last executing test programs: 2m24.858706511s ago: executing program 3 (id=575): bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000", @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) symlinkat(&(0x7f0000000400)='./file1/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000e0ff00000000000000bd0000000000000000000000e4ec010000000040000000000000000000000000000000000000013da51fd47aa2e2f70000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000500)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, 0x1, 0x1, [{{0xa, 0x0, 0x0, @empty}}]}, 0x110) 2m24.717910236s ago: executing program 3 (id=577): r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x2000002, 0x13, r0, 0xfc7a3000) unshare(0x2c020400) r1 = msgget$private(0x0, 0x153) msgsnd(r1, &(0x7f0000000340)=ANY=[@ANYRES16], 0x2000, 0x0) msgrcv(r1, &(0x7f0000001080)={0x0, ""/1}, 0x2000, 0x2, 0x3000) 2m24.484180289s ago: executing program 3 (id=579): r0 = mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x0, 0x0) mq_timedsend(r0, 0x0, 0x0, 0x6, 0x0) mq_timedsend(r0, 0x0, 0x0, 0x6, 0x0) mq_timedsend(r0, 0x0, 0x0, 0x0, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') close(r0) 2m24.312044757s ago: executing program 3 (id=583): mkdirat(0xffffffffffffff9c, &(0x7f0000000a40)='./file0\x00', 0x51) syz_mount_image$fuse(0x0, &(0x7f0000000140)='./file1\x00', 0x8, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000440)={0x8}) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file4\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1/file4\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file0\x00', 0x4) 2m24.224441856s ago: executing program 3 (id=584): socket$key(0xf, 0x3, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f00000005c0)={0x0, 0x4731, 0x400, 0x3, 0x279, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x1, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x10000004, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0xb0d, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x103}}}, &(0x7f0000000300)=0x0) syz_ublk_setup_queues(r0, r6, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2, 0x20000, 0x0, r1}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8b15, 0x1, 0x0, 0x8000004, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x0, 0xfffffffd, 0x68, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2fdf, 0x800, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x40006253, 0x4000, 0x0, 0xfffffffb}}], 0x1, &(0x7f00000003c0)={0x2e, 0x4c, 0x0, r0, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r5, '\x00', {0x0, 0xdb9, 0x0, 0x0}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1a, 0x3, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x4}, 0x94) 2m23.871947892s ago: executing program 3 (id=590): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'bridge_slave_1\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000000)={@mcast2, r2}, 0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x2000, {0x0, 0x0, 0x74, r2, {0xfffd, 0x10}, {0x1, 0xfff1}, {0xfff2, 0xa}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x14004804}, 0x4000860) close_range(r0, 0xffffffffffffffff, 0x0) 2m23.553457795s ago: executing program 32 (id=590): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'bridge_slave_1\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000000)={@mcast2, r2}, 0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x2000, {0x0, 0x0, 0x74, r2, {0xfffd, 0x10}, {0x1, 0xfff1}, {0xfff2, 0xa}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x14004804}, 0x4000860) close_range(r0, 0xffffffffffffffff, 0x0) 2m4.941618668s ago: executing program 4 (id=750): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, r0) setpgid(0x0, r0) tkill(r0, 0x7) wait4(r0, 0x0, 0x0, 0x0) ioprio_set$pid(0x1, r0, 0x6000) 2m4.463408208s ago: executing program 4 (id=755): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000100)={0x20, 0x90069109b15ef6c8, 0x1e, "4d61501d0100000000000000100000000000800700000000000038040000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="403f0100000080"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="200f14"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m1.870388073s ago: executing program 4 (id=786): syz_usb_connect$rtl8150(0x5, 0x0, 0x0, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000100), 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000140), 0x0, 0x0) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000180)={0x0, 0xffffffffffffff36, &(0x7f00000001c0)="952bb3e006ae9a4c3a"}) syz_usb_disconnect(r0) ioctl$EVIOCGID(r1, 0x80084502, 0x0) 2m0.389082605s ago: executing program 4 (id=801): syz_mount_image$udf(&(0x7f0000000f00), &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f0000001500)=ANY=[@ANYBLOB="73686f727461642c756e64656c6574652c73657373696f6e3d30303030000800003030303030303030303139302c6d6f64653d30303030303030303030303030303030303030303030352c726f6f746469723d30303030303030303030303030303030303030352c646d6f64653d30303030303030303030303030303030303030303030362c696f636861727365743d6370313235312c696f636861727365743d6b6f69382d722c6e6f7672732c0084f5b23d82aacbefd1de1daab7394a9b4696461da9ab46f2d71c895d8c", @ANYRESOCT], 0x9, 0xc41, &(0x7f0000001b80)="$eJzs3U9sHNd9B/DfG5Hi0m4rxnYUJ42LTVuksmK5+hdTsQp3VdNsA8gyEYq5BeCKpNSFKZIgqUY20oLupYceAhRFDzkRaI0CKRoYTRH0yLQukFx8KHLqiWhhIyh6YIsAOQUMZvatuKRJmzb/iLI+H5v67s68N/PezHJGIvjmBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ8QcvXTl7Lt3vVgAAh+na6NfOnnf/B4CHynX//gcAAAAAAAAAAAAAgKMuRRGPR4q5a2tpvHrfVrva6r1zd2xoePtq/amqeawqX37Vzp2/cPHLzw1e6uTV1swH1N9vn4tXRq9fqb84e3tufmphYWqyPjbTmpidnNr1FvZaf6vT1QGo3371zuTNmwv1889e2LT67sB7fY+eHLg8+PSZpzplx4aGh0c3itS6y/d87Ia07TTC43gUcSZSPPO9n6ZmRBSx92NRO9xzv1V/1YnTVSfGhoarjky3mjOL5cqRzoEoIupdlRqdY7T9uYie3kPtw84aEUtl88sGny67NzrXnG/emJ6qjzTnF1uLrdmZkdRubdmfehRxKUUsR8Rq3/s31xtF9ESK75xYSzci4ljnOHypGhi8czuKA+zjLpTtrPdGLBcPwDk7wvqiiJcjxc/ePhUT+TpTXWu+GPFymT+IeLPMFyJS+cG4GPHuNp8jHkw9UcRfluf/8lqarK4HnevK1a/Xvzpzc7arbOe68hHvD++7Utyn+0P/ljwcR/zaVIsimtUVfy19/L/sAAAAAAAAAAAAAAAAALDf+qOIz0aKl/7jT6pxxVGNSz9xefAPB361e8z4kx+ynbLssxGxVOxuTO7xPDBwJI2kdJ/HEj/MalHEn+bxf2/c78YAAAAAAAAAAAAAAAAAAAA81Ir4SaR4/p1TaTm65xRvzdyqX2/emG7PCtuZ+7czZ/r6+vp6PbWzkXM851LO5ZwrOVdzRpHr52zkHM+5lHM550rO1ZxxLNfP2cg5nnMp53LOlZyrOaMn18/ZyDmecynncs6VnKs544jM3QsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8ElSRBG/iBTf/uZaihQRjYjxaOdK3/1uHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQ6ktFfD9S1P+ocW9ZT0Sk6v+2U+UfF6NxvMzHojFY5gvRuJKzWWVP44370H72pjcV8eNI0Vd7K1JPe1k+/73td/c+BvHmtzbefS6XPdZZOfBe36MnT1weHP6NJ3d6nbZrwOmrrZk7d+tjQ8PDo12Le/LeH+taNpD3W+xT34lYeO31V5vT01PzH/9F+RHYQ/UH6EX5DXIEmuHFYb2IniPRjPvTdx4C5f3/3Ujxu+/8Z+eG377/1+JX2u/u3eHj53+2cf9/fuuGdnn/79laL9//y3v6dvf/x7uWPZ//NtLbE1FbvD3XezKitvDa62dat5u3pm5NzVw8e/Yrg4NfuXC293hE7WZreqrr1b4cLgAAAAAAAAAAAAAAAIDDk4r4/UjR/PFaqkfE3Wq81sDlwafPPHUsjlXjrTaN235l9PqV+ouzt+fmpxYWpibrYzOtidnJqd3urlYN9xobGj6Qznyo/gNuf3/txdm51+Zbt/54cdv1j9Su3FhYnG9ObL86+qOIaHQvOV01eGxouGr0dKs5U1Ud2XYw/UfXm4r4r0gxcbGevpCX5fH/W0f4bxr/v7R1Qwc0/v9TXcvKfaZUxM8jxe/81ZPxhaqdj8T7jlku93eR4vSlz+dycbws12nDY9VDBNojA8uy/xcp/ukXm8t2xkO2xyBWZc/t/sg+GMrzfyJSfP8vvhu/mZdtfv7D9uf/ka0bOqDz/0TXskc2Pa9gz10nn/8zkeKFx9+K38rLPuj5H51nb5zKhe89n+OAzv+nu5YN5P3+9v50HQAAAAAAAAAA4IHWm4r4+0jxw+Ge9Fxetpvf/5vcuqED+v2vz3Qtm9yf+Yo+9MWeDyoAAAAAHBG9qYifRIpbi2/dG0O9efx31/jP39sY/zmUtqytfs73a9VzA/bz53/dBvJ+x/febQAAAAAAAAAAAAAAAAAAADhSUiriuTyf+ng1nn9yx/nUVyLFS//zTC6XTpblOvPAD1R/1q7Nzpy5Mj09O9FcbN6YnqqPzjUnpsq6T0SKtb/9fK5bVPOrd+abb8/xvjEX+3ykGP6HTtn2XOyducmf2Ch7riz7qUjx3/+Yy66vV2U781h/eqPs+bLs30SKb/zL5u12yp7cKHuhLPvdSPGjb9Q7ZR8py3aej/qZjbLPTswWB3BWAAAAAAAAAAAAAAAAAAAAeNj0piL+PFL87+3le2P58/z/vV1vK29+q2u+/y3uVvP8D1Tz/+/0+uPM/189V2Bpp70CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAnU4oiXo8Uc9fW0kpf+b6tdrU1c+fu2NDw9tX6U1XzWFW+/KqdO3/h4pefG7zUyQ+uv98+G6+MXr9Sf3H29tz81MLC1GR9bKY1MTs5test7LX+VqerA1C//eqdyZs3F+rnn72wafXdgff6Hj05cHnw6TNPdcqODQ0Pj3aV6en9qDt9Y8c1aYflx6OIv44Uz3zvp+mHfRFF7P1YbPvZ6dt9L/aov+rE6aoTY0PDVUemW82ZxXLlSOdAFBH1rkqNzjHat3NxQBoRS2XzywafLrs3Otecb96YnqqPNOcXW4ut2ZmR1G5t2Z96FHEpRSxHxOo256A3ing1UnznxFr6176IY53j8KVro187e37ndhQH2MddKNtZ741YLh6Ac3aE9UUR/xwpfvb2qfi3voieaH/FFyNeLvMHEW9G+3yn8oNxMeLdw/te5oD1RBH/X57/y2vp7b7yetC5rlz9ev2rMzdnu8p2risHcn84PP2Hurcjfm2qRRE/qq74a+nffV8DAAAAAAAAAAAAAAAAHCFF/HqkeP6dU6kaH3xvTHFr5lb9evPGdHtYX2fsX2fM9Pr6+no9tbORczznUs7lnCs5V3NGkevnbJRZW18fz++Xci7nXMm5mjOO5fo5GznHcy7lXM65knM1Z/Tk+jkbOcdzLuVczrmSczVnHJGxewAAAAAAAAAAAAAAAAAAwCdLUf2X4tvfXEvrfe35pcejnSvmA/3E+2UAAAD//xtt+zc=") creat(&(0x7f0000000e80)='./bus\x00', 0x44) mount(&(0x7f0000000ec0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000f40)='./bus\x00', 0x0, 0x321001, 0x0) r0 = open(&(0x7f0000000f80)='./bus\x00', 0x64842, 0x5a) pwritev2(r0, &(0x7f0000001080)=[{&(0x7f00000010c0)="85", 0x78c00}], 0x1, 0x7a00, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./proc\x00', 0x1ff) 1m59.624585433s ago: executing program 4 (id=802): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x50, 0x0, 0x0) r3 = eventfd(0x1) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000280)={0x2, 0x9000, 0x4, r3}) 1m59.205075946s ago: executing program 4 (id=807): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000880)={0x1, &(0x7f00000008c0)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000240)={0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="2014120000003219fad1a560da0781c2106a5bd2cb999f", @ANYRES16=r1], 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) 1m58.937083873s ago: executing program 33 (id=807): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000880)={0x1, &(0x7f00000008c0)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000240)={0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="2014120000003219fad1a560da0781c2106a5bd2cb999f", @ANYRES16=r1], 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) 1m46.635197292s ago: executing program 5 (id=896): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000100)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000180)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000200)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000280)={&(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x1, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000380)={0x0, 0x1, &(0x7f0000000400)=[r2], &(0x7f0000000440)=[0x1], &(0x7f0000000480)=[r3], &(0x7f00000004c0), 0x0, 0xffffffffffffffff}) 1m46.377735028s ago: executing program 5 (id=900): r0 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000180)=0x6, 0x4) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f0000000140)=0x400030, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000380)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) 1m46.115014535s ago: executing program 5 (id=902): r0 = syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1000040, &(0x7f0000000640)={[{@barrier}, {@nodioread_nolock}, {@noquota}, {@jqfmt_vfsv1}, {@auto_da_alloc}, {@nodioread_nolock}, {@bh}]}, 0xfe, 0x59c, &(0x7f0000000d00)="$eJzs3U9oHGUbAPBnZrNN/+T70g++Dz6lh6JChdJN0j9aPbVXsVDoQfCiYbMNJZtsySbahIDpvYg9iEov9aYHj4oHD+LFo1cvimeh2KDQ9KArm51N03S3bmI2W7O/H0z2fWdm93nfmX3e7AwzTAB962j9TxrxVERcTCKGNywbiGzh0cZ6qytLxfsrS8UkarVLvySRRMS9laVic/0kez0UEcsR8f+I+CYfcTxd/8h9zUJ1YXFqvFwuzWb1kbnpqyPVhcUTV6bHJ0uTpZlTL7505uzpM2MnxzY2935tYy2/tb7e+PHmuze+e+X2zU8/O7JcfH88iXMxlC3b2I+d1Ngm+Ti3af7pbgTroaTXDWBbclme11PpfzEcuSzrW6ltHBwGd6V5QBfVBiNq6zYUgT6QSHroU83fAfXj3+a0m78/7pxvHIDU466uLBXfiWb8gca5idi/dmxy8NfkoSOT+vHm4d1sKHvS8vWIGB0YePT7n2Tfv+0b3YkG0lVfn2/sqEf3f7o+/kSL8Weoee70b2qOf6vZ+LfaIn6uzfh3scMYv7/+00dt418fjKdbxk/W4yct4qcR8WaH8W+99uXZdstqH0cci9bxm5LHnx8euXylXBpt/G0Z46tjR15u3/+Ig23iN87Z7l9ryMb+78valHbY/y++/fyZ5cfEf/7Zx+//Vtv/QES812H8/9z75NV2y+5cT+7WfwVsdf8nkY/bHcZ/4dzRH7Kis4YAAAAAAAAAALCD0rVr2ZK0sF5O00KhcQ/vf+NgWq5U545frszPTDSueTsc+bR5pdVwo57U62PZ9bjN+slN9VO5LGDuwFq9UKyUJ3rcdwAAAAAAAAAAAAAAAAAAAHhSHNp0//9vubX7/zc/rhrYq9o/8hvY6+Q/9K+H8z/pWTuA3ef/P/StmvyH/iX/oX/Jf+hf8h/6l/yH/iX/oX/JfwAAAAAAAAAAAAAAAAAAAAAAAAAA6IqLFy7Up9r9laVivT4xsDA/VXnrxESpOlWYni8WipXZq4XJSmWyXCoUK9N/9XlJpXJ1NGbmr43MlapzI9WFxTemK/MzzWeKlvJd7xEAAAAAAAAAAAAAAAAAAAD88wytTUlaiMg36mlaKET8KyIOJ5FcvlIujUbEvyPi+1x+sF4f63WjAQAAAAAAAAAAAAAAAAAAYI+pLixOjZfLpdnuFQayUF0M0XlhYCsrR8Tyzjaj/olbflc+24A93nR7o5B7Mr6HT36hh4MSAAAAAAAAAAAAAAAAAAD0qQc3/Xb6jj+62yAAAAAAAAAAAAAAAAAAAADoS+nPSUTUp2PDzw1tXrovWc2tvUbE27cufXBtfG5udqw+/+76/LkPs/kne9F+oFPNPE0jop7HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAPVhcWp8XK5NLvNwmAH6/S6jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADb8WcAAAD//y4WzlE=") r1 = openat(r0, &(0x7f0000000c80)='./file1\x00', 0x101042, 0x94) pwrite64(r1, &(0x7f0000000cc0)='2', 0xfdef, 0xc00) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x2, 0x28011, r1, 0x0) write$P9_RLERRORu(r1, &(0x7f0000000740)={0x14, 0x7, 0x2, {{0x7, 'noquota'}}}, 0x14) ftruncate(r1, 0x3) 1m44.953165824s ago: executing program 5 (id=914): mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x20000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) 1m44.648167345s ago: executing program 5 (id=917): syz_mount_image$btrfs(&(0x7f00000002c0), &(0x7f0000000300)='./file0\x00', 0x0, &(0x7f0000000340)={[{@compress_algo={'compress', 0x3d, 'zstd'}}]}, 0x5, 0x559a, &(0x7f00000088c0)="$eJzs3X2QVWUdB/Bzd1lYZGI3BMGBFShfQEIhpVRS7kBBuDJtkjU2GQtioaAwzBI1ii04WLgam1kz5QxCiwjDUmszGmXlygyQk9PWjIPIgjLThjG9SMXEFjU2e+99Lveey+5eyVxfPh9m99zn/s7znOeeOX/c72WfcyMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIoujgjtr/rB1ZV75+06hFt199cPSq0RNWVDWdHHWg+rzdl/absWjovuntdw6b0bH6SPX65tsu6IyiRKpfItN/3vSPX/+FufPmlIcBaz+Z3lZWdnfIdNfD6Ub/vCe7+uX/zI+iqCw2QGlmu7s0p52IHyBaXjhgj8pmbVsycEGyduvmp+ouX7J1XOFLp0t5X0+gr2Suq45T11Iy9bsktke2nXPpJfIu0XT/+AX3prwIAOB1mVST2mTfjmbe4mbb9fF6rJ2MtRtj7fAOoTG3cSbS4/bvbp5j4vU+mmcyHRUGdDvPWD1z/rPtmnj/WDsWNV7HPPN3zUSa8u7muSxW76t5AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALyVvFa3Ys34z714sOyX549bvfLk4WvLL3zoq/8uWXrzS68dqlnzl7ah+6a33zlsRsfqI9Xrm2+7oDOKKlP9EunuiWknXr1kYvWcUeuf+N7ETc+OP16aGTds++XsHO0PD66siKIFOZWOMOzRwVFUk19INaPvFhZuTT2YHQoAAAC8k5yb+l2SbafjYFleO5FKk4nUvyAdFstmbVsycEGyduvmp+ouX7J13JmPV9PNeMnTjpdtV576SeQE4xB/4+OdqoddlxeM07P4iPE8P+X5l1+oGHHtT5+pOu+mlde/NPKax9tmfnP48UX7K+8YtGrc2CsK8n9lz/k/nDn5HwAAgP+F/B8fp2e95f/PzK+75Y5HvnJszD2HVw66+8H9G4eVH7nplsn7/jj8hosvvqz2xoL8PybvkAX5P8w45P+S6MzyPwAAALyV/b/zf7JgnJ71lv/bhzff/MB7Di2sbOt4evtlK/b0X3j1RUMOPHTR3In3XjdozPkNBfl/UnH5v1/utMOTz4UJL66IoknFn1QAAAAgT/h/91MfLYS8nv7kIJ7XW+dtGd3y6swvTxj78KH6P1Vtnvj5jUMe37lh5jd2PXf3/RPbzi7I/8ni8n/Zm/NyAQAAgCI0HTpnxNBPJ38e3X/01vnf/+yuR+9b+sWrLtnbOWvC2l9UP72jviD/1xSX/wf0zcsBAAAATuPE+GsW/mPnkd9e1/yJ+5qO/v5Lq0p/NaNp9/62hqZ/bh81e/XkgvxfW1z+Pyuzzax8SHfaE/4K4VsVUVTe9WBZurA3apyWLQAAAABvkJDT75ryfMm9A6edu2Xub06Me+KFPZ/aN3vxhnPWTGp69n2tiz9y4WMF+X9Zz/f/D3c6COv/8+7/V7D+P6eQvuvfVDcGAAAA4N2ocD1/uD1++psLuvv+/WLX///w6xv+mqiqf/ID8342q/P9zT/Z2zr1wZNVf5hz/OGW5MgnL32xIP/XF5f/S3O3b+T3/wEAAMAZeLt9/9+NBeP0rLf7/7c980j1o1d+6GtXza2buuN3H77iz68Mn9qwPXpl+UfbFx342K5fF+T/xuLyf9gOyn15reH83FMRRSO6HmTuJrgtTHdxrNBSllNIn/hYj7mhR6bQMiCnkLIs1uODFVE0tutBfazw3lBojBWODc4UNsYKbaGQuR6yhR/ECq3hSvvO4Mx044Ufh0JmgUVLWEExKLskItbj79316Cqctkd79uAAAADvKiE8Z7JsWX4zikfZlkRvO5zV2w4lve1Q2tsO/WI7xHfs7vmoNr8Qnv/Rt294ecBdD2yom7Jl04KqhrPX/euxyZNuX7Z2Z93SziF/W7euIP9vLC7/h1PRP73pbv1/FNb/Z77XMLv+vzYUKmOFllCoid8xoCYcIx12G8IxKmsyPY6NyBYAAADgHS18LlDax/MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/7J373FW1nXiwL8zzIUZhplRMS+RISaKwTCMKYaZID/TnwQOq6WFJgSDjgxCXEzQTUTd1VzB2+ZtE0jdtIwoNbVUeGnekspLsKl5SfHSK41lS5Js133NnPM9nPOcOc5BQBn3/f5jzvecz/f6nMuc7/M85/sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/N2z85GVfeHmfj/xg3cKBi1eP+krfI4cMn3DMNTceu/jhb0/e777f//8+aw575sydR60955XRi245de+3QmjuKFeSKl5y6F/XNQwePabvotuvGbz0kYF/qUjXm46HXu1/StN3zoutru0dwh0lIZQlA4NrUoHy9P2aWF/fmhB2CJsCmRIt1akSyYbDA1UhLAmbApmq7qoKoSYrcOwT9624uD1xRVUIe4cQKpNtPFuZaqMqGRhQkQpUJwPTy1KBv76TkgncWZoKwBaLb4bMi355c26G+s7LFXj9lW+1jn2wksPrERP1hfO9MXIbdypLRfKB5i162vKqY5vIe3us9G7rBu+2vO18iact+4tU+hvKO5tClaF0csuUiXPaZsdHSkNDQ49CNW2j5/np9WdN2px0t3kdxg7Ub5XX4aoLe49d/OhRw2+tG35Dn0ELN25pNwtt3m2tMqRfc93meYxG+DzpBm+/vG9J/XzpCiHsf9v42798wcs3L7h87K4HPbHTsDc+u/vdLT+75YTxxx++fsVXf//jvPl//bvP/+PLOd6W5uSOrb5dm5qbx0dqYmJdbWpuDgAAAN1Gd9hr+srq/5722X3HDX185OrqW2+659SL7/v8tT9r3a/t4bE77fj8vvN+lDf/71fc8f94yL8me7QrQxjRkTi3LoRdOx5PBW6O3flqXQh7dqSacwMjE4GVIezWkRiYqSpRomcs0S8ReLU2HRiRCDwYA82JwI0xcEkicF4MLE8EJsXAykTgsBgIrbnj2K82PY6iA1UxMCG1EZfHsxD+XBtbS2yrZzJVAQAAbCXp2WF57t2scx22NEOcXi6v6ipDPAO7YIbKRA3JGWxmWlWwhrKuaijtqobMuOe/+/Dzai7pqua80zBKcjNcWXXLpT8aNumNu2e8tOG0Iz7x2quP1S/96afXXfPGU9Mr79/j8ofz5v+N7z7/r+ykIyV5x/9DGNfxN+YuTUfaMvEJzTkZAAAAgC3w1sADvvydsq/NfeH3jwz75K+vfez1lQ9/dO8zb1v7/Bk/+NZ3au4fnTf/H1Hc+f9xn0iPrMxhVdwNMbUuhMbcQKrag/MDqaPevdIBAAAA6A4yx+Mzx8Jb07epU7ST8+n8/M2bmT8e+B/Raf7131p2/Y6feGT2Q7W3zXhqw+NfWTl64bEz3xh05dmP7HvoQU+N/Gze/L+5uPP/q3NvU514MPbi8roQemYFHoq9bA906BcDLxyaG0iP/8G4AS6KVaVPTMhUdVEsMSEGGhOBJYVKPJYpsWtuIP1kZRo/NzOO1nSJrAAAAAC87+LugHhcPp7/v2LBXZf9x41/umzVgUtnnzz98de+V1H5zknL7zyxzwX39li008hJefP/CZt3/n/HPDjv9P62XiEMKQuhR/KHAauqUwsDxkBNSTpxT3Wqrh7JqhZUh3Bw+8CSVb2YXv+/LLnG4JNVqapiYNf+N60f0J64oSqEIdmBNeOXHtCemJMIZBr/YlUIH28fbbLxn/RMNV6ebPyqniHskRXIVDWpZwjtjVUkq7q/Mn0dg2RVyytD2CkrkKlqWGUIcwMA3VX8Xzo5+8FZc+dNndjW1jJzGybiTvyqMKW1raVh0vS2yZUF+jQ50eecdYzOyR9TsZe++V16jaLVx0ytKyad+aFgY3Zb6R35eWcOpu/HL0PlHeNsKs+5u39yyPvuld9EyPoqVWjIpdt4yNXZlWx6EvPqj/krQq/Qc86slpkNZ0ycPXvm0NTfYrM3pf7G40ypbTU0ua2qO+tbES+PgstlJbzXbTUgu5Ihs6fNGDJr7rzBrdMmntxycstpwz7VNKxp6P5NjUPaB5X+28VIB3RWc2Kk7ywtclhbcaS7l2VV8n58aEhISHS3xE2Xj39m0UcXV3538UmXPHH++WefcvrOt1057ft9p48fdOXnlkz9et78f8a7z//jp0784E+vz1Do+H99PMyfenzTYf4JMbCk2OP/9YWO5mdODOiXCMyPgfkO8wMAAPDhEHdHxr2Zcad07SvfOP1/Tjii9NA/HP2LpqGDdrnw1qkDbnx94+kf23vekmvLKvKv/ze/uN//b6X1/zNL1x9VaJn/gbFEY6H1/5PL/GfW/59faP3/5DL/mfX/l3wA6//PyQQSm+TP1v8HAAA+DN6/9f+7XN4/eYGAvAxdLu+fvEBAXoYul/Ev9gIBm73+/89/XrbDx47YrW/ZF56YuNedB/7mpGkP7vKjUVev+3RT/TfPWPPzZXnz/0uKm/9buB8AAAC2Hyfs+6UBC14a8vVzpj/ww8Ezdn7purOfH3HPL4/75MYxfddVr+v76bz5/5Li5v/v//p/odD5//0KBZoLLQxo/T8AAAC6qULr//3t42d987p+O24Y1O/M29+6emrJ8L2fO/XXbRc9NOrwj435xyWTrs2b/y8vbv4fT7sozckde/N2bWpNu5Bc025dbeYnAwAAANA9lIaGhvIi8+YsjDryvbf5dHop0HdLZ9vtE6vWnHvvdX8fcvP5C9Ydf3rtQUf+oeyQOydf99KCU/boX/Pc2rz5/8ri5v85v8tYdWHvsYsfPWr427fWDb+hz6CFGzcd/wcAAAC2nWL3SwAAAAAAAAAAAAAAAB+8Y1b95Kz/+uWY4+4cNu/qR3d+/OT//PqsM1on/aLtiHUHPLv0hk/tk/f7/zCuo1yh3//H6/7F3xf0yckdW+16/b/0/WNHL5vbsWThqtoQ9soOTF0wdYeQvjb/PtmBFScO3KU9sSBZ4u7nDnu5PXFSMnDk4B03tCc+kwhMiIsk7pYMxKsqbuidCMTlFZ9MBuL2WJ4MVKQDF/ZOjaMkua3+UJPaViXJbfV0TQh1WYHMtrqjJtVGSXKAVyQCmQF+LRmIAxybDpQme7WsV6pXMVATiy7uleoVAADbrfgtsDxMaW1raYxf4ePt7mW5t1HOkmXn5FdbUmTzv0svTbb6mKl1xaR7JL+LbrrWeHmobB/C0Lyvq9lZSjpGuXVq6WLT9Skw5K5WeystUC5pczddReERVaVG1DBpetvk8i4Hvn/XWZrKuswyNG+yk52ltGOTFlFLEX0pYkRFbpsiuhzvl4aGhh6JXMNjsD7k6OoVUezv9bPX+Sv0KsjOs3zUQQOOW/bcgRMWPXnQtKnhI5e9M2Li5FmHXPHiU0vnjxw0oUfe/L++uPl/Zfa4NqQvBjA/Xlnv4LoQJhQ5IgAAAPjwO+W05y674P5LX32hecDL04dcuuK3c6+aV1Z783mHP3336W+OX3jSlsYHDHtj6Kl3/ebcjU2jHrqy99X3X7PTkXU//H/Vvea+tWLQmy/cvVfe/L9fcfP/uAcrfSg4tbdjZbz+/7l1IXRcWr8+Fbg5DverdSHs2ZFqjiVSF9Q/KpZoTAVujjtMBsYSE5pzq+oZA8sTgVdr04GVicCDMZDeS3FTSO/KubQ2hAM6UuNyS8yIJeoTgaNjoF8i0BADjYlA7xgYkQi83jsdaE4EHo2B0Jq7rW7tnd5WAAAAmyM9zyrPvRuS87zlZV1lKOkqQ3VXGUq7ylDZVYZCo4j3fxwzlCdOXinJylSerLUqUUtehngx/M3uV16G8FhuzmTBvKbj+QeZ8w1KcjNccWbF9Dc/33/R8UPGrB/ftPhzc38a/uHtOW9d8OYvz6977pqNJXnz/8bi5v/Vubep1h+M8/9N1/9LBR6K3bs8njreLwZeODQ3kN4x8GCc7F6Uqao5XSI9ab8olhgRA/0SgRkxMCIRmDAuHViyS24gPdPONH5upvHWdImsAAAAALzv4g6CuJsmzv+fXTv+iWnjf3vQZX1nLzx/+VFffvrXx736i3t73v3d/osebitZuzpv/j+iuPl/bK9XdmPnxd6s7R3CHSWbepMJDK5JBeJ+jJr48/i+NSHskLWDI1OipTpVoiLRcHigKvUL9YpkVXdVpdYYiPePfeK+FRe3J66oCmHvrL0vmTaerUy1UZUMDKhIBaqTgellqUDc85MJ3FmaCsAWy+wVjC+o9KkuGfWdlyvw+vuwXBM0Oby8faCd5OvsN1fbSmXygfQ+1YzNe9ryqmObyHt7rPRu647vtnrvtuwvUulvKO9sClWG0sktUybOaZsdH8n+JWuebfQ8Z/9KtZj0Vngdzn/vve1aZbIDjYmPj8bOy3X+OiyJ1a26sPfYxY8eNfzWuuE39Bm0cGPR3Sgg/lB45rCr6rM377ZWGdKvuW73edLs86Q7/hvo52kLIYy7d+xFjYfcuHDSiP7X73xH7fDLvzT4lkMbnx1XM2eXw8e89sV5efP/5uLm/2WJ2w4b48acVRfCvlkbd1Xc/KPqUp+DWYHUp+RO+YHUIfeXagt+cgIAAMDWltndkdlf0Jq+TZ0Qnpwn5+dv3sz8cX/FiE7zF9vv/lecsnL0hAN/23f8XoccvM9Zdy04er+/Tbz+tT9Wj5z0wPd+tfr6vPn/hHef//dMdNPxf8f/2UYc/+/U9r4rumfygflbtCs6rzq2Ccf/O7W9v9sc/++U4/+O/3fG8f8uOP7fqe39acv7ljTDl64Qwr9f/vm/vX3Pbv02LC393pQH5vU//rLvL1r2k52f+efH/mn69H33/FXe/H9GcfN/6/91vmhfZv2/CYXW/5tRaP2/+db/AwAAtqkCC80l53l5q/flZUiu3peXocsFArtcYtD6f5u9/t+L/3Lpgr2mjv3GiWc9dnDvR+tHrRkz6O8nvbrnmuuevHLoIyf8/dt58//5xc3/48uhV3br3WX9v37jClR1SQzMsDAgAAAA26NCOwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4YJ31xynnjVjw+J+ap39l/fLx32nd8fGHprzefMQPRy87es0pu5xyb581hz1z5s6j1p7zyuhFt5y691shtHaUK0kVLzn0r+saBo8e03fR7dcMXvrIwL9UpustT99+NCd3bPXt2hCWZD1SExPratvvbAocO3rZ3LL2xKraEPbKDkxdMHWH9sSNtSHskx1YceLAXdoTC5Il7n7usJfbEyclA0cO3nFDe+Iz6UBJsrv/1jvV3ZJkdy/uHUJdViDT3VN751aVaeOIdKA02cZ3a1JtxEBNLHpVTaqNGGiLJVp7hjCkLIQeyaoeqUxV1SNZ1U8rU1X1SFZ1dmUIB4cQypJVPV+RqqosOfLHKlJVxcCu/W9aP6A9sbQihCHZgTXjlx7QnpiZCGQaP6YihI+3v2SSjd9anmq8PNn4v5aHsEcIoSJZ4s2yVImKZIkXy0LYKSuwaSOWhTA38OEQP30mZz84a+68qRPb2lpmbsNERbqtqjClta2lYdL0tsmViT4VUpKVfuec9z72360/a1L77epjptYVky5Llyvv6HJTec7d/bf33sd+VWdXsun5yKs/5q8IvULPObNaZjacMXH27JlDU3+Lzd6U+tsjHU1tq6HdZVsNyK5kyOxpM4bMmjtvcOu0iSe3nNxy2rBPNQ1rGrp/U+OQ9kGl/26NkS59/0e6e1lWJe/H+19CQqK7JUpzPt0at/fP8bwv+ps6Wh4qOz6g86YV2VlKOka5NQY98j2O+L18TelyREPzJg55WZq6zrJ/3mRiU5aqVJaOr3V5k8Psmko7Nmm8XxoaGnoU2g71uXezN+8bW7B5n05vumLTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwv+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwLAAAAAAgzN86jJ4NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAD//+GI8JI=") r0 = openat(0xffffffffffffff9c, &(0x7f000000de80)='./file1\x00', 0x2, 0x0) fallocate(r0, 0x10, 0x0, 0x90003) r1 = openat(0xffffffffffffff9c, &(0x7f000000dec0)='./file1\x00', 0x1, 0x100) write$P9_RSTATu(r0, &(0x7f000000ff40)=ANY=[], 0x54) lseek(r1, 0x3c, 0x4) 1m44.196438191s ago: executing program 5 (id=925): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x2040, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000240)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0xc, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file0/file1\x00', 0x20400, 0x20) lseek(r0, 0xfffffffffffffff9, 0x0) 1m43.702130842s ago: executing program 34 (id=925): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x2040, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000240)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0xc, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file0/file1\x00', 0x20400, 0x20) lseek(r0, 0xfffffffffffffff9, 0x0) 21.542835306s ago: executing program 7 (id=1823): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000440)="cb56b6cc04f01f56bb6e284f5fab5c66", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x48844) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000007c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20000010}, 0x44000) 21.388828642s ago: executing program 7 (id=1825): munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f000000d040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, 0x0, 0x8de13c6b70ae92c3, 0x41003, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4050) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x40085507, &(0x7f00000000c0)=0x18) 21.139326258s ago: executing program 1 (id=1829): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x2, 0x440800) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f0000000280)) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000000000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r2, 0x8100, 0xe, 0x0, &(0x7f00000002c0)="c8e8a1aee95e10e19e00399da26f", 0x0, 0xadf0, 0x21, 0x0, 0x0, 0x0, 0x0}, 0x50) 20.963989126s ago: executing program 1 (id=1831): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000000c00000009"], 0x50) socket$inet_tcp(0x2, 0x1, 0x0) mkdir(&(0x7f0000001700)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001700)='./sys\x00', &(0x7f0000001800)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001c00)='./sys/devices/platform/vhci_hcd.0/attach\x00', 0x1, 0x0) write(r0, &(0x7f0000001d00)='0 4 0 2', 0x7) 20.653516437s ago: executing program 1 (id=1833): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) read(r1, &(0x7f0000000140)=""/87, 0x57) 20.513405482s ago: executing program 7 (id=1836): io_cancel(0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) r0 = add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x0, 0x0, 0x0, 0x34]}, &(0x7f00000000c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00"}, 0x48, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r1, 0x5761, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000000000001"]) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0x0) add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x0, 0x36, 0x36, 0x0, 0x0, 0x64]}, &(0x7f00000004c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00", 0xfffffffc}, 0x48, 0xfffffffffffffffe) 20.443604369s ago: executing program 1 (id=1838): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x0) 20.307875913s ago: executing program 7 (id=1841): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x101, 0x800, 0x103, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000001, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e4, 0x4, 0xfffffffe, 0x146, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90e, 0x0, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8dd0, 0x0, 0x2, 0x36b}}], 0x1, &(0x7f0000000340)={0x2e, 0x6, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x2, {}, 0x1f, 0x0, '\x00', {0x2, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x2, 0x0, 0x0, &(0x7f00000002c0)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 20.263477647s ago: executing program 1 (id=1842): mkdirat(0xffffffffffffff9c, &(0x7f0000000c80)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000cc0)='./file0\x00', &(0x7f0000000d00)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000d40)='./file0\x00', &(0x7f0000000d80), 0x0, &(0x7f0000000dc0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000001b40)='./file0\x00') llistxattr(&(0x7f0000000340)='./dev\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) 19.951369049s ago: executing program 1 (id=1847): munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f000000d040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, 0x0, 0x8de13c6b70ae92c3, 0x41003, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4050) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x40085507, &(0x7f00000000c0)=0x18) 19.088348557s ago: executing program 7 (id=1859): mkdirat(0xffffffffffffff9c, &(0x7f0000000c80)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000cc0)='./file0\x00', &(0x7f0000000d00)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000d40)='./file0\x00', &(0x7f0000000d80), 0x0, &(0x7f0000000dc0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chdir(&(0x7f0000001b40)='./file0\x00') llistxattr(&(0x7f0000000340)='./dev\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) 18.846063592s ago: executing program 7 (id=1863): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) fcntl$setlease(r0, 0x400, 0x1) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x80000, 0x82) openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x8040, 0x4) open(&(0x7f0000000000)='./file0\x00', 0x4000, 0x20) fcntl$setlease(r0, 0x400, 0x0) 4.861296533s ago: executing program 35 (id=1847): munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f000000d040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, 0x0, 0x8de13c6b70ae92c3, 0x41003, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4050) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x40085507, &(0x7f00000000c0)=0x18) 3.71057201s ago: executing program 36 (id=1863): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) fcntl$setlease(r0, 0x400, 0x1) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x80000, 0x82) openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x8040, 0x4) open(&(0x7f0000000000)='./file0\x00', 0x4000, 0x20) fcntl$setlease(r0, 0x400, 0x0) 2.227395142s ago: executing program 0 (id=1984): socketpair(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x12, 0x9, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r1, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000500)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r1}, &(0x7f0000000580)=0x2, &(0x7f0000000740)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{r2, 0xffffffffffffffff}, &(0x7f00000007c0), &(0x7f0000000800)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000009c0)={r3, &(0x7f0000000880), &(0x7f00000008c0)=""/196}, 0x20) 2.091972406s ago: executing program 6 (id=1986): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_tracing={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2}, 0x94) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000780)=@generic={0x0, r3}, 0x18) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000340)={r2, 0x0, 0x0}, 0x10) 2.036153772s ago: executing program 0 (id=1987): syz_mount_image$ext4(&(0x7f0000000400)='ext4\x00', &(0x7f0000000500)='./bus\x00', 0xe, &(0x7f0000000540)={[{}, {@oldalloc}, {@resuid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@block_validity}, {@jqfmt_vfsv1}]}, 0x3, 0x447, &(0x7f00000005c0)="$eJzs28tvG0UYAPBv10lKX8SU8ugDCBRExCNp0gI9cAGBxAEkJDiUY0jSqtRtUBMkWlW0IFSOqBJ3xIEDEn8BJ7gg4ITEFe6oUoV6aeFktPZuYjt2mocTF/z7SdvO7M5q5vPu2DM72QD61kj2TxKxKyJ+j4jhera5wEj9v1s3Lk7/fePidBLV6lt/JbVyN29cnC6KFuftzDOjaUT6aRIH2tQ7f/7C6alKZfZcnh9fOPP++Pz5C8+eOjN1cvbk7NnJY8eOHpl44fnJ57oSZ9amm/s/mju477V3rr4xffzquz9/mxTxt8TRJSMrHXyiWu1ydb21uyGdDPSwIaxJKSKyyzVY6//DUYqlizccr37S08YBm6parVZ3dj58uQr8jyXR6xYAvVH80Gfz32LboqHHHeH6S/UJUBb3rXyrHxmINC8z2DK/7aaRiDh++Z8vsy025zkEAECT77PxzzPtxn9p3N9Q7u58bagcEfdExJ6IuDci9kbEfRG1sg9ExINrrL91kWT5+Ce9tq7AVikb/72Yr201j/+K0V+US3ludy3+weTEqcrs4fwzGY3BbVl+YoU6fnjlt887HWsc/2VbVn8xFszbcW1gW/M5M1MLUxuJudH1jyP2D7SLP1lcCUgiYl9E7F9nHaee+uZgp2O3j38FXVhnqn4V8WT9+l+OlvgLycrrk+N3RWX28HhxVyz3y69X3uxU/4bi74Ls+u9oe/8vxl9OGtdr59dex5U/Pus4p1nd/V+91HhOdv8PJW/X0kP5vg+nFhbOTUQMJa/XG924f3Lp3CJflM/iHz3Uvv/viaVP4kBEZDfxQxHxcEQ8krf90Yh4LCIOrRD/Ty8//t76499cWfwza7r+S4mhaN3TPlE6/eN3TZWW1xJ/dv2P1lKj+Z7VfP+tpl3ru5sBAADgvyeNiF2RpGOL6TQdG6v/vfze2JFW5uYXnj4x98HZmfo7AuUYTIsnXcMNz0Mn8ml9kZ+M+LoxfyR/bvxFaXstPzY9V5npdfDQ53Z26P+ZP0u9bh2w6byvBf1L/4f+pf9D/9L/oX+16f/be9EOYOu1+/2/1IN2AFuvpf9b9oM+Yv4P/Uv/h/6l/0Nfmt8et39JXkJiWSLSO6IZEt1JpBHRtGf5d0W5F19QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG/RvAAAA//831udB") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a40)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000a80), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) write$binfmt_elf64(r0, &(0x7f0000000ac0)={{0x7f, 0x45, 0x4c, 0x46, 0x11, 0x8, 0xc0, 0x7f, 0x6, 0x2, 0x6, 0x6, 0x249, 0x40, 0xf, 0x2, 0x5, 0x38, 0x1, 0x6, 0x80, 0x2}, [{0x7, 0xa, 0x8000000000000000, 0x6, 0x9, 0x140000000000000, 0x4, 0x80}]}, 0x78) 1.837443042s ago: executing program 2 (id=1988): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./dev\x00', &(0x7f00000002c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/kmsg\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000380)='.\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000400)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) 1.722827144s ago: executing program 6 (id=1989): syz_mount_image$erofs(&(0x7f00000000c0), &(0x7f0000000340)='./file2\x00', 0x2010000, &(0x7f0000000200)=ANY=[], 0x41, 0x251, &(0x7f0000000b80)="$eJzsmb9rFEEUx7+zv+4uilil0EYwYES9y+0VpjnUgGBlk/ir0sOsId4mJ3creAtigo0W2lkINhb+AxYBU1nY2VkJWqggCHqghY3NyuzMzs3eXTZmD6u8TzH57ry3M++9mX1FDgRB7Fq+fP796dHc7MJxAHsxhYKc/2YCjAltaP4fn94+9qR+9tnLDy/erO67uzm4Hn8litITxbRLymwBeH3GxD21kzL/4WJKPizAUPoCDByV+hIYylJfg4GLUntguCL3v5loAC3uXy7fWPa98vWWv8jFDB+qfHD5UMNAfL11hkUVfBTJssAG0OmGzYbve21NWNLOZ07OpUy5hAqmOTl0fjYc9A4CdS0+XsXLD+6v8+ekNjOqfu9QhYGfMokaGOalzywKSW1ESbT8D1j4nqxvavuLKJNsU3FzV27YLsmiEPVfI31Q3HnVHHjtTqkfYXwhlA8/tux1pnk6p4dN+5HnFJF+y0bfZMrAsDbO/ci8OrGwhk9nUJyS5cqx1/lUeTPEY34m/ylTXeTKIhGTvc23+syhbmjD/6pmnJHffBixbVd+NfHv96eY6eP0E8RDeW65Uy4hbBrjVCxko3YH3m+I/hE9Zzii9SdL6x+VYOVWpdMNTyyvNJa8JW/VdWuFPcIWN6JKPA71vX5/LsX9aUJb397C1zEc3GkEQbsqRoc5KCEI2m787GqfzfxG68dV+VqAcwAOiwfeNh21ouiEBW0PU/oY8V+ups0tgycIgiAIgiAIgiAIgiAIgtgJyT9XoywYsCZ+nvkbAAD//07yWUk=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x60840, 0x8) io_setup(0x2c, &(0x7f0000000200)=0x0) r2 = inotify_init1(0x0) inotify_add_watch(r2, &(0x7f0000000140)='./file0\x00', 0x16000067) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0xf, r0, 0x0, 0x0, 0x3fffffe}]) 1.624808464s ago: executing program 2 (id=1990): r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x2940, 0x2, 0x10}, 0x18) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) r3 = fcntl$dupfd(r2, 0x0, r0) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}}) 1.541711783s ago: executing program 0 (id=1991): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$uinput_user_dev(r0, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000140)="240000001a005f0400f9f407000904018020000000000000000000000820020000000045", 0x24) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_PERIODIC_INQ={{0x3}, 0x5}}}, 0x7) 1.409195536s ago: executing program 2 (id=1992): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000540)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) sendto$inet6(r0, &(0x7f0000000580)='\x00', 0x1, 0x0, &(0x7f00000005c0)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000600)=0x81, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32, @ANYBLOB="01000000000000001c0012000c00010062"], 0x3c}}, 0x0) recvmmsg(r0, &(0x7f0000000640), 0x40000000000036a, 0x10122, 0x0) 1.228660715s ago: executing program 6 (id=1993): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r2, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x224e}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) 1.018246576s ago: executing program 6 (id=1994): sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0xca, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = epoll_create(0x4583) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0xc8000015}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0x1, 0x1, 0x107fff, 0x10, 0x4, 0x9, 0x80000001, 0xffb, 0x9, 0xb6b, 0x800c5, 0x4, 0x1, 0x1, 0x7, 0xff, 0x1000, 0xc, 0xf, 0x3, 0x80000001, 0xfffffffa, 0x0, 0x1, 0x9, 0x2, 0x7, 0x8, 0x100000, 0x762, 0x3, 0x63c, 0xe, 0x6, 0x100, 0x6, 0x1bfe, 0x7, 0x7, 0x40, 0x1000, 0x80000fd, 0x3, 0x0, 0x11000, 0x4, 0x5, 0x79b, 0x5, 0x1, 0x7f, 0x4, 0x9, 0x7, 0xf, 0x101, 0xa, 0x8a7a, 0x81, 0xa9, 0x81, 0x2, 0x180000, 0x4003, 0x28b, 0x5, 0x2af, 0x3, 0x85, 0x2, 0x1, 0xb, 0x4, 0x7, 0x4009, 0x0, 0x9, 0x100002, 0x8, 0x0, 0x0, 0x3, 0x0, 0x10000, 0x3f6, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0xfffffffe, 0x84, 0x100, 0x0, 0x5, 0x3, 0xb, 0x2, 0x20006, 0xc50, 0x2, 0xe, 0x30000002, 0xd9a, 0xc8, 0x2a2, 0xffffdffd, 0x3, 0x2, 0x1, 0x8, 0x0, 0x4, 0x200, 0x200, 0x0, 0x1, 0x4, 0x401, 0x66cd, 0xc, 0x8, 0x4, 0x1f8, 0x1ff, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 885.849989ms ago: executing program 0 (id=1995): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendmsg$inet(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt(r0, 0x200000000114, 0x2715, 0x0, &(0x7f0000000400)) 705.433588ms ago: executing program 0 (id=1996): syz_open_dev$sndctrl(&(0x7f0000000640), 0x4bb, 0x800) r0 = syz_open_dev$sndpcmp(&(0x7f0000000140), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000180)={0x400000, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0x39a8, 0xffffffff, 0xffffffff, 0x3, 0xffffffff, 0xffffffff, 0xfffffff7, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xe8e1, 0xffffffff, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x1c, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x2, 0xd3, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r0, 0x40084149, &(0x7f0000000400)=0xfd8) ioctl$SNDRV_PCM_IOCTL_DRAIN(r0, 0x4144, 0x0) 656.414273ms ago: executing program 6 (id=1997): r0 = userfaultfd(0x1) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, r0, 0x91c6b000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) syz_open_procfs(0x0, &(0x7f0000001040)='net/nf_conntrack_expect\x00') ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000000000/0x800000)=nil, 0x800000}) 548.834904ms ago: executing program 0 (id=1998): r0 = memfd_create(&(0x7f0000000100)='\vem\xda\x99R@m\xfc\xfe\x9b#*\xff', 0x0) write(r0, &(0x7f0000000040)="0600", 0x2) sendfile(r0, r0, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'ovf\x00', 0x36, 0x5, 0x104a}, 0x2c) 458.741563ms ago: executing program 2 (id=1999): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002700)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000002780)={0x1, 0xf, &(0x7f0000002840)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000028c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0x11, 0x200000000000002, 0x300) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000002900)=r1, 0x4) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000002440)={0x0, 0x0, &(0x7f0000002480)={&(0x7f00000024c0)=@newtfilter={0x24, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3}, {}, {0x4, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x94}, 0x24040084) 322.200337ms ago: executing program 6 (id=2000): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000140)={0x1f, 0x80, @any, 0x0, 0x1}, 0xe) listen(r0, 0x5) syz_emit_vhci(&(0x7f0000000980)=ANY=[@ANYBLOB="02c90012000e00050014420a008000400003e3ee"], 0x17) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000940)={0x1, &(0x7f0000000d00)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 253.303174ms ago: executing program 2 (id=2001): syz_open_dev$sndpcmc(&(0x7f0000000000), 0x1, 0x2) r0 = syz_open_procfs(0x0, &(0x7f0000004400)='fd/3\x00') r1 = fanotify_init(0x40, 0x101000) fanotify_mark(r1, 0x1, 0x8000039, r0, 0x0) io_setup(0x9, &(0x7f0000004440)=0x0) io_submit(r2, 0x1, &(0x7f0000004480)=[&(0x7f00000044c0)={0x0, 0x0, 0x0, 0x7, 0xb, r0, 0x0}]) 0s ago: executing program 2 (id=2002): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000003d80)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) close(0x4) kernel console output (not intermixed with test programs): change from 0 to 32896 [ 140.716249][ T6489] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 140.756901][ T6489] ext4 filesystem being mounted at /4/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 140.824655][ T6110] EXT4-fs (loop5): unmounting filesystem. [ 141.111847][ T7] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 141.126178][ T6496] loop4: detected capacity change from 0 to 49152 [ 141.196435][ T6496] EXT4-fs (loop4): Using encoding defined by superblock: utf8-12.1.0 with flags 0x0 [ 141.258942][ T6496] EXT4-fs (loop4): mounted filesystem with ordered data mode. Quota mode: none. [ 141.271943][ T6496] ext4 filesystem being mounted at /144/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 141.318914][ T7] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 141.380526][ T7] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 141.453925][ T7] usb 2-1: New USB device found, idVendor=0a12, idProduct=0001, bcdDevice= 0.00 [ 141.501815][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 141.521299][ T4283] EXT4-fs (loop4): unmounting filesystem. [ 141.540330][ T7] usb 2-1: Product: syz [ 141.558052][ T7] usb 2-1: Manufacturer: syz [ 141.570461][ T7] usb 2-1: SerialNumber: syz [ 141.752284][ T6530] gadgetfs: bound to dummy_udc driver [ 142.245130][ T4363] usb 2-1: USB disconnect, device number 8 [ 142.247871][ T4292] Bluetooth: hci5: CSR: Local version failed (-71) [ 142.349003][ T6544] loop4: detected capacity change from 0 to 8192 [ 142.409676][ T6544] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 142.432112][ T6544] REISERFS (device loop4): found reiserfs format "3.6" with non-standard journal [ 142.441550][ T6544] REISERFS (device loop4): using ordered data mode [ 142.449564][ T6544] reiserfs: using flush barriers [ 142.456426][ T6544] REISERFS (device loop4): journal params: device loop4, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 142.473371][ T6544] REISERFS (device loop4): checking transaction log (loop4) [ 142.675078][ T6544] REISERFS (device loop4): Using tea hash to sort names [ 142.691553][ T6544] REISERFS (device loop4): Created .reiserfs_priv - reserved for xattr storage. [ 142.769601][ T6568] loop2: detected capacity change from 0 to 33792 [ 142.850267][ T6568] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 142.904224][ T6544] REISERFS warning (device loop4): vs-13060 reiserfs_update_sd_size: stat data of object [2 5 0x0 SD] (nlink == 2) not found (pos 4) [ 142.956587][ T6568] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 143.004949][ T26] audit: type=1800 audit(1794581384.130:12): pid=6568 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.728" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 143.034643][ T6568] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 143.079084][ T6544] overlayfs: failed to resolve './file1': -2 [ 143.132264][ T6568] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2805: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 143.216033][ T6579] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 64 with error 28 [ 143.311952][ T6579] EXT4-fs (loop2): This should not happen!! Data will be lost [ 143.311952][ T6579] [ 143.383975][ T6579] EXT4-fs (loop2): Total free blocks count 0 [ 143.401927][ T6579] EXT4-fs (loop2): Free/Dirty block details [ 143.407898][ T6579] EXT4-fs (loop2): free_blocks=20480 [ 143.426474][ T6579] EXT4-fs (loop2): dirty_blocks=64 [ 143.431810][ T6579] EXT4-fs (loop2): Block reservation details [ 143.461964][ T6579] EXT4-fs (loop2): i_reserved_data_blocks=4 [ 143.644921][ T4281] EXT4-fs (loop2): unmounting filesystem. [ 143.886342][ T4951] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 144.091825][ T4951] usb 5-1: Using ep0 maxpacket: 16 [ 144.098812][ T4951] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 144.134458][ T4951] usb 5-1: config 0 interface 0 has no altsetting 0 [ 144.148162][ T4951] usb 5-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00 [ 144.173563][ T4951] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.208354][ T4951] usb 5-1: config 0 descriptor?? [ 144.403629][ T6611] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 144.445444][ T6595] loop2: detected capacity change from 0 to 40427 [ 144.476254][ T6611] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 144.489495][ T6595] F2FS-fs (loop2): invalid crc value [ 144.511318][ T6595] F2FS-fs (loop2): Found nat_bits in checkpoint [ 144.534821][ T6611] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 144.605317][ T6611] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 144.623253][ T6595] F2FS-fs (loop2): Start checkpoint disabled! [ 144.625822][ T6611] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 144.636533][ T4951] uclogic 0003:5543:0064.0007: unknown main item tag 0x0 [ 144.666788][ T4951] uclogic 0003:5543:0064.0007: unknown main item tag 0x0 [ 144.682834][ T4951] uclogic 0003:5543:0064.0007: unknown main item tag 0x0 [ 144.706566][ T6611] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 144.711816][ T4951] uclogic 0003:5543:0064.0007: unknown main item tag 0x0 [ 144.721166][ T6595] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 144.752019][ T4951] uclogic 0003:5543:0064.0007: unknown main item tag 0x0 [ 144.759189][ T6611] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 144.764746][ T4951] uclogic 0003:5543:0064.0007: No inputs registered, leaving [ 144.813892][ T4951] uclogic 0003:5543:0064.0007: hiddev0,hidraw0: USB HID v0.01 Device [HID 5543:0064] on usb-dummy_hcd.4-1/input0 [ 144.922107][ T4951] usb 5-1: USB disconnect, device number 9 [ 144.958086][ T6595] syz.2.736: attempt to access beyond end of device [ 144.958086][ T6595] loop2: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 145.072051][ T6595] syz.2.736: attempt to access beyond end of device [ 145.072051][ T6595] loop2: rw=2049, sector=45120, nr_sectors = 8 limit=40427 [ 145.209066][ T6620] fido_id[6620]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 145.367024][ T4398] kworker/u4:7: attempt to access beyond end of device [ 145.367024][ T4398] loop2: rw=2049, sector=40960, nr_sectors = 8 limit=40427 [ 145.409388][ T4398] kworker/u4:7: attempt to access beyond end of device [ 145.409388][ T4398] loop2: rw=2049, sector=40992, nr_sectors = 8 limit=40427 [ 145.794728][ T6653] Bluetooth: ISO socket layer initialized [ 146.402101][ T4951] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 146.604703][ T4951] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 146.621888][ T4951] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 146.638877][ T4951] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 146.669241][ T4951] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 146.697900][ T4951] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 146.724242][ T4951] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.491604][ T6713] netlink: 51 bytes leftover after parsing attributes in process `syz.0.774'. [ 147.667755][ T14] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 147.843472][ T6715] loop5: detected capacity change from 0 to 32768 [ 147.882484][ T14] usb 3-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 147.906521][ T14] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.950930][ T6715] XFS (loop5): Mounting V5 Filesystem [ 147.989908][ T4951] gud 5-1:1.0: USB-2: Failed to add properties (ret=-71) [ 148.009333][ T4951] gud 5-1:1.0: Failed to get connectors (error=-71) [ 148.016461][ T4951] gud: probe of 5-1:1.0 failed with error -71 [ 148.102004][ T4951] usb 5-1: USB disconnect, device number 10 [ 148.106926][ T6736] loop1: detected capacity change from 0 to 33792 [ 148.128434][ T6736] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 148.162074][ T6715] XFS (loop5): Ending clean mount [ 148.186037][ T6715] XFS (loop5): Quotacheck needed: Please wait. [ 148.240136][ T6736] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 148.308173][ T6715] XFS (loop5): Quotacheck: Done. [ 148.326245][ T26] audit: type=1804 audit(1794581389.450:13): pid=6736 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.781" name="/newroot/150/file1/bus" dev="loop1" ino=18 res=1 errno=0 [ 148.585554][ T6110] XFS (loop5): Unmounting Filesystem [ 149.169197][ T14] usb 3-1: Cannot set autoneg [ 149.182078][ T14] MOSCHIP usb-ethernet driver: probe of 3-1:7.0 failed with error -71 [ 149.201472][ T14] usb 3-1: USB disconnect, device number 7 [ 149.247503][ T4275] EXT4-fs (loop1): unmounting filesystem. [ 149.748061][ T6780] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 150.200840][ T6797] loop5: detected capacity change from 0 to 33792 [ 150.208460][ T6798] loop4: detected capacity change from 0 to 2048 [ 150.241910][ T6797] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 150.277352][ T6798] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 150.333401][ T6797] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 150.365563][ T26] audit: type=1804 audit(1794581391.490:14): pid=6797 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.5.800" name="/newroot/31/file1/bus" dev="loop5" ino=18 res=1 errno=0 [ 150.840943][ T4283] UDF-fs: error (device loop4): udf_read_inode: (ino 1345) failed !bh [ 150.900556][ T4283] UDF-fs: error (device loop4): udf_read_inode: (ino 1345) failed !bh [ 151.338467][ T6819] ip_tables: iptables: counters copy to user failed while replacing table [ 151.575475][ T6810] loop1: detected capacity change from 0 to 32768 [ 151.608348][ T6810] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.812 (6810) [ 151.662715][ T6823] syz.0.809 (6823) used greatest stack depth: 20800 bytes left [ 151.682017][ T6810] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 151.710882][ T6810] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 151.729945][ T6810] BTRFS warning (device loop1): excessive commit interval 3581 [ 151.749040][ T6810] BTRFS info (device loop1): force zlib compression, level 3 [ 151.776539][ T6810] BTRFS info (device loop1): metadata ratio 107050 [ 151.797681][ T6810] BTRFS info (device loop1): turning on flush-on-commit [ 151.820405][ T6810] BTRFS info (device loop1): max_inline at 4096 [ 151.841587][ T6810] BTRFS info (device loop1): using free space tree [ 152.040223][ T6810] BTRFS info (device loop1): enabling ssd optimizations [ 152.129902][ T6110] EXT4-fs (loop5): unmounting filesystem. [ 152.262136][ T4293] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 152.273577][ T4293] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 152.282129][ T4293] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 152.289898][ T4293] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 152.298989][ T4293] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 152.316883][ T4293] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 152.404336][ T4275] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 152.659542][ T6848] rxe_eth0 speed is unknown, defaulting to 1000 [ 153.457165][ T6857] loop2: detected capacity change from 0 to 32768 [ 153.588037][ T6857] JBD2: Ignoring recovery information on journal [ 153.786855][ T6857] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 153.834819][ T6848] chnl_net:caif_netlink_parms(): no params data found [ 154.040571][ T26] audit: type=1804 audit(1794581395.160:15): pid=6857 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.816" name="/newroot/179/file1/file1" dev="loop2" ino=17059 res=1 errno=0 [ 154.167637][ T4281] ocfs2: Unmounting device (7,2) on (node local) [ 154.380529][ T4293] Bluetooth: hci3: command 0x0409 tx timeout [ 154.481108][ T6848] bridge0: port 1(bridge_slave_0) entered blocking state [ 154.488820][ T6848] bridge0: port 1(bridge_slave_0) entered disabled state [ 154.517374][ T6848] device bridge_slave_0 entered promiscuous mode [ 154.559493][ T6848] bridge0: port 2(bridge_slave_1) entered blocking state [ 154.586718][ T6848] bridge0: port 2(bridge_slave_1) entered disabled state [ 154.616835][ T6848] device bridge_slave_1 entered promiscuous mode [ 154.808173][ T6848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 154.886914][ T6848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 154.989718][ T6848] team0: Port device team_slave_0 added [ 155.034647][ T6848] team0: Port device team_slave_1 added [ 155.129927][ T6848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 155.154009][ T6848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.212040][ T6848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 155.398766][ T6848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 155.425914][ T6848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 155.522709][ T6848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 155.800436][ T26] audit: type=1326 audit(1794581396.920:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6939 comm="syz.2.839" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4003a94d9 code=0x7ffc0000 [ 155.838564][ T6848] device hsr_slave_0 entered promiscuous mode [ 155.872222][ T6848] device hsr_slave_1 entered promiscuous mode [ 155.892766][ T26] audit: type=1326 audit(1794581396.930:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6939 comm="syz.2.839" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4003a94d9 code=0x7ffc0000 [ 155.920268][ T6848] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 155.939099][ T6848] Cannot create hsr debugfs directory [ 155.993595][ T26] audit: type=1326 audit(1794581396.930:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6939 comm="syz.2.839" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4003a94d9 code=0x7ffc0000 [ 156.072764][ T4398] device hsr_slave_0 left promiscuous mode [ 156.092288][ T4398] device hsr_slave_1 left promiscuous mode [ 156.101315][ T26] audit: type=1326 audit(1794581396.930:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6939 comm="syz.2.839" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fa4003a94d9 code=0x7ffc0000 [ 156.126079][ T4398] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 156.131601][ T26] audit: type=1326 audit(1794581396.930:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6939 comm="syz.2.839" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4003a94d9 code=0x7ffc0000 [ 156.157903][ T4398] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 156.191678][ T26] audit: type=1326 audit(1794581396.940:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6939 comm="syz.2.839" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4003a94d9 code=0x7ffc0000 [ 156.215917][ T26] audit: type=1326 audit(1794581396.940:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6939 comm="syz.2.839" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4003a94d9 code=0x7ffc0000 [ 156.240312][ T26] audit: type=1326 audit(1794581396.940:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6939 comm="syz.2.839" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa4003a94d9 code=0x7ffc0000 [ 156.242579][ T4398] team0 (unregistering): Port device veth3 removed [ 156.272210][ T26] audit: type=1326 audit(1794581396.940:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6939 comm="syz.2.839" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7fa4003a94d9 code=0x7ffc0000 [ 156.458117][ T4293] Bluetooth: hci3: command 0x041b tx timeout [ 157.494090][ T4398] team0 (unregistering): Port device team_slave_1 removed [ 157.546777][ T4398] team0 (unregistering): Port device team_slave_0 removed [ 157.586147][ T4398] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 157.628952][ T4398] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 157.919157][ T4398] bond0 (unregistering): Released all slaves [ 158.494951][ T6848] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 158.523311][ T6848] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 158.531915][ T4293] Bluetooth: hci3: command 0x040f tx timeout [ 158.540011][ T6848] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 158.577868][ T6848] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 158.763853][ T6848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 158.813784][ T7004] FAULT_INJECTION: forcing a failure. [ 158.813784][ T7004] name failslab, interval 1, probability 0, space 0, times 0 [ 158.832266][ T6848] 8021q: adding VLAN 0 to HW filter on device team0 [ 158.839154][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 158.857041][ T7004] CPU: 1 PID: 7004 Comm: syz.1.856 Not tainted syzkaller #0 [ 158.864376][ T7004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 158.874451][ T7004] Call Trace: [ 158.877745][ T7004] [ 158.880694][ T7004] dump_stack_lvl+0x188/0x24e [ 158.885404][ T7004] ? show_regs_print_info+0x12/0x12 [ 158.886347][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 158.890610][ T7004] ? load_image+0x410/0x410 [ 158.902320][ T7004] ? __might_sleep+0xd0/0xd0 [ 158.906934][ T7004] ? __lock_acquire+0x7ea0/0x7ea0 [ 158.911986][ T7004] should_fail_ex+0x390/0x4c0 [ 158.916696][ T7004] should_failslab+0x5/0x20 [ 158.921218][ T7004] slab_pre_alloc_hook+0x59/0x300 [ 158.926269][ T7004] ? dup_fd+0x71e/0xa20 [ 158.930446][ T7004] ? alloc_fdtable+0xca/0x2c0 [ 158.935145][ T7004] __kmem_cache_alloc_node+0x4f/0x270 [ 158.940536][ T7004] ? __lock_acquire+0x7ea0/0x7ea0 [ 158.945594][ T7004] ? alloc_fdtable+0xca/0x2c0 [ 158.950308][ T7004] kmalloc_trace+0x26/0xe0 [ 158.954737][ T7004] alloc_fdtable+0xca/0x2c0 [ 158.959249][ T7004] dup_fd+0x743/0xa20 [ 158.963256][ T7004] ? __ia32_sys_get_robust_list+0x100/0x100 [ 158.969148][ T7004] ksys_unshare+0x458/0x8e0 [ 158.973657][ T7004] ? sighand_ctor+0x40/0x40 [ 158.978156][ T7004] ? lock_chain_count+0x20/0x20 [ 158.983015][ T7004] ? syscall_enter_from_user_mode+0x21/0x80 [ 158.988916][ T7004] __x64_sys_unshare+0x34/0x40 [ 158.993679][ T7004] do_syscall_64+0x4c/0xa0 [ 158.998096][ T7004] ? clear_bhb_loop+0x60/0xb0 [ 159.002770][ T7004] ? clear_bhb_loop+0x60/0xb0 [ 159.007449][ T7004] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 159.013347][ T7004] RIP: 0033:0x7f664c5a94d9 [ 159.017759][ T7004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.037367][ T7004] RSP: 002b:00007f664d3a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 159.045783][ T7004] RAX: ffffffffffffffda RBX: 00007f664c825fa0 RCX: 00007f664c5a94d9 [ 159.053750][ T7004] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002e000480 [ 159.061716][ T7004] RBP: 00007f664c63804e R08: 0000000000000000 R09: 0000000000000000 [ 159.069686][ T7004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 159.077654][ T7004] R13: 00007f664c826038 R14: 00007f664c825fa0 R15: 00007fff0ba1a878 [ 159.085631][ T7004] [ 159.136080][ T7007] A link change request failed with some changes committed already. Interface gre1 may have been left with an inconsistent configuration, please check. [ 159.193698][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 159.209105][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 159.239401][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.246597][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 159.313016][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 159.339004][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 159.384887][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 159.428129][ T4388] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.435337][ T4388] bridge0: port 2(bridge_slave_1) entered forwarding state [ 159.476613][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 159.503952][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 159.566019][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 159.603345][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 159.637098][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 159.663840][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 159.732767][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 159.761650][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 159.770916][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 159.819334][ T6848] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 159.847192][ T6848] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 159.858135][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 159.872891][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 160.342855][ T7038] 9pnet: p9_errstr2errno: server reported unknown error n$Ž[ [ 160.342855][ T7038] Q&|xù6 [ 160.561863][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 160.589557][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 160.620719][ T6848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 160.629949][ T4293] Bluetooth: hci3: command 0x0419 tx timeout [ 160.919919][ T7061] mmap: syz.1.871 (7061) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 161.554604][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 161.587549][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 161.660689][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 161.685873][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 161.714576][ T7087] netlink: 'syz.2.878': attribute type 10 has an invalid length. [ 161.748189][ T7067] loop5: detected capacity change from 0 to 32768 [ 161.811044][ T7067] XFS (loop5): Mounting V5 Filesystem [ 161.812743][ T7087] team0: Port device dummy0 added [ 161.853157][ T6848] device veth0_vlan entered promiscuous mode [ 161.859830][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 161.896905][ T7099] loop1: detected capacity change from 0 to 33280 [ 161.912735][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 161.927442][ T6848] device veth1_vlan entered promiscuous mode [ 161.935530][ T7067] XFS (loop5): Ending clean mount [ 161.966198][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): ipvlan0: link becomes ready [ 161.970350][ T7099] EXT4-fs (loop1): invalid journal inode [ 161.978349][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): ipvlan1: link becomes ready [ 161.998541][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 162.013163][ T7099] EXT4-fs (loop1): can't get journal size [ 162.029459][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 162.058688][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 162.074518][ T7099] EXT4-fs (loop1): 1 truncate cleaned up [ 162.081098][ T7099] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 162.172732][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 162.192299][ T6848] device veth0_macvtap entered promiscuous mode [ 162.209104][ T4275] EXT4-fs (loop1): unmounting filesystem. [ 162.251214][ T6848] device veth1_macvtap entered promiscuous mode [ 162.265559][ T6110] XFS (loop5): Unmounting Filesystem [ 162.368956][ T6848] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 162.377568][ T7110] Unable to locate . in FUNC.INSTANCE [ 162.397433][ T6848] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 162.438454][ T6848] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 162.456372][ T6848] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 162.467900][ T6848] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 162.497275][ T6848] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 162.521962][ T6848] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 162.542919][ T6848] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 162.603171][ T6848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 162.650625][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 162.659934][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 162.668767][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 162.699754][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 162.732602][ T6848] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 162.767471][ T6848] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 162.799742][ T6848] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 162.828344][ T6848] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 162.848682][ T6848] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 162.889866][ T6848] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 162.928123][ T6848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 162.955342][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 162.975358][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 163.008451][ T6848] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.032509][ T6848] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.067462][ T6848] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.091857][ T6848] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.146973][ T7138] loop1: detected capacity change from 0 to 512 [ 163.255794][ T7138] FAT-fs (loop1): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 163.318779][ T7138] FAT-fs (loop1): Filesystem has been set read-only [ 163.362938][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.370816][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.423397][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 163.492753][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.500621][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.570361][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 164.482978][ T7189] loop5: detected capacity change from 0 to 33792 [ 164.504961][ T7189] EXT4-fs: Ignoring removed bh option [ 164.560154][ T7189] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 164.621621][ T7189] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 164.762647][ T7198] netlink: 8 bytes leftover after parsing attributes in process `syz.2.905'. [ 164.789194][ T7189] EXT4-fs error (device loop5): ext4_map_blocks:747: inode #15: block 3: comm syz.5.902: lblock 3 mapped to illegal pblock 3 (length 3) [ 164.819221][ T7198] netlink: 16 bytes leftover after parsing attributes in process `syz.2.905'. [ 164.852363][ T7102] EXT4-fs error (device loop5): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 164.915500][ T7189] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 164.953271][ T7189] EXT4-fs (loop5): This should not happen!! Data will be lost [ 164.953271][ T7189] [ 164.982842][ T7201] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.902: lblock 3 mapped to illegal pblock 3 (length 1) [ 165.094416][ T7206] EXT4-fs error (device loop5): ext4_map_blocks:747: inode #15: comm syz.5.902: lblock 0 mapped to illegal pblock 0 (length 1) [ 165.110397][ T7201] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: comm syz.5.902: lblock 0 mapped to illegal pblock 0 (length 1) [ 165.157336][ T7201] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: block 3: comm syz.5.902: lblock 3 mapped to illegal pblock 3 (length 1) [ 165.174432][ T7210] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: comm syz.5.902: lblock 0 mapped to illegal pblock 0 (length 1) [ 165.247513][ T7210] EXT4-fs error (device loop5): ext4_ext_remove_space:2945: inode #15: comm syz.5.902: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 3, max 4(4), depth 0(0) [ 165.377300][ T7201] EXT4-fs error (device loop5): ext4_map_blocks:637: inode #15: comm syz.5.902: lblock 0 mapped to illegal pblock 0 (length 1) [ 165.421847][ T7210] EXT4-fs error (device loop5) in ext4_setattr:5728: Corrupt filesystem [ 165.566240][ T6110] EXT4-fs (loop5): unmounting filesystem. [ 166.157893][ T7222] loop6: detected capacity change from 0 to 32768 [ 166.296351][ T7259] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 166.339323][ T7222] XFS (loop6): Mounting V5 Filesystem [ 166.357484][ T7259] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 166.393117][ T7259] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 166.417293][ T7259] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 166.444739][ T7222] XFS (loop6): Ending clean mount [ 166.457997][ T7222] XFS (loop6): Quotacheck needed: Please wait. [ 166.584602][ T7222] XFS (loop6): Quotacheck: Done. [ 166.668052][ T48] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.740444][ T6848] XFS (loop6): Unmounting Filesystem [ 166.857770][ T48] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.888014][ T7275] netlink: 12 bytes leftover after parsing attributes in process `syz.2.928'. [ 166.917167][ T7275] netlink: 12 bytes leftover after parsing attributes in process `syz.2.928'. [ 167.071373][ T48] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.259821][ T48] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.639321][ T4292] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 167.651298][ T4292] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 167.661157][ T4292] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 167.669122][ T4292] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 167.676961][ T4292] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 167.684442][ T4292] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 167.958097][ T7291] rxe_eth0 speed is unknown, defaulting to 1000 [ 168.117915][ T7290] loop1: detected capacity change from 0 to 32768 [ 168.236895][ T7290] XFS (loop1): Mounting V5 Filesystem [ 168.341077][ T7290] XFS (loop1): Ending clean mount [ 168.824828][ T7291] chnl_net:caif_netlink_parms(): no params data found [ 168.841519][ T4275] XFS (loop1): Unmounting Filesystem [ 169.467066][ T7291] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.510145][ T7291] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.529707][ T7291] device bridge_slave_0 entered promiscuous mode [ 169.554908][ T7291] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.578836][ T7291] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.607336][ T7291] device bridge_slave_1 entered promiscuous mode [ 169.680422][ T48] device hsr_slave_0 left promiscuous mode [ 169.692135][ T48] device hsr_slave_1 left promiscuous mode [ 169.705932][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 169.721245][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 169.737160][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 169.744987][ T4293] Bluetooth: hci1: command 0x0409 tx timeout [ 169.767955][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 169.784095][ T48] device bridge_slave_1 left promiscuous mode [ 169.811040][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.830635][ T48] device bridge_slave_0 left promiscuous mode [ 169.849154][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.972900][ T48] device veth1_macvtap left promiscuous mode [ 169.978967][ T48] device veth0_macvtap left promiscuous mode [ 170.019437][ T48] device veth1_vlan left promiscuous mode [ 170.025433][ T48] device veth0_vlan left promiscuous mode [ 170.112279][ T7352] loop1: detected capacity change from 0 to 32768 [ 170.178284][ T7352] XFS (loop1): Mounting V5 Filesystem [ 170.253827][ T7352] XFS (loop1): Ending clean mount [ 170.449119][ T4275] XFS (loop1): Unmounting Filesystem [ 171.446640][ T48] team0 (unregistering): Port device team_slave_1 removed [ 171.501171][ T48] team0 (unregistering): Port device team_slave_0 removed [ 171.579619][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 171.651490][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 171.821824][ T4293] Bluetooth: hci1: command 0x041b tx timeout [ 172.024456][ T48] bond0 (unregistering): Released all slaves [ 172.096408][ T7291] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 172.137681][ T7291] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 172.279629][ T7291] team0: Port device team_slave_0 added [ 172.298058][ T7411] loop6: detected capacity change from 0 to 2048 [ 172.320447][ T7291] team0: Port device team_slave_1 added [ 172.389860][ T7411] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 172.399562][ T7291] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 172.465399][ T7291] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 172.561798][ T7291] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 172.613954][ T7291] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 172.620943][ T7291] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 172.741795][ T7291] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 172.889941][ T7291] device hsr_slave_0 entered promiscuous mode [ 172.916743][ T7291] device hsr_slave_1 entered promiscuous mode [ 173.376757][ T7291] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 173.390538][ T7291] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 173.429308][ T7291] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 173.453946][ T7291] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 173.589019][ T7291] 8021q: adding VLAN 0 to HW filter on device bond0 [ 173.631325][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 173.646912][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 173.688975][ T7291] 8021q: adding VLAN 0 to HW filter on device team0 [ 173.721273][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 173.737339][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 173.766134][ T77] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.773364][ T77] bridge0: port 1(bridge_slave_0) entered forwarding state [ 173.793099][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 173.801288][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 173.815250][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 173.825803][ T77] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.832986][ T77] bridge0: port 2(bridge_slave_1) entered forwarding state [ 173.843326][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 173.863072][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 173.879995][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 173.893379][ T4292] Bluetooth: hci1: command 0x040f tx timeout [ 173.908321][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 173.919455][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 173.933499][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 173.963273][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 173.991271][ T7291] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 174.009636][ T7291] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 174.024179][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 174.034425][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 174.043285][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 174.053849][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 174.067920][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 174.571976][ T4972] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 174.628018][ T7488] FAULT_INJECTION: forcing a failure. [ 174.628018][ T7488] name failslab, interval 1, probability 0, space 0, times 0 [ 174.661200][ T7488] CPU: 1 PID: 7488 Comm: syz.1.982 Not tainted syzkaller #0 [ 174.668538][ T7488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 174.678609][ T7488] Call Trace: [ 174.681903][ T7488] [ 174.684843][ T7488] dump_stack_lvl+0x188/0x24e [ 174.689547][ T7488] ? show_regs_print_info+0x12/0x12 [ 174.694770][ T7488] ? load_image+0x410/0x410 [ 174.699292][ T7488] ? __might_sleep+0xd0/0xd0 [ 174.703905][ T7488] ? __lock_acquire+0x7ea0/0x7ea0 [ 174.709133][ T7488] should_fail_ex+0x390/0x4c0 [ 174.713833][ T7488] should_failslab+0x5/0x20 [ 174.718355][ T7488] slab_pre_alloc_hook+0x59/0x300 [ 174.723415][ T7488] ? __rdma_create_id+0x65/0x620 [ 174.728378][ T7488] __kmem_cache_alloc_node+0x4f/0x270 [ 174.733770][ T7488] ? __rdma_create_id+0x65/0x620 [ 174.738727][ T7488] kmalloc_trace+0x26/0xe0 [ 174.743159][ T7488] ? ucma_alloc_ctx+0x2d0/0x2d0 [ 174.748025][ T7488] ? ucma_alloc_ctx+0x2d0/0x2d0 [ 174.752890][ T7488] __rdma_create_id+0x65/0x620 [ 174.757676][ T7488] ? do_raw_spin_unlock+0x11d/0x230 [ 174.762888][ T7488] ? ucma_alloc_ctx+0x2d0/0x2d0 [ 174.767759][ T7488] rdma_create_user_id+0x7d/0xc0 [ 174.772724][ T7488] ucma_create_id+0x227/0x370 [ 174.777425][ T7488] ? __lock_acquire+0x7ea0/0x7ea0 [ 174.782473][ T7488] ? ucma_close+0x170/0x170 [ 174.784912][ T4972] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 174.786982][ T7488] ? __might_fault+0xa6/0x120 [ 174.802506][ T7488] ? __might_fault+0xc2/0x120 [ 174.805616][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 174.807178][ T7488] ? __might_fault+0xa6/0x120 [ 174.819139][ T7488] ucma_write+0x24e/0x2f0 [ 174.823488][ T7488] ? ucma_get_global_nl_info+0x70/0x70 [ 174.824944][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 174.828948][ T7488] ? common_file_perm+0x171/0x1c0 [ 174.828976][ T7488] ? fsnotify_perm+0x5a/0x550 [ 174.840285][ T4972] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 174.841247][ T7488] ? security_file_permission+0x75/0xa0 [ 174.861184][ T7488] ? ucma_get_global_nl_info+0x70/0x70 [ 174.864805][ T4972] usb 7-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 174.866644][ T7488] vfs_write+0x2dc/0x9a0 [ 174.879905][ T7488] ? file_end_write+0x250/0x250 [ 174.884776][ T7488] ? __fget_files+0x28/0x460 [ 174.886663][ T7291] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 174.889377][ T7488] ? __fget_files+0x3fc/0x460 [ 174.900812][ T7488] ? __fdget_pos+0x1d4/0x360 [ 174.905432][ T7488] ? ksys_write+0x70/0x260 [ 174.909870][ T7488] ksys_write+0x14d/0x260 [ 174.914217][ T7488] ? __ia32_sys_read+0x80/0x80 [ 174.914505][ T4972] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.918981][ T7488] ? lockdep_hardirqs_on+0x94/0x140 [ 174.919006][ T7488] do_syscall_64+0x4c/0xa0 [ 174.936599][ T7488] ? clear_bhb_loop+0x60/0xb0 [ 174.941301][ T7488] ? clear_bhb_loop+0x60/0xb0 [ 174.946016][ T7488] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 174.951929][ T7488] RIP: 0033:0x7f664c5a94d9 [ 174.956359][ T7488] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 174.965232][ T4972] usb 7-1: config 0 descriptor?? [ 174.975965][ T7488] RSP: 002b:00007f664d3a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 174.975990][ T7488] RAX: ffffffffffffffda RBX: 00007f664c825fa0 RCX: 00007f664c5a94d9 [ 174.976003][ T7488] RDX: 0000000000000020 RSI: 0000200000000c40 RDI: 0000000000000003 [ 174.976013][ T7488] RBP: 00007f664c63804e R08: 0000000000000000 R09: 0000000000000000 [ 174.976024][ T7488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 174.976034][ T7488] R13: 00007f664c826038 R14: 00007f664c825fa0 R15: 00007fff0ba1a878 [ 174.976060][ T7488] [ 175.735684][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 175.754873][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 175.792257][ T4391] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 175.806353][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 175.829880][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 175.858081][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 175.884150][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 175.917174][ T7291] device veth0_vlan entered promiscuous mode [ 175.960041][ T7523] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 175.971988][ T4292] Bluetooth: hci1: command 0x0419 tx timeout [ 175.975581][ T7523] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 175.985656][ T4972] hid-led 0003:27B8:01ED.0008: hidraw0: USB HID v0.00 Device [HID 27b8:01ed] on usb-dummy_hcd.6-1/input0 [ 175.989940][ T7523] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 176.012336][ T4391] usb 2-1: config 0 interface 0 altsetting 255 endpoint 0x4 has invalid maxpacket 12336, setting to 64 [ 176.031509][ T7523] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 176.062217][ T4391] usb 2-1: config 0 interface 0 has no altsetting 0 [ 176.071863][ T4972] hid-led 0003:27B8:01ED.0008: ThingM blink(1) initialized [ 176.103683][ T4391] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 176.128604][ T4391] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 176.148946][ T7291] device veth1_vlan entered promiscuous mode [ 176.181871][ T4391] usb 2-1: Product: syz [ 176.186777][ T4391] usb 2-1: Manufacturer: syz [ 176.191470][ T4391] usb 2-1: SerialNumber: syz [ 176.218659][ T4391] usb 2-1: config 0 descriptor?? [ 176.232655][ T129] usb 7-1: USB disconnect, device number 2 [ 176.252450][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): ipvlan0: link becomes ready [ 176.260555][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): ipvlan1: link becomes ready [ 176.287547][ T7529] fido_id[7529]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/7-1/report_descriptor': No such file or directory [ 176.290703][ T4391] usb 2-1: selecting invalid altsetting 0 [ 176.309104][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 176.326362][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 176.362708][ T7291] device veth0_macvtap entered promiscuous mode [ 176.419812][ T7291] device veth1_macvtap entered promiscuous mode [ 176.482414][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 176.511892][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 176.514560][ T7508] usb 2-1: cannot submit urb 0, error -8: unknown error [ 176.542735][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 176.630946][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 176.658432][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 176.680252][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 176.701500][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 176.736936][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 176.763247][ T7291] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 176.784471][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 176.809359][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 176.839309][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 176.875550][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 176.898903][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 176.921283][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 176.958389][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 176.987048][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.003408][ T7291] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 177.045373][ T7291] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 177.077643][ T7291] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 177.088367][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 177.126617][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 177.154013][ T7291] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.187008][ T7291] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.209163][ T7291] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.226997][ T7291] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 177.410383][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.465827][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.527789][ T33] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 177.593982][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 177.614967][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 177.672926][ T77] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 177.821043][ T7586] netlink: 'syz.7.926': attribute type 10 has an invalid length. [ 177.900981][ T7586] team0: Port device dummy0 added [ 178.292854][ T7508] snd-usb-audio 2-1:0.0: Runtime PM usage count underflow! [ 178.314317][ T4391] usb 2-1: USB disconnect, device number 9 [ 179.358836][ T7644] loop7: detected capacity change from 0 to 33792 [ 179.424303][ T7644] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 179.517318][ T7644] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 179.595500][ T26] kauditd_printk_skb: 242 callbacks suppressed [ 179.595514][ T26] audit: type=1804 audit(1794581420.720:267): pid=7644 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.1028" name="/newroot/3/file1/bus" dev="loop7" ino=18 res=1 errno=0 [ 179.795592][ T7666] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1033'. [ 180.332439][ T7683] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1036'. [ 180.372835][ T7683] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1036'. [ 180.407141][ T7683] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 180.416706][ T7683] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 180.425489][ T7683] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 180.434286][ T7683] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 180.575708][ T7683] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1036'. [ 180.598567][ T7683] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1036'. [ 180.644080][ T7291] EXT4-fs (loop7): unmounting filesystem. [ 181.053060][ T7712] loop1: detected capacity change from 0 to 128 [ 181.101709][ T7712] FAT-fs (loop1): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 181.384953][ T33] FAT-fs (loop1): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 181.525216][ T7735] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1055'. [ 181.586523][ T7735] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.594490][ T7735] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.682044][ T7741] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1055'. [ 182.257018][ T4972] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 182.455538][ T4972] usb 7-1: not running at top speed; connect to a high speed hub [ 182.485280][ T4972] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 182.512271][ T4972] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 182.528087][ T4972] usb 7-1: config 1 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 182.574038][ T7782] loop7: detected capacity change from 0 to 128 [ 182.590087][ T4972] usb 7-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice= 1.00 [ 182.622314][ T4972] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.641853][ T4972] usb 7-1: Product: syz [ 182.646448][ T7782] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 182.657538][ T4972] usb 7-1: Manufacturer: syz [ 182.662507][ T4972] usb 7-1: SerialNumber: syz [ 182.686455][ T4972] keyspan 7-1:1.0: Keyspan 4 port adapter converter detected [ 182.699064][ T4972] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 88 [ 182.735530][ T4972] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 182.764874][ T4972] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 182.822639][ T4972] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 182.856053][ T4972] usb 7-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 182.895604][ T4388] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 183.225133][ T7763] Set syz1 is full, maxelem 6117 reached [ 183.251009][ T7801] netlink: 'syz.1.1068': attribute type 10 has an invalid length. [ 183.299647][ T7801] team0: Port device dummy0 added [ 183.363216][ T4951] usb 7-1: USB disconnect, device number 3 [ 183.390718][ T4951] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 183.410332][ T4951] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 183.436719][ T4951] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 183.467109][ T4951] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 183.509992][ T4951] keyspan 7-1:1.0: device disconnected [ 184.266886][ T7846] loop1: detected capacity change from 0 to 33280 [ 184.465831][ T7856] netlink: 27 bytes leftover after parsing attributes in process `syz.2.1087'. [ 184.525393][ T7852] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 184.762012][ T4972] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 184.908415][ T26] audit: type=1326 audit(1794581426.030:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7867 comm="syz.7.1093" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0527fa94d9 code=0x0 [ 184.963352][ T4972] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 184.982139][ T4972] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 185.001225][ T4972] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 185.030371][ T4972] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 185.053324][ T4972] usb 7-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 185.064818][ T4972] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.089897][ T7855] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 185.109863][ T7855] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 185.123965][ T4972] pl2303 7-1:1.0: pl2303 converter detected [ 185.136214][ T4972] usb 7-1: pl2303 converter now attached to ttyUSB0 [ 185.409175][ T7855] pl2303 7-1:1.0: pl2303_vendor_write - failed to write [0007]: -71 [ 185.409364][ T4972] usb 7-1: USB disconnect, device number 4 [ 185.422047][ T7855] pl2303 ttyUSB0: pl2303_get_line_request - failed: -19 [ 185.439991][ T7855] pl2303 ttyUSB0: pl2303_set_line_request - failed: -19 [ 185.449094][ T7855] pl2303 7-1:1.0: pl2303_vendor_read - failed to read [000a]: -19 [ 185.465588][ T7855] pl2303 ttyUSB0: failed to submit interrupt urb: -19 [ 185.488662][ T4972] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 185.509043][ T4972] pl2303 7-1:1.0: device disconnected [ 185.785393][ T7900] loop1: detected capacity change from 0 to 256 [ 185.891883][ T4292] Bluetooth: hci2: command 0x0406 tx timeout [ 185.892080][ T4280] Bluetooth: hci0: command 0x0406 tx timeout [ 185.897906][ T4292] Bluetooth: hci4: command 0x0406 tx timeout [ 185.963383][ T7913] TCP: tcp_parse_options: Illegal window scaling value 254 > 14 received [ 186.153814][ T7919] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 186.205371][ T7924] Invalid ELF header magic: != ELF [ 186.295883][ T7926] loop6: detected capacity change from 0 to 256 [ 186.332652][ T7926] exfat: Deprecated parameter 'utf8' [ 186.370133][ T7926] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xe3908169, utbl_chksum : 0xe619d30d) [ 186.711823][ T4974] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 186.905617][ T4974] usb 8-1: config 0 interface 0 altsetting 255 endpoint 0x4 has invalid maxpacket 12336, setting to 64 [ 186.931269][ T4974] usb 8-1: config 0 interface 0 has no altsetting 0 [ 186.945084][ T7952] loop6: detected capacity change from 0 to 512 [ 186.958083][ T4974] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 186.975611][ T4974] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 186.991373][ T4974] usb 8-1: Product: syz [ 186.994512][ T7952] FAT-fs (loop6): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 186.997719][ T4974] usb 8-1: Manufacturer: syz [ 187.017904][ T4974] usb 8-1: SerialNumber: syz [ 187.028506][ T4974] usb 8-1: config 0 descriptor?? [ 187.043176][ T7952] FAT-fs (loop6): Filesystem has been set read-only [ 187.049443][ T4974] usb 8-1: selecting invalid altsetting 0 [ 187.104482][ T7955] FAT-fs (loop6): error, fat_get_cluster: invalid start cluster (i_pos 0, start 22000003) [ 187.322503][ T7932] usb 8-1: cannot submit urb 0, error -8: unknown error [ 187.446912][ T7966] overlayfs: failed to clone lowerpath [ 187.772157][ T7985] loop6: detected capacity change from 0 to 16 [ 187.807721][ T7985] erofs: (device loop6): z_erofs_load_lz4_config: too large lz4 pclusterblks 16832 [ 188.952164][ T4972] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 189.019975][ T4954] usb 8-1: USB disconnect, device number 2 [ 189.153782][ T4972] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 189.178402][ T4972] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 189.215599][ T4972] usb 2-1: config 0 descriptor?? [ 189.230541][ T4972] cp210x 2-1:0.0: cp210x converter detected [ 189.335494][ T4292] Bluetooth: hci3: command 0x0406 tx timeout [ 189.636059][ T4972] cp210x 2-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 189.665263][ T4972] usb 2-1: cp210x converter now attached to ttyUSB0 [ 189.859067][ T4974] usb 2-1: USB disconnect, device number 10 [ 189.912633][ T4974] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 189.942473][ T4974] cp210x 2-1:0.0: device disconnected [ 190.234398][ T8071] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1153'. [ 190.513504][ T8077] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 190.530985][ C0] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 190.539060][ T8077] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 190.552050][ C0] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 191.089528][ T8099] ip_tables: iptables: counters copy to user failed while replacing table [ 191.136863][ T8104] ip_tables: iptables: counters copy to user failed while replacing table [ 191.166454][ T8101] loop7: detected capacity change from 0 to 33280 [ 191.279458][ T8101] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 191.394334][ T8101] ext4 filesystem being mounted at /24/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 191.499569][ T8101] EXT4-fs (loop7): shut down requested (2) [ 191.631498][ T7291] EXT4-fs (loop7): unmounting filesystem. [ 191.766115][ T26] audit: type=1326 audit(1794581432.890:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8125 comm="syz.6.1169" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7aff7a94d9 code=0x0 [ 192.289606][ T8120] loop1: detected capacity change from 0 to 40427 [ 192.319549][ T8120] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 192.337310][ T8120] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 192.378569][ T8120] F2FS-fs (loop1): invalid crc value [ 192.439215][ T8120] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 9809626597) [ 192.603620][ T8120] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 192.610707][ T8120] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 192.769175][ T8149] ip_tables: iptables: counters copy to user failed while replacing table [ 192.808595][ T8152] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 192.844790][ T8152] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 192.870499][ T8152] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 192.913840][ T8152] device bridge_slave_0 left promiscuous mode [ 192.920121][ T8152] bridge0: port 1(bridge_slave_0) entered disabled state [ 192.926641][ T8156] loop6: detected capacity change from 0 to 33792 [ 192.986754][ T8161] loop7: detected capacity change from 0 to 164 [ 193.010475][ T8152] device bridge_slave_1 left promiscuous mode [ 193.015514][ T8156] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 193.064377][ T8152] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.169335][ T8152] bond0: (slave bond_slave_0): Releasing backup interface [ 193.254873][ T8152] bond0: (slave bond_slave_1): Releasing backup interface [ 193.317801][ T8156] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 193.465381][ T26] audit: type=1804 audit(1794581434.590:270): pid=8156 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.1171" name="/newroot/51/file1/bus" dev="loop6" ino=18 res=1 errno=0 [ 193.468965][ T8173] loop7: detected capacity change from 0 to 33280 [ 193.502805][ T8152] team0: Port device team_slave_0 removed [ 193.536716][ T8152] team0: Port device team_slave_1 removed [ 193.562967][ T8152] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 193.570742][ T8152] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 193.588549][ T8152] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 193.618690][ T8173] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 193.650384][ T8173] ext4 filesystem being mounted at /29/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 193.660740][ T8152] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 193.777116][ T8152] bond1: (slave bridge1): Releasing backup interface [ 193.829137][ T8152] device bridge1 left promiscuous mode [ 193.918284][ T7291] EXT4-fs (loop7): unmounting filesystem. [ 193.924948][ T8152] bond3: (slave vti0): Releasing backup interface [ 193.953660][ T6848] EXT4-fs (loop6): unmounting filesystem. [ 194.057461][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.063856][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.882226][ T4951] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 195.065957][ T8229] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 195.081861][ T4951] usb 7-1: Using ep0 maxpacket: 8 [ 195.091951][ T4951] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 195.121919][ T4951] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 195.139705][ T4951] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.159191][ T4951] usb 7-1: config 0 descriptor?? [ 195.267140][ T8229] team0: Port device dummy0 removed [ 195.286868][ T8229] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 195.318984][ T8229] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 195.347334][ T8229] device veth0 left promiscuous mode [ 195.367561][ T8229] bridge0: port 3(veth0) entered disabled state [ 195.380637][ T4951] iowarrior 7-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 195.423783][ T8229] device bridge_slave_0 left promiscuous mode [ 195.452027][ T8229] bridge0: port 1(bridge_slave_0) entered disabled state [ 195.504168][ T8229] device bridge_slave_1 left promiscuous mode [ 195.518244][ T8229] bridge0: port 2(bridge_slave_1) entered disabled state [ 195.531036][ T8229] bond0: (slave bond_slave_0): Releasing backup interface [ 195.576009][ T8229] bond0: (slave bond_slave_1): Releasing backup interface [ 195.636849][ T8229] team0: Port device team_slave_0 removed [ 195.703963][ T8229] team0: Port device team_slave_1 removed [ 195.710426][ T8229] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 195.752143][ T8229] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 195.762457][ T8255] loop7: detected capacity change from 0 to 256 [ 195.805040][ T8255] exfat: Deprecated parameter 'utf8' [ 195.883002][ T8255] exfat: Deprecated parameter 'namecase' [ 195.931589][ T129] usb 7-1: USB disconnect, device number 5 [ 195.967624][ T8255] exfat: Deprecated parameter 'namecase' [ 195.998813][ T8255] exfat: Deprecated parameter 'utf8' [ 196.042644][ T8255] exFAT-fs (loop7): failed to load upcase table (idx : 0x00012153, chksum : 0xc9bffc20, utbl_chksum : 0xe619d30d) [ 197.501258][ T8317] rxe_eth0 speed is unknown, defaulting to 1000 [ 198.017549][ T8334] device team0 entered promiscuous mode [ 198.034671][ T8334] device team_slave_0 entered promiscuous mode [ 198.073239][ T8334] device team_slave_1 entered promiscuous mode [ 198.098066][ T8334] device dummy0 entered promiscuous mode [ 198.128229][ T8333] device team0 left promiscuous mode [ 198.150638][ T8333] device team_slave_0 left promiscuous mode [ 198.178648][ T8333] device team_slave_1 left promiscuous mode [ 198.198292][ T8333] device dummy0 left promiscuous mode [ 199.029250][ T26] audit: type=1326 audit(1794581440.150:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8354 comm="syz.7.1230" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0527fa94d9 code=0x0 [ 199.269826][ T8372] FAULT_INJECTION: forcing a failure. [ 199.269826][ T8372] name failslab, interval 1, probability 0, space 0, times 0 [ 199.371927][ T8372] CPU: 1 PID: 8372 Comm: syz.1.1236 Not tainted syzkaller #0 [ 199.379364][ T8372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 199.389444][ T8372] Call Trace: [ 199.392745][ T8372] [ 199.395695][ T8372] dump_stack_lvl+0x188/0x24e [ 199.400406][ T8372] ? show_regs_print_info+0x12/0x12 [ 199.405639][ T8372] ? load_image+0x410/0x410 [ 199.410168][ T8372] ? __might_sleep+0xd0/0xd0 [ 199.414777][ T8372] ? __lock_acquire+0x7ea0/0x7ea0 [ 199.419800][ T8372] should_fail_ex+0x390/0x4c0 [ 199.424487][ T8372] should_failslab+0x5/0x20 [ 199.429010][ T8372] slab_pre_alloc_hook+0x59/0x300 [ 199.434065][ T8372] ? percpu_ref_init+0xc0/0x340 [ 199.438952][ T8372] __kmem_cache_alloc_node+0x4f/0x270 [ 199.444352][ T8372] ? percpu_ref_init+0xc0/0x340 [ 199.449232][ T8372] ? percpu_ref_put+0x230/0x230 [ 199.454101][ T8372] kmalloc_trace+0x26/0xe0 [ 199.458545][ T8372] percpu_ref_init+0xc0/0x340 [ 199.463258][ T8372] ioctx_alloc+0x20d/0x7b0 [ 199.467709][ T8372] __se_sys_io_setup+0x7b/0x190 [ 199.472592][ T8372] do_syscall_64+0x4c/0xa0 [ 199.477040][ T8372] ? clear_bhb_loop+0x60/0xb0 [ 199.481743][ T8372] ? clear_bhb_loop+0x60/0xb0 [ 199.486452][ T8372] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 199.492370][ T8372] RIP: 0033:0x7f664c5a94d9 [ 199.496804][ T8372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.516440][ T8372] RSP: 002b:00007f664d3a8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 199.524884][ T8372] RAX: ffffffffffffffda RBX: 00007f664c825fa0 RCX: 00007f664c5a94d9 [ 199.532884][ T8372] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000008 [ 199.540882][ T8372] RBP: 00007f664c63804e R08: 0000000000000000 R09: 0000000000000000 [ 199.548890][ T8372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 199.556897][ T8372] R13: 00007f664c826038 R14: 00007f664c825fa0 R15: 00007fff0ba1a878 [ 199.564915][ T8372] [ 200.199361][ T8405] netlink: 'syz.7.1245': attribute type 1 has an invalid length. [ 200.290333][ T8405] 8021q: adding VLAN 0 to HW filter on device bond1 [ 200.364760][ T8407] bond1: (slave geneve2): making interface the new active one [ 200.410331][ T8407] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 200.455369][ T4398] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 200.614019][ T8407] syz.7.1245 (8407) used greatest stack depth: 20704 bytes left [ 200.948063][ T8446] loop1: detected capacity change from 0 to 33792 [ 201.001115][ T8446] EXT4-fs: Ignoring removed mblk_io_submit option [ 201.109335][ T8446] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 202.133126][ T4275] EXT4-fs (loop1): unmounting filesystem. [ 203.447888][ T8577] fuse: Bad value for 'fd' [ 203.673094][ T4975] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 203.873753][ T4975] usb 2-1: Using ep0 maxpacket: 8 [ 203.881666][ T4975] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 203.924922][ T4975] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 203.944994][ T4975] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.003222][ T4975] usb 2-1: config 0 descriptor?? [ 204.008859][ T8604] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1296'. [ 204.136259][ T8613] overlayfs: failed to clone upperpath [ 204.240564][ T4975] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 204.334965][ T8618] overlayfs: failed to clone upperpath [ 204.494685][ T4975] usb 2-1: USB disconnect, device number 11 [ 204.578490][ T8626] input input14: cannot allocate more than FF_MAX_EFFECTS effects [ 204.914625][ T8639] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1307'. [ 207.126325][ T8723] 9pnet: p9_errstr2errno: server reported unknown error  [ 207.157312][ T4975] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 207.242946][ T8731] loop7: detected capacity change from 0 to 8 [ 207.268787][ T8731] SQUASHFS error: lzo decompression failed, data probably corrupt [ 207.286476][ T8731] SQUASHFS error: Failed to read block 0x28d: -5 [ 207.301883][ T8731] SQUASHFS error: Unable to read metadata cache entry [28b] [ 207.324714][ T8731] SQUASHFS error: Unable to read inode 0x11f [ 207.343988][ T4975] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 207.358629][ T4975] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 207.363805][ T26] audit: type=1326 audit(1794581448.480:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8732 comm="syz.2.1345" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa4003a94d9 code=0x0 [ 207.375386][ T4975] usb 7-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 207.406306][ T4975] usb 7-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 207.415465][ T4975] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.466979][ T8731] loop7: detected capacity change from 0 to 2048 [ 207.476770][ T8731] UDF-fs: error (device loop7): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 207.491126][ T8731] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 207.858501][ T4975] cxacru 7-1:1.0: send of cm 0x91 failed (-71) [ 207.876828][ T4975] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 207.894335][ T4975] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 207.916157][ T4975] cxacru: probe of 7-1:1.0 failed with error -71 [ 207.940758][ T4975] usb 7-1: USB disconnect, device number 6 [ 207.996410][ T8745] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1350'. [ 208.142676][ T8750] loop1: detected capacity change from 0 to 64 [ 208.858598][ T8785] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1365'. [ 209.351422][ T8801] size and base must be multiples of 4 kiB [ 209.357430][ T8801] CPU: 1 PID: 8801 Comm: syz.1.1369 Not tainted syzkaller #0 [ 209.364823][ T8801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 209.374899][ T8801] Call Trace: [ 209.378200][ T8801] [ 209.381150][ T8801] dump_stack_lvl+0x188/0x24e [ 209.385877][ T8801] ? show_regs_print_info+0x12/0x12 [ 209.391104][ T8801] ? load_image+0x410/0x410 [ 209.395634][ T8801] ? __lock_acquire+0x7ea0/0x7ea0 [ 209.400692][ T8801] mtrr_add+0x8e/0xc0 [ 209.404703][ T8801] mtrr_ioctl+0x9bf/0x1140 [ 209.409149][ T8801] ? mtrr_close+0x1f0/0x1f0 [ 209.413687][ T8801] ? __fget_files+0x28/0x460 [ 209.418313][ T8801] ? mtrr_close+0x1f0/0x1f0 [ 209.422843][ T8801] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 209.428324][ T8801] ? proc_reg_poll+0x280/0x280 [ 209.433105][ T8801] __se_sys_ioctl+0xfa/0x170 [ 209.437724][ T8801] do_syscall_64+0x4c/0xa0 [ 209.442173][ T8801] ? clear_bhb_loop+0x60/0xb0 [ 209.446880][ T8801] ? clear_bhb_loop+0x60/0xb0 [ 209.451584][ T8801] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 209.457501][ T8801] RIP: 0033:0x7f664c5a94d9 [ 209.461931][ T8801] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.481557][ T8801] RSP: 002b:00007f664d3a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 209.489998][ T8801] RAX: ffffffffffffffda RBX: 00007f664c825fa0 RCX: 00007f664c5a94d9 [ 209.497997][ T8801] RDX: 0000200000000b80 RSI: 00000000400c4d01 RDI: 0000000000000003 [ 209.505994][ T8801] RBP: 00007f664c63804e R08: 0000000000000000 R09: 0000000000000000 [ 209.513988][ T8801] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 209.521982][ T8801] R13: 00007f664c826038 R14: 00007f664c825fa0 R15: 00007fff0ba1a878 [ 209.529990][ T8801] [ 210.064173][ T8790] loop6: detected capacity change from 0 to 40427 [ 210.099551][ T8790] F2FS-fs (loop6): Wrong secs_per_zone / total_sections (262145, 24) [ 210.118159][ T8790] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 210.132292][ T4391] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 210.146073][ T8790] F2FS-fs (loop6): invalid crc value [ 210.167617][ T8790] F2FS-fs (loop6): invalid crc value [ 210.183372][ T8790] F2FS-fs (loop6): Failed to get valid F2FS checkpoint [ 210.343658][ T4391] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 210.374352][ T4391] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 210.397441][ T8829] FAULT_INJECTION: forcing a failure. [ 210.397441][ T8829] name fail_futex, interval 1, probability 0, space 0, times 1 [ 210.410681][ T8829] CPU: 0 PID: 8829 Comm: syz.7.1377 Not tainted syzkaller #0 [ 210.415343][ T4391] usb 2-1: New USB device found, idVendor=9710, idProduct=7810, bcdDevice= 1.00 [ 210.418055][ T8829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 210.437157][ T8829] Call Trace: [ 210.440454][ T8829] [ 210.443400][ T8829] dump_stack_lvl+0x188/0x24e [ 210.448121][ T8829] ? show_regs_print_info+0x12/0x12 [ 210.453351][ T8829] ? load_image+0x410/0x410 [ 210.457898][ T8829] should_fail_ex+0x390/0x4c0 [ 210.462617][ T8829] futex_lock_pi_atomic+0x117/0xcb0 [ 210.467759][ T4391] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 210.467830][ T8829] ? pi_state_update_owner+0x340/0x340 [ 210.481273][ T8829] ? futex_setup_timer+0xc0/0xc0 [ 210.486244][ T8829] futex_lock_pi+0x227/0x9e0 [ 210.490863][ T8829] ? futex_wait_queue+0x134/0x1b0 [ 210.495908][ T8829] ? fixup_pi_state_owner+0x5e0/0x5e0 [ 210.496868][ T4391] usb 2-1: Product: syz [ 210.501307][ T8829] ? file_end_write+0x156/0x250 [ 210.501330][ T8829] ? vfs_write+0x777/0x9a0 [ 210.514755][ T8829] do_futex+0x27f/0x320 [ 210.518943][ T8829] ? __ia32_sys_get_robust_list+0x100/0x100 [ 210.521760][ T4391] usb 2-1: Manufacturer: syz [ 210.524845][ T8829] __se_sys_futex+0x381/0x410 [ 210.534114][ T8829] ? __x64_sys_futex+0xf0/0xf0 [ 210.538910][ T8829] ? __x64_sys_futex+0x1d/0xf0 [ 210.543695][ T8829] do_syscall_64+0x4c/0xa0 [ 210.548133][ T8829] ? clear_bhb_loop+0x60/0xb0 [ 210.552829][ T8829] ? clear_bhb_loop+0x60/0xb0 [ 210.557526][ T8829] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 210.563443][ T8829] RIP: 0033:0x7f0527fa94d9 [ 210.567871][ T8829] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 210.584457][ T4391] mos7840 2-1:1.0: Moschip 7840/7820 USB Serial Driver converter detected [ 210.587476][ T8829] RSP: 002b:00007f0528efe028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 210.604403][ T8829] RAX: ffffffffffffffda RBX: 00007f0528225fa0 RCX: 00007f0527fa94d9 [ 210.612400][ T8829] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000 [ 210.620388][ T8829] RBP: 00007f052803804e R08: 0000000000000000 R09: 0000000000000000 [ 210.628377][ T8829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 210.636371][ T8829] R13: 00007f0528226038 R14: 00007f0528225fa0 R15: 00007ffcd82f3268 [ 210.644373][ T8829] [ 210.647470][ C0] vkms_vblank_simulate: vblank timer overrun [ 210.687816][ T8835] netlink: 'syz.6.1378': attribute type 4 has an invalid length. [ 210.809167][ T8837] netlink: 'syz.6.1378': attribute type 4 has an invalid length. [ 211.801133][ T4391] mos7840: probe of ttyUSB0 failed with error -71 [ 211.853176][ T4391] usb 2-1: USB disconnect, device number 12 [ 211.917321][ T4391] mos7840 2-1:1.0: device disconnected [ 212.336795][ T8904] netlink: 'syz.2.1396': attribute type 1 has an invalid length. [ 213.360112][ T8961] FAULT_INJECTION: forcing a failure. [ 213.360112][ T8961] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 213.375769][ T8961] CPU: 0 PID: 8961 Comm: syz.1.1408 Not tainted syzkaller #0 [ 213.383179][ T8961] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 213.393256][ T8961] Call Trace: [ 213.396549][ T8961] [ 213.399498][ T8961] dump_stack_lvl+0x188/0x24e [ 213.404216][ T8961] ? show_regs_print_info+0x12/0x12 [ 213.409454][ T8961] ? load_image+0x410/0x410 [ 213.413988][ T8961] ? __lock_acquire+0x7ea0/0x7ea0 [ 213.419038][ T8961] ? __lock_acquire+0x1359/0x7ea0 [ 213.424099][ T8961] should_fail_ex+0x390/0x4c0 [ 213.428811][ T8961] prepare_alloc_pages+0x1e1/0x5b0 [ 213.433967][ T8961] __alloc_pages+0x130/0x4f0 [ 213.438603][ T8961] ? zone_statistics+0x170/0x170 [ 213.443573][ T8961] ? verify_lock_unused+0x140/0x140 [ 213.448782][ T8961] __folio_alloc+0xe/0x30 [ 213.453111][ T8961] vma_alloc_folio+0x499/0x900 [ 213.457874][ T8961] ? mpol_shared_policy_lookup+0x147/0x1e0 [ 213.463682][ T8961] shmem_alloc_and_acct_folio+0x463/0xbd0 [ 213.469415][ T8961] ? shmem_replace_folio+0xdc0/0xdc0 [ 213.474716][ T8961] ? xas_load+0x119/0x140 [ 213.479042][ T8961] ? __filemap_get_folio+0x10f/0xde0 [ 213.484332][ T8961] ? __filemap_get_folio+0xb43/0xde0 [ 213.489617][ T8961] ? __filemap_get_folio+0x10f/0xde0 [ 213.494901][ T8961] ? page_cache_prev_miss+0x380/0x380 [ 213.500289][ T8961] ? _raw_spin_lock_irq+0xb7/0xf0 [ 213.505315][ T8961] ? _raw_spin_unlock_irq+0x1f/0x40 [ 213.510510][ T8961] ? lockdep_hardirqs_on+0x94/0x140 [ 213.515710][ T8961] shmem_get_folio_gfp+0x1439/0x35e0 [ 213.521022][ T8961] shmem_write_begin+0xee/0x3f0 [ 213.525880][ T8961] generic_perform_write+0x2fa/0x5c0 [ 213.531180][ T8961] ? generic_file_direct_write+0x330/0x330 [ 213.536987][ T8961] ? __file_remove_privs+0x5f0/0x5f0 [ 213.542269][ T8961] ? rwsem_write_trylock+0x135/0x1c0 [ 213.547551][ T8961] ? clear_nonspinnable+0x60/0x60 [ 213.552571][ T8961] ? generic_write_checks_count+0x363/0x440 [ 213.558466][ T8961] __generic_file_write_iter+0x148/0x2a0 [ 213.564099][ T8961] generic_file_write_iter+0xab/0x2e0 [ 213.569470][ T8961] __kernel_write_iter+0x298/0x690 [ 213.574580][ T8961] ? vfs_read+0x960/0x960 [ 213.578901][ T8961] ? rcu_read_lock_any_held+0xb0/0x130 [ 213.584381][ T8961] ? common_file_perm+0x171/0x1c0 [ 213.589409][ T8961] ? iov_iter_kvec+0x4a/0x1f0 [ 213.594090][ T8961] kernel_write+0x1b1/0x350 [ 213.598595][ T8961] ? __kernel_write+0x170/0x170 [ 213.603447][ T8961] ? __shmem_file_setup+0x1ee/0x290 [ 213.608646][ T8961] big_key_preparse+0x3cb/0x4c0 [ 213.613500][ T8961] ? keyctl_pkey_verify+0x430/0x430 [ 213.618699][ T8961] ? key_task_permission+0x360/0x4a0 [ 213.623982][ T8961] key_update+0x209/0x530 [ 213.628309][ T8961] ? lookup_user_key_possessed+0x40/0x40 [ 213.633937][ T8961] ? __key_update+0x440/0x440 [ 213.638611][ T8961] ? search_process_keyrings_rcu+0x360/0x360 [ 213.644590][ T8961] ? _copy_from_user+0x11/0x170 [ 213.649440][ T8961] ? copy_user_enhanced_fast_string+0xa/0x40 [ 213.655428][ T8961] keyctl_update_key+0xf0/0x120 [ 213.660272][ T8961] __se_sys_keyctl+0x2d8/0x870 [ 213.665031][ T8961] ? __x64_sys_keyctl+0xc0/0xc0 [ 213.669874][ T8961] ? do_futex+0x2e2/0x320 [ 213.674207][ T8961] ? __ia32_sys_get_robust_list+0x100/0x100 [ 213.680092][ T8961] ? slab_free_freelist_hook+0x133/0x1b0 [ 213.685732][ T8961] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 213.691722][ T8961] ? lock_chain_count+0x20/0x20 [ 213.696577][ T8961] ? lockdep_hardirqs_on+0x94/0x140 [ 213.701768][ T8961] ? __x64_sys_keyctl+0x1c/0xc0 [ 213.706615][ T8961] do_syscall_64+0x4c/0xa0 [ 213.711028][ T8961] ? clear_bhb_loop+0x60/0xb0 [ 213.715705][ T8961] ? clear_bhb_loop+0x60/0xb0 [ 213.720379][ T8961] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 213.726271][ T8961] RIP: 0033:0x7f664c5a94d9 [ 213.730679][ T8961] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 213.750276][ T8961] RSP: 002b:00007f664d3a8028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 213.758684][ T8961] RAX: ffffffffffffffda RBX: 00007f664c825fa0 RCX: 00007f664c5a94d9 [ 213.766651][ T8961] RDX: 0000200000000e00 RSI: 00000000116d195e RDI: 0000000000000002 [ 213.774613][ T8961] RBP: 00007f664c63804e R08: 0000000000000000 R09: 0000000000000000 [ 213.782579][ T8961] R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000000 [ 213.790541][ T8961] R13: 00007f664c826038 R14: 00007f664c825fa0 R15: 00007fff0ba1a878 [ 213.798550][ T8961] [ 214.045057][ T8972] loop1: detected capacity change from 0 to 8192 [ 214.069810][ T8972] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 214.503087][ T8870] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 215.657645][ T9014] loop6: detected capacity change from 0 to 32768 [ 215.780386][ T9014] XFS (loop6): Mounting V5 Filesystem [ 215.951612][ T9056] overlayfs: failed to clone upperpath [ 215.976867][ T9014] XFS (loop6): Ending clean mount [ 216.003353][ T9014] XFS (loop6): Quotacheck needed: Please wait. [ 216.136553][ T9014] XFS (loop6): Quotacheck: Done. [ 216.238351][ T9067] device macvlan0 entered promiscuous mode [ 216.637779][ T6848] XFS (loop6): Unmounting Filesystem [ 216.916817][ T9092] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 216.984296][ T4951] libceph: connect (1)0.0.0.0:6789 error -22 [ 217.027504][ T4951] libceph: mon0 (1)0.0.0.0:6789 connect error [ 217.051524][ T129] libceph: connect (1)127.0.0.1:6789 error -101 [ 217.061614][ T129] libceph: mon0 (1)127.0.0.1:6789 connect error [ 217.304129][ T4951] libceph: connect (1)0.0.0.0:6789 error -22 [ 217.310262][ T4951] libceph: mon0 (1)0.0.0.0:6789 connect error [ 217.352052][ T129] libceph: connect (1)127.0.0.1:6789 error -101 [ 217.358450][ T129] libceph: mon0 (1)127.0.0.1:6789 connect error [ 217.431364][ T9123] device geneve1 entered promiscuous mode [ 217.581646][ T9127] overlayfs: failed to clone upperpath [ 217.763091][ T9095] ceph: No mds server is up or the cluster is laggy [ 217.763091][ T9101] ceph: No mds server is up or the cluster is laggy [ 217.855972][ T4356] libceph: connect (1)0.0.0.0:6789 error -22 [ 217.872661][ T4356] libceph: mon0 (1)0.0.0.0:6789 connect error [ 217.881928][ T129] libceph: connect (1)127.0.0.1:6789 error -101 [ 217.907741][ T129] libceph: mon0 (1)127.0.0.1:6789 connect error [ 218.201889][ T9144] 9pnet: p9_errstr2errno: server reported unknown error 0x0000 [ 219.096758][ T9178] netlink: 'syz.7.1466': attribute type 4 has an invalid length. [ 219.187765][ T9183] netlink: 'syz.7.1466': attribute type 4 has an invalid length. [ 219.595098][ T26] audit: type=1326 audit(1794581460.720:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 219.691826][ T26] audit: type=1326 audit(1794581460.720:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 219.782421][ T26] audit: type=1326 audit(1794581460.760:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 219.853782][ T26] audit: type=1326 audit(1794581460.760:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 219.939723][ T26] audit: type=1326 audit(1794581460.760:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 220.047946][ T26] audit: type=1326 audit(1794581460.760:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f74c0ba9242 code=0x7ffc0000 [ 220.157140][ T26] audit: type=1326 audit(1794581460.770:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f74c0b69d0e code=0x7ffc0000 [ 220.211687][ T9221] FAULT_INJECTION: forcing a failure. [ 220.211687][ T9221] name failslab, interval 1, probability 0, space 0, times 0 [ 220.231821][ T26] audit: type=1326 audit(1794581460.800:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f74c0ba9307 code=0x7ffc0000 [ 220.279784][ T9221] CPU: 0 PID: 9221 Comm: syz.6.1482 Not tainted syzkaller #0 [ 220.287204][ T9221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 220.297276][ T9221] Call Trace: [ 220.300572][ T9221] [ 220.303516][ T9221] dump_stack_lvl+0x188/0x24e [ 220.308314][ T9221] ? show_regs_print_info+0x12/0x12 [ 220.313546][ T9221] ? load_image+0x410/0x410 [ 220.318075][ T9221] ? __lock_acquire+0x7ea0/0x7ea0 [ 220.323134][ T9221] should_fail_ex+0x390/0x4c0 [ 220.327840][ T9221] should_failslab+0x5/0x20 [ 220.332362][ T9221] slab_pre_alloc_hook+0x59/0x300 [ 220.337404][ T9221] ? __lock_acquire+0x7ea0/0x7ea0 [ 220.342449][ T9221] ? anon_vma_name_alloc+0x37/0xb0 [ 220.347579][ T9221] __kmem_cache_alloc_node+0x4f/0x270 [ 220.352956][ T9221] ? anon_vma_name_alloc+0x37/0xb0 [ 220.358061][ T9221] __kmalloc+0xa3/0x240 [ 220.362212][ T9221] ? _copy_from_user+0x10b/0x170 [ 220.367151][ T9221] anon_vma_name_alloc+0x37/0xb0 [ 220.372083][ T9221] prctl_set_vma+0x185/0x2e0 [ 220.376674][ T9221] __se_sys_prctl+0x162/0x1100 [ 220.381443][ T9221] ? __x64_sys_prctl+0xc0/0xc0 [ 220.386209][ T9221] ? lockdep_hardirqs_on+0x94/0x140 [ 220.391403][ T9221] ? __x64_sys_prctl+0x1c/0xc0 [ 220.396173][ T9221] do_syscall_64+0x4c/0xa0 [ 220.400587][ T9221] ? clear_bhb_loop+0x60/0xb0 [ 220.405261][ T9221] ? clear_bhb_loop+0x60/0xb0 [ 220.409941][ T9221] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 220.415842][ T9221] RIP: 0033:0x7f7aff7a94d9 [ 220.420252][ T9221] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 220.439854][ T9221] RSP: 002b:00007f7b0071f028 EFLAGS: 00000246 ORIG_RAX: 000000000000009d [ 220.448260][ T9221] RAX: ffffffffffffffda RBX: 00007f7affa25fa0 RCX: 00007f7aff7a94d9 [ 220.456225][ T9221] RDX: 0000200000ffa000 RSI: 0000000000000000 RDI: 0000000053564d41 [ 220.464189][ T9221] RBP: 00007f7aff83804e R08: 0000200000000100 R09: 0000000000000000 [ 220.472168][ T9221] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000 [ 220.480216][ T9221] R13: 00007f7affa26038 R14: 00007f7affa25fa0 R15: 00007ffe92cd3628 [ 220.488367][ T9221] [ 220.533738][ T26] audit: type=1326 audit(1794581460.800:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f74c0b69d0e code=0x7ffc0000 [ 220.621770][ T26] audit: type=1326 audit(1794581460.800:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9200 comm="syz.0.1472" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f74c0b69d0e code=0x7ffc0000 [ 221.464459][ T9265] FAULT_INJECTION: forcing a failure. [ 221.464459][ T9265] name failslab, interval 1, probability 0, space 0, times 0 [ 221.511992][ T9265] CPU: 1 PID: 9265 Comm: syz.6.1492 Not tainted syzkaller #0 [ 221.519410][ T9265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 221.529499][ T9265] Call Trace: [ 221.532794][ T9265] [ 221.535821][ T9265] dump_stack_lvl+0x188/0x24e [ 221.540530][ T9265] ? show_regs_print_info+0x12/0x12 [ 221.545755][ T9265] ? load_image+0x410/0x410 [ 221.550284][ T9265] ? __lock_acquire+0x7ea0/0x7ea0 [ 221.555345][ T9265] should_fail_ex+0x390/0x4c0 [ 221.560047][ T9265] should_failslab+0x5/0x20 [ 221.564566][ T9265] slab_pre_alloc_hook+0x59/0x300 [ 221.569617][ T9265] ? io_alloc_hash_table+0x2d/0xb0 [ 221.574748][ T9265] __kmem_cache_alloc_node+0x4f/0x270 [ 221.580159][ T9265] ? io_alloc_hash_table+0x2d/0xb0 [ 221.585271][ T9265] __kmalloc+0xa3/0x240 [ 221.589430][ T9265] io_alloc_hash_table+0x2d/0xb0 [ 221.594374][ T9265] io_ring_ctx_alloc+0x130/0xc85 [ 221.599312][ T9265] io_uring_create+0x29f/0xd6c [ 221.604070][ T9265] ? __might_fault+0xc2/0x120 [ 221.608739][ T9265] ? __might_fault+0xa6/0x120 [ 221.613411][ T9265] __x64_sys_io_uring_setup+0x21b/0x230 [ 221.618956][ T9265] ? __ia32_sys_io_uring_enter+0xf0/0xf0 [ 221.624597][ T9265] ? lockdep_hardirqs_on+0x94/0x140 [ 221.629790][ T9265] do_syscall_64+0x4c/0xa0 [ 221.634204][ T9265] ? clear_bhb_loop+0x60/0xb0 [ 221.638876][ T9265] ? clear_bhb_loop+0x60/0xb0 [ 221.643555][ T9265] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 221.649441][ T9265] RIP: 0033:0x7f7aff7a94d9 [ 221.653851][ T9265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 221.673448][ T9265] RSP: 002b:00007f7b0071efb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 221.681857][ T9265] RAX: ffffffffffffffda RBX: 00002000000001c0 RCX: 00007f7aff7a94d9 [ 221.689819][ T9265] RDX: 0000200000000280 RSI: 00002000000001c0 RDI: 0000000000000021 [ 221.697785][ T9265] RBP: 00007f7aff83804e R08: 0000000000000000 R09: 0000000000000000 [ 221.705907][ T9265] R10: 00002000000002c0 R11: 0000000000000206 R12: 0000200000000280 [ 221.713870][ T9265] R13: 00002000000002c0 R14: 0000200000000240 R15: 00007ffe92cd3628 [ 221.721848][ T9265] [ 222.298934][ T9287] 9pnet_fd: p9_fd_create_unix (9287): problem connecting socket: ./file0: -111 [ 223.217677][ T9332] netlink: 'syz.0.1515': attribute type 4 has an invalid length. [ 223.248236][ T9332] netlink: 'syz.0.1515': attribute type 4 has an invalid length. [ 223.324274][ T9337] ecryptfs_parse_options: eCryptfs: unrecognized option [eccipher=aes] [ 223.344244][ T9337] ecryptfs_mount: kern_path() failed [ 223.368687][ T9337] Reading sb failed; rc = [-20] [ 223.984424][ T9371] netlink: 'syz.2.1529': attribute type 4 has an invalid length. [ 224.036892][ T9371] netlink: 'syz.2.1529': attribute type 4 has an invalid length. [ 224.157916][ T9374] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 224.989952][ T9403] overlayfs: failed to clone upperpath [ 225.127285][ T9409] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.1544'. [ 225.546145][ T9392] ceph: No mds server is up or the cluster is laggy [ 225.557639][ T9395] ceph: No mds server is up or the cluster is laggy [ 225.616455][ T9421] loop7: detected capacity change from 0 to 32768 [ 225.695119][ T9421] XFS (loop7): Mounting V5 Filesystem [ 225.810048][ T9421] XFS (loop7): Ending clean mount [ 226.109333][ T7291] XFS (loop7): Unmounting Filesystem [ 226.127637][ T9421] syz.7.1550 (9421) used greatest stack depth: 20496 bytes left [ 226.421628][ T9447] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 227.164827][ T9491] loop6: detected capacity change from 0 to 256 [ 228.613007][ T9547] netlink: 27 bytes leftover after parsing attributes in process `syz.6.1588'. [ 228.874478][ T9554] kvm: emulating exchange as write [ 229.165379][ T9569] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1595'. [ 229.431554][ T9584] ip_tables: iptables: counters copy to user failed while replacing table [ 229.653121][ T9595] netlink: 194236 bytes leftover after parsing attributes in process `syz.1.1604'. [ 229.695070][ T9595] netlink: zone id is out of range [ 229.721159][ T9595] netlink: zone id is out of range [ 229.731248][ T9595] netlink: get zone limit has 8 unknown bytes [ 230.003675][ T9616] FAULT_INJECTION: forcing a failure. [ 230.003675][ T9616] name failslab, interval 1, probability 0, space 0, times 0 [ 230.073132][ T9616] CPU: 0 PID: 9616 Comm: syz.6.1612 Not tainted syzkaller #0 [ 230.080557][ T9616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 230.090636][ T9616] Call Trace: [ 230.093929][ T9616] [ 230.096880][ T9616] dump_stack_lvl+0x188/0x24e [ 230.101591][ T9616] ? show_regs_print_info+0x12/0x12 [ 230.106825][ T9616] ? load_image+0x410/0x410 [ 230.111354][ T9616] ? __might_sleep+0xd0/0xd0 [ 230.115966][ T9616] ? __lock_acquire+0x7ea0/0x7ea0 [ 230.121463][ T9616] should_fail_ex+0x390/0x4c0 [ 230.126183][ T9616] should_failslab+0x5/0x20 [ 230.130716][ T9616] slab_pre_alloc_hook+0x59/0x300 [ 230.135809][ T9616] ? pkcs7_parse_message+0xf2/0x520 [ 230.141043][ T9616] __kmem_cache_alloc_node+0x4f/0x270 [ 230.142023][ T4292] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 230.146426][ T9616] ? pkcs7_parse_message+0xf2/0x520 [ 230.161573][ T9616] kmalloc_trace+0x26/0xe0 [ 230.166011][ T9616] pkcs7_parse_message+0xf2/0x520 [ 230.171061][ T9616] verify_pkcs7_signature+0x2c/0x90 [ 230.176283][ T9616] pkcs7_preparse+0x87/0xb0 [ 230.180803][ T9616] ? pkcs7_preparse+0xb0/0xb0 [ 230.185500][ T9616] key_create_or_update+0x405/0xa50 [ 230.190721][ T9616] ? key_type_put+0x20/0x20 [ 230.195250][ T9616] ? __check_object_size+0x86/0xa70 [ 230.200456][ T9616] ? strncpy_from_user+0x1dc/0x340 [ 230.205614][ T9616] __se_sys_add_key+0x34b/0x410 [ 230.210474][ T9616] ? __x64_sys_add_key+0xc0/0xc0 [ 230.215418][ T9616] ? lockdep_hardirqs_on+0x94/0x140 [ 230.220613][ T9616] ? __x64_sys_add_key+0x1c/0xc0 [ 230.225557][ T9616] do_syscall_64+0x4c/0xa0 [ 230.229986][ T9616] ? clear_bhb_loop+0x60/0xb0 [ 230.234668][ T9616] ? clear_bhb_loop+0x60/0xb0 [ 230.239344][ T9616] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 230.245243][ T9616] RIP: 0033:0x7f7aff7a94d9 [ 230.249655][ T9616] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 230.269256][ T9616] RSP: 002b:00007f7b0071f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 230.277664][ T9616] RAX: ffffffffffffffda RBX: 00007f7affa25fa0 RCX: 00007f7aff7a94d9 [ 230.285630][ T9616] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000240 [ 230.293595][ T9616] RBP: 00007f7aff83804e R08: ffffffffffffffff R09: 0000000000000000 [ 230.301559][ T9616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 230.309521][ T9616] R13: 00007f7affa26038 R14: 00007f7affa25fa0 R15: 00007ffe92cd3628 [ 230.317524][ T9616] [ 230.325098][ T4292] CPU: 1 PID: 4292 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 230.333041][ T4292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 230.343122][ T4292] Workqueue: hci0 hci_rx_work [ 230.347812][ T4292] Call Trace: [ 230.351107][ T4292] [ 230.354043][ T4292] dump_stack_lvl+0x188/0x24e [ 230.358735][ T4292] ? show_regs_print_info+0x12/0x12 [ 230.363951][ T4292] ? load_image+0x410/0x410 [ 230.368476][ T4292] sysfs_create_dir_ns+0x26a/0x290 [ 230.373599][ T4292] ? __lock_acquire+0x7ea0/0x7ea0 [ 230.378638][ T4292] ? sysfs_warn_dup+0xa0/0xa0 [ 230.383321][ T4292] ? do_raw_spin_unlock+0x11d/0x230 [ 230.388516][ T4292] kobject_add_internal+0x617/0xca0 [ 230.393717][ T4292] kobject_add+0x160/0x230 [ 230.398142][ T4292] ? kobject_init+0x1c0/0x1c0 [ 230.402820][ T4292] ? __raw_spin_lock_init+0x41/0x100 [ 230.408104][ T4292] ? klist_children_get+0x50/0x50 [ 230.413135][ T4292] ? get_device_parent+0x121/0x3e0 [ 230.418246][ T4292] device_add+0x470/0x1050 [ 230.422666][ T4292] hci_conn_add_sysfs+0xd1/0x1e0 [ 230.427603][ T4292] le_conn_complete_evt+0x10db/0x17c0 [ 230.432984][ T4292] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 230.439225][ T4292] ? __copy_skb_header+0x3ba/0x4f0 [ 230.444331][ T4292] ? memcpy+0x3c/0x60 [ 230.448310][ T4292] ? skb_pull_data+0xec/0x1f0 [ 230.452990][ T4292] hci_le_conn_complete_evt+0x183/0x440 [ 230.458542][ T4292] hci_event_packet+0x61f/0xe60 [ 230.463395][ T4292] ? hci_remote_host_features_evt+0x230/0x230 [ 230.469454][ T4292] ? bis_list+0x280/0x280 [ 230.473776][ T4292] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 230.479667][ T4292] ? kcov_remote_start+0x50f/0x810 [ 230.484774][ T4292] ? lockdep_hardirqs_on+0x94/0x140 [ 230.489968][ T4292] ? hci_send_to_monitor+0x9c/0x4a0 [ 230.495162][ T4292] hci_rx_work+0x3eb/0xd40 [ 230.499571][ T4292] ? _raw_spin_unlock+0x40/0x40 [ 230.504435][ T4292] ? process_one_work+0x7b4/0x1160 [ 230.509540][ T4292] process_one_work+0x8ab/0x1160 [ 230.514487][ T4292] ? worker_detach_from_pool+0x240/0x240 [ 230.520118][ T4292] ? _raw_spin_lock_irq+0xb7/0xf0 [ 230.525137][ T4292] ? _raw_spin_lock_irqsave+0x100/0x100 [ 230.530680][ T4292] ? wq_worker_running+0x97/0x190 [ 230.535697][ T4292] worker_thread+0xaf5/0x12a0 [ 230.540379][ T4292] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 230.546277][ T4292] kthread+0x29d/0x330 [ 230.550337][ T4292] ? worker_clr_flags+0x1a0/0x1a0 [ 230.555358][ T4292] ? kthread_blkcg+0xd0/0xd0 [ 230.559942][ T4292] ret_from_fork+0x1f/0x30 [ 230.564371][ T4292] [ 230.574433][ T4292] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 230.587946][ T4292] Bluetooth: hci0: failed to register connection device [ 230.644310][ T9622] netlink: 'syz.0.1614': attribute type 3 has an invalid length. [ 230.652255][ T9622] netlink: 'syz.0.1614': attribute type 1 has an invalid length. [ 230.659994][ T9622] netlink: 198032 bytes leftover after parsing attributes in process `syz.0.1614'. [ 230.965347][ T9630] user requested TSC rate below hardware speed [ 231.004032][ T9630] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 231.055799][ T9639] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 231.861838][ T4974] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 232.045309][ T4974] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 232.088325][ T4974] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 232.158582][ T9651] loop7: detected capacity change from 0 to 131072 [ 232.160441][ T4974] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 232.181688][ T9651] F2FS-fs (loop7): invalid crc value [ 232.197122][ T9651] F2FS-fs (loop7): Found nat_bits in checkpoint [ 232.262658][ T9651] F2FS-fs (loop7): Cannot turn on quotas: -2 on 2 [ 232.281947][ T9651] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e4 [ 232.299936][ T4974] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 232.336848][ T9671] fuse: Bad value for 'fd' [ 232.349897][ T4974] usb 7-1: SerialNumber: syz [ 232.375381][ T9674] ip_tables: iptables: counters copy to user failed while replacing table [ 232.594112][ T4974] usb 7-1: 0:2 : does not exist [ 232.599095][ T4974] usb 7-1: unit 2 not found! [ 232.717035][ T4974] usb 7-1: USB disconnect, device number 7 [ 232.994001][ T9338] udevd[9338]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 233.793498][ T9725] netlink: 240 bytes leftover after parsing attributes in process `syz.2.1648'. [ 234.062924][ T9735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1652'. [ 234.184364][ T9738] netlink: 143828 bytes leftover after parsing attributes in process `syz.0.1654'. [ 234.231858][ T9738] netlink: del zone limit has 4 unknown bytes [ 234.427266][ T9749] overlayfs: failed to clone upperpath [ 235.560793][ T9781] loop6: detected capacity change from 0 to 49152 [ 235.671381][ T9781] EXT4-fs (loop6): mounted filesystem with ordered data mode. Quota mode: none. [ 235.945890][ T6848] EXT4-fs (loop6): unmounting filesystem. [ 237.270620][ T9834] rxe_eth0 speed is unknown, defaulting to 1000 [ 237.522872][ T9855] rxe_eth0 speed is unknown, defaulting to 1000 [ 238.243165][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88807c22ac00: rx timeout, send abort [ 238.631981][ T4974] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 238.743267][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88807c229400: rx timeout, send abort [ 238.753466][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88807c22ac00: abort rx timeout. Force session deactivation [ 238.813509][ T4974] usb 7-1: New USB device found, idVendor=086a, idProduct=0100, bcdDevice= 0.01 [ 238.849504][ T4974] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.885115][ T4974] emi26 - firmware loader 7-1:1.0: emi26_probe start [ 238.910078][ T4974] usb 7-1: Direct firmware load for emi26/loader.fw failed with error -2 [ 238.931517][ T4974] usb 7-1: Falling back to sysfs fallback for: emi26/loader.fw [ 238.950027][ T9904] fuse: Bad value for 'fd' [ 239.092246][ T9881] firmware emi26!loader.fw: firmware_loading_store: unexpected value (0) [ 239.135620][ T4974] usb 7-1: emi26_load_firmware - request_firmware() failed [ 239.154746][ T4974] usb 7-1: emi26_load_firmware - error loading firmware: error = -2 [ 239.181295][ T4974] emi26 - firmware loader: probe of 7-1:1.0 failed with error -5 [ 239.227359][ T4974] usb 7-1: USB disconnect, device number 8 [ 239.251671][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88807c229400: abort rx timeout. Force session deactivation [ 240.708483][ T9957] FAULT_INJECTION: forcing a failure. [ 240.708483][ T9957] name failslab, interval 1, probability 0, space 0, times 0 [ 240.758540][ T9957] CPU: 1 PID: 9957 Comm: syz.6.1732 Not tainted syzkaller #0 [ 240.765971][ T9957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 240.776046][ T9957] Call Trace: [ 240.779337][ T9957] [ 240.782278][ T9957] dump_stack_lvl+0x188/0x24e [ 240.786984][ T9957] ? show_regs_print_info+0x12/0x12 [ 240.792212][ T9957] ? load_image+0x410/0x410 [ 240.796741][ T9957] ? __might_sleep+0xd0/0xd0 [ 240.801353][ T9957] ? __lock_acquire+0x7ea0/0x7ea0 [ 240.806404][ T9957] should_fail_ex+0x390/0x4c0 [ 240.811127][ T9957] should_failslab+0x5/0x20 [ 240.815652][ T9957] slab_pre_alloc_hook+0x59/0x300 [ 240.820699][ T9957] ? current_cpuset_is_being_rebound+0x19/0x300 [ 240.826965][ T9957] kmem_cache_alloc+0x56/0x2f0 [ 240.831748][ T9957] ? mpol_set_shared_policy+0xb2/0xe80 [ 240.837232][ T9957] mpol_set_shared_policy+0xb2/0xe80 [ 240.842530][ T9957] ? mbind_range+0x3bd/0x750 [ 240.847126][ T9957] ? mbind_range+0x4cb/0x750 [ 240.851715][ T9957] vma_replace_policy+0x1ae/0x2c0 [ 240.856747][ T9957] __se_sys_mbind+0x5f2/0x810 [ 240.861422][ T9957] ? __ia32_sys_get_robust_list+0x100/0x100 [ 240.867319][ T9957] ? __x64_sys_mbind+0xf0/0xf0 [ 240.872110][ T9957] ? lock_chain_count+0x20/0x20 [ 240.876966][ T9957] ? __x64_sys_mbind+0x1d/0xf0 [ 240.881738][ T9957] do_syscall_64+0x4c/0xa0 [ 240.886155][ T9957] ? clear_bhb_loop+0x60/0xb0 [ 240.890830][ T9957] ? clear_bhb_loop+0x60/0xb0 [ 240.895506][ T9957] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 240.901395][ T9957] RIP: 0033:0x7f7aff7a94d9 [ 240.905805][ T9957] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.925406][ T9957] RSP: 002b:00007f7b0071f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed [ 240.933824][ T9957] RAX: ffffffffffffffda RBX: 00007f7affa25fa0 RCX: 00007f7aff7a94d9 [ 240.941794][ T9957] RDX: 0000000000000005 RSI: 0000000000600000 RDI: 0000200000000000 [ 240.949760][ T9957] RBP: 00007f7aff83804e R08: 0000000000000008 R09: 0000000000000000 [ 240.957725][ T9957] R10: 0000200000000480 R11: 0000000000000246 R12: 0000000000000000 [ 240.965687][ T9957] R13: 00007f7affa26038 R14: 00007f7affa25fa0 R15: 00007ffe92cd3628 [ 240.973665][ T9957] [ 242.343388][ T26] kauditd_printk_skb: 14 callbacks suppressed [ 242.343403][ T26] audit: type=1800 audit(1794581483.470:297): pid=9979 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.1741" name="alua_access_type" dev="configfs" ino=51974 res=0 errno=0 [ 242.579122][ T9994] loop6: detected capacity change from 0 to 33280 [ 242.598349][ T9994] EXT4-fs: Ignoring removed bh option [ 242.621988][ T9994] EXT4-fs: Ignoring removed i_version option [ 242.649427][ T9994] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 242.732069][ T9994] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 242.744067][ T9994] ext4 filesystem being mounted at /141/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 242.885706][T10006] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1751'. [ 243.046316][ T6848] EXT4-fs (loop6): unmounting filesystem. [ 243.160182][T10017] "syz.6.1753" (10017) uses obsolete ecb(arc4) skcipher [ 243.384692][T10025] "syz.6.1755" (10025) uses obsolete ecb(arc4) skcipher [ 243.594026][ T26] audit: type=1800 audit(1794581484.720:298): pid=10032 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1756" name="alua_access_type" dev="configfs" ino=52019 res=0 errno=0 [ 244.601720][ C0] sched: RT throttling activated [ 245.058334][T10076] loop6: detected capacity change from 0 to 33280 [ 245.099558][T10076] EXT4-fs (loop6): orphan cleanup on readonly fs [ 245.106144][ T4974] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 245.126426][T10076] EXT4-fs (loop6): Cannot turn on journaled quota: type 0: error -13 [ 245.142188][T10076] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 245.250345][T10084] kAFS: No cell specified [ 245.255474][T10076] EXT4-fs error (device loop6): ext4_clear_blocks:883: inode #13: comm syz.6.1764: attempt to clear invalid blocks 2 len 1 [ 245.311936][ T4974] usb 8-1: Using ep0 maxpacket: 16 [ 245.318891][ T4974] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 245.337298][ T4974] usb 8-1: config 0 has no interface number 0 [ 245.354015][ T4974] usb 8-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 245.367501][T10076] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #13: comm syz.6.1764: invalid indirect mapped block 1819239214 (level 0) [ 245.391848][ T4974] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.419263][T10076] EXT4-fs error (device loop6): ext4_free_branches:1030: inode #13: comm syz.6.1764: invalid indirect mapped block 1819239214 (level 1) [ 245.420701][ T4974] usb 8-1: Product: syz [ 245.463236][T10076] EXT4-fs (loop6): 1 truncate cleaned up [ 245.464587][ T4974] usb 8-1: Manufacturer: syz [ 245.479991][T10076] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 245.494568][ T4974] usb 8-1: SerialNumber: syz [ 245.514879][ T4974] usb 8-1: config 0 descriptor?? [ 245.534457][ T4974] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 245.553800][T10076] EXT4-fs error (device loop6): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz.6.1764: bad entry in directory: inode out of bounds - offset=24, inode=85, rec_len=20, size=1024 fake=0 [ 245.674552][ T6848] EXT4-fs (loop6): unmounting filesystem. [ 246.105683][T10105] netlink: 104 bytes leftover after parsing attributes in process `syz.6.1777'. [ 246.342858][T10116] sctp: [Deprecated]: syz.6.1782 (pid 10116) Use of struct sctp_assoc_value in delayed_ack socket option. [ 246.342858][T10116] Use struct sctp_sack_info instead [ 246.547967][T10124] smc: removing ib device rxe0 [ 246.657099][ T8514] RDS/IB: rds_ib_setup_qp failed (-95) [ 246.680309][ T77] RDS/IB: rds_ib_setup_qp failed (-95) [ 246.708241][ T9] RDS/IB: rds_ib_setup_qp failed (-95) [ 246.741491][ T4974] gspca_spca1528: reg_w err -71 [ 246.756683][ T4974] spca1528: probe of 8-1:0.1 failed with error -71 [ 246.807186][ T4974] usb 8-1: USB disconnect, device number 3 [ 247.126249][T10147] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1794'. [ 247.618879][T10166] blktrace: Concurrent blktraces are not allowed on loop14 [ 247.754099][T10168] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1804'. [ 248.223979][T10183] loop7: detected capacity change from 0 to 33280 [ 248.528320][T10195] netlink: 4768 bytes leftover after parsing attributes in process `syz.7.1817'. [ 249.219715][T10215] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 249.637832][T10235] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 249.644914][T10235] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 249.682082][T10237] vhci_hcd: xmit failed -107 [ 249.698726][T10235] vhci_hcd vhci_hcd.0: Device attached [ 249.732917][ T8514] vhci_hcd: stop threads [ 249.737201][ T8514] vhci_hcd: release socket [ 249.775151][ T8514] vhci_hcd: disconnect device [ 250.415999][T10275] overlayfs: failed to clone lowerpath [ 251.677815][ T26] audit: type=1326 audit(1794581492.800:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 251.755115][ T26] audit: type=1326 audit(1794581492.800:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 251.867455][ T26] audit: type=1326 audit(1794581492.830:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 251.976861][ T26] audit: type=1326 audit(1794581492.830:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 252.074080][ T26] audit: type=1326 audit(1794581492.830:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 252.161153][ T26] audit: type=1326 audit(1794581492.840:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 252.261949][ T26] audit: type=1326 audit(1794581492.840:305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 252.332029][ T26] audit: type=1326 audit(1794581492.840:306): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 252.458355][ T26] audit: type=1326 audit(1794581492.840:307): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 252.532780][ T26] audit: type=1326 audit(1794581492.840:308): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10318 comm="syz.0.1860" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74c0ba94d9 code=0x7ffc0000 [ 253.147082][T10360] overlayfs: failed to clone lowerpath [ 253.964186][T10363] loop6: detected capacity change from 0 to 32768 [ 254.150441][T10363] XFS (loop6): Mounting V5 Filesystem [ 254.288561][T10363] XFS (loop6): Ending clean mount [ 254.749256][ T6848] XFS (loop6): Unmounting Filesystem [ 254.894529][ T4280] Bluetooth: Unknown LE signaling command 0xf9 [ 254.903524][ T4280] Bluetooth: Wrong link type (-22) [ 255.494756][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.501299][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.709492][T10424] loop6: detected capacity change from 0 to 32768 [ 256.774712][T10424] JBD2: Ignoring recovery information on journal [ 256.856538][T10424] ocfs2: Mounting device (7,6) on (node local, slot 0) with ordered data mode. [ 256.888215][ T8514] (kworker/u4:24,8514,0):ocfs2_read_blocks_sync:112 ERROR: status = -12 [ 256.904520][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 256.904534][ T26] audit: type=1800 audit(1794581498.030:313): pid=10424 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1897" name="file1" dev="loop6" ino=17058 res=0 errno=0 [ 256.979358][ T8514] (kworker/u4:24,8514,1):ocfs2_read_locked_inode:570 ERROR: status = -12 [ 257.021784][ T8514] (kworker/u4:24,8514,1):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #72: rec_len is smaller than minimal - offset=256, inode=0, rec_len=0, name_len=0 [ 257.277342][T10432] (syz.6.1897,10432,0):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #72: rec_len is smaller than minimal - offset=0, inode=1099511627848, rec_len=12, name_len=0 [ 257.355495][T10432] (syz.6.1897,10432,1):__ocfs2_delete_entry:1223 ERROR: status = -5 [ 257.364000][T10432] (syz.6.1897,10432,1):ocfs2_orphan_del:2390 ERROR: status = -5 [ 257.371670][T10432] (syz.6.1897,10432,1):ocfs2_orphan_del:2405 ERROR: status = -5 [ 257.380016][T10432] (syz.6.1897,10432,1):ocfs2_del_inode_from_orphan:2738 ERROR: status = -5 [ 257.389907][T10432] (syz.6.1897,10432,1):ocfs2_dio_end_io_write:2418 ERROR: status = -5 [ 257.537454][ T6848] ocfs2: Unmounting device (7,6) on (node local) [ 258.327975][T10450] sctp: [Deprecated]: syz.0.1906 (pid 10450) Use of struct sctp_assoc_value in delayed_ack socket option. [ 258.327975][T10450] Use struct sctp_sack_info instead [ 258.918561][T10462] loop6: detected capacity change from 0 to 8 [ 258.997115][T10462] SQUASHFS error: lzo decompression failed, data probably corrupt [ 259.052749][T10462] SQUASHFS error: Failed to read block 0x91: -5 [ 259.059193][T10462] SQUASHFS error: Unable to read metadata cache entry [8f] [ 259.096023][T10462] SQUASHFS error: Unable to read inode 0x11f [ 259.238459][T10462] syz.6.1913 (10462) used greatest stack depth: 19600 bytes left [ 259.818639][T10481] loop6: detected capacity change from 0 to 33280 [ 259.867746][T10481] EXT4-fs error (device loop6): ext4_xattr_inode_iget:401: inode #12: comm syz.6.1921: missing EA_INODE flag [ 259.894177][T10481] EXT4-fs error (device loop6): ext4_xattr_inode_iget:406: comm syz.6.1921: error while reading EA inode 12 err=-117 [ 259.957706][T10481] EXT4-fs (loop6): 1 orphan inode deleted [ 260.010911][T10481] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 260.334096][ T6848] EXT4-fs (loop6): unmounting filesystem. [ 260.408925][T10487] fuse: Bad value for 'fd' [ 260.586240][T10491] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1925'. [ 261.680333][T10503] bridge0: port 3(syz_tun) entered blocking state [ 261.707932][T10503] bridge0: port 3(syz_tun) entered disabled state [ 261.757218][T10503] device syz_tun entered promiscuous mode [ 263.928645][T10557] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1941'. [ 263.938608][T10557] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1941'. [ 264.687519][T10579] 9pnet: p9_errstr2errno: server reported unknown error ents [ 265.555769][T10605] netlink: 3568 bytes leftover after parsing attributes in process `syz.0.1961'. [ 266.077597][T10617] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1967'. [ 266.543665][ T4292] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 266.568439][ T4292] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 266.578448][ T4292] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 266.586804][ T4292] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 266.596124][ T4292] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 266.604065][ T4292] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 266.669819][T10627] rxe_eth0 speed is unknown, defaulting to 1000 [ 266.694576][T10627] rxe_eth0 speed is unknown, defaulting to 1000 [ 266.732184][T10627] rxe_eth0 speed is unknown, defaulting to 1000 [ 266.878988][T10635] FAULT_INJECTION: forcing a failure. [ 266.878988][T10635] name failslab, interval 1, probability 0, space 0, times 0 [ 266.962103][T10635] CPU: 0 PID: 10635 Comm: syz.6.1973 Not tainted syzkaller #0 [ 266.969623][T10635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 266.979703][T10635] Call Trace: [ 266.982999][T10635] [ 266.985943][T10635] dump_stack_lvl+0x188/0x24e [ 266.990653][T10635] ? show_regs_print_info+0x12/0x12 [ 266.995897][T10635] ? load_image+0x410/0x410 [ 267.000438][T10635] ? __might_sleep+0xd0/0xd0 [ 267.005080][T10635] ? __lock_acquire+0x7ea0/0x7ea0 [ 267.010134][T10635] should_fail_ex+0x390/0x4c0 [ 267.014835][T10635] should_failslab+0x5/0x20 [ 267.019354][T10635] slab_pre_alloc_hook+0x59/0x300 [ 267.024417][T10635] ? __request_module+0x31c/0xa00 [ 267.029471][T10635] __kmem_cache_alloc_node+0x4f/0x270 [ 267.034865][T10635] ? __request_module+0x31c/0xa00 [ 267.039918][T10635] kmalloc_trace+0x26/0xe0 [ 267.044353][T10635] __request_module+0x31c/0xa00 [ 267.049245][T10635] ? copy_regset_to_user+0x1f0/0x1f0 [ 267.054572][T10635] ? __lock_acquire+0x7ea0/0x7ea0 [ 267.059625][T10635] ? rcu_read_unlock+0x8c/0xa0 [ 267.064423][T10635] inet_create+0x3e0/0xf60 [ 267.068860][T10635] ? inet_create+0x9e/0xf60 [ 267.073380][T10635] __sock_create+0x49a/0x940 [ 267.077984][T10635] __sys_socket+0xc4/0x190 [ 267.082404][T10635] __x64_sys_socket+0x76/0x80 [ 267.087080][T10635] do_syscall_64+0x4c/0xa0 [ 267.091493][T10635] ? clear_bhb_loop+0x60/0xb0 [ 267.096169][T10635] ? clear_bhb_loop+0x60/0xb0 [ 267.100844][T10635] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 267.106768][T10635] RIP: 0033:0x7f7aff7a94d9 [ 267.111183][T10635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.130825][T10635] RSP: 002b:00007f7b0071f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 267.139247][T10635] RAX: ffffffffffffffda RBX: 00007f7affa25fa0 RCX: 00007f7aff7a94d9 [ 267.147218][T10635] RDX: 0000000000000106 RSI: 0000000000080805 RDI: 0000000000000002 [ 267.155187][T10635] RBP: 00007f7aff83804e R08: 0000000000000000 R09: 0000000000000000 [ 267.163154][T10635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 267.171121][T10635] R13: 00007f7affa26038 R14: 00007f7affa25fa0 R15: 00007ffe92cd3628 [ 267.179104][T10635] [ 267.341943][T10627] infiniband rxe0: set active [ 267.346682][T10627] infiniband rxe0: added rxe_eth0 [ 267.353551][ T129] rxe_eth0 speed is unknown, defaulting to 1000 [ 267.461577][T10627] RDS/IB: rxe0: added [ 267.516930][T10627] smc: adding ib device rxe0 with port count 1 [ 267.541174][T10627] smc: ib device rxe0 port 1 has pnetid [ 267.551933][ T129] rxe_eth0 speed is unknown, defaulting to 1000 [ 267.561574][T10627] rxe_eth0 speed is unknown, defaulting to 1000 [ 267.820321][T10627] rxe_eth0 speed is unknown, defaulting to 1000 [ 267.914129][ T4280] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 267.945294][ T4293] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 267.954619][ T4293] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 267.967633][ T4293] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 267.980631][ T4293] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 267.990013][ T4293] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 268.044054][T10660] overlayfs: overlapping lowerdir path [ 268.066896][T10659] overlayfs: overlapping lowerdir path [ 268.136380][T10662] fuse: Bad value for 'fd' [ 268.228205][T10627] rxe_eth0 speed is unknown, defaulting to 1000 [ 268.578185][T10656] rxe_eth0 speed is unknown, defaulting to 1000 [ 268.692067][ T4292] Bluetooth: hci0: command 0x0409 tx timeout [ 268.696323][ T4293] Bluetooth: hci1: command 0x0406 tx timeout [ 268.751221][T10681] 9pnet_fd: Insufficient options for proto=fd [ 268.878182][T10627] rxe_eth0 speed is unknown, defaulting to 1000 [ 268.882363][T10684] loop6: detected capacity change from 0 to 16 [ 268.973555][T10684] erofs: (device loop6): mounted with root inode @ nid 36. [ 269.268874][T10627] rxe_eth0 speed is unknown, defaulting to 1000 [ 269.279880][T10656] chnl_net:caif_netlink_parms(): no params data found [ 269.456060][T10627] rxe_eth0 speed is unknown, defaulting to 1000 [ 269.555163][T10656] bridge0: port 1(bridge_slave_0) entered blocking state [ 269.596567][T10656] bridge0: port 1(bridge_slave_0) entered disabled state [ 269.610408][T10656] device bridge_slave_0 entered promiscuous mode [ 269.619135][T10656] bridge0: port 2(bridge_slave_1) entered blocking state [ 269.626510][T10656] bridge0: port 2(bridge_slave_1) entered disabled state [ 269.635009][T10656] device bridge_slave_1 entered promiscuous mode [ 269.675374][T10656] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 269.708066][T10656] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 269.819469][T10656] team0: Port device team_slave_0 added [ 269.853735][T10656] team0: Port device team_slave_1 added [ 269.927651][T10656] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 269.948647][T10656] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 270.016573][T10656] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 270.051914][ T4292] Bluetooth: hci5: command 0x0409 tx timeout [ 270.072365][T10656] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 270.079339][T10656] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 270.112116][T10656] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 270.318611][T10656] device hsr_slave_0 entered promiscuous mode [ 270.368787][T10656] device hsr_slave_1 entered promiscuous mode [ 270.395698][T10656] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 270.433212][T10656] Cannot create hsr debugfs directory [ 270.456922][T10716] IPVS: Scheduler module ip_vs_ not found [ 270.545175][T10627] chnl_net:caif_netlink_parms(): no params data found [ 270.594842][ T4374] ------------[ cut here ]------------ [ 270.600655][ T4374] sysfs group 'byte_queue_limits' not found for kobject 'tx-0' [ 270.621944][ T4374] WARNING: CPU: 0 PID: 4374 at fs/sysfs/group.c:280 sysfs_remove_group+0x177/0x290 [ 270.631265][ T4374] Modules linked in: [ 270.635490][ T4374] CPU: 0 PID: 4374 Comm: kworker/0:7 Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 270.643042][ T4374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 270.653719][ T4374] Workqueue: events delete_netdev [ 270.659089][ T4374] RIP: 0010:sysfs_remove_group+0x177/0x290 [ 270.664977][ T4374] Code: 8b 1b 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 db f3 ca ff 49 8b 17 48 c7 c7 a0 7c bc 8a 48 89 de e8 b9 f1 44 ff <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 e3 8f 79 ff [ 270.684641][ T4374] RSP: 0018:ffffc900049b78e0 EFLAGS: 00010246 [ 270.690729][ T4374] RAX: d56ee42d9f2c1b00 RBX: ffffffff8bac6b60 RCX: ffff888032571e00 [ 270.698784][ T4374] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 270.706823][ T4374] RBP: 00000000000000a9 R08: ffffc900049b7567 R09: 1ffff92000936eac [ 270.714871][ T4374] R10: dffffc0000000000 R11: fffff52000936ead R12: 1ffffffff1758c80 [ 270.722901][ T4374] R13: dffffc0000000000 R14: ffff888057373d98 R15: ffff88807b9ebc20 [ 270.730889][ T4374] FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 [ 270.739893][ T4374] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 270.746526][ T4374] CR2: 0000001b3011dff8 CR3: 0000000062e2a000 CR4: 00000000003506f0 [ 270.754568][ T4374] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 270.762593][ T4374] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 270.770586][ T4374] Call Trace: [ 270.773931][ T4374] [ 270.776871][ T4374] ? netdev_queue_update_kobjects+0x3a2/0x480 [ 270.782083][ T4293] Bluetooth: hci0: command 0x041b tx timeout [ 270.782996][ T4374] netdev_queue_update_kobjects+0x3dd/0x480 [ 270.794905][ T4374] netdev_unregister_kobject+0x104/0x250 [ 270.800562][ T4374] unregister_netdevice_many_notify+0x14b6/0x1990 [ 270.807063][ T4374] ? unregister_netdevice_many+0x20/0x20 [ 270.812753][ T4374] ? __mutex_lock+0x858/0xb40 [ 270.817449][ T4374] ? __mutex_lock+0x3ba/0xb40 [ 270.822205][ T4374] unregister_netdevice_queue+0x2e5/0x330 [ 270.827944][ T4374] ? list_netdevice+0x640/0x640 [ 270.832863][ T4374] ? read_lock_is_recursive+0x10/0x10 [ 270.838253][ T4374] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 270.844223][ T4374] ? _raw_spin_unlock+0x40/0x40 [ 270.849087][ T4374] ? process_one_work+0x7b4/0x1160 [ 270.854266][ T4374] ? process_one_work+0x7b4/0x1160 [ 270.859401][ T4374] lowpan_unregister_netdev+0x18/0x20 [ 270.864859][ T4374] unregister_dev+0x70/0x1a0 [ 270.869469][ T4374] ? process_one_work+0x7b4/0x1160 [ 270.874656][ T4374] process_one_work+0x8ab/0x1160 [ 270.879635][ T4374] ? worker_detach_from_pool+0x240/0x240 [ 270.885340][ T4374] ? _raw_spin_lock_irq+0xb7/0xf0 [ 270.890382][ T4374] ? _raw_spin_lock_irqsave+0x100/0x100 [ 270.896002][ T4374] ? wq_worker_running+0x97/0x190 [ 270.901045][ T4374] worker_thread+0xaf5/0x12a0 [ 270.905795][ T4374] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 270.911750][ T4374] kthread+0x29d/0x330 [ 270.915833][ T4374] ? worker_clr_flags+0x1a0/0x1a0 [ 270.920875][ T4374] ? kthread_blkcg+0xd0/0xd0 [ 270.925535][ T4374] ret_from_fork+0x1f/0x30 [ 270.929984][ T4374] [ 270.933079][ T4374] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 270.940363][ T4374] CPU: 0 PID: 4374 Comm: kworker/0:7 Not tainted syzkaller #0 [ 270.947829][ T4374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 270.957897][ T4374] Workqueue: events delete_netdev [ 270.962940][ T4374] Call Trace: [ 270.966226][ T4374] [ 270.969163][ T4374] dump_stack_lvl+0x188/0x24e [ 270.973858][ T4374] ? memcpy+0x3c/0x60 [ 270.977847][ T4374] ? show_regs_print_info+0x12/0x12 [ 270.983069][ T4374] ? load_image+0x410/0x410 [ 270.987606][ T4374] panic+0x2d3/0x710 [ 270.991532][ T4374] ? bpf_jit_dump+0xd0/0xd0 [ 270.996061][ T4374] ? ret_from_fork+0x1f/0x30 [ 271.000672][ T4374] __warn+0x2f8/0x4f0 [ 271.004663][ T4374] ? sysfs_remove_group+0x177/0x290 [ 271.009879][ T4374] ? sysfs_remove_group+0x177/0x290 [ 271.015093][ T4374] report_bug+0x2ba/0x4f0 [ 271.019438][ T4374] ? sysfs_remove_group+0x177/0x290 [ 271.024659][ T4374] handle_bug+0x3a/0x70 [ 271.028826][ T4374] exc_invalid_op+0x16/0x40 [ 271.033337][ T4374] asm_exc_invalid_op+0x16/0x20 [ 271.038197][ T4374] RIP: 0010:sysfs_remove_group+0x177/0x290 [ 271.044021][ T4374] Code: 8b 1b 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 db f3 ca ff 49 8b 17 48 c7 c7 a0 7c bc 8a 48 89 de e8 b9 f1 44 ff <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 e3 8f 79 ff [ 271.063636][ T4374] RSP: 0018:ffffc900049b78e0 EFLAGS: 00010246 [ 271.069697][ T4374] RAX: d56ee42d9f2c1b00 RBX: ffffffff8bac6b60 RCX: ffff888032571e00 [ 271.077658][ T4374] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 271.085624][ T4374] RBP: 00000000000000a9 R08: ffffc900049b7567 R09: 1ffff92000936eac [ 271.093592][ T4374] R10: dffffc0000000000 R11: fffff52000936ead R12: 1ffffffff1758c80 [ 271.101561][ T4374] R13: dffffc0000000000 R14: ffff888057373d98 R15: ffff88807b9ebc20 [ 271.109542][ T4374] ? netdev_queue_update_kobjects+0x3a2/0x480 [ 271.115610][ T4374] netdev_queue_update_kobjects+0x3dd/0x480 [ 271.121519][ T4374] netdev_unregister_kobject+0x104/0x250 [ 271.127146][ T4374] unregister_netdevice_many_notify+0x14b6/0x1990 [ 271.133562][ T4374] ? unregister_netdevice_many+0x20/0x20 [ 271.139191][ T4374] ? __mutex_lock+0x858/0xb40 [ 271.143857][ T4374] ? __mutex_lock+0x3ba/0xb40 [ 271.148530][ T4374] unregister_netdevice_queue+0x2e5/0x330 [ 271.154244][ T4374] ? list_netdevice+0x640/0x640 [ 271.159086][ T4374] ? read_lock_is_recursive+0x10/0x10 [ 271.164459][ T4374] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 271.170343][ T4374] ? _raw_spin_unlock+0x40/0x40 [ 271.175199][ T4374] ? process_one_work+0x7b4/0x1160 [ 271.180305][ T4374] ? process_one_work+0x7b4/0x1160 [ 271.185406][ T4374] lowpan_unregister_netdev+0x18/0x20 [ 271.190780][ T4374] unregister_dev+0x70/0x1a0 [ 271.195365][ T4374] ? process_one_work+0x7b4/0x1160 [ 271.200467][ T4374] process_one_work+0x8ab/0x1160 [ 271.205405][ T4374] ? worker_detach_from_pool+0x240/0x240 [ 271.211040][ T4374] ? _raw_spin_lock_irq+0xb7/0xf0 [ 271.216053][ T4374] ? _raw_spin_lock_irqsave+0x100/0x100 [ 271.221595][ T4374] ? wq_worker_running+0x97/0x190 [ 271.226610][ T4374] worker_thread+0xaf5/0x12a0 [ 271.231289][ T4374] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 271.237180][ T4374] kthread+0x29d/0x330 [ 271.241234][ T4374] ? worker_clr_flags+0x1a0/0x1a0 [ 271.246244][ T4374] ? kthread_blkcg+0xd0/0xd0 [ 271.250824][ T4374] ret_from_fork+0x1f/0x30 [ 271.255246][ T4374] [ 271.258511][ T4374] Kernel Offset: disabled [ 271.262913][ T4374] Rebooting in 86400 seconds..