last executing test programs: 3m17.518620511s ago: executing program 3 (id=8501): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x800053, 0x0, 0xfc, 0x0, &(0x7f00000000c0)) unlinkat(0xffffffffffffff9c, &(0x7f0000000080)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) 3m17.306958062s ago: executing program 3 (id=8505): pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r0, 0x0, 0x15) 3m17.122095087s ago: executing program 3 (id=8507): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, 0x0) 3m16.938140108s ago: executing program 3 (id=8510): syz_mount_image$exfat(&(0x7f0000000000), &(0x7f0000000200)='./bus\x00', 0x2a10812, &(0x7f0000000580)=ANY=[@ANYBLOB='dmask=00000000000000000002621,utf8,umask=00000000000000000200000,namecase=1,discard,errors=remount-ro,umask=00000000000000000200004,umask=00000000000000000003377,namecase=1,utf8,iocharset=iso8859-4,iocharset=cp874,dmask=01777777777777777777770,errors=remount-ro,uid=', @ANYRESDEC, @ANYRES32, @ANYRESOCT=0x0, @ANYRES64=0x0, @ANYRES64, @ANYRES8, @ANYRES32, @ANYRES32, @ANYRES8, @ANYRES8, @ANYRESDEC, @ANYRESOCT], 0x21, 0x1508, &(0x7f0000002080)="$eJzs3AvYTdX2MPAx5pyLl6Sd5D7HHIudXkySJJckuSRJcuRIbglJkiRJ5X5LckvIPck9JLeQ3O+33JMkSZKE5JbM79Hf+XRO53yd8/+f/+P5zjt+z7Oed4691phrrD3286619n72/q7dgEp1KpevxczwP4L/9aczAKQAQG8AuA4AIgAonqV4lkvrM2js/D/bifj3enjK1a5AXE3S/7RN+p+2Sf/TNul/2ib9T9uk/2mb9D9tk/4LkZZtmZrzelnS7iLv/6dlcv7/D3Ko8Kiv1hW+sf2/kCL9T9uk/2mb9D9tk/6nbdL/tE36n7ZJ/9M26b8Qadl//71j+ezgP2G52q8/IYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBpw9lwhQGAv4yvdl1CCCGEEEIIIYT49wnpr3YFQgghhBBCCCGE+N+HoECDgQjSQXpIgQyQEa6BTHAtZIbrIAHXQxa4AbLCjZANskMOyAm5IDfkAQsEDhhiyAv5IAk3QX64GVKhABSEQuChMBSBW6Ao3ArF4DYoDrdDCbgDSkIpKA1l4E4oC3dBObgbysM9UAEqQiWoDPdCFbgPqsL9UA0egOrwINSAh6Am/AlqwcNQG/4MdeARqAuPQj2oDw2gITT6b+W/BC/DK9AROkFn6AJdoRt0hx7QE3pBb3gV+kDK5eemPwyAgTAI3oDB8CYMgaEwDN6C4TACRsIoGA1jYCy8DePgHRgP78IEmAiTYDJMgakwDd6D6TADZsL7MAs+gNkwB+bCPJgPH8ICWAiL4CNYDB/DElgKy2A5rICVsApWwxpYC+tgPWyAjbAJNsMW+AS2wjbYDjtgJ+yC3fAp7IHPYC98Dvvgi38x/8zf5LdHQECFCg0aTIfpMAVTMCNmxEyYCTNjZkxgArNgFsyKWTEbZrs5B+bAXJgL82AeJCQAZMyLeTGJScyP+TEVU7EgFkSPHotgESyKt2IxLIbFsTiWwBJYEkthKSyDZbAslsVyWA7LY3msgBWwElbCe/FevA+rYlWshtWwOlbHGlgDD+WuibWwFtbG2lgH62BdrIv1sB42wAbYCBthY2yMTbAJNsNm2BybYwtsgS2xJbbCVtgaW2MbbINtsS22w3bYHl/EF/ElfAlfwVewE1ZQXbArdsXu2B17Yi/sha9iH3wNX8PXsR/2xwE4EAfiGzgYT+MQHIrDcBiWVSNwJI5CVmNwLI7FcTgOx+N4nIATcSJOxik4FafhNJyOM3AGvo+z8AP8AOfgHJyH83E+LsCFAy+/wnAJLsVluBxX4EpcgatxDa7Gdbge1+FG3IibcTN+gp/gNtyGO3AH7kIDgJ/iZ/gZ9sN9uA/34348gAfwIB7EQ3gID+NhPIJH8CgexWN4DI/jCTyJJ/AUnsLTeAbP4lk8j+fxAj6f65vauwqs7QfqEqOMSqfSqRSVojKqjCqTyqQyq8wqoRIqi8qisqqsKpvKpnKoHCqXyqXyqHOKFClWscqr8qqkSqr8Kr9KVamqoCqovPKqiCqiiqqiqpgqpoqr21UJdYcqqUqppr6MKqPKqma+nLpblVflVQVVUVVSlVVlVUVVUVVVVVVNVVPVVXVVQz2kaqou2BMfVpc6U0f1x7pqANZT9VUD1VC9gY+pxmowNlFNVTP1hBqKQ7CFauxbqqdVKzUSW6tn1Sh8TrVVY7CdekG1Vy+qDipSL6smvqPqpCZgF9VVTcbuqofqqXqp6VhRXepYJfW66qf6qwFqoJqHb6jB6k01RA1Vw9RbargaoUaqUWq0GqPGqrfVOPWOGq/eVRPURDVJTVZT1FQ1Tb2npqsZaqZ6X81SH6jZao6aq+ap+epDtUAtVIvUR2qx+lgtUUvVMrVcrVAr1Sq1Wq1Ra9U6tV5tUBvVJrVZbVGfqK1qm9qudqidapfarT5Ve9Rnaq/6XO1TX6j96kt1QH2lDqqv1SH1jTqsvlVH1HfqqPpeHVM/qOPqhDqpflSn1E/qtDqjzqpz6rz6WV1Qv6iLKijQqJXW2uhIp9PpdYrOoDPqa3Qmfa3OrK/TCX29zqJv0Fn1jTqbzq5z6Jw6l86t82irSTvNOtZ5dT6d1Dfp/PpmnaoL6IK6kPa6sC6ib9FF9a26mL5NF9e36xL6Dl1Sl9KldRl9py6r79Ll9N26vL5HV9AVdSVdWd+rq+j7dFV9v66mH9DV9YO6hn5I19R/0rX0w7q2/rOuox/RdfWjup6urxvohrqRfkw31o/rJrqpbqaf0M31k7qFfkq31E/rVvoZ3Vo/q9vo53Rb/bxup1/Q7fWLuoP+RV/UQXfUnXRn3UV31d10d91D99S9dG/9qu6jX9N99eu6n+6vB+iBepB+Qw/Wb+oheqgept/Sw/UIPVKP0qP1GD1Wv63H6Xf0eP2unqAn6kl6sp6ip+qel2ea+U/kv/N38vv+uvfNeov+RG/V2/R2vUPv1Lv0br1b79F79F69V+/T+/R+vV8f0Af0QX1QH9KH9GF9WB/RR/RRfVQf08f0cX1Cn9M/6lP6J31an9Fn9Dl9Xp/XFy4/B2DQKKONMZFJZ9KbFJPBZDTXmEzmWpPZXGcS5nqTxdxgspobTTaT3eQwOU0uk9vkMdaQcYZNbPKafCZpbsLLJ01T0BQy3hQ2Rcwt/0q+yW9uNqmmwF/l/1F9jUwj09g0Nk1ME9PMNDPNTXPTwrS49VIdrUwr09q0Nm1MG9PWtDXtTDvT3rQ3HUwH87J52XQ0HU1n09l0Nd1Md9PD9DS9TG/zqulj+pi+pq/pZ/qZAWaAGWQGmcFmsBlihphhZpgZboabkWakGW1Gm7FmrBlnxpnxZryZYCaYSWaSmWKmmGlmmpluppuZZqaZZWaZ2Wa2mWvmmvlmvllgFphFZpFZbBabJWapWWqWm+VmpVlpVpvVZq1Za9ab9Waj2WiWpN9itpitZqvZbrabnWan2W12mz1mj9lr9pp9Zp/Zb/abA+aAOWgOmkPmkDlsDpsj5og5ao6aY+aYOW6Om5PmpDllTpnT5rQ5a86a8+a8uWAumIvm4qXLvkhFKjKRidJF6aKUKCXKGGWMMkWZosxR5igRJaIsUZYoa3RjlC3KHuWIcka5otxRnshGFLmIozjKG+WLktFNUf7o5ig1KhAVjApFPiocFYluiYpGt0bFotui4tHtUYnojqhkVCoqHZWJ7ozKRndF5aK7o/LRPVGFqGJUKaoc3RtVie6Lqkb3R9WiB6Lq0YNRjeihqGb0p6hW9HBUO/pzVCd6JKobPRrVi+pHDaKGUaN/6/whnM7+uO9oO9nOtovtarvZ7raH7Wl72d72VdvHvmb72tdtP9vfDrAD7SD7hh1s37RD7FA7zL5lh9sRdqQdZUfbMXasfduOs+/Y8fZdO8FOtJPsZDvFTrXT7Ht2up1hZ9r37Sz7gZ1t59i5dp6dbz+0C+xCu8h+ZBfbj+0Su9Qus8vtCrvSrrKr7Rq71q6z6+0Gu9FuspvtFvuJ3Wq32e12h91pd9nd9lO7x35m99rP7T77hd1vv7QH7Ff2oP3aHrLf2MP2W3vEfmeP2u/tMfuDPW5P2JP2R3vK/mRP2zP2rD1nz9uf7QX7i71ow6WL+0undzJkKB2loxRKoYyUkTJRJspMmSlBCcpCWSgrZaVslI1yUA7KRbkoD+WhS5iY8lJeSlKS8lN+SqVUKkgFyZOnIlSEilJRKkbFqDgVpxJUgkpSSSpNpelOupPuorvobrqb7qF7qCJVpMpUmapQFapKVakaVaPqVJ1qUA2qSTWpFtWi2lSb6lAdqkt1qR7VowbUgBpRI2pMjakJNaFm1IyaU3NqQS2oJbWkVtSKWlNrakNtqC21pXbUjtpTe+pAHehlepk6UkfqTJ2pK3Wl7tSdelJP6k29qQ/1ob7Ul/pRPxpAA2gQDaLBNJiG0FAaRm/RcBpBI2kUjaYxNJbG0jgaR+NpPE2gCTSJJtEUmkLTaBpNp+k0k2bSLJpFs2k2zaW5NJ/m0wJaQItoES2mxbSEltAyWkYraAWtolW0htbQOlpHG2gDbaJNtIW20FbaSttpO+2knbSbdtMe2kN7aS/to320n/bTATpAB+kgHaJDdJgO0xE6QkfpKB2jY3ScjtNJOkmn6BSdptN0ls7SefqZLtAvdJECpbgMLqO7xmVy17rM7jr3t3EOl9PlcrldHmddNpf9r2JyzqW6Aq6gK+S8K+yKuFtc6qUL3t/EJV0pV9qVcXe6su4uV+53cRV3n6vq7nfV3AOusrv3r+Lq7kFXwz3iarpHXS1X39V2DV0d94ir6x519Vx918A1dM3dk66Fe8q1dE+7Vu6Z38UL3EK3xq1169x6t8d95s66c+6I+86ddz+7jq6T6+1edX3ca66ve931c/1/Fw9zb7nhboQb6Ua50W7M7+JJbrKb4qa6ae49N93N+F08333oZrlFbrab4+a6eb/Gl2pa5D5yi93Hbolb6pa55W6FW+lWudX/t9blbqPb5Da73e5Tt9Vtc9vdDrfT7fo1vnQce93nbp/7wh1237oD7it30B11h9w3v8aXju+o+94dcz+44+6EO+l+dKfcT+60O/Pr8V869h/dL+6iCw4YWbFmwxGn4/Scwhk4I1/DmfhazszXcYKv5yx8A2flGzkbZ+ccnJNzcW7Ow5aJHTPHnJfzcZJv4vx8M6dyAS7IhdhzYS7Ct3BRvpWL8W1cnG/nEnwHl+RSXJrL8J1clu/icnw3l+d7uAJX5Epcme/lKnwfV+X7uRo/wNX5Qa7BD3FN/hPX4oe5Nv+Z6/AjXJcf5XpcnxtwQ27Ej3FjfpybcFNuxk9wc36SW/BT3JKf5lb8DLfmZ7kNP8dt+Xluxy9we36RO/BL/DK/wh25E3fmLtyVu3F37sE9uRf35le5D7/Gffl17sf9eQAP5EH8Bg/mN3kID+Vh/BYP5xE8kkfxaB7DY/ltHsfv8Hh+lyfwRJ7Ek3kKT+Vp/B5P5xk8k9/nWfwBz+Y5PJfn8Xz+kBfwQl7EH/Fi/piX8FJexst5Ba/kVbya1/BaXsfreQNv5E28mbfwJ7yVt/F23sE7eRfv5k95D3/Ge/lz3sdf8H7+kg/wV3yQv+ZD/A0f5m/5CH/HR/l7PsY/8HE+wSf5Rz7FP/FpPsNn+Ryf55/5Av/CFzkwxBirWMcmjuJ0cfo4Jc4QZ4yviTPF18aZ4+viRHx9nCW+Ic4a3xhni7PHOeKcca44d5wntjHFLuY4jvPG+eJkfFOcP745To0LxAXjQrGPC8dF4lviovGtcbH4trh4fHtcIr4jLhmXih95oEx8Z1w2visuF98dl4/viSvEFeNKceX43rhKfF9cNb4/rhY/EBeLH4xrxA/FcPn7KrXjP8d14kfiuvGjcb24ftwgbhg3ih+LG8ePx03ipnGz+Im4efxk3CJ+Km4ZPx23ip/5w/Wd4y5x17hb3C0O4X49NzkvOT/5YXJBcmFyUfKj5OLkx8klyaXJZcnlyRXJlclVydXJNcm1yXXJ9ckNyY3JTcnNyRAqpwePXnntjY98Op/ep/gMPqO/xmfy1/rM/jqf8Nf7LP4Gn9Xf6LP57D6Hz+lz+dw+j7eevPPsY5/X5/NJf5PP72/2qb6AL+gLee8L+yK+oW/kG/nG/nHfxDf1zfwT/gn/pH/SP+Wf8k/7Vv4Z39o/69v453xb/7x/3r/g2/sXfQf/kn/Zv+I7+k6+s+/su/quvrvv7nv6nr637+37+D6+r+/r+/l+foAf4Af5QX6wH+yH+CF+mB/mh/vhfqQf6Uf70X6sH+vH+XF+vB/vJ/gJfpKf5Kf4KX6an+an++l+pp/pZ6XO8rP9bD/Xz/Xz/Xy/wC/wi/wiv9gv9kv8Er/ML/Mr/Aq/yq/ya/wav86v8xv8Br/Jb/Jb/Ba/1W/12/12v9Pv9Lv9br/H7/F7/V6/z+/z+/1+f8Af8Af91/6Q/8Yf9t/6I/47f9R/74/5H/xxf8Kf9D/6U/4nf9qf8Wf9OX/e/+wv+F/8RR/82MTbiXGJdxLjE+8mJiQmJiYlJiemJKYmpiXeS0xPzEjMTLyfmJX4IDE7MScxNzEvMT/xYWJBYmFiUeKjxOLEx4kliaWJZYnliRWJlYkQcm+NQ96QLyTDTSF/uDmkhgKhYCgUfCgcioRbQtFwaygWbgvFw+2hRLgjlAylQunwaKgX6ocGoWFoFB4LjcPjoUloGpqFJ0Lz8GRoEZ4KLcPToVV4JrQOz4Y24bnQNjwf2oUXQvu/3HGFV0LH0Cl0Dl1C19AtdA89Qs/QK/QOr4Y+4bXQN7we+oX+YUAYGAaFN8Lg8GYYEoaGYeGtMDyMCCPDqDA6jAljw9thXHgnjA/vhglhYpgUJocpYWqYFt4L08OMMDO8H2aFD8LsMCfMDfPC/PBhWBAWhkXho7A4fByWhKVhWVgeVoSVYVVYHdaEtWFdWB82hI1hU9gctoRPwtawLWwPO8LOsCvsDp+GPeGzsDd8HvaFL8L+8GU4EL4KB8PX4VD4JhwO34Yj4btwNHwfjoUfwvFwIpwMP4ZT4adwOpwJZ8O5cD78HC6EX8JF+c6aEEIIIcQ/pdsfrO/ydx4zAKAuj7sCwLXbch767XoNABuy/de4h8rVPAEAT3dq9/BflgoVOnfufHnbJRqifHMAIPE3O7gcL4Vm8CS0hKZQ9O/W10O9eJ7/YP7k7QAZf5OTAlfiK/N/+Q/mf+yJYQtKxGez/D/mnwOQmu9KTga4Ei+FZl+8AgBNodg/mD974z+oP8NXYwGa/CYnE1yJr9RfBB6HZ6DlX235Nx645h+vE0IIIYQQQgjxH62HKt3mj+6fL92f5zJXctLDlfiP7s+FEEIIIYQQQghx9T33YoenHmvZsmmbf36Q/l/ZWAYykMH/j4Or/Z9JCCGEEEII8e925aL/ymMZrmZBQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCFEGvSbH/3KAAD/Kz8ndrWPUQghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhLja/k8AAAD//3BjMQc=") mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x109041, 0x0) 3m16.270103239s ago: executing program 3 (id=8524): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x32, &(0x7f0000006c00)=0x1, 0x4) 3m15.723941794s ago: executing program 3 (id=8534): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000031401000000000000000000090002002f797a2f000000000800410072786500140033007465616d5f736c6176655f30"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8844) 3m15.33254159s ago: executing program 32 (id=8534): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000031401000000000000000000090002002f797a2f000000000800410072786500140033007465616d5f736c6176655f30"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8844) 2m51.156215616s ago: executing program 4 (id=8798): r0 = inotify_init() ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x5452, &(0x7f0000000000)={'sit0\x00', 0x0}) 2m50.824168366s ago: executing program 4 (id=8803): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x55e, 0x0, 0x3eae}, &(0x7f0000000040)=0x10) 2m50.69187119s ago: executing program 4 (id=8807): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000071123b00000000009500000000000000ded6ed0c87acf3dddd96d70e5dcec1d29d78bf898296b1566600a8c69c67afcf6c14401e53320d6f040009d6507810250a651f94c65456bd74a78fbf84f15823420bbc5522d8e81fa07bf2fd8b4cdf44ee9a01773abc7de1b4bde364dd0000e207f457ec26c10d0632a0b6"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, &(0x7f00000006c0)="88"}, 0x50) 2m50.464567838s ago: executing program 4 (id=8811): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000780)={0x64, 0x19, 0x1, 0x0, 0x0, {0x1d, 0xd601, 0x9}, [@nested={0x50, 0x10, 0x0, 0x1, [@typed={0x49, 0x121, 0x0, 0x0, @binary="c9a7befe6f6d645a1a11b81b2c4b101c7510e19feecb90ee6bb49f6cc7a2c50fd57c06db1a75df432aa833928a0772ff8f5e9ed32d3b477d35b296674f1fe35663c0d236fd"}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) 2m50.266303596s ago: executing program 4 (id=8816): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 2m50.072664313s ago: executing program 4 (id=8819): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x7d, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x48010}, 0x4000000) 2m47.410632002s ago: executing program 2 (id=8841): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000043c0)={0x6, 0x13, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a0000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000004380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 2m47.163205269s ago: executing program 2 (id=8844): r0 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x1, 0xffffffff, @loopback={0xffffffffffff0000}, 0x92}, 0x1c) 2m46.986760963s ago: executing program 2 (id=8846): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newtaction={0x84, 0x30, 0x871a15abc695fb3d, 0x70bd26, 0x0, {}, [{0x70, 0x1, [@m_tunnel_key={0x6c, 0x1, 0x0, 0x0, {{0xf}, {0x3c, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0xe, @ipv4={'\x00', '\xff\xff', @private}}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x84}}, 0x0) 2m46.624774812s ago: executing program 2 (id=8849): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x104, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 2m46.298499567s ago: executing program 2 (id=8852): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f0000000400)=@newtaction={0x70, 0x30, 0x9, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_skbedit={0x58, 0x1, 0x0, 0x0, {{0xc}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x4}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x1, 0x0, 0x0, 0x2}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x6}]}, {0x4}, {0xc, 0xa}, {0xc, 0x9}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000084}, 0x0) 2m46.065760728s ago: executing program 2 (id=8854): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='nfsd\x00', 0x0, 0x0) 2m33.714648861s ago: executing program 33 (id=8819): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x7d, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x48010}, 0x4000000) 2m29.737067785s ago: executing program 34 (id=8854): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='nfsd\x00', 0x0, 0x0) 1m56.027334123s ago: executing program 1 (id=9598): mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x6000003, 0x42031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) 1m55.676790399s ago: executing program 1 (id=9603): r0 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000040)={r0, r0, r0}, &(0x7f0000000000)=""/50, 0x32, &(0x7f0000000100)={&(0x7f0000000080)={'sha384\x00'}}) 1m55.442627608s ago: executing program 1 (id=9605): r0 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b\xba\xdf//\xdc/\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b\xc5p4\x16\x91G\xe3\x9ef\xe7\xdc9;\x1c|\x1b.q\xb2\xc7\xed\xa8{\xac\x13\xe1\x05\xd8]\"\xeaD%\xc5\r', 0x0) 571.687426ms ago: executing program 0 (id=11137): r0 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000300)='source', &(0x7f00000000c0)='%/,:', 0x0) 512.505272ms ago: executing program 0 (id=11138): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="240000001b1401002abdd444d446df250800010000000000090002"], 0x24}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) 435.618283ms ago: executing program 8 (id=11139): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_NUM_PEER_NOTIF={0x5, 0x10, 0xa8}, @IFLA_BOND_RESEND_IGMP={0x8, 0xf, 0x6}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x0) 377.217049ms ago: executing program 0 (id=11140): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x80000, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) 310.217086ms ago: executing program 8 (id=11141): syz_mount_image$btrfs(&(0x7f00000055c0), &(0x7f0000000180)='./bus\x00', 0x0, &(0x7f0000000440), 0x1, 0x559d, &(0x7f0000005680)="$eJzs3X1sVWcdB/BzeynlJaFlyjLUhfkPThCpmFiEoEVgAoPRgSbDwCgO2BAGhQRhY9OOOZ0jk4Y5xoovDKQCxq6+rJiYIbqIcU4mi8OGEXnJIuICK4yoJNOZ3nufy73n0vYO5zq3z4e05z73d57nPPfk/HG/lz7nRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBF0cHlC/627gfLv/nQdSenbLz/zAMnap57fNP4u+fsHnX4gVVXtp1uaip99fmzNyy67+GqoSf2zD8URYlUv0Sm/7xPTZ65aNa86X3CgLU3prcVFZ0dMt31WLrRO+/Jjn75P/OjKCqNDZDMbCf1z2kn4geIVhYO2KXtVWNWDdw4cdrmssmDFibrGgtfOh369PQEekrmunrx4rVUnfpdEtsj28659BJ5l2i6f/yCe1NeBADwulTWpDbZt6OZt7jZdn28HmtXx9oNsXZ4h9CQ27gc6XF7dzbPa+L1HppndToqlHU6z1g9c/6z7Zp4/1g7FjVexzzzd81Emj6dzbMuVu+peQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8ldx9/JanSzb96H1L149MHh887BdfbdryvUnt5VO+tm9D2+9bn3tPU1Ppq8+fvWHRfQ9XDT2xZ/6hKKpI9Uukuyfm7mjd8LMVU1b/fM6jzefee8euZGbcsO2Vs3PUFh58vDyKPp9TeTEMe2pAFNXkF1LN6NHCwuLUgymhAAAAwNvJ4NTvkmw7HQdL89qJVJpMpP4F6bC4vWrMqoEbJ07bXDZ50MJkXePlj1fTyXjVlxwv2664+JPICcYh/sbHu1gPu64sGKdr8RHjeX7U0AuHj3x9+Ya1jf1P7u87MDnpV1+uHXzFnNGvXDt2zG1/fWRHQf6v6Dr/hzMn/wMAAPDfkP/j43Stu/w/7Mj9Z+469dN1tZ/ZNvf4+G/UDnhX5Zo/NX/4c+uHTZ3Y69iVWwry/zV5hyzI/2HGIf+XRJeX/wEAAOCt7H+d/6sLxulad/l/2ZoRf592YdbEJ8Zd+OGZO4f88uCRaG/9iC+03P6B/bP7DWj4SUH+rywu//fKnXZ48pkw4SXlUVRZ/EkFAAAA8oT/d7/40ULI6+lPDuJ5fc75g5NuLn3w7EdmXzt029Ehu9rP/2PJ8k0XRjfPGF716acrNhTk/+ri8n/pm/NyAQAAgCI8tfgTN+2Mpk/6UPU9h/cv2P5I/bK1K5c2liWm/ntl2/X/au5dkP9risv/ZT3zcgAAAIBLOPSlbbtfm7msdXhz2fmtf3jtz49fPXz1gabKoyt/O7B0RWvt4oL8X1tc/u+X2WZWPqQ77Q9/hfBQeRT16XhQly78Jmr4ZLYAAAAAvEFCTv/nsbaRO68r+/VT339586zvfHvQ3m/NONj43Qn9b5n44IEZB56sLcj/dV3f/z/c6SCs/8+7/1/B+v+cQvquf2PdGAAAAIB3osL1/OH2+OlvLujs+/eLXf9/4xdbXzp++/yvtL97yE3LXr7tils/Nv7UH6ffmdw57q6SqVNfOl2Q/+uLy//J3O0b+f1/AAAAcBn+377/b3bBOF3r7v7/Mx+752j7X14YN2Jm49pFJ8dv/PG8Lc88trvq6nMLbu77wWeX7i3I/w3F5f+w7Z/78vaF83NveRRd1fEgczfBXWG6S2KFltKcQvrEx3rMCj0yhZaynEJKXazHqPIoen/Hg/pYYWAoNMQK7QMyha2xwrOhkLkesoXmWGFfuNI2DchMN17YEwqZBRYtYQVF/+ySiFiPVzrr0VG4ZI8XsgcHAAB4RwnhOZNlS/ObUTzKtiS626FfdzuUdLdDsrsdesV2iO/Y2fNRbX4hPH9+zRO/q/xoyWcP3XrHhOEjF667t2HsgeTcCdc/uaPvuRWnR68uyP9bi8v/4VT0Tm86W/8fhfX/me81zK7/rw2FilihJRRq4ncMqAnHSIfd9eEYFTWZHu1XZQsAAADwthY+F0j28DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgP+zde5xU1Z0g8NNNP2homhbjK2JsdW1Fh6ZBUT/BB2omGmBNo+zMuPhohEaRVhBhIq5RULObxMEoKlFnRmEVRlZx8AVkNQE1ooloNI5mRh1DMGrcjR/FiH6yxrif7lunqLrVZRcCSjvf7x9dp+p3nrceXefeW+cCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/Max/9MYj/umiJ0eP2jBvwPJXDv/vH9YfumzRO//rT89ed9ve8763ftWSJZV/en7jSZO/c8PhjRtWTnghhJbOcmVJ8bLTF6/4waoLvvGtB0+76e5395y9tCpTbyYe+nb8Kc/cuTK2+tt+IawsC6EiHRhcmwQqM/drY30Da0PYKWwOZEu09UlKpBsOj9WEsDBsDmSr+lFNCLU5gXG/fGT1vI7E9TUh7B9CqE638e/VSRs16UBjVRLokw5Mq0gCH3ycyAZWlScB2GrxzZB90S9vyc9Q33W5Iq+/ym3Wsc9Xeni9YqK+eL63jt3OncpRlX6gZauetoLq2C4K3h5rvNt6wLutYDtf42nL/SKV+Yby8eZQdSif1DZ5wqz2mfGR8tDU1KtYTdvpeX5x4yUTtyTdY16HsQP12+R1+Pj5A+9c0Dhm15sf3jD59apnF2xtN4tt3u2tOmRecz3meYxG+jzpAW+/gm9JDb50hRBuP37T2799aez//dWDTw9+75tDzxrywitD627+7rR+f332/6m8ZerGgvl//SfP/+PLOd6W5+WOrX5Yl8zN4yO1MfF2XTI3BwAAgB6jJ+w1fWPEQW/Xrmt4eN+vr5h83qJ5r51+7p+rftp3wkEnnjL0+3fcOPW0gvl/Q2nH/+Mh/9rc0a4JYWRn4or+Ieze+XgSWBq7c1b/EPbpTLXkB45NBdaEsEdnYlC2qlSJ3rFEQyrwRl0mMDIVWBsDLanA4hi4JhW4MgaWpwITY2BNKnBcDIQp+eM4qC4zjpIDNTHQmmzE5fEshD/UxdZS2+qlbFUAAADbSGZ2WJl/N+dch63NEKeXy2u6yxDPwC6aoTpVQ3oGm51WFa2horsayrurITvuOZ88/IKay7qrueA0jLL8DO8deN/c1Q/8249vnHDYUwd92HrGy+tXPTp6U6+/e2fMjy8dN3/Y+IL5f/Mnz/+ru+hIWcHx/xDGdv6NucszkfZsvLUlLwMAAACwFSpeW3ryL+Z+VLbkZ+ds3P8vTxt3de8V++47YO3B9/2/hjcHHL9q/4L5/8jSzv+P+0R65WQO6+JuiKn9Q2jODyTVjigMJEe9+2YCAAAA0BNkj8dnj4VPydwmp2in59OF+Vu2MH888D+yy/yDx129rnn17adMGXHomjWbztj15WUbntpl/3deOPDk00+4f2rDPQXz/5bSzv/vk3+bdGJt7MV1/UPonRN4PPayI9CpIQbWH5MfyIx/bdwAV8WqMicmZKu6KpZojYHmVGBhsRLPZEvsnh/IPFnZxq/IjmNKpkROAAAAAD5zcXdAPC4fz/9/+tx+j/7jslsueXDJutD37OW/uOzo4QPnD+791rRnDnnkb989eWrB/L91y87/75wHF5ze3943hCEVIfRK/zBgXZ9kYcAYqC3LJH7cJ6mrV7qqy/uEMKJjYOmqNmTW/69IrzH4XE1SVQzsvu8dGxs7ErfXhDAkN/DC+EXDOxKzUoFs439VE8LeHaNNN76id9J4ZbrxG3uH8JWcQLaqib1D6GisKl3Vo9WZ6xikq1peHcLOOYFsVYdXhzA7ANBTxf+lk3IfvHD2xVMntLe3zdiOibgTvyZMntLe1jRxWvuk6iJ9mpTqc946RnMLx1TqpW9ezqxRdNeopv6lpLM/FGzObSuzI7/gzMHM/fhlqLJznMMq8+4ekh7ygfsVNhFyvkoVG3L5dh5yn9xKNj+JBfXH/FWhb+g968K2GU0XTZg5c8bQ5G+p2Yclf+NxpmRbDU1vqz5d9a2El0fR5bJSPu22asytZMjM86YPuXD2xYOnnDfh7Laz284/bPhhRxwx7NBDhw/pGFRz8rebkTZ2VXNqpB8vKnFY23CkX67IqeSz+NCQkJDoaYlVv9vj5aN3Wfq9FbcsnvHz9qPafv71nXces6Tqmy9suvSy/Z/+Hx8UzP+nf/L8P37qxA/+zPoMxY7/18fD/Mnjmw/zt8bAwlKP/9cXO5qfPTGgIRWYEwNzHOYHAADgiyHujox7M+NO6Ufm7/Yvd467b8z89Qc/ue65svV9Dv77D39fXnnZuP9yzAMNt333bwrm/3NK+/3/Nlr/P7t0/ahiy/wPiiWai63/n17mP7v+/5xi6/+nl/nPrv+/8HNY/39WNpDaJH+w/j8AAPBF8Nmt/9/t8v7pCwQUZOh2ef/0BQIKMnS7jH+pFwjY4vX/H2k4aORPVn/nN43LLpj2zn8bct/oAXs2/O6Rva6cNHXk6NEjBv9Lwfz/mtLm/xbuBwAAgB3HAROPfWrjpL2Pvfp/3rbTHj9p/fauh+3y/WVHts3ftH7i39z27jl/XTD/X1ja/P+zX/8vFDv/v6FYoKXYwoDW/wMAAKCHKrb+39Abv3X5q4uPu/+ey6eNam0dP/uKq/dbfUD1qeGl0fMb/mLGvR8VzP+Xlzb/j6ddlOfljr35sC5Z0y6k17R7uy77kwEAAADoGcpDU1NliXnzFkY99tO3+WJmKdBPSud68sH9nn/gqyNOnL+46urXynYb9vFT1888+Piv/fDVjXtdcse55+1XMP9fU9r8P+93GY+fP/DOBY1jdv3w5oc3TH696tkFm4//AwAAANtPqfslAAAAAAAAAAAAAACAz98JD//k6rcnLvnanIW/3PWnvcY+u3zDrDlNs2uvf/WH1/7qiDsfHlfw+/8wtrNcsd//x+v+xd8XfCkvd2y1+/X/MvfHjb57dueShevqQtgvNzD18qk7hcy1+Q/IDaw+fdBuHYnL0yUeeuW41zoSZ6YDJw4e8H5H4shUoDUukrhHOhCvqvh+v1QgLq/4XDoQt8fydKAqE/hev2QcZelt9WZtsq3K0tvqxdoQ+ucEsttqZW3SRll6gNenAtkBXpAOxAGelAmUp3t1d9+kVzFQG4ve2jfpFQAAO6z4LbAyTJ7S3tYcv8LH2y9X5N9GeUuWzS2stqzE5l/OLE1216im/qWke6W/i26+1nhlqO4YwtCCr6u5Wco6R7ltaulm032pyJC7W+2tvEi5tC3ddFXFR1STjKhp4rT2SZXdDvyQ7rMMq+g2y9CCyU5ulvLOTVpCLSX0pYQRlbhtSuhyvF8empp6pXJ9NQbrQ57uXhGl/l4/d52/Yq+C3DxPvtn+1BP//PzKfR7/89Nnf/BXk7596byzznj3yHOq/+E/lz39XwfuXDD/ry9t/l+dO673MxcDmBOvrDeifwitJY4IAAAAvvjOOf+V+d999No31rc0vjZtyLWr/3X2jRdX1C298i9ffOhvN42/+sytjb/58zv2eXjyhGe+dO4hy054fZ+DL2s88637/mLeuAev6nvLD+ff8YOC+X9DafP/uAcrcyg42duxJl7//4r+IXReWr8+CSyNwz2rfwj7dKZaYonkgvqjYonmJLA07jAZFEu0tuRX1TsGlqcCb9RlAmtSgbUxkNlLcUfI7Mq5ti6E4Z2psfklpscS9anAN2OgIRVoioHmVKBfDIxMBX7fLxNoSQWejIEwJX9b3dcvs60AAAC2RGaeVZl/N6TnecsrustQ1l2GPt1lKO8uQ3V3GYqNIt6/N2aoTJ28UpaTqTJda02qloIM8WL4W9yvggzhmfyc6YIFTcfzD7LnG5TlZ3jg5K/ec9WCyYPKf/XR2qWt790/ccWts49eec5Df/fEpH0X3XX93gXz/+bS5v998m+T1tfG+f/m6/8lgcdj966Lp443xMD6Y/IDmR0Da+Nk96psVS2ZEplJ+1WxxMgYaEgFpsfAyFSgdWwmsHC3/EBmpp1t/Ips41MyJXICAAAA8JmLOwjibpo4///jsmePeqxi0V3/+ur4u+6d89Y99/70nntuvXf07Zu+/twVF7970UcF8/+Rpc3/Y3t9cxu7Mvbmt/1CWFm2uTfZwODaJBD3Y9TGn8cPrA1hp5wdHNkSbX2SElWphsNjNckv1KvSVf2oJlljIN4f98tHVs/rSFxfE8L+OXtfsm38e3XSRk060FiVBPqkA9MqkkDc85MNrCpPArDVsnsF4wsqc6pLVn3X5Yq8/r4o1wRND69gH2gX+br6zdX2Up1+ILNPNWvLnraC6tguCt4ea7zbeuK7rd67LfeLVOYbysebQ9WhfFLb5Amz2mfGR3J/yVpgOz3Pub9SLSW9DV6Hcz59b7tXne5Ac+rjo7nrcl2/DstidY+fP/DOBY1jdr354Q2TX696dkHJ3Sgi/lD4maoB9bmbd3urDpnXXI/7PGnxedIT/w00eNpCCBsuPeG6kVXTr1g5+pAj93rttFOqZ7437+/vf+mBd/f9xxUTh31tQMH8v6W0+X9F6rbTH+PGvLB/CAfmbNx1cfMf3z/5HMwJJJ+SOxcGkkPur9YV/eQEAACAbS27uyO7v2BK5jY5ITw9Ty7M37KF+eP+ipFd5i+13z8adMpe9+9297hrTz3qpn/+zdh+G8e/uOSYFa1HNS49+mf/6cyaeQXz/9ZPnv/3TnXT8X/H/9lOHP/v0o6+K7p3+oE5W7UruqA6tgvH/7u0o7/bHP/vkuP/jv93xfH/bjj+36Ud/Wkr+JY03ZeuEMKwMWcMrr1r8BPvD1z96yeemvJvc1sn3PONq27Z8+Nv1y9eUL9r34L5//TS5v/W/+t60b7s+n+txdb/m15s/b851v8DAAC2qyILzaXneQWr9xVkSK/eV5Ch2wUCu11i0Pp/W7z+32NHHTl++ejFv16z95gDLus7d+6puzx504stM9+vue2D93f7xYGjCub/c0qb/8eXQ9/c1nvK+n8NY4tUdU0MTLcwIAAAADuiYjsIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+HztfsN1449prj7pN8dfWjP6+w+tO6D6mldOvXTZhFsnfeX28wfNWrFkSeWfnt940uTv3HB444aVE14IYUpnubKkeNnpi1f8YNUF3/jWg6fddPe7e85eWp2ptzJzu2de7tjqh3UhLMx5pDYm3q7ruLM5MG703bMrOhLr6kLYLzcw9fKpO3UkFteFcEBuYPXpg3brSFyeLvHQK8e91pE4Mx04cfCA9zsSR2YCZenu/kO/pLtl6e7O6xdC/5xAtrvn9suvKtvGCZlAebqNf6pN2oiB2lj0xtqkjRhojyWm9A5hSEUIvdJV/aw6qapXuqr/XZ1U1Std1WXVIYwIIVSkq/p1VVJVRXrkz1QlVcXA7vvesbGxI7GoKoQhuYEXxi8a3pGYkQpkGz+lKoS9O14y6cbvq0war0w3fkNlCF8JIVSlS2yqSEpUpUtsqAhh55zA5o1YEcLswBdD/PSZlPvghbMvnjqhvb1txnZMVGXaqgmTp7S3NU2c1j6pOtWnYspy0h/P/fRjf3njJRM7bu8a1dS/lHRFplxlZ5eHVebdPWRH733sV5/cSjY/HwX1x/xVoW/oPevCthlNF02YOXPG0ORvqdmHJX97ZaLJthraU7ZVY24lQ2aeN33IhbMvHjzlvAlnt53ddv5hww874ohhhx46fEjHoJqTv9tipIs++5F+uSKnks/i/S8hIdHTEuV5n27NO/rneMEX/c0drQzVnR/QBdOK3CxlnaPcFoM+9lOO+NN8Tel2REMLJg4FWYZ1n+WQgsnE5iw1SZbOr3UFk8Pcmso7N2m8Xx6amnoV2w71+XdzN+9bW7F5X8xsulLTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD/ZwcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCAAAAAAAOT/2ghVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV2IFjAQAAAABh/tZh9GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFwKAAD//y85Ijg=") faccessat2(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x3, 0x300) 207.81302ms ago: executing program 0 (id=11142): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000100), 0x80082, 0x0) ioctl$FBIOGETCMAP(r0, 0x4604, &(0x7f0000000240)={0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0}) 86.082988ms ago: executing program 0 (id=11143): r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x3ff, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f00000001c0)={0x1, 0x0, {0x0, 0x401, 0x3001, 0x1, 0xc, 0x8, 0x2}}) 0s ago: executing program 9 (id=11144): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000740)='./binderfs/binder1\x00', 0x1802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f00000004c0)=[@increfs_done={0x40106308, 0x2}], 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): warning: mounting fs with errors, running e2fsck is recommended [ 945.428377][T28270] EXT4-fs error (device loop7): __ext4_remount:6810: comm syz.7.9708: Abort forced by user [ 945.443039][T28283] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 945.478568][T28270] EXT4-fs (loop7): Remounting filesystem read-only [ 945.485170][T28270] EXT4-fs (loop7): re-mounted 00000000-0000-0000-0000-000000000000 r/w. [ 945.518365][T28270] ext4 filesystem being remounted at /75/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 945.731490][T26860] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 945.935385][T28048] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 946.096806][T28048] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 946.155078][T28048] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 946.209777][T28048] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 946.675207][T28048] 8021q: adding VLAN 0 to HW filter on device bond0 [ 946.689918][T28339] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9732'. [ 946.754390][T28339] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9732'. [ 946.826537][T28339] netlink: 21 bytes leftover after parsing attributes in process `syz.0.9732'. [ 946.925425][T28048] 8021q: adding VLAN 0 to HW filter on device team0 [ 946.999119][ T78] bridge0: port 1(bridge_slave_0) entered blocking state [ 947.006461][ T78] bridge0: port 1(bridge_slave_0) entered forwarding state [ 947.097745][ T78] bridge0: port 2(bridge_slave_1) entered blocking state [ 947.105012][ T78] bridge0: port 2(bridge_slave_1) entered forwarding state [ 947.922842][T28390] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9752'. [ 948.110014][T28048] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 948.280251][ T29] audit: type=1326 audit(2000000059.995:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28405 comm="syz.7.9758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd8b9acb9 code=0x7ffc0000 [ 948.368608][ T29] audit: type=1326 audit(2000000060.031:174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28405 comm="syz.7.9758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd8b9acb9 code=0x7ffc0000 [ 948.458751][ T29] audit: type=1326 audit(2000000060.031:175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28405 comm="syz.7.9758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=461 compat=0 ip=0x7f0dd8b9acb9 code=0x7ffc0000 [ 948.532521][ T29] audit: type=1326 audit(2000000060.031:176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28405 comm="syz.7.9758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd8b9acb9 code=0x7ffc0000 [ 948.660507][ T29] audit: type=1326 audit(2000000060.031:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28405 comm="syz.7.9758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd8b9acb9 code=0x7ffc0000 [ 949.203404][T28048] veth0_vlan: entered promiscuous mode [ 949.260553][T28048] veth1_vlan: entered promiscuous mode [ 949.387192][T28048] veth0_macvtap: entered promiscuous mode [ 949.423659][T28048] veth1_macvtap: entered promiscuous mode [ 949.507770][T28048] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 949.520275][T28412] loop5: detected capacity change from 0 to 32768 [ 949.552733][T28048] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 949.569388][T28412] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.9761 (28412) [ 949.611366][ T3441] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 949.639791][T28412] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 949.653356][ T3441] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 949.678298][T28452] netlink: 3 bytes leftover after parsing attributes in process `syz.7.9777'. [ 949.687497][T28412] BTRFS info (device loop5): using sha256 checksum algorithm [ 949.705644][ T3441] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 949.756743][ T3441] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 949.795070][T28452] 0X: renamed from caif0 [ 949.829359][T28452] 0X: entered allmulticast mode [ 949.848038][T28452] A link change request failed with some changes committed already. Interface 60X may have been left with an inconsistent configuration, please check. [ 949.863063][T28454] xt_CT: No such helper "snmp_trap" [ 949.909881][T28412] BTRFS info (device loop5): enabling ssd optimizations [ 949.931126][T28412] BTRFS info (device loop5): turning on async discard [ 949.945047][T28412] BTRFS info (device loop5): enabling free space tree [ 950.210211][T25488] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 950.255314][T28478] netlink: 'syz.6.9782': attribute type 2 has an invalid length. [ 950.282492][T28477] bridge1: entered promiscuous mode [ 950.460996][T28478] 9: entered promiscuous mode [ 950.518941][ T78] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 950.570514][ T78] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 950.698703][T28480] openvswitch: netlink: IP tunnel dst address not specified [ 950.715024][T14955] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 950.745976][T14955] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 950.888027][T28484] xt_cgroup: xt_cgroup: no path or classid specified [ 951.341119][T28497] loop6: detected capacity change from 0 to 4096 [ 951.410868][T28502] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 951.841803][T28514] loop8: detected capacity change from 0 to 1024 [ 951.887082][T28514] EXT4-fs (loop8): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 951.940911][T28514] EXT4-fs (loop8): revision level too high, forcing read-only mode [ 951.993041][T28514] EXT4-fs (loop8): orphan cleanup on readonly fs [ 952.065995][T28514] EXT4-fs error (device loop8): __ext4_get_inode_loc:4809: comm syz.8.9799: Invalid inode table block 0 in block_group 0 [ 952.136503][T28532] loop7: detected capacity change from 0 to 256 [ 952.155000][T28514] loop8: lost filesystem error report for type 5 error -117 [ 952.155644][T28514] EXT4-fs (loop8): Remounting filesystem read-only [ 952.163172][ C0] EXT4-fs (loop8): error count since last fsck: 1 [ 952.163198][ C0] EXT4-fs (loop8): initial error at time 2000000063: __ext4_get_inode_loc:4809 [ 952.163227][ C0] EXT4-fs (loop8): last error at time 2000000063: __ext4_get_inode_loc:4809 [ 952.231972][T28532] FAT-fs (loop7): Directory bread(block 64) failed [ 952.241602][T28532] FAT-fs (loop7): Directory bread(block 65) failed [ 952.261316][T28532] FAT-fs (loop7): Directory bread(block 66) failed [ 952.280475][T28514] Quota error (device loop8): write_blk: dquota write failed [ 952.291560][T28532] FAT-fs (loop7): Directory bread(block 67) failed [ 952.309652][T28514] Quota error (device loop8): qtree_write_dquot: Error -117 occurred while creating quota [ 952.319959][T28532] FAT-fs (loop7): Directory bread(block 68) failed [ 952.329827][T28532] FAT-fs (loop7): Directory bread(block 69) failed [ 952.342468][T28514] EXT4-fs (loop8): 1 truncate cleaned up [ 952.353199][T28532] FAT-fs (loop7): Directory bread(block 70) failed [ 952.366033][T28514] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 952.401792][T28532] FAT-fs (loop7): Directory bread(block 71) failed [ 952.412001][T28532] FAT-fs (loop7): Directory bread(block 72) failed [ 952.435001][T28532] FAT-fs (loop7): Directory bread(block 73) failed [ 952.496206][T28539] xt_TCPMSS: Only works on TCP SYN packets [ 952.609119][T28048] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 952.933416][T28554] openvswitch: netlink: IP tunnel dst address not specified [ 953.170515][T28565] openvswitch: netlink: nsh attribute has 1 unknown bytes. [ 953.382510][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 953.402664][T28576] netlink: 16 bytes leftover after parsing attributes in process `syz.7.9828'. [ 953.576246][T28583] netlink: 220 bytes leftover after parsing attributes in process `syz.6.9832'. [ 954.246197][T28608] loop7: detected capacity change from 0 to 16 [ 954.269230][T28608] erofs (device loop7): mounted with root inode @ nid 36. [ 954.406036][T28616] libceph: resolve '4' (ret=-3): failed [ 954.799161][T26923] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 954.980400][T26923] usb 8-1: Using ep0 maxpacket: 8 [ 954.990522][T28646] netlink: 20 bytes leftover after parsing attributes in process `syz.6.9862'. [ 955.011606][T26923] usb 8-1: config 179 has an invalid interface number: 65 but max is 0 [ 955.024406][T28644] netlink: 'syz.0.9861': attribute type 4 has an invalid length. [ 955.043094][T28644] netlink: 200 bytes leftover after parsing attributes in process `syz.0.9861'. [ 955.052477][T26923] usb 8-1: config 179 has no interface number 0 [ 955.052536][T26923] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 955.052566][T26923] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 955.052595][T26923] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 955.052623][T26923] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 955.052651][T26923] usb 8-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 955.052705][T26923] usb 8-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 955.052732][T26923] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 955.061777][T28622] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 955.183820][T28644] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9861'. [ 955.265404][T28652] loop8: detected capacity change from 0 to 512 [ 955.296894][T28652] FAT-fs (loop8): Directory bread(block 199916) failed [ 955.314930][T28652] FAT-fs (loop8): Directory bread(block 199917) failed [ 955.348082][T28652] FAT-fs (loop8): Directory bread(block 199918) failed [ 955.355039][T28652] FAT-fs (loop8): Directory bread(block 199919) failed [ 955.374162][T28652] FAT-fs (loop8): Directory bread(block 199920) failed [ 955.441227][T28652] FAT-fs (loop8): Directory bread(block 199921) failed [ 955.463738][T28652] FAT-fs (loop8): Directory bread(block 199922) failed [ 955.471945][T28652] FAT-fs (loop8): Directory bread(block 199923) failed [ 955.479363][T26923] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 955.497828][T28652] FAT-fs (loop8): Directory bread(block 199916) failed [ 955.532364][T28652] FAT-fs (loop8): Directory bread(block 199917) failed [ 955.648938][T28660] netlink: 'syz.6.9869': attribute type 2 has an invalid length. [ 955.665211][T26923] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 955.698886][T25878] usb 8-1: USB disconnect, device number 5 [ 955.698965][ C0] xpad 8-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 955.699024][ C0] xpad 8-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 955.728706][T28662] netlink: 4 bytes leftover after parsing attributes in process `syz.8.9870'. [ 955.740304][T26923] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 955.768890][T28660] : entered promiscuous mode [ 955.779992][T26923] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 955.797893][T26923] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 955.818994][T26923] usb 6-1: Product: syz [ 955.834719][T26923] usb 6-1: Manufacturer: syz [ 955.845128][T26923] usb 6-1: SerialNumber: syz [ 956.110148][T28649] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 956.339651][T26923] cdc_ncm 6-1:1.0: bind() failure [ 956.411020][T26923] cdc_ncm 6-1:1.1: probe with driver cdc_ncm failed with error -71 [ 956.441346][T28687] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 956.451704][T26923] cdc_mbim 6-1:1.1: probe with driver cdc_mbim failed with error -71 [ 956.481624][T26923] usbtest 6-1:1.1: probe with driver usbtest failed with error -71 [ 956.518900][T26923] usb 6-1: USB disconnect, device number 5 [ 957.378563][T28727] netlink: 16 bytes leftover after parsing attributes in process `syz.5.9902'. [ 957.455243][T28729] loop6: detected capacity change from 0 to 64 [ 957.837340][T28745] loop8: detected capacity change from 0 to 256 [ 957.911804][T28745] exFAT-fs (loop8): failed to load upcase table (idx : 0x00010000, chksum : 0x9059ffb0, utbl_chksum : 0xe619d30d) [ 958.112460][T28755] loop5: detected capacity change from 0 to 8 [ 958.179058][T28755] SQUASHFS error: zlib decompression failed, data probably corrupt [ 958.197521][T28755] SQUASHFS error: Failed to read block 0x9b: -5 [ 958.214666][T28755] SQUASHFS error: Unable to read metadata cache entry [99] [ 958.223041][T28759] netlink: 6032 bytes leftover after parsing attributes in process `syz.7.9918'. [ 958.250286][T28755] SQUASHFS error: Unable to read inode 0x127 [ 958.269468][T28760] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9919'. [ 958.321906][T28764] netlink: 'syz.6.9920': attribute type 11 has an invalid length. [ 958.337742][T28760] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9919'. [ 958.365766][T28764] netlink: 216 bytes leftover after parsing attributes in process `syz.6.9920'. [ 958.859755][T28788] tmpfs: Bad value for 'mpol' [ 959.156290][T28802] openvswitch: netlink: IP tunnel dst address not specified [ 959.413877][T28814] cgroup: none used incorrectly [ 959.666024][T28815] loop7: detected capacity change from 0 to 4096 [ 959.709870][T28815] ntfs3(loop7): Different NTFS sector size (2048) and media sector size (512). [ 959.872655][T28833] nfs: Unknown parameter 'smackfsdef' [ 959.882318][T28815] ntfs3(loop7): Failed to initialize $Extend/$ObjId. [ 960.411561][T28858] loop5: detected capacity change from 0 to 8 [ 960.482654][T28858] SQUASHFS error: zlib decompression failed, data probably corrupt [ 960.551653][T28858] SQUASHFS error: Failed to read block 0x4e8: -5 [ 960.581369][ T29] audit: type=1800 audit(2000000071.357:178): pid=28858 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.9957" name="file1" dev="loop5" ino=5 res=0 errno=0 [ 960.712097][T28867] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 960.898220][T28877] ieee802154 phy1 wpan1: encryption failed: -22 [ 961.123074][ T6120] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 961.306423][T28890] loop8: detected capacity change from 0 to 4096 [ 961.313663][ T6120] usb 6-1: Using ep0 maxpacket: 8 [ 961.324423][ T6120] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 961.361100][ T6120] usb 6-1: config 0 interface 0 has no altsetting 0 [ 961.385961][ T6120] usb 6-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 961.415385][ T6120] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 961.423501][ T6120] usb 6-1: Product: syz [ 961.464189][ T6120] usb 6-1: Manufacturer: syz [ 961.469074][ T6120] usb 6-1: SerialNumber: syz [ 961.525377][ T6120] usb 6-1: config 0 descriptor?? [ 961.580438][ T6120] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 found [ 961.804992][ T6120] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 now disconnected [ 961.830319][ T6120] snd_usb_toneport 6-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 961.997951][T28918] tmpfs: Bad value for 'mpol' [ 962.032362][ T6120] usb 6-1: USB disconnect, device number 6 [ 962.159419][T28922] loop8: detected capacity change from 0 to 2048 [ 962.176621][T28927] openvswitch: netlink: IP tunnel dst address not specified [ 962.221172][T28922] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 962.659980][T28944] bridge5: entered promiscuous mode [ 962.914521][T28960] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 963.515914][ T29] audit: type=1326 audit(2000000074.061:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28986 comm="syz.5.10010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 963.601772][ T29] audit: type=1326 audit(2000000074.061:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28986 comm="syz.5.10010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 963.699001][ T29] audit: type=1326 audit(2000000074.061:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28986 comm="syz.5.10010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=6 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 963.802923][ T29] audit: type=1326 audit(2000000074.061:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28986 comm="syz.5.10010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 963.858760][T29002] loop7: detected capacity change from 0 to 764 [ 963.908729][ T29] audit: type=1326 audit(2000000074.061:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28986 comm="syz.5.10010" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 964.473138][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 964.796720][T29043] loop6: detected capacity change from 0 to 1024 [ 964.942014][T27479] hfsplus: b-tree write err: -5, ino 4 [ 965.115618][T29055] loop6: detected capacity change from 0 to 512 [ 965.192711][T29055] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 965.230429][T29055] ext4 filesystem being mounted at /205/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 965.401460][T29031] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 965.414514][T29031] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 965.420976][T29031] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 965.428901][T29031] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 965.442786][T29031] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 965.451903][T26761] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 965.465054][T29031] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 965.471772][T29031] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 965.483488][T29031] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 965.486626][T29074] netlink: 'syz.5.10043': attribute type 2 has an invalid length. [ 965.518562][T29074] netlink: 'syz.5.10043': attribute type 9 has an invalid length. [ 965.532873][T29031] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 965.540081][T29074] netlink: 209852 bytes leftover after parsing attributes in process `syz.5.10043'. [ 965.566025][T29031] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 965.599704][T29031] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 965.635935][T29031] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 965.652249][T29031] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 965.691853][T29031] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 966.196014][T29101] loop5: detected capacity change from 0 to 1024 [ 966.229935][T29101] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 966.273426][T29104] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 966.319456][T29104] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 966.319600][T29104] gretap1: entered promiscuous mode [ 966.319619][T29104] gretap1: entered allmulticast mode [ 966.350509][T29101] EXT4-fs error (device loop5): ext4_empty_dir:3107: inode #11: block 623: comm syz.5.10056: Attempting to read directory block (623) that is past i_size (638464) [ 966.354378][T29101] EXT4-fs (loop5): Remounting filesystem read-only [ 966.522707][T25488] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 966.572858][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888043bb4000 (11)(bridge1) start [ 966.599513][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888043bb4000 (6)(bridge1) end [ 966.674794][T29119] SET target dimension over the limit! [ 966.741380][T29121] loop7: detected capacity change from 0 to 64 [ 966.810889][ T6002] Bluetooth: hci1: command 0x0c1a tx timeout [ 967.477734][T29153] netlink: 'syz.0.10083': attribute type 1 has an invalid length. [ 967.591318][T28051] Bluetooth: hci2: command 0x0c1a tx timeout [ 967.597612][ T6002] Bluetooth: hci3: command 0x0c1a tx timeout [ 967.678451][ T6002] Bluetooth: hci5: command 0x0c1a tx timeout [ 967.764292][ T6002] Bluetooth: hci6: command 0x0c1a tx timeout [ 967.865734][ T6002] Bluetooth: hci0: command 0x0c1a tx timeout [ 968.244644][T29145] loop5: detected capacity change from 0 to 32768 [ 968.702274][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888086a4c000 (11)(bridge1) start [ 968.751008][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888086a4c000 (6)(bridge1) end [ 968.788233][T29202] loop7: detected capacity change from 0 to 512 [ 968.898673][T29202] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 968.968779][T29202] ext4 filesystem being mounted at /155/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 969.008341][T29180] loop6: detected capacity change from 0 to 32768 [ 969.031844][T29211] netlink: 'syz.5.10109': attribute type 1 has an invalid length. [ 969.200115][T26860] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 969.849695][ T6002] Bluetooth: hci3: command 0x0c1a tx timeout [ 969.923308][T29243] loop6: detected capacity change from 0 to 736 [ 969.931784][ T6002] Bluetooth: hci5: command 0x0c1a tx timeout [ 970.019043][ T6002] Bluetooth: hci6: command 0x0c1a tx timeout [ 970.104354][ T6002] Bluetooth: hci0: command 0x0c1a tx timeout [ 970.256645][T29250] netlink: 'syz.8.10126': attribute type 23 has an invalid length. [ 970.536678][T29262] loop6: detected capacity change from 0 to 128 [ 970.557408][T29262] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 970.614262][T29262] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 970.767318][T29270] netlink: 'syz.5.10136': attribute type 11 has an invalid length. [ 970.971394][T29276] netlink: 'syz.5.10140': attribute type 2 has an invalid length. [ 971.011409][T29276] netlink: 'syz.5.10140': attribute type 1 has an invalid length. [ 971.161514][T29284] nbd: couldn't find device at index -37165402 [ 971.375973][T29292] bond1: Removing last arp target with arp_interval on [ 971.467583][T29295] 8021q: adding VLAN 0 to HW filter on device bond1 [ 971.888860][T29318] loop5: detected capacity change from 0 to 4096 [ 971.900087][T29280] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 972.009975][T29318] ntfs3(loop5): Mark volume as dirty due to NTFS errors [ 972.089071][T29318] ntfs3(loop5): ino=9, ntfs_sync_fs failed, -22. [ 972.107995][ T6002] Bluetooth: hci3: command 0x0c1a tx timeout [ 972.167729][T29329] loop7: detected capacity change from 0 to 2048 [ 972.184421][ T6002] Bluetooth: hci5: command 0x0c1a tx timeout [ 972.228554][T29329] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 972.271509][ T6002] Bluetooth: hci6: command 0x0c1a tx timeout [ 972.334460][T25488] ntfs3(loop5): ino=9, ntfs_sync_fs failed, -22. [ 972.358488][ T6002] Bluetooth: hci0: command 0x0c1a tx timeout [ 972.433050][T29333] netlink: 'syz.0.10166': attribute type 17 has an invalid length. [ 972.476930][T29333] netlink: 148 bytes leftover after parsing attributes in process `syz.0.10166'. [ 972.772782][T29315] loop8: detected capacity change from 0 to 32768 [ 972.811799][T29315] (syz.8.10157,29315,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 972.848303][T29315] (syz.8.10157,29315,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 972.962417][T29315] JBD2: Ignoring recovery information on journal [ 973.119587][T29315] ocfs2: Mounting device (7,8) on (node local, slot 0) with ordered data mode. [ 973.304447][T29368] loop6: detected capacity change from 0 to 16 [ 973.348148][T29368] erofs (device loop6): mounted with root inode @ nid 36. [ 973.404022][T29368] erofs (device loop6): per-inode big pcluster without sb feature for nid 36 [ 973.435934][T29368] erofs (device loop6): per-inode big pcluster without sb feature for nid 36 [ 973.457653][T29368] erofs (device loop6): read error -117 @ 43 of nid 36 [ 973.695873][T28048] ocfs2: Unmounting device (7,8) on (node local) [ 973.829098][T29389] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10193'. [ 973.879425][T29389] netlink: 'syz.0.10193': attribute type 3 has an invalid length. [ 973.917268][T29389] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10193'. [ 973.968910][T29389] netlink: 44 bytes leftover after parsing attributes in process `syz.0.10193'. [ 974.164490][T29395] bond1: entered allmulticast mode [ 974.615865][ T6002] Bluetooth: hci0: command 0x0c1a tx timeout [ 974.641373][T29424] loop6: detected capacity change from 0 to 2048 [ 974.663580][T27373] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888068b90000 (13)(batadv0) start [ 974.688537][T29424] NILFS (loop6): broken superblock, retrying with spare superblock (blocksize = 1024) [ 974.739866][T27373] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888068b90000 (7)(batadv0) end [ 974.800121][T29425] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 975.299792][ T29] audit: type=1326 audit(2000000084.934:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29444 comm="syz.8.10220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec8d19acb9 code=0x7ffc0000 [ 975.364433][T29449] xt_cgroup: invalid path, errno=-2 [ 975.383873][ T29] audit: type=1326 audit(2000000084.962:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29444 comm="syz.8.10220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec8d19acb9 code=0x7ffc0000 [ 975.461677][ T29] audit: type=1326 audit(2000000084.971:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29444 comm="syz.8.10220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=90 compat=0 ip=0x7fec8d19acb9 code=0x7ffc0000 [ 975.595049][ T29] audit: type=1326 audit(2000000084.971:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29444 comm="syz.8.10220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec8d19acb9 code=0x7ffc0000 [ 975.638497][ T29] audit: type=1326 audit(2000000084.980:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29444 comm="syz.8.10220" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec8d19acb9 code=0x7ffc0000 [ 975.854676][T29464] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 975.869759][T29464] batadv_slave_0: entered promiscuous mode [ 975.875723][T29464] batadv_slave_0: entered allmulticast mode [ 976.134115][T29474] netlink: 12 bytes leftover after parsing attributes in process `syz.7.10233'. [ 976.439730][T29486] loop8: detected capacity change from 0 to 1764 [ 976.459385][T29486] ISOFS: Logical zone size(0) < hardware blocksize(1024) [ 976.474815][T25878] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 976.682842][T25878] usb 7-1: config 0 has an invalid interface number: 168 but max is 0 [ 976.711797][T25878] usb 7-1: config 0 has no interface number 0 [ 976.722755][T25878] usb 7-1: New USB device found, idVendor=05ab, idProduct=0060, bcdDevice=11.06 [ 976.763644][T25878] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 976.813084][T25878] usb 7-1: config 0 descriptor?? [ 976.964277][T29497] loop7: detected capacity change from 0 to 64 [ 977.055044][ T6002] Bluetooth: hci5: Malformed LE Event: 0x0d [ 977.068926][T25878] usb 7-1: string descriptor 0 read error: -71 [ 977.083171][T25878] usb-storage 7-1:0.168: USB Mass Storage device detected [ 977.142253][T25878] usb-storage 7-1:0.168: Quirks match for vid 05ab pid 0060: 2 [ 977.255184][T25878] usb 7-1: USB disconnect, device number 3 [ 977.350494][T29511] netlink: 5 bytes leftover after parsing attributes in process `syz.0.10249'. [ 977.797349][T29531] binfmt_misc: register: failed to install interpreter file ./file0 [ 978.276933][T29552] netlink: 'syz.8.10270': attribute type 3 has an invalid length. [ 978.289331][T29552] netlink: 'syz.8.10270': attribute type 3 has an invalid length. [ 978.436507][T29562] netlink: 60 bytes leftover after parsing attributes in process `syz.5.10275'. [ 978.460560][T29561] netlink: 4 bytes leftover after parsing attributes in process `syz.7.10276'. [ 978.596320][T29564] SET target dimension over the limit! [ 978.695262][T29568] netlink: 'syz.6.10279': attribute type 15 has an invalid length. [ 978.720725][T29568] netlink: 666 bytes leftover after parsing attributes in process `syz.6.10279'. [ 978.731258][T29571] loop7: detected capacity change from 0 to 64 [ 978.785154][T29571] hfs: filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only. [ 978.836690][T29571] hfs: filesystem is marked locked, mounting read-only. [ 978.852934][T29566] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 979.220616][T29588] loop6: detected capacity change from 0 to 1024 [ 979.454437][T29566] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 979.508332][T29566] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 979.561704][T29566] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 979.599617][T29566] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 979.791196][ T29] audit: type=1326 audit(2000000089.087:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29610 comm="syz.7.10295" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd8b9acb9 code=0x7ffc0000 [ 979.893174][ T29] audit: type=1326 audit(2000000089.106:190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29610 comm="syz.7.10295" exe="/root/syz-executor" sig=0 arch=c000003e syscall=25 compat=0 ip=0x7f0dd8b9acb9 code=0x7ffc0000 [ 980.007227][ T29] audit: type=1326 audit(2000000089.106:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29610 comm="syz.7.10295" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd8b9acb9 code=0x7ffc0000 [ 980.115127][ T29] audit: type=1326 audit(2000000089.106:192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29610 comm="syz.7.10295" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0dd8b9acb9 code=0x7ffc0000 [ 980.236987][T29625] netlink: 144 bytes leftover after parsing attributes in process `syz.7.10301'. [ 980.347709][T29566] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 980.353895][T29566] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 980.402171][T29566] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 980.460436][T29566] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 980.473590][T29629] loop6: detected capacity change from 0 to 1024 [ 980.501670][T29566] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 980.527825][T29566] Bluetooth: hci6: Error when powering off device on rfkill (-4) [ 980.580652][T29627] loop7: detected capacity change from 0 to 4096 [ 980.580651][T29632] loop5: detected capacity change from 0 to 256 [ 980.870035][T29637] netlink: 9 bytes leftover after parsing attributes in process `syz.6.10305'. [ 981.054875][T29637] 0: renamed from hsr0 (while UP) [ 981.093217][T29637] 0: entered allmulticast mode [ 981.133823][T29637] hsr_slave_0: entered allmulticast mode [ 981.145066][T29637] hsr_slave_1: entered allmulticast mode [ 981.151343][T29637] A link change request failed with some changes committed already. Interface 70 may have been left with an inconsistent configuration, please check. [ 981.286306][ T29] audit: type=1326 audit(2000000090.472:193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29644 comm="syz.5.10308" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 981.387603][ T29] audit: type=1326 audit(2000000090.472:194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29644 comm="syz.5.10308" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 981.417883][T29566] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 981.423858][T29566] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 981.484528][ T29] audit: type=1326 audit(2000000090.472:195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29644 comm="syz.5.10308" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 981.539811][T29652] netlink: 308 bytes leftover after parsing attributes in process `syz.6.10310'. [ 981.588597][T29652] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10310'. [ 981.597859][ T29] audit: type=1326 audit(2000000090.509:196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29644 comm="syz.5.10308" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 981.644423][T29654] netlink: 44 bytes leftover after parsing attributes in process `syz.5.10311'. [ 981.672530][T29652] A link change request failed with some changes committed already. Interface vlan0 may have been left with an inconsistent configuration, please check. [ 981.700460][ T29] audit: type=1326 audit(2000000090.518:197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29644 comm="syz.5.10308" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 981.787594][ T29] audit: type=1326 audit(2000000090.518:198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29644 comm="syz.5.10308" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 981.861904][ T29] audit: type=1326 audit(2000000090.518:199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29644 comm="syz.5.10308" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 981.927931][ T29] audit: type=1326 audit(2000000090.518:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29644 comm="syz.5.10308" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 982.033564][T25878] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 982.220472][T25878] usb 8-1: Using ep0 maxpacket: 8 [ 982.227543][T25878] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 982.291610][T25878] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 982.330813][T25878] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 982.371264][T25878] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 65535, setting to 1024 [ 982.417512][T25878] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 982.454500][T25878] usb 8-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 982.509251][T25878] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 982.560560][T25878] usb 8-1: config 0 descriptor?? [ 982.577308][T29658] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 982.707530][T29680] loop5: detected capacity change from 0 to 4096 [ 982.977779][T29680] ntfs3(loop5): ino=9, attr_set_size [ 983.119745][T26897] usb 8-1: USB disconnect, device number 6 [ 983.128862][ T6002] Bluetooth: hci7: Opcode 0x0c03 failed: -71 [ 983.583029][T29724] nbd: must specify a device to reconfigure [ 983.727629][T29729] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10340'. [ 983.911105][T29737] loop7: detected capacity change from 0 to 256 [ 983.941472][T29738] comedi comedi0: rti802: a I/O base address must be specified [ 984.048217][ T42] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 984.183576][T29740] loop5: detected capacity change from 0 to 4096 [ 984.216644][T29740] ntfs3(loop5): Different NTFS sector size (4096) and media sector size (512). [ 984.255842][ T42] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 984.303226][ T42] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 984.344061][ T42] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 984.347033][T29740] ntfs3(loop5): Failed to load $Extend (-22). [ 984.378509][ T42] usb 7-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 984.394695][T29740] ntfs3(loop5): Failed to initialize $Extend. [ 984.434312][ T42] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 984.481182][ T42] usb 7-1: Product: syz [ 984.486473][ T42] usb 7-1: Manufacturer: syz [ 984.516133][ T42] usb 7-1: SerialNumber: syz [ 984.528405][ T42] usb 7-1: config 0 descriptor?? [ 984.534268][T29731] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 984.572188][T29755] loop7: detected capacity change from 0 to 2048 [ 984.581421][T29731] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 984.595011][ T42] usb 7-1: ucan: probing device on interface #0 [ 984.680342][T29755] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 984.906621][T26860] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 985.071029][ T42] usb 7-1: ucan: failed to retrieve device info [ 985.097454][ T42] usb 7-1: ucan: probe failed; try to update the device firmware [ 985.202821][ T42] usb 7-1: USB disconnect, device number 4 [ 985.440010][T29791] netlink: 8 bytes leftover after parsing attributes in process `syz.8.10363'. [ 985.664510][T29801] overlayfs: missing 'lowerdir' [ 985.793302][T29807] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 986.366744][T29834] netlink: 20 bytes leftover after parsing attributes in process `syz.6.10380'. [ 986.403068][T29834] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 986.953972][T29863] openvswitch: netlink: Invalid VLAN frame [ 986.995097][T12743] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 987.190845][T12743] usb 7-1: Using ep0 maxpacket: 16 [ 987.208509][T12743] usb 7-1: config 0 interface 0 has no altsetting 0 [ 987.224879][T12743] usb 7-1: New USB device found, idVendor=25c6, idProduct=9002, bcdDevice=41.ba [ 987.249269][T12743] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 987.271611][T12743] usb 7-1: Product: syz [ 987.275863][T12743] usb 7-1: Manufacturer: syz [ 987.304176][T12743] usb 7-1: SerialNumber: syz [ 987.334153][T12743] usb 7-1: config 0 descriptor?? [ 987.589184][T12743] usb 7-1: selecting invalid altsetting 0 [ 987.621116][T12743] usb 7-1: can't set first interface for hiFace device. [ 987.645091][T29891] loop5: detected capacity change from 0 to 128 [ 987.654024][T12743] snd-usb-hiface 7-1:0.0: probe with driver snd-usb-hiface failed with error -5 [ 987.754526][T12743] usb 7-1: USB disconnect, device number 5 [ 987.864989][T29892] loop7: detected capacity change from 0 to 4096 [ 987.911261][T29892] ntfs3(loop7): Different NTFS sector size (1024) and media sector size (512). [ 987.986925][T29892] ntfs3(loop7): ino=18, mi_enum_attr [ 988.016870][T29892] ntfs3(loop7): Mark volume as dirty due to NTFS errors [ 988.080314][T29892] ntfs3(loop7): ino=0, attr_set_size [ 988.097033][T29900] loop5: detected capacity change from 0 to 4096 [ 988.166633][T29900] ntfs3(loop5): ino=3, ntfs_set_state failed, -22. [ 988.207723][T29900] ntfs3(loop5): Failed to initialize $Extend/$ObjId. [ 988.315703][T29900] ntfs3(loop5): ino=1e, "file1" attr_set_size [ 988.473770][ T3441] ntfs3(loop5): ino=3, ntfs3_write_inode failed, -22. [ 988.498421][T25488] ntfs3(loop5): ino=3, ntfs_set_state failed, -22. [ 988.537426][T25488] ntfs3(loop5): Mark volume as dirty due to NTFS errors [ 988.564531][T25488] ntfs3(loop5): ino=3, ntfs_set_state failed, -22. [ 988.584468][ T2991] ntfs3(loop5): ino=3, ntfs3_write_inode failed, -22. [ 989.216247][T29942] netlink: 8 bytes leftover after parsing attributes in process `syz.6.10425'. [ 989.236783][T29914] loop7: detected capacity change from 0 to 32768 [ 989.277904][T29914] (syz.7.10412,29914,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 989.325477][T29914] (syz.7.10412,29914,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 989.363755][T29914] JBD2: Ignoring recovery information on journal [ 989.489286][T29914] ocfs2: Mounting device (7,7) on (node local, slot 0) with ordered data mode. [ 989.538449][T29952] netlink: 404 bytes leftover after parsing attributes in process `syz.0.10431'. [ 989.560491][T29952] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10431'. [ 989.581076][T29952] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10431'. [ 989.614834][T29952] netlink: 72 bytes leftover after parsing attributes in process `syz.0.10431'. [ 989.821595][T29960] tmpfs: Bad value for 'mpol' [ 989.942344][T26860] ocfs2: Unmounting device (7,7) on (node local) [ 990.070443][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888066dac000 (18)(syz_tun) start [ 990.144771][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888066dac000 (4)(syz_tun) end [ 990.179915][T29940] loop5: detected capacity change from 0 to 32768 [ 990.206556][T29940] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.10423 (29940) [ 990.224664][T29968] loop8: detected capacity change from 0 to 1024 [ 990.242081][T29968] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 990.284424][T29968] EXT4-fs (loop8): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 990.297953][T29940] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 990.330173][T29940] BTRFS info (device loop5): using sha256 checksum algorithm [ 990.347959][T29968] EXT4-fs error (device loop8): ext4_map_blocks:776: inode #3: block 2: comm syz.8.10439: lblock 2 mapped to illegal pblock 2 (length 1) [ 990.452692][T29968] loop8: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 990.461684][ C1] EXT4-fs (loop8): error count since last fsck: 1 [ 990.477299][ C1] EXT4-fs (loop8): initial error at time 2000000098: ext4_map_blocks:776: inode 3: block 2 [ 990.487444][ C1] EXT4-fs (loop8): last error at time 2000000098: ext4_map_blocks:776: inode 3: block 2 [ 990.494428][T29968] Quota error (device loop8): qtree_write_dquot: dquota write failed [ 990.537723][T29968] EXT4-fs error (device loop8): ext4_map_blocks:776: inode #3: block 48: comm syz.8.10439: lblock 0 mapped to illegal pblock 48 (length 1) [ 990.595821][T29968] loop8: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 990.596201][T29968] Quota error (device loop8): v2_write_file_info: Can't write info structure [ 990.657375][T29968] EXT4-fs error (device loop8): ext4_acquire_dquot:7007: comm syz.8.10439: Failed to acquire dquot type 0 [ 990.691225][T29968] loop8: lost filesystem error report for type 5 error -117 [ 990.694505][T29968] EXT4-fs error (device loop8) in ext4_reserve_inode_write:6277: Corrupt filesystem [ 990.730498][T29987] netlink: 'syz.7.10436': attribute type 2 has an invalid length. [ 990.741877][T29968] loop8: lost filesystem error report for type 5 error -117 [ 990.745781][T29940] BTRFS info (device loop5): enabling ssd optimizations [ 990.745781][T29968] EXT4-fs error (device loop8): ext4_evict_inode:255: inode #11: comm syz.8.10439: mark_inode_dirty error [ 990.745813][T29968] loop8: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 990.775343][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055b80000 (13)(netdevsim3) start [ 990.803079][T29968] EXT4-fs warning (device loop8): ext4_evict_inode:258: couldn't mark inode dirty (err -117) [ 990.821403][T29940] BTRFS info (device loop5): turning on async discard [ 990.828245][T29940] BTRFS info (device loop5): enabling free space tree [ 990.828271][ T78] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 990.875090][T29968] EXT4-fs (loop8): 1 orphan inode deleted [ 990.897664][ T1129] EXT4-fs error (device loop8): ext4_map_blocks:776: inode #3: block 1: comm kworker/u8:6: lblock 1 mapped to illegal pblock 1 (length 1) [ 990.917165][ T1129] loop8: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 990.919018][ T1129] Quota error (device loop8): remove_tree: Can't read quota data block 1 [ 990.919314][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055b80000 (7)(netdevsim3) end [ 990.952206][T29968] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 990.965676][ T1129] EXT4-fs error (device loop8): ext4_release_dquot:7043: comm kworker/u8:6: Failed to release dquot type 0 [ 990.994218][ T1129] loop8: lost filesystem error report for type 5 error -117 [ 990.995867][T25488] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 991.165523][T28048] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 991.212889][T27373] EXT4-fs error (device loop8): ext4_map_blocks:776: inode #3: block 1: comm kworker/u8:1: lblock 1 mapped to illegal pblock 1 (length 1) [ 991.235594][T27373] loop8: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 991.235892][T27373] Quota error (device loop8): remove_tree: Can't read quota data block 1 [ 991.256571][T27373] EXT4-fs error (device loop8): ext4_release_dquot:7043: comm kworker/u8:1: Failed to release dquot type 0 [ 991.268342][T27373] loop8: lost filesystem error report for type 5 error -117 [ 991.269356][T28048] EXT4-fs error (device loop8): __ext4_get_inode_loc:4809: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 991.290228][T28048] loop8: lost filesystem error report for type 5 error -117 [ 991.290593][T28048] EXT4-fs error (device loop8) in ext4_reserve_inode_write:6277: Corrupt filesystem [ 991.314642][T28048] loop8: lost filesystem error report for type 5 error -117 [ 991.315015][T28048] EXT4-fs error (device loop8): ext4_quota_off:7291: inode #3: comm syz-executor: mark_inode_dirty error [ 991.334556][T28048] loop8: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 991.422723][ T35] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88802892c000 (13)(netdevsim2) start [ 991.451857][ T78] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.524064][ T35] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88802892c000 (5)(netdevsim2) end [ 991.686848][ T6002] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 991.699866][ T6002] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 991.725316][ T6002] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 991.734111][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888068b88000 (13)(netdevsim1) start [ 991.741404][ T78] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 991.787107][ T6002] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 991.824120][ T6002] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 991.854810][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888068b88000 (3)(netdevsim1) end [ 991.919626][T28051] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 991.927287][T28051] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 991.934840][T28051] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 991.943403][T28051] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 991.951505][T28051] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 992.100534][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88802a76c000 (13)(netdevsim0) start [ 992.122125][ T78] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 992.158076][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88802a76c000 (5)(netdevsim0) end [ 992.292791][T25878] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 992.295214][T30003] wg2 speed is unknown, defaulting to 1000 [ 992.476954][T25878] usb 8-1: Using ep0 maxpacket: 16 [ 992.495318][T25878] usb 8-1: config 0 has an invalid interface number: 132 but max is 0 [ 992.529065][T25878] usb 8-1: config 0 has no interface number 0 [ 992.566369][T25878] usb 8-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 992.575910][T25878] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.583975][T25878] usb 8-1: Product: syz [ 992.588347][T25878] usb 8-1: Manufacturer: syz [ 992.592987][T25878] usb 8-1: SerialNumber: syz [ 992.625683][ T78] bridge_slave_1: left allmulticast mode [ 992.638294][ T78] bridge_slave_1: left promiscuous mode [ 992.662270][T25878] usb 8-1: config 0 descriptor?? [ 992.670584][ T78] bridge0: port 2(bridge_slave_1) entered disabled state [ 992.697058][T25878] hub 8-1:0.132: bad descriptor, ignoring hub [ 992.703214][T25878] hub 8-1:0.132: probe with driver hub failed with error -5 [ 992.727365][ T78] bridge_slave_0: left allmulticast mode [ 992.733085][ T78] bridge_slave_0: left promiscuous mode [ 992.772188][ T78] bridge0: port 1(bridge_slave_0) entered disabled state [ 992.781247][T25878] input: bcm5974 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.132/input/input59 [ 993.162060][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888045364000 (15)(ip6gretap0) start [ 993.195940][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888045364000 (7)(ip6gretap0) end [ 993.329087][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888033548000 (12)(erspan0) start [ 993.365413][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888033548000 (7)(erspan0) end [ 993.383921][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888011e1a000 (9)(gretap0) start [ 993.401149][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888011e1a000 (7)(gretap0) end [ 993.427877][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888033a88000 (11)(gretap1) start [ 993.457147][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888033a88000 (4)(gretap1) end [ 993.535282][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88804806c000 (14)(geneve1) start [ 993.560954][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88804806c000 (7)(geneve1) end [ 993.598630][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888048068000 (14)(geneve0) start [ 993.630027][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888048068000 (7)(geneve0) end [ 993.659323][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888088cb4000 (12)(bridge0) start [ 993.676627][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888088cb4000 (12)(bridge0) end [ 993.707375][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff8880251c8000 (11)(bridge1) start [ 993.727972][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff8880251c8000 (6)(bridge1) end [ 993.829722][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888068a08000 (16)(bond0) start [ 993.849391][ T78] ***** Releasing 0 refcount on 0000000000000000 [ 993.867069][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888068a08000 (13)(bond0) end [ 993.884486][ T78] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 993.913463][ T78] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 993.935570][ T78] bond0 (unregistering): Released all slaves [ 993.956679][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888036574000 (41)(bond1) start [ 993.978840][ T78] ***** Releasing 0 refcount on 0000000000000000 [ 993.988644][ T78] bond1 (unregistering): Released all slaves [ 993.995402][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888036574000 (36)(bond1) end [ 994.049831][T30003] lo speed is unknown, defaulting to 1000 [ 994.199502][ T78] 9: left promiscuous mode [ 994.215880][T28051] Bluetooth: hci5: command tx timeout [ 994.226831][T30051] Sensor B: ================= START STATUS ================= [ 994.234820][T30051] Sensor B: Test Pattern: 75% Colorbar [ 994.245167][T30051] Sensor B: Show Information: All [ 994.250332][T30051] Sensor B: Vertical Flip: false [ 994.257184][T30051] Sensor B: Horizontal Flip: false [ 994.262372][T30051] Sensor B: Brightness: 128 [ 994.265042][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888054e70000 (9)(9) start [ 994.269136][T30051] Sensor B: Contrast: 128 [ 994.288613][T30051] Sensor B: Hue: 0 [ 994.292435][T30051] Sensor B: Saturation: 128 [ 994.297483][T30051] Sensor B: ================== END STATUS ================== [ 994.309293][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888054e70000 (9)(9) end [ 994.462676][ T78] : left promiscuous mode [ 994.505858][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b3da000 (9)() start [ 994.534875][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b3da000 (4)() end [ 994.747005][T26897] IPVS: starting estimator thread 0... [ 994.757842][T30070] netlink: 'syz.8.10477': attribute type 10 has an invalid length. [ 994.850359][ T35] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88803a544000 (11)(wlan1) start [ 994.871353][T30074] IPVS: using max 30 ests per chain, 72000 per kthread [ 994.901094][ T35] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88803a544000 (3)(wlan1) end [ 994.939548][T30070] team0: Device veth1_macvtap failed to register rx_handler [ 995.253468][ T35] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888067e74000 (11)(wlan0) start [ 995.338910][ T35] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888067e74000 (3)(wlan0) end [ 995.576115][T30102] netlink: 12 bytes leftover after parsing attributes in process `syz.7.10488'. [ 995.589776][T30003] chnl_net:caif_netlink_parms(): no params data found [ 995.946281][T30109] loop7: detected capacity change from 0 to 2048 [ 995.964420][T30109] UDF-fs: error (device loop7): udf_read_tagged: read failed, block=27485, location=27485 [ 996.015783][T30109] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 996.074989][T30116] loop8: detected capacity change from 0 to 128 [ 996.384605][T30125] openvswitch: netlink: Tunnel attr 183 out of range max 16 [ 996.453410][T28051] Bluetooth: hci5: command tx timeout [ 996.538470][ T78] hsr_slave_0: left promiscuous mode [ 996.616120][ T78] hsr_slave_1: left promiscuous mode [ 996.630962][ T78] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 996.645701][ T6120] usb 8-1: USB disconnect, device number 7 [ 996.677046][ T78] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 996.721385][ T78] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 996.738566][ T78] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 996.852893][ T78] veth1_macvtap: left promiscuous mode [ 996.877409][ T78] veth0_macvtap: left promiscuous mode [ 996.893794][ T78] veth1_vlan: left promiscuous mode [ 996.905585][ T78] veth0_vlan: left promiscuous mode [ 996.924374][T30140] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 996.935006][T30140] block device autoloading is deprecated and will be removed. [ 997.116974][T30144] overlayfs: workdir and upperdir must be separate subtrees [ 997.183930][T30146] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10507'. [ 997.196908][T30120] loop5: detected capacity change from 0 to 32768 [ 997.206992][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807782c000 (16)(macsec0) start [ 997.264084][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807782c000 (6)(macsec0) end [ 997.291746][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888076494000 (14)(macvtap0) start [ 997.328501][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888076494000 (14)(macvtap0) end [ 997.346683][T30120] XFS (loop5): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 997.398651][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055816000 (16)(veth0_macvtap) start [ 997.418626][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055816000 (9)(veth0_macvtap) end [ 997.459729][T30120] XFS (loop5): Ending clean mount [ 997.516257][T27373] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055814000 (16)(veth1_macvtap) start [ 997.560655][T27373] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055814000 (9)(veth1_macvtap) end [ 997.597787][T25488] XFS (loop5): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 997.634031][T26923] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 997.653664][T27373] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055810000 (6)(ipvlan1) start [ 997.712113][T27373] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055810000 (6)(ipvlan1) end [ 997.741437][T27373] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888079a8c000 (6)(ipvlan0) start [ 997.763363][T27373] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888079a8c000 (6)(ipvlan0) end [ 997.794939][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88803141c000 (14)(macvlan1) start [ 997.823174][T26923] usb 8-1: Using ep0 maxpacket: 8 [ 997.836590][T26923] usb 8-1: unable to get BOS descriptor or descriptor too short [ 997.873657][T26923] usb 8-1: config 8 has an invalid interface number: 255 but max is 0 [ 997.886950][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88803141c000 (7)(macvlan1) end [ 997.893569][T26923] usb 8-1: config 8 has no interface number 0 [ 997.959298][T26923] usb 8-1: config 8 interface 255 has no altsetting 0 [ 997.984859][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888077814000 (14)(macvlan0) start [ 998.036176][T26923] usb 8-1: string descriptor 0 read error: -22 [ 998.036451][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888077814000 (7)(macvlan0) end [ 998.054424][T26923] usb 8-1: New USB device found, idVendor=0423, idProduct=000a, bcdDevice= 0.00 [ 998.100308][T26923] usb 8-1: New USB device strings: Mfr=229, Product=1, SerialNumber=3 [ 998.147068][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888021fbe000 (15)(vlan1) start [ 998.181895][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888021fbe000 (8)(vlan1) end [ 998.224469][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888050500000 (8)(vlan0) start [ 998.242113][T14955] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888050500000 (8)(vlan0) end [ 998.303388][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055faa000 (10)(veth0_vlan) start [ 998.327960][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055faa000 (10)(veth0_vlan) end [ 998.372681][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055fa8000 (17)(veth1_vlan) start [ 998.392228][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055fa8000 (10)(veth1_vlan) end [ 998.469350][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b65c000 (16)(virt_wifi0) start [ 998.488169][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b65c000 (15)(virt_wifi0) end [ 998.567714][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888036972000 (15)(veth0_virt_wifi) start [ 998.592367][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888036972000 (8)(veth0_virt_wifi) end [ 998.628714][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888036970000 (15)(veth1_virt_wifi) start [ 998.660302][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888036970000 (8)(veth1_virt_wifi) end [ 998.706921][T28051] Bluetooth: hci5: command tx timeout [ 998.713723][T26923] eth%d: CATC EL1210A NetMate USB Ethernet at usb-dummy_hcd.7-1, 00:00:00:00:00:00. [ 998.734399][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b31e000 (14)(70) start [ 998.772686][T30171] netlink: 420 bytes leftover after parsing attributes in process `syz.8.10515'. [ 998.782130][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b31e000 (7)(70) end [ 998.805342][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888078382000 (5)(hsr_slave_1) start [ 998.822392][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888078382000 (5)(hsr_slave_1) end [ 998.857923][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888078380000 (15)(veth1_to_hsr) start [ 998.891505][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888078380000 (8)(veth1_to_hsr) end [ 998.943720][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff8880574ec000 (12)(hsr_slave_0) start [ 998.987294][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff8880574ec000 (5)(hsr_slave_0) end [ 999.023627][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88802b478000 (8)(veth0_to_hsr) start [ 999.065277][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88802b478000 (8)(veth0_to_hsr) end [ 999.125409][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888091f58000 (8)(batadv_slave_1) start [ 999.161846][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888091f58000 (8)(batadv_slave_1) end [ 999.195142][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888095446000 (8)(veth1_to_batadv) start [ 999.215767][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888095446000 (8)(veth1_to_batadv) end [ 999.259224][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888091f54000 (6)(batadv_slave_0) start [ 999.300384][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888091f54000 (6)(batadv_slave_0) end [ 999.345348][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888091f52000 (6)(veth0_to_batadv) start [ 999.383001][ T78] team0 (unregistering): Port device team_slave_1 removed [ 999.403556][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888091f52000 (6)(veth0_to_batadv) end [ 999.451423][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055050000 (10)(team_slave_1) start [ 999.491378][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888055050000 (10)(team_slave_1) end [ 999.535168][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888025f6e000 (12)(veth1_to_team) start [ 999.574891][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888025f6e000 (6)(veth1_to_team) end [ 999.642913][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807a354000 (14)(team_slave_0) start [ 999.660932][ T78] team0 (unregistering): Port device team_slave_0 removed [ 999.669253][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807a354000 (17)(team_slave_0) end [ 999.762546][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807c948000 (16)(veth0_to_team) start [ 999.822593][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807c948000 (8)(veth0_to_team) end [ 999.840176][T30173] loop8: detected capacity change from 0 to 40427 [ 999.860367][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888076e46000 (4)(bond_slave_1) start [ 999.880836][T30173] F2FS-fs (loop8): Invalid log_blocksize (268), supports only 12 [ 999.899727][T30173] F2FS-fs (loop8): Can't find valid F2FS filesystem in 1th superblock [ 999.921974][T30173] F2FS-fs (loop8): invalid crc value [ 999.927683][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888076e46000 (4)(bond_slave_1) end [ 1000.029616][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807a356000 (14)(veth1_to_bond) start [ 1000.078141][T27479] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807a356000 (7)(veth1_to_bond) end [ 1000.161532][T30173] F2FS-fs (loop8): sanity_check_inode: directory inode (ino=3) has a single i_nlink [ 1000.171550][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888054aee000 (8)(bond_slave_0) start [ 1000.189448][T30173] F2FS-fs (loop8): Failed to read root inode [ 1000.217236][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888054aee000 (4)(bond_slave_0) end [ 1000.299848][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888054c2e000 (7)(veth0_to_bond) start [ 1000.335394][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888054c2e000 (5)(veth0_to_bond) end [ 1000.356402][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888081838000 (14)(bridge_slave_1) start [ 1000.372630][T30192] netlink: 244 bytes leftover after parsing attributes in process `syz.7.10524'. [ 1000.401230][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888081838000 (5)(bridge_slave_1) end [ 1000.426552][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888025e14000 (15)(veth1_to_bridge) start [ 1000.445588][ T58] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888025e14000 (8)(veth1_to_bridge) end [ 1000.498835][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888074118000 (14)(bridge_slave_0) start [ 1000.519834][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888074118000 (5)(bridge_slave_0) end [ 1000.610086][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888035f94000 (15)(veth0_to_bridge) start [ 1000.646925][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888035f94000 (6)(veth0_to_bridge) end [ 1000.774345][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b16e000 (15)(veth1) start [ 1000.817588][ T1301] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b16e000 (8)(veth1) end [ 1000.855025][ T3441] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b16c000 (15)(veth0) start [ 1000.878436][ T3441] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88807b16c000 (8)(veth0) end [ 1000.966088][T28051] Bluetooth: hci5: command tx timeout [ 1000.973532][ T3441] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888033598000 (13)(batadv0) start [ 1000.990567][ T3441] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888033598000 (7)(batadv0) end [ 1001.062425][ T3441] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888025322000 (14)(dummy0) start [ 1001.080650][ T3441] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888025322000 (7)(dummy0) end [ 1001.115147][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888058b78000 (15)(team0) start [ 1001.132013][ T8454] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff888058b78000 (8)(team0) end [ 1001.205015][T30146] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1001.229204][T26923] usb 8-1: USB disconnect, device number 8 [ 1001.323289][ T3441] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff8880a29c0000 (11)(eth13) start [ 1001.356043][ T3441] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff8880a29c0000 (3)(eth13) end [ 1001.377022][T30003] bridge0: port 1(bridge_slave_0) entered blocking state [ 1001.387220][T30003] bridge0: port 1(bridge_slave_0) entered disabled state [ 1001.423105][T30003] bridge_slave_0: entered allmulticast mode [ 1001.432437][T30003] bridge_slave_0: entered promiscuous mode [ 1001.484392][T30003] bridge0: port 2(bridge_slave_1) entered blocking state [ 1001.500194][T30003] bridge0: port 2(bridge_slave_1) entered disabled state [ 1001.516708][T30003] bridge_slave_1: entered allmulticast mode [ 1001.541179][T30003] bridge_slave_1: entered promiscuous mode [ 1001.771980][T30003] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1001.821702][T30003] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1001.980050][T30212] IPv6: NLM_F_CREATE should be specified when creating new route [ 1002.052003][T30003] team0: Port device team_slave_0 added [ 1002.084697][T30003] team0: Port device team_slave_1 added [ 1002.173914][T26923] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1002.217175][T30003] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1002.224265][T30003] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1002.276553][T30003] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1002.290161][T30003] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1002.297560][T30003] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1002.330556][T30003] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1002.359956][T26923] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1002.400205][T30225] netlink: 'syz.8.10536': attribute type 1 has an invalid length. [ 1002.408259][T26923] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1002.429644][T30225] netlink: 16949 bytes leftover after parsing attributes in process `syz.8.10536'. [ 1002.445384][T26923] usb 6-1: New USB device found, idVendor=13e5, idProduct=0001, bcdDevice=4e.53 [ 1002.473110][T26923] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1002.513641][T26923] usb 6-1: config 0 descriptor?? [ 1002.705637][T30003] hsr_slave_0: entered promiscuous mode [ 1002.728998][T30003] hsr_slave_1: entered promiscuous mode [ 1002.760746][T30003] debugfs: 'hsr0' already exists in 'hsr' [ 1002.766599][T30003] Cannot create hsr debugfs directory [ 1002.776204][T26923] usb 6-1: string descriptor 0 read error: -71 [ 1002.976634][T26923] usb 6-1: USB disconnect, device number 7 [ 1003.142536][T30247] loop7: detected capacity change from 0 to 4096 [ 1003.246374][T30247] ntfs3(loop7): ino=b, Correct links count -> 1. [ 1003.259736][T30247] ntfs3(loop7): ino=18, mi_enum_attr [ 1003.265119][T30247] ntfs3(loop7): Mark volume as dirty due to NTFS errors [ 1003.415885][T30260] loop8: detected capacity change from 0 to 256 [ 1003.503741][T30260] FAT-fs (loop8): Directory bread(block 64) failed [ 1003.533678][T30260] FAT-fs (loop8): Directory bread(block 65) failed [ 1003.557267][T30257] xt_CT: No such helper "snmp_trap" [ 1003.573928][T30262] loop5: detected capacity change from 0 to 256 [ 1003.614825][T30260] FAT-fs (loop8): Directory bread(block 66) failed [ 1003.621426][T30260] FAT-fs (loop8): Directory bread(block 67) failed [ 1003.657537][T30262] FAT-fs (loop5): Directory bread(block 64) failed [ 1003.687033][T30262] FAT-fs (loop5): Directory bread(block 65) failed [ 1003.690526][T30260] FAT-fs (loop8): Directory bread(block 68) failed [ 1003.704134][T30262] FAT-fs (loop5): Directory bread(block 66) failed [ 1003.710881][T30262] FAT-fs (loop5): Directory bread(block 67) failed [ 1003.766615][T30260] FAT-fs (loop8): Directory bread(block 69) failed [ 1003.773298][T30260] FAT-fs (loop8): Directory bread(block 70) failed [ 1003.781333][T30262] FAT-fs (loop5): Directory bread(block 68) failed [ 1003.821275][T30262] FAT-fs (loop5): Directory bread(block 69) failed [ 1003.827993][T30262] FAT-fs (loop5): Directory bread(block 70) failed [ 1003.842622][T30260] FAT-fs (loop8): Directory bread(block 71) failed [ 1003.856217][T30260] FAT-fs (loop8): Directory bread(block 72) failed [ 1003.874074][T30260] FAT-fs (loop8): Directory bread(block 73) failed [ 1003.887458][T30262] FAT-fs (loop5): Directory bread(block 71) failed [ 1003.894167][T30262] FAT-fs (loop5): Directory bread(block 72) failed [ 1003.938786][T30262] FAT-fs (loop5): Directory bread(block 73) failed [ 1004.003038][T30003] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1004.058174][T30003] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1004.128558][T30003] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1004.186061][T30003] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1004.685448][T30003] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1004.779500][T30003] 8021q: adding VLAN 0 to HW filter on device team0 [ 1004.863679][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 1004.870969][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1004.933192][ T8454] bridge0: port 2(bridge_slave_1) entered blocking state [ 1004.940477][ T8454] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1004.954218][T30312] loop8: detected capacity change from 0 to 1024 [ 1004.995324][T30312] EXT4-fs (loop8): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 1005.036957][T30312] EXT4-fs (loop8): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 1005.081039][T30312] EXT4-fs error (device loop8): ext4_get_journal_inode:5869: inode #32: comm syz.8.10566: iget: special inode unallocated [ 1005.175360][T30312] loop8: lost file I/O error report for ino 32 type 5 pos 0x0 len 0x0 error -117 [ 1005.180888][T30312] EXT4-fs (loop8): Remounting filesystem read-only [ 1005.190168][ C0] EXT4-fs (loop8): error count since last fsck: 1 [ 1005.190192][ C0] EXT4-fs (loop8): initial error at time 2000000112: ext4_get_journal_inode:5869: inode 32 [ 1005.190223][ C0] EXT4-fs (loop8): last error at time 2000000112: ext4_get_journal_inode:5869: inode 32 [ 1005.263088][T30322] netlink: 'syz.0.10572': attribute type 3 has an invalid length. [ 1005.302432][T30312] EXT4-fs (loop8): no journal found [ 1005.323034][T30312] EXT4-fs (loop8): can't get journal size [ 1005.380134][T30312] EXT4-fs (loop8): filesystem is read-only [ 1005.410260][T30312] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 1005.686329][T28048] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1005.730750][T30003] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1005.776569][T30340] netlink: 'syz.0.10576': attribute type 16 has an invalid length. [ 1005.859050][T30340] netlink: 'syz.0.10576': attribute type 3 has an invalid length. [ 1005.873987][T30340] netlink: 132 bytes leftover after parsing attributes in process `syz.0.10576'. [ 1006.600502][T30332] loop5: detected capacity change from 0 to 32768 [ 1006.648591][T30332] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.10573 (30332) [ 1006.745672][T30332] BTRFS info (device loop5): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 1006.755841][T30332] BTRFS info (device loop5): using xxhash64 checksum algorithm [ 1006.948737][T30003] veth0_vlan: entered promiscuous mode [ 1006.996910][T30332] BTRFS info (device loop5): enabling ssd optimizations [ 1007.003931][T30332] BTRFS info (device loop5): turning on flush-on-commit [ 1007.011130][T30332] BTRFS info (device loop5): turning on async discard [ 1007.018280][T30332] BTRFS info (device loop5): enabling free space tree [ 1007.025238][T30332] BTRFS info (device loop5): force zlib compression, level 3 [ 1007.034484][T30332] BTRFS info (device loop5): max_inline set to 4096 [ 1007.090149][T30003] veth1_vlan: entered promiscuous mode [ 1007.268846][T30003] veth0_macvtap: entered promiscuous mode [ 1007.300871][T30003] veth1_macvtap: entered promiscuous mode [ 1007.351775][T30408] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1007.393093][T30408] overlayfs: missing 'lowerdir' [ 1007.445134][T30003] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1007.489758][T30003] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1007.636057][ T35] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.666592][ T35] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.675698][ T35] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.719630][ T35] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1008.127138][ T3441] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1008.179370][ T3441] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1008.257352][T30433] sctp: [Deprecated]: syz.0.10604 (pid 30433) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1008.257352][T30433] Use struct sctp_sack_info instead [ 1008.300226][ T8454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1008.320263][ T8454] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1008.668516][T25488] BTRFS info (device loop5): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2 [ 1008.700572][T30446] loop7: detected capacity change from 0 to 256 [ 1008.728427][T30444] loop9: detected capacity change from 0 to 512 [ 1008.813438][T30444] EXT4-fs (loop9): Cannot turn on journaled quota: type 0: error -2 [ 1008.875889][T30444] EXT4-fs (loop9): 1 truncate cleaned up [ 1008.929124][T30446] FAT-fs (loop7): Directory bread(block 64) failed [ 1008.937487][T30444] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1008.980407][T30446] FAT-fs (loop7): Directory bread(block 65) failed [ 1008.987122][T30446] FAT-fs (loop7): Directory bread(block 66) failed [ 1009.050295][T30444] EXT4-fs (loop9): re-mounted 00000000-0000-0000-0000-000000000000. [ 1009.057341][T30446] FAT-fs (loop7): Directory bread(block 67) failed [ 1009.092892][T30446] FAT-fs (loop7): Directory bread(block 68) failed [ 1009.134971][T30446] FAT-fs (loop7): Directory bread(block 69) failed [ 1009.170249][T30446] FAT-fs (loop7): Directory bread(block 70) failed [ 1009.193753][T30446] FAT-fs (loop7): Directory bread(block 71) failed [ 1009.226331][T30003] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1009.248462][T30446] FAT-fs (loop7): Directory bread(block 72) failed [ 1009.255094][T30446] FAT-fs (loop7): Directory bread(block 73) failed [ 1009.416451][T30463] mmap: syz.9.10612 (30463): VmData 45850624 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 1009.771352][T30449] loop8: detected capacity change from 0 to 32768 [ 1009.811243][T30449] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop8 (7:8) scanned by syz.8.10609 (30449) [ 1009.854726][T30449] BTRFS info (device loop8): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1009.871921][T26923] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1009.886652][T30449] BTRFS info (device loop8): using sha256 checksum algorithm [ 1010.041427][T26923] usb 6-1: Using ep0 maxpacket: 32 [ 1010.063487][T26923] usb 6-1: config 0 has an invalid interface number: 196 but max is 0 [ 1010.089314][T30449] BTRFS info (device loop8): enabling ssd optimizations [ 1010.107787][T26923] usb 6-1: config 0 has no interface number 0 [ 1010.113974][T26923] usb 6-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 1010.134650][T30449] BTRFS info (device loop8): turning on async discard [ 1010.176213][T30449] BTRFS info (device loop8): enabling free space tree [ 1010.212934][T26923] usb 6-1: config 0 interface 196 has no altsetting 0 [ 1010.225968][T26923] usb 6-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 1010.253649][T26923] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1010.281980][T26923] usb 6-1: Product: syz [ 1010.297347][T26923] usb 6-1: Manufacturer: syz [ 1010.325291][T26923] usb 6-1: SerialNumber: syz [ 1010.376031][T26923] usb 6-1: config 0 descriptor?? [ 1010.382224][T30468] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1010.451413][T28048] BTRFS info (device loop8): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1010.503879][T30504] openvswitch: netlink: IP tunnel dst address not specified [ 1010.721987][T26923] ipheth 6-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 1010.764186][T26923] ipheth 6-1:0.196: probe with driver ipheth failed with error -71 [ 1010.830351][T26923] usb 6-1: USB disconnect, device number 8 [ 1011.225788][T30483] loop9: detected capacity change from 0 to 32768 [ 1011.276322][T30483] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop9 (7:9) scanned by syz.9.10620 (30483) [ 1011.346491][T30483] BTRFS info (device loop9): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1011.404304][T30483] BTRFS info (device loop9): using sha256 checksum algorithm [ 1011.715239][T30483] BTRFS info (device loop9): enabling ssd optimizations [ 1011.747140][T30483] BTRFS info (device loop9): turning on async discard [ 1011.779981][T30483] BTRFS info (device loop9): enabling free space tree [ 1011.872779][ T6120] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1011.970464][T30003] BTRFS info (device loop9): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1012.081085][ T6120] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 1012.101468][ T6120] usb 6-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1012.112811][T30560] netlink: 'syz.0.10645': attribute type 1 has an invalid length. [ 1012.132595][ T6120] usb 6-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1012.177080][ T6120] usb 6-1: config 220 has no interface number 2 [ 1012.188096][ T6120] usb 6-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1012.260245][ T6120] usb 6-1: config 220 interface 0 has no altsetting 0 [ 1012.286982][ T6120] usb 6-1: config 220 interface 76 has no altsetting 0 [ 1012.323625][ T6120] usb 6-1: config 220 interface 1 has no altsetting 0 [ 1012.344236][ T6120] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1012.373175][ T6120] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.381843][T30566] netlink: 'syz.0.10647': attribute type 2 has an invalid length. [ 1012.404532][ T6120] usb 6-1: Product: syz [ 1012.426658][ T6120] usb 6-1: Manufacturer: syz [ 1012.445202][ T6120] usb 6-1: SerialNumber: syz [ 1012.492793][T30524] loop8: detected capacity change from 0 to 32768 [ 1012.548966][T30524] (syz.8.10634,30524,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1012.609066][T30524] (syz.8.10634,30524,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 1012.727462][ T6120] usb 6-1: selecting invalid altsetting 0 [ 1012.764986][T30524] JBD2: Ignoring recovery information on journal [ 1012.767968][ T6120] uvcvideo 6-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1012.834704][ T6120] uvcvideo 6-1:220.0: No valid video chain found. [ 1012.880729][ T6120] usb 6-1: selecting invalid altsetting 0 [ 1012.891111][T30524] ocfs2: Mounting device (7,8) on (node local, slot 0) with ordered data mode. [ 1012.917313][T30575] ip6gre1: entered allmulticast mode [ 1012.928860][ T6120] usbtest 6-1:220.1: probe with driver usbtest failed with error -22 [ 1013.017476][ T6120] usb 6-1: USB disconnect, device number 9 [ 1013.153473][T30582] openvswitch: netlink: Unexpected mask (mask=2200040, allowed=2010048) [ 1013.253550][T28048] ocfs2: Unmounting device (7,8) on (node local) [ 1013.422941][T30592] loop9: detected capacity change from 0 to 256 [ 1013.507191][T30592] FAT-fs (loop9): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 1013.682391][T30600] sctp: [Deprecated]: syz.0.10663 (pid 30600) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1013.682391][T30600] Use struct sctp_sack_info instead [ 1013.985137][T30611] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10669'. [ 1014.161631][T30619] loop9: detected capacity change from 0 to 256 [ 1014.187852][T30623] netlink: 20 bytes leftover after parsing attributes in process `syz.7.10674'. [ 1014.586325][T30638] netlink: 48 bytes leftover after parsing attributes in process `syz.5.10680'. [ 1014.600509][T30638] netlink: 'syz.5.10680': attribute type 2 has an invalid length. [ 1015.242528][T30662] netlink: 288 bytes leftover after parsing attributes in process `syz.0.10691'. [ 1015.453779][T30670] kernel read not supported for file / 7âW)sPmQfsl{Tr)rO2:" (pid: 30670 comm: syz.8.10696) [ 1015.506449][ T29] audit: type=1800 audit(2000000122.039:201): pid=30670 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.10696" name=20019C1437B1CFFCC3A25729EB7350C86DE0518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C099 dev="mqueue" ino=85967 res=0 errno=0 [ 1015.583993][T30640] loop7: detected capacity change from 0 to 32768 [ 1015.727956][T30640] XFS (loop7): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1015.789950][T30688] netlink: 20 bytes leftover after parsing attributes in process `syz.9.10702'. [ 1015.881096][ T29] audit: type=1326 audit(2000000122.399:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30692 comm="syz.0.10704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa108d9acb9 code=0x7ffc0000 [ 1015.914733][T30695] netlink: 'syz.9.10705': attribute type 1 has an invalid length. [ 1015.923031][T30695] netlink: 232 bytes leftover after parsing attributes in process `syz.9.10705'. [ 1015.952653][T30640] XFS (loop7): Ending clean mount [ 1015.985832][ T29] audit: type=1326 audit(2000000122.426:203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30692 comm="syz.0.10704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa108d9acb9 code=0x7ffc0000 [ 1016.068360][ T29] audit: type=1326 audit(2000000122.426:204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30692 comm="syz.0.10704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa108d9acb9 code=0x7ffc0000 [ 1016.162233][ T29] audit: type=1326 audit(2000000122.454:205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30692 comm="syz.0.10704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=277 compat=0 ip=0x7fa108d9acb9 code=0x7ffc0000 [ 1016.216964][ T29] audit: type=1326 audit(2000000122.454:206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30692 comm="syz.0.10704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa108d9acb9 code=0x7ffc0000 [ 1016.240494][T26860] XFS (loop7): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 1016.260558][ T29] audit: type=1326 audit(2000000122.454:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30692 comm="syz.0.10704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa108d9acb9 code=0x7ffc0000 [ 1016.283332][T30704] netlink: 'syz.5.10709': attribute type 3 has an invalid length. [ 1016.297953][ T29] audit: type=1326 audit(2000000122.454:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30692 comm="syz.0.10704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa108d9acb9 code=0x7ffc0000 [ 1016.410465][ T29] audit: type=1326 audit(2000000122.454:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30692 comm="syz.0.10704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fa108d9acb9 code=0x7ffc0000 [ 1016.449098][ T29] audit: type=1326 audit(2000000122.454:210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30692 comm="syz.0.10704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fa108d9acb9 code=0x7ffc0000 [ 1016.484841][T30708] netlink: 84 bytes leftover after parsing attributes in process `syz.9.10714'. [ 1016.596067][T30712] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10713'. [ 1017.158930][T30722] loop9: detected capacity change from 0 to 4096 [ 1017.207591][T30722] ntfs3(loop9): Different NTFS sector size (4096) and media sector size (512). [ 1017.336517][T30722] ntfs3(loop9): ino=19, mi_enum_attr [ 1017.353955][T30722] ntfs3(loop9): Mark volume as dirty due to NTFS errors [ 1017.838029][T30751] loop8: detected capacity change from 0 to 2048 [ 1017.876796][T30751] NILFS (loop8): broken superblock, retrying with spare superblock (blocksize = 1024) [ 1017.951061][T30754] NILFS (loop8): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1018.025416][T30751] NILFS (loop8): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157 [ 1018.047126][T30751] NILFS error (device loop8): nilfs_bmap_lookup_contig: broken bmap (inode number=16) [ 1018.119584][T30751] Remounting filesystem read-only [ 1018.129924][T30751] NILFS (loop8): bad btree node (ino=16, blocknr=15): level = 1, flags = 0x0, nchildren = 157 [ 1018.151686][T30751] NILFS error (device loop8): nilfs_bmap_last_key: broken bmap (inode number=16) [ 1018.161145][T30751] NILFS (loop8): error -5 truncating bmap (ino=16) [ 1018.199052][T30758] netlink: 8 bytes leftover after parsing attributes in process `syz.9.10735'. [ 1018.220218][T30758] netlink: 12 bytes leftover after parsing attributes in process `syz.9.10735'. [ 1018.260007][T30730] loop5: detected capacity change from 0 to 32768 [ 1018.292882][T28048] NILFS (loop8): disposed unprocessed dirty file(s) when detaching log writer [ 1018.300197][T30730] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.10720 (30730) [ 1018.452206][T30730] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1018.501059][T30730] BTRFS info (device loop5): using sha256 checksum algorithm [ 1018.780078][T30730] BTRFS info (device loop5): enabling ssd optimizations [ 1018.815108][T30730] BTRFS info (device loop5): turning on async discard [ 1018.821973][T30730] BTRFS info (device loop5): enabling free space tree [ 1018.967016][T25488] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1019.416081][T30811] __nla_validate_parse: 2 callbacks suppressed [ 1019.416102][T30811] netlink: 56 bytes leftover after parsing attributes in process `syz.7.10752'. [ 1019.647457][T30819] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10756'. [ 1019.724680][T30823] overlay: Unknown parameter 'smackfstransmute' [ 1020.103435][T30840] netlink: 256 bytes leftover after parsing attributes in process `syz.9.10765'. [ 1020.215063][T30842] loop5: detected capacity change from 0 to 512 [ 1020.250014][T30842] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 1020.264823][T30839] loop7: detected capacity change from 0 to 4096 [ 1020.311333][T30842] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 1020.340749][T30839] ntfs3(loop7): Different NTFS sector size (4096) and media sector size (512). [ 1020.351187][T30839] ntfs3(loop7): RAW NTFS volume: Filesystem size 0.00 Gb > volume size 0.00 Gb. Mount in read-only. [ 1020.365230][T30842] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 1020.373361][T30842] System zones: 0-1, 15-15, 18-18, 34-34 [ 1020.438830][T30839] ntfs3(loop7): $Secure::$SDH is corrupted. [ 1020.442103][T30842] EXT4-fs (loop5): orphan cleanup on readonly fs [ 1020.452149][T30842] EXT4-fs warning (device loop5): ext4_enable_quotas:7242: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 1020.482426][T30839] ntfs3(loop7): Failed to initialize $Secure (-22). [ 1020.483569][T30842] EXT4-fs (loop5): Cannot turn on quotas: error -22 [ 1020.544523][T30842] EXT4-fs (loop5): 1 truncate cleaned up [ 1020.583808][T30842] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 1020.729792][T30842] fscrypt (loop5, inode 16): Error -61 getting encryption context [ 1020.832845][T25488] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1020.876385][T30866] loop7: detected capacity change from 0 to 128 [ 1020.954826][T30866] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1021.028522][T30871] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10776'. [ 1021.037841][T30866] ext4 filesystem being mounted at /301/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1021.237008][T26860] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1021.408325][T30884] x_tables: unsorted underflow at hook 3 [ 1021.634675][T30892] loop5: detected capacity change from 0 to 16 [ 1021.665806][T30892] erofs (device loop5): mounted with root inode @ nid 36. [ 1022.083682][T30906] loop7: detected capacity change from 0 to 64 [ 1022.127525][T30861] loop8: detected capacity change from 0 to 32768 [ 1022.241862][T30861] ERROR: (device loop8): xtTruncate: xt_getpage: xtree page corrupt [ 1022.241862][T30861] [ 1022.306424][T30861] ERROR: (device loop8): remounting filesystem as read-only [ 1022.950774][T30902] loop5: detected capacity change from 0 to 32768 [ 1022.977531][T30924] loop8: detected capacity change from 0 to 4096 [ 1022.987761][T30902] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.10785 (30902) [ 1023.030865][T30924] ntfs3(loop8): Different NTFS sector size (1024) and media sector size (512). [ 1023.062348][T30902] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1023.114661][T30902] BTRFS info (device loop5): using sha256 checksum algorithm [ 1023.226116][T30924] ntfs3(loop8): ino=1d, mi_enum_attr [ 1023.255909][T30924] ntfs3(loop8): Mark volume as dirty due to NTFS errors [ 1023.298938][T30924] ntfs3(loop8): ino=1d, mi_enum_attr [ 1023.450619][T30902] BTRFS info (device loop5): enabling ssd optimizations [ 1023.513488][T30902] BTRFS info (device loop5): turning on async discard [ 1023.530687][T28048] ntfs3(loop8): ino=1d, mi_enum_attr [ 1023.573125][T30902] BTRFS info (device loop5): enabling free space tree [ 1023.698666][T30902] BTRFS error: failed to open device for path {P/AťG3OtU?XoW0%sof*n9XEaWٔc~]ojK-K l">T f]2'#_Ȕrt_^e with flags 0x1: -2 [ 1023.973257][T30973] netlink: 'syz.8.10805': attribute type 11 has an invalid length. [ 1024.004119][T30973] netlink: 140 bytes leftover after parsing attributes in process `syz.8.10805'. [ 1024.039156][T25488] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1024.112892][T30970] loop9: detected capacity change from 0 to 4096 [ 1024.172690][T30970] ntfs3(loop9): Different NTFS sector size (4096) and media sector size (512). [ 1024.484255][T30979] bridge0: port 3(team0) entered blocking state [ 1024.509414][T30979] bridge0: port 3(team0) entered disabled state [ 1024.534891][T30979] team0: entered allmulticast mode [ 1024.553075][T30979] team_slave_0: entered allmulticast mode [ 1024.570957][T30979] team_slave_1: entered allmulticast mode [ 1024.597314][T30979] team0: entered promiscuous mode [ 1024.613990][T30979] team_slave_0: entered promiscuous mode [ 1024.631199][T30979] team_slave_1: entered promiscuous mode [ 1025.267662][T30999] loop5: detected capacity change from 0 to 8 [ 1025.275537][T30997] gfs2: error -5 reading superblock [ 1025.375436][T31002] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1025.696720][T31006] loop7: detected capacity change from 0 to 4096 [ 1025.753793][T31006] ntfs3(loop7): Different NTFS sector size (4096) and media sector size (512). [ 1025.844681][T31006] ntfs3(loop7): ino=19, mi_enum_attr [ 1025.878098][T31006] ntfs3(loop7): Mark volume as dirty due to NTFS errors [ 1025.963515][T31006] ntfs3(loop7): failed to convert "c46c" to iso8859-7 [ 1025.978264][T31006] ntfs3(loop7): ino=20, mi_enum_attr [ 1026.119848][T31024] loop8: detected capacity change from 0 to 1024 [ 1026.140003][T31024] hfsplus: unable to change nls mapping [ 1026.641301][T31045] netlink: 'syz.0.10830': attribute type 28 has an invalid length. [ 1026.673907][T31045] netlink: 'syz.0.10830': attribute type 3 has an invalid length. [ 1026.723959][T31045] netlink: 132 bytes leftover after parsing attributes in process `syz.0.10830'. [ 1026.762840][T31052] loop8: detected capacity change from 0 to 1024 [ 1026.963281][ T35] hfsplus: b-tree write err: -5, ino 4 [ 1027.518314][T31049] loop5: detected capacity change from 0 to 32768 [ 1027.639663][T31049] XFS (loop5): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 1027.852427][T31049] XFS (loop5): Starting recovery (logdev: internal) [ 1027.932432][T31049] XFS (loop5): Ending recovery (logdev: internal) [ 1028.080355][T31107] bond5: up delay (4) is not a multiple of miimon (7), value rounded to 0 ms [ 1028.081031][T25488] XFS (loop5): Unmounting Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 1028.098129][T31107] bond5: entered allmulticast mode [ 1028.453990][T31125] loop9: detected capacity change from 0 to 256 [ 1028.737816][T31132] ptrace attach of "./syz-executor exec"[26860] was attempted by "  "[31132] [ 1029.042284][T31138] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1029.258175][T31146] No source specified [ 1029.263228][T31145] netlink: 16 bytes leftover after parsing attributes in process `syz.9.10875'. [ 1029.504575][T31155] loop8: detected capacity change from 0 to 764 [ 1029.629669][T31155] syz.8.10880: attempt to access beyond end of device [ 1029.629669][T31155] loop8: rw=524288, sector=872, nr_sectors = 256 limit=764 [ 1029.687090][T31155] syz.8.10880: attempt to access beyond end of device [ 1029.687090][T31155] loop8: rw=524288, sector=1128, nr_sectors = 256 limit=764 [ 1029.703885][T31155] syz.8.10880: attempt to access beyond end of device [ 1029.703885][T31155] loop8: rw=8388608, sector=872, nr_sectors = 8 limit=764 [ 1029.720981][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 1029.721000][ T29] audit: type=1800 audit(2000000135.173:211): pid=31155 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.10880" name="file1" dev="loop8" ino=1807 res=0 errno=0 [ 1030.142377][T31172] netlink: 228 bytes leftover after parsing attributes in process `syz.8.10889'. [ 1030.276001][T31174] netlink: 220 bytes leftover after parsing attributes in process `syz.9.10890'. [ 1030.289349][T31148] loop7: detected capacity change from 0 to 32768 [ 1030.338911][T31148] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop7 (7:7) scanned by syz.7.10877 (31148) [ 1030.419916][T31178] netlink: 1 bytes leftover after parsing attributes in process `syz.8.10892'. [ 1030.444689][T31178] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1030.462241][T31148] BTRFS info (device loop7): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1030.512320][T31148] BTRFS info (device loop7): using sha256 checksum algorithm [ 1030.555120][T31181] loop9: detected capacity change from 0 to 512 [ 1030.563984][T31182] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10893'. [ 1030.576998][T31181] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 1030.639507][T31181] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1030.753672][T30003] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1030.882737][T31148] BTRFS info (device loop7): enabling ssd optimizations [ 1030.917792][T31194] loop8: detected capacity change from 0 to 4096 [ 1030.927965][T31148] BTRFS info (device loop7): turning on async discard [ 1030.967456][T31148] BTRFS info (device loop7): enabling free space tree [ 1031.172820][T26860] BTRFS info (device loop7): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1031.784350][T31233] netlink: 64 bytes leftover after parsing attributes in process `syz.0.10911'. [ 1031.883437][T31235] loop5: detected capacity change from 0 to 512 [ 1031.944164][T31235] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 1031.972849][T31235] EXT4-fs warning (device loop5): dx_probe:837: inode #2: comm syz.5.10914: Unimplemented hash flags: 0x0001 [ 1031.988148][T31235] EXT4-fs warning (device loop5): dx_probe:934: inode #2: comm syz.5.10914: Corrupt directory, running e2fsck is recommended [ 1032.177205][T25488] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1032.240923][T31248] loop7: detected capacity change from 0 to 512 [ 1032.264086][T31248] EXT4-fs (loop7): DAX unsupported by block device. [ 1032.410029][T31254] netlink: 'syz.5.10919': attribute type 1 has an invalid length. [ 1032.630607][T31265] loop8: detected capacity change from 0 to 16 [ 1032.647664][T31266] netlink: 'syz.5.10926': attribute type 1 has an invalid length. [ 1032.674091][T31265] erofs (device loop8): mounted with root inode @ nid 36. [ 1032.961517][T31268] loop7: detected capacity change from 0 to 8192 [ 1033.165537][T31284] loop8: detected capacity change from 0 to 8 [ 1033.178812][T31284] MTD: Attempt to mount non-MTD device "/dev/loop8" [ 1033.190664][ T6009] udevd[6009]: incorrect cramfs checksum on /dev/loop8 [ 1033.209166][T31284] cramfs: Error -3 while decompressing! [ 1033.226068][T31284] cramfs: ffffffff9a119088(26)->ffff88806a3f4000(4096) [ 1033.251421][T31284] cramfs: Error -3 while decompressing! [ 1033.277433][T31284] cramfs: ffffffff9a1190a2(26)->ffff88808f97b000(4096) [ 1033.304737][T31284] cramfs: Error -3 while decompressing! [ 1033.317220][T31284] cramfs: ffffffff9a1190bc(16)->ffff88805128c000(4096) [ 1033.333024][T31284] cramfs: Error -3 while decompressing! [ 1033.349789][T31284] cramfs: ffffffff9a119088(26)->ffff88806a3f4000(4096) [ 1033.365879][ T29] audit: type=1800 audit(2000000138.542:212): pid=31284 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.10935" name="file2" dev="loop8" ino=348 res=0 errno=0 [ 1033.643644][T31304] loop9: detected capacity change from 0 to 512 [ 1033.726634][T31304] EXT4-fs: Ignoring removed orlov option [ 1033.792432][T31304] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1033.810536][T31311] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10947'. [ 1033.820643][T31312] netlink: 32 bytes leftover after parsing attributes in process `syz.8.10948'. [ 1033.887695][T31304] ext4 filesystem being mounted at /76/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1034.137020][T30003] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1034.263598][T31331] netlink: 'syz.8.10958': attribute type 1 has an invalid length. [ 1034.285275][T31331] netlink: 224 bytes leftover after parsing attributes in process `syz.8.10958'. [ 1034.735447][T31349] netdevsim netdevsim5: Direct firmware load for failed with error -2 [ 1034.781154][T31349] netdevsim netdevsim5: Falling back to sysfs fallback for: [ 1035.096833][T31371] netlink: 'syz.0.10977': attribute type 1 has an invalid length. [ 1035.105185][T31371] netlink: 228 bytes leftover after parsing attributes in process `syz.0.10977'. [ 1035.117986][T31370] netlink: 'syz.8.10976': attribute type 1 has an invalid length. [ 1035.893546][T31380] loop9: detected capacity change from 0 to 32768 [ 1035.929140][T31380] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop9 (7:9) scanned by syz.9.10981 (31380) [ 1036.003856][T31380] BTRFS info (device loop9): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1036.049278][T31380] BTRFS info (device loop9): using sha256 checksum algorithm [ 1036.068696][T31380] BTRFS warning (device loop9): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2 [ 1036.386106][T31380] BTRFS info (device loop9): rebuilding free space tree [ 1036.470595][T31380] BTRFS info (device loop9): disabling free space tree [ 1036.488566][T31380] BTRFS info (device loop9): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 1036.528917][T31380] BTRFS info (device loop9): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 1036.546059][T31435] binder: 31434:31435 ioctl c0046209 200000000000000 returned -22 [ 1036.562373][T26897] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1036.574843][T31380] BTRFS info (device loop9): enabling ssd optimizations [ 1036.592962][T31380] BTRFS info (device loop9): enabling disk space caching [ 1036.624122][T31380] BTRFS info (device loop9): force clearing of disk cache [ 1036.634949][T31380] BTRFS info (device loop9): enabling auto defrag [ 1036.658474][T31380] BTRFS info (device loop9): max_inline set to 0 [ 1036.746414][T26897] usb 6-1: Using ep0 maxpacket: 8 [ 1036.751756][T31441] netlink: 'syz.7.11004': attribute type 21 has an invalid length. [ 1036.791039][T26897] usb 6-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 1036.807363][T31441] netlink: 4 bytes leftover after parsing attributes in process `syz.7.11004'. [ 1036.831135][T26897] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1036.842070][T26897] usb 6-1: Product: syz [ 1036.870316][T26897] usb 6-1: Manufacturer: syz [ 1036.875089][T26897] usb 6-1: SerialNumber: syz [ 1036.903665][T26897] usb 6-1: config 0 descriptor?? [ 1036.924312][T26897] radio-usb-si4713 6-1:0.0: Si4713 development board discovered: (10C4:8244) [ 1036.993760][T31445] netlink: 104 bytes leftover after parsing attributes in process `syz.0.11006'. [ 1037.069389][T30003] BTRFS info (device loop9): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1037.385198][T26897] radio-usb-si4713 6-1:0.0: probe with driver radio-usb-si4713 failed with error -71 [ 1037.454660][T26897] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1037.463819][T31453] loop7: detected capacity change from 0 to 2048 [ 1037.477075][T26897] usb 6-1: USB disconnect, device number 10 [ 1037.560062][T31453] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1037.804927][T26860] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1038.226282][T31480] loop5: detected capacity change from 0 to 8 [ 1038.255665][T31480] MTD: Attempt to mount non-MTD device "/dev/loop5" [ 1038.282496][ T6009] udevd[6009]: incorrect cramfs checksum on /dev/loop5 [ 1038.318488][T31480] cramfs: Error -3 while decompressing! [ 1038.324118][T31480] cramfs: ffffffff9a11d088(26)->ffff88803d1f4000(4096) [ 1038.370458][ T6011] udevd[6011]: incorrect cramfs checksum on /dev/loop5 [ 1038.414051][T31480] cramfs: Error -3 while decompressing! [ 1038.419685][T31480] cramfs: ffffffff9a11d0a2(26)->ffff88803d2cd000(4096) [ 1038.436631][T31480] cramfs: Error -3 while decompressing! [ 1038.448413][T31480] cramfs: ffffffff9a11d0bc(16)->ffff88803cc36000(4096) [ 1038.470830][T31480] cramfs: Error -3 while decompressing! [ 1038.493994][T31480] cramfs: ffffffff9a11d088(26)->ffff88803d1f4000(4096) [ 1038.627351][T31488] loop9: detected capacity change from 0 to 2048 [ 1038.688529][T31488] NILFS (loop9): broken superblock, retrying with spare superblock (blocksize = 1024) [ 1038.874212][T31494] NILFS (loop9): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1039.287027][T31476] loop7: detected capacity change from 0 to 40427 [ 1039.334157][T31476] F2FS-fs (loop7): invalid crc value [ 1039.690418][T31476] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 1039.704976][T31522] netlink: 8 bytes leftover after parsing attributes in process `syz.9.11038'. [ 1039.725488][T31476] F2FS-fs (loop7): Start checkpoint disabled! [ 1039.739605][T31476] F2FS-fs (loop7): f2fs_disable_checkpoint() finish, err:0 [ 1039.759338][T31476] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 1040.062551][ T29] audit: type=1326 audit(2000000144.717:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.157151][ T29] audit: type=1326 audit(2000000144.744:214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.253640][ T29] audit: type=1326 audit(2000000144.744:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.284087][T31542] netlink: 288 bytes leftover after parsing attributes in process `syz.5.11049'. [ 1040.352253][ T29] audit: type=1326 audit(2000000144.744:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.440701][ T29] audit: type=1326 audit(2000000144.744:217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=229 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.531614][T31548] xt_SECMARK: invalid mode: 2 [ 1040.560107][ T29] audit: type=1326 audit(2000000144.744:218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.659869][ T29] audit: type=1326 audit(2000000144.744:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.777824][ T29] audit: type=1326 audit(2000000144.744:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.801321][ T29] audit: type=1326 audit(2000000144.744:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.844389][ T29] audit: type=1326 audit(2000000144.744:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31533 comm="syz.5.11045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f64ddf9acb9 code=0x7ffc0000 [ 1040.952184][T31561] netlink: 16 bytes leftover after parsing attributes in process `syz.9.11058'. [ 1041.029852][T31565] netlink: 72 bytes leftover after parsing attributes in process `syz.5.11061'. [ 1041.060464][T31565] netlink: 72 bytes leftover after parsing attributes in process `syz.5.11061'. [ 1041.094752][T31565] netlink: 72 bytes leftover after parsing attributes in process `syz.5.11061'. [ 1041.129227][T31565] netlink: 72 bytes leftover after parsing attributes in process `syz.5.11061'. [ 1041.151837][T31565] netlink: 72 bytes leftover after parsing attributes in process `syz.5.11061'. [ 1041.175281][T31565] netlink: 72 bytes leftover after parsing attributes in process `syz.5.11061'. [ 1041.195504][T31565] netlink: 72 bytes leftover after parsing attributes in process `syz.5.11061'. [ 1041.235641][T31573] overlayfs: workdir and upperdir must be separate subtrees [ 1041.282635][T31565] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1041.294936][T31565] 8021q: adding VLAN 0 to HW filter on device team0 [ 1041.318754][T31565] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1041.367989][ T6116] lo speed is unknown, defaulting to 1000 [ 1041.393620][ T6116] syz0: Port: 1 Link ACTIVE [ 1041.689269][T31590] xt_recent: hitcount (16777216) is larger than allowed maximum (65535) [ 1042.163917][T26897] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1042.185224][T31615] xt_l2tp: v2 doesn't support IP mode [ 1042.340275][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88803615a000 (14)(macsec0) start [ 1042.359799][T26897] usb 10-1: Using ep0 maxpacket: 16 [ 1042.372067][T26897] usb 10-1: config 0 has an invalid interface number: 105 but max is 0 [ 1042.390770][ T1129] infiniband: netdevice_event(NETDEV_UNREGISTER) ib_dev=ffff888088ac8000 (13)(syz2) rdma_ndev=ffff88805924c000 (19)(wg2) cookie=ffff88803615a000 (5)(macsec0) end [ 1042.395614][T26897] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1042.431186][T26897] usb 10-1: config 0 has no interface number 0 [ 1042.441534][T26897] usb 10-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28 [ 1042.477035][T26897] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1042.509786][T26897] usb 10-1: Product: syz [ 1042.514109][T26897] usb 10-1: Manufacturer: syz [ 1042.518817][T26897] usb 10-1: SerialNumber: syz [ 1042.577054][T26897] usb 10-1: config 0 descriptor?? [ 1042.587585][T26897] uvcvideo 10-1:0.105: probe with driver uvcvideo failed with error -22 [ 1042.849879][T25878] usb 10-1: USB disconnect, device number 2 [ 1043.054597][T31646] program syz.8.11099 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1043.166760][T31650] CIFS mount error: No usable UNC path provided in device string! [ 1043.166760][T31650] [ 1043.215529][T31650] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1043.266104][T31652] loop7: detected capacity change from 0 to 2048 [ 1043.337857][T31656] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1043.810206][T31668] sctp: [Deprecated]: syz.9.11109 (pid 31668) Use of int in max_burst socket option. [ 1043.810206][T31668] Use struct sctp_assoc_value instead [ 1043.941054][T31673] mac80211_hwsim hwsim26 wlan0: entered promiscuous mode [ 1043.970358][T31673] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1044.631949][T31660] loop8: detected capacity change from 0 to 32768 [ 1044.670427][T31660] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 1044.713011][T31660] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 1044.767869][T31660] gfs2: fsid=syz:syz.s: journal 0 mapped with 5 extents in 0ms [ 1044.872777][T12743] usb 8-1: new full-speed USB device number 9 using dummy_hcd [ 1044.892650][T31705] loop5: detected capacity change from 0 to 1024 [ 1044.908883][T31660] gfs2: fsid=syz:syz.s: first mount done, others may mount [ 1044.997463][T31705] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1045.072680][T12743] usb 8-1: config 0 has an invalid interface number: 52 but max is 0 [ 1045.082311][T31705] EXT4-fs error (device loop5): ext4_empty_dir:3084: inode #11: block 32: comm syz.5.11126: bad entry in directory: inode out of bounds - offset=0, inode=695563, rec_len=1024, size=1024 fake=1 [ 1045.109909][T12743] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1045.120809][T31705] EXT4-fs (loop5): Remounting filesystem read-only [ 1045.136669][T31705] EXT4-fs warning (device loop5): ext4_empty_dir:3087: inode #11: comm syz.5.11126: directory missing '.' [ 1045.152951][T12743] usb 8-1: config 0 has no interface number 0 [ 1045.175247][T12743] usb 8-1: config 0 interface 52 has no altsetting 0 [ 1045.198478][T12743] usb 8-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 1045.231809][T12743] usb 8-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 1045.272196][T12743] usb 8-1: Manufacturer: syz [ 1045.304396][T12743] usb 8-1: config 0 descriptor?? [ 1045.329356][T12743] hub 8-1:0.52: bad descriptor, ignoring hub [ 1045.335790][T12743] hub 8-1:0.52: probe with driver hub failed with error -5 [ 1045.355168][T25488] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1045.402206][T31719] futex_wake_op: syz.0.11132 tries to shift op by -3; fix this program [ 1045.814179][T31726] bond2: down delay (262144) is not a multiple of miimon (5), value rounded to 262140 ms [ 1045.834589][T31732] kAFS: unable to lookup cell '/,' [ 1045.890030][T12743] usb 8-1: USB disconnect, device number 9 [ 1046.292370][ T30] INFO: task syz.2.8854:26306 blocked for more than 143 seconds. [ 1046.318163][T31722] loop5: detected capacity change from 0 to 32768 [ 1046.324820][ T30] Tainted: G L syzkaller #0 [ 1046.331387][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1046.379006][T31722] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.11134 (31722) [ 1046.398867][ T30] task:syz.2.8854 state:D stack:28336 pid:26306 tgid:26305 ppid:6006 task_flags:0x400140 flags:0x00080002 [ 1046.424694][ T30] Call Trace: [ 1046.438858][ T30] [ 1046.448793][ T30] __schedule+0x153e/0x4fe0 [ 1046.459068][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 1046.480135][ T30] ? __pfx___schedule+0x10/0x10 [ 1046.485132][ T30] ? schedule+0x90/0x360 [ 1046.505480][ T30] schedule+0x164/0x360 [ 1046.540904][ T30] schedule_preempt_disabled+0x13/0x30 [ 1046.546663][ T30] __mutex_lock+0x7fe/0x1300 [ 1046.557031][T31722] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1046.561479][ T30] ? __mutex_lock+0x5ac/0x1300 [ 1046.589906][T31722] BTRFS info (device loop5): using sha256 checksum algorithm [ 1046.609072][ T30] ? nfsd_shutdown_threads+0x4e/0xd0 [ 1046.624251][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 1046.631864][ T30] ? net_generic+0x1e/0x240 [ 1046.636473][ T30] ? net_generic+0x1e/0x240 [ 1046.642001][ T30] nfsd_shutdown_threads+0x4e/0xd0 [ 1046.647295][ T30] nfsd_umount+0x41/0x60 [ 1046.659934][ T30] deactivate_locked_super+0xbc/0x130 [ 1046.665406][ T30] cleanup_mnt+0x437/0x4d0 [ 1046.680667][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 1046.689110][ T30] task_work_run+0x1d9/0x270 [ 1046.699709][ T30] ? __pfx_task_work_run+0x10/0x10 [ 1046.713090][ T30] exit_to_user_mode_loop+0xed/0x480 [ 1046.718565][ T30] ? rcu_is_watching+0x15/0xb0 [ 1046.726737][ T30] do_syscall_64+0x2b7/0xf80 [ 1046.731490][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1046.739057][ T30] ? trace_irq_disable+0x37/0x100 [ 1046.744245][ T30] ? clear_bhb_loop+0x40/0x90 [ 1046.751162][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1046.757291][ T30] RIP: 0033:0x7fa6d1d9acb9 [ 1046.762063][ T30] RSP: 002b:00007fa6d2d29028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1046.771225][ T30] RAX: ffffffffffffffec RBX: 00007fa6d2015fa0 RCX: 00007fa6d1d9acb9 [ 1046.779563][ T30] RDX: 0000200000000200 RSI: 00002000000001c0 RDI: 0000000000000000 [ 1046.787780][ T30] RBP: 00007fa6d1e08bf7 R08: 0000000000000000 R09: 0000000000000000 [ 1046.796082][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1046.804484][ T30] R13: 00007fa6d2016038 R14: 00007fa6d2015fa0 R15: 00007fffa30dd528 [ 1046.813230][ T30] [ 1046.816492][ T30] [ 1046.816492][ T30] Showing all locks held in the system: [ 1046.828011][ T30] 1 lock held by khungtaskd/30: [ 1046.833161][ T30] #0: ffffffff8e55dda0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1046.843665][T31741] loop8: detected capacity change from 0 to 32768 [ 1046.844753][ T30] 1 lock held by klogd/5189: [ 1046.855220][ T30] #0: ffff8880b873abe0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 [ 1046.865713][ T30] 2 locks held by getty/5586: [ 1046.866704][T31741] BTRFS: device fsid a6a605fc-d5f1-4e66-8595-3726e2b761d6 devid 1 transid 8 /dev/loop8 (7:8) scanned by syz.8.11141 (31741) [ 1046.870889][ T30] #0: ffff8880331930a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1046.894117][ T30] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 1046.914791][ T30] 2 locks held by syz.4.8819/26195: [ 1046.925165][T31722] BTRFS info (device loop5): enabling ssd optimizations [ 1046.934809][T31741] BTRFS info (device loop8): first mount of filesystem a6a605fc-d5f1-4e66-8595-3726e2b761d6 [ 1046.951501][ T30] #0: ffffffff8fa24970 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1046.966692][T31722] BTRFS info (device loop5): turning on async discard [ 1046.977073][ T30] #1: ffffffff8e87f6e8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x141/0x16c0 [ 1046.997389][T31741] BTRFS info (device loop8): using blake2b checksum algorithm [ 1047.008675][T31722] BTRFS info (device loop5): enabling free space tree [ 1047.017419][ T30] 2 locks held by syz.2.8854/26306: [ 1047.030803][ T30] #0: ffff888031abe0e0 (&type->s_umount_key#138){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 [ 1047.064105][ T30] #1: ffffffff8e87f6e8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x4e/0xd0 [ 1047.088382][ T30] 1 lock held by syz.5.11134/31722: [ 1047.100954][ T30] #0: ffffffff8e564038 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 1047.132025][ T30] 2 locks held by syz.8.11141/31741: [ 1047.143560][ T30] #0: ffff88803465a0e0 (&type->s_umount_key#74/1){+.+.}-{4:4}, at: alloc_super+0x28c/0xab0 [ 1047.192634][T31741] BTRFS info (device loop8): enabling ssd optimizations [ 1047.211438][ T30] #1: ffffffff8e55dda0 (rcu_read_lock){....}-{1:3}, at: btrfs_emit_options+0x6cf/0x4130 [ 1047.232632][T31741] BTRFS info (device loop8): turning on async discard [ 1047.240290][T31741] BTRFS info (device loop8): enabling free space tree [ 1047.247339][ T30] 1 lock held by udevadm/31775: [ 1047.257219][ T30] [ 1047.272205][ T30] ============================================= [ 1047.272205][ T30] [ 1047.320351][ T30] NMI backtrace for cpu 1 [ 1047.320375][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1047.320404][ T30] Tainted: [L]=SOFTLOCKUP [ 1047.320412][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1047.320426][ T30] Call Trace: [ 1047.320434][ T30] [ 1047.320444][ T30] dump_stack_lvl+0xe8/0x150 [ 1047.320479][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 1047.320504][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1047.320535][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1047.320562][ T30] sys_info+0x135/0x170 [ 1047.320581][ T30] watchdog+0xf90/0xfe0 [ 1047.320611][ T30] ? watchdog+0x209/0xfe0 [ 1047.320642][ T30] kthread+0x388/0x470 [ 1047.320665][ T30] ? __pfx_watchdog+0x10/0x10 [ 1047.320694][ T30] ? __pfx_kthread+0x10/0x10 [ 1047.320717][ T30] ret_from_fork+0x51b/0xa40 [ 1047.320748][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1047.320775][ T30] ? __switch_to+0xc7d/0x1400 [ 1047.320803][ T30] ? __pfx_kthread+0x10/0x10 [ 1047.320827][ T30] ret_from_fork_asm+0x1a/0x30 [ 1047.320878][ T30] [ 1047.321430][ T30] Sending NMI from CPU 1 to CPUs 0: [ 1047.438991][ C0] NMI backtrace for cpu 0 [ 1047.439012][ C0] CPU: 0 UID: 0 PID: 14955 Comm: kworker/u8:17 Tainted: G L syzkaller #0 PREEMPT(full) [ 1047.439036][ C0] Tainted: [L]=SOFTLOCKUP [ 1047.439044][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1047.439056][ C0] Workqueue: events_unbound toggle_allocation_gate [ 1047.439081][ C0] RIP: 0010:lockdep_hardirqs_on_prepare+0x110/0x260 [ 1047.439109][ C0] Code: 31 73 2d 41 8b 44 24 20 a9 00 00 04 00 74 db 25 00 00 03 00 83 f8 01 ba 03 00 00 00 83 da 00 48 89 df 4c 89 e6 e8 a0 62 00 00 <85> c0 75 bc eb 79 48 c7 c7 50 bf 42 8e 4c 89 fe e8 fb 85 35 03 eb [ 1047.439125][ C0] RSP: 0018:ffffc90000007d20 EFLAGS: 00000002 [ 1047.439139][ C0] RAX: 0000000000000001 RBX: ffff888030d9dac0 RCX: ffffffff939bc840 [ 1047.439152][ C0] RDX: 0000000000000002 RSI: ffff888030d9e678 RDI: ffff888030d9dac0 [ 1047.439165][ C0] RBP: ffffc90000007f30 R08: ffffffff8fefdcb7 R09: 1ffffffff1fdfb96 [ 1047.439178][ C0] R10: dffffc0000000000 R11: fffffbfff1fdfb97 R12: ffff888030d9e678 [ 1047.439191][ C0] R13: dffffc0000000000 R14: ffff888030d9e5d8 R15: 0000000000000004 [ 1047.439205][ C0] FS: 0000000000000000(0000) GS:ffff8881256f0000(0000) knlGS:0000000000000000 [ 1047.439219][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1047.439231][ C0] CR2: 00007f4d243212c0 CR3: 000000000e34a000 CR4: 00000000003526f0 [ 1047.439247][ C0] Call Trace: [ 1047.439254][ C0] [ 1047.439263][ C0] trace_hardirqs_on+0x28/0x40 [ 1047.439283][ C0] _raw_spin_unlock_irq+0x23/0x50 [ 1047.439305][ C0] tmigr_handle_remote+0x12c4/0x13a0 [ 1047.439324][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 1047.439347][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1047.439376][ C0] ? __pfx_tmigr_handle_remote+0x10/0x10 [ 1047.439392][ C0] ? clockevents_program_event+0x247/0x350 [ 1047.439420][ C0] ? sched_clock_cpu+0x74/0x440 [ 1047.439449][ C0] handle_softirqs+0x22a/0x7c0 [ 1047.439474][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 1047.439500][ C0] __irq_exit_rcu+0x5f/0x150 [ 1047.439523][ C0] irq_exit_rcu+0x9/0x30 [ 1047.439544][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1047.439567][ C0] [ 1047.439573][ C0] [ 1047.439581][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1047.439600][ C0] RIP: 0010:smp_call_function_many_cond+0xc91/0x1220 [ 1047.439622][ C0] Code: 45 8b 2c 24 44 89 ee 83 e6 01 31 ff e8 68 b7 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 13 b3 0b 00 eb 38 f3 90 <42> 0f b6 04 2b 84 c0 75 11 41 f7 04 24 01 00 00 00 74 1e e8 f7 b2 [ 1047.439637][ C0] RSP: 0018:ffffc9000db4f760 EFLAGS: 00000293 [ 1047.439651][ C0] RAX: ffffffff81b72099 RBX: 1ffff110170e80ed RCX: ffff888030d9dac0 [ 1047.439664][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 1047.439675][ C0] RBP: ffffc9000db4f8a0 R08: ffffffff8fefdcb7 R09: 1ffffffff1fdfb96 [ 1047.439689][ C0] R10: dffffc0000000000 R11: fffffbfff1fdfb97 R12: ffff8880b8740768 [ 1047.439702][ C0] R13: dffffc0000000000 R14: ffff8880b863bd80 R15: 0000000000000001 [ 1047.439718][ C0] ? smp_call_function_many_cond+0xca9/0x1220 [ 1047.439746][ C0] ? __pfx_do_sync_core+0x10/0x10 [ 1047.439768][ C0] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 1047.439790][ C0] ? kmem_cache_alloc_bulk_noprof+0xae/0x790 [ 1047.439807][ C0] ? __pfx___text_poke+0x10/0x10 [ 1047.439826][ C0] ? __pfx_do_sync_core+0x10/0x10 [ 1047.439843][ C0] on_each_cpu_cond_mask+0x3f/0x80 [ 1047.439865][ C0] smp_text_poke_batch_finish+0xb5f/0x1160 [ 1047.439889][ C0] ? __pfx_smp_text_poke_batch_finish+0x10/0x10 [ 1047.439910][ C0] ? arch_jump_label_transform_queue+0x97/0x110 [ 1047.439945][ C0] arch_jump_label_transform_apply+0x1c/0x30 [ 1047.439966][ C0] static_key_disable_cpuslocked+0xc5/0x1a0 [ 1047.439989][ C0] static_key_disable+0x1a/0x20 [ 1047.440008][ C0] toggle_allocation_gate+0x1fe/0x290 [ 1047.440026][ C0] ? __pfx_toggle_allocation_gate+0x10/0x10 [ 1047.440044][ C0] ? process_one_work+0x87c/0x15a0 [ 1047.440068][ C0] ? preempt_schedule_thunk+0x16/0x30 [ 1047.440088][ C0] ? process_one_work+0x87c/0x15a0 [ 1047.440110][ C0] ? process_one_work+0x87c/0x15a0 [ 1047.440132][ C0] process_one_work+0x949/0x15a0 [ 1047.440164][ C0] ? __pfx_process_one_work+0x10/0x10 [ 1047.440186][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 1047.440209][ C0] ? assign_work+0x3d5/0x5e0 [ 1047.440233][ C0] worker_thread+0x9af/0xee0 [ 1047.440268][ C0] kthread+0x388/0x470 [ 1047.440286][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1047.440308][ C0] ? __pfx_kthread+0x10/0x10 [ 1047.440326][ C0] ret_from_fork+0x51b/0xa40 [ 1047.440350][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1047.440371][ C0] ? __switch_to+0xc7d/0x1400 [ 1047.440392][ C0] ? __pfx_kthread+0x10/0x10 [ 1047.440410][ C0] ret_from_fork_asm+0x1a/0x30 [ 1047.440443][ C0] [ 1047.909929][T25488] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1047.919119][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 1047.919201][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1047.919279][ T30] Tainted: [L]=SOFTLOCKUP [ 1047.919309][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1047.919350][ T30] Call Trace: [ 1047.919374][ T30] [ 1047.919403][ T30] vpanic+0x1e0/0x670 [ 1047.919498][ T30] panic+0xc5/0xd0 [ 1047.919578][ T30] ? __pfx_panic+0x10/0x10 [ 1047.919663][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 1047.919748][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 1047.919832][ T30] watchdog+0xfda/0xfe0 [ 1047.919909][ T30] ? watchdog+0x209/0xfe0 [ 1047.919991][ T30] kthread+0x388/0x470 [ 1047.920055][ T30] ? __pfx_watchdog+0x10/0x10 [ 1047.920161][ T30] ? __pfx_kthread+0x10/0x10 [ 1047.920195][ T30] ret_from_fork+0x51b/0xa40 [ 1047.920226][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1047.920253][ T30] ? __switch_to+0xc7d/0x1400 [ 1047.920281][ T30] ? __pfx_kthread+0x10/0x10 [ 1047.920304][ T30] ret_from_fork_asm+0x1a/0x30 [ 1047.920352][ T30] [ 1047.920973][ T30] Kernel Offset: disabled