last executing test programs: 6.421685998s ago: executing program 0 (id=161): r0 = syz_usb_connect$hid(0x0, 0x6c, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040b827ed0100000000000109022400010000000009040000010300000009210000200122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000b80)={0x24, 0x0, 0x0, &(0x7f0000000b00)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x0, "efb9ce47"}]}}, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_usb_control_io(r0, 0x0, &(0x7f0000000640)={0x84, &(0x7f0000000180)={0x0, 0xc, 0x4, "e8c7d131"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.938185529s ago: executing program 1 (id=173): r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000240)={'vxcan1\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r1, 0x2, {0x2, 0x0, 0x1}, 0xfd}, 0x18) r2 = epoll_create(0x9) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x28}}, 0x44001) 3.764825072s ago: executing program 2 (id=175): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@polexpire={0xc0, 0x1b, 0x4, 0x70bd28, 0x25dfdbfe, {{{@in=@multicast2, @in=@rand_addr=0x64010100, 0x4e22, 0x0, 0x4e23, 0x0, 0x2, 0x20, 0xa0, 0x2c, 0x0, 0xee01}, {0xbf, 0x10000, 0x7ff, 0x1f2, 0x8, 0x1, 0x60dd, 0x4}, {0xe8dd, 0xa, 0x0, 0x1ff}, 0x7a, 0x6e6bc0, 0x0, 0x0, 0x0, 0x3}, 0xfa}}, 0xc0}, 0x1, 0x0, 0x0, 0x8010}, 0x4000000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd0900300003003000000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff02000000000000000000000000000112006558"], 0xfdef) 3.763207482s ago: executing program 3 (id=176): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000480)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000100)={0x1d, r1, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$can_j1939(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x1d, r1, 0x0, {0x0, 0x0, 0x4}, 0x1}, 0x18, &(0x7f00000001c0)={&(0x7f0000000580)="5ab37158946b88213a", 0x9}, 0x1, 0x0, 0x0, 0x200088c0}, 0x4000000) readv(r0, &(0x7f0000000440)=[{&(0x7f0000003200)=""/4096, 0x1000}], 0x1) 3.718758573s ago: executing program 1 (id=177): syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x8c0, &(0x7f0000000340)=ANY=[@ANYBLOB="61636c2c6865617274626561743d6e6f6e652c6469725f726573765f6c6576656c3d30303030303030303030303030303030303030332c726573765f6c6576656c3d30303030303030303030303030303030303030362c636f686572656e63793d66756c6c2c6c6f63616c666c6f636b732c636f686572656e63793d66756c6c2c6e6f61636c2c004c98065b85e5b137d63b2211c62c402045083da9bddc3b0d88d44ecd24ba5288d428197284f332858b83349af2c7646f1e07e91120d7f23ce20389bbc031d81d654f1ca08f61c92d90e6ea478843c1ad942c7c257f9ff5348dd038e947775991ad90f8861dada21d5fa2de7042b5e2cbbcd1ada2b568e375812eb0bc448e68eda4c70cf1d5adf566142ed45924fe72a1eb1a914faf754b9d94bf0fdc1f98c708bd89940b5ef96e328240c39559b35bc83c15c15104f3b3fe1945f0278c34e2399dadcd9776ac659afcbb239569140ab408ad87f15b353941"], 0x1, 0x442d, &(0x7f0000004480)="$eJzs3c9rVNceAPBzb/KeiU998cfCBw/ewBPeoy0hcdU2QjVGY6KpxVYp3YyTZNS0k4wkk9KFi3QndFXoQrqQFrrLSrLo1v4J3XRp10K76KZQkKbMzJ0492aGTCXXVPl8wJzc8zvznXvmzOJ64kTt1sJKYWGlUFoqVOdurJwsfFytrC6WQ/yc7PX49CaPOIn93rl89vy7106G8N38D483Nzc3Q11/6Gi07fdff7kz1562xJk29X4797ZbPgghHNs2r7q+EML734YQhRDOJHnjSToYQjgUmmXX7nx2vbBLs3nwqHyq+GTm7sbYien1+xvd//YohC8r/3rt5uJP/+0b+/GVXRoeAAAAAAAAAAAAAAAAAIAX3OSVy1ffGRkND6PQvx5tf153Mkm7PR+7uWv+k/8fCwAAAAAAAAAAAAAAAAAAAH9RT5//L0RHOjz/P5Gkp7u033wr/zmSn6m3L0+cGxlNzn+PtpW/nmT9fKYvHO5w7nv2/Pczmfadz3/fPs6zas2vNe5QiOLh1HUcDw+H8HVy8PvxaH9cqa7UXr1RXV2a37VpvLDS8W+e3p+KTnKgf6/xH8/0n//5/0e3vZvq19d37y32UkvHv69rvW8+jXqK/9l0s3s5TbvN0fyHeIml49/fyBtsr7CvmdTj/3n/zvGfyPSf1/1/KIRQiOpzLaRWgPoepp7fbb9CWjr+f2vkpZbO5IXsdv//lon/uUz/e7X+r2U/iOgoHf+/N/IGUjWaG4BG/OOd7//zmf73Iv71+a/5/O9JOv7JYt+fqtJ4JXtd/ycz/ecV/6txMs9DUeodsB4187v9f3WkpeM/sK386fe/uKf934VM++f1/a81buv7X2v5/3/U/P5HZ+n4D3at1+v9P5Vpl/f6f7qx/+NZpeO/v5GX3jsPNX72Gv/pTP95xb+xKxloxf/pevL7vmb+V/Z/PUnH/x/NzLi9xlrjZ2P/F+28/7+Y6X8v9n/1+a/F+Y76skjH/0DXevX4f9/D5/+lTLv84x/CiL3+M0vH/2DXeo37f2Dn+M9k2uUd///l2TkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAC2A8SYdCFA+nruN4eDiEs8n18bA/mi3NF2cr1bmPVkKYSPIL4Uh0s1KdLVWKC0vV+XKxVKlU50I4l5QfCwPRSqVaKy6Wbp/f6mswulUuLddmy6VaCGEyyf93ONjqa3ahtli6HUK4sFX2z7i6fPtWaak4v7D85sjIyEiY2prD4aj8Sa28VGuO3iwNYXqr7VDUNrlG8cWtuRyIPqyuLi+VKo38S21tKtW5UqWtzUxS9kU4HNWWV5fmSrVysVK92RpvL51O0ompK+9duTS6rfx61EzHn++0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPiTHo69cS+E0N+8ikMIhSj5JUr+pTx4VD5VfDJzd2PsxPT6/Y3HneoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAH+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhl/5RIgaiOAC/GQUtPYZVSDrbiCJaGBE8gR7Dw+hRvIR3sLCwtVgWdiew5A+EwHbf1zyYH2/ewDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgubvn7uWpbiJSnG/OIr7evn8O84dSP66n+09WzDxd0cNx3D92N7d1U/49jfKrcvTb5l36//f+GhO19znYk+E+7Y3nDM3t29z7+rkXkXIVEW3JL1POVbXsLgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGDLDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgWAAAAABAmL91FH0bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPwKAAD//4w3HM8=") r0 = open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0x20) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x110) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000540), 0x44800, 0x0) sendfile(r1, r2, 0x0, 0xfffe82) copy_file_range(r0, 0x0, r0, &(0x7f00000000c0)=0xf5ff, 0xa00, 0x0) 3.621964015s ago: executing program 0 (id=178): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000180)={@multicast2, @loopback}, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'lo\x00'}) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)=ANY=[@ANYBLOB="e00000027f0007000000000002"], 0x18) 3.40086891s ago: executing program 3 (id=179): r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x1) fchdir(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='.\x00', 0x0, 0x0) utimensat(r2, 0x0, 0x0, 0x0) 3.359906141s ago: executing program 2 (id=180): bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xf, 0x4, 0x8, 0xb}, 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0xa00, 0x106, 0x2, 0xff, 0x1}}) 3.286990522s ago: executing program 0 (id=181): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_mount_image$udf(&(0x7f0000000000), &(0x7f0000000180)='./file0\x00', 0x1200082, &(0x7f0000000700)=ANY=[], 0x1, 0xc46, &(0x7f0000001cc0)="$eJzs3U9sHNd9B/DfGy5F0m4rJk5Uu42LTVukMmO5sqSYilW4q5pmG0CWiVDMLQBX5EpdmCIJkmpkN62ZXnroIUBR9JATgdYokKKB0QRFj2zrAsnFh8KnnogWNoKiB7YIkFPAYGbfiiuJsv6QlCj787Gp7+zMezPvzaxnZEFvXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEb/3ytnjz6eH3QoA4EE6P/nV4yc8/wHgE+WC//8HAAAAAAAAAAAAAICDLkURT0SKxfObabr63DF4rj1/9drU2PjO1YZSVbOvKl/+DD5/4uSpL70werqbH11/rz0Vr01eOFt/eeHK4lJrebk1W5+ab88szLbueg+7rX+zkeoE1K+8fnX20qXl+onnTt6w+drwhwOPHxk+M/rMsae7ZafGxscne8rU+u/76Le43QiPQ1HEsUjx7Pd+nJoRUcTuz8Udvjv7bajqxEjViamx8aojc+3m/Eq5caJ7IoqIek+lRvccPYBrsSuNiNWy+WWDR8ruTS42l5oX51r1iebSSnulvTA/kTqtLftTjyJOp4i1iNgYuHV3/VFELVJ85/BmuhgRfd3z8MVqYPDt21HsYx/vQtnOen/EWvEIXLMDbCCKeDVS/OTdImbKc5Z/4gsRr5b5TxFvl/lSRCq/GKciPqi+R0MPueXshVoU8Rfl9T+zmWar+0H3vnLua/WvzF9a6Cnbva888s+HB+mA35sGo4hmdcffTPf/mx0AAAAAAAAAAAAAAAAA9tpQFPFUpHjlP/6oGlcc1bj0w2dGf3/4F3vHjD95h/2UZZ+LiNXi7sbkHspDiCfSREoPeSzxJ9lgFPEnefzftx52YwAAAAAAAAAAAAAAAAAAAD7Ring/Urz43tG0Fr1zirfnL9cvNC/OdWaF7c79250zfWtra6ueOtnIOZ1zNedazvWcGzmjyPVzNnJO51zNuZZzPedGzujL9XM2ck7nXM25lnM950bOqOX6ORs5p3Ou5lzLuZ5zI2cckLl7AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+Tooo4meR4tvf2EyRIqIRMR2dXB/olgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHqaBVMT3I0X9DxrX19UiIlX/dhwtfzkVjUNlfjoao2W+FI2zOZtV1hrfegjtZ3f6UxE/ihQDg+9cv+D5+vd3Pl3/GsTb39z+9Cu1TvZ1Nw5/OPD4kcNnRsd/7cnbLaedGjByrj1/9Vp9amx8fLJndS0f/dM964bzcYu96ToRsfzGm6835+ZaS4/gwtZbnT4clPY8Egu1zkIt7qf6QETsuGko4r52+AAWap2FfL+Kh96e2yw0DkYztheiuvfveM/mY6N8/n8QKX77vf/sPvC7z/9f6Hy6/oSPn/7p9vP/xZt3tE/P/yd61r2YfzfSX4sYXLmy2H8kYnD5jTePta80L7cut+ZPHT/+5dHRL5883n8oYvBSe67Vs7TrUwUAAAAAAAAAAAAAAADwYKUifjdSNH+0meoRca0arzV8ZvSZY0/3RV813uqGcVuvTV44W3954criUmt5uTVbn5pvzyzMtu72cIPVcK+psfF96cwdDe1z+4cGX15YfGOpffkPV3bc/tjg2YvLK0vNmZ03x1AUEY3eNSNVg6fGxqtGz7Wb81XViT0amNmfivivSDFzqp4+n9fl8X9lvN/fU7Z3/P9qz/pqeZ/G/33qpuOkVMRPI8Vv/eWT8fmqnY/FLecsl/vbSDFy+nO5XBwqy3Xb0HmvQGdkYFn2/yLFP/7sxrLdvj+xXfb5ezu7B195/Q9Hiu//+Xfj1/O6G9//sD3+s/f6P3bzjvbp+n+mZ91jN7yvYNddJ1//Y5HipSfeid/I6z7q/R9FbG1tvRVxNBe+/n6Ofbr+n+1ZNxyd4/7m3nUfAAAAAAAAAADgkdWfivi7SH0xXksv5HV38/f/Zm/e0T79/a9f7lk3+4DmK9r1SQUAAACAA6I/FfF+pLi88s71MdQ9479vHP/5O9tzr4+lm7ZWf873S9V7A/byz/96DefjTu++2wAAAAAAAAAAAAAAAAAAAHCgpFTEC3k+9ek7zKe+Hile+Z9nc7l0pCzXnQd+uPp18PzC/LGzc3MLM82V5sW5Vn1ysTnTKut+JlJs/s3nct2iml+9O998Z473wa3uXOxLkWL877tlO3Oxd+cm78wH3pmLvSz7qUjx3/9wY9nuPNaf3S57oiz715Hi6/+8c9kj22VPlmW/Gyl++PV6t+xjZdnu+1E77yQdrMVc67mZhblbXoUKAAAAAAAAAAAAAAAAAAAA96o/FfFnkeJ/r6zFah72n+f/787AX+uWffubPfP93+RaNc//cDX//03LhyIv38/8/8N71lMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHh0pCjizUixeH4zrQ+UnzsGz7Xnr16bGhvfudpQqmr2VeXLn8HnT5w89aUXRk9386Pr77Wn4rXJC2frLy9cWVxqLS+3ZutT8+2ZhdnWXe9ht/W3T13HSHUC6ldevzp76dJy/cRzJ2/YfG34w4HHjwyfGX3m2NPdslNj4+OTPWVq/fdw9Htq3LZDUcRfRYpnv/fj9C8DEUXs/lzc4buz34aqToxUnZgaG686Mtduzq+UGye6J6KIqPdUanTP0QO4FrvSiFgtm182eKTs3uRic6l5ca5Vn2gurbRX2gvzE6nT2rI/9SjidIpYi4iNgVt31x9FvB4pvnN4M/3rDzrrqvPwxfOTXz1+4vbtKParg3enr+xbf8Ra8QhcswNsIIr4QaT4ybtH498GImrR+YkvRLzaW/CliFR+MU5FfLDD94hHUy2K+P/y+p/ZTO8OlPeD7n3l3NfqX5m/tNBTtntfOUjPh617/y4O7cFh794BvzcNRhE/rO74m+nf/XcNAAAAAAAAAAAAAAAAcIAU8auR4sX3jqZqfPD1McXt+cv1C82Lc51hfd2xf/WIPy5za2trq5462cg5nXM151rO9ZwbOaPI9XM2ck7nXM25lnM950bO6Mv1czZyTudczbmWcz3nRs6oVbG1tfVWp34t18+5mnOtFlGU9fPnjZxxQMbuAQAAAAAAAAAAAAAAAAAAHy9F9U+Kb39jM1VzqTYipqOT6+YD/dj7eQAAAP//6u/7gA==") setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x34, &(0x7f0000000000)=0x2f, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) 3.230943393s ago: executing program 3 (id=182): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) 3.129357745s ago: executing program 2 (id=183): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200), 0xa2442, 0x0) write$dsp(r0, &(0x7f0000000280)='\x00', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r2, 0x80184132, &(0x7f00000002c0)) 2.834793931s ago: executing program 0 (id=184): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bic', 0xff3d) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 2.567033507s ago: executing program 3 (id=185): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x60001, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="080086dd0001280004000003a60c6eec00be00442ffffedb4000000088fc70738daf7b3200aaff020000000000000000000000000001042022eb40f05b"], 0xfdef) 2.362243471s ago: executing program 2 (id=186): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6", 0x1, 0x40, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x51, 0x0, 0x0}, &(0x7f0000000100)=0x3e) 2.304788012s ago: executing program 3 (id=187): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000012c0)=ANY=[@ANYBLOB="12010000c6700610f71400058544010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000240)={0x40, 0xe}, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000300)={0x0, 0x7f, 0x6, &(0x7f00000002c0)={0x10, "dbe59aa96be76f16b24f7fa82127993690ff06d3586655d666db04ee3f6df95bc9"}}) 2.173075615s ago: executing program 2 (id=188): r0 = msgget(0x2, 0x200) msgctl$IPC_RMID(r0, 0x0) msgget(0x0, 0x710) msgget(0x2, 0x624) msgget(0x1, 0x240) msgget(0x3, 0x606) 2.107841287s ago: executing program 1 (id=189): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x28843, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r1, 0xaea2, 0xffffffffffffffff) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_TSC_KHZ_cpu(r2, 0xaea2, 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.092964756s ago: executing program 2 (id=190): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x6) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/tcp6\x00') read$FUSE(r1, &(0x7f00000046c0)={0x2020}, 0x2020) 1.764276303s ago: executing program 0 (id=191): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x10000, &(0x7f0000000080)={[{@quota}, {@delalloc}, {@data_err_ignore}, {@debug}, {@usrjquota}, {@bsdgroups}]}, 0x1, 0x4e8, &(0x7f00000016c0)="$eJzs3M9vFGUfAPDvbLu0wMtLRSQBUQtobExsoaBw8IKJiQdNjHiQY9MWUlnA0B6ENLIkBs8k3o1H400Tr3o0nvwD8ODBxJAQ5QJ4WjO7M9vt/uh2S2nT7ueTLDzP7PPM8zwz88w+M09nAuhbo+k/ScT/IuJuROytRZcnGK399+jB4vTjB4vTUa5Uzv2dVNM9TOOZPN/uLDJWiCh8kTStsGb++o1LU6XS7LUoV+MTC5c/nZi/fuP1uctTF2cvzl6ZPHPm1MkTp9+cfKM563DXRrUpL23Xw0OfXz188N3zd96fHmxeWWM7Ospz/VPumjTybdvBK43r2wb2NIST1nbd3NDKsGrD2WFYTPv/Yuno+c2uELBhKpVKZajz1+VKs1stS4AtK4nNrgGwOfIf+vT6N//UlhQ3Yvix6e6frV0APXywWLkZMf2o3v7BKGRpik3Xt6kVxkw9GY2Ij8v/fp1+YqX7EH+sU4EAQN/7+Ww2DEyiafxXiAMN6f6fzaGMRMQzEbEvIp6NiP0R8VzEsrTLJBGVFcrf37ygXv4P2SxC4d5a27Ya6fjvrWxuK/9k5eZJRgay2J6IfMA8ezzbJmNRHLowV5o90WH9O7qU3zj+Sz9p+flYMKvHvcGmwebM1MLU2lrb6v6tiEODze1PBtMdl0/jJBFxMCIO9bDekYbw3GvfHq5Hmi4rure/qtJmSm9d5s8q30S8Wtv/5Vi2/5dKTBrnJwst85MTw1GaPT6RHgXH25bx62+3P+hUftf2//hnc5Z3Tv907kmbXZfu/10Nx3/k87dL7R9JIpL6fO18RGWgtzJu//5ldb2jx1q/W+vxvyP5qBrO+9dnUwsL105E7Ejea10+uZQ3j+fp0/aPHWvf//dledIt8XxEpAfxCxHxYsRAXvcjEXE0Ito0re6Xt1/+pNN3qzz+n5q0/TNtz3/L9v/SfP0qA3nmdMnApSN3H3c4eWTt37vy/j9VDY1lS9qf/5Jlp4jV1vTJth4AAABsDYWo/u1/YbweLhTGx2v3gPbHrkLp6vzCSxFxZab2jMBIFAsX5kqz+Q25kSgm+f3PkYb4ZFP8ZHbf+KuBndX4+PTV0sxmNx763O5qn09a+n/qrx7v8wJb0DZ6Dg3oUbf+f+DOBlUE2HB+/6F/NfT/Tm+2KPtLGdie/P5D/2rX/2/Gdys+u+CcAVtfRV+GvrZy/+/+vk1g6xqMD+vh6mPPbZ+2BbYj43/oS70+199boDLU/qvhaPPGgOGnU42dbcralEA6slrHFRYjYnWJd66liHwI2PkND4XeVjgUrV8NxEq5kvbvcYiIcsdc6VbpWp+LB9b94M/fibLeh833S/20uMrd/aQB1/sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMC28l8AAAD//w1dzgU=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x40) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x42) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r1, 0x8004587d, &(0x7f0000000540)={@id={0x2, 0x0, @c}}) write$uinput_user_dev(r0, 0x0, 0x0) 1.089311777s ago: executing program 1 (id=192): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xf1, @empty, 0x19f4929}], 0x1c) listen(r0, 0x100) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r1, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @loopback=0x7f00fffd}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000300)="d9", 0xfffd}], 0x1, &(0x7f0000000100)=[@dstaddrv4={0x18, 0x84, 0x7, @local}], 0x18, 0x48d5}, 0x8050) close(0x3) 810.758723ms ago: executing program 0 (id=193): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) 545.990588ms ago: executing program 1 (id=194): ptrace$poke(0x5, 0x0, 0x0, 0x5) syz_mount_image$udf(&(0x7f0000000f00), &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000002800)=ANY=[@ANYBLOB="73686f727461642c756e64656c6574652c73657373696f6e3d30303030000800003030303030303030303139302c6d6f64653d30303030303030303030303030303030303030303030352c726f6f746469723d30303030303030303030303030303030303030352c646d6f64653d30303030303030303030303030303030303030303030362c696f636861727365743d6370313235312c696f636861727365743d6b6f69382d722c6e6f7672732c0084f5b23d82aacbefd1de1daab7394a9b4696461da9ab46f2d71c895d8c"], 0x1, 0xc41, &(0x7f0000001b80)="$eJzs3U9sHNd9B/DfG5Hi0m4rxnYUJ42LTVuksmK5+hdTsQp3VdNsA8gyEYq5BeCKpNSFKZIgqUY20oLupYceAhRFDzkRaI0CKRoYTRH0yLQukFx8KHLqiWhhIyh6YIsAOQUMZvatuKRJmzb/iLI+H5v67s68N/PezHJGIvjmBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ8QcvXTl7Lt3vVgAAh+na6NfOnnf/B4CHynX//gcAAAAAAAAAAAAAgKMuRRGPR4q5a2tpvHrfVrva6r1zd2xoePtq/amqeawqX37Vzp2/cPHLzw1e6uTV1swH1N9vn4tXRq9fqb84e3tufmphYWqyPjbTmpidnNr1FvZaf6vT1QGo3371zuTNmwv1889e2LT67sB7fY+eHLg8+PSZpzplx4aGh0c3itS6y/d87Ia07TTC43gUcSZSPPO9n6ZmRBSx92NRO9xzv1V/1YnTVSfGhoarjky3mjOL5cqRzoEoIupdlRqdY7T9uYie3kPtw84aEUtl88sGny67NzrXnG/emJ6qjzTnF1uLrdmZkdRubdmfehRxKUUsR8Rq3/s31xtF9ESK75xYSzci4ljnOHypGhi8czuKA+zjLpTtrPdGLBcPwDk7wvqiiJcjxc/ePhUT+TpTXWu+GPFymT+IeLPMFyJS+cG4GPHuNp8jHkw9UcRfluf/8lqarK4HnevK1a/Xvzpzc7arbOe68hHvD++7Utyn+0P/ljwcR/zaVIsimtUVfy19/L/sAAAAAAAAAAAAAAAAALDf+qOIz0aKl/7jT6pxxVGNSz9xefAPB361e8z4kx+ynbLssxGxVOxuTO7xPDBwJI2kdJ/HEj/MalHEn+bxf2/c78YAAAAAAAAAAAAAAAAAAAA81Ir4SaR4/p1TaTm65xRvzdyqX2/emG7PCtuZ+7czZ/r6+vp6PbWzkXM851LO5ZwrOVdzRpHr52zkHM+5lHM550rO1ZxxLNfP2cg5nnMp53LOlZyrOaMn18/ZyDmecynncs6VnKs544jM3QsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8ElSRBG/iBTf/uZaihQRjYjxaOdK3/1uHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQ6ktFfD9S1P+ocW9ZT0Sk6v+2U+UfF6NxvMzHojFY5gvRuJKzWWVP44370H72pjcV8eNI0Vd7K1JPe1k+/73td/c+BvHmtzbefS6XPdZZOfBe36MnT1weHP6NJ3d6nbZrwOmrrZk7d+tjQ8PDo12Le/LeH+taNpD3W+xT34lYeO31V5vT01PzH/9F+RHYQ/UH6EX5DXIEmuHFYb2IniPRjPvTdx4C5f3/3Ujxu+/8Z+eG377/1+JX2u/u3eHj53+2cf9/fuuGdnn/79laL9//y3v6dvf/x7uWPZ//NtLbE1FbvD3XezKitvDa62dat5u3pm5NzVw8e/Yrg4NfuXC293hE7WZreqrr1b4cLgAAAAAAAAAAAAAAAIDDk4r4/UjR/PFaqkfE3Wq81sDlwafPPHUsjlXjrTaN235l9PqV+ouzt+fmpxYWpibrYzOtidnJqd3urlYN9xobGj6Qznyo/gNuf3/txdm51+Zbt/54cdv1j9Su3FhYnG9ObL86+qOIaHQvOV01eGxouGr0dKs5U1Ud2XYw/UfXm4r4r0gxcbGevpCX5fH/W0f4bxr/v7R1Qwc0/v9TXcvKfaZUxM8jxe/81ZPxhaqdj8T7jlku93eR4vSlz+dycbws12nDY9VDBNojA8uy/xcp/ukXm8t2xkO2xyBWZc/t/sg+GMrzfyJSfP8vvhu/mZdtfv7D9uf/ka0bOqDz/0TXskc2Pa9gz10nn/8zkeKFx9+K38rLPuj5H51nb5zKhe89n+OAzv+nu5YN5P3+9v50HQAAAAAAAAAA4IHWm4r4+0jxw+Ge9Fxetpvf/5vcuqED+v2vz3Qtm9yf+Yo+9MWeDyoAAAAAHBG9qYifRIpbi2/dG0O9efx31/jP39sY/zmUtqytfs73a9VzA/bz53/dBvJ+x/febQAAAAAAAAAAAAAAAAAAADhSUiriuTyf+ng1nn9yx/nUVyLFS//zTC6XTpblOvPAD1R/1q7Nzpy5Mj09O9FcbN6YnqqPzjUnpsq6T0SKtb/9fK5bVPOrd+abb8/xvjEX+3ykGP6HTtn2XOyducmf2Ch7riz7qUjx3/+Yy66vV2U781h/eqPs+bLs30SKb/zL5u12yp7cKHuhLPvdSPGjb9Q7ZR8py3aej/qZjbLPTswWB3BWAAAAAAAAAAAAAAAAAAAAeNj0piL+PFL87+3le2P58/z/vV1vK29+q2u+/y3uVvP8D1Tz/+/0+uPM/189V2Bpp70CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAnU4oiXo8Uc9fW0kpf+b6tdrU1c+fu2NDw9tX6U1XzWFW+/KqdO3/h4pefG7zUyQ+uv98+G6+MXr9Sf3H29tz81MLC1GR9bKY1MTs5test7LX+VqerA1C//eqdyZs3F+rnn72wafXdgff6Hj05cHnw6TNPdcqODQ0Pj3aV6en9qDt9Y8c1aYflx6OIv44Uz3zvp+mHfRFF7P1YbPvZ6dt9L/aov+rE6aoTY0PDVUemW82ZxXLlSOdAFBH1rkqNzjHat3NxQBoRS2XzywafLrs3Otecb96YnqqPNOcXW4ut2ZmR1G5t2Z96FHEpRSxHxOo256A3ing1UnznxFr6176IY53j8KVro187e37ndhQH2MddKNtZ741YLh6Ac3aE9UUR/xwpfvb2qfi3voieaH/FFyNeLvMHEW9G+3yn8oNxMeLdw/te5oD1RBH/X57/y2vp7b7yetC5rlz9ev2rMzdnu8p2risHcn84PP2Hurcjfm2qRRE/qq74a+nffV8DAAAAAAAAAAAAAAAAHCFF/HqkeP6dU6kaH3xvTHFr5lb9evPGdHtYX2fsX2fM9Pr6+no9tbORczznUs7lnCs5V3NGkevnbJRZW18fz++Xci7nXMm5mjOO5fo5GznHcy7lXM65knM1Z/Tk+jkbOcdzLuVczrmSczVnHJGxewAAAAAAAAAAAAAAAAAAwCdLUf2X4tvfXEvrfe35pcejnSvmA/3E+2UAAAD//xtt+zc=") setrlimit(0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x147441, 0x94) truncate(&(0x7f0000000340)='./file1\x00', 0x20fffbfffc) write$binfmt_register(r0, &(0x7f0000000100)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0x0, 0x3a, 'udf\x00', 0x3a, 'udf\x00', 0x3a, './file1'}, 0x2f) 20.78457ms ago: executing program 3 (id=195): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r0, &(0x7f00000006c0)=[{&(0x7f0000000080)="2e9b5b00073f861a88f1c600000000008100", 0x12}, {&(0x7f0000000380)="b7000018", 0x4}], 0x2) 0s ago: executing program 1 (id=196): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="c60009"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001640)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="002290"], 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0xedff) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0xae343) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.18' (ED25519) to the list of known hosts. [ 83.507827][ T5760] cgroup: Unknown subsys name 'net' [ 83.644639][ T5760] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 85.298353][ T5760] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 87.489527][ T5782] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.506365][ T5782] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.526556][ T5782] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.534501][ T5782] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.556114][ T5782] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.576522][ T5782] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.584748][ T5782] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 87.596329][ T5783] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 87.603859][ T5787] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.605519][ T5782] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.623590][ T5782] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 87.632183][ T5787] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 87.639456][ T5782] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.655556][ T5787] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 87.656819][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.671285][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.675877][ T5787] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 87.688622][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 87.695959][ T5783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 87.703151][ T5787] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.723370][ T5789] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.732923][ T5789] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.762177][ T5787] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 87.771082][ T5787] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.324098][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 88.379961][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 88.439930][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 88.470048][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 88.603332][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.611920][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.622177][ T5772] bridge_slave_0: entered allmulticast mode [ 88.629853][ T5772] bridge_slave_0: entered promiscuous mode [ 88.676745][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.683977][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.691521][ T5772] bridge_slave_1: entered allmulticast mode [ 88.699129][ T5772] bridge_slave_1: entered promiscuous mode [ 88.712914][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.720165][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.727466][ T5775] bridge_slave_0: entered allmulticast mode [ 88.735001][ T5775] bridge_slave_0: entered promiscuous mode [ 88.743617][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.751046][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.758426][ T5775] bridge_slave_1: entered allmulticast mode [ 88.765887][ T5775] bridge_slave_1: entered promiscuous mode [ 88.840645][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.851553][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.859187][ T5774] bridge_slave_0: entered allmulticast mode [ 88.866864][ T5774] bridge_slave_0: entered promiscuous mode [ 88.897941][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.907436][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.914610][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.922961][ T5773] bridge_slave_0: entered allmulticast mode [ 88.930559][ T5773] bridge_slave_0: entered promiscuous mode [ 88.938583][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.946530][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.953793][ T5774] bridge_slave_1: entered allmulticast mode [ 88.961064][ T5774] bridge_slave_1: entered promiscuous mode [ 88.981789][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.996189][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.017530][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.024698][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.034450][ T5773] bridge_slave_1: entered allmulticast mode [ 89.041699][ T5773] bridge_slave_1: entered promiscuous mode [ 89.072200][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.107646][ T5772] team0: Port device team_slave_0 added [ 89.116522][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.128753][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.153959][ T5772] team0: Port device team_slave_1 added [ 89.163021][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.186477][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.220774][ T5775] team0: Port device team_slave_0 added [ 89.261752][ T5775] team0: Port device team_slave_1 added [ 89.290414][ T5773] team0: Port device team_slave_0 added [ 89.302764][ T5774] team0: Port device team_slave_0 added [ 89.321507][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.328653][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.355338][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.369879][ T5773] team0: Port device team_slave_1 added [ 89.380550][ T5774] team0: Port device team_slave_1 added [ 89.399121][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.406434][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.432435][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.444633][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.451761][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.477912][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.523342][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.530572][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.556825][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.594258][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.601678][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.629116][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.688135][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.695400][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.722613][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.728666][ T5776] Bluetooth: hci3: command tx timeout [ 89.734199][ T5787] Bluetooth: hci0: command tx timeout [ 89.746315][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.753325][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.779639][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.792758][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.799927][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.826272][ T5787] Bluetooth: hci1: command tx timeout [ 89.831928][ T5787] Bluetooth: hci2: command tx timeout [ 89.837918][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.887598][ T5772] hsr_slave_0: entered promiscuous mode [ 89.895210][ T5772] hsr_slave_1: entered promiscuous mode [ 89.939978][ T5775] hsr_slave_0: entered promiscuous mode [ 89.946643][ T5775] hsr_slave_1: entered promiscuous mode [ 89.952829][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.960840][ T5775] Cannot create hsr debugfs directory [ 90.003075][ T5774] hsr_slave_0: entered promiscuous mode [ 90.010151][ T5774] hsr_slave_1: entered promiscuous mode [ 90.016746][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.024327][ T5774] Cannot create hsr debugfs directory [ 90.155510][ T5773] hsr_slave_0: entered promiscuous mode [ 90.161932][ T5773] hsr_slave_1: entered promiscuous mode [ 90.168499][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.176215][ T5773] Cannot create hsr debugfs directory [ 90.574669][ T5772] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.593116][ T5772] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.625781][ T5772] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.639853][ T5772] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.677618][ T5775] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.709437][ T5775] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.730193][ T5775] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.742748][ T5775] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 90.839830][ T5774] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.853688][ T5774] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.879642][ T5774] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.891626][ T5774] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 90.996381][ T5773] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 91.007460][ T5773] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 91.021512][ T5773] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 91.033841][ T5773] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 91.070318][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.131380][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.150115][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.183933][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.191395][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.235726][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.249987][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.257225][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.288703][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.295877][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.328941][ T1108] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.336176][ T1108] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.408302][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.460509][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.482869][ T5775] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 91.522443][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.529632][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.544451][ T1086] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.551715][ T1086] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.580158][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.691481][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.767293][ T1143] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.774495][ T1143] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.808439][ T5776] Bluetooth: hci3: command tx timeout [ 91.808451][ T5787] Bluetooth: hci0: command tx timeout [ 91.830862][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.838185][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.886251][ T5776] Bluetooth: hci2: command tx timeout [ 91.887510][ T5787] Bluetooth: hci1: command tx timeout [ 91.970843][ T5773] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 92.103835][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.137422][ T27] cfg80211: failed to load regulatory.db [ 92.272134][ T5775] veth0_vlan: entered promiscuous mode [ 92.311339][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.337648][ T5775] veth1_vlan: entered promiscuous mode [ 92.348742][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.464744][ T5774] veth0_vlan: entered promiscuous mode [ 92.483190][ T5775] veth0_macvtap: entered promiscuous mode [ 92.495610][ T5775] veth1_macvtap: entered promiscuous mode [ 92.522050][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.556115][ T5774] veth1_vlan: entered promiscuous mode [ 92.566385][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.596296][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.623143][ T5775] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.634885][ T5775] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.643870][ T5775] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.654884][ T5775] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.678298][ T5772] veth0_vlan: entered promiscuous mode [ 92.731679][ T5772] veth1_vlan: entered promiscuous mode [ 92.763031][ T5773] veth0_vlan: entered promiscuous mode [ 92.821460][ T5774] veth0_macvtap: entered promiscuous mode [ 92.853458][ T5774] veth1_macvtap: entered promiscuous mode [ 92.870245][ T5772] veth0_macvtap: entered promiscuous mode [ 92.878957][ T5773] veth1_vlan: entered promiscuous mode [ 92.914843][ T5772] veth1_macvtap: entered promiscuous mode [ 92.922110][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.941183][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.990284][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.001931][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.015650][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.048495][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.059777][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.076199][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.085797][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.093689][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.108240][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.119660][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.130850][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.141521][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.153814][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.177175][ T5774] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.188966][ T5774] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.198467][ T5774] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.207429][ T5774] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.252430][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.266134][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.281518][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.295278][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.309283][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.351140][ T5773] veth0_macvtap: entered promiscuous mode [ 93.379639][ T5772] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.390204][ T5772] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.399449][ T5772] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.411507][ T5772] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.460988][ T5773] veth1_macvtap: entered promiscuous mode [ 93.532617][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.550488][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.561901][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.586310][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.601423][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.613720][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.629794][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.640579][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.653883][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.693043][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.705516][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.716089][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.733650][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.752137][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.763080][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.786724][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.821786][ T4175] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.846781][ T4175] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.886991][ T5787] Bluetooth: hci3: command tx timeout [ 93.887018][ T5776] Bluetooth: hci0: command tx timeout [ 93.959408][ T1108] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.970639][ T5776] Bluetooth: hci2: command tx timeout [ 93.977421][ T5776] Bluetooth: hci1: command tx timeout [ 94.013392][ T1108] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.037531][ T5773] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.060764][ T5773] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.077737][ T5773] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.101568][ T5773] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.233651][ T4175] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.253380][ T4175] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.328730][ T4175] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.375300][ T4175] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.440783][ T1108] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.479924][ T1108] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.864527][ T5859] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 95.862996][ T5876] Driver unsupported XDP return value 0 on prog (id 2) dev N/A, expect packet loss! [ 95.965182][ T5776] Bluetooth: hci0: command tx timeout [ 95.965468][ T5787] Bluetooth: hci3: command tx timeout [ 96.045723][ T5787] Bluetooth: hci1: command tx timeout [ 96.051227][ T5787] Bluetooth: hci2: command tx timeout [ 96.220225][ T5883] ======================================================= [ 96.220225][ T5883] WARNING: The mand mount option has been deprecated and [ 96.220225][ T5883] and is ignored by this kernel. Remove the mand [ 96.220225][ T5883] option from the mount to silence this warning. [ 96.220225][ T5883] ======================================================= [ 96.412506][ T5887] syz.1.17[5887]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 96.571079][ T5889] loop3: detected capacity change from 0 to 2048 [ 96.645939][ T5889] UDF-fs: error (device loop3): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 96.660742][ T5889] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 96.746143][ T9] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 96.974310][ T9] usb 2-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 10 [ 97.008605][ T9] usb 2-1: config 0 interface 0 altsetting 255 endpoint 0x4 has invalid maxpacket 169, setting to 64 [ 97.050863][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 97.071307][ T9] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 97.083775][ T9] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 97.117536][ T9] usb 2-1: Product: syz [ 97.121796][ T9] usb 2-1: Manufacturer: syz [ 97.130798][ T9] usb 2-1: SerialNumber: syz [ 97.173032][ T9] usb 2-1: config 0 descriptor?? [ 97.187889][ T5887] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 97.220665][ T9] usb 2-1: selecting invalid altsetting 0 [ 97.647723][ T5887] usb 2-1: BOGUS urb xfer, pipe 0 != type 1 [ 98.363974][ T5915] netlink: 8 bytes leftover after parsing attributes in process `syz.0.27'. [ 98.432247][ T5915] Zero length message leads to an empty skb [ 98.524879][ T5921] netlink: 12 bytes leftover after parsing attributes in process `syz.3.28'. [ 98.593456][ T5921] netlink: 4 bytes leftover after parsing attributes in process `syz.3.28'. [ 98.897788][ T5927] loop3: detected capacity change from 0 to 8192 [ 99.008661][ T28] audit: type=1800 audit(1784729340.947:2): pid=5927 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.31" name="file2" dev="loop3" ino=1048593 res=0 errno=0 [ 99.055498][ T5927] syz.3.31: attempt to access beyond end of device [ 99.055498][ T5927] loop3: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 99.094329][ T5934] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 99.281290][ T5936] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 99.325592][ T5936] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 99.368490][ T5936] bond0 (unregistering): (slave ip6gretap0): Releasing backup interface [ 99.419021][ T5936] bond0 (unregistering): Released all slaves [ 99.490049][ T9] usb 2-1: USB disconnect, device number 2 [ 99.676484][ T5943] loop1: detected capacity change from 0 to 128 [ 99.759234][ T5943] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 99.801166][ T5943] ext4 filesystem being mounted at /5/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 99.922570][ T5947] loop0: detected capacity change from 0 to 512 [ 99.953440][ T5947] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 100.011637][ T5947] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 100.043526][ T5938] loop2: detected capacity change from 0 to 32768 [ 100.058130][ T5943] syz.1.37 (pid 5943) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 100.076357][ T5947] EXT4-fs error (device loop0): ext4_orphan_get:1430: comm syz.0.38: bad orphan inode 131083 [ 100.121523][ T5947] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 100.188936][ T5773] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 100.240480][ T5772] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 100.323302][ T5938] JBD2: Ignoring recovery information on journal [ 100.489057][ T5938] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 101.125340][ T5938] syz.2.35 (5938) used greatest stack depth: 18264 bytes left [ 101.238266][ T5774] ocfs2: Unmounting device (7,2) on (node local) [ 101.607706][ T5985] warning: `syz.0.51' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 101.755857][ T5989] io-wq is not configured for unbound workers [ 102.047911][ T5999] netlink: 8 bytes leftover after parsing attributes in process `syz.2.57'. [ 102.095192][ T5999] netlink: 8 bytes leftover after parsing attributes in process `syz.2.57'. [ 102.124501][ T6001] loop3: detected capacity change from 0 to 512 [ 102.157505][ T6001] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 102.309235][ T6001] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 102.394156][ T6001] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 102.764603][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.563540][ T5762] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 104.637837][ T5762] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 104.729765][ T6053] loop2: detected capacity change from 0 to 4096 [ 104.757373][ T6053] ext4: Bad value for 'sb' [ 104.820633][ T5895] I/O error, dev loop2, sector 3968 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 104.973692][ T6057] loop1: detected capacity change from 0 to 8192 [ 105.036144][ T6057] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 105.143121][ T6057] REISERFS (device loop1): found reiserfs format "3.5" with non-standard journal [ 105.195228][ T6057] REISERFS (device loop1): using ordered data mode [ 105.201842][ T6057] reiserfs: using flush barriers [ 105.235288][ T6057] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 105.273174][ T6057] REISERFS (device loop1): checking transaction log (loop1) [ 105.344503][ T6057] REISERFS (device loop1): Using r5 hash to sort names [ 105.390280][ T6057] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage. [ 105.696920][ T6066] loop2: detected capacity change from 0 to 2048 [ 105.745318][ T6066] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 105.955439][ T175] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 105.972556][ T6070] loop1: detected capacity change from 0 to 1024 [ 105.988039][ T6070] EXT4-fs: inline encryption not supported [ 106.076012][ T6070] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 106.144175][ T6070] EXT4-fs error (device loop1): ext4_read_inline_dir:1591: inode #12: block 7: comm syz.1.82: path /19/file0/file0: bad entry in directory: rec_len is smaller than minimal - offset=40, inode=14, rec_len=8, size=80 fake=0 [ 106.155685][ T175] usb 1-1: Using ep0 maxpacket: 32 [ 106.173401][ T175] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 106.185669][ T175] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 106.195884][ T175] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 106.212540][ T175] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.223328][ T175] usb 1-1: config 0 descriptor?? [ 106.234720][ T175] hub 1-1:0.0: USB hub found [ 106.290183][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 106.468194][ T175] hub 1-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 106.574663][ T6081] netlink: 'syz.3.86': attribute type 4 has an invalid length. [ 106.881012][ T175] hid-generic 0003:046D:C31C.0002: unknown main item tag 0x0 [ 106.913784][ T175] hid-generic 0003:046D:C31C.0002: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.0-1/input0 [ 106.943175][ T6087] loop2: detected capacity change from 0 to 1024 [ 106.981115][ T6087] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 107.001975][ T6087] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (42152!=20869) [ 107.041633][ T6087] EXT4-fs (loop2): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 107.076705][ T6087] EXT4-fs error (device loop2): ext4_get_journal_inode:5820: inode #5: comm syz.2.88: unexpected bad inode w/o EXT4_IGET_BAD [ 107.111666][ T6087] EXT4-fs (loop2): no journal found [ 107.129942][ T6087] EXT4-fs (loop2): can't get journal size [ 107.148807][ T6087] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 107.411619][ T6098] loop1: detected capacity change from 0 to 512 [ 107.458645][ T5774] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.492873][ T6098] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 107.677454][ T5840] usb 1-1: USB disconnect, device number 2 [ 107.751625][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.880589][ T6107] overlayfs: metacopy with no lower data found - abort lookup (/file1) [ 107.965110][ T175] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 108.042552][ T6113] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 108.137849][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 108.153808][ T175] usb 3-1: Using ep0 maxpacket: 32 [ 108.169929][ T175] usb 3-1: config 2 has an invalid interface number: 88 but max is 0 [ 108.185377][ T175] usb 3-1: config 2 has no interface number 0 [ 108.191593][ T175] usb 3-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 108.223483][ T175] usb 3-1: config 2 interface 88 has no altsetting 0 [ 108.237995][ T175] usb 3-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 108.251528][ T175] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 108.270084][ T175] usb 3-1: Product: syz [ 108.274354][ T175] usb 3-1: Manufacturer: syz [ 108.290033][ T175] usb 3-1: SerialNumber: syz [ 108.318345][ T6103] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 108.358423][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 108.366901][ T9] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.378228][ T9] usb 4-1: config 0 interface 0 has no altsetting 0 [ 108.386808][ T9] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 108.399941][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.418934][ T9] usb 4-1: config 0 descriptor?? [ 108.550779][ T6103] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 108.880600][ T6123] loop0: detected capacity change from 0 to 32768 [ 108.882770][ T9] nzxt-smart2 0003:1E71:2009.0003: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 108.965548][ T6123] [ 108.965548][ T6123] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 108.965548][ T6123] [ 109.043646][ T28] audit: type=1800 audit(1784729350.987:3): pid=6123 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.101" name="file1" dev="loop0" ino=4 res=0 errno=0 [ 109.243035][ T6123] ERROR: (device loop0): xtSearch: stack overrun! [ 109.243035][ T6123] [ 109.347218][ T6123] ERROR: (device loop0): xtSearch: stack overrun! [ 109.347218][ T6123] [ 109.385519][ T6123] xtLookup: xtSearch returned -5 [ 109.391491][ T6123] ERROR: (device loop0): xtTruncate: stack overrun! [ 109.391491][ T6123] [ 109.418985][ T5762] usb 4-1: USB disconnect, device number 2 [ 109.538536][ T48] [ 109.538536][ T48] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.538536][ T48] [ 109.549830][ T48] [ 109.549830][ T48] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.549830][ T48] [ 109.562932][ T48] [ 109.562932][ T48] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.562932][ T48] [ 109.574117][ T48] [ 109.574117][ T48] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.574117][ T48] [ 109.589282][ T175] asix 3-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 109.617410][ T48] JFS: metapage_get_blocks failed [ 109.625778][ T175] asix: probe of 3-1:2.88 failed with error -71 [ 109.633078][ T48] [ 109.633078][ T48] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.633078][ T48] [ 109.649613][ T5772] [ 109.649613][ T5772] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.649613][ T5772] [ 109.666690][ T175] usb 3-1: USB disconnect, device number 2 [ 109.686053][ T5772] [ 109.686053][ T5772] ... Log Wrap ... Log Wrap ... Log Wrap ... [ 109.686053][ T5772] [ 110.013746][ T6133] loop0: detected capacity change from 0 to 8192 [ 110.665258][ T5762] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 110.885953][ T5762] usb 3-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 110.915735][ T5762] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.924356][ T5762] usb 3-1: Product: syz [ 110.945241][ T5762] usb 3-1: Manufacturer: syz [ 110.953466][ T5762] usb 3-1: SerialNumber: syz [ 110.973692][ T5762] usb 3-1: config 0 descriptor?? [ 111.003554][ T5762] ch341 3-1:0.0: ch341-uart converter detected [ 111.318673][ T6146] loop1: detected capacity change from 0 to 40427 [ 111.384430][ T6146] F2FS-fs (loop1): invalid crc value [ 111.467738][ T6146] F2FS-fs (loop1): Found nat_bits in checkpoint [ 111.612449][ T6146] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 111.965514][ T6168] syz.1.109: attempt to access beyond end of device [ 111.965514][ T6168] loop1: rw=2049, sector=77824, nr_sectors = 2048 limit=40427 [ 112.017760][ T5762] usb 3-1: ch341-uart converter now attached to ttyUSB0 [ 112.225132][ T5762] usb 3-1: USB disconnect, device number 3 [ 112.245987][ T5762] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 112.268137][ T5762] ch341 3-1:0.0: device disconnected [ 112.269069][ T5773] syz-executor: attempt to access beyond end of device [ 112.269069][ T5773] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 112.312726][ T5773] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 113.733517][ T6196] loop1: detected capacity change from 0 to 4096 [ 113.891671][ T6198] loop2: detected capacity change from 0 to 256 [ 114.122020][ T6192] loop0: detected capacity change from 0 to 32768 [ 114.132279][ T6184] loop3: detected capacity change from 0 to 40427 [ 114.186486][ T6184] F2FS-fs (loop3): invalid crc value [ 114.261303][ T6192] JBD2: Ignoring recovery information on journal [ 114.272228][ T6184] F2FS-fs (loop3): Found nat_bits in checkpoint [ 114.349452][ T6192] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 114.497624][ T6184] F2FS-fs (loop3): Start checkpoint disabled! [ 114.582003][ T6184] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 114.762412][ T28] audit: type=1800 audit(1784729356.697:4): pid=6184 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.123" name="file1" dev="loop3" ino=10 res=0 errno=0 [ 114.795498][ T6184] syz.3.123: attempt to access beyond end of device [ 114.795498][ T6184] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 114.847540][ T6184] syz.3.123: attempt to access beyond end of device [ 114.847540][ T6184] loop3: rw=2049, sector=45104, nr_sectors = 8 limit=40427 [ 114.883886][ T6192] syz.0.126 (6192) used greatest stack depth: 18024 bytes left [ 114.908950][ T6184] syz.3.123: attempt to access beyond end of device [ 114.908950][ T6184] loop3: rw=2049, sector=45112, nr_sectors = 8 limit=40427 [ 114.936811][ T6184] syz.3.123: attempt to access beyond end of device [ 114.936811][ T6184] loop3: rw=2049, sector=45120, nr_sectors = 8 limit=40427 [ 114.976580][ T5772] ocfs2: Unmounting device (7,0) on (node local) [ 115.248704][ T4175] kworker/u4:10: attempt to access beyond end of device [ 115.248704][ T4175] loop3: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 115.273847][ T4175] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 115.282707][ T4175] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 115.430948][ T6223] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 115.911828][ T6235] loop0: detected capacity change from 0 to 8192 [ 115.959640][ T6235] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 116.012065][ T6235] REISERFS (device loop0): found reiserfs format "3.5" with non-standard journal [ 116.064345][ T6235] REISERFS (device loop0): using ordered data mode [ 116.066497][ T175] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 116.079256][ T6235] reiserfs: using flush barriers [ 116.091184][ T6235] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 116.098177][ T6238] loop3: detected capacity change from 0 to 1024 [ 116.113432][ T6235] REISERFS (device loop0): checking transaction log (loop0) [ 116.144459][ T6235] REISERFS (device loop0): Using r5 hash to sort names [ 116.156262][ T6238] EXT4-fs: Ignoring removed i_version option [ 116.177993][ T6238] EXT4-fs: Ignoring removed bh option [ 116.185687][ T6235] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage. [ 116.219664][ T6238] EXT4-fs (loop3): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 116.303289][ T6238] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 116.344612][ T175] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 116.410907][ T175] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.465080][ T175] usb 2-1: Product: syz [ 116.483273][ T175] usb 2-1: Manufacturer: syz [ 116.511926][ T175] usb 2-1: SerialNumber: syz [ 116.520004][ T6238] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000 ro. [ 116.539650][ T175] usb 2-1: config 0 descriptor?? [ 116.609421][ T5775] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.348050][ T6266] Bluetooth: MGMT ver 1.22 [ 117.578371][ T175] usb 2-1: unexpected transceiver, part 0x00 version 0xe2 [ 117.779178][ T175] usb 2-1: Firmware version (0.0) predates our first public release. [ 117.798368][ T175] usb 2-1: Please update to version 0.2 or newer [ 117.815532][ T175] usb 2-1: atusb_probe: initialization failed, error = -19 [ 117.839655][ T175] usb 2-1: USB disconnect, device number 3 [ 118.071504][ T6271] loop0: detected capacity change from 0 to 32768 [ 118.083209][ T6271] XFS: attr2 mount option is deprecated. [ 118.147353][ T6271] XFS (loop0): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 118.184481][ T6280] netlink: 36 bytes leftover after parsing attributes in process `syz.2.155'. [ 118.275384][ T5840] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 118.328645][ T6271] XFS (loop0): Ending clean mount [ 118.362212][ T175] XFS (loop0): Corruption warning: Metadata has LSN (1:256) ahead of current LSN (1:80). Please unmount and run xfs_repair (>= v4.3) to resolve. [ 118.419935][ T175] XFS (loop0): Metadata CRC error detected at xfs_inobt_read_verify+0x42/0xd0, xfs_finobt block 0x10 [ 118.474424][ T175] XFS (loop0): Unmount and run xfs_repair [ 118.491005][ T175] XFS (loop0): First 128 bytes of corrupted metadata buffer: [ 118.502396][ T5840] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 118.525060][ T5840] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.535265][ T175] 00000000: 46 49 42 33 00 00 00 01 ff ff ff ff ff ff ff ff FIB3............ [ 118.558598][ T5840] usb 4-1: config 0 descriptor?? [ 118.565638][ T175] 00000010: 00 00 00 00 00 00 00 10 00 00 00 01 00 00 01 00 ................ [ 118.574567][ T175] 00000020: ed 37 bf 6e 74 ea 4e 01 af ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 118.595565][ T175] 00000030: 00 00 00 00 66 dd 03 89 00 00 18 00 00 00 40 37 ....f.........@7 [ 118.607991][ T175] 00000040: ff ff ff ff ff ff fe 00 00 00 00 00 00 00 00 00 ................ [ 118.621764][ T175] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 118.631245][ T175] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 118.642645][ T175] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 118.652119][ T6271] XFS (loop0): metadata I/O error in "xfs_btree_read_buf_block+0x1df/0x2e0" at daddr 0x10 len 4 error 74 [ 118.667483][ T6271] XFS (loop0): Failed to initialize disk quotas. [ 118.795120][ T27] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 118.995169][ T27] usb 2-1: Using ep0 maxpacket: 16 [ 119.012213][ T27] usb 2-1: config 128 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.027499][ T27] usb 2-1: config 128 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 119.049303][ T27] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 119.061273][ T27] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.170322][ T5772] XFS (loop0): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 119.219101][ T175] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 119.424292][ T175] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 10 [ 119.440286][ T175] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x4 has invalid maxpacket 169, setting to 64 [ 119.453998][ T175] usb 3-1: config 0 interface 0 has no altsetting 0 [ 119.468769][ T175] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 119.483529][ T175] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 119.505048][ T175] usb 3-1: Product: syz [ 119.509340][ T175] usb 3-1: Manufacturer: syz [ 119.533195][ T175] usb 3-1: SerialNumber: syz [ 119.540036][ T27] mcp2221 0003:04D8:00DD.0004: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 119.557002][ T175] usb 3-1: config 0 descriptor?? [ 119.563190][ T6295] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 119.587265][ T175] usb 3-1: selecting invalid altsetting 0 [ 119.773819][ T175] usb 2-1: USB disconnect, device number 4 [ 119.793893][ T5840] usb 4-1: Cannot set autoneg [ 119.818269][ T5840] MOSCHIP usb-ethernet driver: probe of 4-1:0.0 failed with error -71 [ 119.865041][ T5780] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 119.882706][ T5840] usb 4-1: USB disconnect, device number 3 [ 119.929167][ C1] dummy_hcd dummy_hcd.2: timer fired with no URBs pending? [ 119.970668][ T8] usb 3-1: USB disconnect, device number 4 [ 120.092198][ T5780] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 120.103297][ T5780] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 120.113688][ T5780] usb 1-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 120.123315][ T5780] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.134731][ T5780] usb 1-1: config 0 descriptor?? [ 120.997329][ T5780] hid-led 0003:27B8:01ED.0005: hidraw0: USB HID v0.00 Device [HID 27b8:01ed] on usb-dummy_hcd.0-1/input0 [ 121.068353][ T5780] hid-led 0003:27B8:01ED.0005: ThingM blink(1) v1 initialized [ 121.078264][ T6318] netlink: 4 bytes leftover after parsing attributes in process `syz.2.170'. [ 121.123450][ T6318] veth0_macvtap: left promiscuous mode [ 121.297887][ T23] usb 1-1: USB disconnect, device number 3 [ 121.918591][ T6329] syz.2.175 uses obsolete (PF_INET,SOCK_PACKET) [ 121.940320][ T6329] syzkaller1: entered promiscuous mode [ 121.954797][ T6329] syzkaller1: entered allmulticast mode [ 122.459734][ T6343] loop0: detected capacity change from 0 to 2048 [ 122.531240][ T6343] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 122.581949][ T6343] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 122.752471][ T6334] loop1: detected capacity change from 0 to 32768 [ 122.853299][ T6334] JBD2: Ignoring recovery information on journal [ 122.924808][ T6334] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 123.540345][ T5773] ocfs2: Unmounting device (7,1) on (node local) [ 123.575319][ T8] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 123.806310][ T8] usb 4-1: Using ep0 maxpacket: 16 [ 123.838015][ T8] usb 4-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 123.862528][ T6372] loop0: detected capacity change from 0 to 512 [ 123.875426][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.896401][ T8] usb 4-1: Product: syz [ 123.905537][ T8] usb 4-1: Manufacturer: syz [ 123.914236][ T6372] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 123.966573][ T8] usb 4-1: SerialNumber: syz [ 123.987151][ T6372] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a80ec01c, mo2=0003] [ 124.003807][ T8] usb 4-1: config 0 descriptor?? [ 124.012477][ T6372] System zones: 1-2, 4-12, 8-8 [ 124.057305][ T8] usb 4-1: selecting invalid altsetting 1 [ 124.063175][ T8] technisat-usb2: could not set alternate setting to 0 [ 124.109202][ T6372] EXT4-fs error (device loop0): ext4_orphan_get:1404: inode #15: comm syz.0.191: iget: bad i_size value: 38620345925642 [ 124.185608][ T6374] kvm: user requested TSC rate below hardware speed [ 124.221857][ T6372] EXT4-fs error (device loop0): ext4_orphan_get:1409: comm syz.0.191: couldn't read orphan inode 15 (err -117) [ 124.268670][ T8] technisat-usb2: firmware version: 0.0 [ 124.278253][ T6372] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 124.291727][ T8] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 124.400227][ T28] audit: type=1804 audit(1784729366.347:5): pid=6372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.191" name="/newroot/39/file1/file1" dev="loop0" ino=18 res=1 errno=0 [ 124.424826][ T6372] EXT4-fs (loop0): shut down requested (0) [ 124.728963][ T8] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 124.779259][ T5772] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 124.799616][ T8] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2)) [ 124.821765][ T8] usb 4-1: media controller created [ 124.828242][ T8] technisat-usb2: i2c-error: out failed 53 = -22 [ 124.848742][ T8] dvb-usb: MAC address reading failed. [ 124.889984][ T8] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 124.906688][ T6362] technisat-usb2: i2c-error: out failed 00 = -22 [ 125.167134][ T8] DVB: Unable to find symbol stv090x_attach() [ 125.189058][ T8] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)' [ 125.242809][ T6387] loop1: detected capacity change from 0 to 2048 [ 125.323005][ T6387] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 125.345052][ T8] rc_core: IR keymap rc-technisat-usb2 not found [ 125.351459][ T8] Registered IR keymap rc-empty [ 125.410426][ T8] rc rc0: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 125.471683][ T8] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input5 [ 125.550420][ T8] dvb-usb: schedule remote query interval to 100 msecs. [ 125.597531][ T8] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected. [ 125.669576][ T8] usb 4-1: USB disconnect, device number 4 [ 125.709176][ T5840] dvb-usb: error -19 while querying for an remote control event. [ 125.965590][ T8] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected. [ 126.004692][ T6385] ================================================================== [ 126.012858][ T6385] BUG: KASAN: slab-use-after-free in dvb_device_open+0xc9/0x360 [ 126.020556][ T6385] Read of size 8 at addr ffff8880265aac18 by task syz.0.193/6385 [ 126.028330][ T6385] [ 126.030723][ T6385] CPU: 0 PID: 6385 Comm: syz.0.193 Not tainted syzkaller #0 [ 126.038066][ T6385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 126.048198][ T6385] Call Trace: [ 126.051535][ T6385] [ 126.054513][ T6385] dump_stack_lvl+0x18c/0x250 [ 126.059263][ T6385] ? read_lock_is_recursive+0x20/0x20 [ 126.064696][ T6385] ? show_regs_print_info+0x20/0x20 [ 126.069965][ T6385] ? load_image+0x420/0x420 [ 126.074542][ T6385] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 126.080069][ T6385] ? __virt_addr_valid+0x10c/0x380 [ 126.085245][ T6385] ? __virt_addr_valid+0x10c/0x380 [ 126.090421][ T6385] ? __virt_addr_valid+0x10c/0x380 [ 126.095596][ T6385] print_report+0xa8/0x210 [ 126.100124][ T6385] ? dvb_device_open+0xc9/0x360 [ 126.105025][ T6385] kasan_report+0x117/0x150 [ 126.109586][ T6385] ? chrdev_open+0x385/0x600 [ 126.114228][ T6385] ? dvb_device_open+0xc9/0x360 [ 126.119145][ T6385] dvb_device_open+0xc9/0x360 [ 126.123880][ T6385] chrdev_open+0x58c/0x600 [ 126.128354][ T6385] ? cd_forget+0x160/0x160 [ 126.132828][ T6385] ? fsnotify_perm+0x3ed/0x5e0 [ 126.137649][ T6385] do_dentry_open+0x880/0x14b0 [ 126.142468][ T6385] ? cd_forget+0x160/0x160 [ 126.146938][ T6385] path_openat+0x284f/0x3270 [ 126.151594][ T6385] ? do_sys_openat2+0xda/0x1d0 [ 126.156418][ T6385] ? __x64_sys_openat+0x139/0x160 [ 126.161506][ T6385] ? verify_lock_unused+0x140/0x140 [ 126.166777][ T6385] ? do_filp_open+0x430/0x430 [ 126.171514][ T6385] do_filp_open+0x1f2/0x430 [ 126.176083][ T6385] ? vfs_tmpfile+0x480/0x480 [ 126.180740][ T6385] ? _raw_spin_unlock+0x28/0x40 [ 126.185684][ T6385] ? alloc_fd+0x590/0x640 [ 126.190070][ T6385] do_sys_openat2+0x134/0x1d0 [ 126.194805][ T6385] ? do_sys_open+0xe0/0xe0 [ 126.199272][ T6385] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 126.205499][ T6385] __x64_sys_openat+0x139/0x160 [ 126.210419][ T6385] do_syscall_64+0x55/0xb0 [ 126.214908][ T6385] ? clear_bhb_loop+0x40/0x90 [ 126.219638][ T6385] ? clear_bhb_loop+0x40/0x90 [ 126.224372][ T6385] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 126.230345][ T6385] RIP: 0033:0x7f1f0ff5e6ce [ 126.234853][ T6385] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 126.254607][ T6385] RSP: 002b:00007f1f10e94b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 126.263090][ T6385] RAX: ffffffffffffffda RBX: 00007f1f10e956c0 RCX: 00007f1f0ff5e6ce [ 126.271121][ T6385] RDX: 0000000000000002 RSI: 00007f1f10e94c00 RDI: ffffffffffffff9c [ 126.279145][ T6385] RBP: 00007f1f10e94c00 R08: 0000000000000000 R09: 0000000000000000 [ 126.287155][ T6385] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 126.295156][ T6385] R13: 00007f1f10226038 R14: 00007f1f10225fa0 R15: 00007ffe33907278 [ 126.303185][ T6385] [ 126.306276][ T6385] [ 126.308629][ T6385] Allocated by task 1: [ 126.312752][ T6385] kasan_set_track+0x4e/0x70 [ 126.317390][ T6385] __kasan_kmalloc+0x8f/0xa0 [ 126.322028][ T6385] dvb_register_device+0x309/0x1df0 [ 126.327296][ T6385] dvb_register_frontend+0x62d/0x900 [ 126.332646][ T6385] vidtv_bridge_probe+0x9d6/0xf60 [ 126.337722][ T6385] platform_probe+0x13b/0x1c0 [ 126.342446][ T6385] really_probe+0x247/0xae0 [ 126.347030][ T6385] __driver_probe_device+0x1f5/0x390 [ 126.352375][ T6385] driver_probe_device+0x4f/0x420 [ 126.357454][ T6385] __driver_attach+0x444/0x6d0 [ 126.362267][ T6385] bus_for_each_dev+0x235/0x2b0 [ 126.367164][ T6385] bus_add_driver+0x340/0x630 [ 126.371889][ T6385] driver_register+0x23a/0x310 [ 126.376716][ T6385] vidtv_bridge_init+0x3d/0x70 [ 126.381580][ T6385] do_one_initcall+0x242/0x790 [ 126.386396][ T6385] do_initcall_level+0x13d/0x1f0 [ 126.391377][ T6385] do_initcalls+0x69/0xd0 [ 126.395757][ T6385] kernel_init_freeable+0x3d9/0x560 [ 126.401009][ T6385] kernel_init+0x1d/0x1c0 [ 126.405393][ T6385] ret_from_fork+0x48/0x80 [ 126.409863][ T6385] ret_from_fork_asm+0x11/0x20 [ 126.414694][ T6385] [ 126.417065][ T6385] Freed by task 6345: [ 126.421087][ T6385] kasan_set_track+0x4e/0x70 [ 126.425751][ T6385] kasan_save_free_info+0x28/0x40 [ 126.431162][ T6385] ____kasan_slab_free+0x126/0x1f0 [ 126.436322][ T6385] slab_free_freelist_hook+0x130/0x1a0 [ 126.441824][ T6385] __kmem_cache_free+0xba/0x1f0 [ 126.446734][ T6385] dvb_device_open+0x2d9/0x360 [ 126.451556][ T6385] chrdev_open+0x58c/0x600 [ 126.456018][ T6385] do_dentry_open+0x880/0x14b0 [ 126.460829][ T6385] path_openat+0x284f/0x3270 [ 126.465465][ T6385] do_filp_open+0x1f2/0x430 [ 126.470005][ T6385] do_sys_openat2+0x134/0x1d0 [ 126.474746][ T6385] __x64_sys_openat+0x139/0x160 [ 126.479647][ T6385] do_syscall_64+0x55/0xb0 [ 126.484136][ T6385] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 126.490087][ T6385] [ 126.492451][ T6385] The buggy address belongs to the object at ffff8880265aac00 [ 126.492451][ T6385] which belongs to the cache kmalloc-256 of size 256 [ 126.506582][ T6385] The buggy address is located 24 bytes inside of [ 126.506582][ T6385] freed 256-byte region [ffff8880265aac00, ffff8880265aad00) [ 126.520351][ T6385] [ 126.522707][ T6385] The buggy address belongs to the physical page: [ 126.529180][ T6385] page:ffffea0000996a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x265aa [ 126.539424][ T6385] head:ffffea0000996a80 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 126.548399][ T6385] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 126.556428][ T6385] page_type: 0xffffffff() [ 126.560822][ T6385] raw: 00fff00000000840 ffff888017c41b40 dead000000000122 0000000000000000 [ 126.569465][ T6385] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 126.578092][ T6385] page dumped because: kasan: bad access detected [ 126.584547][ T6385] page_owner tracks the page as allocated [ 126.590294][ T6385] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 19498598857, free_ts 0 [ 126.610062][ T6385] post_alloc_hook+0x1c1/0x200 [ 126.614890][ T6385] get_page_from_freelist+0x2181/0x22a0 [ 126.620481][ T6385] __alloc_pages+0x1f0/0x460 [ 126.625114][ T6385] alloc_page_interleave+0x24/0x1e0 [ 126.630355][ T6385] alloc_slab_page+0x5d/0x180 [ 126.635072][ T6385] new_slab+0x87/0x2d0 [ 126.639198][ T6385] ___slab_alloc+0xc5c/0x12f0 [ 126.643924][ T6385] __kmem_cache_alloc_node+0x11f/0x250 [ 126.649446][ T6385] kmalloc_trace+0x2a/0xe0 [ 126.653908][ T6385] bus_add_driver+0x162/0x630 [ 126.658639][ T6385] driver_register+0x23a/0x310 [ 126.663459][ T6385] usb_register_driver+0x205/0x3c0 [ 126.668619][ T6385] do_one_initcall+0x242/0x790 [ 126.673432][ T6385] do_initcall_level+0x13d/0x1f0 [ 126.678425][ T6385] do_initcalls+0x69/0xd0 [ 126.682793][ T6385] kernel_init_freeable+0x3d9/0x560 [ 126.688048][ T6385] page_owner free stack trace missing [ 126.693451][ T6385] [ 126.695805][ T6385] Memory state around the buggy address: [ 126.701472][ T6385] ffff8880265aab00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 126.709587][ T6385] ffff8880265aab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 126.717697][ T6385] >ffff8880265aac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 126.725816][ T6385] ^ [ 126.730741][ T6385] ffff8880265aac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 126.738848][ T6385] ffff8880265aad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 126.746960][ T6385] ================================================================== [ 126.762276][ T6385] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 126.769556][ T6385] CPU: 0 PID: 6385 Comm: syz.0.193 Not tainted syzkaller #0 [ 126.776890][ T6385] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 126.787030][ T6385] Call Trace: [ 126.790348][ T6385] [ 126.793322][ T6385] dump_stack_lvl+0x18c/0x250 [ 126.798070][ T6385] ? show_regs_print_info+0x20/0x20 [ 126.803336][ T6385] ? load_image+0x420/0x420 [ 126.807902][ T6385] panic+0x2ca/0x720 [ 126.811856][ T6385] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 126.818073][ T6385] ? bpf_jit_dump+0xd0/0xd0 [ 126.822631][ T6385] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 126.828672][ T6385] ? _raw_spin_unlock+0x40/0x40 [ 126.833885][ T6385] ? dvb_device_open+0xc9/0x360 [ 126.838791][ T6385] check_panic_on_warn+0x84/0xa0 [ 126.843778][ T6385] ? dvb_device_open+0xc9/0x360 [ 126.848672][ T6385] end_report+0x6f/0x130 [ 126.852972][ T6385] kasan_report+0x128/0x150 [ 126.857537][ T6385] ? chrdev_open+0x385/0x600 [ 126.862183][ T6385] ? dvb_device_open+0xc9/0x360 [ 126.867087][ T6385] dvb_device_open+0xc9/0x360 [ 126.871810][ T6385] chrdev_open+0x58c/0x600 [ 126.876283][ T6385] ? cd_forget+0x160/0x160 [ 126.880744][ T6385] ? fsnotify_perm+0x3ed/0x5e0 [ 126.885563][ T6385] do_dentry_open+0x880/0x14b0 [ 126.890381][ T6385] ? cd_forget+0x160/0x160 [ 126.894847][ T6385] path_openat+0x284f/0x3270 [ 126.899501][ T6385] ? do_sys_openat2+0xda/0x1d0 [ 126.904315][ T6385] ? __x64_sys_openat+0x139/0x160 [ 126.909393][ T6385] ? verify_lock_unused+0x140/0x140 [ 126.914628][ T6385] ? do_filp_open+0x430/0x430 [ 126.919337][ T6385] do_filp_open+0x1f2/0x430 [ 126.923926][ T6385] ? vfs_tmpfile+0x480/0x480 [ 126.928554][ T6385] ? _raw_spin_unlock+0x28/0x40 [ 126.933437][ T6385] ? alloc_fd+0x590/0x640 [ 126.937795][ T6385] do_sys_openat2+0x134/0x1d0 [ 126.942504][ T6385] ? do_sys_open+0xe0/0xe0 [ 126.946957][ T6385] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 126.953149][ T6385] __x64_sys_openat+0x139/0x160 [ 126.958039][ T6385] do_syscall_64+0x55/0xb0 [ 126.962491][ T6385] ? clear_bhb_loop+0x40/0x90 [ 126.967188][ T6385] ? clear_bhb_loop+0x40/0x90 [ 126.971885][ T6385] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 126.977810][ T6385] RIP: 0033:0x7f1f0ff5e6ce [ 126.982256][ T6385] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 127.001891][ T6385] RSP: 002b:00007f1f10e94b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 127.010363][ T6385] RAX: ffffffffffffffda RBX: 00007f1f10e956c0 RCX: 00007f1f0ff5e6ce [ 127.018362][ T6385] RDX: 0000000000000002 RSI: 00007f1f10e94c00 RDI: ffffffffffffff9c [ 127.026357][ T6385] RBP: 00007f1f10e94c00 R08: 0000000000000000 R09: 0000000000000000 [ 127.034355][ T6385] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 127.042348][ T6385] R13: 00007f1f10226038 R14: 00007f1f10225fa0 R15: 00007ffe33907278 [ 127.050353][ T6385] [ 127.053961][ T6385] Kernel Offset: disabled [ 127.058299][ T6385] Rebooting in 86400 seconds..