode [ 308.638444][ T154] bond2 (unregistering): Released all slaves [ 308.726455][ T154] bond1 (unregistering): Released all slaves [ 308.984272][ T7290] binder: 7288:7290 ioctl f507 0 returned -22 [ 309.269044][ T154] bond0 (unregistering): Released all slaves [ 309.508323][ T7295] loop5: detected capacity change from 0 to 40427 [ 309.553441][ T7295] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12 [ 309.561437][ T7295] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 309.608725][ T7295] F2FS-fs (loop5): invalid crc value [ 309.861700][ T7295] F2FS-fs (loop5): Found nat_bits in checkpoint [ 309.974199][ T7295] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0 [ 309.981450][ T7295] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 310.621780][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 310.637191][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 310.702274][ T7157] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 311.327141][ T4235] usb 42-1: device descriptor read/8, error -110 [ 311.947126][ T4235] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 311.988323][ T7324] input: syz1 as /devices/virtual/input/input12 [ 313.537602][ T4235] usb usb42-port1: attempt power cycle [ 313.879723][ T4235] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 314.051693][ T7342] input: syz1 as /devices/virtual/input/input13 [ 314.227148][ T4235] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 315.464758][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 315.520991][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 315.555745][ T4235] usb usb42-port1: unable to enumerate USB device [ 315.595741][ T7157] device veth0_vlan entered promiscuous mode [ 315.603733][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 315.613321][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 315.632218][ T7157] device veth1_vlan entered promiscuous mode [ 315.647401][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 315.703944][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 315.784808][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 315.948720][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 316.352795][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 316.455212][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 317.009073][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.015519][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.779655][ T7157] device veth0_macvtap entered promiscuous mode [ 317.872637][ T7157] device veth1_macvtap entered promiscuous mode [ 317.994879][ T7157] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 318.057011][ T7157] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 318.165253][ T7361] input: syz1 as /devices/virtual/input/input14 [ 319.636554][ T7157] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 319.678738][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 319.716409][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 319.772921][ T7157] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 319.829780][ T7157] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 319.902638][ T7157] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 319.930499][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 319.952598][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 320.230456][ T7157] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.271696][ T7157] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.358973][ T7157] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.430985][ T7157] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 321.172206][ T7387] netlink: 12 bytes leftover after parsing attributes in process `syz.0.753'. [ 321.217707][ T7370] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 321.374237][ T7370] bond3: (slave lo): Enslaving as an active interface with an up link [ 321.383466][ T7370] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 322.186849][ T4235] Bluetooth: hci2: command 0x0409 tx timeout [ 323.317878][ T7399] input: syz1 as /devices/virtual/input/input15 [ 323.395491][ T7401] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 323.402047][ T7401] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 323.665026][ T7401] vhci_hcd vhci_hcd.0: Device attached [ 323.939303][ T4272] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 323.977241][ T4272] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 323.987360][ T4195] usb 44-1: SetAddress Request (2) to port 0 [ 323.993409][ T4195] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 324.022025][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 324.042693][ T7412] Cannot find map_set index 135 as target [ 325.128577][ T4275] Bluetooth: hci2: command 0x041b tx timeout [ 325.177454][ T4408] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 325.192397][ T4408] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 325.280650][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 325.308794][ T7402] vhci_hcd: connection reset by peer [ 325.316787][ T4284] vhci_hcd: stop threads [ 325.333941][ T4284] vhci_hcd: release socket [ 325.379449][ T7373] chnl_net:caif_netlink_parms(): no params data found [ 325.405921][ T4284] vhci_hcd: disconnect device [ 325.549480][ T7428] input: syz1 as /devices/virtual/input/input16 [ 325.895320][ T7431] overlayfs: failed to resolve './file1/file0': -2 [ 326.137078][ T4232] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 328.190642][ T4235] Bluetooth: hci2: command 0x040f tx timeout [ 328.247084][ T4232] usb 1-1: config 0 has an invalid interface number: 147 but max is 0 [ 328.255782][ T4232] usb 1-1: config 0 has no interface number 0 [ 328.299081][ T4232] usb 1-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 328.432117][ T7440] netlink: 12 bytes leftover after parsing attributes in process `syz.5.763'. [ 328.470500][ T7441] input: syz1 as /devices/virtual/input/input17 [ 329.087050][ T4195] usb 44-1: device descriptor read/8, error -110 [ 330.064722][ T7373] bridge0: port 1(bridge_slave_0) entered blocking state [ 330.157032][ T7373] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.206111][ T7373] device bridge_slave_0 entered promiscuous mode [ 330.213230][ T4275] Bluetooth: hci2: command 0x0419 tx timeout [ 330.319425][ T4195] usb usb44-port1: Cannot enable. Maybe the USB cable is bad? [ 330.329592][ T4195] usb usb44-port1: attempt power cycle [ 330.633166][ T7463] Cannot find del_set index 1 as target [ 330.893276][ T4195] usb usb44-port1: Cannot enable. Maybe the USB cable is bad? [ 331.679999][ T7373] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.726989][ T7373] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.735056][ T7373] device bridge_slave_1 entered promiscuous mode [ 332.017201][ T4195] usb usb44-port1: Cannot enable. Maybe the USB cable is bad? [ 332.036343][ T7373] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 332.055319][ T4195] usb usb44-port1: unable to enumerate USB device [ 332.091042][ T7373] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 332.277052][ T4232] usb 1-1: string descriptor 0 read error: -71 [ 332.283505][ T4232] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 332.294168][ T7483] input: syz1 as /devices/virtual/input/input18 [ 333.600758][ T7373] team0: Port device team_slave_0 added [ 334.112891][ T7489] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 334.119447][ T7489] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 334.220557][ T7489] vhci_hcd vhci_hcd.0: Device attached [ 334.257037][ T4232] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.267024][ T4232] usb 1-1: config 0 descriptor?? [ 334.287670][ T4232] usb 1-1: can't set config #0, error -71 [ 334.294627][ T4232] usb 1-1: USB disconnect, device number 12 [ 334.414281][ T7373] team0: Port device team_slave_1 added [ 334.468880][ T7491] vhci_hcd: connection closed [ 335.191221][ T4272] vhci_hcd: stop threads [ 335.243193][ T4272] vhci_hcd: release socket [ 335.263504][ T4272] vhci_hcd: disconnect device [ 335.276001][ T7373] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 335.303082][ T7373] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 335.431064][ T7373] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 336.232620][ T7373] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 336.325434][ T7509] input: syz1 as /devices/virtual/input/input19 [ 336.537476][ T7373] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 336.563865][ C1] vkms_vblank_simulate: vblank timer overrun [ 337.547411][ T7519] Cannot find map_set index 135 as target [ 337.635002][ T7516] input: syz1 as /devices/virtual/input/input20 [ 339.496652][ T7373] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 339.811412][ T7539] input: syz1 as /devices/virtual/input/input21 [ 340.085638][ T7373] device hsr_slave_0 entered promiscuous mode [ 340.251260][ T7373] device hsr_slave_1 entered promiscuous mode [ 340.411862][ T7373] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 340.509861][ T7373] Cannot create hsr debugfs directory [ 346.709290][ T7579] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 346.715849][ T7579] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 349.243369][ T7579] vhci_hcd vhci_hcd.0: Device attached [ 349.486988][ T7582] vhci_hcd: connection closed [ 349.520318][ T4408] vhci_hcd: stop threads [ 349.573432][ T4408] vhci_hcd: release socket [ 349.758168][ T4235] usb 46-1: SetAddress Request (2) to port 0 [ 349.925623][ T4408] vhci_hcd: disconnect device [ 350.269878][ T4235] usb 46-1: new SuperSpeed USB device number 2 using vhci_hcd [ 350.306945][ T7599] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 350.314877][ T7599] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 351.988695][ T7373] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 353.274560][ T7373] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 353.284756][ T7373] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 353.537013][ T5695] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 353.654161][ T7373] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 353.687999][ T7622] input: syz1 as /devices/virtual/input/input24 [ 355.327249][ T4235] usb 46-1: device descriptor read/8, error -110 [ 355.524638][ T5695] usb 1-1: device descriptor read/all, error -71 [ 356.312777][ T4235] usb usb46-port1: Cannot enable. Maybe the USB cable is bad? [ 356.357919][ T4235] usb usb46-port1: attempt power cycle [ 357.579296][ T4235] usb usb46-port1: Cannot enable. Maybe the USB cable is bad? [ 357.610190][ T7373] 8021q: adding VLAN 0 to HW filter on device bond0 [ 357.634805][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 357.643801][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 357.657535][ T7373] 8021q: adding VLAN 0 to HW filter on device team0 [ 358.479995][ T4235] usb usb46-port1: Cannot enable. Maybe the USB cable is bad? [ 358.487777][ T4235] usb usb46-port1: unable to enumerate USB device [ 358.567103][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 358.627663][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 358.688843][ T1170] bridge0: port 1(bridge_slave_0) entered blocking state [ 358.696303][ T1170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 358.943006][ T7671] loop6: detected capacity change from 0 to 512 [ 358.945492][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 358.958764][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 358.967375][ T1170] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.974669][ T1170] bridge0: port 2(bridge_slave_1) entered forwarding state [ 358.983161][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 358.992340][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 359.004641][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 359.095584][ T7671] EXT4-fs (loop6): Ignoring removed orlov option [ 359.136275][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 359.187294][ T7671] EXT4-fs (loop6): Ignoring removed mblk_io_submit option [ 359.212898][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 359.239144][ T7671] EXT4-fs error (device loop6): ext4_iget_extra_inode:4573: inode #15: comm syz.6.816: corrupted in-inode xattr [ 359.263337][ T7671] EXT4-fs error (device loop6): ext4_orphan_get:1411: comm syz.6.816: couldn't read orphan inode 15 (err -117) [ 359.282075][ T7671] EXT4-fs (loop6): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 359.307741][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 359.308432][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 359.458805][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 359.480620][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 359.502106][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 360.360543][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 360.451174][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 364.257600][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 364.286814][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 364.320851][ T7373] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 364.561967][ T154] device hsr_slave_0 left promiscuous mode [ 364.594832][ T154] device hsr_slave_1 left promiscuous mode [ 364.676006][ T154] bond1 (unregistering): Released all slaves [ 365.750402][ T154] bond0 (unregistering): (slave lo): Releasing backup interface [ 365.769152][ T154] bond0 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 365.781421][ T154] bond0 (unregistering): Released all slaves [ 369.243172][ T7759] loop4: detected capacity change from 0 to 512 [ 369.345098][ T7759] EXT4-fs (loop4): Ignoring removed orlov option [ 369.467003][ T7759] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 370.322036][ T7759] EXT4-fs error (device loop4): ext4_iget_extra_inode:4573: inode #15: comm syz.4.830: corrupted in-inode xattr [ 370.338470][ T7759] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.830: couldn't read orphan inode 15 (err -117) [ 370.442490][ T7759] EXT4-fs (loop4): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 370.744048][ T7770] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 370.758778][ T7770] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 375.857509][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 375.901491][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 376.100210][ T7829] loop0: detected capacity change from 0 to 512 [ 376.144285][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 376.158472][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 376.175640][ T7829] EXT4-fs (loop0): Ignoring removed orlov option [ 376.199867][ T7373] device veth0_vlan entered promiscuous mode [ 376.213090][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 376.221943][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 376.241112][ T7373] device veth1_vlan entered promiscuous mode [ 376.284694][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 377.204136][ T7829] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 377.265372][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 377.276137][ T7829] EXT4-fs error (device loop0): ext4_iget_extra_inode:4573: inode #15: comm syz.0.845: corrupted in-inode xattr [ 377.723621][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 378.277618][ T7829] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.845: couldn't read orphan inode 15 (err -117) [ 378.298311][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 378.343425][ T7829] EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 378.375442][ T7373] device veth0_macvtap entered promiscuous mode [ 378.386661][ T7373] device veth1_macvtap entered promiscuous mode [ 378.398062][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 378.440843][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 378.449467][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.455901][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.532150][ T7373] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 378.587539][ T7373] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.599581][ T7373] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 379.642183][ T7373] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.668677][ T7373] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 379.686234][ T4384] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 379.734815][ T4384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 379.779864][ T7373] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 379.822043][ T7373] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.849108][ T7373] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 379.889183][ T7373] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.943955][ T7373] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 379.987938][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 379.996658][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 381.202809][ T7879] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 381.215389][ T7863] chnl_net:caif_netlink_parms(): no params data found [ 381.237262][ T7879] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 381.779153][ T7891] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[7892] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[7891] [ 382.461375][ T4236] Bluetooth: hci3: command 0x0409 tx timeout [ 382.744485][ T7863] bridge0: port 1(bridge_slave_0) entered blocking state [ 382.789806][ T7863] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.855817][ T7905] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 383.708534][ T7863] device bridge_slave_0 entered promiscuous mode [ 383.863204][ T7863] bridge0: port 2(bridge_slave_1) entered blocking state [ 383.954425][ T7863] bridge0: port 2(bridge_slave_1) entered disabled state [ 384.021031][ T7863] device bridge_slave_1 entered promiscuous mode [ 384.128659][ T7863] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 384.183757][ T1325] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 384.253968][ T7863] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 384.567097][ T1325] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 385.227019][ T1325] usb 7-1: config 0 has no interface number 0 [ 385.242412][ T4232] Bluetooth: hci3: command 0x041b tx timeout [ 385.387225][ T1325] usb 7-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 385.410782][ T1325] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.468188][ T1325] usb 7-1: Product: syz [ 385.472555][ T1325] usb 7-1: Manufacturer: syz [ 385.477608][ T1325] usb 7-1: SerialNumber: syz [ 385.483144][ T7918] Cannot find del_set index 1 as target [ 385.494413][ T1325] usb 7-1: config 0 descriptor?? [ 386.374752][ T1325] usb 7-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 386.552102][ T7863] team0: Port device team_slave_0 added [ 386.616466][ T7923] loop4: detected capacity change from 0 to 512 [ 386.670239][ T1325] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 386.711381][ T1325] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 386.751668][ T1325] usb 7-1: media controller created [ 386.770353][ T7923] EXT4-fs (loop4): Ignoring removed orlov option [ 386.818480][ T1325] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 387.052276][ T7923] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 387.071238][ T7863] team0: Port device team_slave_1 added [ 387.102938][ T7923] EXT4-fs error (device loop4): ext4_iget_extra_inode:4573: inode #15: comm syz.4.863: corrupted in-inode xattr [ 387.125381][ T7923] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.863: couldn't read orphan inode 15 (err -117) [ 387.144392][ T7923] EXT4-fs (loop4): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 387.248488][ T7863] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 387.273677][ T7863] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 387.340279][ T4235] Bluetooth: hci3: command 0x040f tx timeout [ 387.353451][ T7863] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 387.413046][ T7863] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 387.426312][ T1325] usb 7-1: USB disconnect, device number 2 [ 387.557013][ T7863] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 387.596738][ T7863] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 388.536864][ T7863] device hsr_slave_0 entered promiscuous mode [ 388.591749][ T7863] device hsr_slave_1 entered promiscuous mode [ 388.696423][ T7863] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 388.769971][ T7863] Cannot create hsr debugfs directory [ 389.629012][ T4232] Bluetooth: hci3: command 0x0419 tx timeout [ 391.047002][ T4195] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 392.007167][ T4195] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 393.188651][ T7995] loop6: detected capacity change from 0 to 512 [ 393.205388][ T4195] usb 5-1: config 0 has no interface number 0 [ 393.240697][ T7995] EXT4-fs (loop6): Ignoring removed orlov option [ 393.247344][ T7995] EXT4-fs (loop6): Ignoring removed mblk_io_submit option [ 393.294561][ T7995] EXT4-fs error (device loop6): ext4_iget_extra_inode:4573: inode #15: comm syz.6.876: corrupted in-inode xattr [ 393.317384][ T7995] EXT4-fs error (device loop6): ext4_orphan_get:1411: comm syz.6.876: couldn't read orphan inode 15 (err -117) [ 393.334335][ T7995] EXT4-fs (loop6): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 393.377156][ T4195] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 393.426590][ T4195] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.478560][ T4195] usb 5-1: Product: syz [ 393.482794][ T4195] usb 5-1: Manufacturer: syz [ 393.524382][ T4195] usb 5-1: SerialNumber: syz [ 393.542426][ T4195] usb 5-1: config 0 descriptor?? [ 393.777052][ T4195] dvb_usb_ec168: probe of 5-1:0.1 failed with error -71 [ 393.801459][ T4195] usb 5-1: USB disconnect, device number 14 [ 394.147510][ T7863] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 394.183237][ T7863] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 394.221259][ T7863] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 395.112531][ T7863] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 395.807088][ T154] device hsr_slave_0 left promiscuous mode [ 395.823711][ T154] device hsr_slave_1 left promiscuous mode [ 395.894530][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 395.924888][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 397.284055][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 397.331676][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 397.394507][ T154] device bridge_slave_1 left promiscuous mode [ 397.457099][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 397.582980][ T8057] loop0: detected capacity change from 0 to 512 [ 397.716957][ T4236] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 398.816192][ T154] device bridge_slave_0 left promiscuous mode [ 398.822557][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 398.835739][ T154] device veth1_macvtap left promiscuous mode [ 398.841899][ T154] device veth0_macvtap left promiscuous mode [ 398.848398][ T154] device veth1_vlan left promiscuous mode [ 398.854850][ T154] device veth0_vlan left promiscuous mode [ 398.967160][ T8057] EXT4-fs (loop0): Ignoring removed orlov option [ 399.012729][ T8057] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 399.080221][ T8057] EXT4-fs error (device loop0): ext4_iget_extra_inode:4573: inode #15: comm syz.0.887: corrupted in-inode xattr [ 399.147396][ T8057] EXT4-fs error (device loop0): ext4_orphan_get:1411: comm syz.0.887: couldn't read orphan inode 15 (err -117) [ 399.167200][ T4236] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 399.175694][ T4236] usb 7-1: config 0 has no interface number 0 [ 399.226314][ T8057] EXT4-fs (loop0): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 399.251641][ C0] vkms_vblank_simulate: vblank timer overrun [ 399.349574][ T4236] usb 7-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 399.389083][ T4236] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.414584][ T4236] usb 7-1: Product: syz [ 399.423840][ T4236] usb 7-1: Manufacturer: syz [ 399.432303][ T4236] usb 7-1: SerialNumber: syz [ 399.439876][ T4236] usb 7-1: config 0 descriptor?? [ 399.455998][ T154] team0 (unregistering): Port device team_slave_1 removed [ 399.488355][ T154] team0 (unregistering): Port device team_slave_0 removed [ 399.506130][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 399.520059][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 399.579628][ T154] bond0 (unregistering): Released all slaves [ 399.687100][ T4236] usb 7-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 399.707884][ T4236] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 399.745896][ T4236] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 399.803492][ T7863] 8021q: adding VLAN 0 to HW filter on device bond0 [ 399.938875][ T4236] usb 7-1: media controller created [ 399.950885][ T7863] 8021q: adding VLAN 0 to HW filter on device team0 [ 399.965550][ T4236] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 400.031498][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 400.071571][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 400.512136][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 400.533594][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 400.553756][ T4273] bridge0: port 1(bridge_slave_0) entered blocking state [ 400.560923][ T4273] bridge0: port 1(bridge_slave_0) entered forwarding state [ 400.731417][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 400.761917][ T1325] usb 7-1: USB disconnect, device number 3 [ 400.895449][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 400.970694][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 401.853279][ T4284] bridge0: port 2(bridge_slave_1) entered blocking state [ 401.860421][ T4284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 402.093876][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 402.226150][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 402.259205][ T8097] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 402.265755][ T8097] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 402.278098][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 402.320389][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 402.347913][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 402.358735][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 402.383619][ T7863] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 402.394391][ T7863] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 402.407086][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 402.415282][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 402.425680][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 402.434725][ T8097] vhci_hcd vhci_hcd.0: Device attached [ 402.452843][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 402.777009][ T4236] usb 42-1: SetAddress Request (7) to port 0 [ 403.404942][ T4236] usb 42-1: new SuperSpeed USB device number 7 using vhci_hcd [ 403.425384][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 403.555580][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 403.585787][ T8098] vhci_hcd: connection reset by peer [ 403.607891][ T4272] vhci_hcd: stop threads [ 403.612198][ T4272] vhci_hcd: release socket [ 404.987439][ T4272] vhci_hcd: disconnect device [ 405.117819][ T8119] loop5: detected capacity change from 0 to 512 [ 405.215021][ T8119] EXT4-fs (loop5): Ignoring removed orlov option [ 405.221769][ T8119] EXT4-fs (loop5): Ignoring removed mblk_io_submit option [ 405.427555][ T8119] EXT4-fs error (device loop5): ext4_iget_extra_inode:4573: inode #15: comm syz.5.902: corrupted in-inode xattr [ 405.443145][ T8119] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz.5.902: couldn't read orphan inode 15 (err -117) [ 405.459121][ T8119] EXT4-fs (loop5): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 406.127187][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 406.134680][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 406.229781][ T4193] Bluetooth: hci5: hcon ffff88802a5bc000 sent 1 < count 10 [ 406.237570][ T4193] Bluetooth: hci5: hcon ffff8880634de000 sent 2 < count 16 [ 406.245059][ T4193] Bluetooth: hci5: hcon ffff8880634de000 sent 0 < count 5 [ 406.252317][ T4193] Bluetooth: hci5: hcon ffff8880634de000 sent 0 < count 23552 [ 406.269084][ T8141] qnx6: unable to read the first superblock [ 406.934082][ T7863] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 408.447129][ T4236] usb 42-1: device descriptor read/8, error -110 [ 408.868963][ T4236] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 408.884332][ T4236] usb usb42-port1: attempt power cycle [ 409.582298][ T4235] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 409.753017][ T7863] device veth0_vlan entered promiscuous mode [ 409.766412][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 409.777561][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 409.817415][ T4236] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 410.141076][ T4236] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 410.453229][ T4237] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 410.465099][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 410.527312][ T4236] usb usb42-port1: unable to enumerate USB device [ 410.606573][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 410.655848][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 410.702737][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 410.717164][ T4235] usb 1-1: device descriptor read/all, error -71 [ 410.746949][ T4237] usb 5-1: Using ep0 maxpacket: 16 [ 410.749259][ T7863] device veth1_vlan entered promiscuous mode [ 410.867223][ T4237] usb 5-1: config index 0 descriptor too short (expected 37359, got 202) [ 410.895111][ T4237] usb 5-1: config 33 has too many interfaces: 95, using maximum allowed: 32 [ 410.953311][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 410.973255][ T4237] usb 5-1: config 33 has an invalid descriptor of length 0, skipping remainder of the config [ 411.005367][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 411.536746][ T4237] usb 5-1: config 33 has 1 interface, different from the descriptor's value: 95 [ 411.587101][ T4237] usb 5-1: string descriptor 0 read error: -71 [ 411.593362][ T4237] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 411.615019][ T7863] device veth0_macvtap entered promiscuous mode [ 411.618708][ T4237] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.677127][ T4237] usb 5-1: can't set config #33, error -71 [ 411.692628][ T4237] usb 5-1: USB disconnect, device number 15 [ 411.699686][ T7863] device veth1_macvtap entered promiscuous mode [ 411.875395][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 411.885818][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 411.908697][ T7863] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 411.980797][ T7863] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.513815][ T7863] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 412.613139][ T7863] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.649294][ T7863] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 412.701956][ T8206] device syzkaller0 entered promiscuous mode [ 412.723392][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 412.759568][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 412.826147][ T7863] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 412.862771][ T7863] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.900091][ T7863] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 412.940366][ T7863] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 412.986096][ T7863] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 413.112443][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 413.142264][ T1170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 413.198571][ T7863] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.224006][ T7863] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.273691][ T7863] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.306971][ T7863] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.548920][ T4274] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.570211][ T4274] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.604060][ T4284] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 413.737364][ T4274] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.760407][ T4274] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.804596][ T4272] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 415.257038][ T8232] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 415.263602][ T8232] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 415.332533][ T4193] Bluetooth: hci4: hcon ffff88807ad8e000 sent 0 < count 10 [ 415.341961][ T4193] Bluetooth: hci4: hcon ffff88807ad8a000 sent 0 < count 16 [ 415.350470][ T4193] Bluetooth: hci4: hcon ffff88807ad8a000 sent 0 < count 5 [ 415.358750][ T4193] Bluetooth: hci4: hcon ffff88807ad8a000 sent 0 < count 23552 [ 415.372853][ T8235] qnx6: unable to read the first superblock [ 415.392782][ T8232] vhci_hcd vhci_hcd.0: Device attached [ 415.717598][ T4237] usb 42-1: SetAddress Request (11) to port 0 [ 415.728825][ T4237] usb 42-1: new SuperSpeed USB device number 11 using vhci_hcd [ 416.784619][ T8233] vhci_hcd: connection reset by peer [ 416.794747][ T4273] vhci_hcd: stop threads [ 416.799147][ T4273] vhci_hcd: release socket [ 416.834605][ T4273] vhci_hcd: disconnect device [ 417.220838][ T4275] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 418.028232][ T4275] usb 5-1: Using ep0 maxpacket: 16 [ 418.177060][ T4275] usb 5-1: config index 0 descriptor too short (expected 37359, got 202) [ 418.199024][ T4275] usb 5-1: config 33 has too many interfaces: 95, using maximum allowed: 32 [ 418.228427][ T4275] usb 5-1: config 33 has an invalid descriptor of length 0, skipping remainder of the config [ 418.286952][ T4275] usb 5-1: config 33 has 1 interface, different from the descriptor's value: 95 [ 418.497305][ T4275] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 418.514287][ T4275] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.543010][ T4275] usb 5-1: Product: syz [ 418.605586][ T4275] usb 5-1: Manufacturer: syz [ 418.634613][ T4275] usb 5-1: SerialNumber: syz [ 419.017125][ T4275] usb 5-1: 0:2 : does not exist [ 419.207343][ T4275] usb 5-1: USB disconnect, device number 16 [ 419.858596][ T4180] udevd[4180]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:33.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 420.927139][ T4237] usb 42-1: device descriptor read/8, error -110 [ 422.187116][ T4237] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 423.072846][ T4237] usb usb42-port1: attempt power cycle [ 423.427557][ T4237] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 424.467482][ T4237] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 424.943355][ T4237] usb usb42-port1: unable to enumerate USB device [ 425.545887][ T8361] input: syz1 as /devices/virtual/input/input25 [ 428.116995][ T7] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 428.413870][ T7] usb 7-1: Using ep0 maxpacket: 16 [ 428.784150][ T8388] input: syz1 as /devices/virtual/input/input26 [ 429.337804][ T7] usb 7-1: config index 0 descriptor too short (expected 37359, got 202) [ 430.368053][ T7] usb 7-1: config 33 has too many interfaces: 95, using maximum allowed: 32 [ 430.488565][ T7] usb 7-1: config 33 has an invalid descriptor of length 0, skipping remainder of the config [ 430.500163][ T7] usb 7-1: config 33 has 1 interface, different from the descriptor's value: 95 [ 430.557110][ T7] usb 7-1: string descriptor 0 read error: -71 [ 430.614552][ T8385] input: syz1 as /devices/virtual/input/input27 [ 430.627353][ T7] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 430.915004][ T7] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.954955][ T150] block nbd6: Attempted send on invalid socket [ 430.961477][ T150] blk_update_request: I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 430.973732][ T8403] SQUASHFS error: Failed to read block 0x0: -5 [ 430.996742][ T8403] unable to read squashfs_super_block [ 431.617429][ T7] usb 7-1: can't set config #33, error -71 [ 431.717982][ T7] usb 7-1: USB disconnect, device number 4 [ 432.558554][ T8420] input: syz1 as /devices/virtual/input/input28 [ 434.125082][ T8432] binder: 8422:8432 ioctl f507 0 returned -22 [ 434.396962][ T4236] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 435.757219][ T4236] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 435.810660][ T4236] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 56128, setting to 64 [ 435.864561][ T4236] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 23 [ 435.964172][ T8450] loop7: detected capacity change from 0 to 512 [ 435.977172][ T4236] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 436.022215][ T4236] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 436.036161][ T4236] usb 1-1: SerialNumber: syz [ 436.047445][ T5621] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 436.057444][ T8416] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 436.077732][ T4236] hub 1-1:1.0: bad descriptor, ignoring hub [ 436.083758][ T4236] hub: probe of 1-1:1.0 failed with error -5 [ 436.134929][ T8455] loop4: detected capacity change from 0 to 512 [ 436.142094][ T4236] cdc_acm 1-1:1.0: Control and data interfaces are not separated! [ 436.317265][ T5621] usb 7-1: Using ep0 maxpacket: 32 [ 436.425104][ T8461] netlink: 28 bytes leftover after parsing attributes in process `syz.0.960'. [ 436.437451][ T5621] usb 7-1: config 0 has an invalid interface number: 89 but max is 0 [ 436.437547][ T5621] usb 7-1: config 0 has no interface number 0 [ 436.437782][ T5621] usb 7-1: config 0 interface 89 altsetting 225 has an invalid endpoint with address 0x0, skipping [ 436.437964][ T5621] usb 7-1: config 0 interface 89 has no altsetting 0 [ 436.617976][ T5621] usb 7-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 436.618211][ T5621] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.618438][ T5621] usb 7-1: Product: syz [ 436.618612][ T5621] usb 7-1: Manufacturer: syz [ 436.618750][ T5621] usb 7-1: SerialNumber: syz [ 436.628479][ T5621] usb 7-1: config 0 descriptor?? [ 436.661126][ T8458] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 436.663411][ T8458] FAT-fs (loop4): Filesystem has been set read-only [ 436.683043][ T5621] hub 7-1:0.89: bad descriptor, ignoring hub [ 436.683127][ T5621] hub: probe of 7-1:0.89 failed with error -5 [ 436.686654][ T5621] option 7-1:0.89: GSM modem (1-port) converter detected [ 437.721782][ T4275] usb 7-1: USB disconnect, device number 5 [ 437.796096][ T4275] option 7-1:0.89: device disconnected [ 437.879058][ T8467] FAT-fs (loop7): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 437.879258][ T8467] FAT-fs (loop7): Filesystem has been set read-only [ 438.604880][ T8471] input: syz1 as /devices/virtual/input/input29 [ 438.604981][ T4236] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 438.643167][ T4236] usb 1-1: USB disconnect, device number 17 [ 438.813021][ T8481] loop0: detected capacity change from 0 to 512 [ 439.907537][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.914947][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.078804][ T8481] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 441.344100][ T8506] loop4: detected capacity change from 0 to 512 [ 441.379557][ T8481] FAT-fs (loop0): Filesystem has been set read-only [ 441.921689][ T8506] EXT4-fs (loop4): Ignoring removed orlov option [ 442.038075][ T8506] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 442.153455][ T8506] EXT4-fs error (device loop4): ext4_iget_extra_inode:4573: inode #15: comm syz.4.977: corrupted in-inode xattr [ 442.166022][ T8506] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz.4.977: couldn't read orphan inode 15 (err -117) [ 442.255792][ T8506] EXT4-fs (loop4): mounted filesystem without journal. Opts: jqfmt=vfsold,inode_readahead_blks=0x0000000004000000,orlov,noload,delalloc,mblk_io_submit,commit=0x0000000000000000,grpquota,nogrpid,init_itable=0x0000000000000fff,,errors=continue. Quota mode: writeback. [ 442.282166][ C0] vkms_vblank_simulate: vblank timer overrun [ 547.196840][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 547.204028][ C1] (detected by 1, t=10502 jiffies, g=33025, q=284) [ 547.210619][ C1] rcu: All QSes seen, last rcu_preempt kthread activity 10482 (4294991851-4294981369), jiffies_till_next_fqs=1, root ->qsmask 0x0 [ 547.224090][ C1] rcu: rcu_preempt kthread starved for 10482 jiffies! g33025 f0x2 RCU_GP_CLEANUP(7) ->state=0x0 ->cpu=1 [ 547.235299][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 547.245274][ C1] rcu: RCU grace-period kthread stack dump: [ 547.251162][ C1] task:rcu_preempt state:R running task stack:27728 pid: 15 ppid: 2 flags:0x00004000 [ 547.262071][ C1] Call Trace: [ 547.265364][ C1] [ 547.268397][ C1] __schedule+0x11ef/0x43c0 [ 547.273022][ C1] ? release_firmware_map_entry+0x190/0x190 [ 547.279019][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 547.285021][ C1] ? preempt_schedule+0xbc/0xd0 [ 547.289882][ C1] preempt_schedule_common+0x82/0xd0 [ 547.295175][ C1] preempt_schedule+0xbc/0xd0 [ 547.299857][ C1] ? schedule_preempt_disabled+0x20/0x20 [ 547.305492][ C1] ? lockdep_hardirqs_on+0x94/0x140 [ 547.310731][ C1] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 547.316893][ C1] preempt_schedule_thunk+0x16/0x18 [ 547.322099][ C1] _raw_spin_unlock_irq+0x3c/0x40 [ 547.327131][ C1] rcu_gp_cleanup+0xd6/0xa90 [ 547.331727][ C1] ? _raw_spin_unlock_irq+0x1f/0x40 [ 547.336933][ C1] ? lockdep_hardirqs_on+0x94/0x140 [ 547.342150][ C1] rcu_gp_kthread+0xa9/0x370 [ 547.346745][ C1] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 547.352642][ C1] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 547.357756][ C1] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 547.363653][ C1] ? __kthread_parkme+0x157/0x1b0 [ 547.368682][ C1] kthread+0x436/0x520 [ 547.372872][ C1] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 547.378618][ C1] ? kthread_blkcg+0xd0/0xd0 [ 547.383221][ C1] ret_from_fork+0x1f/0x30 [ 547.387657][ C1] [ 547.390678][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 547.397011][ C1] NMI backtrace for cpu 1 [ 547.401348][ C1] CPU: 1 PID: 8500 Comm: syz.6.975 Not tainted syzkaller #0 [ 547.408714][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 547.418857][ C1] Call Trace: [ 547.422367][ C1] [ 547.425225][ C1] dump_stack_lvl+0x188/0x250 [ 547.429969][ C1] ? show_regs_print_info+0x20/0x20 [ 547.435171][ C1] ? load_image+0x400/0x400 [ 547.439679][ C1] ? irq_work_queue+0xbf/0x140 [ 547.444458][ C1] nmi_cpu_backtrace+0x3a2/0x3d0 [ 547.449417][ C1] ? nmi_trigger_cpumask_backtrace+0x280/0x280 [ 547.455569][ C1] ? _printk+0xda/0x130 [ 547.459724][ C1] ? cpu_online+0x1d/0x30 [ 547.464054][ C1] ? load_image+0x400/0x400 [ 547.468559][ C1] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 547.474624][ C1] nmi_trigger_cpumask_backtrace+0x163/0x280 [ 547.480606][ C1] rcu_check_gp_kthread_starvation+0x1cd/0x250 [ 547.486765][ C1] print_other_cpu_stall+0x1110/0x1270 [ 547.492228][ C1] ? print_cpu_stall+0x5f0/0x5f0 [ 547.497167][ C1] ? timekeeping_advance+0x7f6/0xac0 [ 547.502461][ C1] ? __lock_acquire+0x7d10/0x7d10 [ 547.507493][ C1] rcu_sched_clock_irq+0x843/0x1120 [ 547.512694][ C1] ? rcutree_dead_cpu+0x20/0x20 [ 547.517654][ C1] ? account_process_tick+0x22a/0x3a0 [ 547.523039][ C1] update_process_times+0x193/0x200 [ 547.528353][ C1] tick_sched_timer+0x37d/0x560 [ 547.533221][ C1] ? tick_setup_sched_timer+0x2c0/0x2c0 [ 547.539122][ C1] __hrtimer_run_queues+0x4b4/0xb70 [ 547.544342][ C1] ? hrtimer_interrupt+0x8d0/0x8d0 [ 547.549456][ C1] ? ktime_get_update_offsets_now+0x3ce/0x3e0 [ 547.555528][ C1] hrtimer_interrupt+0x3bb/0x8d0 [ 547.560671][ C1] __sysvec_apic_timer_interrupt+0x137/0x4a0 [ 547.566842][ C1] sysvec_apic_timer_interrupt+0x9b/0xc0 [ 547.572565][ C1] [ 547.575500][ C1] [ 547.578631][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 547.584724][ C1] RIP: 0010:_raw_spin_unlock_irq+0x25/0x40 [ 547.590552][ C1] Code: 00 00 00 66 90 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 ae bd 96 f7 48 89 df e8 e6 95 97 f7 e8 81 8b b8 f7 fb bf 01 00 00 00 c6 9c 8b f7 65 8b 05 e7 85 3b 76 85 c0 74 02 5b c3 e8 34 93 39 [ 547.610178][ C1] RSP: 0018:ffffc90002fdfcf0 EFLAGS: 00000286 [ 547.616252][ C1] RAX: f23a525c54852800 RBX: ffff88807c6c1280 RCX: f23a525c54852800 [ 547.624226][ C1] RDX: dffffc0000000000 RSI: ffffffff8a2b3180 RDI: 0000000000000001 [ 547.632197][ C1] RBP: ffffc90002fdff10 R08: ffff88807c6c1283 R09: 1ffff1100f8d8250 [ 547.640175][ C1] R10: dffffc0000000000 R11: ffffed100f8d8251 R12: 1ffff920005fbfa8 [ 547.648152][ C1] R13: dffffc0000000000 R14: 00007f200167ea78 R15: ffff888019bc3b80 [ 547.656250][ C1] __ia32_sys_rt_sigreturn+0x1ad/0x760 [ 547.661724][ C1] ? load_gs_index+0x130/0x130 [ 547.666493][ C1] ? __context_tracking_exit+0x4c/0x80 [ 547.671954][ C1] ? __lock_acquire+0x7d10/0x7d10 [ 547.676985][ C1] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 547.683088][ C1] ? lock_chain_count+0x20/0x20 [ 547.687938][ C1] ? vtime_user_exit+0x2c8/0x3e0 [ 547.692891][ C1] ? lockdep_hardirqs_on+0x94/0x140 [ 547.698232][ C1] do_syscall_64+0x4c/0xa0 [ 547.702662][ C1] ? clear_bhb_loop+0x30/0x80 [ 547.707339][ C1] ? clear_bhb_loop+0x30/0x80 [ 547.712019][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 547.717914][ C1] RIP: 0033:0x7f20033c71d9 [ 547.722367][ C1] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 547.741973][ C1] RSP: 002b:00007f200167ea80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 547.750396][ C1] RAX: ffffffffffffffda RBX: 00007f200369efa0 RCX: 00007f20033c71d9 [ 547.758369][ C1] RDX: 00007f200167ea80 RSI: 00007f200167ebb0 RDI: 0000000000000021 [ 547.766355][ C1] RBP: 00007f20034bbd6f R08: 0000000000001000 R09: 0000000000000000 [ 547.774329][ C1] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 547.782296][ C1] R13: 00007f200369f038 R14: 00007f200369efa0 R15: 00007fff653ead38 [ 547.790278][ C1]