last executing test programs: 2m41.366046707s ago: executing program 0 (id=1): userfaultfd(0x80001) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_emit_vhci(0x0, 0x7) syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x101000) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x3ffff) newfstatat(0xffffffffffffff9c, &(0x7f0000000340)='./bus\x00', 0x0, 0x800) sendfile(r1, r0, 0x0, 0x7ffff000) 2m39.818257342s ago: executing program 0 (id=7): syz_mount_image$minix(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x1, &(0x7f0000000480)=ANY=[], 0x1, 0x185, &(0x7f0000000d80)="$eJzs28tOGnEUx/HfwHApvdHSS9J00VXTTRmgCW13+CgERkIclIgbiIn4Hm7c+XCycOdKDMPMCCMLVIZB+X42np+HyRwWfzghIABbq6YfMmQoPQnfs/mTgjHTHcY3GIDIjb2/N2MA2yd5HfcEAOIx2pG6ki6vjhtKpv214KtfTPo1v5/I3NsfRqfSN9PrG1m9Cu8X59JP/3ojt/D6XNB/vbD/S3nv/m/0Vu/0Xnl90EcVvH4zuP7LE7chAAC2g6FiOM/9I6HdtmOXgpxyc1k5c5rTbq4E/Wn+E+SMm4uNA6cZ4bMA8BgJFS9mc/j8J0Pn3/TOP4Dnr9cf7NUdxz5cU+F/PrDWm66m0HAjxlhJkdJGjEGxoDC1EWPE/MIEIHLWUadr9fqD3+1OvWW37P1qpVr9X/r3t2y5i781v/4DeEHu3vSXebQZ/UAAAAAAAAAAAAAAAODBPulz3CMAAAAAWJPIfkVkSDrT0t8sBgAAAAAAAAAAAAAAAAAAy7sNAAD//8TRGu4=") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x1204001, &(0x7f00000011c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}, 0x3a}], [], 0x2f}) chdir(&(0x7f00000001c0)='./file0\x00') mount$overlay(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f0000000780)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r1}, 0x4) r2 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000640)=@newqdisc={0xc0, 0x24, 0xf0b, 0x0, 0x1000000, {0x0, 0x0, 0x12, r3, {0x0, 0x300}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x90, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x1}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [], 0x0, [0x8, 0x4], [0x0, 0x0, 0x0, 0x0, 0xd645, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffff]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x2c, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x3f0000}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0xa}]}, {0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x6}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xbff3}]}]}]}}]}, 0xc0}, 0x1, 0x7a00}, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x10, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffe}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) chdir(&(0x7f0000000040)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x40000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) syz_mount_image$squashfs(&(0x7f0000000240), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[], 0x1, 0x228, &(0x7f0000000300)="$eJzKKC4sZmdgYPj7sSaZgUGAAQRYGEQYLjAwMrAwMDDIM4KFGD4yQeipUPomlGaDyl+B0r5Q8XYo/de8KiKKgYExU+meGdMB8RRFRgEGHpGvpx4wJDPwxzJYzvNecykoc8pVobdL94PUe4VWbmJgVE/hXzRnwwSnmbxgYxkjo5DNYT4gM4sDZBADA8PkPxH3HrBIMoggmSXK8U/sVMvyVWad9xlmdExLY2A0mMXBwMCgx8kw086AtxvsNBBRWZWdmJOTWlR8hgHV/MmM+5kUGUFKzvy9GvyA0Y6hm5+BkUFug7/a4m9/pCo3bqqPnF4VUTO1u+nm0vVxDNv0/14xkXo/MSPs/4NDgloWefkf5skofd/cMOdDTd0TE8fORuW5/K2X/757H1NbnKDG9Fi8q5CNP8FNq4aPwcnN8vHc9Or2LcWsDAwMLhOPTb34N+H4WgaGyRee2OrXnDkUrxjDKeVWOTfmrlu8INcy9fN1bxgYDkZ9nsjAuJxxPxMDw8ywnXvg/mKMjCpvgEYGAzMDA4MK2LMsDGmZOakGHgyMDMxQjiELVBVMNRMDB1hCLzk/J6WdgRGcBMDaljOwwM0wfMzACucYIXOMLRqgJjG0Q2kVKO0BpZdD6cdQWh4t2bCATeiH8jQaGBjYGCoSS0qKDNkYGKAsuJgRXMxIAG4zE9TWuUyonjvOxDAKRsEoGAWjYBSMglEwCkbBKBgFIxkAAgAA//9n5bTt") mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6d706f6c3d62690bbe608ae7a8e257d632a80e6e643a302d", @ANYRESDEC]) 2m37.858792159s ago: executing program 0 (id=9): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), r1) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)={0x40, r2, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x18}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x8810) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x0, {0x0, 0x0, 0x6, 0xffffffffffffffff, 0x7f, 0x0, {0x2, 0x20000000000000, 0x7, 0x1000007, 0x0, 0x0, 0xfffffffe, 0x8000000, 0x4, 0xa000, 0x10000, 0x0, 0x0, 0xa, 0x200000}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_CAP_SPLIT_IRQCHIP(r5, 0x4068aea3, &(0x7f0000000040)) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r7 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_ADD_MFC(r7, 0x29, 0xcc, &(0x7f0000000700)={{0xa, 0x4e22, 0x5, @mcast1, 0xfffffffc}, {0xa, 0x4e24, 0x8, @private1, 0x80000}, 0x1, {[0xc8, 0x6, 0x0, 0x1, 0x5, 0x3ad, 0x2, 0x1]}}, 0x5c) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r3) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000002c0)={[0x8aba, 0x4, 0x1004, 0x804, 0x5, 0xc, 0x120000, 0xff, 0xffffffffffffffff, 0x9, 0xffff, 0x4, 0x0, 0x105, 0x400000000000006, 0x5], 0x8000000, 0x141200}) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4400ae8f, &(0x7f0000000100)=@x86={0x40, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x8, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x80, '\x00', 0x0, 0x5}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2m36.31313701s ago: executing program 0 (id=14): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xd1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="150000001000000002"], 0x48) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pwrite64(r2, &(0x7f0000000140)="d21ebb80aa2611876edb5ea27ee66e1b5d7fced69b259d5e3be225f02ed85c1777459a84aaf373c1e3420cee8da3e28601121ec184deb90b90509c96a233f06ab1ad5f2d6af81a90928a4d2f48d38cb5d9d5aa1ba3c9178e24cb8baf88b3a1cc0a3622875016fce68662ff49b8cd363b8fe3c7f91a2b7f39e35c4b26a88ff1bb449269827c65459faa89246fb8bad0a3adec265403f97a4993a44937d7d69b313384a4dcc7ecfa3b", 0xa8, 0x2) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x6, &(0x7f00000013c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000003000000018120000", @ANYRES32=r1, @ANYBLOB="000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x19}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_NG_TYPE={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcc}}, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000000040000000000080000100850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000280)='netlink_extack\x00', r6}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@bridge_delneigh={0x1c, 0x1e, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}}, 0x1c}}, 0x24000090) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r8, 0x89f8, &(0x7f0000000000)) setsockopt$IP_VS_SO_SET_STARTDAEMON(r5, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'wlan0\x00', 0x2000000}, 0x18) syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0x3c, 0x3a, 0x0, @private2, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0x0, @empty, @ipv4={'\x00', '\xff\xff', @multicast1}, [], "17c17f079171000700840000"}}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 2m32.231235537s ago: executing program 32 (id=14): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xd1) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="150000001000000002"], 0x48) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) pwrite64(r2, &(0x7f0000000140)="d21ebb80aa2611876edb5ea27ee66e1b5d7fced69b259d5e3be225f02ed85c1777459a84aaf373c1e3420cee8da3e28601121ec184deb90b90509c96a233f06ab1ad5f2d6af81a90928a4d2f48d38cb5d9d5aa1ba3c9178e24cb8baf88b3a1cc0a3622875016fce68662ff49b8cd363b8fe3c7f91a2b7f39e35c4b26a88ff1bb449269827c65459faa89246fb8bad0a3adec265403f97a4993a44937d7d69b313384a4dcc7ecfa3b", 0xa8, 0x2) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x6, &(0x7f00000013c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000003000000018120000", @ANYRES32=r1, @ANYBLOB="000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x19}, @NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_NG_TYPE={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcc}}, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000000040000000000080000100850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f0000000280)='netlink_extack\x00', r6}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@bridge_delneigh={0x1c, 0x1e, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}}, 0x1c}}, 0x24000090) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r8, 0x89f8, &(0x7f0000000000)) setsockopt$IP_VS_SO_SET_STARTDAEMON(r5, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'wlan0\x00', 0x2000000}, 0x18) syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "e400ff", 0x3c, 0x3a, 0x0, @private2, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, '\x00', 0x0, 0x11, 0x0, @empty, @ipv4={'\x00', '\xff\xff', @multicast1}, [], "17c17f079171000700840000"}}}}}}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 35.363923489s ago: executing program 1 (id=114): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) keyctl$restrict_keyring(0x4, 0xfffffffffffffffc, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x0) r0 = landlock_create_ruleset(&(0x7f0000000140)={0x2000}, 0x10, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file3\x00', 0x6c6882, 0x13d) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000340)={0x2000, r1}, 0x0) landlock_restrict_self(r0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./file1/file3\x00', 0xffffffffffffff9c, 0x0, 0x2) 34.162536455s ago: executing program 1 (id=116): r0 = socket$inet6_udp(0xa, 0x2, 0x0) syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000000)='./bus\x00', 0x280008a, &(0x7f0000000240)=ANY=[@ANYBLOB='shortname=lower,shortname=win95,rodir,iocharset=default,uni_xlate=0,nonumtail=1,utf8=0,flush,rodir,shortname=win95,shortname=winnt,shortname=win95,showexec,uni_xlate=0,utf8=0,utf8=0,uni_xlate=0,shortname=mixed,\x00'], 0x97, 0x2ad, &(0x7f00000007c0)="$eJzs3b9rO2UYAPDn0jQJOiSCkwge6OD05dvv6pIiLRQzKRnUQYttQZogtFDwB8ZOri6Ori6C4OY/4eJ/ILgKbhYsnNzlrklqGpPatP74fJa+fe953nve69uWDvf03eeHxwdpHJ1/8lO0WknUutGNiyQ6UYvKZzGj+0UAAP9mF1kWv2Zjq+QlEdFaX1kAwBqt/Pv/u7WXBACs2RtvvvXadq+383qatmJ3+PlZP//LPv84vr59FO/HIA7jcbTjMiK7Mh7vZlk2qqe5Trw0HJ3188zhOz+U62//ElHkb0U7OsXUbP5eb2crHZvKH+V1PFXev5vnP4l2PDvn/nu9nSdz8qPfiJdfnKr/UbTjx/figxjEQVHEOD9qEZ9upemr2Ze/ffx2Xl6en4zO+s0ibiLbuOcvDQAAAAAAAAAAAAAAAAAAAAAA/2GPyt45zSj69+RTZf+djcv8k81IK53Z/jzj/KRa6Fp/oFEWX1X9eR6naZqVgZP8ejxXj/rD7BoAAAAAAAAAAAAAAAAAAAD+WU4//Oh4fzA4PLmTQdUNoHqt/7brdKdmXojFwc3JvWrlcMHKsVHFJBELy8g3sXTNv5dtD2736J65qeZvvl16na//eu/lYHOJmL85qE7X8X4y/xk2o5ppVYfk++mYRix5r8ZNl7KVjl9j7qX2yntvPF0MRgtiIllU2Cs/j59cOZNc30WjeKpz0zfLwVT6bExr+fOcf6f8SXLVrSO52x9CAAAAAAAAAAAAAAAAAABAYfLS75yL5wtTa1lzbWUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwL2a/P//FQajMnmJ4EacnD7wFgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgf+CMAAP//SfdjDw==") r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x105042, 0x189) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) write$binfmt_format(r1, &(0x7f0000000000)='1\x00', 0xb000) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x2, 0x5, 0x4d0, 0x0, 0x1e0, 0xffffffff, 0x0, 0x1e0, 0x400, 0x400, 0xffffffff, 0x400, 0x400, 0x5, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @remote, [], [], 'dvmrp0\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x1, @ipv6=@loopback, @ipv6=@mcast2, @gre_key, @gre_key}}}, {{@ipv6={@dev, @loopback, [], [], 'dvmrp0\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xf0}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv6=@private0, @icmp_id, @gre_key}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev}, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @port, @gre_key}}}, {{@ipv6={@rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [], [], 'ipvlan0\x00', 'pim6reg\x00'}, 0x0, 0x100, 0x130, 0x0, {}, [@common=@mh={{0x28}, {"a7fe"}}, @common=@srh={{0x30}}]}, @common=@inet=@SET2={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x530) 32.347205373s ago: executing program 1 (id=120): syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="6e6f646973636172642c6261636b67726f756e645f67633d73796e632c6261636b67726f756e645f67633d6f6e2c6e6f757365725f78617474722c6e6f71756f74612c64697361626c655f726f6c6c5f666f72776172642c67635f6d657267652c6e6f757365725f78617474722c636865636b706f696e743d64697361626c652c757365725f78617474722c6673796e635f6d6f64653d7374726963742c646973636172645f756e69743d73656374696f6e2c636865636b706f696e743d64697361626c652c6e6f696e6c696e655f64656e7472792c00ec6da92d1c80a6c720380e3c2c55bf27596d2776ce408c4bb19b149757508e1c7e919c6c2047023baa412d14fa75c8cac6e5f103e13ea52708af0a7c5da8af4ecb6612"], 0x2, 0x5505, &(0x7f0000002480)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYoIAfSQhqgBnJLCRFEeBwCEYdIHttK9H2SMxnL/HiD4DAz0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF26r9aL26vf121zdvt28owGAAAAuGRbrRf1P7PU/9rc/97c+tn0i4goI+LS3H0Un84yR01O9fL8zenz1asa7iLqhMN7TJrrS0T8aa7HH11/CgAAAPBxbZareZqtpz+zoQuiT2nRpvz2N1NeERHV7CFTWnnI+5UprP5+j+N/prR6AWuaKSwtuY1zpb1J/XM/rtpNT5oiNeXFlx2LzDZ2AACgR6Ozpt9ZCAAAAH36N3QBDKOI563M41bgJDXN9t7nsx4AAADwDhVDFwAAAAB0rp7/93T+3975fwAAADCMdP4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXdpW68VmuZq3zdnt28kzGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHhif95RIATCIAz2ru9M5v6HlQZNTU2qQPj4G4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIv9eUmBEAiCKJgz/nfS9z+sJOgZRIiAhkcVtWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIud+3mNo4oDAP5mZmdrq+IaZQ8RUfCgF7vd1tbexIMSPPgnCCHd1titP9ocbCliLt4k515EjyKCEm/9H3JOIJd4y2EPETwrMzuTnfwA118zm+TzgTfvu8Mw7/tmIeQ77yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACURm9P4iQ7dMZxXJzb3Hu4lPVbh/rM47Xt+axlcVRn0ifDi9UPUbe5RAAAADg7krK+DyHspOsLWR938vo/La/Jav5vnx7HZT1/uO4v+7L2z9ovP+8+vz9QZzxOdtOby8PBpaOptP6/Wc62Z/7yilb+5PN3L0n+hcTvrT43SvPnGX29sfFOOw/P1ZEtAPBPXCz7Iih/H8r6fpOJAXBmtCqFd1n/J51mcwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACow2g1PFnGUQhhvjWJM1t7D5eO6x+vbc+X7dqjR2vhy8k9s1ukIYSby8PBpVpnM9vu3X9we3E4HNytP3gphNDU6G8V07/9wRQXh9DI8xH8R0FcfNmzks/JCBr8oQQAwKmUFi2r63fS9YXsXDQXwh/fHaz/X63EYcr6f/fDa5vVsar1f7+2Gc6+3sqdT3v37j94ffnO4q3BrcHHb1zuv9m/cv3q1eu9/F1JzxsTAAAA/p120ar1fzx3dP3/QiUOU9b/n33T/6I6VqL+P9Zk0a/pTAAAAM62Z1/+/bfomPNRux0+X1xZudsfH/c/Xx4fG0j1bztXtGr9n8w1nRUAAABQh9FqdGD9/0YlDlOu/z/1/Qs/Vu+ZhBDOF+v/F5c+Gd6obzozrY4/J256jgAAADTrfNGq6/9pvv8/3t/yEIcQXntlHBf/BnCq+j9596sfqmNV9/9fqW+KMynujp9H3ndDaHWbzggAAIDT7ImiZcX+r+n6wkc/XXi/bf8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN3+DAAA//962D6S") syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x5, 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='system.posix_acl_access\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="0200000001e5ff000000040036006a98c6600200fa000000bc73"], 0x24, 0x1) listxattr(&(0x7f0000006440)='./file0\x00', 0x0, 0x100000) 27.540281647s ago: executing program 1 (id=132): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @broadcast}, 0x10) syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000040)='./file1\x00', 0x400, &(0x7f00000000c0)=ANY=[], 0x1, 0x6a1, &(0x7f0000000940)="$eJzs3U9sHFcdB/DvbnbX3oBSp03SgCoRNVJBRCROrKSYSwNCKBIVqsoBIU5W4jRWNmnluMiJEIT/By4ceuJCkciNC0jcg8oZOPXqYyUkLj0FkFg0s7P2eu04uybO2uLziWbfm3l/5r3fzOzszipygP9bV86k8TC1XDnz+mqxvvZgrrP2YO5WP59kKkk9afSS1G4ntQ+Sy0m77OJTxcaqu9rj9vPe0vybH3689lFvrVEtZf36Tu22uFTfZuP9asmpJIeqdNivvjPyTjb1d3Wov9bI3fTV1md4OcnpKoWJaybpbvLtExslTzT6dQvsW7XefXPLBT2THE4yXX0O6N0Ve/fsA+3+pAcAAAAAz8Bzvyi/wh+Z9DgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgIKn+/n+tWur9/KnU+n//v1VtS5U/0B5OegAAAAAAAAAAML6vf3Jow2ce5VFWc6S/3q2Vv/m/XK4cK18/kXdzJ4tZztmsZiErWclyzieZKcub5WtrdWFlZfn8CC0vrLfMQMsLI86gvfvJAwAAAAAAAMBB0Ri/yY9yZeP3fwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2A9qyaFeUi7H+vmZ1BtJppO0inr3k7/28/vSr/80uNb9d7e0pdrDZzkmAAAAmJDnHuVRVnOkv96tld/5T5Tf+6fzbm5nJUtZSSeLuVY+C+h966+vPZjrrD2Yu1UsW/v98j/GGkbZY3rPHrbf88myRjvXs1RuOZureTudXEu9bFk42R/P9uP6YTGm2muVEUd2rUqLmf8yzbFmtRu1kWvOlBEpRtSLyGzVtojG0Z0jMebR6e+pH/vzqa8/+Tn2NGO+2kte/W0vLebzs7FisteGI3Fh4Ow7sXMkks/+8XffutG5fXPq+p0z+2dKY5gaeII2HIm5gUi8uF0k2gMd9SNx46BGYtBsGYnj6+tX8rV8M2dyKm9kOUv5bhayksWcylezkENZqM7n4nVm53Pm8qa1N540klZ5XJrVu+joY1rJQl4u2x7JUr6Rt3Mti7lU/ruQ83k1F3Mx8wNH+PgIV319vHfa058beJj886ETZrKKgR1dvzsNnvWz5XVwdNOWjSg9//TvR41PV5liHz+u0v1hOBLnByLxws6R+E35tnKnc/vm8o2Fd0bc3ytVWlxHPx3zLrG3USvOl+eLg1WubT47irIXhsume/FqVb+4NKoxDsayKDu+XvakK7VVfYbb2tOFsuzFbcvmyrKTA2WbPm9d7n3eAmDfO/z5w63239t/ab/f/kn7Rvv16a9MfXHqpVaaf25+qTF76JX6S7U/5P18f+P7PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsHt37t67udDpLC4PZbrd7g8eU7SHmXaS/pbkSa2aeXKdvcm0kpSZRj8zXj9TI1VubRyd136/y6FOJ1lsVluajz3cQ5nkqQSqUZ1kd+/d/Ge3233mh2mbTHOHc34j061sKeqO1HximX91n16HE35jAvbcuZVb75y7c/feF5ZuLby1+Nbi7fmLF+dn5y9e+tu560udxdne66RHCeyFjZv+pEcCAAAAAAAAAAAAjOpZ/LeEx+z6P894qgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMABdeXMVJU7O1u8rj2Y6xRLP79esaxWT1L7XlL7ILmc3pKZge5qj9vPe0vzb3748dpHvbVGtZT165vaNXczi/vVklNJDlXpoOn/ob+rVbqrkZVq6zMsAna6HziYtP8GAAD//4cBD/Q=") r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x105042, 0x189) write$binfmt_format(r1, &(0x7f0000000000)='1\x00', 0xb000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x181042, 0x5) socket$netlink(0x10, 0x3, 0x0) r3 = getpgrp(0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f0000000080)={0x0, 0x0}) r5 = getpid() openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) r6 = syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) wait4(r6, 0x0, 0x2, 0x0) ptrace$cont(0x18, r6, 0x1000, 0x0) r7 = syz_open_procfs$namespace(r3, &(0x7f00000001c0)='ns/uts\x00') sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=@RTM_NEWNSID={0x54, 0x58, 0x300, 0x70bd28, 0x25dfdbfd, {}, [@NETNSA_PID={0x8, 0x2, r3}, @NETNSA_PID={0x8, 0x2, r4}, @NETNSA_PID={0x8, 0x2, r5}, @NETNSA_NSID={0x8, 0x1, 0x1}, @NETNSA_NSID={0x8, 0x1, 0x1}, @NETNSA_FD={0x8, 0x3, r7}, @NETNSA_NSID={0x8}, @NETNSA_NSID={0x8, 0x1, 0x2}]}, 0x54}}, 0x20008040) process_vm_readv(r3, &(0x7f0000000440)=[{&(0x7f0000000240)=""/64, 0x40}, {&(0x7f00000002c0)=""/144, 0x90}, {&(0x7f0000000380)=""/176, 0xb0}], 0x3, &(0x7f0000000700)=[{&(0x7f0000000480)=""/32, 0x20}, {&(0x7f00000004c0)=""/174, 0xae}, {&(0x7f0000000580)=""/52, 0x34}, {&(0x7f00000005c0)=""/146, 0x92}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000000680)=""/121, 0x79}], 0x6, 0x0) 24.950780879s ago: executing program 1 (id=136): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4, 0x1, 0x4, 0x9, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000000c0)={r1, 0x5}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000080)=@sack_info={r1, 0x8, 0x6}, &(0x7f0000000100)=0xc) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000400)={r3, 0x3}, &(0x7f0000000440)=0x8) 23.585993444s ago: executing program 1 (id=140): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r0) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {{}, {0x0, 0x800b}}}, 0x1c}}, 0x10) syz_usb_connect(0x2, 0x3f0, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000072771c40e00500069bf9010203010902de0301000000000904af00100de1130009050900400000b208ab035ac996787ecb440a6cd869ab0f7077064618a072d7bb7916a199dedaf7708866e5233e204dd14444c3ee6b718038526c6bd45123a28131dc5c483de3e462a652473d558e27e67a040b3ce5b78166e74a0f16f9df02be33a9b200b92587ba73bd6c540e25637c4e8e6a381c9d3ee1e8521863c2d3cef0ffffff93fec28c8604a378f65ff31e903b4b79031a4301e0244b2ff9f0b469afb99f40f79a6de21f2f29bc61cf090aa1e112da07250101000300090507080800040406b505bce3"], 0x0) syz_read_part_table(0x5d6, &(0x7f0000000600)="$eJzs3LFrU1scB/CTIBEFETc3gxkiLilkDBE0xEsJmBB86CCiWx2y6OQQIxgQB+MSEVzqoAg1KA+dRARBxKRDIVNpad/SltLhUegSKCWPwu0f0PdI4cHnA2c4v/O993cPlzveE/hfS4a/x+NxIoQwPn74q/+YK1+dTtcu16+HkAi3QghTfxZm9lcSceLgrufj+Wo8z3871ng+Fz3tdE+d/ZLenU/G64/jsTF4ffs/b46Ju/Dg4o9zo+GZr5Xwpn+pXzjZuDnTy5ZavYXa5yvv0u8P3ntuQv0/FX+dftK+H3UeFu8tRs21aDO5sx1dezWbS71o1bNbU3HuzoT6N/ZupD68/Vlqr5/I/65Uq92Pyy8zzfL39qPhILM0enY3zq38i68LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICjd+HBxR/nRsMzXyvhTf9Sv3CycXOmly21egu1z1fepd+fj3O5CfX/VPx1+kn7ftR5WLy3GDXXos3kznZ07dVsLvWiVc9uTcW5OxPq39i7kfrw9mepvX4i/7tSrXY/Lr/MNMvf24+Gg8zS6NndOLdyfEIPAAAAAAAAAAAAAAAAAAAAACGE8tXpdO1y/XoIiXArhFCYnV7er4/j/90Tce7gHIDVuJ7/dqzxfC562umeOvslvTv/V1x/HI+NwevbR74ZDu2fAAAA//9Dz4ow") r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01032757c38d085641a7260000000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x20040005}, 0x0) 19.624497135s ago: executing program 33 (id=140): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r0) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {{}, {0x0, 0x800b}}}, 0x1c}}, 0x10) syz_usb_connect(0x2, 0x3f0, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000072771c40e00500069bf9010203010902de0301000000000904af00100de1130009050900400000b208ab035ac996787ecb440a6cd869ab0f7077064618a072d7bb7916a199dedaf7708866e5233e204dd14444c3ee6b718038526c6bd45123a28131dc5c483de3e462a652473d558e27e67a040b3ce5b78166e74a0f16f9df02be33a9b200b92587ba73bd6c540e25637c4e8e6a381c9d3ee1e8521863c2d3cef0ffffff93fec28c8604a378f65ff31e903b4b79031a4301e0244b2ff9f0b469afb99f40f79a6de21f2f29bc61cf090aa1e112da07250101000300090507080800040406b505bce3"], 0x0) syz_read_part_table(0x5d6, &(0x7f0000000600)="$eJzs3LFrU1scB/CTIBEFETc3gxkiLilkDBE0xEsJmBB86CCiWx2y6OQQIxgQB+MSEVzqoAg1KA+dRARBxKRDIVNpad/SltLhUegSKCWPwu0f0PdI4cHnA2c4v/O993cPlzveE/hfS4a/x+NxIoQwPn74q/+YK1+dTtcu16+HkAi3QghTfxZm9lcSceLgrufj+Wo8z3871ng+Fz3tdE+d/ZLenU/G64/jsTF4ffs/b46Ju/Dg4o9zo+GZr5Xwpn+pXzjZuDnTy5ZavYXa5yvv0u8P3ntuQv0/FX+dftK+H3UeFu8tRs21aDO5sx1dezWbS71o1bNbU3HuzoT6N/ZupD68/Vlqr5/I/65Uq92Pyy8zzfL39qPhILM0enY3zq38i68LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICjd+HBxR/nRsMzXyvhTf9Sv3CycXOmly21egu1z1fepd+fj3O5CfX/VPx1+kn7ftR5WLy3GDXXos3kznZ07dVsLvWiVc9uTcW5OxPq39i7kfrw9mepvX4i/7tSrXY/Lr/MNMvf24+Gg8zS6NndOLdyfEIPAAAAAAAAAAAAAAAAAAAAACGE8tXpdO1y/XoIiXArhFCYnV7er4/j/90Tce7gHIDVuJ7/dqzxfC562umeOvslvTv/V1x/HI+NwevbR74ZDu2fAAAA//9Dz4ow") r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01032757c38d085641a7260000000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x20040005}, 0x0) 10.02482595s ago: executing program 5 (id=165): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x1fffffffffffffcd, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x2010000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='module_request\x00', r0}, 0x10) socketpair(0x0, 0x0, 0x0, &(0x7f00000006c0)) 8.485328203s ago: executing program 5 (id=168): r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0xcad7f8d921d48bf2}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, @void, @value}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r2}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000100)={'vlan0\x00', 0x400}) 7.220357945s ago: executing program 5 (id=172): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='timer_start\x00', r1}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000940)) 6.203104504s ago: executing program 5 (id=174): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xc, 0xd, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000015000000850000000700000095"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000240)=[0x0, 0x0], 0x0, 0x0, 0xeb, &(0x7f00000002c0)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0x56, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) socketpair(0x2, 0x80000, 0x31e9c1e0, &(0x7f0000000780)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000080)="0000090000980500000000002c00", 0x0, 0x7fffffff, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 6.141652607s ago: executing program 3 (id=175): r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0xcad7f8d921d48bf2}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, @void, @value}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r3}, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r4, 0x400454d9, &(0x7f0000000100)={'vlan0\x00', 0x400}) 5.813429726s ago: executing program 2 (id=176): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r0, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='tlb_flush\x00', r2}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='module_request\x00', r3}, 0x10) 5.123516923s ago: executing program 4 (id=177): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x208, 0x21, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000001850000001b000000b70000000000070095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kfree\x00', r1}, 0x18) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x0, 0x3b, 0x3, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={r2, 0x0, 0x0}, 0x20) 4.828487158s ago: executing program 3 (id=178): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) socketpair(0xf, 0x3, 0x2, &(0x7f00000001c0)) 4.689417734s ago: executing program 2 (id=179): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, @void, @value}, 0x94) close(0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) socketpair(0x11, 0xa, 0x0, &(0x7f0000001080)) 4.689255922s ago: executing program 5 (id=180): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000060000007c"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000800007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='percpu_create_chunk\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a00000001010000ff7f0000cc"], 0x48) 4.150449324s ago: executing program 4 (id=181): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001d00)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8fff7ff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b70500000000e000720a23fe000000008500000012000000b70000000000000095000000000000004e6258941c823b7505608556ba4ababb42684e890d31ae450400373a0a5447a801b8c1c4f0c4bd97c6555e61345400f9bd42abeb9ade0105000000000000a21902ff07000094a2b51c21df74924f5436a6ed89b98f75e800230c49c90fe1336481f3b92a63336c36fcd745d61d7739c6554ca201000000bebbe8282f8b1e26407437a397bf8f50e87ed4d27adfd876bffc402887781979461c4363bc5c9b6202ea471428197ef88bc333fbcec0ea4334844d232279ae95a90fd41d528f58d305000000435883df6c10ce86188c92292b2d0226082960be682836bdff8b0971f2a5405e453228e7b1005bd73479358a90df3e481947de6453736aa572158af6ea63d6d418fbbd2bba050000001da000ef78df03000000d19913a5fb03c79dac2e489f68127892658115e7ffb588a71dffffff951b8535167ab8069a2c92a3aa18e22517000026637b4c34bf2d0aa304ed42bf70480e9e97203fd169411f37fddd1f7fbe16dbbc0f307bceb5064f388a0350c3dc928b0e638b1e2b2a9d25264233e5d45eb377f56b95241024dbe30f67191c2b56b70328d6d3215dfffe5d89af1d10599bd494d921d1fb2db99b6aba0fa978f41eb1d4c553e5a9326ed550c13f8dd36716a899a1e79234294707c5312b924d142c17b20bb80ee202222c03fa84ccc374e717f694018630366397266090a82343aedfbf7afe892390c2eb775b0d16073da2229958db05de7df6ab7600004000010000006d8081cb3bf251d906c00da0e23b50465f8394820be571e3592d0000c7ef10fdc462e7040e7074ec43aa461fc54401a76406db718d4efd6c1bd10ce1d087cf9bba461162555a95524c84df0952d32093082b7aa71304e0d2d9ec310d1b676b378a5879e47941de1a28c3a8f400000000000000000e032b7d2badd0bc6617a859b7ac273b6304555f664469cec152030f06cc0ca1765838eb5590264736fbccfc3a8f4e3b10daf6a275daf5db2dac7096fe8ac8876acaad043663b3b0fedb05e6d31408fa20140c9d2db1c59ac8a3ce28e489d67d87d3a107ccea3007f58f2c5017e8807107f79ac50cc1d4f546b4443d137eb706b71b1767a10cca7a7c82b76c96e874aff249f36329a6526b354b6e674b08f7ef492b804c4b08fb10de807d79fd782027318cd7632e22d2faa16209272b39b5ec8d239832ea02cc88e249a2e77753a58987547571fbc8de747faab724bebb6401412b496e078fcb6c78ab447e871b76a8b0506f49594aa1d610567e14d739a60ff3ce04d0d2e5681e787c7e1ad25467bb81f2f448128207fe07a83759ec30cf9e0a3fd3f2fcee97fe8d273f8e712a8a64eaf2d89a1fa44554357fcd7ab531ff7a41c27164fca430a62d015b477de61853f5ee2e25b00a63642ec32ece2ff3bb5883deb895f52a923b5c744d8dccdd6a09ded8b90f1eeda8e6e884a4f090edb6ab9fc8107846508d51f3735493d5860cf80200ce31b92eb3563d485b5a7d192092d7a9fd2bc67d305d1d4573aad5f6501d1cd27657ce17330402dacb78d72d776330711645eed7d4c292f4448733c0826c4eb950f3d40457f82d7f792d106518f6bde874aff9e2bea7d73f74bebeeacfc700000000000000000000d40d73be47803297db004264c8c70b7761b22a7114a078a87d63d63b0c9dcc263a5b773bfeba212abef4181ad9e4872e328c0f105d51e3d167a2b717051d7681ba04552eeba18a000000b22b50d76d85040c9000ea68a528049a60d5e26b20455194f4be3b8466fd66d0e6cefcff7891c485d61cb66f4076cd60a22733cb00cf7cc12ca7d9bb864c0e650236a79a5c85349a9b1e6bbc3bace197e72490c566431cd3a08e9d1b641c1ba1f661d01573b904c3fa1427370fa15cecd294ac21fefe3d161fdf58e8bc5957ef145839f4370176e1be88d2e3516a1998c1621a00b4438b85a4dfee6f61827a1e50e158038b037dfda3ffb35069e41fc740ae720800de53948f176c3c15f3a529c02434b920d87f12a6e3420a2fdcb3559e7a5b1ddbb06b7a5977f63bfac701e673bf626d126b213c92e7169a930beb8d76f9db34e8098bea301baa96916d6458c923866dc192928b320738d1b298fb55f2a64500000000000000000000000000509885a38d9d995a46817e7ff7acddcc5f9253c63f86baf33f92820c9ff497cf76b6482c3ab53fb6ecea6d220b91b99b2fb4279ab09ae0645ab92df309000000000000a4868411948f8e3e259b717d722a1eebd3f6860a17f1ae9e10a1178f6aef4951b192d13e9600c1f700ca7b1d127e451034469bf2a8f93dbae6ad8e932e431dc18323794156238625bb9c45c5a76a68a8646e701b29a71ffbd854f50f195823106a5625ff94221f1f04c72525b50aae69081de9626de9847bf53475d90642d9730101d80b1b0000000000000000822b0641698d60160d9157548302dd2636d12c431f96728ae4a45361e6d47a1c4a52d67c0f0a62585c09fcfd70d0f249f87c44b47283c1c6f2430d70c751e4ada9b646e6e7c1719faee476d88a2943c71a21db55b7497dd7ed385ac2e8cb916390a3a0ed52e7371e1a141e69afa07b46ac20f3521fb251b72c82ee1c7eb4f67c0deed5618d0db925ce7a7c50a99835544c540f5d528587d1a26e78df1bc9a8e4d90c57d0b8122eae7b23e4456624f5337c16c42648c7a3d0b799ad409befe0cbe2aa781ba826918df7aa80dff4f62258e54419629eb1d37de7f6a3512bd618781d1ad3a4d4b0da44df9f9a93f0487f79a9b16dfa6f68b06ce6a96ca344d194cded05702c2300d1a4f451b33830765f8131f6c28fada65701851bba089b8a8347900e72d68cea965feb6a06225dd3f0e135323a5bde3b43c9d242b73abf9e05336af040a4a6bb5918146393f1d50705c1d1e986bf2f690de51ee8727d37339df5391db535bb1e9bb3e5dadb6e5a2bb4faa2dcbc6ca9b40ac96e448b9dadeb08fc2cf3a960f22bf20b9e967b7a75687372b8e3edc543896c360674d901a7f56b07ba1479b46eea3d94026a9c7e670ab40bb2c1ca1a7c90299361239bef773140af974c7efc285a64633d21513481b3ac62dec9fa3e8ce6156d76b82baa145bc550b0ccbc0934ccfea45292caa2f0654fe18dc0669a4f2af9fa232a293ad94261f55675cc686db72783a6bacc0df6a1ea943ae266af112f35319980cd681811a369e0d03cf7d22bed7cbe1afe498b88942b1bf7edae441a0d0d88fce65cb4e848793a28cbd7373f6acd3b5a48c034e487750388929d37fa3165f205dab3be5f3e5781a84298687cbf02dcaf0e14a2b260293f349d076eb75a2ddc5382d106f0beea02aa45018fe36d1176cf7704383b6922d10dc80bc7feca3982ae232d4bb47c722c83a7cf6ee8832f038b072eb803a47cd7f753e80c9f6eedb8"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1d4, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x300f000, 0xe, 0x0, &(0x7f0000000080)="0069c2704ade28eddb0000200000", 0x0, 0x48b8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 3.736711176s ago: executing program 2 (id=182): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x0, 0x7fffd, 0x8, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000280)={r1, 0x0, &(0x7f0000000200)=""/76}, 0x20) 3.66910512s ago: executing program 3 (id=183): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x4, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e705"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r0}, &(0x7f0000000800), &(0x7f0000000840)=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r3, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) 3.115026094s ago: executing program 4 (id=184): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) 2.610611188s ago: executing program 3 (id=185): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2, 0xffffffffffffffff}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{r3}, &(0x7f0000000500), &(0x7f0000000680)=r0}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r4, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r5}, &(0x7f0000000280), &(0x7f00000002c0)=r0}, 0x20) 2.436857994s ago: executing program 2 (id=186): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a000000020000000110000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='qdisc_reset\x00', r2}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f0000000100)={'vlan0\x00', 0x400}) 2.326606271s ago: executing program 4 (id=187): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180100000000000000000000000000001812"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000e00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='workqueue_queue_work\x00', r1}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x1d, &(0x7f00000001c0), 0x4) 1.688088433s ago: executing program 3 (id=188): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40047459, 0x0) 1.253310717s ago: executing program 4 (id=189): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) close(0xffffffffffffffff) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.141245938s ago: executing program 2 (id=190): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r0}, 0x18) preadv2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x4, 0x1) 425.612653ms ago: executing program 3 (id=191): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1, 0x0, 0x5}, 0x18) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00000007c0)={0x300, 0x0, &(0x7f0000000780)={&(0x7f0000000b00)=ANY=[@ANYBLOB="020a06000300000028bd7008fcd1df25010018"], 0x18}}, 0x40) 293.762642ms ago: executing program 5 (id=192): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 163.785797ms ago: executing program 4 (id=193): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r3], 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="71050903020e01915f76427eece2e159c344"], 0x12) 0s ago: executing program 2 (id=194): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000080)='sched_switch\x00', r0, 0x0, 0x80000001}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000300)=ANY=[@ANYBLOB='_\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000300"], 0x68}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.78' (ED25519) to the list of known hosts. [ 202.655224][ T5777] cgroup: Unknown subsys name 'net' [ 202.811490][ T5777] cgroup: Unknown subsys name 'cpuset' [ 202.828733][ T5777] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 229.682836][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 229.689763][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.740030][ T5777] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 264.086620][ T5801] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 264.111258][ T5801] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 264.121968][ T5801] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 264.145787][ T5803] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 264.156550][ T5803] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 264.166668][ T5803] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 264.174703][ T5803] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 264.197147][ T5807] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 264.206357][ T5807] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 264.218304][ T5807] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 264.228968][ T5807] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 264.233623][ T5096] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 264.245431][ T5096] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 264.248102][ T5807] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 264.257094][ T5096] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 264.272643][ T5807] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 264.278281][ T5096] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 264.301371][ T5096] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 264.336343][ T49] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 264.346996][ T49] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 264.355919][ T5096] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 264.372866][ T5096] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 264.381508][ T5096] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 264.413731][ T5810] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 264.427240][ T5810] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 265.891800][ T5799] chnl_net:caif_netlink_parms(): no params data found [ 266.066003][ T5804] chnl_net:caif_netlink_parms(): no params data found [ 266.222928][ T5096] Bluetooth: hci0: command tx timeout [ 266.316158][ T5096] Bluetooth: hci2: command tx timeout [ 266.380524][ T5096] Bluetooth: hci1: command tx timeout [ 266.460041][ T5096] Bluetooth: hci4: command tx timeout [ 266.553273][ T5096] Bluetooth: hci3: command tx timeout [ 266.680797][ T5811] chnl_net:caif_netlink_parms(): no params data found [ 266.918619][ T5800] chnl_net:caif_netlink_parms(): no params data found [ 267.108732][ T5799] bridge0: port 1(bridge_slave_0) entered blocking state [ 267.119964][ T5799] bridge0: port 1(bridge_slave_0) entered disabled state [ 267.127750][ T5799] bridge_slave_0: entered allmulticast mode [ 267.138044][ T5799] bridge_slave_0: entered promiscuous mode [ 267.174144][ T5799] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.182206][ T5799] bridge0: port 2(bridge_slave_1) entered disabled state [ 267.190145][ T5799] bridge_slave_1: entered allmulticast mode [ 267.200358][ T5799] bridge_slave_1: entered promiscuous mode [ 267.215725][ T5812] chnl_net:caif_netlink_parms(): no params data found [ 267.542069][ T5799] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 267.580065][ T5799] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 267.985417][ T5799] team0: Port device team_slave_0 added [ 268.145693][ T5804] bridge0: port 1(bridge_slave_0) entered blocking state [ 268.155578][ T5804] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.164643][ T5804] bridge_slave_0: entered allmulticast mode [ 268.174695][ T5804] bridge_slave_0: entered promiscuous mode [ 268.190587][ T5811] bridge0: port 1(bridge_slave_0) entered blocking state [ 268.198255][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.206942][ T5811] bridge_slave_0: entered allmulticast mode [ 268.217444][ T5811] bridge_slave_0: entered promiscuous mode [ 268.234427][ T5804] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.243110][ T5804] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.251031][ T5804] bridge_slave_1: entered allmulticast mode [ 268.261108][ T5804] bridge_slave_1: entered promiscuous mode [ 268.283866][ T5799] team0: Port device team_slave_1 added [ 268.320097][ T5096] Bluetooth: hci0: command tx timeout [ 268.381390][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.382852][ T5096] Bluetooth: hci2: command tx timeout [ 268.389082][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.402355][ T5811] bridge_slave_1: entered allmulticast mode [ 268.412604][ T5811] bridge_slave_1: entered promiscuous mode [ 268.459720][ T5096] Bluetooth: hci1: command tx timeout [ 268.489222][ T5799] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 268.496639][ T5799] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 268.524831][ T5799] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 268.539812][ T5096] Bluetooth: hci4: command tx timeout [ 268.619890][ T5096] Bluetooth: hci3: command tx timeout [ 268.666433][ T5799] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 268.675336][ T5799] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 268.702299][ T5799] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 268.840809][ T5804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 268.850732][ T5800] bridge0: port 1(bridge_slave_0) entered blocking state [ 268.858382][ T5800] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.866429][ T5800] bridge_slave_0: entered allmulticast mode [ 268.876542][ T5800] bridge_slave_0: entered promiscuous mode [ 268.923032][ T5811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 268.982628][ T5804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 268.992646][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state [ 269.000725][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state [ 269.008433][ T5812] bridge_slave_0: entered allmulticast mode [ 269.018634][ T5812] bridge_slave_0: entered promiscuous mode [ 269.033151][ T5800] bridge0: port 2(bridge_slave_1) entered blocking state [ 269.040891][ T5800] bridge0: port 2(bridge_slave_1) entered disabled state [ 269.048621][ T5800] bridge_slave_1: entered allmulticast mode [ 269.058269][ T5800] bridge_slave_1: entered promiscuous mode [ 269.124428][ T5811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 269.135046][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state [ 269.143082][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state [ 269.152788][ T5812] bridge_slave_1: entered allmulticast mode [ 269.162364][ T5812] bridge_slave_1: entered promiscuous mode [ 269.459220][ T5800] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 269.563037][ T5804] team0: Port device team_slave_0 added [ 269.587458][ T5799] hsr_slave_0: entered promiscuous mode [ 269.599615][ T5799] hsr_slave_1: entered promiscuous mode [ 269.619060][ T5800] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 269.637649][ T5811] team0: Port device team_slave_0 added [ 269.657780][ T5812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 269.676260][ T5804] team0: Port device team_slave_1 added [ 269.826910][ T5811] team0: Port device team_slave_1 added [ 269.848369][ T5812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 269.863647][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 269.870984][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 269.897434][ T5804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 270.088581][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 270.095900][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 270.122437][ T5804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 270.158337][ T5800] team0: Port device team_slave_0 added [ 270.280543][ T5800] team0: Port device team_slave_1 added [ 270.290998][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 270.298182][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 270.325083][ T5811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 270.345993][ T5812] team0: Port device team_slave_0 added [ 270.356372][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 270.363888][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 270.390728][ T5811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 270.412180][ T5096] Bluetooth: hci0: command tx timeout [ 270.459973][ T5096] Bluetooth: hci2: command tx timeout [ 270.515279][ T5812] team0: Port device team_slave_1 added [ 270.539599][ T5096] Bluetooth: hci1: command tx timeout [ 270.619831][ T5096] Bluetooth: hci4: command tx timeout [ 270.711014][ T5096] Bluetooth: hci3: command tx timeout [ 270.895237][ T5804] hsr_slave_0: entered promiscuous mode [ 270.905921][ T5804] hsr_slave_1: entered promiscuous mode [ 270.914659][ T5804] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 270.922566][ T5804] Cannot create hsr debugfs directory [ 270.931756][ T5800] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 270.938979][ T5800] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 270.966964][ T5800] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 270.997553][ T5811] hsr_slave_0: entered promiscuous mode [ 271.007347][ T5811] hsr_slave_1: entered promiscuous mode [ 271.016574][ T5811] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 271.024492][ T5811] Cannot create hsr debugfs directory [ 271.104549][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 271.112576][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 271.139068][ T5812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 271.156105][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 271.163608][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 271.190297][ T5812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 271.208170][ T5800] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 271.216505][ T5800] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 271.243377][ T5800] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 271.895589][ T5812] hsr_slave_0: entered promiscuous mode [ 271.906507][ T5812] hsr_slave_1: entered promiscuous mode [ 271.914577][ T5812] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 271.922520][ T5812] Cannot create hsr debugfs directory [ 272.016758][ T5800] hsr_slave_0: entered promiscuous mode [ 272.027549][ T5800] hsr_slave_1: entered promiscuous mode [ 272.036827][ T5800] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 272.044912][ T5800] Cannot create hsr debugfs directory [ 272.459846][ T5096] Bluetooth: hci0: command tx timeout [ 272.539993][ T5096] Bluetooth: hci2: command tx timeout [ 272.627625][ T5096] Bluetooth: hci1: command tx timeout [ 272.699787][ T5096] Bluetooth: hci4: command tx timeout [ 272.798516][ T5096] Bluetooth: hci3: command tx timeout [ 272.928997][ T5799] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 273.016356][ T5799] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 273.094132][ T5799] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 273.176107][ T5799] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 273.320814][ T5811] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 273.444973][ T5811] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 273.468261][ T5811] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 273.495870][ T5811] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 273.702137][ T5804] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 273.767265][ T5804] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 273.840527][ T5804] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 273.933221][ T5804] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 274.139653][ T5812] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 274.197198][ T5800] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 274.233623][ T5800] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 274.269070][ T5800] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 274.293383][ T5812] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 274.329803][ T5812] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 274.371867][ T5800] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 274.410079][ T5812] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 274.806936][ T5799] 8021q: adding VLAN 0 to HW filter on device bond0 [ 275.059075][ T5799] 8021q: adding VLAN 0 to HW filter on device team0 [ 275.185010][ T3537] bridge0: port 1(bridge_slave_0) entered blocking state [ 275.192781][ T3537] bridge0: port 1(bridge_slave_0) entered forwarding state [ 275.228086][ T5811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 275.302841][ T3537] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.310632][ T3537] bridge0: port 2(bridge_slave_1) entered forwarding state [ 275.545587][ T5804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 275.588125][ T5811] 8021q: adding VLAN 0 to HW filter on device team0 [ 275.755725][ T5804] 8021q: adding VLAN 0 to HW filter on device team0 [ 275.802497][ T3743] bridge0: port 1(bridge_slave_0) entered blocking state [ 275.810240][ T3743] bridge0: port 1(bridge_slave_0) entered forwarding state [ 275.976173][ T3743] bridge0: port 2(bridge_slave_1) entered blocking state [ 275.983917][ T3743] bridge0: port 2(bridge_slave_1) entered forwarding state [ 276.001713][ T3743] bridge0: port 1(bridge_slave_0) entered blocking state [ 276.009515][ T3743] bridge0: port 1(bridge_slave_0) entered forwarding state [ 276.096370][ T3743] bridge0: port 2(bridge_slave_1) entered blocking state [ 276.104150][ T3743] bridge0: port 2(bridge_slave_1) entered forwarding state [ 276.160576][ T5800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 276.506806][ T5800] 8021q: adding VLAN 0 to HW filter on device team0 [ 276.644830][ T3577] bridge0: port 1(bridge_slave_0) entered blocking state [ 276.652622][ T3577] bridge0: port 1(bridge_slave_0) entered forwarding state [ 276.712609][ T5812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 276.768964][ T5811] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 276.823070][ T3577] bridge0: port 2(bridge_slave_1) entered blocking state [ 276.830816][ T3577] bridge0: port 2(bridge_slave_1) entered forwarding state [ 276.980602][ T5812] 8021q: adding VLAN 0 to HW filter on device team0 [ 277.161305][ T3577] bridge0: port 1(bridge_slave_0) entered blocking state [ 277.168975][ T3577] bridge0: port 1(bridge_slave_0) entered forwarding state [ 277.195978][ T3577] bridge0: port 2(bridge_slave_1) entered blocking state [ 277.203745][ T3577] bridge0: port 2(bridge_slave_1) entered forwarding state [ 277.426652][ T5800] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 277.439050][ T5800] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 277.733095][ T5812] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 277.746016][ T5812] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 278.458904][ T5799] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 278.990406][ T5804] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 279.112251][ T5799] veth0_vlan: entered promiscuous mode [ 279.292265][ T5811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 279.309292][ T5799] veth1_vlan: entered promiscuous mode [ 279.829224][ T5799] veth0_macvtap: entered promiscuous mode [ 279.892366][ T5811] veth0_vlan: entered promiscuous mode [ 279.921350][ T5799] veth1_macvtap: entered promiscuous mode [ 280.037540][ T5811] veth1_vlan: entered promiscuous mode [ 280.098180][ T5800] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 280.249086][ T5799] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 280.300067][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 280.379109][ T5799] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 280.496585][ T5799] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.507029][ T5799] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.516535][ T5799] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.525861][ T5799] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 280.691969][ T5811] veth0_macvtap: entered promiscuous mode [ 280.768191][ T5811] veth1_macvtap: entered promiscuous mode [ 280.885557][ T5800] veth0_vlan: entered promiscuous mode [ 281.117578][ T5800] veth1_vlan: entered promiscuous mode [ 281.140462][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 281.157318][ T5812] veth0_vlan: entered promiscuous mode [ 281.209297][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 281.301115][ T5811] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.310382][ T5811] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.319774][ T5811] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.328879][ T5811] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 281.403872][ T5812] veth1_vlan: entered promiscuous mode [ 281.624039][ T5800] veth0_macvtap: entered promiscuous mode [ 281.755650][ T5800] veth1_macvtap: entered promiscuous mode [ 281.828427][ T5812] veth0_macvtap: entered promiscuous mode [ 281.932411][ T5812] veth1_macvtap: entered promiscuous mode [ 282.006897][ T5800] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 282.104658][ T5800] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 282.156999][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 282.236041][ T5800] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.245490][ T5800] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.254851][ T5800] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.264106][ T5800] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.299298][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 282.347399][ T5812] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.357402][ T5812] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.366712][ T5812] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.375934][ T5812] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.653422][ T5804] veth0_vlan: entered promiscuous mode [ 282.759120][ T5804] veth1_vlan: entered promiscuous mode [ 283.148152][ T5804] veth0_macvtap: entered promiscuous mode [ 283.234770][ T5804] veth1_macvtap: entered promiscuous mode [ 283.414406][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 283.518784][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 283.638719][ T5804] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.650402][ T5804] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.659852][ T5804] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 283.668939][ T5804] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 289.112371][ T4602] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 289.122081][ T4602] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 289.452896][ T1890] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 289.461225][ T1890] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.077463][ T5799] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 290.150279][ T4602] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 290.158415][ T4602] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.488968][ T3904] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 290.498339][ T3904] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.778611][ T3904] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 290.790037][ T3904] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 290.961518][ T4210] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 290.970830][ T4210] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 291.136423][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 291.143497][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 291.366306][ T3537] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 291.374685][ T3537] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 291.449284][ T3577] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 291.457978][ T3577] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 292.188575][ T5990] loop0: detected capacity change from 0 to 64 [ 292.285417][ T3537] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 292.293956][ T3537] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 292.650662][ T24] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 292.704044][ T3904] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 292.712578][ T3904] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 292.924127][ T24] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 292.926108][ T5990] tmpfs: Bad value for 'mpol' [ 292.932740][ T24] usb 3-1: config 8 has no interface number 0 [ 292.932888][ T24] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1022, setting to 64 [ 292.933071][ T24] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 292.933227][ T24] usb 3-1: config 8 interface 177 has no altsetting 0 [ 292.933428][ T24] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 292.933594][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.987263][ T5989] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 293.062973][ T5996] loop1: detected capacity change from 0 to 1024 [ 293.134691][ T5996] ======================================================= [ 293.134691][ T5996] WARNING: The mand mount option has been deprecated and [ 293.134691][ T5996] and is ignored by this kernel. Remove the mand [ 293.134691][ T5996] option from the mount to silence this warning. [ 293.134691][ T5996] ======================================================= [ 293.374308][ T24] usb 3-1: string descriptor 0 read error: -71 [ 293.398830][ T24] ir_toy 3-1:8.177: required endpoints not found [ 293.494593][ T24] usb 3-1: USB disconnect, device number 2 [ 294.073210][ T6003] netlink: 68 bytes leftover after parsing attributes in process `syz.4.5'. [ 294.168078][ T5799] VFS: Lookup of '.' in minix loop0 would have caused loop [ 294.214077][ T6005] netlink: 'syz.4.5': attribute type 4 has an invalid length. [ 294.224197][ T3743] hfsplus: b-tree write err: -5, ino 4 [ 294.280878][ T5799] VFS: Lookup of '.' in minix loop0 would have caused loop [ 294.388652][ T6005] loop4: detected capacity change from 0 to 16 [ 294.430328][ T6005] erofs (device loop4): algorithm 1 isn't enabled on this kernel [ 294.854965][ T6009] process 'syz.3.11' launched '/dev/fd/6' with NULL argv: empty string added [ 295.229588][ T1890] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.271581][ T6017] afs: Unknown parameter 'dyndPD\H#7./m\q}N*HZcr2ĢKsY 3ATTN{ ^Q' PÒ3 ?׼:| s2'⑜rO5艡0[vOD' [ 295.608950][ T1890] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 295.790121][ T5854] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 295.822325][ T1890] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 296.069653][ T5854] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 296.080525][ T5854] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 296.164569][ T1890] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 296.315235][ T5854] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 296.327523][ T5854] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 296.336109][ T5854] usb 3-1: Product: syz [ 296.340783][ T5854] usb 3-1: Manufacturer: syz [ 296.345669][ T5854] usb 3-1: SerialNumber: syz [ 296.408782][ T6020] tmpfs: Bad value for 'mpol' [ 296.585883][ T5854] cdc_ncm 3-1:1.0: skipping garbage [ 297.232471][ T1890] bridge_slave_1: left allmulticast mode [ 297.238704][ T1890] bridge_slave_1: left promiscuous mode [ 297.247135][ T1890] bridge0: port 2(bridge_slave_1) entered disabled state [ 297.425624][ T5854] cdc_ncm 3-1:1.0: SET_CRC_MODE failed [ 297.441856][ T5854] cdc_ncm 3-1:1.0: SET_NTB_FORMAT failed [ 297.476142][ T5854] cdc_ncm 3-1:1.0: bind() failure [ 297.503893][ T1890] bridge_slave_0: left allmulticast mode [ 297.510170][ T1890] bridge_slave_0: left promiscuous mode [ 297.516961][ T1890] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.635731][ T5854] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 297.644319][ T5854] cdc_ncm 3-1:1.1: bind() failure [ 297.769992][ T5854] usb 3-1: USB disconnect, device number 3 [ 298.638230][ T1890] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 298.657553][ T1890] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 298.686639][ T1890] bond0 (unregistering): Released all slaves [ 299.482936][ T1890] hsr_slave_0: left promiscuous mode [ 299.501251][ T1890] hsr_slave_1: left promiscuous mode [ 299.509995][ T1890] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 299.517757][ T1890] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 299.605522][ T1890] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 299.613534][ T1890] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 299.793319][ T1890] veth1_macvtap: left promiscuous mode [ 299.799187][ T1890] veth0_macvtap: left promiscuous mode [ 299.805399][ T1890] veth1_vlan: left promiscuous mode [ 299.811174][ T1890] veth0_vlan: left promiscuous mode [ 299.978049][ T6044] loop3: detected capacity change from 0 to 64 [ 299.996012][ T6045] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 300.019682][ T30] audit: type=1326 audit(1750165518.484:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6037 comm="syz.2.17" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbff558e929 code=0x0 [ 300.354872][ T6039] Zero length message leads to an empty skb [ 301.032477][ T1890] team0 (unregistering): Port device team_slave_1 removed [ 301.214447][ T1890] team0 (unregistering): Port device team_slave_0 removed [ 302.164897][ T5810] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 302.268615][ T5810] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 302.428423][ T5810] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 302.676488][ T5810] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 302.697689][ T6060] loop2: detected capacity change from 0 to 32768 [ 302.733585][ T5810] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 302.889721][ T24] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 303.094705][ T6056] loop1: detected capacity change from 0 to 4096 [ 303.096623][ T6060] XFS (loop2): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 303.135294][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 303.148223][ T24] usb 5-1: not running at top speed; connect to a high speed hub [ 303.170181][ T24] usb 5-1: config 3 has 0 interfaces, different from the descriptor's value: 1 [ 303.210899][ T24] usb 5-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice=e8.8a [ 303.229116][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 303.237672][ T24] usb 5-1: Product: syz [ 303.242299][ T24] usb 5-1: Manufacturer: syz [ 303.247191][ T24] usb 5-1: SerialNumber: syz [ 303.728090][ T6080] netlink: 32 bytes leftover after parsing attributes in process `syz.4.22'. [ 304.180586][ T6056] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 304.578896][ T6060] XFS (loop2): Ending clean mount [ 304.612156][ T6060] XFS (loop2): Quotacheck needed: Please wait. [ 304.790626][ T5852] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 304.794408][ T5096] Bluetooth: hci0: command tx timeout [ 304.847018][ T6060] XFS (loop2): Quotacheck: Done. [ 304.985747][ T5811] XFS (loop2): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 305.021632][ T5852] usb 2-1: Using ep0 maxpacket: 16 [ 305.197618][ T5852] usb 2-1: unable to get BOS descriptor or descriptor too short [ 305.333133][ T5852] usb 2-1: config 1 interface 0 has no altsetting 0 [ 306.131630][ T24] usb 5-1: USB disconnect, device number 2 [ 306.303622][ T6092] loop3: detected capacity change from 0 to 256 [ 306.331385][ T6061] chnl_net:caif_netlink_parms(): no params data found [ 306.864091][ T5096] Bluetooth: hci0: command tx timeout [ 306.952255][ T6097] FAULT_INJECTION: forcing a failure. [ 306.952255][ T6097] name failslab, interval 1, probability 0, space 0, times 1 [ 306.966092][ T6097] CPU: 1 UID: 0 PID: 6097 Comm: syz.4.27 Not tainted 6.16.0-rc2-syzkaller-00024-g9afe652958c3 #0 PREEMPT(undef) [ 306.966264][ T6097] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 306.966364][ T6097] Call Trace: [ 306.966423][ T6097] [ 306.966482][ T6097] __dump_stack+0x26/0x30 [ 306.966693][ T6097] dump_stack_lvl+0x1df/0x270 [ 306.966913][ T6097] dump_stack+0x1e/0x25 [ 306.967117][ T6097] should_fail_ex+0x7dc/0x8a0 [ 306.967352][ T6097] should_failslab+0x15b/0x200 [ 306.967598][ T6097] __kmalloc_cache_noprof+0xcb/0xed0 [ 306.967785][ T6097] ? kmsan_get_metadata+0xfb/0x160 [ 306.968017][ T6097] ? alloc_pipe_info+0x14a/0xc50 [ 306.968257][ T6097] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 306.968482][ T6097] ? kmsan_get_metadata+0xfb/0x160 [ 306.968731][ T6097] alloc_pipe_info+0x14a/0xc50 [ 306.968972][ T6097] ? __rcu_read_unlock+0x6d/0xd0 [ 306.969156][ T6097] ? aa_file_perm+0x24c/0x18d0 [ 306.969369][ T6097] ? kmsan_get_metadata+0xfb/0x160 [ 306.969597][ T6097] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 306.969849][ T6097] splice_direct_to_actor+0x1174/0x1550 [ 306.970090][ T6097] ? __pfx_direct_splice_actor+0x10/0x10 [ 306.970313][ T6097] ? filter_irq_stacks+0x49/0x190 [ 306.970499][ T6097] ? stack_depot_save_flags+0x35/0x7b0 [ 306.970711][ T6097] ? kmsan_get_metadata+0xfb/0x160 [ 306.970944][ T6097] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 306.971171][ T6097] ? kmsan_get_metadata+0xfb/0x160 [ 306.971403][ T6097] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 306.971655][ T6097] do_splice_direct+0x1e0/0x350 [ 306.971879][ T6097] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 306.972149][ T6097] do_sendfile+0x9eb/0x1110 [ 306.972386][ T6097] __se_sys_sendfile64+0x1e3/0x280 [ 306.972574][ T6097] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 306.972826][ T6097] __x64_sys_sendfile64+0xbd/0x120 [ 306.973039][ T6097] x64_sys_call+0xd49/0x3db0 [ 306.973262][ T6097] do_syscall_64+0xd9/0x210 [ 306.973445][ T6097] ? irqentry_exit+0x16/0x60 [ 306.973604][ T6097] ? clear_bhb_loop+0x40/0x90 [ 306.973793][ T6097] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 306.973995][ T6097] RIP: 0033:0x7fd8c0f8e929 [ 306.974129][ T6097] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 306.974266][ T6097] RSP: 002b:00007fd8bedd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 306.974423][ T6097] RAX: ffffffffffffffda RBX: 00007fd8c11b6080 RCX: 00007fd8c0f8e929 [ 306.974540][ T6097] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000006 [ 306.974634][ T6097] RBP: 00007fd8bedd5090 R08: 0000000000000000 R09: 0000000000000000 [ 306.974734][ T6097] R10: 000000007ffff000 R11: 0000000000000246 R12: 0000000000000001 [ 306.974833][ T6097] R13: 0000000000000000 R14: 00007fd8c11b6080 R15: 00007fff645d5ac8 [ 306.974985][ T6097] [ 307.387900][ T6094] loop2: detected capacity change from 0 to 1024 [ 307.749221][ T5852] usb 2-1: New USB device found, idVendor=046d, idProduct=ffff, bcdDevice= 0.40 [ 307.760709][ T5852] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.769057][ T5852] usb 2-1: Product: Ћ [ 307.962820][ T5812] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 308.335272][ T5852] usb 2-1: can't set config #1, error -71 [ 308.350145][ T30] audit: type=1800 audit(1750165526.804:3): pid=6092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.26" name="file0" dev="loop3" ino=1048600 res=0 errno=0 [ 308.450384][ T5852] usb 2-1: USB disconnect, device number 2 [ 308.690419][ T5854] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 308.940297][ T5096] Bluetooth: hci0: command tx timeout [ 308.976892][ T5854] usb 4-1: config 0 has an invalid interface number: 69 but max is 0 [ 308.986605][ T5854] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 308.997337][ T5854] usb 4-1: config 0 has no interface number 0 [ 309.003899][ T5854] usb 4-1: config 0 interface 69 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 309.014203][ T5854] usb 4-1: config 0 interface 69 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 309.423804][ T5854] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 309.433503][ T5854] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 309.442041][ T5854] usb 4-1: Product: syz [ 309.446500][ T5854] usb 4-1: Manufacturer: syz [ 309.451504][ T5854] usb 4-1: SerialNumber: syz [ 309.545142][ T3743] hfsplus: b-tree write err: -5, ino 4 [ 309.661357][ T5854] usb 4-1: config 0 descriptor?? [ 310.256797][ T5854] usb 4-1: can't set config #0, error -71 [ 310.363954][ T5854] usb 4-1: USB disconnect, device number 2 [ 311.011217][ T6061] bridge0: port 1(bridge_slave_0) entered blocking state [ 311.018943][ T6061] bridge0: port 1(bridge_slave_0) entered disabled state [ 311.019891][ T5096] Bluetooth: hci0: command tx timeout [ 311.026837][ T6061] bridge_slave_0: entered allmulticast mode [ 311.042202][ T6061] bridge_slave_0: entered promiscuous mode [ 311.314728][ T6061] bridge0: port 2(bridge_slave_1) entered blocking state [ 311.322650][ T6061] bridge0: port 2(bridge_slave_1) entered disabled state [ 311.330906][ T6061] bridge_slave_1: entered allmulticast mode [ 311.341085][ T6061] bridge_slave_1: entered promiscuous mode [ 311.669779][ T30] audit: type=1326 audit(1750165530.154:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6122 comm="syz.1.32" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7bcc98e929 code=0x0 [ 311.832791][ T6061] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 311.938485][ T6061] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 311.938990][ T6128] fuse: Bad value for 'user_id' [ 311.953584][ T6128] fuse: Bad value for 'user_id' [ 312.086591][ T6110] loop4: detected capacity change from 0 to 8192 [ 312.456660][ T6061] team0: Port device team_slave_0 added [ 312.591763][ T6061] team0: Port device team_slave_1 added [ 312.761860][ T6110] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 2074) [ 312.771435][ T6110] FAT-fs (loop4): Filesystem has been set read-only [ 312.778803][ T6110] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 2074) [ 312.788426][ T6110] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 2074) [ 312.798233][ T6110] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 2074) [ 313.254757][ T6061] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 313.262840][ T6061] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 313.289789][ T6061] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 313.490184][ T6061] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 313.497450][ T6061] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 313.530373][ T6061] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 313.827790][ T6142] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 314.455022][ T6061] hsr_slave_0: entered promiscuous mode [ 314.466226][ T6061] hsr_slave_1: entered promiscuous mode [ 314.559657][ T6148] loop4: detected capacity change from 0 to 128 [ 315.063765][ T6152] loop8: detected capacity change from 0 to 1 [ 315.141964][ T6152] Dev loop8: unable to read RDB block 1 [ 315.148034][ T6152] loop8: unable to read partition table [ 315.251611][ T6152] loop8: partition table beyond EOD, truncated [ 315.258272][ T6152] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 315.694636][ T6153] loop2: detected capacity change from 0 to 1024 [ 316.815964][ T3069] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 317.072699][ T3069] usb 5-1: config 0 has an invalid interface number: 175 but max is 0 [ 317.081453][ T3069] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 317.092283][ T3069] usb 5-1: config 0 has no interface number 0 [ 317.098719][ T3069] usb 5-1: config 0 interface 175 altsetting 0 has an endpoint descriptor with address 0xBC, changing to 0x8C [ 317.110966][ T3069] usb 5-1: config 0 interface 175 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 317.116317][ T6061] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 317.122671][ T3069] usb 5-1: config 0 interface 175 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 317.122836][ T3069] usb 5-1: config 0 interface 175 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 16 [ 317.257266][ T30] audit: type=1326 audit(1750165535.684:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6162 comm="syz.2.44" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbff558e929 code=0x0 [ 317.327932][ T3069] usb 5-1: New USB device found, idVendor=05e0, idProduct=0600, bcdDevice=f9.9b [ 317.338017][ T3069] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.353211][ T3069] usb 5-1: Product: syz [ 317.357702][ T3069] usb 5-1: Manufacturer: syz [ 317.366172][ T3069] usb 5-1: SerialNumber: syz [ 317.403260][ T6061] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 317.438547][ T6061] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 317.531854][ T6061] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 317.605965][ T6167] loop3: detected capacity change from 0 to 16 [ 317.637125][ T3069] usb 5-1: config 0 descriptor?? [ 317.679909][ T6167] erofs: Unknown parameter '' [ 317.721866][ T3069] symbolserial 5-1:0.175: symbol converter detected [ 317.915789][ T3069] usb 5-1: symbol converter now attached to ttyUSB0 [ 318.317746][ T6172] netlink: 596 bytes leftover after parsing attributes in process `syz.4.43'. [ 318.468365][ T6161] loop4: detected capacity change from 0 to 2048 [ 318.795130][ T6161] loop4: p1 p2 p3 [ 318.955420][ T6173] warning: `syz.1.46' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 319.006547][ T5852] usb 5-1: USB disconnect, device number 3 [ 319.093878][ T5852] symbol ttyUSB0: symbol converter now disconnected from ttyUSB0 [ 319.104829][ T5852] symbolserial 5-1:0.175: device disconnected [ 319.161622][ T6178] loop2: detected capacity change from 0 to 1024 [ 319.518186][ T6061] 8021q: adding VLAN 0 to HW filter on device bond0 [ 319.947566][ T6061] 8021q: adding VLAN 0 to HW filter on device team0 [ 319.973384][ T6182] loop3: detected capacity change from 0 to 1764 [ 320.061528][ T6182] ISOFS: Bad logical zone size 1280 [ 320.140103][ T1890] bridge0: port 1(bridge_slave_0) entered blocking state [ 320.147806][ T1890] bridge0: port 1(bridge_slave_0) entered forwarding state [ 320.341605][ T4602] hfsplus: b-tree write err: -5, ino 4 [ 320.394155][ T1890] bridge0: port 2(bridge_slave_1) entered blocking state [ 320.401966][ T1890] bridge0: port 2(bridge_slave_1) entered forwarding state [ 322.296237][ T6203] loop2: detected capacity change from 0 to 128 [ 323.682244][ T6210] loop2: detected capacity change from 0 to 4096 [ 323.857406][ T6210] ntfs3(loop2): Different NTFS sector size (1024) and media sector size (512). [ 323.920601][ T6219] loop4: detected capacity change from 0 to 256 [ 323.922039][ T6061] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 324.015098][ T6219] vfat: Deprecated parameter 'posix' [ 324.020985][ T6219] FAT-fs: "posix" option is obsolete, not supported now [ 324.297093][ T6225] FAULT_INJECTION: forcing a failure. [ 324.297093][ T6225] name failslab, interval 1, probability 0, space 0, times 0 [ 324.321665][ T6225] CPU: 0 UID: 0 PID: 6225 Comm: syz.3.57 Not tainted 6.16.0-rc2-syzkaller-00024-g9afe652958c3 #0 PREEMPT(undef) [ 324.321838][ T6225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 324.321940][ T6225] Call Trace: [ 324.321999][ T6225] [ 324.322058][ T6225] __dump_stack+0x26/0x30 [ 324.322262][ T6225] dump_stack_lvl+0x1df/0x270 [ 324.322466][ T6225] dump_stack+0x1e/0x25 [ 324.322653][ T6225] should_fail_ex+0x7dc/0x8a0 [ 324.322871][ T6225] should_failslab+0x15b/0x200 [ 324.323093][ T6225] kmem_cache_alloc_node_noprof+0xf3/0xf00 [ 324.323262][ T6225] ? __alloc_skb+0x1e0/0x7d0 [ 324.323476][ T6225] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 324.323695][ T6225] ? kmsan_get_metadata+0xfb/0x160 [ 324.323908][ T6225] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 324.324143][ T6225] __alloc_skb+0x1e0/0x7d0 [ 324.324378][ T6225] tcp_stream_alloc_skb+0x4c/0x5f0 [ 324.324602][ T6225] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 324.324839][ T6225] tcp_sendmsg_locked+0x3e41/0x79b0 [ 324.325108][ T6225] ? aa_label_sk_perm+0x6f0/0x7b0 [ 324.325279][ T6225] ? stack_depot_save_flags+0x35/0x7b0 [ 324.325471][ T6225] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 324.325692][ T6225] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 324.325959][ T6225] ? __pfx_tcp_sendmsg+0x10/0x10 [ 324.326172][ T6225] tcp_sendmsg+0x4b/0x90 [ 324.326371][ T6225] ? __pfx_tcp_sendmsg+0x10/0x10 [ 324.326575][ T6225] inet_sendmsg+0x134/0x2a0 [ 324.326769][ T6225] __sock_sendmsg+0x278/0x3d0 [ 324.326975][ T6225] __sys_sendto+0x593/0x720 [ 324.327119][ T6225] ? kmsan_internal_unpoison_memory+0x14/0x20 [ 324.327334][ T6225] ? vfs_write+0x1359/0x1580 [ 324.327538][ T6225] ? kmsan_get_metadata+0xfb/0x160 [ 324.327808][ T6225] __x64_sys_sendto+0x130/0x200 [ 324.327993][ T6225] x64_sys_call+0x3c0b/0x3db0 [ 324.328204][ T6225] do_syscall_64+0xd9/0x210 [ 324.328373][ T6225] ? irqentry_exit+0x16/0x60 [ 324.328516][ T6225] ? clear_bhb_loop+0x40/0x90 [ 324.328727][ T6225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 324.328898][ T6225] RIP: 0033:0x7fbad6b8e929 [ 324.329026][ T6225] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 324.329163][ T6225] RSP: 002b:00007fbad7a96038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 324.329314][ T6225] RAX: ffffffffffffffda RBX: 00007fbad6db5fa0 RCX: 00007fbad6b8e929 [ 324.329429][ T6225] RDX: 0000000000000002 RSI: 00002000000004c0 RDI: 0000000000000003 [ 324.329525][ T6225] RBP: 00007fbad7a96090 R08: 0000000000000000 R09: 0000000000000000 [ 324.329631][ T6225] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 324.329726][ T6225] R13: 0000000000000000 R14: 00007fbad6db5fa0 R15: 00007ffcea582d48 [ 324.329871][ T6225] [ 325.205085][ T6210] ntfs3(loop2): Failed to read $UpCase (-4). [ 326.996127][ T6237] loop1: detected capacity change from 0 to 64 [ 327.211862][ T6240] tmpfs: Unknown parameter '/' [ 328.454638][ T6061] veth0_vlan: entered promiscuous mode [ 328.563843][ T6061] veth1_vlan: entered promiscuous mode [ 328.794844][ T6061] veth0_macvtap: entered promiscuous mode [ 328.860170][ T6061] veth1_macvtap: entered promiscuous mode [ 329.013029][ T6061] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 329.115881][ T6061] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 329.181257][ T6061] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.190671][ T6061] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.200183][ T6061] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 329.209260][ T6061] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 333.195603][ T4602] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 333.204057][ T4602] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 333.336146][ T1787] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 333.346555][ T1787] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.028965][ T6311] loop5: detected capacity change from 0 to 512 [ 336.164983][ T6311] EXT4-fs: Ignoring removed nomblk_io_submit option [ 336.429934][ T6311] EXT4-fs error (device loop5): ext4_expand_extra_isize_ea:2798: inode #11: comm syz.5.63: corrupted xattr block 95: invalid header [ 336.588702][ T6311] EXT4-fs (loop5): Remounting filesystem read-only [ 336.605242][ T6311] EXT4-fs warning (device loop5): ext4_expand_extra_isize_ea:2848: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 336.621532][ T6311] EXT4-fs warning (device loop5): ext4_evict_inode:257: couldn't mark inode dirty (err -30) [ 336.632339][ T6311] EXT4-fs (loop5): 1 orphan inode deleted [ 336.641095][ T6311] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 336.939260][ T6316] loop2: detected capacity change from 0 to 32768 [ 336.966535][ T6318] loop3: detected capacity change from 0 to 2048 [ 337.191144][ T6316] XFS (loop2): Mounting V5 Filesystem 9f1cad42-11bd-4e12-8f0b-f07876b81d9a [ 337.404931][ T6061] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 337.490899][ T6333] syz.4.69 uses obsolete (PF_INET,SOCK_PACKET) [ 337.681055][ T6336] FAULT_INJECTION: forcing a failure. [ 337.681055][ T6336] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 337.695186][ T6336] CPU: 0 UID: 0 PID: 6336 Comm: syz.1.68 Not tainted 6.16.0-rc2-syzkaller-00024-g9afe652958c3 #0 PREEMPT(undef) [ 337.695353][ T6336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 337.695441][ T6336] Call Trace: [ 337.695496][ T6336] [ 337.695578][ T6336] __dump_stack+0x26/0x30 [ 337.695774][ T6336] dump_stack_lvl+0x1df/0x270 [ 337.695988][ T6336] dump_stack+0x1e/0x25 [ 337.696169][ T6336] should_fail_ex+0x7dc/0x8a0 [ 337.696390][ T6336] should_fail+0x2a/0x40 [ 337.696570][ T6336] should_fail_usercopy+0x2e/0x40 [ 337.696776][ T6336] _copy_from_user+0x33/0x100 [ 337.696974][ T6336] ___sys_sendmsg+0x11b/0x3b0 [ 337.697163][ T6336] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 337.697407][ T6336] ? __rcu_read_unlock+0x6d/0xd0 [ 337.697577][ T6336] ? __fget_files+0x3b4/0x4a0 [ 337.697730][ T6336] ? __fget_files+0x3b9/0x4a0 [ 337.697895][ T6336] ? kmsan_get_metadata+0xfb/0x160 [ 337.698110][ T6336] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 337.698349][ T6336] __x64_sys_sendmsg+0x211/0x3e0 [ 337.698525][ T6336] ? fput+0x113/0x160 [ 337.698687][ T6336] ? kmsan_get_metadata+0xfb/0x160 [ 337.698909][ T6336] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 337.699134][ T6336] ? kmsan_get_metadata+0xfb/0x160 [ 337.699378][ T6336] x64_sys_call+0x32fb/0x3db0 [ 337.699577][ T6336] do_syscall_64+0xd9/0x210 [ 337.699745][ T6336] ? irqentry_exit+0x16/0x60 [ 337.699898][ T6336] ? clear_bhb_loop+0x40/0x90 [ 337.700076][ T6336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.700248][ T6336] RIP: 0033:0x7f7bcc98e929 [ 337.700368][ T6336] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 337.700505][ T6336] RSP: 002b:00007f7bca7f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 337.700656][ T6336] RAX: ffffffffffffffda RBX: 00007f7bccbb5fa0 RCX: 00007f7bcc98e929 [ 337.700772][ T6336] RDX: 0000000000040000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 337.700882][ T6336] RBP: 00007f7bca7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 337.700981][ T6336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 337.701076][ T6336] R13: 0000000000000000 R14: 00007f7bccbb5fa0 R15: 00007ffecc6f0ac8 [ 337.701222][ T6336] [ 338.509662][ T6316] XFS (loop2): Ending clean mount [ 338.517728][ T6316] XFS (loop2): Metadata CRC error detected at xfs_inobt_read_verify+0xaf/0x2d0, xfs_finobt block 0x20 [ 338.529759][ T6316] XFS (loop2): Unmount and run xfs_repair [ 338.535784][ T6316] XFS (loop2): First 128 bytes of corrupted metadata buffer: [ 338.550244][ T6316] 00000000: 46 49 42 33 00 00 00 01 ff ff ff ff ff ff ff ff FIB3............ [ 338.559635][ T6316] 00000010: 00 00 00 00 00 00 00 20 00 00 00 01 00 00 00 40 ....... .......@ [ 338.568812][ T6316] 00000020: 9f 1c ad 42 11 bd 4e 12 8f 0b f0 78 76 b8 1d 9a ...B..N....xv... [ 338.579181][ T6316] 00000030: 00 00 00 00 8a d2 18 46 00 00 16 80 00 00 40 37 .......F......@7 [ 338.588538][ T6316] 00000040: ff ff ff ff ff ff fe 00 00 00 00 00 00 00 00 00 ................ [ 338.597906][ T6316] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 ................ [ 338.607293][ T6316] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 338.616688][ T6316] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 338.625950][ T6316] XFS (loop2): metadata I/O error in "xfs_btree_read_buf_block+0x33d/0x5f0" at daddr 0x20 len 8 error 74 [ 338.638510][ T6316] XFS (loop2): Failed to initialize disk quotas, err -117. [ 338.857716][ T5811] XFS (loop2): Unmounting Filesystem 9f1cad42-11bd-4e12-8f0b-f07876b81d9a [ 338.904199][ T6345] tipc: Started in network mode [ 338.909835][ T6345] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 338.919038][ T6345] tipc: Enabled bearer , priority 10 [ 338.945496][ T5811] XFS (loop2): Uncorrected metadata errors detected; please run xfs_repair. [ 340.061629][ T6352] loop1: detected capacity change from 0 to 32768 [ 340.074705][ T3069] tipc: Node number set to 10005162 [ 340.093132][ T6352] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.73 (6352) [ 340.250502][ T6352] BTRFS info (device loop1): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 340.261278][ T6352] BTRFS info (device loop1): using sha256 (sha256-x86_64) checksum algorithm [ 340.363150][ T6358] tmpfs: Bad value for 'mpol' [ 340.599108][ T30] audit: type=1326 audit(1750165559.064:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6361 comm="syz.5.76" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f240b18e929 code=0x0 [ 340.888522][ T5812] BTRFS info (device loop1): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 341.049794][ T3069] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 341.280094][ T3069] usb 6-1: Using ep0 maxpacket: 16 [ 341.370834][ T3069] usb 6-1: config index 0 descriptor too short (expected 16456, got 72) [ 341.379899][ T3069] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 341.388395][ T3069] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 341.397192][ T3069] usb 6-1: config 0 has an invalid interface number: 125 but max is 1 [ 341.405873][ T3069] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 341.421831][ T3069] usb 6-1: config 0 has no interface number 0 [ 341.428264][ T3069] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 341.442301][ T3069] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 341.452643][ T3069] usb 6-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 341.463049][ T3069] usb 6-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 341.476724][ T3069] usb 6-1: config 0 interface 125 has no altsetting 0 [ 341.484115][ T3069] usb 6-1: config 0 interface 125 has no altsetting 2 [ 342.087533][ T6387] loop3: detected capacity change from 0 to 256 [ 342.152405][ T3069] usb 6-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 342.162214][ T3069] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.171346][ T3069] usb 6-1: Product: syz [ 342.175817][ T3069] usb 6-1: Manufacturer: syz [ 342.181065][ T3069] usb 6-1: SerialNumber: syz [ 342.281654][ T3069] usb 6-1: config 0 descriptor?? [ 342.429556][ T3069] usb 6-1: selecting invalid altsetting 2 [ 342.511465][ T6379] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 342.523747][ T6379] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 343.208194][ T6383] loop4: detected capacity change from 0 to 4096 [ 343.520784][ T3069] get_1284_register timeout [ 343.525647][ T3069] uss720 6-1:0.125: probe with driver uss720 failed with error -5 [ 343.534154][ C1] usb 6-1: async_complete: urb error -104 [ 343.534945][ C1] usb 6-1: async_complete: urb error -104 [ 343.828623][ T6398] netlink: 8 bytes leftover after parsing attributes in process `syz.3.80'. [ 344.746864][ T3069] usb 6-1: USB disconnect, device number 2 [ 352.564933][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 352.576863][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 390.460135][ T6568] Bluetooth: hci1: command 0x0406 tx timeout [ 390.466767][ T5801] Bluetooth: hci4: command 0x0406 tx timeout [ 390.467163][ T49] Bluetooth: hci3: command 0x0406 tx timeout [ 390.473237][ T6568] Bluetooth: hci2: command 0x0406 tx timeout [ 403.490494][ T6587] netlink: 16 bytes leftover after parsing attributes in process `syz.2.86'. [ 403.613436][ T6587] netlink: 4 bytes leftover after parsing attributes in process `syz.2.86'. [ 404.371766][ T5859] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 404.570171][ T5859] usb 5-1: Using ep0 maxpacket: 16 [ 404.616897][ T5859] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 404.677597][ T5859] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 404.687392][ T5859] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.698509][ T5859] usb 5-1: Product: syz [ 404.703831][ T5859] usb 5-1: Manufacturer: syz [ 404.708710][ T5859] usb 5-1: SerialNumber: syz [ 404.864129][ T5859] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 405.104406][ T6606] input: syz0 as /devices/virtual/input/input7 [ 406.171308][ T3069] usb 5-1: USB disconnect, device number 4 [ 406.415050][ T6614] loop2: detected capacity change from 0 to 32768 [ 406.487072][ T6614] XFS (loop2): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 406.500036][ T5859] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 406.700464][ T5859] usb 2-1: Using ep0 maxpacket: 8 [ 406.776585][ T6632] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 406.794914][ T6618] netlink: 12 bytes leftover after parsing attributes in process `syz.5.96'. [ 406.820009][ T5859] usb 2-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 406.829671][ T5859] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.837993][ T5859] usb 2-1: Product: syz [ 406.844907][ T5859] usb 2-1: Manufacturer: syz [ 406.850607][ T5859] usb 2-1: SerialNumber: syz [ 406.930130][ T5859] usb 2-1: config 0 descriptor?? [ 406.955905][ T5859] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 407.337699][ T6614] XFS (loop2): Ending clean mount [ 407.396393][ T6614] XFS (loop2): Quotacheck needed: Please wait. [ 407.546959][ T6614] XFS (loop2): Quotacheck: Done. [ 408.119210][ T5811] XFS (loop2): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 408.552390][ T30] audit: type=1326 audit(1750165627.034:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6636 comm="syz.3.99" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbad6b8e929 code=0x0 [ 409.138583][ T6646] sd 0:0:1:0: PR command failed: 1026 [ 409.145020][ T6646] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 409.152832][ T6646] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 409.553260][ T5859] usb 2-1: USB disconnect, device number 3 [ 410.871044][ T6654] loop2: detected capacity change from 0 to 40427 [ 410.893720][ T6654] F2FS-fs (loop2): Fix alignment : internally, start(4096) end(16896) block(12288) [ 410.916754][ T6654] F2FS-fs (loop2): invalid crc value [ 411.107136][ T6653] loop3: detected capacity change from 0 to 40427 [ 411.253511][ T6653] F2FS-fs (loop3): invalid crc value [ 411.281319][ T6649] loop5: detected capacity change from 0 to 4096 [ 411.483561][ T6654] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 411.752714][ T6653] F2FS-fs (loop3): Start checkpoint disabled! [ 411.817063][ T6653] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 412.159126][ T6649] ntfs3(loop5): Failed to read $UpCase (-4). [ 412.212315][ T6657] Cannot find add_set index 0 as target [ 412.358271][ T4602] kworker/u8:31: attempt to access beyond end of device [ 412.358271][ T4602] loop3: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 412.376109][ T4602] CPU: 0 UID: 0 PID: 4602 Comm: kworker/u8:31 Not tainted 6.16.0-rc2-syzkaller-00024-g9afe652958c3 #0 PREEMPT(undef) [ 412.376280][ T4602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 412.376418][ T4602] Workqueue: writeback wb_workfn (flush-7:3) [ 412.376632][ T4602] Call Trace: [ 412.376688][ T4602] [ 412.376745][ T4602] __dump_stack+0x26/0x30 [ 412.376934][ T4602] dump_stack_lvl+0x1df/0x270 [ 412.377136][ T4602] dump_stack+0x1e/0x25 [ 412.377312][ T4602] f2fs_handle_critical_error+0xa6f/0xc20 [ 412.377593][ T4602] f2fs_stop_checkpoint+0x65/0x80 [ 412.377821][ T4602] f2fs_write_end_io+0xb4b/0x1920 [ 412.377992][ T4602] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 412.378237][ T4602] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 412.378393][ T4602] bio_endio+0xe24/0xf80 [ 412.378614][ T4602] submit_bio_noacct+0x214/0x2710 [ 412.378882][ T4602] submit_bio+0x5a9/0x5d0 [ 412.379095][ T4602] f2fs_submit_write_bio+0x92/0x250 [ 412.379319][ T4602] __submit_merged_bio+0x16f/0x6a0 [ 412.379530][ T4602] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 412.379768][ T4602] __submit_merged_write_cond+0x715/0x9a0 [ 412.379969][ T4602] ? filemap_get_folios_tag+0x488/0x510 [ 412.380168][ T4602] f2fs_submit_merged_write+0x31/0x40 [ 412.380372][ T4602] f2fs_sync_node_pages+0x26ce/0x27c0 [ 412.380593][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.380914][ T4602] f2fs_write_node_pages+0x3c5/0xb40 [ 412.381105][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.381320][ T4602] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 412.381573][ T4602] ? __pfx_f2fs_write_node_pages+0x10/0x10 [ 412.381769][ T4602] do_writepages+0x3f2/0x860 [ 412.381959][ T4602] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 412.382192][ T4602] ? queue_io+0x741/0x790 [ 412.382361][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.382612][ T4602] __writeback_single_inode+0x101/0x1190 [ 412.382820][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.383054][ T4602] writeback_sb_inodes+0xaa9/0x1c90 [ 412.383355][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.383633][ T4602] wb_writeback+0x4ce/0xc00 [ 412.383841][ T4602] ? queue_io+0x441/0x790 [ 412.384036][ T4602] wb_workfn+0x397/0x1910 [ 412.384200][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.384445][ T4602] ? __pfx_wb_workfn+0x10/0x10 [ 412.384611][ T4602] process_scheduled_works+0xb91/0x1d80 [ 412.384906][ T4602] worker_thread+0xedf/0x1590 [ 412.385166][ T4602] kthread+0xd5c/0xf00 [ 412.385317][ T4602] ? __pfx_worker_thread+0x10/0x10 [ 412.385567][ T4602] ? __pfx_kthread+0x10/0x10 [ 412.385730][ T4602] ret_from_fork+0x1e3/0x310 [ 412.385890][ T4602] ? __pfx_kthread+0x10/0x10 [ 412.386052][ T4602] ret_from_fork_asm+0x1a/0x30 [ 412.386291][ T4602] [ 412.656224][ T4602] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 412.666857][ T4602] CPU: 0 UID: 0 PID: 4602 Comm: kworker/u8:31 Not tainted 6.16.0-rc2-syzkaller-00024-g9afe652958c3 #0 PREEMPT(undef) [ 412.667031][ T4602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 412.667153][ T4602] Workqueue: writeback wb_workfn (flush-7:3) [ 412.667361][ T4602] Call Trace: [ 412.667419][ T4602] [ 412.667477][ T4602] __dump_stack+0x26/0x30 [ 412.667665][ T4602] dump_stack_lvl+0x1df/0x270 [ 412.667869][ T4602] dump_stack+0x1e/0x25 [ 412.668047][ T4602] f2fs_handle_critical_error+0xa6f/0xc20 [ 412.668322][ T4602] f2fs_stop_checkpoint+0x65/0x80 [ 412.668557][ T4602] f2fs_write_end_io+0xb4b/0x1920 [ 412.668758][ T4602] ? __pfx_f2fs_write_end_io+0x10/0x10 [ 412.668916][ T4602] bio_endio+0xe24/0xf80 [ 412.669128][ T4602] submit_bio_noacct+0x214/0x2710 [ 412.669404][ T4602] submit_bio+0x5a9/0x5d0 [ 412.669617][ T4602] f2fs_submit_write_bio+0x92/0x250 [ 412.669836][ T4602] __submit_merged_bio+0x16f/0x6a0 [ 412.670047][ T4602] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 412.670281][ T4602] __submit_merged_write_cond+0x715/0x9a0 [ 412.670480][ T4602] ? filemap_get_folios_tag+0x488/0x510 [ 412.670670][ T4602] f2fs_submit_merged_write+0x31/0x40 [ 412.670865][ T4602] f2fs_sync_node_pages+0x26ce/0x27c0 [ 412.671076][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.671400][ T4602] f2fs_write_node_pages+0x3c5/0xb40 [ 412.671584][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.671795][ T4602] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 412.672036][ T4602] ? __pfx_f2fs_write_node_pages+0x10/0x10 [ 412.672223][ T4602] do_writepages+0x3f2/0x860 [ 412.672424][ T4602] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 412.672653][ T4602] ? queue_io+0x741/0x790 [ 412.672822][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.673051][ T4602] __writeback_single_inode+0x101/0x1190 [ 412.673251][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.673487][ T4602] writeback_sb_inodes+0xaa9/0x1c90 [ 412.673781][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.674049][ T4602] wb_writeback+0x4ce/0xc00 [ 412.674257][ T4602] ? queue_io+0x441/0x790 [ 412.674457][ T4602] wb_workfn+0x397/0x1910 [ 412.674610][ T4602] ? kmsan_get_metadata+0xfb/0x160 [ 412.674848][ T4602] ? __pfx_wb_workfn+0x10/0x10 [ 412.675004][ T4602] process_scheduled_works+0xb91/0x1d80 [ 412.675314][ T4602] worker_thread+0xedf/0x1590 [ 412.675583][ T4602] kthread+0xd5c/0xf00 [ 412.675733][ T4602] ? __pfx_worker_thread+0x10/0x10 [ 412.675972][ T4602] ? __pfx_kthread+0x10/0x10 [ 412.676127][ T4602] ret_from_fork+0x1e3/0x310 [ 412.676278][ T4602] ? __pfx_kthread+0x10/0x10 [ 412.676444][ T4602] ret_from_fork_asm+0x1a/0x30 [ 412.676677][ T4602] [ 412.938751][ T4602] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 414.029017][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 414.036042][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 416.494136][ T6672] loop5: detected capacity change from 0 to 32768 [ 416.602785][ T6680] loop2: detected capacity change from 0 to 128 [ 416.695698][ T6680] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 416.733659][ T6680] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 416.744624][ T6680] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 416.755456][ T6680] UDF-fs: Scanning with blocksize 512 failed [ 416.820737][ T6672] XFS (loop5): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 416.873552][ T6680] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 416.933553][ T6680] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 416.944033][ T6680] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 416.952376][ T6680] UDF-fs: Scanning with blocksize 1024 failed [ 417.133758][ T6680] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 417.247388][ T6680] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 417.257742][ T6680] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 417.266403][ T6680] UDF-fs: Scanning with blocksize 2048 failed [ 417.469726][ T6680] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 417.631176][ T6680] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=512, location=512 [ 417.642186][ T6680] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 417.650609][ T6680] UDF-fs: Scanning with blocksize 4096 failed [ 417.656958][ T6680] UDF-fs: warning (device loop2): udf_fill_super: No partition found (1) [ 418.012756][ T6691] netlink: 16 bytes leftover after parsing attributes in process `syz.3.115'. [ 418.087366][ T6672] XFS (loop5): Ending clean mount [ 418.127863][ T6672] XFS (loop5): Quotacheck needed: Please wait. [ 418.168825][ T6680] loop2: detected capacity change from 0 to 1024 [ 418.236179][ T6672] XFS (loop5): Quotacheck: Done. [ 418.356245][ T6061] XFS (loop5): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 418.389843][ T6694] loop1: detected capacity change from 0 to 256 [ 418.570155][ T6680] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 418.725018][ T30] audit: type=1800 audit(1750165637.194:8): pid=6694 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.116" name="file2" dev="loop1" ino=1048610 res=0 errno=0 [ 418.858074][ T6695] loop4: detected capacity change from 0 to 2048 [ 419.065254][ T6680] EXT4-fs error (device loop2): mb_free_blocks:1948: group 0, inode 18: block 129:freeing already freed block (bit 8); block bitmap corrupt. [ 421.412574][ T6722] netlink: 16 bytes leftover after parsing attributes in process `syz.3.122'. [ 421.908697][ T5811] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 422.206287][ T30] audit: type=1326 audit(1750165640.684:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6725 comm="syz.5.118" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f240b18e929 code=0x0 [ 422.602469][ T6736] loop2: detected capacity change from 0 to 64 [ 422.716492][ T6736] BFS-fs: bfs_fill_super(): loop2 is unclean, continuing [ 422.724202][ T6736] BFS-fs: bfs_fill_super(): Superblock is corrupted on loop2 [ 422.891634][ T6736] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 423.757565][ T6744] loop5: detected capacity change from 0 to 2048 [ 423.976382][ T6744] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 424.330217][ T5859] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 424.710620][ T5859] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 424.720245][ T5859] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.833929][ T6758] loop1: detected capacity change from 0 to 1024 [ 424.855838][ T5859] usb 3-1: config 0 descriptor?? [ 425.117710][ T30] audit: type=1800 audit(1750165643.544:10): pid=6758 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.132" name="file2" dev="loop1" ino=22 res=0 errno=0 [ 425.161099][ T6758] hfsplus: request for non-existent node 16777216 in B*Tree [ 425.168839][ T6758] hfsplus: request for non-existent node 16777216 in B*Tree [ 425.185935][ T5859] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 425.371229][ T6751] UDF-fs: warning (device loop5): udf_truncate_tail_extent: Too long extent after EOF in inode 1436: i_size: 65536 lbcount: 69632 extent 195+8192 [ 426.300250][ T5810] Bluetooth: hci0: command 0x0406 tx timeout [ 426.336586][ T30] audit: type=1326 audit(1750165644.804:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6765 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8c0f8e929 code=0x7ffc0000 [ 426.359799][ T30] audit: type=1326 audit(1750165644.824:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6765 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fd8c0f8e929 code=0x7ffc0000 [ 426.383488][ T30] audit: type=1326 audit(1750165644.824:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6765 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8c0f8e929 code=0x7ffc0000 [ 426.473731][ T6766] mmap: syz.4.135 (6766) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 426.493219][ T6772] netlink: 8 bytes leftover after parsing attributes in process `syz.3.133'. [ 426.695385][ T6748] loop2: detected capacity change from 0 to 4096 [ 426.859190][ T30] audit: type=1326 audit(1750165644.954:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6765 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd8c0f8e929 code=0x7ffc0000 [ 426.882756][ T30] audit: type=1326 audit(1750165644.954:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6765 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8c0f8e929 code=0x7ffc0000 [ 426.905510][ T30] audit: type=1326 audit(1750165644.954:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6765 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8c0f8e929 code=0x7ffc0000 [ 426.934118][ T30] audit: type=1326 audit(1750165644.964:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6765 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fd8c0f8e929 code=0x7ffc0000 [ 426.958717][ T30] audit: type=1326 audit(1750165644.964:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6765 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8c0f8e929 code=0x7ffc0000 [ 426.981627][ T30] audit: type=1326 audit(1750165644.964:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6765 comm="syz.4.135" exe="/root/syz-executor" sig=0 arch=c000003e syscall=216 compat=0 ip=0x7fd8c0f8e929 code=0x7ffc0000 [ 427.792683][ T3743] hfsplus: request for non-existent node 16777216 in B*Tree [ 427.800724][ T3743] hfsplus: request for non-existent node 16777216 in B*Tree [ 427.809519][ T1812] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.109789][ T1812] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.187826][ T5859] [drm:udl_init] *ERROR* Selecting channel failed [ 428.259672][ T3069] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 428.321880][ T5859] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 2 [ 428.328921][ T5859] [drm] Initialized udl on minor 2 [ 428.428462][ T1812] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.500978][ T5859] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 428.513924][ T5859] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 428.540044][ T5854] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 428.580087][ T5854] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 428.588816][ T5854] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 428.638167][ T5859] usb 3-1: USB disconnect, device number 4 [ 428.703501][ T3069] usb 4-1: New USB device found, idVendor=0b95, idProduct=772b, bcdDevice=a2.4c [ 428.713267][ T3069] usb 4-1: New USB device strings: Mfr=24, Product=2, SerialNumber=3 [ 428.722417][ T3069] usb 4-1: Product: syz [ 428.726902][ T3069] usb 4-1: Manufacturer: syz [ 428.731882][ T3069] usb 4-1: SerialNumber: syz [ 428.800415][ T1812] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.897283][ T3069] usb 4-1: config 0 descriptor?? [ 429.129017][ T3069] asix 4-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 429.140571][ T3069] asix 4-1:0.0: probe with driver asix failed with error -61 [ 429.530142][ T6778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.540855][ T6778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 429.839845][ T1812] bridge_slave_1: left allmulticast mode [ 429.845822][ T1812] bridge_slave_1: left promiscuous mode [ 429.852955][ T1812] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.937677][ T1812] bridge_slave_0: left allmulticast mode [ 429.944306][ T1812] bridge_slave_0: left promiscuous mode [ 429.951334][ T1812] bridge0: port 1(bridge_slave_0) entered disabled state [ 431.081314][ T1812] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 431.131611][ T1812] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 431.173730][ T1812] bond0 (unregistering): Released all slaves [ 431.219082][ T24] usb 4-1: USB disconnect, device number 3 [ 432.011243][ T1812] hsr_slave_0: left promiscuous mode [ 432.029593][ T1812] hsr_slave_1: left promiscuous mode [ 432.044658][ T1812] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 432.052610][ T1812] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 432.114464][ T1812] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 432.122412][ T1812] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 432.280118][ T1812] veth1_macvtap: left promiscuous mode [ 432.286009][ T1812] veth0_macvtap: left promiscuous mode [ 432.292244][ T1812] veth1_vlan: left promiscuous mode [ 432.297904][ T1812] veth0_vlan: left promiscuous mode [ 432.672915][ T6797] loop2: detected capacity change from 0 to 64 [ 433.641960][ T5810] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 433.665748][ T5810] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 433.705849][ T5810] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 433.881855][ T5810] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 433.904618][ T5810] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 434.150291][ T6810] loop2: detected capacity change from 0 to 512 [ 434.458693][ T1812] team0 (unregistering): Port device team_slave_1 removed [ 434.540300][ T6810] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 434.553599][ T6810] ext4 filesystem being mounted at /28/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 434.600629][ T1812] team0 (unregistering): Port device team_slave_0 removed [ 434.951328][ T6827] netlink: 'syz.3.151': attribute type 4 has an invalid length. [ 435.551097][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 435.551182][ T30] audit: type=1326 audit(1750165654.044:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 435.913307][ T30] audit: type=1326 audit(1750165654.344:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 435.941083][ T30] audit: type=1326 audit(1750165654.374:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 435.965191][ T30] audit: type=1326 audit(1750165654.374:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 436.222576][ T5807] Bluetooth: hci4: command tx timeout [ 436.289856][ T30] audit: type=1326 audit(1750165654.484:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 436.313051][ T30] audit: type=1326 audit(1750165654.484:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 436.340081][ T30] audit: type=1326 audit(1750165654.484:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=291 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 436.364139][ T30] audit: type=1326 audit(1750165654.484:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 436.387035][ T30] audit: type=1326 audit(1750165654.484:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 436.409810][ T30] audit: type=1326 audit(1750165654.484:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6830 comm="syz.5.152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f240b18e929 code=0x7ffc0000 [ 436.957692][ T5811] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 437.159923][ T6843] loop4: detected capacity change from 0 to 64 [ 437.382029][ T6807] chnl_net:caif_netlink_parms(): no params data found [ 438.267360][ T6845] loop3: detected capacity change from 0 to 32768 [ 438.289635][ T6845] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.156 (6845) [ 438.304256][ T5807] Bluetooth: hci4: command tx timeout [ 438.333453][ T6845] BTRFS info (device loop3): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 438.345517][ T6845] BTRFS info (device loop3): using sha256 (sha256-x86_64) checksum algorithm [ 439.466054][ T6872] loop4: detected capacity change from 0 to 32768 [ 439.495659][ T6872] BTRFS: device /dev/loop4 (7:4) using temp-fsid a7ac1295-6a44-43e6-811a-5b85b22133b2 [ 439.510645][ T6872] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.158 (6872) [ 439.549844][ T5800] BTRFS info (device loop3): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 439.592630][ T6872] BTRFS info (device loop4): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 439.603577][ T6872] BTRFS info (device loop4): using sha256 (sha256-x86_64) checksum algorithm [ 440.033403][ T6872] BTRFS info (device loop4): rebuilding free space tree [ 440.105662][ T6872] BTRFS info (device loop4): disabling free space tree [ 440.113153][ T6872] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 440.129875][ T6872] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 440.380715][ T5807] Bluetooth: hci4: command tx timeout [ 440.628858][ T5804] BTRFS info (device loop4): last unmount of filesystem a7ac1295-6a44-43e6-811a-5b85b22133b2 [ 441.155569][ T6807] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.163563][ T6807] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.171650][ T6807] bridge_slave_0: entered allmulticast mode [ 441.182019][ T6807] bridge_slave_0: entered promiscuous mode [ 441.462919][ T6807] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.471803][ T6807] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.479890][ T6807] bridge_slave_1: entered allmulticast mode [ 441.490334][ T6807] bridge_slave_1: entered promiscuous mode [ 442.203700][ T6807] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 442.296418][ T6807] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 442.481123][ T5807] Bluetooth: hci4: command tx timeout [ 442.864471][ T6807] team0: Port device team_slave_0 added [ 442.992309][ T6807] team0: Port device team_slave_1 added [ 443.558350][ T6807] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 443.566183][ T6807] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.594977][ T6807] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 443.964024][ T6807] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 443.972524][ T6807] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 443.999441][ T6807] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 444.876576][ T6807] hsr_slave_0: entered promiscuous mode [ 444.887665][ T6807] hsr_slave_1: entered promiscuous mode [ 444.897269][ T6807] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 444.905451][ T6807] Cannot create hsr debugfs directory [ 447.478982][ T6807] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 447.642089][ T6807] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 447.745498][ T6807] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 447.934406][ T6807] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 449.841061][ T6807] 8021q: adding VLAN 0 to HW filter on device bond0 [ 450.203150][ T6807] 8021q: adding VLAN 0 to HW filter on device team0 [ 450.296866][ T6811] bridge0: port 1(bridge_slave_0) entered blocking state [ 450.304652][ T6811] bridge0: port 1(bridge_slave_0) entered forwarding state [ 450.466542][ T6811] bridge0: port 2(bridge_slave_1) entered blocking state [ 450.474377][ T6811] bridge0: port 2(bridge_slave_1) entered forwarding state [ 452.574017][ T6997] netlink: 75 bytes leftover after parsing attributes in process `syz.2.194'. [ 452.683472][ T57] ===================================================== [ 452.691176][ T57] BUG: KMSAN: uninit-value in nci_ntf_packet+0x2753/0x42b0 [ 452.698681][ T57] nci_ntf_packet+0x2753/0x42b0 [ 452.704931][ T57] nci_rx_work+0x403/0x750 [ 452.709709][ T57] process_scheduled_works+0xb91/0x1d80 [ 452.720206][ T57] worker_thread+0xedf/0x1590 [ 452.725217][ T57] kthread+0xd5c/0xf00 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 452.731007][ T57] ret_from_fork+0x1e3/0x310 [ 452.735850][ T57] ret_from_fork_asm+0x1a/0x30 [ 452.740997][ T57] [ 452.743456][ T57] Uninit was created at: [ 452.748358][ T57] kmem_cache_alloc_node_noprof+0x818/0xf00 [ 452.754807][ T57] kmalloc_reserve+0x13c/0x4b0 [ 452.760220][ T57] __alloc_skb+0x347/0x7d0 [ 452.764925][ T57] virtual_ncidev_write+0x6b/0x430 [ 452.770412][ T57] vfs_write+0x463/0x1580 [ 452.775024][ T57] __x64_sys_write+0x1fb/0x4d0 [ 452.780240][ T57] x64_sys_call+0x38c3/0x3db0 [ 452.785208][ T57] do_syscall_64+0xd9/0x210 [ 452.790672][ T57] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.796816][ T57] [ 452.799388][ T57] CPU: 1 UID: 0 PID: 57 Comm: kworker/u8:3 Not tainted 6.16.0-rc2-syzkaller-00024-g9afe652958c3 #0 PREEMPT(undef) [ 452.811833][ T57] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 452.828586][ T57] Workqueue: nfc2_nci_rx_wq nci_rx_work [ 452.836584][ T57] ===================================================== [ 452.843796][ T57] Disabling lock debugging due to kernel taint [ 452.850647][ T57] Kernel panic - not syncing: kmsan.panic set ... [ 452.857263][ T57] CPU: 1 UID: 0 PID: 57 Comm: kworker/u8:3 Tainted: G B 6.16.0-rc2-syzkaller-00024-g9afe652958c3 #0 PREEMPT(undef) [ 452.871213][ T57] Tainted: [B]=BAD_PAGE [ 452.875529][ T57] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 452.885809][ T57] Workqueue: nfc2_nci_rx_wq nci_rx_work [ 452.891648][ T57] Call Trace: [ 452.895090][ T57] [ 452.898261][ T57] __dump_stack+0x26/0x30 [ 452.902889][ T57] dump_stack_lvl+0x53/0x270 [ 452.907777][ T57] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 452.913932][ T57] dump_stack+0x1e/0x25 [ 452.918366][ T57] panic+0x4bd/0xd50 [ 452.922603][ T57] kmsan_report+0x31c/0x320 [ 452.927415][ T57] ? __msan_warning+0x1b/0x30 [ 452.932372][ T57] ? nci_ntf_packet+0x2753/0x42b0 [ 452.937692][ T57] ? nci_rx_work+0x403/0x750 [ 452.942549][ T57] ? process_scheduled_works+0xb91/0x1d80 [ 452.948593][ T57] ? worker_thread+0xedf/0x1590 [ 452.953758][ T57] ? kthread+0xd5c/0xf00 [ 452.958247][ T57] ? ret_from_fork+0x1e3/0x310 [ 452.963269][ T57] ? ret_from_fork_asm+0x1a/0x30 [ 452.968506][ T57] ? ret_from_fork_asm+0x1a/0x30 [ 452.973743][ T57] ? kmsan_get_metadata+0xfb/0x160 [ 452.979256][ T57] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 452.985375][ T57] ? kmsan_get_metadata+0xfb/0x160 [ 452.990782][ T57] ? kmsan_internal_set_shadow_origin+0x79/0x110 [ 452.997406][ T57] ? kmsan_internal_unpoison_memory+0x14/0x20 [ 453.003756][ T57] ? _raw_spin_unlock_irqrestore+0x3f/0x60 [ 453.009864][ T57] ? stack_depot_save_flags+0x60f/0x7b0 [ 453.015852][ T57] ? kmsan_get_metadata+0xfb/0x160 [ 453.021253][ T57] ? kmsan_internal_memmove_metadata+0x181/0x230 [ 453.027866][ T57] ? kmsan_get_metadata+0xfb/0x160 [ 453.033275][ T57] __msan_warning+0x1b/0x30 [ 453.038039][ T57] nci_ntf_packet+0x2753/0x42b0 [ 453.043176][ T57] ? advisor_target_scan_time_store+0x170/0x180 [ 453.049738][ T57] nci_rx_work+0x403/0x750 [ 453.054406][ T57] ? __pfx_nci_rx_work+0x10/0x10 [ 453.059589][ T57] process_scheduled_works+0xb91/0x1d80 [ 453.065495][ T57] worker_thread+0xedf/0x1590 [ 453.070502][ T57] kthread+0xd5c/0xf00 [ 453.074790][ T57] ? __pfx_worker_thread+0x10/0x10 [ 453.080223][ T57] ? __pfx_kthread+0x10/0x10 [ 453.085041][ T57] ret_from_fork+0x1e3/0x310 [ 453.089925][ T57] ? __pfx_kthread+0x10/0x10 [ 453.094752][ T57] ret_from_fork_asm+0x1a/0x30 [ 453.099818][ T57] [ 453.103313][ T57] Kernel Offset: disabled [ 453.107755][ T57] Rebooting in 86400 seconds..