last executing test programs: 2m39.414565967s ago: executing program 3 (id=562): r0 = creat(&(0x7f0000000200)='./file0\x00', 0x17c) close(r0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000680), 0x802, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x10800, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) 2m39.28313791s ago: executing program 3 (id=564): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x5ff5, 0x800, 0x0, 0x800010100000}, 0x0, &(0x7f00000000c0)={0x1c, 0x40002, 0x0, 0x0, 0x0, 0x200000000, 0x6a9}, 0x0, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x20008004) 2m38.219696316s ago: executing program 3 (id=575): ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, 0x0) setns(0xc9, 0x0) r0 = socket$netlink(0x10, 0x3, 0xb) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000380)={'nat\x00', 0x2, [{}, {}]}, 0x48) 2m37.989491581s ago: executing program 3 (id=579): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x200) 2m37.813760726s ago: executing program 3 (id=581): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) r2 = eventfd2(0x1, 0x80001) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000001c0)={0x0, r2}) close_range(r0, 0xffffffffffffffff, 0x0) 2m37.493931103s ago: executing program 3 (id=585): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000007740)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f00000003c0)="db1f00d6", 0x4}], 0x1}}], 0x1, 0x8800) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000000000)=0x40) 2m37.051966914s ago: executing program 32 (id=585): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000007740)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f00000003c0)="db1f00d6", 0x4}], 0x1}}], 0x1, 0x8800) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}, &(0x7f0000000000)=0x40) 2m23.58950291s ago: executing program 4 (id=642): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = open(&(0x7f0000000280)='.\x00', 0x80, 0x122) fcntl$notify(r0, 0x402, 0x8000003d) r1 = open(&(0x7f0000000580)='./bus\x00', 0x84242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r1, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x2, 0x5, 0x7, 0x3, 0x3, {0x400000080001, 0xff, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x5, 0x2000001}}, {0x0, 0x14}}}, 0xa0) sendfile(r1, r1, &(0x7f0000000080), 0x7f03) 2m23.357636856s ago: executing program 4 (id=643): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) 2m22.859100918s ago: executing program 4 (id=645): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x82316000) r1 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000480), 0x4) recvmmsg(r1, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000001e40)=""/174, 0xffda}], 0x1, &(0x7f0000001fc0)=""/65, 0x41}, 0x2}], 0x1, 0x40002122, 0x0) sendmsg$tipc(r1, &(0x7f0000000100)={&(0x7f0000000040)=@id={0x1e, 0x3, 0x2, {0x4e24}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000000c0)="1ea840abc98cd515716ec91298b29dc7707407bc42e1aa63fb", 0x19}], 0x1, 0x0, 0x0, 0x20004800}, 0x4800) 2m22.593159805s ago: executing program 4 (id=647): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000700)='./file1\x00', 0x0, &(0x7f0000000000), 0xfe, 0x250, &(0x7f0000000300)="$eJzs3T9oJFUcB/DvzO565m7RUxtB/AMiooFwdoLN2SgcyHGICCqciNgod8J5h11iZWOhtUoqmyB2RktJE2wUwSpqitgIGiwMFlqs7M4G8mc1ZnfdkcznA5OZybyZ3xt2vm+3ebsBGutskvNJWknmk3SSFHsb3FctZ4e7y3Prl5Ne7+lfi0G7ar+ye96ZJEtJHk2yVhZ5tZ3cWH1+6/eNJx9853rngY9Wn5ub6U0ObW9tPrXz4cW3P73wyI2vv/35YpHz6e67r+krRvyvXSS3/xfF/ieKdt094N+49OYn3/Vzf0eS+wf576RM9eK9e+2mtU4e/uDvzn3vl2/ummVfgenr9Tr998ClHtA4ZZJuinIhSbVdlgsL1Wf471uny9euXntj/pWr16+8XPdIBUxLN9l84vNTn505kP+fWlX+gZOrn/9nLq380N/eadXdG2Am7q5W/fzPv7j4UOQfGkf+obnkH5pL/qG55B+aS/6hueQfTrDOPx+Wf2gu+Yfmkn9orr35BwCapXdqnFnDt05/IjIwc3WPPwAAAAAAAAAAAAAAAAAAwGHLc+uXd5dxr1Ecs/2X7yfbjydpj6rfGvwecXLz4O/p34p+s3212uN2dOiFeye8wIQ+rnn29S0/1lv/q3vqrb94JVl6K8m5dvvw81cMn7/x3XbE8c5LExY4poP5fOzZ2dY/6M+Veutf2Ei+6I8/50aNP2XuHKxHjz/do79i+Uiv/zHhBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJiZvwIAAP//1rxsXQ==") open(&(0x7f00000000c0)='./bus\x00', 0x14927e, 0x1a) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f00000003c0)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x8000, 0xa0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x14, 0xd, "ef359f413bb9386ff7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e7376b7a5ff537ed73ac58818d78c660e677df8dc905b90242b7c528a076d2f6a00400", "036c5bc6780820d1cbf7966d61fdcf335263bd9b0abdc2542ded71038259ca171ce1a311ef545032d71e14ef3dc177e9b48b001d00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x8]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mydev\x00', 0x1ff) 2m21.664743057s ago: executing program 4 (id=654): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') preadv(r0, &(0x7f0000000540)=[{&(0x7f0000000040)=""/208, 0xd0}], 0x1, 0x3, 0xd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)=ANY=[], 0x6a) 2m20.575339594s ago: executing program 4 (id=666): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a0000020050005000000001000b0018601003e80000000001010103", 0x2e}], 0x1, 0x0, 0x2) 2m20.100295695s ago: executing program 33 (id=666): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a000002005000500000000100000001601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000003c0)="00214500002c00000000400600000a0000010a0000020050005000000001000b0018601003e80000000001010103", 0x2e}], 0x1, 0x0, 0x2) 1m57.045826033s ago: executing program 0 (id=842): r0 = fsopen(&(0x7f0000000020)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000050)='127.0.0.1:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000060)='addr\x00', &(0x7f0000000070)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='port\x00', &(0x7f00000000a0)='2056\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000000c0)='xprtsec\x00', &(0x7f00000000e0)='tls\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 1m56.77835199s ago: executing program 0 (id=846): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x80, &(0x7f0000000340), 0x1, 0x7a2, &(0x7f0000003dc0)="$eJzs3MFrHGUbAPBnptmmbfJ9mw++w/dd+n3QQgulm6S5tCfjRbwUCgWvNSSbEDLJluymJrHQ1Jsg1OaiIojePXoVSv0DvElBwbsgWuNBvazM7mbb1N10Y5Nsrb8fTOZ533lnnved3byZgcwE8Lf1//xHEjEcEVciotiqTyPiaCM6FrHRbLf18OZ0viRRr1/9Icl3i616sX2spLUeisYu8Z+IuF+IOPfWjpT1wYiorq0vTGVZeblVOVpbvD5aXVs/P784NVeeKy+NT1wauzgxcXFsYt/Gevq1S8fvfvnK5uZXn9XunBw4n8RkY9zRGlsjOLFv6Rqa56QQk0/UL+1vmr5LemgzcAj9AABgd/l1/pHWtVkhinFkt6s0F3AAAADwl1QfrPfq155bAgAAAM+ZJPrdAwAAAOBgbf8fwPazve3nYA/J9y9HxEin/AONZ4gjjkUhIk5sJTseP0iau8Ez2bgdEfcmO3z/enmieXdjj8Lj+3NE9tu9fP6Z7DT/pO35JzrMPwPb7054Rt3nv0f5j3SZ/670mOPzj/5b6Jr/dnX17ZOd8ift/EmX/K/3mP/O5jt3u22rfxJxpuPfn2RHrl3eDzE6O591+tVqd/f+b2cfdB9/85UPO/MnSSNr0mX8s81N13sc/5tbPy1s7JL/7KndP/9m/sEd++XfiXdb5yaNiLutdV7efCLHqcWvv/hj5mRjO/9Ml/Pf+fN/tbU14uMex//tp4OrPTYFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAhjQihiNJS+04TUuliKGI+HecSLNKtXZutrKyNJNvixiJQjo7n5XHIqLYLCd5ebwRPypfeKI8ERH/+uZ4M+l8Vi5NV7KZfg8eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAtqGIGI4kLUVEGhE/F9O0VOp3rwAAAID9lUSM9LsPAAAAwIFz/w8AAAAvvr3e/ydJa30QnQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABeVFcuX86X+tbDm9N5eebG2spC5cb5mXJ1obS4Ml2arixfL81VKnNZuTRdWXza8dKIGL8UK6ujtXK1NlrNy5WVpdq1+cWpufK1cuFQRgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBeDTeWJC1FRNqI07RUivhHRIxEIZmdz8pjEfHPiHhQLAzm5fF+dxoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB9V11bX5jKsvLyAQQx0gzq9Xr9gFJsB/VDGM7zGEQS8Rx0o0vwQetT2a1NshHR966mrY4+y3Ei9rLXraecln4H/+vTfAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQH9V19YXprKsvFx9atOjh9IhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+iT9LomIfDlTPD2c1ww9tvVo8kuxsY6INz68+t7qVK22PJ7X/9iur73fqr/w2I63DnscAAAA8EJ7aS+Nt+/Tt+/jAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAelVdW1+YyrLy8gEGcbvfowQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP6M3wMAAP//zFe7Bg==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x42, 0x98) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) write$P9_RREADLINK(r0, &(0x7f0000000000)={0xffffffffffffff23, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) fadvise64(r0, 0xfe53, 0x0, 0x4) 1m55.94496991s ago: executing program 0 (id=851): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000000000000000850000000f00000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000000000008500000058"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x28}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 1m55.311772915s ago: executing program 0 (id=856): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x404, &(0x7f00000012c0)={[{@nogrpid}, {@data_err_ignore}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x68}}, {@errors_remount}, {@mblk_io_submit}, {@quota}, {@nojournal_checksum}]}, 0x3, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000000100)='./file0\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x2000080, 0x0, 0x0, 0x0, {0x25}, 0x0, 0x0, 0x0, 0x0}, 0x58) 1m54.741317319s ago: executing program 0 (id=860): io_uring_setup(0x3ced, &(0x7f0000000540)={0x0, 0xf822, 0x1, 0x0, 0x38e}) close(0x3) r0 = mq_open(&(0x7f0000000000)='!s\"D\xd7$\xd6\xe0\x8b\xdb\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x6e93ebbbcc0884f2, 0x80, &(0x7f0000000300)={0x9, 0x1, 0x3, 0xfffffffffffffff9}) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x1a) mq_timedreceive(r0, &(0x7f0000000380)=""/128, 0x80, 0x6, &(0x7f0000000180)={0x77359400}) 1m54.169245083s ago: executing program 0 (id=869): r0 = memfd_create(&(0x7f00000005c0)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) r1 = dup(r0) r2 = fanotify_init(0x0, 0x40000) fanotify_mark(r2, 0x1, 0x3, r1, 0x0) write$binfmt_elf64(r1, &(0x7f00000006c0)={{0x7f, 0x45, 0x4c, 0x46, 0x6, 0xff, 0x78, 0xa0, 0x2, 0x2, 0x3e, 0xcd, 0x3cb, 0x40, 0x2ea, 0x10000, 0x5, 0x38, 0x1, 0xd71a, 0x6b1, 0x400}, [{0x3, 0x81, 0x9, 0xff5, 0x1, 0x1b8, 0x1}]}, 0x78) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 1m53.853864061s ago: executing program 34 (id=869): r0 = memfd_create(&(0x7f00000005c0)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) r1 = dup(r0) r2 = fanotify_init(0x0, 0x40000) fanotify_mark(r2, 0x1, 0x3, r1, 0x0) write$binfmt_elf64(r1, &(0x7f00000006c0)={{0x7f, 0x45, 0x4c, 0x46, 0x6, 0xff, 0x78, 0xa0, 0x2, 0x2, 0x3e, 0xcd, 0x3cb, 0x40, 0x2ea, 0x10000, 0x5, 0x38, 0x1, 0xd71a, 0x6b1, 0x400}, [{0x3, 0x81, 0x9, 0xff5, 0x1, 0x1b8, 0x1}]}, 0x78) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 1m50.762962576s ago: executing program 1 (id=891): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000700000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5a}, 0x48) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x10, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="791048000000000079001a0000"], 0x0, 0x8, 0x0, 0x0, 0x40f00}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000a40)={@fallback=r0, r0, 0x2f}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001700)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab000e271f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1ff032aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f757036303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e0800000092e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9be7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa5200002fe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb0972d39e4b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e501ddddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981179186e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b605908000000f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c332c34812382e57c0e0d83f3f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217b6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2a434b9048ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b4783d66661a92f174f2b88cd544b2a8e1b05ea7cf51578169fff7765f9978883b4b5983b42a35a05dabfc325ec2a2ec2f9b0882fdcf5d6f72272d2ff0d8eea60f5494ba42b4d40f144f0ab680a6f40f9094d3afb58a1efd6109894b8605c6b3b3f020c222f6446195b2274f634fbb737948a1f36ea729467e132385e9da614e4625175f4443b97a675934db90010e4b884200c3546c4d86d712c3939e11be3343f693846f509ad4c445ade5cd6d126d5694462ac5d3b527c3bd51c0a715a28d65fe94b255d02cdc1fab99b5b9c352f1b284115e4046285a824d22b6f0afbed8d6096a72fef72ebd6aae78b02fa1993e8fe2020ae93aae2bcfffa40b98549f1fb9fcefa74329909a207336d07f6f59da423ac5fa47852055d5ce6d2c56bdbbcdbf3458ba478c669f39d5272e65c90908ea2cb86d38f8ebf80a8cb85d8399b42403c94b8662af5cf1411526f177b4d476169a5d5a8c37d0d8893a77d0bd47b8a0bba60b3e26094209c889585f997ff556bcd2cc223f9c0c44de9d0fe1b5a8a815f652e79747d3e1f413fa0575d51f652d22883e143065c5ad74bdc864754ba3dad5a8fc8fc2c807d1a51dfb29884adee415c13f2ce14d307bd6165ec6ba68a766adfcbe444ea72d586bb47dd98a225467aab538a77667d19bae2e51727ba6d190e6d7"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000000100)="b9ff0b078059268cb89e14f088a82d", 0x0, 0x28e, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1m49.969542755s ago: executing program 1 (id=893): r0 = syz_usb_connect(0x2, 0x4b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040480b03100001000000010902390002010080fa0904000000ff0000000904010000ff0000000904010103ff0000000705010240"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000100)=""/64) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000200)={0x1, 0x7, 0x1, &(0x7f0000000040)={0x5, "810556c721393f4084c89ea7f77d040b00"}}) 1m47.524754564s ago: executing program 1 (id=901): r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000004c0)=""/4091, 0xffb}], 0x1}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000018000000000200000000000000000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000b05d25a806c8c6f94f90324fc600e0005000a000200053582c137153e3704000880fc0b0b000300", 0x33fe0}], 0x1}, 0x0) 1m47.229073912s ago: executing program 1 (id=903): syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x101880a, &(0x7f0000000400)=ANY=[@ANYBLOB="6e6f646973636172642c6261636b67726f756e645f67633d73796e632c61636c2c6673796e635f6d6f64653d7374726963742c696e6c696e655f78617474722c6673796e635f6d6f64653d706f7369782c646973636172645f756e69743d7365676d656e742c6261636b67726f756e645f67633d6f6e2c6e6f696e6c696e655f78617474722c646973636172645f756e69743d626c6f636b2c6673796e635f6d6f64653d7374726963742c617467632c657874656e745f63616368652c6661756c745f696e6a656374696f6e3d30303030303030303030303030303031343033302c00271d57a599b8b169a579679e220c689eaaec4fa6229021e75c68a687d319b615573b0b0ceefba8e2e2419434463974ef8174b66469344931de0ccad650792761"], 0x1, 0x5522, &(0x7f0000000b40)="$eJzs3L1vW1UUAPDjpOk3JUIMbH1SVSmRalOnH4KtQCs+RKuqwMAEju1abm2/KHadkImBETHwnyCQmBj5GxiY2RADiA0J5HdfSgNUqhQnJsnvJz2fd6+vzzvXqiqd9yIHcGQtZr//WolzcSoi5iPibERxXimPwo0UXoqI8xEx98RRKecfTxyPiNMRcW6SPOWslG99eWl84dov7/z23Q8njp356tsfZ7drYNYuRkR/LZ1v9FPMOyk+KOcb424R+1fHZUxv9B+W4zzFjfZqkWGjsb2uUcQrnbQ+X3s0nMT7vUZzEjvd+8X82iBdcDjubOcpPvCgsV6MW+3VInaHeRE7W6muza30f9vWcJTytMp8nxTpYzTajml9e7Od9rP2sIjNwaicT3nzVntzEsdlLC8XzbzXKupY3cUX/T/3bnfwaDMbt9eH3XyQXavVX6nVr1fr63mrPWpfrTb6retXs6VOb7KsOmo3+jc6ed7ptWvNvL+cLXWazWq9ni3dbK92G4OsXq9dqV2uXlsuzy5lb975IOu1sqVJfL07eDTq9obZ/Xw9S59YzlZqV15dzi7Us/du383u3rt16/bd9z+6+eGd126//Ua56F9lZUsrl1dWqvXL1ZX68hHa/2dl0VPcP+xKZdYFABw8+n9gFi7GwuPz6fb/6/ci9r7/j2fq/9O8/v/pDlT/e/j6/42XI2a6f9gV/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJH108LXbxUni2l8ppx/rpx6oRxXImIuIv78D/NxfEfO+TLPwlPWL/yjhu8rUWSYXONEeZyOiBvl8cfze/0tAAAAwOH1zafnv0jdenpZnHVB7Kd002bu7MdTyleJiIXFn6eUbW7y8uKUkhX/vo/F5pSyFTewTk4pWbrldmxa2Z7J/I5w8olQSWFuX8sBAAD2xc5OYH+7EAAAAPbT57MugNmoxPajzO1nwcVf3v/9QPDUjhEAAABwAFVmXQAAAACw54r+3+//AQAAwOGWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4C927uc2cSCKA/CzwQv7T4tWe99W9gZlbAl73GNEAWmCAnIgLaQBaiC3lBBBhMchEHGI5LGtRN8nOZOxzI83CA4zIw0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF26r9aL26vf121zdvt28owGAAAAuGRbrRf1P7PU/9rc/97c+tn0i4goI+LS3H0Un84yR01O9fL8zenz1asa7iLqhMN7TJrrS0T8aa7HH11/CgAAAPBxbZareZqtpz+zoQuiT2nRpvz2N1NeERHV7CFTWnnI+5UprP5+j+N/prR6AWuaKSwtuY1zpb1J/XM/rtpNT5oiNeXFlx2LzDZ2AACgR6Ozpt9ZCAAAAH36N3QBDKOI563M41bgJDXN9t7nsx4AAADwDhVDFwAAAAB0rp7/93T+3975fwAAADCMdP4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXdpW68VmuZq3zdnt28kzGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAn9ucdBUIgDMJg7/rOZO5/WGnQ1NSkCoSPvzEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYn5cUCIEgiII5438nff/DSoKeQYQIaHhUUYsGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYuZ/XOKo4AODf2d3Z2FYxRskhIgoe9GLTbW3tTTwowYN/ghDSbY3d+qMNYksRc/EmOfciehQRlHjr/9BzC73UWw85VPCsvNmZ7DQNuCqd2SafD7x5350M875vhoR8500CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABUdt6ZxN20mR/HnXLf7QfX11J/Z0+f3Ny6u5RairMmk34yvFT/kC1GxLH2kgEAAOBw6Fb1fUTcy7dXUt+ZL+r/vDom1fzfPzOOy3r+i6pk3Vv/V7V/ar/9ev+F3YHmx+Okk55fHw1PPJpK73HNcdY9+49H9IorXzx76RY3pPP+5vM7eXE9s29v3Xq3X4RzTWQLAPwXx6u+DKrfh1I/aDMxAA6NXq3wrur/7ny7OQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0YWczjlVxFhFLvUmc3HlwfW2//ubW3aWqnblxYyu+npwznSKPiPPro+GJRmcz265cvXZxdTQaXm4+eDki2hr97XL6Fz+c4uCIVq7PAQmy8vu2kUHn0j3d+6VOebNn4Wo8OUFrP5IAADig8rKl+uBevr2S9mULEX/98HD9/1otjinr//sfnbldH6te/w8am+HsW9649NnylavX3li/tHpheGH4yZsnB28NTp09ffrscvGsZNkTEwAAAP6fftnq9X9n4dH1/6O1OKas/z//bvBVfayu+n9fk0W/tjMBAAA43J575c8/sn32Z/1+fLm6sXF5MN7ufj453raQ6r82V7Z6/d9daDsrAAAAoAk7m9lD6//nanFMuf7/9I8v/lw/ZzcijpTr/8fXPh2da246M62JPydue44AAAC060jZ6uv/efH+f2f3lYdORLz+6jgu/w3gVPV/971vfqqPVX///1RzU5xJncXx9Sj6xYjeYtsZAQAAcJA9VbZU7P+eb698/MvRD/re/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABo2t8BAAD//1IGNfA=") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) symlinkat(&(0x7f0000002300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 1m44.640985244s ago: executing program 1 (id=918): unshare(0x20000400) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x82000, 0xa1) fsync(r0) 1m41.976240609s ago: executing program 1 (id=934): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = eventfd(0x0) io_setup(0xc, &(0x7f0000000140)=0x0) io_submit(r1, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xc2, r0, &(0x7f0000000180)='\x00\x00\x00a\x00\x00\x00\x00', 0x8, 0x34}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0xffff, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r0}]) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000000)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 1m41.49151661s ago: executing program 35 (id=934): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = eventfd(0x0) io_setup(0xc, &(0x7f0000000140)=0x0) io_submit(r1, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xc2, r0, &(0x7f0000000180)='\x00\x00\x00a\x00\x00\x00\x00', 0x8, 0x34}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0xffff, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r0}]) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000000)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 1m24.817384195s ago: executing program 5 (id=1045): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @sack_perm, @window={0x3, 0x9, 0x9}, @window={0x3, 0x6, 0xff81}, @window={0x3, 0x8, 0x6}, @timestamp, @sack_perm, @window={0x3, 0x1, 0x5}], 0x8) r1 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r1, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x810, 0x0, 0x0) 1m24.574339791s ago: executing program 5 (id=1046): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000400)=[{&(0x7f00000001c0)="ee44eee46e", 0x5}, {&(0x7f00000002c0)="b967e69b25897083c064cd833ee3b5a1daf59b6584de763b6fedf4862f1e783deb8428f8371518bb2c1583c40a", 0x2d}, {&(0x7f0000000340)="e8e16db6129feb75c8f1d61f70e223467a3dec559b36ce70526f9330e04ae7f025e2edf66358ecb70cf69bd8dc487c3154848657c7dfc9c5bfabbe39b2068e2755f8ff3d977a0bcef5bb61a6fe82", 0x4e}], 0x3, 0xc) splice(r2, 0x0, r1, 0x0, 0x8000, 0x0) 1m24.362057036s ago: executing program 5 (id=1048): r0 = io_uring_setup(0x1e41, &(0x7f00000002c0)={0x0, 0x284f, 0x2, 0xfffffffe, 0x239}) setresuid(0xee00, 0xee00, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) setresuid(0x0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1m24.243918679s ago: executing program 5 (id=1050): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) chdir(&(0x7f0000000200)='./file0/file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000000)='sysfs\x00', 0x1214040, 0x0) 1m24.071971883s ago: executing program 5 (id=1052): r0 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) lseek(r2, 0xfffffffffffffffe, 0x1) 1m23.687340092s ago: executing program 5 (id=1056): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r0, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x6, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0feffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000801000085000000a500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000400)={r2, 0x0, 0x0}, 0x10) 1m23.271656732s ago: executing program 36 (id=1056): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r0, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x6, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0feffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000801000085000000a500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000400)={r2, 0x0, 0x0}, 0x10) 4.775078234s ago: executing program 8 (id=1713): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = openat$cgroup_procs(r0, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) 4.427270533s ago: executing program 8 (id=1714): unshare(0x40200) r0 = semget(0x1, 0x4, 0x39c) semop(r0, &(0x7f0000000080)=[{0x1, 0x8001, 0x1000}], 0x1) semop(r0, &(0x7f00000008c0)=[{0x3, 0xbbdd, 0x1000}], 0x1) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000140)=[0x6, 0x7fff]) unshare(0x40400) 3.467238596s ago: executing program 8 (id=1721): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x8, 0x4, 0x4, 0x9}, 0x50) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)={0x34, r1, 0x1, 0x70bd28, 0x25dfdbfc, {0x1a}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040840}, 0x0) 3.349936709s ago: executing program 8 (id=1723): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) mount$bpf(0x0, 0x0, 0x0, 0x834, &(0x7f0000000240)=ANY=[@ANYRESOCT]) mount$9p_fd(0x0, 0x0, 0x0, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB='tran', @ANYRESHEX, @ANYRESHEX, @ANYBLOB="2c616e616d653d62c58c09d6cb19a2712c76657273696f6e3d3970323030302c63616368653d"]) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x14000, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[], [], 0x6b}}) 3.109991665s ago: executing program 8 (id=1724): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x60, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) 1.320426828s ago: executing program 2 (id=1740): rt_sigprocmask(0x2, &(0x7f0000000080)={[0xffffffffffffffff]}, 0x0, 0x8) r0 = gettid() r1 = getpid() rt_tgsigqueueinfo(r1, r0, 0x5, &(0x7f00000003c0)={0xd, 0x1858, 0x6}) r2 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0xfffffffffffffff7]}, 0x8, 0x0) read$watch_queue(r2, &(0x7f0000000300)=""/176, 0xb0) 1.207250851s ago: executing program 2 (id=1741): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000001, 0x31, 0xffffffffffffffff, 0x0) setresuid(0x0, 0xee00, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000001, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000ceb000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) prlimit64(0x0, 0x8, &(0x7f0000001080)={0x4, 0x7}, 0x0) remap_file_pages(&(0x7f0000603000/0x3000)=nil, 0x3000, 0x0, 0x4, 0x1) 1.163103452s ago: executing program 6 (id=1742): symlinkat(&(0x7f0000002040)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') r0 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) renameat2(r1, &(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000200)='.\x02\x00', 0x4) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='.\x02\x00', r1, &(0x7f0000000000)='./file0\x00', 0x2) 1.124871393s ago: executing program 7 (id=1743): r0 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0xa0000004}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000000)={0xa0000001}) 1.030652185s ago: executing program 6 (id=1744): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) bind$netlink(r0, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfb, 0x4}, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 885.275559ms ago: executing program 7 (id=1745): r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x63) write$P9_RLERRORu(r0, &(0x7f0000000300)=ANY=[@ANYRESHEX], 0x10) write$P9_RSTATu(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="c400a9"], 0xc4) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x10012, r0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000280)=[0x4], 0x0, 0x0, 0x1, 0x1}}, 0x40) 776.070111ms ago: executing program 6 (id=1746): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}]}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000640)=""/88, 0x7}, {&(0x7f0000000280)=""/121, 0xa2ec4ae9}], 0x2, 0x0, 0x8dff}, 0x0) 607.244955ms ago: executing program 7 (id=1747): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000fcffffff0000000007000000850000009e0000001801"], 0x0, 0x545, 0x0, 0x0, 0x40f00, 0x34}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/ptp/ptp0/max_vclocks\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='10485', 0x5) 549.699617ms ago: executing program 2 (id=1748): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x4e21, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000001c0)={0x0, 0x9}, &(0x7f0000000200)=0x8) 517.221517ms ago: executing program 6 (id=1749): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9e", 0x50}], 0x1}], 0x1, 0x40800) recvmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000000200)=""/29, 0x1d}, {&(0x7f0000000180)=""/78, 0x4e}], 0x2}, 0x0) 394.359671ms ago: executing program 7 (id=1750): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) recvfrom(r1, &(0x7f0000000000)=""/44, 0x40000, 0x100, 0x0, 0x0) 394.0923ms ago: executing program 2 (id=1751): socket$kcm(0x2, 0x1, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b0000008000000001000000ffff000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0xca, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000005c0)={r0, &(0x7f0000000080), &(0x7f00000004c0)=""/234}, 0x20) 393.528301ms ago: executing program 6 (id=1752): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000980)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, &(0x7f00000006c0)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18, 0x800}, 0xc084) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) 273.971483ms ago: executing program 7 (id=1753): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x2041, 0x0, 0x1}, 0x10) sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f00000002c0)=@nameseq={0x1e, 0x1, 0x2, {0x41}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x44010}, 0x0) 246.385474ms ago: executing program 6 (id=1754): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0xa, &(0x7f0000000280)=0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x1) syz_clone3(&(0x7f0000000300)={0x23800400, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x37}, 0x0, 0x0, 0x0, 0x0}, 0x58) close(r0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}]) 196.267485ms ago: executing program 2 (id=1755): r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xdafbe5d6891b6e4) r1 = inotify_init1(0x0) r2 = inotify_add_watch(r1, &(0x7f0000000440)='.\x00', 0x20000000) write$binfmt_elf32(r0, &(0x7f0000005640)=ANY=[@ANYRES16=r2], 0x69) close(r0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 131.319127ms ago: executing program 8 (id=1756): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000880)={'veth1_to_bond\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r2, 0x2, 0x6, @random="91266b9cc593"}, 0x10) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000080)={r2, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}}, 0x10) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="b40000001100010002000000f6dbdf25650000001b"], 0xb4}], 0x1}, 0x0) 91.595538ms ago: executing program 7 (id=1757): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="020000000000000002000000e0", @ANYRESOCT=r0, @ANYRES64=r0], 0x190) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="020000000000000002000000e001"], 0x190) close(0x3) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000080)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) 0s ago: executing program 2 (id=1758): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a0000000212a277", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="06"], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000040)={0x0, 0x6}, 0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000e00)={0x0, 0x5, 0x1, "19"}, 0x9) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000180)={0x0, 0x6}, 0x8) kernel console output (not intermixed with test programs): tover after parsing attributes in process `syz.0.584'. [ 164.826063][ T7432] hsr_slave_0: left promiscuous mode [ 164.848818][ T7432] hsr_slave_1: left promiscuous mode [ 164.958111][ T3480] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.083202][ T3480] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.160216][ T6427] scsi host1: usb-storage 2-1:1.0 [ 165.207555][ T3480] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.455371][ T6426] usb 2-1: USB disconnect, device number 6 [ 165.513540][ T7442] loop0: detected capacity change from 0 to 512 [ 165.632925][ T7442] EXT4-fs error (device loop0): ext4_iget_extra_inode:4740: inode #15: comm syz.0.589: corrupted in-inode xattr: invalid ea_ino [ 165.704920][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 165.717426][ T7442] EXT4-fs error (device loop0): ext4_orphan_get:1413: comm syz.0.589: couldn't read orphan inode 15 (err -117) [ 165.740497][ T7442] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 165.755510][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 165.775089][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 165.791072][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 165.817679][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 165.825827][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 166.011149][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 166.920493][ T7461] loop1: detected capacity change from 0 to 32768 [ 166.938387][ T7461] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.594 (7461) [ 166.992647][ T7461] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 167.021875][ T7461] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 167.066328][ T7461] BTRFS info (device loop1): using free space tree [ 167.209082][ T7448] chnl_net:caif_netlink_parms(): no params data found [ 167.277655][ T7461] BTRFS info (device loop1): enabling ssd optimizations [ 167.307144][ T7461] BTRFS info (device loop1): auto enabling async discard [ 167.933783][ T5788] Bluetooth: hci0: command tx timeout [ 168.307913][ T1135] BTRFS info (device loop1): qgroup scan completed (inconsistency flag cleared) [ 168.393076][ T7448] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.425806][ T7448] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.433218][ T7448] bridge_slave_0: entered allmulticast mode [ 168.461078][ T7448] bridge_slave_0: entered promiscuous mode [ 168.488133][ T7448] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.518016][ T7448] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.550739][ T7448] bridge_slave_1: entered allmulticast mode [ 168.577093][ T7448] bridge_slave_1: entered promiscuous mode [ 168.665510][ T7532] loop2: detected capacity change from 0 to 128 [ 168.672997][ T7532] EXT4-fs: Ignoring removed nobh option [ 168.753948][ T7532] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 168.831056][ T3480] hsr_slave_0: left promiscuous mode [ 168.866756][ T7532] ext4 filesystem being mounted at /135/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 168.944774][ T3480] hsr_slave_1: left promiscuous mode [ 168.996453][ T3480] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 169.004033][ T3480] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 169.021155][ T7532] fscrypt (loop2, inode 12): Unsupported encryption modes (contents 0, filenames 0) [ 169.063362][ T5788] Bluetooth: hci2: link tx timeout [ 169.070026][ T5788] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 169.084147][ T3480] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 169.091640][ T3480] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 169.115676][ T3480] bridge_slave_1: left allmulticast mode [ 169.121414][ T3480] bridge_slave_1: left promiscuous mode [ 169.144600][ T3480] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.164914][ T3480] bridge_slave_0: left allmulticast mode [ 169.170915][ T3480] bridge_slave_0: left promiscuous mode [ 169.176997][ T3480] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.207734][ T5776] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 169.295728][ T3480] veth1_macvtap: left promiscuous mode [ 169.301881][ T3480] veth0_macvtap: left promiscuous mode [ 169.362270][ T3480] veth1_vlan: left promiscuous mode [ 169.390731][ T3480] veth0_vlan: left promiscuous mode [ 169.428032][ T5777] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 169.445037][ T7544] loop0: detected capacity change from 0 to 1024 [ 169.495086][ T7544] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 169.705677][ T28] kauditd_printk_skb: 31 callbacks suppressed [ 169.705694][ T28] audit: type=1800 audit(1788419774.900:354): pid=7544 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.609" name="bus" dev="loop0" ino=990 res=0 errno=0 [ 170.021044][ T51] Bluetooth: hci0: command tx timeout [ 170.097508][ T7547] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input13 [ 170.206578][ T7555] netlink: 12 bytes leftover after parsing attributes in process `syz.0.612'. [ 170.222791][ T7556] loop1: detected capacity change from 0 to 128 [ 170.430603][ T3480] bond1 (unregistering): (slave veth3): Releasing backup interface [ 170.449739][ T3480] veth3 (unregistering): left promiscuous mode [ 170.875702][ T3480] bond1 (unregistering): Released all slaves [ 171.051115][ T7560] loop0: detected capacity change from 0 to 32768 [ 171.094560][ T7560] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz.0.613 (7560) [ 171.109660][ T7569] loop1: detected capacity change from 0 to 2048 [ 171.117187][ T7568] loop2: detected capacity change from 0 to 4096 [ 171.125648][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 171.169869][ T7560] BTRFS info (device loop0): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 171.201208][ T7560] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm [ 171.218756][ T7560] BTRFS info (device loop0): setting nodatasum [ 171.225353][ T7560] BTRFS info (device loop0): force zlib compression, level 3 [ 171.232850][ T7560] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_LZO (0x8) [ 171.248516][ T7560] BTRFS info (device loop0): use lzo compression, level 0 [ 171.256058][ T7560] BTRFS info (device loop0): turning on flush-on-commit [ 171.263072][ T7560] BTRFS info (device loop0): enabling auto defrag [ 171.269873][ T7560] BTRFS info (device loop0): max_inline at 4096 [ 171.276516][ T7560] BTRFS info (device loop0): using free space tree [ 171.321640][ T7568] ntfs: volume version 3.1. [ 171.616079][ T7560] BTRFS info (device loop0): enabling ssd optimizations [ 172.103463][ T5788] Bluetooth: hci0: command tx timeout [ 172.283478][ T5774] BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 172.902492][ T7598] loop0: detected capacity change from 0 to 32768 [ 172.951606][ T7598] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 172.960195][ T7598] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 173.033597][ T7598] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 173.042879][ T5780] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 173.084706][ T5780] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 173.215643][ T5780] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 130ms [ 173.238988][ T5780] gfs2: fsid=syz:syz.0: jid=0: Done [ 173.257921][ T7598] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 173.552830][ T3480] team0 (unregistering): Port device team_slave_1 removed [ 173.571734][ T7598] gfs2: fsid=syz:syz.0: found 1 quota changes [ 173.678459][ T28] audit: type=1800 audit(1788419778.890:355): pid=7598 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.620" name="file1" dev="loop0" ino=2341 res=0 errno=0 [ 173.701983][ T7598] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 173.701983][ T7598] inode = 11 2339 [ 173.701983][ T7598] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 421 [ 173.723596][ T7598] gfs2: fsid=syz:syz.0: G: s:EX n:2/923 f:qobnN t:EX d:EX/0 a:0 v:0 r:4 m:20 p:1 [ 173.734219][ T7598] gfs2: fsid=syz:syz.0: H: s:EX f:H e:0 p:7598 [syz.0.620] gfs2_quota_sync+0x411/0x5a0 [ 173.744069][ T7598] gfs2: fsid=syz:syz.0: I: n:11/2339 t:0 f:0x00 d:0x00000000 s:0 p:0 [ 173.752562][ T7598] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 173.760362][ T5780] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 173.782423][ T3480] team0 (unregistering): Port device team_slave_0 removed [ 173.830901][ T3480] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 173.885708][ T3480] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 173.958618][ T5780] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 173.973659][ T5780] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 173.989447][ T5780] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 174.008929][ T5780] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 174.018230][ T5780] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.031260][ T5780] usb 2-1: config 0 descriptor?? [ 174.177238][ T5788] Bluetooth: hci0: command tx timeout [ 174.348194][ T3480] bond0 (unregistering): Released all slaves [ 174.466977][ T5780] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving [ 174.504021][ T5780] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 174.547834][ T7448] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 174.615975][ T7448] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.751184][ T7448] team0: Port device team_slave_0 added [ 174.792464][ T7448] team0: Port device team_slave_1 added [ 174.860653][ T7448] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 174.874485][ T7448] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 174.912619][ T7448] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 174.948894][ T7448] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 174.974774][ T7448] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 175.014953][ T7448] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 175.111864][ T7448] hsr_slave_0: entered promiscuous mode [ 175.132288][ T7448] hsr_slave_1: entered promiscuous mode [ 175.494186][ T7448] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 175.512826][ T7448] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 175.537340][ T7448] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 175.554002][ T7448] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 175.574778][ T6426] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 175.709486][ T7448] 8021q: adding VLAN 0 to HW filter on device bond0 [ 175.735221][ T7448] 8021q: adding VLAN 0 to HW filter on device team0 [ 175.758629][ T3480] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.765897][ T3480] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.784564][ T6426] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 175.807453][ T6426] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 175.819433][ T3480] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.826685][ T3480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.827767][ T6426] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 175.850189][ T6426] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 175.875533][ T6426] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 175.885194][ T6426] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.270933][ T7448] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 176.635790][ T6427] usb 2-1: USB disconnect, device number 7 [ 176.963557][ T7448] veth0_vlan: entered promiscuous mode [ 177.006497][ T7448] veth1_vlan: entered promiscuous mode [ 177.030760][ T6426] [drm] Initialized gud 1.0.0 20200422 for 3-1:1.0 on minor 2 [ 177.082213][ T7448] veth0_macvtap: entered promiscuous mode [ 177.099391][ T7448] veth1_macvtap: entered promiscuous mode [ 177.188381][ T7448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 177.203110][ T7448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.220503][ T7448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 177.238017][ T7448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.264129][ T7448] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 177.274128][ T6426] gud 3-1:1.0: [drm] fb1: guddrmfb frame buffer device [ 177.299010][ T7448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 177.321447][ T6426] usb 3-1: USB disconnect, device number 6 [ 177.327656][ T7448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.357993][ T7448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 177.384841][ T7448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.424736][ T7448] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 177.450279][ T7448] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.475348][ T7448] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.484137][ T7448] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.514735][ T7448] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.735416][ T7674] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 1, id = 0 [ 177.750135][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.773786][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.832677][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.841452][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 178.425450][ T6427] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 178.626730][ T6427] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.649404][ T6427] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 178.669650][ T6427] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 178.698736][ T6427] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 178.714873][ T6427] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.743267][ T6427] usb 2-1: Product: syz [ 178.753618][ T6427] usb 2-1: Manufacturer: syz [ 178.759969][ T6427] usb 2-1: SerialNumber: syz [ 178.778641][ T6427] usb 2-1: config 0 descriptor?? [ 178.812450][ T7598] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 178.821454][ T7598] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 178.829445][ T7598] gfs2: fsid=syz:syz.0: File system withdrawn [ 178.835893][ T7598] CPU: 0 PID: 7598 Comm: syz.0.620 Not tainted syzkaller #0 [ 178.843238][ T7598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 178.853345][ T7598] Call Trace: [ 178.856682][ T7598] [ 178.859665][ T7598] dump_stack_lvl+0x18c/0x250 [ 178.864428][ T7598] ? show_regs_print_info+0x20/0x20 [ 178.869711][ T7598] ? load_image+0x420/0x420 [ 178.874276][ T7598] ? kobject_uevent_env+0x368/0x890 [ 178.879564][ T7598] gfs2_withdraw+0xe16/0x1400 [ 178.884339][ T7598] ? gfs2_lm+0x240/0x240 [ 178.888629][ T7598] ? wake_bit_function+0x200/0x200 [ 178.893816][ T7598] ? gfs2_consist_inode_i+0xf5/0x110 [ 178.899172][ T7598] gfs2_inode_refresh+0xb3c/0x11a0 [ 178.904363][ T7598] ? gfs2_inode_metasync+0xf0/0xf0 [ 178.909532][ T7598] ? gfs2_glock_nq+0xe2e/0x1440 [ 178.914471][ T7598] gfs2_instantiate+0x162/0x220 [ 178.919410][ T7598] gfs2_glock_wait+0x1d4/0x2a0 [ 178.924271][ T7598] do_sync+0x4b8/0xd90 [ 178.928403][ T7598] ? gfs2_quota_sync+0x411/0x5a0 [ 178.933422][ T7598] ? bh_get+0x760/0x760 [ 178.937650][ T7598] ? __lock_acquire+0x7d80/0x7d80 [ 178.942734][ T7598] ? do_raw_spin_lock+0x11f/0x2b0 [ 178.947852][ T7598] ? gfs2_quota_sync+0x411/0x5a0 [ 178.952867][ T7598] ? do_raw_spin_unlock+0x121/0x230 [ 178.958130][ T7598] gfs2_quota_sync+0x411/0x5a0 [ 178.962968][ T7598] __se_sys_quotactl_fd+0x2a0/0x410 [ 178.968236][ T7598] do_syscall_64+0x55/0xb0 [ 178.972704][ T7598] ? clear_bhb_loop+0x40/0x90 [ 178.977449][ T7598] ? clear_bhb_loop+0x40/0x90 [ 178.982187][ T7598] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 178.988154][ T7598] RIP: 0033:0x7fe33ed9e159 [ 178.992628][ T7598] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 179.012333][ T7598] RSP: 002b:00007fe33fce0028 EFLAGS: 00000246 ORIG_RAX: 00000000000001bb [ 179.020822][ T7598] RAX: ffffffffffffffda RBX: 00007fe33f025fa0 RCX: 00007fe33ed9e159 [ 179.028856][ T7598] RDX: 0000000000000000 RSI: ffffffff80000100 RDI: 0000000000000004 [ 179.036892][ T7598] RBP: 00007fe33ee35024 R08: 0000000000000000 R09: 0000000000000000 [ 179.044931][ T7598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 179.052957][ T7598] R13: 00007fe33f026038 R14: 00007fe33f025fa0 R15: 00007ffebe4faad8 [ 179.061023][ T7598] [ 179.587440][ T7723] loop4: detected capacity change from 0 to 128 [ 179.676247][ T7723] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 179.725217][ T7723] ext4 filesystem being mounted at /7/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 179.748744][ T6427] usb 2-1: USB disconnect, device number 8 [ 179.970773][ T7723] loop4: detected capacity change from 128 to 64 [ 180.023585][ T7736] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Out of memory [ 180.051529][ T7736] EXT4-fs error (device loop4): ext4_ext_tree_init:891: inode #13: comm syz.4.647: mark_inode_dirty error [ 180.143235][ T7736] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Out of memory [ 180.176801][ T7736] EXT4-fs error (device loop4): __ext4_new_inode:1358: inode #13: comm syz.4.647: mark_inode_dirty error [ 180.202041][ T7736] EXT4-fs error (device loop4) in __ext4_new_inode:1360: Out of memory [ 180.231678][ T7736] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Out of memory [ 180.260974][ T7736] EXT4-fs error (device loop4): ext4_evict_inode:254: inode #13: comm syz.4.647: mark_inode_dirty error [ 180.308450][ T33] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 180.319710][ T7736] EXT4-fs warning (device loop4): ext4_evict_inode:257: couldn't mark inode dirty (err -12) [ 180.393061][ T7448] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5940: Out of memory [ 180.429556][ T7448] EXT4-fs error (device loop4): ext4_dirty_inode:6144: inode #2: comm syz-executor: mark_inode_dirty error [ 180.998891][ T7767] netlink: 4 bytes leftover after parsing attributes in process `syz.1.659'. [ 181.390768][ T7448] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 181.543758][ T12] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.584580][ T7785] tipc: Started in network mode [ 181.590392][ T7785] tipc: Node identity ac1414aa, cluster identity 4711 [ 181.597986][ T7785] tipc: New replicast peer: 172.20.20.187 [ 181.610300][ T7785] tipc: Enabled bearer , priority 10 [ 181.681380][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.832310][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.951090][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.794746][ T5780] tipc: Node number set to 2886997162 [ 183.013695][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 183.031816][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 183.045398][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 183.065408][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 183.086216][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 183.094479][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 183.263406][ T7835] loop0: detected capacity change from 0 to 128 [ 183.289196][ T7835] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 183.315240][ T7835] ext4 filesystem being mounted at /181/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 183.464402][ T7838] EXT4-fs (loop0): shut down requested (2) [ 183.676659][ T5774] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 184.675118][ T7825] chnl_net:caif_netlink_parms(): no params data found [ 185.125297][ T51] Bluetooth: hci0: command tx timeout [ 185.531622][ T12] hsr_slave_0: left promiscuous mode [ 185.572328][ T12] hsr_slave_1: left promiscuous mode [ 185.600600][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 185.621663][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 185.641762][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 185.649762][ T7888] netlink: 8 bytes leftover after parsing attributes in process `syz.1.693'. [ 185.673336][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 185.695777][ T12] bridge_slave_1: left allmulticast mode [ 185.701483][ T12] bridge_slave_1: left promiscuous mode [ 185.737905][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 185.761806][ T7890] fuse: Bad value for 'fd' [ 185.766630][ T12] bridge_slave_0: left allmulticast mode [ 185.772344][ T12] bridge_slave_0: left promiscuous mode [ 185.794933][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 185.838185][ T7893] loop0: detected capacity change from 0 to 2048 [ 185.884387][ T12] veth1_macvtap: left promiscuous mode [ 185.900232][ T12] veth0_macvtap: left promiscuous mode [ 185.907986][ T12] veth1_vlan: left promiscuous mode [ 185.913437][ T12] veth0_vlan: left promiscuous mode [ 185.922005][ T7893] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 186.189048][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 187.179829][ T12] team0 (unregistering): Port device team_slave_1 removed [ 187.204865][ T51] Bluetooth: hci0: command tx timeout [ 187.259000][ T12] team0 (unregistering): Port device team_slave_0 removed [ 187.347813][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 187.410979][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 187.603935][ T7921] fuse: Bad value for 'fd' [ 187.919091][ T12] bond0 (unregistering): Released all slaves [ 188.043120][ T7825] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.050593][ T7825] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.058166][ T7825] bridge_slave_0: entered allmulticast mode [ 188.065737][ T7825] bridge_slave_0: entered promiscuous mode [ 188.102502][ T7914] netlink: 'syz.0.704': attribute type 1 has an invalid length. [ 188.126278][ T7914] netlink: 'syz.0.704': attribute type 2 has an invalid length. [ 188.144497][ T7914] netlink: 244 bytes leftover after parsing attributes in process `syz.0.704'. [ 188.203915][ T7825] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.252385][ T7825] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.287395][ T7825] bridge_slave_1: entered allmulticast mode [ 188.315471][ T7825] bridge_slave_1: entered promiscuous mode [ 188.438586][ T7825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 188.484275][ T7825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 188.653202][ T7825] team0: Port device team_slave_0 added [ 188.710816][ T7825] team0: Port device team_slave_1 added [ 188.849018][ T7825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 188.870648][ T7825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 188.965074][ T7825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 189.017516][ T7825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 189.045095][ T7825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 189.114869][ T7825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 189.284948][ T51] Bluetooth: hci0: command tx timeout [ 189.349869][ T7825] hsr_slave_0: entered promiscuous mode [ 189.395836][ T7825] hsr_slave_1: entered promiscuous mode [ 190.010634][ T7825] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 190.060350][ T7825] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 190.092410][ T7825] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 190.113103][ T7825] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 190.439953][ T7825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 190.528715][ T7825] 8021q: adding VLAN 0 to HW filter on device team0 [ 190.586315][ T3480] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.593570][ T3480] bridge0: port 1(bridge_slave_0) entered forwarding state [ 190.665462][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.672678][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 190.790211][ T7825] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 191.232514][ T7825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 191.365662][ T51] Bluetooth: hci0: command tx timeout [ 191.509899][ T8030] netlink: 8 bytes leftover after parsing attributes in process `syz.2.736'. [ 191.546143][ T8030] netlink: 8 bytes leftover after parsing attributes in process `syz.2.736'. [ 191.928686][ T8046] tipc: Started in network mode [ 191.953939][ T8046] tipc: Node identity 4, cluster identity 4711 [ 191.963033][ T8046] tipc: Node number set to 4 [ 192.246550][ T7825] veth0_vlan: entered promiscuous mode [ 192.307665][ T7825] veth1_vlan: entered promiscuous mode [ 192.409584][ T7825] veth0_macvtap: entered promiscuous mode [ 192.442081][ T7825] veth1_macvtap: entered promiscuous mode [ 192.491347][ T7825] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 192.521856][ T7825] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.554532][ T7825] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 192.578745][ T7825] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.601068][ T7825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 192.648708][ T7825] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.685084][ T7825] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.716999][ T7825] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 192.758358][ T7825] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 192.783160][ T7825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 192.829800][ T7825] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.854507][ T7825] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.875794][ T7825] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.904731][ T7825] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 193.150732][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.179435][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 193.200193][ T8069] all: renamed from lo [ 193.277294][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.329096][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 194.329881][ T8096] netlink: 4 bytes leftover after parsing attributes in process `syz.5.754'. [ 194.500193][ T8073] loop0: detected capacity change from 0 to 32768 [ 194.569546][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.584873][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.598877][ T8073] XFS (loop0): DAX unsupported by block device. Turning off DAX. [ 194.611710][ T8106] netlink: 'syz.2.756': attribute type 25 has an invalid length. [ 194.635494][ T8073] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 194.685030][ T8106] netlink: 4 bytes leftover after parsing attributes in process `syz.2.756'. [ 194.765664][ T8073] XFS (loop0): Ending clean mount [ 194.780462][ T8106] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.789480][ T8106] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.798456][ T8106] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.807401][ T8106] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 194.832456][ T8073] XFS (loop0): Quotacheck needed: Please wait. [ 194.909990][ T8120] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 194.977275][ T8106] netlink: 'syz.2.756': attribute type 25 has an invalid length. [ 194.993757][ T8106] netlink: 4 bytes leftover after parsing attributes in process `syz.2.756'. [ 195.018472][ T8073] XFS (loop0): Quotacheck: Done. [ 195.238299][ T5774] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 196.372724][ T8158] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 196.385494][ T8163] loop0: detected capacity change from 0 to 1024 [ 196.415591][ T8158] overlayfs: failed to set xattr on upper [ 196.432355][ T8158] overlayfs: ...falling back to redirect_dir=nofollow. [ 196.451598][ T8158] overlayfs: ...falling back to index=off. [ 196.460249][ T8163] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 196.480439][ T8158] overlayfs: ...falling back to uuid=null. [ 196.853060][ T5774] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 197.102669][ T8184] fuse: Bad value for 'fd' [ 197.116398][ T8184] overlayfs: failed to resolve './file0/file0': -2 [ 197.369221][ T8195] netlink: 48 bytes leftover after parsing attributes in process `syz.0.775'. [ 197.824405][ T8211] netlink: 'syz.2.781': attribute type 12 has an invalid length. [ 197.832575][ T8211] netlink: 'syz.2.781': attribute type 29 has an invalid length. [ 197.844135][ T8211] netlink: 148 bytes leftover after parsing attributes in process `syz.2.781'. [ 197.874453][ T8211] netlink: 'syz.2.781': attribute type 1 has an invalid length. [ 197.893007][ T8211] netlink: 'syz.2.781': attribute type 2 has an invalid length. [ 197.911536][ T8211] netlink: 'syz.2.781': attribute type 3 has an invalid length. [ 197.935695][ T8211] netlink: 3 bytes leftover after parsing attributes in process `syz.2.781'. [ 198.482188][ T8235] netlink: 4 bytes leftover after parsing attributes in process `syz.2.788'. [ 200.830167][ T8309] netlink: 20 bytes leftover after parsing attributes in process `syz.5.809'. [ 200.862019][ T8309] netlink: 20 bytes leftover after parsing attributes in process `syz.5.809'. [ 201.187385][ T8315] loop5: detected capacity change from 0 to 256 [ 201.325902][ T6405] IPVS: starting estimator thread 0... [ 201.427233][ T8320] IPVS: using max 16 ests per chain, 38400 per kthread [ 201.464034][ T8315] exFAT-fs (loop5): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x190b464b, utbl_chksum : 0xe619d30d) [ 201.750595][ T28] audit: type=1800 audit(1788419806.960:356): pid=8315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.811" name="file1" dev="loop5" ino=1048613 res=0 errno=0 [ 202.324934][ T5780] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 202.525056][ T5780] usb 2-1: Using ep0 maxpacket: 16 [ 202.533353][ T5780] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 202.554888][ T5780] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 202.584764][ T5780] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 202.611995][ T5780] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.632842][ T5780] usb 2-1: config 0 descriptor?? [ 203.099075][ T5780] HID 045e:07da: Invalid code 65791 type 1 [ 203.126180][ T5780] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0006/input/input14 [ 203.196940][ T5780] microsoft 0003:045E:07DA.0006: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 203.226913][ T8375] netlink: 16 bytes leftover after parsing attributes in process `syz.2.828'. [ 204.092637][ T6405] usb 2-1: USB disconnect, device number 9 [ 205.339123][ T8428] loop5: detected capacity change from 0 to 512 [ 205.398201][ T8428] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 205.451284][ T8428] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 205.473987][ T8428] System zones: 1-12 [ 205.508062][ T8435] loop0: detected capacity change from 0 to 2048 [ 205.516921][ T8428] EXT4-fs error (device loop5): ext4_orphan_get:1434: comm syz.5.844: bad orphan inode 131072 [ 205.561860][ T8435] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-00ff07000000 r/w without journal. Quota mode: none. [ 205.575007][ T8428] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 205.612291][ T8435] ext4 filesystem being mounted at /234/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 205.848587][ T8445] EXT4-fs error (device loop0): ext4_validate_block_bitmap:439: comm syz.0.846: bg 0: block 345: padding at end of block bitmap is not set [ 205.877626][ T6405] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 205.908058][ T8447] 9p: Unknown Cache mode or invalid value 7777777777777777777 [ 205.927363][ T8445] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 15 with max blocks 49 with error 117 [ 205.968466][ T8445] EXT4-fs (loop0): This should not happen!! Data will be lost [ 205.968466][ T8445] [ 206.108325][ T6405] usb 6-1: config 0 has an invalid interface number: 44 but max is 0 [ 206.116994][ T6405] usb 6-1: config 0 has no interface number 0 [ 206.123178][ T6405] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 206.149191][ T1073] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 15 with error 28 [ 206.162195][ T6405] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.180640][ T6405] usb 6-1: config 0 descriptor?? [ 206.205001][ T1073] EXT4-fs (loop0): This should not happen!! Data will be lost [ 206.205001][ T1073] [ 206.217876][ T6405] cp210x 6-1:0.44: cp210x converter detected [ 206.234404][ T1073] EXT4-fs (loop0): Total free blocks count 0 [ 206.254814][ T1073] EXT4-fs (loop0): Free/Dirty block details [ 206.260905][ T1073] EXT4-fs (loop0): free_blocks=0 [ 206.281806][ T1073] EXT4-fs (loop0): dirty_blocks=16 [ 206.298462][ T1073] EXT4-fs (loop0): Block reservation details [ 206.342750][ T6428] kernel write not supported for file /input/mice (pid: 6428 comm: kworker/1:15) [ 206.628822][ T6405] cp210x 6-1:0.44: failed to get vendor val 0x000e size 3: -71 [ 206.668185][ T6405] usb 6-1: cp210x converter now attached to ttyUSB0 [ 206.731247][ T6405] usb 6-1: USB disconnect, device number 2 [ 206.796562][ T6405] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 206.838249][ T6405] cp210x 6-1:0.44: device disconnected [ 206.935724][ T8483] loop0: detected capacity change from 0 to 512 [ 206.970495][ T8483] EXT4-fs: Ignoring removed mblk_io_submit option [ 206.997707][ T8483] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 207.047083][ T8483] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2858: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 207.063968][ T8483] EXT4-fs (loop0): 1 truncate cleaned up [ 207.071893][ T8483] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 207.127520][ T5788] Bluetooth: hci3: command 0x0406 tx timeout [ 207.270417][ T7825] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 207.355611][ T5774] EXT4-fs error (device loop0): ext4_readdir:263: inode #11: block 54: comm syz-executor: path /236/file0/lost+found: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 207.414924][ T5774] EXT4-fs (loop0): Remounting filesystem read-only [ 207.764971][ T8500] netlink: 16 bytes leftover after parsing attributes in process `syz.2.864'. [ 207.788331][ T8500] netlink: 8 bytes leftover after parsing attributes in process `syz.2.864'. [ 207.814460][ T7425] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 208.055969][ T6411] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 208.244867][ T6411] usb 6-1: Using ep0 maxpacket: 8 [ 208.252339][ T8514] jffs2: notice: (8514) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 208.270598][ T6411] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 208.289841][ T6411] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 208.308483][ T6411] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 208.323136][ T6411] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 208.333944][ T6411] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 208.352309][ T6411] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 208.369301][ T6411] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.626648][ T6411] usb 6-1: usb_control_msg returned -32 [ 208.632319][ T6411] usbtmc 6-1:16.0: can't read capabilities [ 208.720685][ T8526] loop1: detected capacity change from 0 to 4096 [ 208.872802][ T5788] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 208.883921][ T5788] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 208.892703][ T5788] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 208.909885][ T5788] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 208.919301][ T5788] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 208.929081][ T5788] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 209.372568][ T8544] FAULT_INJECTION: forcing a failure. [ 209.372568][ T8544] name failslab, interval 1, probability 0, space 0, times 0 [ 209.395021][ T8544] CPU: 0 PID: 8544 Comm: syz.1.879 Not tainted syzkaller #0 [ 209.402403][ T8544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 209.412514][ T8544] Call Trace: [ 209.415835][ T8544] [ 209.418821][ T8544] dump_stack_lvl+0x18c/0x250 [ 209.423583][ T8544] ? show_regs_print_info+0x20/0x20 [ 209.428827][ T8544] ? load_image+0x420/0x420 [ 209.433368][ T8544] ? __might_sleep+0xe0/0xe0 [ 209.437993][ T8544] ? __lock_acquire+0x7d80/0x7d80 [ 209.443051][ T8544] should_fail_ex+0x394/0x4c0 [ 209.447805][ T8544] should_failslab+0x9/0x20 [ 209.452358][ T8544] slab_pre_alloc_hook+0x59/0x300 [ 209.457433][ T8544] kmem_cache_alloc+0x5a/0x2c0 [ 209.462236][ T8544] ? getname_flags+0xbb/0x500 [ 209.466961][ T8544] getname_flags+0xbb/0x500 [ 209.471534][ T8544] user_path_at_empty+0x2c/0x60 [ 209.476419][ T8544] path_setxattr+0x253/0x590 [ 209.481055][ T8544] ? rcuref_put_slowpath+0x121/0x150 [ 209.486375][ T8544] ? simple_xattrs_free+0x150/0x150 [ 209.491632][ T8544] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 209.497656][ T8544] ? lock_chain_count+0x20/0x20 [ 209.502548][ T8544] __x64_sys_lsetxattr+0xb8/0xd0 [ 209.507540][ T8544] do_syscall_64+0x55/0xb0 [ 209.511992][ T8544] ? clear_bhb_loop+0x40/0x90 [ 209.516702][ T8544] ? clear_bhb_loop+0x40/0x90 [ 209.521441][ T8544] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 209.527366][ T8544] RIP: 0033:0x7ff2ac99e159 [ 209.531826][ T8544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.551472][ T8544] RSP: 002b:00007ff2ad836028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 209.559921][ T8544] RAX: ffffffffffffffda RBX: 00007ff2acc25fa0 RCX: 00007ff2ac99e159 [ 209.567924][ T8544] RDX: 0000200000000700 RSI: 0000200000000440 RDI: 0000000000000000 [ 209.575926][ T8544] RBP: 00007ff2aca35024 R08: 0000000000000003 R09: 0000000000000000 [ 209.583924][ T8544] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000000 [ 209.591930][ T8544] R13: 00007ff2acc26038 R14: 00007ff2acc25fa0 R15: 00007fff4f5fcd48 [ 209.600033][ T8544] [ 209.621258][ T8527] chnl_net:caif_netlink_parms(): no params data found [ 209.633293][ T8541] usbtmc 6-1:16.0: usb_control_msg returned -32 [ 209.664698][ T6405] usb 6-1: USB disconnect, device number 3 [ 209.764130][ T8549] netlink: 8 bytes leftover after parsing attributes in process `syz.2.880'. [ 209.775549][ T8549] netlink: 'syz.2.880': attribute type 9 has an invalid length. [ 209.813113][ T8527] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.820604][ T8527] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.828424][ T8527] bridge_slave_0: entered allmulticast mode [ 209.838145][ T8527] bridge_slave_0: entered promiscuous mode [ 209.847776][ T8527] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.855270][ T8527] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.862539][ T8527] bridge_slave_1: entered allmulticast mode [ 209.870435][ T8527] bridge_slave_1: entered promiscuous mode [ 209.918121][ T8527] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 210.018203][ T8527] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 210.179832][ T8527] team0: Port device team_slave_0 added [ 210.205130][ T8558] "syz.2.883" (8558) uses obsolete ecb(arc4) skcipher [ 210.217198][ T8527] team0: Port device team_slave_1 added [ 210.320925][ T8527] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 210.364796][ T8527] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 210.436791][ T8527] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 210.624267][ T8566] tipc: New replicast peer: 172.20.20.187 [ 210.631804][ T8566] tipc: Enabled bearer , priority 10 [ 210.643471][ T8527] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 210.684738][ T8527] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 210.751846][ T8527] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 210.784159][ T8572] netlink: 4 bytes leftover after parsing attributes in process `syz.1.887'. [ 210.793414][ T8572] netlink: 14 bytes leftover after parsing attributes in process `syz.1.887'. [ 210.965281][ T5788] Bluetooth: hci2: command tx timeout [ 211.042010][ T8527] hsr_slave_0: entered promiscuous mode [ 211.096169][ T8527] hsr_slave_1: entered promiscuous mode [ 211.123293][ T8527] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 211.144757][ T8527] Cannot create hsr debugfs directory [ 211.345320][ T1073] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 211.382228][ T8563] loop5: detected capacity change from 0 to 32768 [ 211.421445][ T8563] BTRFS: device fsid db05bf05-c4f4-4d41-ba1f-eb57295b561b devid 1 transid 8 /dev/loop5 scanned by syz.5.885 (8563) [ 211.497106][ T8563] BTRFS info (device loop5): first mount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 211.527376][ T8563] BTRFS info (device loop5): using xxhash64 (xxhash64-generic) checksum algorithm [ 211.558046][ T8563] BTRFS info (device loop5): using free space tree [ 211.773464][ T8527] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 211.828399][ T8527] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 211.851086][ T8563] BTRFS info (device loop5): enabling ssd optimizations [ 211.867103][ T8563] BTRFS info (device loop5): auto enabling async discard [ 211.878084][ T8527] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 211.950519][ T8527] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 212.019775][ T5788] Bluetooth: hci1: command 0x0406 tx timeout [ 212.048397][ T8611] trusted_key: syz.2.892 sent an empty control message without MSG_MORE. [ 212.300974][ T8527] 8021q: adding VLAN 0 to HW filter on device bond0 [ 212.376582][ T8527] 8021q: adding VLAN 0 to HW filter on device team0 [ 212.396147][ T8620] netlink: 8 bytes leftover after parsing attributes in process `syz.2.894'. [ 212.425085][ T8620] netlink: 20 bytes leftover after parsing attributes in process `syz.2.894'. [ 212.442015][ T1073] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.449253][ T1073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 212.527401][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.534741][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 212.535015][ T5787] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 212.548173][ T7825] BTRFS info (device loop5): last unmount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b [ 212.588745][ T8620] netlink: 8 bytes leftover after parsing attributes in process `syz.2.894'. [ 212.611034][ T8620] netlink: 20 bytes leftover after parsing attributes in process `syz.2.894'. [ 212.777838][ T5787] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 212.797287][ T5787] usb 2-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 212.817649][ T5787] usb 2-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 212.826933][ T5787] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.056180][ T51] Bluetooth: hci2: command tx timeout [ 213.293125][ T5787] dvb_ttusb_budget: ttusb_init_controller: error [ 213.302209][ T5787] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 213.513375][ T8527] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 213.536014][ T5780] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 213.543870][ T5787] DVB: Unable to find symbol stv0299_attach() [ 213.660728][ T8646] dvb_ttusb_budget: cmd xter failed, receive error -22 [ 213.693140][ T5787] DVB: Unable to find symbol tda8083_attach() [ 213.701280][ T5787] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 213.768916][ T5780] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 213.800359][ T5780] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 213.822204][ T5780] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 213.852496][ T5780] usb 6-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 213.882654][ T9] usb 2-1: USB disconnect, device number 10 [ 213.938526][ T5780] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 213.967243][ T5780] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.981313][ T5780] usb 6-1: Product: syz [ 213.986803][ T5780] usb 6-1: Manufacturer: syz [ 213.991469][ T5780] usb 6-1: SerialNumber: syz [ 214.013794][ T8636] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 214.101178][ T8656] fuse: Bad value for 'fd' [ 214.115975][ T8656] UBIFS error (pid: 8656): cannot open "./file0", error -22 [ 214.393303][ T8527] veth0_vlan: entered promiscuous mode [ 214.439353][ T8527] veth1_vlan: entered promiscuous mode [ 214.545766][ T8527] veth0_macvtap: entered promiscuous mode [ 214.571448][ T8527] veth1_macvtap: entered promiscuous mode [ 214.631111][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 214.651558][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 214.669058][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 214.684048][ T8668] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.901'. [ 214.684086][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 214.717388][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 214.740101][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 214.756768][ T8527] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 214.779122][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 214.810504][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 214.854994][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 214.873012][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 214.883396][ T8527] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 214.894907][ T8527] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 214.907011][ T8527] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 214.939759][ T8527] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.954869][ T8527] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.973903][ T8527] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 214.983031][ T8527] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 215.126717][ T51] Bluetooth: hci2: command tx timeout [ 215.138923][ T5780] cdc_ncm 6-1:1.0: bind() failure [ 215.197545][ T5780] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 215.204477][ T5780] cdc_ncm 6-1:1.1: bind() failure [ 215.266442][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 215.274391][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 215.367607][ T1073] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 215.395238][ T5780] usb 6-1: USB disconnect, device number 4 [ 215.411523][ T1073] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 215.858953][ T8695] loop6: detected capacity change from 0 to 128 [ 215.887899][ T8695] FAT-fs (loop6): Unrecognized mount option "ÿÿÿÿ" or missing value [ 216.233368][ T8676] loop1: detected capacity change from 0 to 40427 [ 216.305954][ T8676] F2FS-fs (loop1): Corrupted extension count (327717 + 1 > 64) [ 216.323817][ T8676] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 216.364079][ T8676] F2FS-fs (loop1): build fault injection attr: rate: 771, type: 0x7ffff [ 216.404423][ T8676] F2FS-fs (loop1): invalid crc value [ 216.432724][ T8676] F2FS-fs (loop1): Found nat_bits in checkpoint [ 216.670210][ T8676] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 216.685567][ T8676] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 216.844506][ T8676] syz.1.903: attempt to access beyond end of device [ 216.844506][ T8676] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 217.045901][ T8727] netlink: 112 bytes leftover after parsing attributes in process `syz.2.914'. [ 217.089447][ T8676] F2FS-fs (loop1): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_page+0x1d0/0x910 [ 217.206138][ T51] Bluetooth: hci2: command tx timeout [ 217.429377][ T5777] F2FS-fs (loop1): access invalid blkaddr:2816 [ 217.453407][ T5777] CPU: 1 PID: 5777 Comm: syz-executor Not tainted syzkaller #0 [ 217.461117][ T5777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 217.471265][ T5777] Call Trace: [ 217.474617][ T5777] [ 217.477610][ T5777] dump_stack_lvl+0x18c/0x250 [ 217.482359][ T5777] ? show_regs_print_info+0x20/0x20 [ 217.487600][ T5777] ? mark_lock+0x94/0x320 [ 217.491993][ T5777] ? __lock_acquire+0x1262/0x7d80 [ 217.497100][ T5777] f2fs_is_valid_blkaddr+0xe6c/0x15c0 [ 217.502540][ T5777] f2fs_map_blocks+0xc20/0x4080 [ 217.507493][ T5777] ? f2fs_get_block_locked+0xe0/0xe0 [ 217.512898][ T5777] ? xa_load+0x64/0x2e0 [ 217.517125][ T5777] ? xa_load+0x64/0x2e0 [ 217.521345][ T5777] ? xa_load+0x2b7/0x2e0 [ 217.525672][ T5777] ? xa_load+0x64/0x2e0 [ 217.529876][ T5777] ? page_index+0xe6/0x480 [ 217.534347][ T5777] f2fs_mpage_readpages+0xa0b/0x1eb0 [ 217.539720][ T5777] ? detach_page_private+0x4d0/0x4d0 [ 217.545065][ T5777] ? __mod_lruvec_page_state+0xa5/0x410 [ 217.550687][ T5777] ? f2fs_readahead+0x167/0x2f0 [ 217.555600][ T5777] ? f2fs_dirty_data_folio+0x830/0x830 [ 217.561118][ T5777] read_pages+0x18b/0x860 [ 217.565536][ T5777] ? __lock_acquire+0x7d80/0x7d80 [ 217.570619][ T5777] ? page_cache_ra_unbounded+0x740/0x740 [ 217.576301][ T5777] ? folio_add_lru+0x323/0xce0 [ 217.581116][ T5777] ? folio_add_lru+0x512/0xce0 [ 217.585940][ T5777] ? filemap_add_folio+0x190/0x3d0 [ 217.591138][ T5777] page_cache_ra_unbounded+0x661/0x740 [ 217.596666][ T5777] f2fs_readdir+0x498/0x970 [ 217.601260][ T5777] ? f2fs_fill_dentries+0xbf0/0xbf0 [ 217.606526][ T5777] ? mutex_lock_nested+0x20/0x20 [ 217.611528][ T5777] ? iterate_dir+0xcb/0x590 [ 217.616090][ T5777] ? down_read_killable+0x1d0/0x340 [ 217.621372][ T5777] ? fsnotify_perm+0x271/0x5e0 [ 217.626208][ T5777] iterate_dir+0x1bd/0x590 [ 217.630692][ T5777] __se_sys_getdents64+0xf6/0x270 [ 217.635798][ T5777] ? __x64_sys_getdents64+0x80/0x80 [ 217.641056][ T5777] ? filldir+0x620/0x620 [ 217.645373][ T5777] ? lock_chain_count+0x20/0x20 [ 217.650283][ T5777] ? lockdep_hardirqs_on+0x98/0x150 [ 217.655543][ T5777] do_syscall_64+0x55/0xb0 [ 217.660026][ T5777] ? clear_bhb_loop+0x40/0x90 [ 217.664746][ T5777] ? clear_bhb_loop+0x40/0x90 [ 217.669468][ T5777] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 217.675416][ T5777] RIP: 0033:0x7ff2ac9c6af3 [ 217.679880][ T5777] Code: c7 c0 e8 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb 9e e8 81 9b fd ff 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 e8 ff ff ff f7 d8 [ 217.699538][ T5777] RSP: 002b:00007fff4f5fae98 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 [ 217.708010][ T5777] RAX: ffffffffffffffda RBX: 00005555749e9a40 RCX: 00007ff2ac9c6af3 [ 217.716032][ T5777] RDX: 0000000000008000 RSI: 00005555749e9a70 RDI: 0000000000000005 [ 217.724067][ T5777] RBP: 00005555749e9a70 R08: 00007ff2acbf2e20 R09: 0000000000000001 [ 217.732088][ T5777] R10: 0000000000000000 R11: 0000000000000293 R12: 00005555749e9a44 [ 217.740112][ T5777] R13: ffffffffffffffe8 R14: 0000000000000010 R15: 00007fff4f5fd140 [ 217.748168][ T5777] [ 217.836024][ T5777] F2FS-fs (loop1): access invalid blkaddr:2816 [ 217.842280][ T5777] CPU: 0 PID: 5777 Comm: syz-executor Not tainted syzkaller #0 [ 217.849872][ T5777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 217.859970][ T5777] Call Trace: [ 217.863290][ T5777] [ 217.866258][ T5777] dump_stack_lvl+0x18c/0x250 [ 217.870995][ T5777] ? show_regs_print_info+0x20/0x20 [ 217.876284][ T5777] ? mark_lock+0x94/0x320 [ 217.880675][ T5777] ? __lock_acquire+0x1262/0x7d80 [ 217.885765][ T5777] f2fs_is_valid_blkaddr+0xe6c/0x15c0 [ 217.891218][ T5777] f2fs_map_blocks+0xc20/0x4080 [ 217.896173][ T5777] ? f2fs_get_block_locked+0xe0/0xe0 [ 217.901531][ T5777] ? xa_load+0x64/0x2e0 [ 217.905766][ T5777] ? xa_load+0x64/0x2e0 [ 217.909987][ T5777] ? xa_load+0x2b7/0x2e0 [ 217.914284][ T5777] ? xa_load+0x64/0x2e0 [ 217.918500][ T5777] ? page_index+0xe6/0x480 [ 217.922989][ T5777] f2fs_mpage_readpages+0xa0b/0x1eb0 [ 217.928369][ T5777] ? detach_page_private+0x4d0/0x4d0 [ 217.933724][ T5777] ? __mod_lruvec_page_state+0xa5/0x410 [ 217.939354][ T5777] ? f2fs_readahead+0x167/0x2f0 [ 217.944255][ T5777] ? f2fs_dirty_data_folio+0x830/0x830 [ 217.949773][ T5777] read_pages+0x18b/0x860 [ 217.954151][ T5777] ? __lock_acquire+0x7d80/0x7d80 [ 217.959241][ T5777] ? page_cache_ra_unbounded+0x740/0x740 [ 217.964925][ T5777] ? folio_add_lru+0x323/0xce0 [ 217.969821][ T5777] ? folio_add_lru+0x512/0xce0 [ 217.974630][ T5777] ? filemap_add_folio+0x190/0x3d0 [ 217.979822][ T5777] page_cache_ra_unbounded+0x661/0x740 [ 217.985344][ T5777] f2fs_readdir+0x498/0x970 [ 217.989921][ T5777] ? f2fs_fill_dentries+0xbf0/0xbf0 [ 217.995180][ T5777] ? mutex_lock_nested+0x20/0x20 [ 218.000185][ T5777] ? iterate_dir+0xcb/0x590 [ 218.004737][ T5777] ? down_read_killable+0x1d0/0x340 [ 218.009988][ T5777] ? fsnotify_perm+0x271/0x5e0 [ 218.014807][ T5777] iterate_dir+0x1bd/0x590 [ 218.019284][ T5777] __se_sys_getdents64+0xf6/0x270 [ 218.024362][ T5777] ? __x64_sys_getdents64+0x80/0x80 [ 218.029621][ T5777] ? filldir+0x620/0x620 [ 218.033923][ T5777] ? lock_chain_count+0x20/0x20 [ 218.038839][ T5777] ? lockdep_hardirqs_on+0x98/0x150 [ 218.044104][ T5777] do_syscall_64+0x55/0xb0 [ 218.048575][ T5777] ? clear_bhb_loop+0x40/0x90 [ 218.053298][ T5777] ? clear_bhb_loop+0x40/0x90 [ 218.058025][ T5777] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 218.063994][ T5777] RIP: 0033:0x7ff2ac9c6af3 [ 218.068481][ T5777] Code: c7 c0 e8 ff ff ff 64 c7 00 16 00 00 00 31 c0 eb 9e e8 81 9b fd ff 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 e8 ff ff ff f7 d8 [ 218.088166][ T5777] RSP: 002b:00007fff4f5fae98 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 [ 218.096639][ T5777] RAX: ffffffffffffffda RBX: 00005555749e9a40 RCX: 00007ff2ac9c6af3 [ 218.104677][ T5777] RDX: 0000000000008000 RSI: 00005555749e9a70 RDI: 0000000000000005 [ 218.112703][ T5777] RBP: 00005555749e9a70 R08: 00007ff2acbf2e20 R09: 0000000000000001 [ 218.120721][ T5777] R10: 0000000000000000 R11: 0000000000000293 R12: 00005555749e9a44 [ 218.128747][ T5777] R13: ffffffffffffffe8 R14: 0000000000000010 R15: 00007fff4f5fd140 [ 218.136792][ T5777] [ 218.295236][ T5777] syz-executor: attempt to access beyond end of device [ 218.295236][ T5777] loop1: rw=0, sector=45064, nr_sectors = 8 limit=40427 [ 218.723400][ T1073] kworker/u4:6: attempt to access beyond end of device [ 218.723400][ T1073] loop1: rw=2049, sector=40960, nr_sectors = 40 limit=40427 [ 218.794235][ T1073] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 218.847532][ T1073] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 218.854514][ T1073] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 218.906273][ T1073] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 218.913966][ T1073] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 219.382708][ T1073] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 219.452773][ T1073] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.497226][ T8784] loop6: detected capacity change from 0 to 4096 [ 219.706173][ T1073] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 219.766056][ T1073] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.946463][ T8784] EXT4-fs (loop6): Test dummy encryption mode enabled [ 220.016519][ T1073] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 220.029060][ T8784] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 220.097561][ T1073] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.371640][ T1073] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 220.395447][ T1073] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.505025][ T8784] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 220.675908][ T8527] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 220.871792][ T1073] tipc: Disabling bearer [ 220.886165][ T1073] tipc: Left network mode [ 221.679084][ T5788] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 221.693541][ T5788] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 221.706675][ T5788] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 221.718658][ T5788] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 221.736497][ T5788] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 221.743917][ T5788] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 221.818644][ T8838] team0: Device veth1_macvtap failed to register rx_handler [ 222.380533][ T8851] FAULT_INJECTION: forcing a failure. [ 222.380533][ T8851] name failslab, interval 1, probability 0, space 0, times 0 [ 222.402734][ T8851] CPU: 1 PID: 8851 Comm: syz.6.945 Not tainted syzkaller #0 [ 222.410161][ T8851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 222.420269][ T8851] Call Trace: [ 222.423637][ T8851] [ 222.426617][ T8851] dump_stack_lvl+0x18c/0x250 [ 222.431349][ T8851] ? show_regs_print_info+0x20/0x20 [ 222.436595][ T8851] ? load_image+0x420/0x420 [ 222.441153][ T8851] ? __might_sleep+0xe0/0xe0 [ 222.445799][ T8851] ? __lock_acquire+0x7d80/0x7d80 [ 222.450883][ T8851] should_fail_ex+0x394/0x4c0 [ 222.455638][ T8851] should_failslab+0x9/0x20 [ 222.460202][ T8851] slab_pre_alloc_hook+0x59/0x300 [ 222.465296][ T8851] kmem_cache_alloc+0x5a/0x2c0 [ 222.470123][ T8851] ? getname_flags+0xbb/0x500 [ 222.474879][ T8851] getname_flags+0xbb/0x500 [ 222.479449][ T8851] user_path_at_empty+0x2c/0x60 [ 222.484351][ T8851] path_setxattr+0x253/0x590 [ 222.489001][ T8851] ? rcuref_put_slowpath+0x121/0x150 [ 222.494347][ T8851] ? simple_xattrs_free+0x150/0x150 [ 222.499631][ T8851] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 222.505674][ T8851] ? lock_chain_count+0x20/0x20 [ 222.510581][ T8851] __x64_sys_lsetxattr+0xb8/0xd0 [ 222.515566][ T8851] do_syscall_64+0x55/0xb0 [ 222.520038][ T8851] ? clear_bhb_loop+0x40/0x90 [ 222.524769][ T8851] ? clear_bhb_loop+0x40/0x90 [ 222.529510][ T8851] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 222.535455][ T8851] RIP: 0033:0x7fe079b9e159 [ 222.539917][ T8851] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 222.559593][ T8851] RSP: 002b:00007fe07a9ab028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 222.568067][ T8851] RAX: ffffffffffffffda RBX: 00007fe079e25fa0 RCX: 00007fe079b9e159 [ 222.576138][ T8851] RDX: 0000200000000700 RSI: 0000200000000440 RDI: 0000000000000000 [ 222.584167][ T8851] RBP: 00007fe079c35024 R08: 0000000000000003 R09: 0000000000000000 [ 222.592249][ T8851] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000000 [ 222.600457][ T8851] R13: 00007fe079e26038 R14: 00007fe079e25fa0 R15: 00007ffdc3ca7318 [ 222.608503][ T8851] [ 223.237272][ T1073] IPVS: stopping backup sync thread 7674 ... [ 223.450677][ T8869] netlink: 1363 bytes leftover after parsing attributes in process `syz.5.949'. [ 223.846821][ T51] Bluetooth: hci3: command tx timeout [ 223.996018][ T8836] chnl_net:caif_netlink_parms(): no params data found [ 224.231635][ T1073] hsr_slave_0: left promiscuous mode [ 224.255253][ T1073] hsr_slave_1: left promiscuous mode [ 224.272595][ T1073] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 224.290409][ T1073] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 224.322351][ T1073] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 224.350564][ T1073] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 224.377708][ T1073] bridge_slave_1: left allmulticast mode [ 224.402535][ T1073] bridge_slave_1: left promiscuous mode [ 224.418945][ T1073] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.450244][ T1073] bridge_slave_0: left allmulticast mode [ 224.474712][ T1073] bridge_slave_0: left promiscuous mode [ 224.485207][ T1073] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.618286][ T1073] veth1_macvtap: left promiscuous mode [ 224.626466][ T1073] veth0_macvtap: left promiscuous mode [ 224.635622][ T1073] veth1_vlan: left promiscuous mode [ 224.658260][ T1073] veth0_vlan: left promiscuous mode [ 225.420583][ T8916] netlink: 276 bytes leftover after parsing attributes in process `syz.6.959'. [ 225.925147][ T51] Bluetooth: hci3: command tx timeout [ 226.431076][ T1073] team0 (unregistering): Port device team_slave_1 removed [ 226.555808][ T1073] team0 (unregistering): Port device team_slave_0 removed [ 226.702934][ T1073] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 227.506558][ T1073] bond0 (unregistering): Released all slaves [ 227.700310][ T8889] netlink: 8 bytes leftover after parsing attributes in process `syz.5.954'. [ 227.922651][ T8836] bridge0: port 1(bridge_slave_0) entered blocking state [ 227.930225][ T8836] bridge0: port 1(bridge_slave_0) entered disabled state [ 227.938006][ T8836] bridge_slave_0: entered allmulticast mode [ 227.946314][ T8836] bridge_slave_0: entered promiscuous mode [ 227.973365][ T8836] bridge0: port 2(bridge_slave_1) entered blocking state [ 227.984830][ T8836] bridge0: port 2(bridge_slave_1) entered disabled state [ 228.004771][ T51] Bluetooth: hci3: command tx timeout [ 228.019513][ T8836] bridge_slave_1: entered allmulticast mode [ 228.043731][ T8836] bridge_slave_1: entered promiscuous mode [ 228.583264][ T8836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 228.638707][ T8836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 228.798070][ T8836] team0: Port device team_slave_0 added [ 228.900850][ T8836] team0: Port device team_slave_1 added [ 228.977810][ T1073] IPVS: stop unused estimator thread 0... [ 229.023376][ T8836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 229.045435][ T8836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 229.118232][ T8836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 229.163414][ T8836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 229.188654][ T8836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 229.242404][ T8836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 229.418929][ T8836] hsr_slave_0: entered promiscuous mode [ 229.455634][ T8836] hsr_slave_1: entered promiscuous mode [ 229.500545][ T8836] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 229.515341][ T8836] Cannot create hsr debugfs directory [ 229.848037][ T9008] netlink: 8 bytes leftover after parsing attributes in process `syz.6.987'. [ 229.885472][ T9008] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 229.894272][ T9008] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 229.903271][ T9008] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 229.912076][ T9008] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 230.000803][ T9008] netlink: 8 bytes leftover after parsing attributes in process `syz.6.987'. [ 230.084995][ T51] Bluetooth: hci3: command tx timeout [ 230.471783][ T9025] FAULT_INJECTION: forcing a failure. [ 230.471783][ T9025] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 230.498811][ T8836] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 230.505726][ T9025] CPU: 0 PID: 9025 Comm: syz.5.990 Not tainted syzkaller #0 [ 230.513078][ T9025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 230.523189][ T9025] Call Trace: [ 230.526558][ T9025] [ 230.529528][ T9025] dump_stack_lvl+0x18c/0x250 [ 230.534285][ T9025] ? show_regs_print_info+0x20/0x20 [ 230.539538][ T9025] ? load_image+0x420/0x420 [ 230.544092][ T9025] ? __lock_acquire+0x7d80/0x7d80 [ 230.549183][ T9025] should_fail_ex+0x394/0x4c0 [ 230.553929][ T9025] prepare_alloc_pages+0x1e1/0x5b0 [ 230.559117][ T9025] __alloc_pages+0x134/0x460 [ 230.563759][ T9025] ? zone_statistics+0x170/0x170 [ 230.568785][ T9025] ? alloc_pages+0x4e1/0x740 [ 230.573429][ T9025] get_zeroed_page+0x17/0x40 [ 230.578064][ T9025] mon_bin_open+0x229/0x510 [ 230.582633][ T9025] chrdev_open+0x58c/0x600 [ 230.587113][ T9025] ? cd_forget+0x160/0x160 [ 230.591593][ T9025] ? fsnotify_perm+0x3ed/0x5e0 [ 230.596450][ T9025] do_dentry_open+0x880/0x14b0 [ 230.601281][ T9025] ? cd_forget+0x160/0x160 [ 230.605757][ T9025] path_openat+0x284f/0x3270 [ 230.610423][ T9025] ? do_sys_openat2+0xda/0x1d0 [ 230.615233][ T9025] ? __x64_sys_openat+0x139/0x160 [ 230.620322][ T9025] ? verify_lock_unused+0x140/0x140 [ 230.625584][ T9025] ? do_filp_open+0x430/0x430 [ 230.630340][ T9025] do_filp_open+0x1f2/0x430 [ 230.634906][ T9025] ? vfs_tmpfile+0x620/0x620 [ 230.639575][ T9025] ? _raw_spin_unlock+0x28/0x40 [ 230.644471][ T9025] ? alloc_fd+0x590/0x640 [ 230.648868][ T9025] do_sys_openat2+0x134/0x1d0 [ 230.653615][ T9025] ? do_sys_open+0xe0/0xe0 [ 230.658096][ T9025] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 230.664132][ T9025] ? lock_chain_count+0x20/0x20 [ 230.669031][ T9025] ? lock_chain_count+0x20/0x20 [ 230.673938][ T9025] __x64_sys_openat+0x139/0x160 [ 230.678852][ T9025] do_syscall_64+0x55/0xb0 [ 230.683326][ T9025] ? clear_bhb_loop+0x40/0x90 [ 230.688066][ T9025] ? clear_bhb_loop+0x40/0x90 [ 230.692817][ T9025] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 230.698776][ T9025] RIP: 0033:0x7fd9aaf5e98e [ 230.703252][ T9025] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 230.722924][ T9025] RSP: 002b:00007fd9abea3b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 230.731416][ T9025] RAX: ffffffffffffffda RBX: 00007fd9abea46c0 RCX: 00007fd9aaf5e98e [ 230.739453][ T9025] RDX: 0000000000000000 RSI: 00007fd9abea3c00 RDI: ffffffffffffff9c [ 230.747472][ T9025] RBP: 00007fd9abea3c00 R08: 0000000000000000 R09: 0000000000000000 [ 230.755494][ T9025] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 230.763525][ T9025] R13: 00007fd9ab226038 R14: 00007fd9ab225fa0 R15: 00007ffcc3a3cb68 [ 230.771594][ T9025] [ 230.811052][ T8836] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 230.842510][ T8836] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 230.866745][ T8836] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 231.098202][ T8836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 231.143380][ T8836] 8021q: adding VLAN 0 to HW filter on device team0 [ 231.186705][ T1073] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.193963][ T1073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 231.248825][ T3480] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.256126][ T3480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 231.403024][ T8836] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 231.519318][ T9044] netlink: 12 bytes leftover after parsing attributes in process `syz.2.995'. [ 231.622136][ T9029] overlayfs: failed to resolve './file0/file0': -103 [ 231.677566][ T9050] loop5: detected capacity change from 0 to 128 [ 231.713231][ T9050] FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 232.015133][ T1135] FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 232.053499][ T8836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 232.880046][ T9091] jffs2: notice: (9091) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 233.050378][ T8836] veth0_vlan: entered promiscuous mode [ 233.070567][ T9098] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1011'. [ 233.098621][ T8836] veth1_vlan: entered promiscuous mode [ 233.238425][ T8836] veth0_macvtap: entered promiscuous mode [ 233.279544][ T8836] veth1_macvtap: entered promiscuous mode [ 233.344256][ T8836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 233.384902][ T8836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 233.416668][ T8836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 233.444964][ T8836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 233.464641][ T8836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 233.484637][ T8836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 233.506823][ T8836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 233.541194][ T8836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 233.564936][ T8836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 233.584726][ T8836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 233.603202][ T8836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 233.613607][ T8836] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 233.624826][ T8836] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 233.636913][ T8836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 233.653356][ T8836] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 233.663364][ T8836] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 233.672496][ T8836] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 233.683125][ T8836] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 233.936452][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 233.962039][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 234.065505][ T1073] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 234.089137][ T1073] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 234.670350][ T9144] loop7: detected capacity change from 0 to 256 [ 234.774373][ T9144] exFAT-fs (loop7): failed to load upcase table (idx : 0x00011a39, chksum : 0xd4e5c97b, utbl_chksum : 0xe619d30d) [ 235.100394][ T9144] exFAT-fs (loop7): error, invalid size(size(4096) > aligned(9223372036854777344) [ 235.100394][ T9144] [ 235.144262][ T9144] exFAT-fs (loop7): Filesystem has been set read-only [ 237.175997][ T9218] sch_tbf: burst 7 is lower than device bridge0 mtu (1514) ! [ 237.398298][ T9221] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 237.441226][ T9223] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1043'. [ 237.472071][ T9223] sch_tbf: burst 0 is lower than device bridge0 mtu (1514) ! [ 237.609342][ T9225] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 237.686860][ T9225] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 237.790027][ T9225] bond0 (unregistering): (slave ip6gretap0): Releasing backup interface [ 237.826452][ T9225] bond0 (unregistering): Released all slaves [ 238.603896][ T1135] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.745147][ T9] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 238.851034][ T1135] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.944765][ T9] usb 8-1: Using ep0 maxpacket: 8 [ 238.957228][ T9] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 238.979345][ T9] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 239.012689][ T9] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 239.053276][ T9] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 239.086073][ T1135] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.094834][ T9] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 239.125639][ T9] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.263605][ T1135] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.363591][ T9] usb 8-1: GET_CAPABILITIES returned 0 [ 239.381156][ T9] usbtmc 8-1:16.0: can't read capabilities [ 239.632049][ C0] usbtmc 8-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 239.642183][ C0] usbtmc 8-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 239.651543][ C0] usbtmc 8-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 239.689157][ T6411] usb 8-1: USB disconnect, device number 2 [ 239.770708][ T5788] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 239.783261][ T5788] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 239.795503][ T5788] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 239.808563][ T5788] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 239.817354][ T5788] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 239.824899][ T5788] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 240.207193][ T9287] netlink: 276 bytes leftover after parsing attributes in process `syz.2.1066'. [ 240.473745][ T9300] loop7: detected capacity change from 0 to 512 [ 240.544518][ T9300] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 240.767127][ T8836] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 241.511696][ T9276] chnl_net:caif_netlink_parms(): no params data found [ 241.932292][ T51] Bluetooth: hci0: command tx timeout [ 242.131777][ T9336] netlink: 'syz.7.1075': attribute type 1 has an invalid length. [ 242.150956][ T9336] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1075'. [ 242.233283][ T1135] hsr_slave_0: left promiscuous mode [ 242.314980][ T1135] hsr_slave_1: left promiscuous mode [ 242.355494][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 242.394689][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 242.425988][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 242.446148][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 242.466124][ T33] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 242.485610][ T1135] bridge_slave_1: left allmulticast mode [ 242.504681][ T1135] bridge_slave_1: left promiscuous mode [ 242.524903][ T1135] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.538306][ T1135] bridge_slave_0: left allmulticast mode [ 242.544040][ T1135] bridge_slave_0: left promiscuous mode [ 242.567807][ T1135] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.655462][ T1135] veth1_macvtap: left promiscuous mode [ 242.661352][ T1135] veth0_macvtap: left promiscuous mode [ 242.681726][ T1135] veth1_vlan: left promiscuous mode [ 242.691797][ T1135] veth0_vlan: left promiscuous mode [ 242.991431][ T9361] fuse: Bad value for 'fd' [ 244.004768][ T5788] Bluetooth: hci0: command tx timeout [ 244.613099][ T9385] ip_tables: iptables: counters copy to user failed while replacing table [ 245.387541][ T1135] team0 (unregistering): Port device team_slave_1 removed [ 245.474365][ T1135] team0 (unregistering): Port device team_slave_0 removed [ 245.542590][ T1135] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 245.628214][ T1135] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 246.087405][ T5788] Bluetooth: hci0: command tx timeout [ 246.138924][ T1135] bond0 (unregistering): Released all slaves [ 246.349527][ T9276] bridge0: port 1(bridge_slave_0) entered blocking state [ 246.371384][ T9276] bridge0: port 1(bridge_slave_0) entered disabled state [ 246.381610][ T9276] bridge_slave_0: entered allmulticast mode [ 246.389566][ T9276] bridge_slave_0: entered promiscuous mode [ 246.403717][ T9276] bridge0: port 2(bridge_slave_1) entered blocking state [ 246.457452][ T9276] bridge0: port 2(bridge_slave_1) entered disabled state [ 246.495141][ T9276] bridge_slave_1: entered allmulticast mode [ 246.503216][ T9276] bridge_slave_1: entered promiscuous mode [ 246.603975][ T9413] sch_tbf: burst 7 is lower than device bridge0 mtu (1514) ! [ 246.712908][ T9416] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1104'. [ 246.744058][ T9416] sch_tbf: burst 0 is lower than device bridge0 mtu (1514) ! [ 246.776756][ T9276] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 246.827909][ T9276] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 247.088282][ T9276] team0: Port device team_slave_0 added [ 247.149332][ T9276] team0: Port device team_slave_1 added [ 247.227467][ T9424] loop6: detected capacity change from 0 to 512 [ 247.262682][ T9276] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 247.329981][ T9276] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 247.388295][ T9276] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 247.400568][ T9424] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 247.438660][ T9424] ext4 filesystem being mounted at /61/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 247.528874][ T9276] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 247.550412][ T9276] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 247.649988][ T9276] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 247.780019][ T8527] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 247.827113][ T9276] hsr_slave_0: entered promiscuous mode [ 247.892941][ T9276] hsr_slave_1: entered promiscuous mode [ 248.174725][ T5788] Bluetooth: hci0: command tx timeout [ 248.679882][ T9276] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 248.725735][ T9276] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 248.760556][ T9276] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 248.835786][ T9463] netlink: 84 bytes leftover after parsing attributes in process `syz.7.1117'. [ 248.856949][ T9276] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 249.004174][ T9469] FAULT_INJECTION: forcing a failure. [ 249.004174][ T9469] name failslab, interval 1, probability 0, space 0, times 0 [ 249.029270][ T9469] CPU: 0 PID: 9469 Comm: syz.7.1120 Not tainted syzkaller #0 [ 249.036743][ T9469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 249.046855][ T9469] Call Trace: [ 249.050184][ T9469] [ 249.053168][ T9469] dump_stack_lvl+0x18c/0x250 [ 249.057920][ T9469] ? show_regs_print_info+0x20/0x20 [ 249.063184][ T9469] ? load_image+0x420/0x420 [ 249.067749][ T9469] ? __might_sleep+0xe0/0xe0 [ 249.072413][ T9469] ? __lock_acquire+0x7d80/0x7d80 [ 249.077528][ T9469] should_fail_ex+0x394/0x4c0 [ 249.082268][ T9469] should_failslab+0x9/0x20 [ 249.086841][ T9469] slab_pre_alloc_hook+0x59/0x300 [ 249.091923][ T9469] ? __might_sleep+0xe0/0xe0 [ 249.096576][ T9469] ? load_msg+0xc4/0x380 [ 249.100885][ T9469] ? load_msg+0xc4/0x380 [ 249.105185][ T9469] __kmem_cache_alloc_node+0x53/0x250 [ 249.110636][ T9469] ? load_msg+0xc4/0x380 [ 249.114939][ T9469] __kmalloc+0xa7/0x240 [ 249.119164][ T9469] load_msg+0xc4/0x380 [ 249.123298][ T9469] do_msgrcv+0x279/0x13d0 [ 249.127689][ T9469] ? do_msgrcv+0x13d0/0x13d0 [ 249.132430][ T9469] ? __might_fault+0xc6/0x120 [ 249.137153][ T9469] ? __might_fault+0xaa/0x120 [ 249.141887][ T9469] ? ksys_msgrcv+0x40/0x40 [ 249.146356][ T9469] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 249.152399][ T9469] ? lock_chain_count+0x20/0x20 [ 249.157315][ T9469] ? lockdep_hardirqs_on+0x98/0x150 [ 249.162577][ T9469] ? __x64_sys_msgrcv+0x20/0xd0 [ 249.167496][ T9469] do_syscall_64+0x55/0xb0 [ 249.171969][ T9469] ? clear_bhb_loop+0x40/0x90 [ 249.176705][ T9469] ? clear_bhb_loop+0x40/0x90 [ 249.181449][ T9469] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 249.187398][ T9469] RIP: 0033:0x7f7c2e79e159 [ 249.191875][ T9469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 249.211535][ T9469] RSP: 002b:00007f7c2f70c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000046 [ 249.215590][ T6426] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 249.219988][ T9469] RAX: ffffffffffffffda RBX: 00007f7c2ea25fa0 RCX: 00007f7c2e79e159 [ 249.220009][ T9469] RDX: 00000000ffffff4e RSI: 0000200000002fc0 RDI: 0000000000000000 [ 249.220024][ T9469] RBP: 00007f7c2e835024 R08: 0000000000004800 R09: 0000000000000000 [ 249.220039][ T9469] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 249.220053][ T9469] R13: 00007f7c2ea26038 R14: 00007f7c2ea25fa0 R15: 00007ffc6db765c8 [ 249.220085][ T9469] [ 249.280844][ T9276] 8021q: adding VLAN 0 to HW filter on device bond0 [ 249.353093][ T9276] 8021q: adding VLAN 0 to HW filter on device team0 [ 249.419915][ T2987] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.427184][ T2987] bridge0: port 1(bridge_slave_0) entered forwarding state [ 249.467806][ T6426] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 249.483267][ T2987] bridge0: port 2(bridge_slave_1) entered blocking state [ 249.484378][ T6426] usb 7-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 249.490502][ T2987] bridge0: port 2(bridge_slave_1) entered forwarding state [ 249.551908][ T6426] usb 7-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice= 1.00 [ 249.572268][ T6426] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.020076][ T6426] dvb_ttusb_budget: ttusb_init_controller: error [ 250.034697][ T6426] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 250.045162][ T5764] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 250.203388][ T6426] DVB: Unable to find symbol stv0299_attach() [ 250.257213][ T5764] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 250.288249][ T5764] usb 8-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 250.311979][ T5764] usb 8-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 37753, setting to 1024 [ 250.331798][ T9276] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 250.348234][ T6426] DVB: Unable to find symbol tda8083_attach() [ 250.356020][ T6426] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 250.385143][ T5764] usb 8-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 250.420327][ T5764] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 250.441944][ T5764] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.475437][ T5764] usb 8-1: Product: syz [ 250.479697][ T5764] usb 8-1: Manufacturer: syz [ 250.484374][ T5764] usb 8-1: SerialNumber: syz [ 250.500199][ T9498] dvb_ttusb_budget: cmd xter failed, receive error -22 [ 250.526920][ T5764] cdc_mbim 8-1:1.0: skipping garbage [ 250.702258][ T6411] usb 7-1: USB disconnect, device number 2 [ 250.746759][ T9478] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 250.754395][ T9478] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 251.065875][ T9276] veth0_vlan: entered promiscuous mode [ 251.092759][ T9276] veth1_vlan: entered promiscuous mode [ 251.165678][ T9276] veth0_macvtap: entered promiscuous mode [ 251.190534][ T9276] veth1_macvtap: entered promiscuous mode [ 251.244461][ T9276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 251.261386][ T9276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 251.273452][ T9276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 251.294272][ T9276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 251.323139][ T9276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 251.357599][ T9276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 251.379132][ T9276] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 251.415380][ T9478] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 251.443958][ T9478] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 251.451647][ T9276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 251.480900][ T9276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 251.484968][ T5764] cdc_mbim 8-1:1.0: setting tx_max = 184 [ 251.514735][ T9276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 251.542110][ T5764] cdc_mbim 8-1:1.0: cdc-wdm0: USB WDM device [ 251.544825][ T9276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 251.571806][ T5764] wwan wwan0: port wwan0mbim0 attached [ 251.577717][ T9276] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 251.577739][ T9276] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 251.600860][ T9276] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 251.673963][ T5764] cdc_mbim 8-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.7-1, CDC MBIM, 72:f5:50:d4:ce:98 [ 251.693457][ T9276] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.723503][ T9276] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.738701][ T9276] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.751380][ T9276] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 251.792335][ T5764] usb 8-1: USB disconnect, device number 3 [ 251.831169][ T5764] cdc_mbim 8-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.7-1, CDC MBIM [ 251.944120][ T5764] wwan wwan0: port wwan0mbim0 disconnected [ 252.049508][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 252.065381][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 252.136542][ T2987] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 252.156339][ T2987] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 252.906159][ T28] audit: type=1326 audit(1788419858.120:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9548 comm="syz.7.1136" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7c2e79e159 code=0x0 [ 253.120454][ T9569] loop6: detected capacity change from 0 to 1024 [ 253.641478][ T9587] loop7: detected capacity change from 0 to 64 [ 253.727326][ T9587] hfs: filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only. [ 253.752124][ T9591] netlink: 'syz.8.1146': attribute type 1 has an invalid length. [ 254.002503][ T9595] input: syz1 as /devices/virtual/input/input15 [ 254.226735][ T5789] udevd[5789]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 254.676184][ T66] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 254.700156][ T9617] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 254.866590][ T9628] netlink: 'syz.2.1157': attribute type 4 has an invalid length. [ 255.015890][ T9630] netlink: 'syz.2.1157': attribute type 4 has an invalid length. [ 256.010664][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.017350][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.671555][ T9708] loop7: detected capacity change from 0 to 1024 [ 258.251318][ T66] Bluetooth: hci4: Frame reassembly failed (-84) [ 258.362304][ T9733] device-mapper: ioctl: Invalid ioctl structure: name m, dev f800 [ 258.724848][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 259.106146][ T9760] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1195'. [ 259.222635][ T9760] bond0: entered promiscuous mode [ 259.247670][ T9760] 8021q: adding VLAN 0 to HW filter on device bond0 [ 259.402661][ T9765] 8021q: adding VLAN 0 to HW filter on device bond0 [ 259.437518][ T9765] bond0: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 259.489613][ T9765] bond0: (slave ip6gre1): Error -95 calling set_mac_address [ 260.245065][ T51] Bluetooth: hci4: command 0x1003 tx timeout [ 260.252915][ T5788] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 260.356545][ T9801] jffs2: notice: (9801) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 261.655852][ T9831] loop8: detected capacity change from 0 to 128 [ 263.501837][ T9903] netlink: 'syz.8.1242': attribute type 1 has an invalid length. [ 263.712573][ T9911] FAULT_INJECTION: forcing a failure. [ 263.712573][ T9911] name failslab, interval 1, probability 0, space 0, times 0 [ 263.741559][ T9911] CPU: 1 PID: 9911 Comm: syz.8.1244 Not tainted syzkaller #0 [ 263.749035][ T9911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 263.759140][ T9911] Call Trace: [ 263.762472][ T9911] [ 263.765455][ T9911] dump_stack_lvl+0x18c/0x250 [ 263.770291][ T9911] ? show_regs_print_info+0x20/0x20 [ 263.775554][ T9911] ? load_image+0x420/0x420 [ 263.780115][ T9911] ? __might_sleep+0xe0/0xe0 [ 263.784759][ T9911] ? __lock_acquire+0x7d80/0x7d80 [ 263.789893][ T9911] should_fail_ex+0x394/0x4c0 [ 263.794661][ T9911] should_failslab+0x9/0x20 [ 263.799219][ T9911] slab_pre_alloc_hook+0x59/0x300 [ 263.804314][ T9911] ? __might_fault+0xaa/0x120 [ 263.809038][ T9911] kmem_cache_alloc+0x5a/0x2c0 [ 263.813865][ T9911] ? getname_flags+0xbb/0x500 [ 263.818614][ T9911] getname_flags+0xbb/0x500 [ 263.823180][ T9911] user_path_at_empty+0x2c/0x60 [ 263.828115][ T9911] __se_sys_mount+0x2a8/0x3d0 [ 263.832871][ T9911] ? __x64_sys_mount+0xc0/0xc0 [ 263.837697][ T9911] ? lockdep_hardirqs_on+0x98/0x150 [ 263.842952][ T9911] ? __x64_sys_mount+0x20/0xc0 [ 263.847769][ T9911] do_syscall_64+0x55/0xb0 [ 263.852235][ T9911] ? clear_bhb_loop+0x40/0x90 [ 263.856963][ T9911] ? clear_bhb_loop+0x40/0x90 [ 263.861692][ T9911] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 263.867639][ T9911] RIP: 0033:0x7f661399e159 [ 263.872101][ T9911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 263.891755][ T9911] RSP: 002b:00007f6614909028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 263.900215][ T9911] RAX: ffffffffffffffda RBX: 00007f6613c25fa0 RCX: 00007f661399e159 [ 263.908237][ T9911] RDX: 00002000000000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 263.916253][ T9911] RBP: 00007f6613a35024 R08: 0000000000000000 R09: 0000000000000000 [ 263.924283][ T9911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 263.932291][ T9911] R13: 00007f6613c26038 R14: 00007f6613c25fa0 R15: 00007ffc73c40f68 [ 263.940320][ T9911] [ 264.934439][ T9951] netlink: 'syz.8.1254': attribute type 2 has an invalid length. [ 266.260276][ T9988] loop8: detected capacity change from 0 to 64 [ 266.732591][ T6411] IPVS: starting estimator thread 0... [ 266.871597][T10000] IPVS: using max 18 ests per chain, 43200 per kthread [ 266.884877][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 267.807486][T10039] pim6reg1: entered promiscuous mode [ 267.813071][T10039] pim6reg1: entered allmulticast mode [ 268.188765][T10050] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1287'. [ 268.425609][T10050] team0 (unregistering): Port device team_slave_0 removed [ 268.456491][T10050] team0 (unregistering): Port device team_slave_1 removed [ 268.542873][T10057] 9pnet: p9_errstr2errno: server reported unknown error n$Ž[ [ 268.542873][T10057] Q&|xù [ 269.511997][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805f99e400: rx timeout, send abort [ 269.520831][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805f99e400: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 270.121111][T10098] loop7: detected capacity change from 0 to 128 [ 270.239435][ T28] audit: type=1800 audit(1788419875.450:358): pid=10098 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.1299" name="bus" dev="loop7" ino=1048634 res=0 errno=0 [ 270.399855][T10106] syz.7.1299: attempt to access beyond end of device [ 270.399855][T10106] loop7: rw=2049, sector=817, nr_sectors = 224 limit=128 [ 270.804384][ C1] vcan0: j1939_tp_rxtimer: 0xffff888024e7e000: rx timeout, send abort [ 270.813257][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888024e7e000: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 270.815590][ T51] Bluetooth: hci4: command 0x1003 tx timeout [ 270.853052][ T5788] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 270.970522][T10118] xt_hashlimit: size too large, truncated to 1048576 [ 271.164337][T10127] loop6: detected capacity change from 0 to 128 [ 271.260644][T10127] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 272.851117][T10153] FAULT_INJECTION: forcing a failure. [ 272.851117][T10153] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 272.884883][T10153] CPU: 0 PID: 10153 Comm: syz.6.1318 Not tainted syzkaller #0 [ 272.892446][T10153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 272.902554][T10153] Call Trace: [ 272.905878][T10153] [ 272.908847][T10153] dump_stack_lvl+0x18c/0x250 [ 272.913578][T10153] ? show_regs_print_info+0x20/0x20 [ 272.918816][T10153] ? load_image+0x420/0x420 [ 272.923350][T10153] ? __lock_acquire+0x7d80/0x7d80 [ 272.928414][T10153] ? __virt_addr_valid+0x10c/0x380 [ 272.933561][T10153] should_fail_ex+0x394/0x4c0 [ 272.938276][T10153] _copy_to_user+0x2f/0xa0 [ 272.942726][T10153] bpf_vlog_reverse_ubuf+0x2ad/0x3a0 [ 272.948082][T10153] bpf_vlog_finalize+0x12b/0x3e0 [ 272.953074][T10153] finalize_log+0x96/0x160 [ 272.957520][T10153] ? btf_parse_struct_metas+0xde0/0xde0 [ 272.963100][T10153] ? btf_check_type_tags+0x674/0x680 [ 272.968422][T10153] btf_new_fd+0x757/0x9e0 [ 272.972796][T10153] ? bpf_btf_show_fdinfo+0x80/0x80 [ 272.977945][T10153] ? capable+0x88/0xe0 [ 272.982057][T10153] __sys_bpf+0x670/0x890 [ 272.986329][T10153] ? bpf_link_show_fdinfo+0x390/0x390 [ 272.991743][T10153] ? lock_chain_count+0x20/0x20 [ 272.996634][T10153] __x64_sys_bpf+0x7c/0x90 [ 273.001077][T10153] do_syscall_64+0x55/0xb0 [ 273.005533][T10153] ? clear_bhb_loop+0x40/0x90 [ 273.010242][T10153] ? clear_bhb_loop+0x40/0x90 [ 273.014954][T10153] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 273.020880][T10153] RIP: 0033:0x7fe079b9e159 [ 273.025323][T10153] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 273.044969][T10153] RSP: 002b:00007fe07a9ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 273.053415][T10153] RAX: ffffffffffffffda RBX: 00007fe079e25fa0 RCX: 00007fe079b9e159 [ 273.061417][T10153] RDX: 0000000000000028 RSI: 0000200000000d80 RDI: 0000000000000012 [ 273.069411][T10153] RBP: 00007fe079c35024 R08: 0000000000000000 R09: 0000000000000000 [ 273.077411][T10153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 273.085413][T10153] R13: 00007fe079e26038 R14: 00007fe079e25fa0 R15: 00007ffdc3ca7318 [ 273.093427][T10153] [ 273.594894][ T48] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 274.017495][ T6424] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 274.224863][ T6424] usb 7-1: Using ep0 maxpacket: 8 [ 274.239920][ T6424] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 274.270604][ T6424] usb 7-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 274.298068][ T6424] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.345918][ T6424] usb 7-1: config 0 descriptor?? [ 274.375932][ T6424] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 274.936789][T10187] loop8: detected capacity change from 0 to 512 [ 274.975888][T10187] EXT4-fs: Ignoring removed nobh option [ 275.077485][T10187] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 275.115372][T10187] ext4 filesystem being mounted at /57/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 275.549401][ T9276] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.690718][ T6424] gspca_vc032x: reg_w err -71 [ 275.695964][ T6424] vc032x: probe of 7-1:0.0 failed with error -71 [ 275.725169][ T6424] usb 7-1: USB disconnect, device number 3 [ 276.357560][T10220] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 278.261152][T10289] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 278.648490][T10294] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 279.437512][ T9] IPVS: starting estimator thread 0... [ 279.534767][T10323] IPVS: using max 21 ests per chain, 50400 per kthread [ 279.856065][T10303] loop8: detected capacity change from 0 to 32768 [ 279.913070][T10303] XFS (loop8): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 280.287516][T10303] XFS (loop8): Ending clean mount [ 280.372672][T10303] XFS (loop8): Quotacheck needed: Please wait. [ 280.525999][T10303] XFS (loop8): Quotacheck: Done. [ 280.552263][ T11] IPVS: stop unused estimator thread 0... [ 280.807654][ T9276] XFS (loop8): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 282.852255][T10413] loop8: detected capacity change from 0 to 256 [ 282.929908][T10413] exFAT-fs (loop8): failed to load upcase table (idx : 0x0000fd4f, chksum : 0xa9436649, utbl_chksum : 0xe619d30d) [ 283.216477][T10425] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1383'. [ 283.585179][ T6424] usb 9-1: new low-speed USB device number 2 using dummy_hcd [ 283.604422][T10440] loop7: detected capacity change from 0 to 512 [ 283.820427][ T6424] usb 9-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 283.892869][ T6424] usb 9-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid maxpacket 1040, setting to 8 [ 283.921903][ T6424] usb 9-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 283.938776][T10440] EXT4-fs error (device loop7): ext4_do_update_inode:5256: inode #16: comm syz.7.1389: corrupted inode contents [ 283.951894][ T6424] usb 9-1: config 0 interface 0 has no altsetting 0 [ 283.958707][ T6424] usb 9-1: New USB device found, idVendor=056a, idProduct=0100, bcdDevice= 0.00 [ 283.972585][ T6424] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 283.983468][ T6424] usb 9-1: config 0 descriptor?? [ 283.997675][T10440] EXT4-fs error (device loop7): ext4_dirty_inode:6144: inode #16: comm syz.7.1389: mark_inode_dirty error [ 284.016670][T10431] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 284.054436][T10440] EXT4-fs error (device loop7): ext4_do_update_inode:5256: inode #16: comm syz.7.1389: corrupted inode contents [ 284.075178][T10440] EXT4-fs error (device loop7): __ext4_ext_dirty:208: inode #16: comm syz.7.1389: mark_inode_dirty error [ 284.104024][T10440] EXT4-fs error (device loop7): ext4_do_update_inode:5256: inode #16: comm syz.7.1389: corrupted inode contents [ 284.121307][T10440] EXT4-fs error (device loop7) in ext4_orphan_del:303: Corrupt filesystem [ 284.132306][T10440] EXT4-fs error (device loop7): ext4_do_update_inode:5256: inode #16: comm syz.7.1389: corrupted inode contents [ 284.164889][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 284.182252][T10440] EXT4-fs error (device loop7): ext4_truncate:4302: inode #16: comm syz.7.1389: mark_inode_dirty error [ 284.194023][T10440] EXT4-fs error (device loop7) in ext4_process_orphan:345: Corrupt filesystem [ 284.219603][T10440] EXT4-fs (loop7): 1 truncate cleaned up [ 284.235928][T10440] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 284.268303][T10263] Quota error (device loop7): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 284.284744][T10440] ext4 filesystem being mounted at /86/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 284.292111][T10263] EXT4-fs error (device loop7): ext4_release_dquot:6989: comm kworker/u4:11: Failed to release dquot type 1 [ 284.355811][T10460] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1393'. [ 284.414806][T10460] netlink: get zone limit has 4 unknown bytes [ 284.483595][T10440] Bluetooth: MGMT ver 1.22 [ 284.606791][ T8836] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 284.713369][ T6424] wacom 0003:056A:0100.0007: hidraw0: USB HID v0.00 Joystick [HID 056a:0100] on usb-dummy_hcd.8-1/input0 [ 284.980640][ T5821] usb 9-1: USB disconnect, device number 2 [ 285.221259][T10484] netlink: 'syz.7.1400': attribute type 3 has an invalid length. [ 285.488544][T10496] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 285.836023][T10505] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1406'. [ 286.006510][T10513] loop5: detected capacity change from 0 to 7 [ 286.067392][T10513] Dev loop5: unable to read RDB block 7 [ 286.094681][T10513] loop5: unable to read partition table [ 286.100743][T10513] loop5: partition table beyond EOD, truncated [ 286.120906][T10513] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 288.386829][T10577] netlink: 'syz.6.1426': attribute type 1 has an invalid length. [ 288.450470][T10577] 8021q: adding VLAN 0 to HW filter on device bond1 [ 288.634193][T10580] bond1: (slave ip6gretap1): making interface the new active one [ 288.677872][T10580] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 290.871824][T10566] loop7: detected capacity change from 0 to 131072 [ 290.911968][T10566] F2FS-fs (loop7): invalid crc value [ 290.934075][T10566] F2FS-fs (loop7): Failed to start F2FS issue_checkpoint_thread (-4) [ 292.565028][ T6424] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 292.785872][ T6424] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 292.810004][ T6424] usb 8-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 292.842943][ T6424] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 292.870662][ T6424] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 292.901954][ T6424] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 292.950601][ T6424] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 292.980010][ T6424] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 293.015105][ T6424] usb 8-1: Product: syz [ 293.031496][ T6424] usb 8-1: Manufacturer: syz [ 293.071488][ T6424] cdc_wdm 8-1:1.0: skipping garbage [ 293.091115][ T6424] cdc_wdm 8-1:1.0: skipping garbage [ 293.114546][ T6424] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 293.143020][ T6424] cdc_wdm 8-1:1.0: Unknown control protocol [ 293.162317][T10712] netlink: 16 bytes leftover after parsing attributes in process `syz.8.1463'. [ 293.670058][ C1] cdc_wdm 8-1:1.0: Unexpected error -71 [ 293.672475][ T6411] usb 8-1: USB disconnect, device number 4 [ 293.683886][ C1] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 293.690863][ C1] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 293.697009][ C1] cdc_wdm 8-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 294.116771][T10742] netlink: 'syz.2.1469': attribute type 7 has an invalid length. [ 294.141447][T10742] netlink: 'syz.2.1469': attribute type 7 has an invalid length. [ 294.394985][ T5764] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 294.550355][T10753] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1472'. [ 294.613398][ T5764] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 294.635616][ T5764] usb 7-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 294.677778][ T5764] usb 7-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 294.709634][ T5764] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.724095][T10759] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1474'. [ 294.726555][ T5764] usb 7-1: Product: syz [ 294.747093][ T5764] usb 7-1: Manufacturer: syz [ 294.752293][ T5764] usb 7-1: SerialNumber: syz [ 295.024052][ T5764] snd-usb-caiaq 7-1:1.0: invalid EPs [ 295.044645][ T5764] usb 7-1: unable to init card! (ret=-22) [ 295.051433][ T5764] snd-usb-caiaq: probe of 7-1:1.0 failed with error -22 [ 295.075547][ T5821] IPVS: starting estimator thread 0... [ 295.186697][ T5764] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 295.210950][ T5821] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 295.218892][T10771] IPVS: using max 18 ests per chain, 43200 per kthread [ 295.332449][ T5764] usb 7-1: USB disconnect, device number 4 [ 295.461412][ T6415] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 295.500209][ T6424] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 295.952277][T10777] ceph: No mds server is up or the cluster is laggy [ 295.973979][T10773] ceph: No mds server is up or the cluster is laggy [ 295.988992][ T5764] libceph: mon0 (1)0.0.0.0:6789 socket error on write [ 296.037197][ T5821] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 297.037215][T10848] 9pnet: p9_errstr2errno: server reported unknown error 000060928, [ 297.092261][T10850] netlink: 'syz.2.1495': attribute type 12 has an invalid length. [ 297.583987][T10867] loop8: detected capacity change from 0 to 512 [ 297.802341][T10867] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 298.097716][ T9276] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 298.699749][T10899] x_tables: duplicate underflow at hook 2 [ 299.194540][T10917] ip6gre1: entered promiscuous mode [ 299.210287][T10917] ip6gre1: entered allmulticast mode [ 299.229844][ T33] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 299.247055][ T33] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 299.255147][ T6415] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 299.275299][T10917] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 299.695308][ T5764] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 299.860912][ T5764] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 301.197035][T10999] device-mapper: ioctl: name not supplied when creating device [ 301.312707][T11004] loop8: detected capacity change from 0 to 128 [ 301.720200][T11016] futex_wake_op: syz.8.1543 tries to shift op by 144; fix this program [ 302.081835][T11028] loop8: detected capacity change from 0 to 128 [ 302.161056][T11030] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1551'. [ 302.625691][T11042] veth1_to_bridge: entered allmulticast mode [ 302.647094][T11042] veth1_to_bridge: left allmulticast mode [ 303.039565][T11059] loop6: detected capacity change from 0 to 128 [ 303.063505][T11059] FAT-fs (loop6): bogus number of reserved sectors [ 303.087730][T11059] FAT-fs (loop6): This doesn't look like a DOS 1.x volume; DOS 2.x BPB is non-zero [ 303.103027][T11061] fuse: Bad value for 'fd' [ 303.114194][T11059] FAT-fs (loop6): Can't find a valid FAT filesystem [ 303.320635][ T28] audit: type=1800 audit(1788419908.530:359): pid=11068 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1569" name="use" dev="configfs" ino=24176 res=0 errno=0 [ 303.414995][ T6424] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 303.444778][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 303.596628][ T6424] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 303.628453][ T6424] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 303.664706][ T6424] usb 8-1: New USB device found, idVendor=1199, idProduct=b000, bcdDevice= 0.00 [ 303.673821][ T6424] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.969018][ T6427] usb 8-1: USB disconnect, device number 5 [ 304.615304][T11098] loop7: detected capacity change from 0 to 1024 [ 304.623329][T10272] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 304.642514][T11098] EXT4-fs: Ignoring removed bh option [ 304.682599][T11098] EXT4-fs (loop7): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 304.719774][T11098] ext4 filesystem being mounted at /123/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 304.859638][ T8836] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 305.184183][T11118] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1587'. [ 305.272413][T11118] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.281879][T11118] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.298630][T11118] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.307564][T11118] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 305.341536][T11118] vxlan0: entered promiscuous mode [ 306.946953][T11164] overlayfs: upper fs does not support tmpfile. [ 307.264723][T11171] FAULT_INJECTION: forcing a failure. [ 307.264723][T11171] name failslab, interval 1, probability 0, space 0, times 0 [ 307.281881][T11171] CPU: 1 PID: 11171 Comm: syz.8.1604 Not tainted syzkaller #0 [ 307.289424][T11171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 307.299587][T11171] Call Trace: [ 307.302915][T11171] [ 307.305910][T11171] dump_stack_lvl+0x18c/0x250 [ 307.310673][T11171] ? show_regs_print_info+0x20/0x20 [ 307.315928][T11171] ? load_image+0x420/0x420 [ 307.320508][T11171] ? __might_sleep+0xe0/0xe0 [ 307.325151][T11171] ? __lock_acquire+0x7d80/0x7d80 [ 307.330236][T11171] should_fail_ex+0x394/0x4c0 [ 307.334983][T11171] should_failslab+0x9/0x20 [ 307.339540][T11171] slab_pre_alloc_hook+0x59/0x300 [ 307.344616][T11171] ? lockdep_init_map_type+0x9c/0x8e0 [ 307.350063][T11171] ? kvmalloc_node+0x70/0x180 [ 307.354793][T11171] ? kvmalloc_node+0x70/0x180 [ 307.359527][T11171] __kmem_cache_alloc_node+0x53/0x250 [ 307.364976][T11171] ? kvmalloc_node+0x70/0x180 [ 307.369741][T11171] __kmalloc_node+0xa6/0x240 [ 307.374494][T11171] kvmalloc_node+0x70/0x180 [ 307.379103][T11171] rhashtable_init+0x529/0xa60 [ 307.383941][T11171] ipc_init_ids+0x7b/0x1f0 [ 307.388453][T11171] msg_init_ns+0x121/0x180 [ 307.392955][T11171] copy_ipcs+0x33f/0x500 [ 307.397256][T11171] create_new_namespaces+0x212/0x700 [ 307.402645][T11171] unshare_nsproxy_namespaces+0x11a/0x160 [ 307.408429][T11171] ksys_unshare+0x4fa/0x8f0 [ 307.413011][T11171] ? sighand_ctor+0x50/0x50 [ 307.417578][T11171] ? lock_chain_count+0x20/0x20 [ 307.422528][T11171] ? syscall_enter_from_user_mode+0x25/0x80 [ 307.428521][T11171] __x64_sys_unshare+0x38/0x40 [ 307.433350][T11171] do_syscall_64+0x55/0xb0 [ 307.437825][T11171] ? clear_bhb_loop+0x40/0x90 [ 307.442556][T11171] ? clear_bhb_loop+0x40/0x90 [ 307.447327][T11171] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 307.453278][T11171] RIP: 0033:0x7f661399e159 [ 307.457742][T11171] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.477405][T11171] RSP: 002b:00007f6614909028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 307.485870][T11171] RAX: ffffffffffffffda RBX: 00007f6613c25fa0 RCX: 00007f661399e159 [ 307.493880][T11171] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000004a000200 [ 307.501923][T11171] RBP: 00007f6613a35024 R08: 0000000000000000 R09: 0000000000000000 [ 307.509975][T11171] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 307.517989][T11171] R13: 00007f6613c26038 R14: 00007f6613c25fa0 R15: 00007ffc73c40f68 [ 307.526022][T11171] [ 309.858734][T11244] syz.2.1635 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 310.725343][ T5764] usb 9-1: new full-speed USB device number 3 using dummy_hcd [ 310.936874][ T5764] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 310.965906][ T5764] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 310.985890][ T5764] usb 9-1: config 16 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 311.016958][ T5764] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 311.037014][ T5764] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 311.098930][ T5764] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.153927][ T5764] usbtmc 9-1:16.0: bulk endpoints not found [ 311.957380][T11298] bridge0: port 3(dummy0) entered blocking state [ 311.964282][T11298] bridge0: port 3(dummy0) entered disabled state [ 311.971684][T11298] dummy0: entered allmulticast mode [ 311.980415][T11298] dummy0: entered promiscuous mode [ 311.986925][T11298] bridge0: port 3(dummy0) entered blocking state [ 311.993847][T11298] bridge0: port 3(dummy0) entered forwarding state [ 312.012616][T11300] dummy0: left allmulticast mode [ 312.018508][T11300] dummy0: left promiscuous mode [ 312.025864][T11300] bridge0: port 3(dummy0) entered disabled state [ 312.198769][T11303] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1654'. [ 312.325151][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 313.448789][ T5821] usb 9-1: USB disconnect, device number 3 [ 314.442130][T11368] Invalid ELF header len 3 [ 315.000224][T11380] gadgetfs: bound to dummy_udc driver [ 316.410114][T11430] loop7: detected capacity change from 0 to 4096 [ 316.428679][T11434] netlink: 208052 bytes leftover after parsing attributes in process `syz.6.1707'. [ 316.488637][T11430] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 316.753267][ T8836] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.451063][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.457775][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.515581][T11447] loop7: detected capacity change from 0 to 32768 [ 317.563743][T11447] XFS (loop7): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 317.702871][T11447] XFS (loop7): Ending clean mount [ 317.991723][ T8836] XFS (loop7): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd [ 318.175157][ T6411] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 318.402768][ T6411] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 318.424214][ T6411] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 318.435649][ T6411] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 318.452947][ T6411] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 318.461558][ T6411] usb 7-1: SerialNumber: syz [ 318.498237][T11481] vxcan3: entered promiscuous mode [ 318.682816][ T6411] usb 7-1: 0:2 : does not exist [ 318.754076][ T6411] usb 7-1: USB disconnect, device number 5 [ 318.834849][ T5789] udevd[5789]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 318.852911][T11486] 8021q: adding VLAN 0 to HW filter on device bond2 [ 318.875697][T11486] bridge0: port 3(bond2) entered blocking state [ 318.882235][T11486] bridge0: port 3(bond2) entered disabled state [ 318.897165][T11486] bond2: entered allmulticast mode [ 318.904341][T11486] bond2: entered promiscuous mode [ 318.927176][T11486] bridge0: port 3(bond2) entered blocking state [ 318.933650][T11486] bridge0: port 3(bond2) entered forwarding state [ 319.274694][ T6427] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 319.365076][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 319.469757][ T6427] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 319.504950][ T6427] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 319.534992][ T6427] usb 9-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 319.544128][ T6427] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 319.615567][ T6427] usb 9-1: probing VID:PID(0424:012C) [ 319.638711][ T6427] usb 9-1: vub300 testing BULK IN EndPoint(0) 81 [ 319.645984][ T6427] usb 9-1: vub300 testing BULK OUT EndPoint(1) 02 [ 319.652498][ T6427] usb 9-1: vub300 testing BULK IN EndPoint(2) 83 [ 319.669530][ T6427] usb 9-1: vub300 testing BULK OUT EndPoint(3) 04 [ 319.685075][ T6427] usb 9-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 319.714409][ T48] bridge0: port 3(bond2) entered disabled state [ 319.963316][T11506] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1730'. [ 320.016949][ T6427] usb 9-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 320.218596][ T6427] usb 9-1: USB vub300 remote SDIO host controller[0]connected with SD/SDIO card inserted [ 320.563194][T11518] device-mapper: ioctl: device name cannot contain '/' [ 321.335403][ T5780] usb 9-1: USB disconnect, device number 4 [ 321.343297][ T5821] usb 9-1: SET_CLOCK_SPEED 200kHz failed with retval=-19 [ 321.475058][ T5780] USB vub300 remote SDIO host controller[0] now disconnected [ 322.059169][T11564] veth1_to_bond: entered allmulticast mode [ 322.085355][ C1] [ 322.085562][T11564] veth1_to_bond: entered promiscuous mode [ 322.088282][ C1] ============================= [ 322.099032][ C1] WARNING: suspicious RCU usage [ 322.103943][ C1] syzkaller #0 Not tainted [ 322.108463][ C1] ----------------------------- [ 322.113354][ C1] kernel/sched/core.c:10174 Illegal context switch in RCU-sched read-side critical section! [ 322.123502][ C1] [ 322.123502][ C1] other info that might help us debug this: [ 322.123502][ C1] [ 322.133822][ C1] [ 322.133822][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 322.142018][ C1] 9 locks held by syz-executor/5776: [ 322.147425][ C1] #0: ffffffff8d1d48b0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x298/0x1e30 [ 322.156353][ C1] #1: ffff888021493120 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 322.165490][ C1] #2: ffff88801bef81a0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 322.174808][ C1] #3: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 322.184409][ C1] #4: ffff888024e1df18 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 322.195176][ C1] #5: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 322.204801][ C1] #6: ffff888063dae498 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 322.215352][ C1] #7: ffffffff8d1321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 322.224880][ C1] #8: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 322.235480][ C1] [ 322.235480][ C1] stack backtrace: [ 322.241414][ C1] CPU: 1 PID: 5776 Comm: syz-executor Not tainted syzkaller #0 [ 322.249011][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 322.259152][ C1] Call Trace: [ 322.262477][ C1] [ 322.265416][ C1] dump_stack_lvl+0x18c/0x250 [ 322.270146][ C1] ? show_regs_print_info+0x20/0x20 [ 322.275485][ C1] ? load_image+0x420/0x420 [ 322.280040][ C1] lockdep_rcu_suspicious+0x1e1/0x300 [ 322.285474][ C1] __might_resched+0x123/0x5f0 [ 322.290299][ C1] ? __might_sleep+0xe0/0xe0 [ 322.294957][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 322.300882][ C1] ? _raw_spin_unlock+0x40/0x40 [ 322.305751][ C1] ? kasan_set_track+0x5f/0x70 [ 322.310570][ C1] ? kasan_save_free_info+0x28/0x40 [ 322.315838][ C1] ? ____kasan_slab_free+0x126/0x1f0 [ 322.321160][ C1] ? slab_free_freelist_hook+0x130/0x1a0 [ 322.326829][ C1] __flush_work+0x10f/0xac0 [ 322.331371][ C1] ? flush_work+0x20/0x20 [ 322.335731][ C1] ? __timer_delete+0x6b/0x290 [ 322.340525][ C1] ? mark_lock+0x94/0x320 [ 322.344926][ C1] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 322.350931][ C1] ? mod_delayed_work_on+0x1c0/0x1c0 [ 322.356237][ C1] ? lock_chain_count+0x20/0x20 [ 322.361120][ C1] ? __cancel_work_timer+0x36e/0x560 [ 322.366437][ C1] __cancel_work_timer+0x3f8/0x560 [ 322.371573][ C1] ? cancel_work_sync+0x20/0x20 [ 322.376451][ C1] ? kobject_put+0x260/0x450 [ 322.381075][ C1] ? __kmem_cache_free+0xba/0x1f0 [ 322.386149][ C1] ? kobject_put+0x421/0x450 [ 322.390776][ C1] mmc_free_host+0x19/0x30 [ 322.395243][ C1] call_timer_fn+0x189/0x540 [ 322.399855][ C1] ? kref_get+0x70/0x70 [ 322.404049][ C1] ? call_timer_fn+0xd2/0x540 [ 322.408750][ C1] ? __run_timers+0x810/0x810 [ 322.413456][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 322.418679][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 322.423906][ C1] ? kref_get+0x70/0x70 [ 322.428113][ C1] __run_timers+0x570/0x810 [ 322.432687][ C1] ? detach_timer+0x2b0/0x2b0 [ 322.437395][ C1] ? lock_chain_count+0x20/0x20 [ 322.442276][ C1] run_timer_softirq+0x67/0xf0 [ 322.447066][ C1] handle_softirqs+0x27d/0x820 [ 322.451857][ C1] ? read_tsc+0x9/0x20 [ 322.455949][ C1] ? ktime_get+0x24b/0x280 [ 322.460417][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 322.465209][ C1] ? do_softirq+0x1a0/0x1a0 [ 322.469737][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 322.474968][ C1] __irq_exit_rcu+0xd3/0x190 [ 322.479580][ C1] ? irq_exit_rcu+0x20/0x20 [ 322.484104][ C1] irq_exit_rcu+0x9/0x20 [ 322.488361][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 322.494027][ C1] [ 322.496993][ C1] [ 322.499968][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 322.505994][ C1] RIP: 0010:lock_acquire+0x208/0x420 [ 322.511322][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 322.530944][ C1] RSP: 0018:ffffc900043bf3a0 EFLAGS: 00000206 [ 322.537071][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 33339fb8212b6300 [ 322.545074][ C1] RDX: 0000000000000000 RSI: ffffffff8acade60 RDI: ffffffff8b1d35e0 [ 322.553076][ C1] RBP: ffffc900043bf4a8 R08: dffffc0000000000 R09: 1ffffffff223dea0 [ 322.561123][ C1] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: 1ffff92000877e80 [ 322.569141][ C1] R13: ffffffff8d1321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 322.577162][ C1] ? read_lock_is_recursive+0x20/0x20 [ 322.582582][ C1] ? page_ext_put+0x9c/0xb0 [ 322.587114][ C1] ? pfn_valid+0xcd/0x420 [ 322.591470][ C1] pfn_valid+0xe9/0x420 [ 322.595688][ C1] ? pfn_valid+0xcd/0x420 [ 322.600056][ C1] page_table_check_set+0x25/0x6e0 [ 322.605206][ C1] copy_page_range+0x24fc/0x3700 [ 322.610203][ C1] ? pfn_valid+0x450/0x450 [ 322.614656][ C1] ? copy_mm+0x1705/0x1e30 [ 322.619094][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 322.624160][ C1] ? down_write+0x16e/0x200 [ 322.628721][ C1] ? up_write+0x1be/0x410 [ 322.633079][ C1] copy_mm+0x1751/0x1e30 [ 322.637357][ C1] ? copy_signal+0x640/0x640 [ 322.641976][ C1] ? lockdep_init_map_type+0x9c/0x8e0 [ 322.647395][ C1] ? __init_rwsem+0x122/0x160 [ 322.652103][ C1] ? copy_signal+0x51f/0x640 [ 322.656720][ C1] copy_process+0x16c9/0x3da0 [ 322.661432][ C1] ? copy_process+0x98e/0x3da0 [ 322.666225][ C1] ? __pidfd_prepare+0x140/0x140 [ 322.671204][ C1] kernel_clone+0x24b/0x8a0 [ 322.675733][ C1] ? create_io_thread+0x190/0x190 [ 322.680793][ C1] ? __might_fault+0xaa/0x120 [ 322.685500][ C1] __x64_sys_clone+0x1b7/0x230 [ 322.690293][ C1] ? __ia32_sys_vfork+0x140/0x140 [ 322.695354][ C1] ? lock_chain_count+0x20/0x20 [ 322.700242][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 322.705470][ C1] do_syscall_64+0x55/0xb0 [ 322.709910][ C1] ? clear_bhb_loop+0x40/0x90 [ 322.714671][ C1] ? clear_bhb_loop+0x40/0x90 [ 322.719383][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 322.725329][ C1] RIP: 0033:0x7f0b675c6bd2 [ 322.729797][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 322.749442][ C1] RSP: 002b:00007ffe5505f570 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 322.757895][ C1] RAX: ffffffffffffffda RBX: 00007ffe5505f570 RCX: 00007f0b675c6bd2 [ 322.765900][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 322.773898][ C1] RBP: 00007ffe5505f6fc R08: 0000000000000000 R09: 0000000000000001 [ 322.781893][ C1] R10: 000055556fd847d0 R11: 0000000000000246 R12: 0000000000000001 [ 322.789894][ C1] R13: 00000000000927c0 R14: 000000000004e98b R15: 00007ffe5505f750 [ 322.797932][ C1] [ 322.801039][ C1] BUG: sleeping function called from invalid context at kernel/workqueue.c:3414 [ 322.810177][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5776, name: syz-executor [ 322.819477][ C1] preempt_count: 103, expected: 0 [ 322.824554][ C1] RCU nest depth: 2, expected: 0 [ 322.829586][ C1] 9 locks held by syz-executor/5776: [ 322.834956][ C1] #0: ffffffff8d1d48b0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x298/0x1e30 [ 322.843848][ C1] #1: ffff888021493120 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 322.852954][ C1] #2: ffff88801bef81a0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 322.862261][ C1] #3: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 322.871978][ C1] #4: ffff888024e1df18 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 322.874910][T11563] veth1_to_bond: left promiscuous mode [ 322.882803][ C1] #5: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 322.897845][ C1] #6: ffff888063dae498 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 322.907419][T11563] veth1_to_bond: left allmulticast mode [ 322.908458][ C1] #7: ffffffff8d1321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 322.923466][ C1] #8: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 322.934069][ C1] Preemption disabled at: [ 322.934085][ C1] [<0000000000000000>] 0x0 [ 322.942958][ C1] CPU: 1 PID: 5776 Comm: syz-executor Not tainted syzkaller #0 [ 322.950557][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 322.960676][ C1] Call Trace: [ 322.964013][ C1] [ 322.966932][ C1] dump_stack_lvl+0x18c/0x250 [ 322.971677][ C1] ? show_regs_print_info+0x20/0x20 [ 322.976933][ C1] ? load_image+0x420/0x420 [ 322.981483][ C1] __might_resched+0x48d/0x5f0 [ 322.986285][ C1] ? __might_sleep+0xe0/0xe0 [ 322.990934][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 322.996861][ C1] ? _raw_spin_unlock+0x40/0x40 [ 323.001746][ C1] ? kasan_set_track+0x5f/0x70 [ 323.006545][ C1] ? kasan_save_free_info+0x28/0x40 [ 323.011776][ C1] ? ____kasan_slab_free+0x126/0x1f0 [ 323.017103][ C1] ? slab_free_freelist_hook+0x130/0x1a0 [ 323.022778][ C1] __flush_work+0x10f/0xac0 [ 323.027321][ C1] ? flush_work+0x20/0x20 [ 323.031675][ C1] ? __timer_delete+0x6b/0x290 [ 323.036472][ C1] ? mark_lock+0x94/0x320 [ 323.040834][ C1] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 323.046839][ C1] ? mod_delayed_work_on+0x1c0/0x1c0 [ 323.052157][ C1] ? lock_chain_count+0x20/0x20 [ 323.057045][ C1] ? __cancel_work_timer+0x36e/0x560 [ 323.062360][ C1] __cancel_work_timer+0x3f8/0x560 [ 323.067504][ C1] ? cancel_work_sync+0x20/0x20 [ 323.072381][ C1] ? kobject_put+0x260/0x450 [ 323.076995][ C1] ? __kmem_cache_free+0xba/0x1f0 [ 323.082052][ C1] ? kobject_put+0x421/0x450 [ 323.086698][ C1] mmc_free_host+0x19/0x30 [ 323.091149][ C1] call_timer_fn+0x189/0x540 [ 323.095767][ C1] ? kref_get+0x70/0x70 [ 323.099951][ C1] ? call_timer_fn+0xd2/0x540 [ 323.104645][ C1] ? __run_timers+0x810/0x810 [ 323.109346][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 323.114570][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 323.119807][ C1] ? kref_get+0x70/0x70 [ 323.123997][ C1] __run_timers+0x570/0x810 [ 323.128542][ C1] ? detach_timer+0x2b0/0x2b0 [ 323.133256][ C1] ? lock_chain_count+0x20/0x20 [ 323.138137][ C1] run_timer_softirq+0x67/0xf0 [ 323.142923][ C1] handle_softirqs+0x27d/0x820 [ 323.147705][ C1] ? read_tsc+0x9/0x20 [ 323.151807][ C1] ? ktime_get+0x24b/0x280 [ 323.156260][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 323.161047][ C1] ? do_softirq+0x1a0/0x1a0 [ 323.165593][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 323.170822][ C1] __irq_exit_rcu+0xd3/0x190 [ 323.175438][ C1] ? irq_exit_rcu+0x20/0x20 [ 323.179960][ C1] irq_exit_rcu+0x9/0x20 [ 323.184224][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 323.189886][ C1] [ 323.192851][ C1] [ 323.195803][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 323.201836][ C1] RIP: 0010:lock_acquire+0x208/0x420 [ 323.207142][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 323.226770][ C1] RSP: 0018:ffffc900043bf3a0 EFLAGS: 00000206 [ 323.232880][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 33339fb8212b6300 [ 323.240881][ C1] RDX: 0000000000000000 RSI: ffffffff8acade60 RDI: ffffffff8b1d35e0 [ 323.248878][ C1] RBP: ffffc900043bf4a8 R08: dffffc0000000000 R09: 1ffffffff223dea0 [ 323.256877][ C1] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: 1ffff92000877e80 [ 323.264876][ C1] R13: ffffffff8d1321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 323.272946][ C1] ? read_lock_is_recursive+0x20/0x20 [ 323.278352][ C1] ? page_ext_put+0x9c/0xb0 [ 323.282887][ C1] ? pfn_valid+0xcd/0x420 [ 323.287242][ C1] pfn_valid+0xe9/0x420 [ 323.291426][ C1] ? pfn_valid+0xcd/0x420 [ 323.295791][ C1] page_table_check_set+0x25/0x6e0 [ 323.300946][ C1] copy_page_range+0x24fc/0x3700 [ 323.305947][ C1] ? pfn_valid+0x450/0x450 [ 323.310393][ C1] ? copy_mm+0x1705/0x1e30 [ 323.314848][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 323.319902][ C1] ? down_write+0x16e/0x200 [ 323.324435][ C1] ? up_write+0x1be/0x410 [ 323.328812][ C1] copy_mm+0x1751/0x1e30 [ 323.333093][ C1] ? copy_signal+0x640/0x640 [ 323.337718][ C1] ? lockdep_init_map_type+0x9c/0x8e0 [ 323.343137][ C1] ? __init_rwsem+0x122/0x160 [ 323.347842][ C1] ? copy_signal+0x51f/0x640 [ 323.352490][ C1] copy_process+0x16c9/0x3da0 [ 323.357214][ C1] ? copy_process+0x98e/0x3da0 [ 323.362021][ C1] ? __pidfd_prepare+0x140/0x140 [ 323.366994][ C1] kernel_clone+0x24b/0x8a0 [ 323.371525][ C1] ? create_io_thread+0x190/0x190 [ 323.376588][ C1] ? __might_fault+0xaa/0x120 [ 323.381296][ C1] __x64_sys_clone+0x1b7/0x230 [ 323.386093][ C1] ? __ia32_sys_vfork+0x140/0x140 [ 323.391166][ C1] ? lock_chain_count+0x20/0x20 [ 323.396049][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 323.401287][ C1] do_syscall_64+0x55/0xb0 [ 323.405742][ C1] ? clear_bhb_loop+0x40/0x90 [ 323.410439][ C1] ? clear_bhb_loop+0x40/0x90 [ 323.415171][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 323.421089][ C1] RIP: 0033:0x7f0b675c6bd2 [ 323.425522][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 323.445160][ C1] RSP: 002b:00007ffe5505f570 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 323.453600][ C1] RAX: ffffffffffffffda RBX: 00007ffe5505f570 RCX: 00007f0b675c6bd2 [ 323.461596][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 323.469619][ C1] RBP: 00007ffe5505f6fc R08: 0000000000000000 R09: 0000000000000001 [ 323.477610][ C1] R10: 000055556fd847d0 R11: 0000000000000246 R12: 0000000000000001 [ 323.485599][ C1] R13: 00000000000927c0 R14: 000000000004e98b R15: 00007ffe5505f750 [ 323.493608][ C1] [ 323.497028][ C1] [ 323.499406][ C1] ============================= [ 323.504278][ C1] WARNING: suspicious RCU usage [ 323.509222][ C1] syzkaller #0 Tainted: G W [ 323.515228][ C1] ----------------------------- [ 323.520112][ C1] kernel/rcu/srcutree.c:1377 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! [ 323.532185][ C1] [ 323.532185][ C1] other info that might help us debug this: [ 323.532185][ C1] [ 323.542509][ C1] [ 323.542509][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 323.550663][ C1] 9 locks held by syz-executor/5776: [ 323.556036][ C1] #0: ffffffff8d1d48b0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x298/0x1e30 [ 323.565018][ C1] #1: ffff888021493120 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 323.574113][ C1] #2: ffff88801bef81a0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 323.583329][ C1] #3: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 323.592944][ C1] #4: ffff888024e1df18 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 323.603898][ C1] #5: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 323.613576][ C1] #6: ffff888063dae498 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 323.624134][ C1] #7: ffffffff8d1321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 323.633696][ C1] #8: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 323.644293][ C1] [ 323.644293][ C1] stack backtrace: [ 323.650293][ C1] CPU: 1 PID: 5776 Comm: syz-executor Tainted: G W syzkaller #0 [ 323.659466][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 323.669588][ C1] Call Trace: [ 323.672912][ C1] [ 323.675803][ C1] dump_stack_lvl+0x18c/0x250 [ 323.680534][ C1] ? show_regs_print_info+0x20/0x20 [ 323.685787][ C1] ? load_image+0x420/0x420 [ 323.690372][ C1] lockdep_rcu_suspicious+0x1e1/0x300 [ 323.695811][ C1] __synchronize_srcu+0x150/0x3d0 [ 323.700902][ C1] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 323.706837][ C1] ? synchronize_srcu_expedited+0x20/0x20 [ 323.712592][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 323.718506][ C1] ? _raw_spin_unlock+0x40/0x40 [ 323.723425][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 323.729345][ C1] ? read_tsc+0x9/0x20 [ 323.733439][ C1] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 323.739037][ C1] ? synchronize_srcu+0x25a/0x280 [ 323.744098][ C1] wakeup_source_unregister+0x116/0x190 [ 323.749672][ C1] mmc_host_classdev_release+0x47/0x100 [ 323.755260][ C1] ? mmc_free_host+0x30/0x30 [ 323.759896][ C1] device_release+0xbc/0x1e0 [ 323.764525][ C1] kobject_put+0x21b/0x450 [ 323.769010][ C1] call_timer_fn+0x189/0x540 [ 323.773630][ C1] ? kref_get+0x70/0x70 [ 323.777852][ C1] ? call_timer_fn+0xd2/0x540 [ 323.782574][ C1] ? __run_timers+0x810/0x810 [ 323.787292][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 323.792517][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 323.797743][ C1] ? kref_get+0x70/0x70 [ 323.801937][ C1] __run_timers+0x570/0x810 [ 323.806479][ C1] ? detach_timer+0x2b0/0x2b0 [ 323.811188][ C1] ? lock_chain_count+0x20/0x20 [ 323.816070][ C1] run_timer_softirq+0x67/0xf0 [ 323.820856][ C1] handle_softirqs+0x27d/0x820 [ 323.825647][ C1] ? read_tsc+0x9/0x20 [ 323.829759][ C1] ? ktime_get+0x24b/0x280 [ 323.834200][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 323.838991][ C1] ? do_softirq+0x1a0/0x1a0 [ 323.843521][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 323.848758][ C1] __irq_exit_rcu+0xd3/0x190 [ 323.853839][ C1] ? irq_exit_rcu+0x20/0x20 [ 323.858377][ C1] irq_exit_rcu+0x9/0x20 [ 323.862644][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 323.868314][ C1] [ 323.871277][ C1] [ 323.874226][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 323.880229][ C1] RIP: 0010:lock_acquire+0x208/0x420 [ 323.885554][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 323.905197][ C1] RSP: 0018:ffffc900043bf3a0 EFLAGS: 00000206 [ 323.911303][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 33339fb8212b6300 [ 323.919304][ C1] RDX: 0000000000000000 RSI: ffffffff8acade60 RDI: ffffffff8b1d35e0 [ 323.927319][ C1] RBP: ffffc900043bf4a8 R08: dffffc0000000000 R09: 1ffffffff223dea0 [ 323.935323][ C1] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: 1ffff92000877e80 [ 323.943424][ C1] R13: ffffffff8d1321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 323.951438][ C1] ? read_lock_is_recursive+0x20/0x20 [ 323.956848][ C1] ? page_ext_put+0x9c/0xb0 [ 323.961396][ C1] ? pfn_valid+0xcd/0x420 [ 323.965779][ C1] pfn_valid+0xe9/0x420 [ 323.969972][ C1] ? pfn_valid+0xcd/0x420 [ 323.974339][ C1] page_table_check_set+0x25/0x6e0 [ 323.979488][ C1] copy_page_range+0x24fc/0x3700 [ 323.984482][ C1] ? pfn_valid+0x450/0x450 [ 323.988929][ C1] ? copy_mm+0x1705/0x1e30 [ 323.993375][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 323.998428][ C1] ? down_write+0x16e/0x200 [ 324.002968][ C1] ? up_write+0x1be/0x410 [ 324.007344][ C1] copy_mm+0x1751/0x1e30 [ 324.011649][ C1] ? copy_signal+0x640/0x640 [ 324.016263][ C1] ? lockdep_init_map_type+0x9c/0x8e0 [ 324.021672][ C1] ? __init_rwsem+0x122/0x160 [ 324.026390][ C1] ? copy_signal+0x51f/0x640 [ 324.031017][ C1] copy_process+0x16c9/0x3da0 [ 324.035819][ C1] ? copy_process+0x98e/0x3da0 [ 324.040654][ C1] ? __pidfd_prepare+0x140/0x140 [ 324.045625][ C1] kernel_clone+0x24b/0x8a0 [ 324.050169][ C1] ? create_io_thread+0x190/0x190 [ 324.055223][ C1] ? __might_fault+0xaa/0x120 [ 324.059947][ C1] __x64_sys_clone+0x1b7/0x230 [ 324.064746][ C1] ? __ia32_sys_vfork+0x140/0x140 [ 324.069804][ C1] ? lock_chain_count+0x20/0x20 [ 324.074691][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 324.079926][ C1] do_syscall_64+0x55/0xb0 [ 324.084373][ C1] ? clear_bhb_loop+0x40/0x90 [ 324.089082][ C1] ? clear_bhb_loop+0x40/0x90 [ 324.093787][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 324.099703][ C1] RIP: 0033:0x7f0b675c6bd2 [ 324.104137][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 324.123764][ C1] RSP: 002b:00007ffe5505f570 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 324.132294][ C1] RAX: ffffffffffffffda RBX: 00007ffe5505f570 RCX: 00007f0b675c6bd2 [ 324.140317][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 324.148315][ C1] RBP: 00007ffe5505f6fc R08: 0000000000000000 R09: 0000000000000001 [ 324.156354][ C1] R10: 000055556fd847d0 R11: 0000000000000246 R12: 0000000000000001 [ 324.164344][ C1] R13: 00000000000927c0 R14: 000000000004e98b R15: 00007ffe5505f750 [ 324.172351][ C1] [ 324.175461][ C1] BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1381 [ 324.184849][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5776, name: syz-executor [ 324.194103][ C1] preempt_count: 103, expected: 0 [ 324.199237][ C1] RCU nest depth: 2, expected: 0 [ 324.204224][ C1] 9 locks held by syz-executor/5776: [ 324.209628][ C1] #0: ffffffff8d1d48b0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x298/0x1e30 [ 324.218574][ C1] #1: ffff888021493120 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 324.227700][ C1] #2: ffff88801bef81a0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 324.236990][ C1] #3: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 324.246677][ C1] #4: ffff888024e1df18 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 324.257456][ C1] #5: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 324.267097][ C1] #6: ffff888063dae498 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 324.277641][ C1] #7: ffffffff8d1321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 324.287233][ C1] #8: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 324.297818][ C1] Preemption disabled at: [ 324.297832][ C1] [<0000000000000000>] 0x0 [ 324.306765][ C1] CPU: 1 PID: 5776 Comm: syz-executor Tainted: G W syzkaller #0 [ 324.315860][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 324.325967][ C1] Call Trace: [ 324.329310][ C1] [ 324.332183][ C1] dump_stack_lvl+0x18c/0x250 [ 324.336899][ C1] ? show_regs_print_info+0x20/0x20 [ 324.342156][ C1] ? load_image+0x420/0x420 [ 324.346711][ C1] __might_resched+0x48d/0x5f0 [ 324.351521][ C1] ? show_regs_print_info+0x20/0x20 [ 324.356758][ C1] ? __might_sleep+0xe0/0xe0 [ 324.361386][ C1] __synchronize_srcu+0x197/0x3d0 [ 324.366440][ C1] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 324.372354][ C1] ? synchronize_srcu_expedited+0x20/0x20 [ 324.378110][ C1] ? read_tsc+0x9/0x20 [ 324.382212][ C1] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 324.387882][ C1] ? synchronize_srcu+0x25a/0x280 [ 324.392985][ C1] wakeup_source_unregister+0x116/0x190 [ 324.398560][ C1] mmc_host_classdev_release+0x47/0x100 [ 324.404131][ C1] ? mmc_free_host+0x30/0x30 [ 324.408761][ C1] device_release+0xbc/0x1e0 [ 324.413386][ C1] kobject_put+0x21b/0x450 [ 324.417847][ C1] call_timer_fn+0x189/0x540 [ 324.422471][ C1] ? kref_get+0x70/0x70 [ 324.426670][ C1] ? call_timer_fn+0xd2/0x540 [ 324.431394][ C1] ? __run_timers+0x810/0x810 [ 324.436103][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 324.441345][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 324.446568][ C1] ? kref_get+0x70/0x70 [ 324.450758][ C1] __run_timers+0x570/0x810 [ 324.455327][ C1] ? detach_timer+0x2b0/0x2b0 [ 324.460038][ C1] ? lock_chain_count+0x20/0x20 [ 324.464927][ C1] run_timer_softirq+0x67/0xf0 [ 324.469716][ C1] handle_softirqs+0x27d/0x820 [ 324.474522][ C1] ? read_tsc+0x9/0x20 [ 324.478641][ C1] ? ktime_get+0x24b/0x280 [ 324.483099][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 324.487914][ C1] ? do_softirq+0x1a0/0x1a0 [ 324.492470][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 324.497696][ C1] __irq_exit_rcu+0xd3/0x190 [ 324.502303][ C1] ? irq_exit_rcu+0x20/0x20 [ 324.506844][ C1] irq_exit_rcu+0x9/0x20 [ 324.511113][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 324.516805][ C1] [ 324.519757][ C1] [ 324.522702][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 324.528703][ C1] RIP: 0010:lock_acquire+0x208/0x420 [ 324.534022][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 324.553677][ C1] RSP: 0018:ffffc900043bf3a0 EFLAGS: 00000206 [ 324.559770][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 33339fb8212b6300 [ 324.567760][ C1] RDX: 0000000000000000 RSI: ffffffff8acade60 RDI: ffffffff8b1d35e0 [ 324.575753][ C1] RBP: ffffc900043bf4a8 R08: dffffc0000000000 R09: 1ffffffff223dea0 [ 324.583746][ C1] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: 1ffff92000877e80 [ 324.591750][ C1] R13: ffffffff8d1321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 324.599817][ C1] ? read_lock_is_recursive+0x20/0x20 [ 324.605234][ C1] ? page_ext_put+0x9c/0xb0 [ 324.609783][ C1] ? pfn_valid+0xcd/0x420 [ 324.614141][ C1] pfn_valid+0xe9/0x420 [ 324.618323][ C1] ? pfn_valid+0xcd/0x420 [ 324.622687][ C1] page_table_check_set+0x25/0x6e0 [ 324.627829][ C1] copy_page_range+0x24fc/0x3700 [ 324.632847][ C1] ? pfn_valid+0x450/0x450 [ 324.637307][ C1] ? copy_mm+0x1705/0x1e30 [ 324.641747][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 324.646797][ C1] ? down_write+0x16e/0x200 [ 324.651336][ C1] ? up_write+0x1be/0x410 [ 324.655689][ C1] copy_mm+0x1751/0x1e30 [ 324.659973][ C1] ? copy_signal+0x640/0x640 [ 324.664586][ C1] ? lockdep_init_map_type+0x9c/0x8e0 [ 324.670013][ C1] ? __init_rwsem+0x122/0x160 [ 324.674710][ C1] ? copy_signal+0x51f/0x640 [ 324.679327][ C1] copy_process+0x16c9/0x3da0 [ 324.684060][ C1] ? copy_process+0x98e/0x3da0 [ 324.688882][ C1] ? __pidfd_prepare+0x140/0x140 [ 324.693869][ C1] kernel_clone+0x24b/0x8a0 [ 324.698401][ C1] ? create_io_thread+0x190/0x190 [ 324.703485][ C1] ? __might_fault+0xaa/0x120 [ 324.708199][ C1] __x64_sys_clone+0x1b7/0x230 [ 324.712998][ C1] ? __ia32_sys_vfork+0x140/0x140 [ 324.718063][ C1] ? lock_chain_count+0x20/0x20 [ 324.722946][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 324.728177][ C1] do_syscall_64+0x55/0xb0 [ 324.732626][ C1] ? clear_bhb_loop+0x40/0x90 [ 324.737327][ C1] ? clear_bhb_loop+0x40/0x90 [ 324.742030][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 324.747967][ C1] RIP: 0033:0x7f0b675c6bd2 [ 324.752414][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 324.772038][ C1] RSP: 002b:00007ffe5505f570 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 324.780481][ C1] RAX: ffffffffffffffda RBX: 00007ffe5505f570 RCX: 00007f0b675c6bd2 [ 324.788476][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 324.796474][ C1] RBP: 00007ffe5505f6fc R08: 0000000000000000 R09: 0000000000000001 [ 324.804474][ C1] R10: 000055556fd847d0 R11: 0000000000000246 R12: 0000000000000001 [ 324.812465][ C1] R13: 00000000000927c0 R14: 000000000004e98b R15: 00007ffe5505f750 [ 324.820517][ C1] [ 324.823603][ C1] ODEBUG: object ffffc900001f09c0 is NOT on stack ffffc900043b8000, but annotated. [ 324.827058][ C1] [ 324.827064][ C1] ====================================================== [ 324.827070][ C1] WARNING: possible circular locking dependency detected [ 324.827078][ C1] syzkaller #0 Tainted: G W [ 324.827089][ C1] ------------------------------------------------------ [ 324.827095][ C1] syz-executor/5776 is trying to acquire lock: [ 324.827105][ C1] ffffffff8d1263e0 (console_owner){-.-.}-{0:0}, at: console_flush_all+0x10b/0xcf0 [ 324.827160][ C1] [ 324.827160][ C1] but task is already holding lock: [ 324.827165][ C1] ffffffff97510368 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_object_init+0x5c/0x450 [ 324.827212][ C1] [ 324.827212][ C1] which lock already depends on the new lock. [ 324.827212][ C1] [ 324.827218][ C1] [ 324.827218][ C1] the existing dependency chain (in reverse order) is: [ 324.827224][ C1] [ 324.827224][ C1] -> #4 (&obj_hash[i].lock){-.-.}-{2:2}: [ 324.827248][ C1] _raw_spin_lock_irqsave+0xb4/0x100 [ 324.827268][ C1] debug_object_activate+0x6c/0x500 [ 324.827291][ C1] insert_work+0x35/0x310 [ 324.827312][ C1] __queue_work+0xbfd/0xfd0 [ 324.827330][ C1] queue_work_on+0x128/0x1f0 [ 324.827348][ C1] start_poll_synchronize_rcu_expedited+0x105/0x140 [ 324.827378][ C1] rcu_init+0x10d/0x160 [ 324.827398][ C1] start_kernel+0x1fd/0x4e0 [ 324.827417][ C1] x86_64_start_reservations+0x2a/0x30 [ 324.827445][ C1] copy_bootdata+0x0/0xd0 [ 324.827470][ C1] secondary_startup_64_no_verify+0x179/0x17b [ 324.827503][ C1] [ 324.827503][ C1] -> #3 (&pool->lock){-.-.}-{2:2}: [ 324.827526][ C1] _raw_spin_lock+0x2e/0x40 [ 324.827543][ C1] __queue_work+0x72f/0xfd0 [ 324.827561][ C1] queue_work_on+0x128/0x1f0 [ 324.827578][ C1] rpm_suspend+0x1133/0x1b60 [ 324.827604][ C1] __pm_runtime_idle+0x12f/0x1a0 [ 324.827629][ C1] __device_attach+0x352/0x420 [ 324.827661][ C1] bus_probe_device+0x180/0x260 [ 324.827685][ C1] device_add+0x87c/0xc40 [ 324.827704][ C1] serial_base_port_add+0x2f6/0x430 [ 324.827724][ C1] serial_core_register_port+0x378/0x20b0 [ 324.827741][ C1] serial8250_register_8250_port+0x15fd/0x1f40 [ 324.827764][ C1] serial_pnp_probe+0x577/0x750 [ 324.827786][ C1] pnp_device_probe+0x305/0x4b0 [ 324.827808][ C1] really_probe+0x247/0xae0 [ 324.827823][ C1] __driver_probe_device+0x1f5/0x390 [ 324.827851][ C1] driver_probe_device+0x4f/0x420 [ 324.827884][ C1] __driver_attach+0x444/0x6d0 [ 324.827911][ C1] bus_for_each_dev+0x235/0x2b0 [ 324.827935][ C1] bus_add_driver+0x340/0x630 [ 324.827960][ C1] driver_register+0x23a/0x310 [ 324.827976][ C1] serial8250_init+0x9a/0x170 [ 324.827994][ C1] do_one_initcall+0x242/0x790 [ 324.828017][ C1] do_initcall_level+0x13d/0x1f0 [ 324.828042][ C1] do_initcalls+0x69/0xd0 [ 324.828061][ C1] kernel_init_freeable+0x3d9/0x560 [ 324.828081][ C1] kernel_init+0x1d/0x1c0 [ 324.828097][ C1] ret_from_fork+0x48/0x80 [ 324.828119][ C1] ret_from_fork_asm+0x11/0x20 [ 324.828143][ C1] [ 324.828143][ C1] -> #2 (&dev->power.lock){-...}-{2:2}: [ 324.828168][ C1] _raw_spin_lock_irqsave+0xb4/0x100 [ 324.828186][ C1] __pm_runtime_resume+0x10f/0x170 [ 324.828211][ C1] __uart_start+0x171/0x3e0 [ 324.828227][ C1] uart_write+0x449/0x5d0 [ 324.828243][ C1] n_tty_write+0xd3d/0x11e0 [ 324.828267][ C1] file_tty_write+0x529/0x960 [ 324.828288][ C1] vfs_write+0x474/0x9a0 [ 324.828312][ C1] ksys_write+0x151/0x260 [ 324.828337][ C1] do_syscall_64+0x55/0xb0 [ 324.828357][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 324.828379][ C1] [ 324.828379][ C1] -> #1 (&port_lock_key){-.-.}-{2:2}: [ 324.828403][ C1] _raw_spin_lock_irqsave+0xb4/0x100 [ 324.828421][ C1] serial8250_console_write+0x181/0x18b0 [ 324.828478][ C1] console_flush_all+0x6ad/0xcf0 [ 324.828501][ C1] console_unlock+0xad/0x350 [ 324.828522][ C1] vprintk_emit+0x497/0x610 [ 324.828544][ C1] _printk+0xde/0x130 [ 324.828559][ C1] register_console+0xb96/0xf00 [ 324.828582][ C1] univ8250_console_init+0x45/0x50 [ 324.828597][ C1] console_init+0x17b/0x5d0 [ 324.828613][ C1] start_kernel+0x2c8/0x4e0 [ 324.828629][ C1] x86_64_start_reservations+0x2a/0x30 [ 324.828655][ C1] copy_bootdata+0x0/0xd0 [ 324.828679][ C1] secondary_startup_64_no_verify+0x179/0x17b [ 324.828701][ C1] [ 324.828701][ C1] -> #0 (console_owner){-.-.}-{0:0}: [ 324.828723][ C1] __lock_acquire+0x37ef/0x7d80 [ 324.828742][ C1] lock_acquire+0x19e/0x420 [ 324.828761][ C1] console_flush_all+0x676/0xcf0 [ 324.828782][ C1] console_unlock+0xad/0x350 [ 324.828803][ C1] vprintk_emit+0x497/0x610 [ 324.828822][ C1] _printk+0xde/0x130 [ 324.828837][ C1] __debug_object_init+0x18d/0x450 [ 324.828861][ C1] __synchronize_srcu+0x2ae/0x3d0 [ 324.828885][ C1] wakeup_source_unregister+0x116/0x190 [ 324.828905][ C1] mmc_host_classdev_release+0x47/0x100 [ 324.828932][ C1] device_release+0xbc/0x1e0 [ 324.828954][ C1] kobject_put+0x21b/0x450 [ 324.828980][ C1] call_timer_fn+0x189/0x540 [ 324.828999][ C1] __run_timers+0x570/0x810 [ 324.829016][ C1] run_timer_softirq+0x67/0xf0 [ 324.829034][ C1] handle_softirqs+0x27d/0x820 [ 324.829074][ C1] __irq_exit_rcu+0xd3/0x190 [ 324.829091][ C1] irq_exit_rcu+0x9/0x20 [ 324.829109][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 324.829136][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 324.829158][ C1] lock_acquire+0x208/0x420 [ 324.829179][ C1] pfn_valid+0xe9/0x420 [ 324.829201][ C1] page_table_check_set+0x25/0x6e0 [ 324.829222][ C1] copy_page_range+0x24fc/0x3700 [ 324.829248][ C1] copy_mm+0x1751/0x1e30 [ 324.829267][ C1] copy_process+0x16c9/0x3da0 [ 324.829285][ C1] kernel_clone+0x24b/0x8a0 [ 324.829305][ C1] __x64_sys_clone+0x1b7/0x230 [ 324.829325][ C1] do_syscall_64+0x55/0xb0 [ 324.829344][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 324.829366][ C1] [ 324.829366][ C1] other info that might help us debug this: [ 324.829366][ C1] [ 324.829372][ C1] Chain exists of: [ 324.829372][ C1] console_owner --> &pool->lock --> &obj_hash[i].lock [ 324.829372][ C1] [ 324.829403][ C1] Possible unsafe locking scenario: [ 324.829403][ C1] [ 324.829408][ C1] CPU0 CPU1 [ 324.829413][ C1] ---- ---- [ 324.829418][ C1] lock(&obj_hash[i].lock); [ 324.829429][ C1] lock(&pool->lock); [ 324.829442][ C1] lock(&obj_hash[i].lock); [ 324.829455][ C1] lock(console_owner); [ 324.829465][ C1] [ 324.829465][ C1] *** DEADLOCK *** [ 324.829465][ C1] [ 324.829470][ C1] 12 locks held by syz-executor/5776: [ 324.829483][ C1] #0: ffffffff8d1d48b0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x298/0x1e30 [ 324.829532][ C1] #1: ffff888021493120 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x2b6/0x1e30 [ 324.829579][ C1] #2: ffff88801bef81a0 (&mm->mmap_lock/1){+.+.}-{3:3}, at: copy_mm+0x3ed/0x1e30 [ 324.829630][ C1] #3: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 324.829676][ C1] #4: ffff888024e1df18 (ptlock_ptr(ptdesc)#2){+.+.}-{2:2}, at: __pte_offset_map_lock+0x106/0x1d0 [ 324.829727][ C1] #5: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: __pte_offset_map+0x2c/0x280 [ 324.829772][ C1] #6: ffff888063dae498 (ptlock_ptr(ptdesc)#2/1){+.+.}-{2:2}, at: copy_page_range+0xfbc/0x3700 [ 324.829835][ C1] #7: ffffffff8d1321a0 (rcu_read_lock_sched){....}-{1:2}, at: pfn_valid+0xcd/0x420 [ 324.829883][ C1] #8: ffffc900001f0be0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd2/0x540 [ 324.829930][ C1] #9: ffffffff97510368 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_object_init+0x5c/0x450 [ 324.829980][ C1] #10: ffffffff8d1264c0 (console_lock){+.+.}-{0:0}, at: _printk+0xde/0x130 [ 324.830023][ C1] #11: ffffffff8d00dcd0 (console_srcu){....}-{0:0}, at: console_flush_all+0x10b/0xcf0 [ 324.830082][ C1] [ 324.830082][ C1] stack backtrace: [ 324.830088][ C1] CPU: 1 PID: 5776 Comm: syz-executor Tainted: G W syzkaller #0 [ 324.830109][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 324.830121][ C1] Call Trace: [ 324.830129][ C1] [ 324.830137][ C1] dump_stack_lvl+0x18c/0x250 [ 324.830162][ C1] ? load_image+0x420/0x420 [ 324.830181][ C1] ? show_regs_print_info+0x20/0x20 [ 324.830209][ C1] ? print_circular_bug+0x12b/0x1a0 [ 324.830235][ C1] check_noncircular+0x2fc/0x400 [ 324.830264][ C1] ? print_deadlock_bug+0x5d0/0x5d0 [ 324.830288][ C1] ? lockdep_lock+0xf5/0x230 [ 324.830317][ C1] __lock_acquire+0x37ef/0x7d80 [ 324.830354][ C1] ? verify_lock_unused+0x140/0x140 [ 324.830390][ C1] lock_acquire+0x19e/0x420 [ 324.830412][ C1] ? console_flush_all+0x10b/0xcf0 [ 324.830440][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 324.830461][ C1] ? do_raw_spin_lock+0x11f/0x2b0 [ 324.830487][ C1] ? read_lock_is_recursive+0x20/0x20 [ 324.830510][ C1] ? __rwlock_init+0x150/0x150 [ 324.830538][ C1] ? do_raw_spin_unlock+0x121/0x230 [ 324.830566][ C1] console_flush_all+0x676/0xcf0 [ 324.830591][ C1] ? console_flush_all+0x10b/0xcf0 [ 324.830618][ C1] ? console_flush_all+0x10b/0xcf0 [ 324.830648][ C1] ? is_console_locked+0x20/0x20 [ 324.830678][ C1] console_unlock+0xad/0x350 [ 324.830704][ C1] ? other_cpu_in_panic+0xf0/0xf0 [ 324.830735][ C1] vprintk_emit+0x497/0x610 [ 324.830761][ C1] ? printk_sprint+0x460/0x460 [ 324.830788][ C1] ? do_raw_spin_lock+0x11f/0x2b0 [ 324.830818][ C1] _printk+0xde/0x130 [ 324.830838][ C1] ? load_image+0x420/0x420 [ 324.830857][ C1] ? alloc_object+0x1c/0x640 [ 324.830887][ C1] __debug_object_init+0x18d/0x450 [ 324.830915][ C1] __synchronize_srcu+0x2ae/0x3d0 [ 324.830942][ C1] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 324.830963][ C1] ? synchronize_srcu_expedited+0x20/0x20 [ 324.830994][ C1] ? read_tsc+0x9/0x20 [ 324.831014][ C1] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 324.831047][ C1] ? synchronize_srcu+0x25a/0x280 [ 324.831075][ C1] wakeup_source_unregister+0x116/0x190 [ 324.831099][ C1] mmc_host_classdev_release+0x47/0x100 [ 324.831128][ C1] ? mmc_free_host+0x30/0x30 [ 324.831154][ C1] device_release+0xbc/0x1e0 [ 324.831180][ C1] kobject_put+0x21b/0x450 [ 324.831224][ C1] call_timer_fn+0x189/0x540 [ 324.831244][ C1] ? kref_get+0x70/0x70 [ 324.831271][ C1] ? call_timer_fn+0xd2/0x540 [ 324.831292][ C1] ? __run_timers+0x810/0x810 [ 324.831316][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 324.831336][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 324.831362][ C1] ? kref_get+0x70/0x70 [ 324.831390][ C1] __run_timers+0x570/0x810 [ 324.831419][ C1] ? detach_timer+0x2b0/0x2b0 [ 324.831442][ C1] ? lock_chain_count+0x20/0x20 [ 324.831468][ C1] run_timer_softirq+0x67/0xf0 [ 324.831488][ C1] handle_softirqs+0x27d/0x820 [ 324.831508][ C1] ? read_tsc+0x9/0x20 [ 324.831529][ C1] ? ktime_get+0x24b/0x280 [ 324.831553][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 324.831576][ C1] ? do_softirq+0x1a0/0x1a0 [ 324.831598][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 324.831625][ C1] __irq_exit_rcu+0xd3/0x190 [ 324.831645][ C1] ? irq_exit_rcu+0x20/0x20 [ 324.831670][ C1] irq_exit_rcu+0x9/0x20 [ 324.831689][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 324.831718][ C1] [ 324.831724][ C1] [ 324.831731][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 324.831756][ C1] RIP: 0010:lock_acquire+0x208/0x420 [ 324.831781][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 324.831799][ C1] RSP: 0018:ffffc900043bf3a0 EFLAGS: 00000206 [ 324.831816][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 33339fb8212b6300 [ 324.831831][ C1] RDX: 0000000000000000 RSI: ffffffff8acade60 RDI: ffffffff8b1d35e0 [ 324.831844][ C1] RBP: ffffc900043bf4a8 R08: dffffc0000000000 R09: 1ffffffff223dea0 [ 324.831859][ C1] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: 1ffff92000877e80 [ 324.831874][ C1] R13: ffffffff8d1321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 324.831904][ C1] ? read_lock_is_recursive+0x20/0x20 [ 324.831931][ C1] ? page_ext_put+0x9c/0xb0 [ 324.831955][ C1] ? pfn_valid+0xcd/0x420 [ 324.831980][ C1] pfn_valid+0xe9/0x420 [ 324.832004][ C1] ? pfn_valid+0xcd/0x420 [ 324.832029][ C1] page_table_check_set+0x25/0x6e0 [ 324.832065][ C1] copy_page_range+0x24fc/0x3700 [ 324.832127][ C1] ? pfn_valid+0x450/0x450 [ 324.832157][ C1] ? copy_mm+0x1705/0x1e30 [ 324.832178][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 324.832201][ C1] ? down_write+0x16e/0x200 [ 324.832231][ C1] ? up_write+0x1be/0x410 [ 324.832252][ C1] copy_mm+0x1751/0x1e30 [ 324.832280][ C1] ? copy_signal+0x640/0x640 [ 324.832300][ C1] ? lockdep_init_map_type+0x9c/0x8e0 [ 324.832331][ C1] ? __init_rwsem+0x122/0x160 [ 324.832350][ C1] ? copy_signal+0x51f/0x640 [ 324.832372][ C1] copy_process+0x16c9/0x3da0 [ 324.832400][ C1] ? copy_process+0x98e/0x3da0 [ 324.832427][ C1] ? __pidfd_prepare+0x140/0x140 [ 324.832454][ C1] kernel_clone+0x24b/0x8a0 [ 324.832478][ C1] ? create_io_thread+0x190/0x190 [ 324.832504][ C1] ? __might_fault+0xaa/0x120 [ 324.832528][ C1] __x64_sys_clone+0x1b7/0x230 [ 324.832552][ C1] ? __ia32_sys_vfork+0x140/0x140 [ 324.832581][ C1] ? lock_chain_count+0x20/0x20 [ 324.832606][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 324.832635][ C1] do_syscall_64+0x55/0xb0 [ 324.832656][ C1] ? clear_bhb_loop+0x40/0x90 [ 324.832678][ C1] ? clear_bhb_loop+0x40/0x90 [ 324.832702][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 324.832725][ C1] RIP: 0033:0x7f0b675c6bd2 [ 324.832741][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 324.832756][ C1] RSP: 002b:00007ffe5505f570 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 324.832774][ C1] RAX: ffffffffffffffda RBX: 00007ffe5505f570 RCX: 00007f0b675c6bd2 [ 324.832792][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 324.832804][ C1] RBP: 00007ffe5505f6fc R08: 0000000000000000 R09: 0000000000000001 [ 324.832816][ C1] R10: 000055556fd847d0 R11: 0000000000000246 R12: 0000000000000001 [ 324.832828][ C1] R13: 00000000000927c0 R14: 000000000004e98b R15: 00007ffe5505f750 [ 324.832867][ C1] [ 326.279284][ C1] ------------[ cut here ]------------ [ 326.284778][ C1] WARNING: CPU: 1 PID: 5776 at lib/debugobjects.c:558 __debug_object_init+0x18d/0x450 [ 326.294350][ C1] Modules linked in: [ 326.298276][ C1] CPU: 1 PID: 5776 Comm: syz-executor Tainted: G W syzkaller #0 [ 326.307311][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 326.317379][ C1] RIP: 0010:__debug_object_init+0x18d/0x450 [ 326.323296][ C1] Code: 24 08 74 2f 41 ff c6 44 89 35 2f f9 25 13 48 c7 c1 80 3e 1d 8b 48 c7 c7 e0 3e 1d 8b 84 c0 48 0f 45 f9 48 89 de e8 53 76 49 06 <0f> 0b eb 05 4c 8b 7c 24 18 4d 8d 65 10 4d 89 e6 49 c1 ee 03 41 0f [ 326.342929][ C1] RSP: 0018:ffffc900001f0928 EFLAGS: 00010046 [ 326.349020][ C1] RAX: 0000000000000050 RBX: ffffc900001f09c0 RCX: 33339fb8212b6300 [ 326.357019][ C1] RDX: 0000000000000100 RSI: 0000000000000104 RDI: 0000000000000000 [ 326.365028][ C1] RBP: dffffc0000000000 R08: ffffc900001f0527 R09: 1ffff9200003e0a4 [ 326.373019][ C1] R10: dffffc0000000000 R11: fffff5200003e0a5 R12: ffff88802fd90020 [ 326.381012][ C1] R13: ffff888030500888 R14: 0000000000000001 R15: ffffffff8acbe000 [ 326.388999][ C1] FS: 000055556fd84500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 326.397958][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 326.404552][ C1] CR2: 00007f0b683556c8 CR3: 0000000063da6000 CR4: 00000000003506e0 [ 326.412545][ C1] Call Trace: [ 326.415839][ C1] [ 326.418710][ C1] __synchronize_srcu+0x2ae/0x3d0 [ 326.423777][ C1] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 326.429693][ C1] ? synchronize_srcu_expedited+0x20/0x20 [ 326.435449][ C1] ? read_tsc+0x9/0x20 [ 326.439534][ C1] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 326.445100][ C1] ? synchronize_srcu+0x25a/0x280 [ 326.450145][ C1] wakeup_source_unregister+0x116/0x190 [ 326.455712][ C1] mmc_host_classdev_release+0x47/0x100 [ 326.461286][ C1] ? mmc_free_host+0x30/0x30 [ 326.465906][ C1] device_release+0xbc/0x1e0 [ 326.470529][ C1] kobject_put+0x21b/0x450 [ 326.474995][ C1] call_timer_fn+0x189/0x540 [ 326.479616][ C1] ? kref_get+0x70/0x70 [ 326.483802][ C1] ? call_timer_fn+0xd2/0x540 [ 326.488525][ C1] ? __run_timers+0x810/0x810 [ 326.493223][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 326.498438][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 326.503659][ C1] ? kref_get+0x70/0x70 [ 326.507851][ C1] __run_timers+0x570/0x810 [ 326.512376][ C1] ? detach_timer+0x2b0/0x2b0 [ 326.517065][ C1] ? lock_chain_count+0x20/0x20 [ 326.521940][ C1] run_timer_softirq+0x67/0xf0 [ 326.526727][ C1] handle_softirqs+0x27d/0x820 [ 326.531520][ C1] ? read_tsc+0x9/0x20 [ 326.535611][ C1] ? ktime_get+0x24b/0x280 [ 326.540043][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 326.544821][ C1] ? do_softirq+0x1a0/0x1a0 [ 326.549336][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 326.554557][ C1] __irq_exit_rcu+0xd3/0x190 [ 326.559172][ C1] ? irq_exit_rcu+0x20/0x20 [ 326.563693][ C1] irq_exit_rcu+0x9/0x20 [ 326.567961][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 326.573624][ C1] [ 326.576571][ C1] [ 326.579534][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 326.585526][ C1] RIP: 0010:lock_acquire+0x208/0x420 [ 326.590822][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 326.610442][ C1] RSP: 0018:ffffc900043bf3a0 EFLAGS: 00000206 [ 326.616528][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 33339fb8212b6300 [ 326.624516][ C1] RDX: 0000000000000000 RSI: ffffffff8acade60 RDI: ffffffff8b1d35e0 [ 326.632509][ C1] RBP: ffffc900043bf4a8 R08: dffffc0000000000 R09: 1ffffffff223dea0 [ 326.640515][ C1] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: 1ffff92000877e80 [ 326.648507][ C1] R13: ffffffff8d1321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 326.656509][ C1] ? read_lock_is_recursive+0x20/0x20 [ 326.661905][ C1] ? page_ext_put+0x9c/0xb0 [ 326.666430][ C1] ? pfn_valid+0xcd/0x420 [ 326.670776][ C1] pfn_valid+0xe9/0x420 [ 326.674948][ C1] ? pfn_valid+0xcd/0x420 [ 326.679404][ C1] page_table_check_set+0x25/0x6e0 [ 326.684540][ C1] copy_page_range+0x24fc/0x3700 [ 326.689521][ C1] ? pfn_valid+0x450/0x450 [ 326.694130][ C1] ? copy_mm+0x1705/0x1e30 [ 326.698566][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 326.703606][ C1] ? down_write+0x16e/0x200 [ 326.708135][ C1] ? up_write+0x1be/0x410 [ 326.712478][ C1] copy_mm+0x1751/0x1e30 [ 326.716748][ C1] ? copy_signal+0x640/0x640 [ 326.721360][ C1] ? lockdep_init_map_type+0x9c/0x8e0 [ 326.726767][ C1] ? __init_rwsem+0x122/0x160 [ 326.731455][ C1] ? copy_signal+0x51f/0x640 [ 326.736067][ C1] copy_process+0x16c9/0x3da0 [ 326.740809][ C1] ? copy_process+0x98e/0x3da0 [ 326.745600][ C1] ? __pidfd_prepare+0x140/0x140 [ 326.750561][ C1] kernel_clone+0x24b/0x8a0 [ 326.755081][ C1] ? create_io_thread+0x190/0x190 [ 326.760150][ C1] ? __might_fault+0xaa/0x120 [ 326.764847][ C1] __x64_sys_clone+0x1b7/0x230 [ 326.769635][ C1] ? __ia32_sys_vfork+0x140/0x140 [ 326.774691][ C1] ? lock_chain_count+0x20/0x20 [ 326.779573][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 326.784814][ C1] do_syscall_64+0x55/0xb0 [ 326.789241][ C1] ? clear_bhb_loop+0x40/0x90 [ 326.793940][ C1] ? clear_bhb_loop+0x40/0x90 [ 326.798658][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 326.804571][ C1] RIP: 0033:0x7f0b675c6bd2 [ 326.809004][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 326.828651][ C1] RSP: 002b:00007ffe5505f570 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 326.837083][ C1] RAX: ffffffffffffffda RBX: 00007ffe5505f570 RCX: 00007f0b675c6bd2 [ 326.845088][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 326.853085][ C1] RBP: 00007ffe5505f6fc R08: 0000000000000000 R09: 0000000000000001 [ 326.861070][ C1] R10: 000055556fd847d0 R11: 0000000000000246 R12: 0000000000000001 [ 326.869055][ C1] R13: 00000000000927c0 R14: 000000000004e98b R15: 00007ffe5505f750 [ 326.877072][ C1] [ 326.880104][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 326.887405][ C1] CPU: 1 PID: 5776 Comm: syz-executor Tainted: G W syzkaller #0 [ 326.896429][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 326.906498][ C1] Call Trace: [ 326.909787][ C1] [ 326.912641][ C1] dump_stack_lvl+0x18c/0x250 [ 326.917340][ C1] ? show_regs_print_info+0x20/0x20 [ 326.922553][ C1] ? load_image+0x420/0x420 [ 326.927085][ C1] panic+0x2ca/0x720 [ 326.931008][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 326.935537][ C1] __warn+0x2e0/0x470 [ 326.939536][ C1] ? __debug_object_init+0x18d/0x450 [ 326.944866][ C1] ? __debug_object_init+0x18d/0x450 [ 326.950167][ C1] report_bug+0x2be/0x4f0 [ 326.954517][ C1] ? __debug_object_init+0x18d/0x450 [ 326.959833][ C1] ? __debug_object_init+0x18d/0x450 [ 326.965129][ C1] ? __debug_object_init+0x18f/0x450 [ 326.970426][ C1] handle_bug+0xcf/0x120 [ 326.974686][ C1] exc_invalid_op+0x1a/0x50 [ 326.979216][ C1] asm_exc_invalid_op+0x1a/0x20 [ 326.984112][ C1] RIP: 0010:__debug_object_init+0x18d/0x450 [ 326.990026][ C1] Code: 24 08 74 2f 41 ff c6 44 89 35 2f f9 25 13 48 c7 c1 80 3e 1d 8b 48 c7 c7 e0 3e 1d 8b 84 c0 48 0f 45 f9 48 89 de e8 53 76 49 06 <0f> 0b eb 05 4c 8b 7c 24 18 4d 8d 65 10 4d 89 e6 49 c1 ee 03 41 0f [ 327.009647][ C1] RSP: 0018:ffffc900001f0928 EFLAGS: 00010046 [ 327.015739][ C1] RAX: 0000000000000050 RBX: ffffc900001f09c0 RCX: 33339fb8212b6300 [ 327.023730][ C1] RDX: 0000000000000100 RSI: 0000000000000104 RDI: 0000000000000000 [ 327.031720][ C1] RBP: dffffc0000000000 R08: ffffc900001f0527 R09: 1ffff9200003e0a4 [ 327.039711][ C1] R10: dffffc0000000000 R11: fffff5200003e0a5 R12: ffff88802fd90020 [ 327.047697][ C1] R13: ffff888030500888 R14: 0000000000000001 R15: ffffffff8acbe000 [ 327.055727][ C1] ? __debug_object_init+0x18d/0x450 [ 327.061037][ C1] __synchronize_srcu+0x2ae/0x3d0 [ 327.066087][ C1] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 327.072001][ C1] ? synchronize_srcu_expedited+0x20/0x20 [ 327.077758][ C1] ? read_tsc+0x9/0x20 [ 327.081839][ C1] ? ktime_get_mono_fast_ns+0x19d/0x1c0 [ 327.087407][ C1] ? synchronize_srcu+0x25a/0x280 [ 327.092451][ C1] wakeup_source_unregister+0x116/0x190 [ 327.098014][ C1] mmc_host_classdev_release+0x47/0x100 [ 327.103579][ C1] ? mmc_free_host+0x30/0x30 [ 327.108190][ C1] device_release+0xbc/0x1e0 [ 327.112806][ C1] kobject_put+0x21b/0x450 [ 327.117265][ C1] call_timer_fn+0x189/0x540 [ 327.121877][ C1] ? kref_get+0x70/0x70 [ 327.126074][ C1] ? call_timer_fn+0xd2/0x540 [ 327.130775][ C1] ? __run_timers+0x810/0x810 [ 327.135473][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 327.140709][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 327.145963][ C1] ? kref_get+0x70/0x70 [ 327.150162][ C1] __run_timers+0x570/0x810 [ 327.154707][ C1] ? detach_timer+0x2b0/0x2b0 [ 327.159416][ C1] ? lock_chain_count+0x20/0x20 [ 327.164289][ C1] run_timer_softirq+0x67/0xf0 [ 327.169065][ C1] handle_softirqs+0x27d/0x820 [ 327.173843][ C1] ? read_tsc+0x9/0x20 [ 327.177954][ C1] ? ktime_get+0x24b/0x280 [ 327.182388][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 327.187215][ C1] ? do_softirq+0x1a0/0x1a0 [ 327.191738][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 327.196959][ C1] __irq_exit_rcu+0xd3/0x190 [ 327.201572][ C1] ? irq_exit_rcu+0x20/0x20 [ 327.206094][ C1] irq_exit_rcu+0x9/0x20 [ 327.210347][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 327.216001][ C1] [ 327.218949][ C1] [ 327.221921][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 327.227923][ C1] RIP: 0010:lock_acquire+0x208/0x420 [ 327.233227][ C1] Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3c 04 f8 0f 85 f0 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 43 c7 44 3c 08 00 00 00 00 65 48 8b 04 25 [ 327.252867][ C1] RSP: 0018:ffffc900043bf3a0 EFLAGS: 00000206 [ 327.258954][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 33339fb8212b6300 [ 327.266943][ C1] RDX: 0000000000000000 RSI: ffffffff8acade60 RDI: ffffffff8b1d35e0 [ 327.274932][ C1] RBP: ffffc900043bf4a8 R08: dffffc0000000000 R09: 1ffffffff223dea0 [ 327.282931][ C1] R10: dffffc0000000000 R11: fffffbfff223dea1 R12: 1ffff92000877e80 [ 327.290920][ C1] R13: ffffffff8d1321a0 R14: 0000000000000246 R15: dffffc0000000000 [ 327.298920][ C1] ? read_lock_is_recursive+0x20/0x20 [ 327.304323][ C1] ? page_ext_put+0x9c/0xb0 [ 327.308862][ C1] ? pfn_valid+0xcd/0x420 [ 327.313221][ C1] pfn_valid+0xe9/0x420 [ 327.317399][ C1] ? pfn_valid+0xcd/0x420 [ 327.321758][ C1] page_table_check_set+0x25/0x6e0 [ 327.326897][ C1] copy_page_range+0x24fc/0x3700 [ 327.331871][ C1] ? pfn_valid+0x450/0x450 [ 327.336320][ C1] ? copy_mm+0x1705/0x1e30 [ 327.340768][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 327.345816][ C1] ? down_write+0x16e/0x200 [ 327.350360][ C1] ? up_write+0x1be/0x410 [ 327.354734][ C1] copy_mm+0x1751/0x1e30 [ 327.359007][ C1] ? copy_signal+0x640/0x640 [ 327.363611][ C1] ? lockdep_init_map_type+0x9c/0x8e0 [ 327.369008][ C1] ? __init_rwsem+0x122/0x160 [ 327.373703][ C1] ? copy_signal+0x51f/0x640 [ 327.378314][ C1] copy_process+0x16c9/0x3da0 [ 327.383012][ C1] ? copy_process+0x98e/0x3da0 [ 327.387800][ C1] ? __pidfd_prepare+0x140/0x140 [ 327.392760][ C1] kernel_clone+0x24b/0x8a0 [ 327.397287][ C1] ? create_io_thread+0x190/0x190 [ 327.402334][ C1] ? __might_fault+0xaa/0x120 [ 327.407030][ C1] __x64_sys_clone+0x1b7/0x230 [ 327.411811][ C1] ? __ia32_sys_vfork+0x140/0x140 [ 327.416864][ C1] ? lock_chain_count+0x20/0x20 [ 327.421744][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 327.426965][ C1] do_syscall_64+0x55/0xb0 [ 327.431399][ C1] ? clear_bhb_loop+0x40/0x90 [ 327.436110][ C1] ? clear_bhb_loop+0x40/0x90 [ 327.440808][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 327.446725][ C1] RIP: 0033:0x7f0b675c6bd2 [ 327.451154][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 327.470873][ C1] RSP: 002b:00007ffe5505f570 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 327.479327][ C1] RAX: ffffffffffffffda RBX: 00007ffe5505f570 RCX: 00007f0b675c6bd2 [ 327.487313][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 327.495297][ C1] RBP: 00007ffe5505f6fc R08: 0000000000000000 R09: 0000000000000001 [ 327.503286][ C1] R10: 000055556fd847d0 R11: 0000000000000246 R12: 0000000000000001 [ 327.511272][ C1] R13: 00000000000927c0 R14: 000000000004e98b R15: 00007ffe5505f750 [ 327.519267][ C1] [ 327.522882][ C1] Kernel Offset: disabled [ 327.527215][ C1] Rebooting in 86400 seconds..