last executing test programs:

22.770724657s ago: executing program 5 (id=37):
socket$nl_route(0x10, 0x3, 0x0)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000c40)='comm\x00')
r1 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000100)={0x3, 0x980900})
r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
socket$inet6_udp(0xa, 0x2, 0x0)
wait4(r2, 0x0, 0x8, 0x0)
syz_pidfd_open(r2, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0)
r3 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r3, 0x4020565a, &(0x7f0000000280)={0x3, 0x980900, 0x2eae0342ca72d7e8})
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x32, &(0x7f0000000480), 0x111, 0x6}}, 0x20)
r4 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0)
ioctl$HIDIOCGUSAGES(r0, 0xd01c4813, 0x0)
ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r4, 0x40045402, &(0x7f0000000140)=0x1)
ioctl$VIDIOC_QUERYMENU(r3, 0xc008561c, &(0x7f0000000000)={0x980900, 0xfffffff2, @name="82bf06255c32514ef266824307509e39f5e892343710c37e48a72f12e53542fb"})
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
epoll_create1(0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, 0x0)
shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000)

21.366609332s ago: executing program 0 (id=38):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a2c000000200a05000000000000000000020000000900020073797a31000000000900010073797a30"], 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000)
ioctl$AUTOFS_IOC_EXPIRE(r0, 0x810c9365, &(0x7f00000000c0)={{0xfffff582, 0x1}, 0x100, '\xe9\x1fq\x89Y\x1e\x923aK\x00'})
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='uid_map\x00')
openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0)
r2 = socket(0x2, 0x80805, 0x0)
r3 = socket$inet_sctp(0x2, 0x5, 0x84)
setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e22, 0x3, 'lc\x00', 0x4, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44)
setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0)
r4 = socket(0x2, 0x80805, 0x0)
r5 = socket$inet_sctp(0x2, 0x5, 0x84)
setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x0, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x41}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @multicast2, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44)
r6 = socket$unix(0x1, 0x5, 0x0)
r7 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
ioctl$VIDIOC_CREATE_BUFS(r7, 0xc100565c, &(0x7f0000000040)={0x100401, 0x1003, 0x4, {0xa, @pix_mp={0x5, 0xffffffff, 0x56595559, 0x3, 0xa, [{}, {0xa, 0x20ae4}, {0x0, 0x4}, {0x4, 0x8}, {0x8fe, 0x8}, {0x5}, {0x4, 0x7a}, {0x1ff, 0x9}], 0x4, 0x8, 0x7, 0x2, 0x1}}, 0x9})
bind$unix(r6, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
listen(r6, 0x0)
r8 = socket$nl_sock_diag(0x10, 0x3, 0x4)
sendmsg$TCPDIAG_GETSOCK(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c00000014000101a4bd7000fddbdf2501"], 0x4c}, 0x1, 0x0, 0x0, 0x40480cc}, 0x40000)
write$vga_arbiter(r1, 0x0, 0x41)
unshare(0x6a040000)
syz_usb_connect$uac2(0x0, 0x8e, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000081e0400304000010203010902"], 0x0)
r9 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$EBT_SO_SET_COUNTERS(r9, 0x0, 0x81, &(0x7f0000000200)={'nat\x00', 0x0, 0x0, 0x0, [0xa2, 0xb, 0x4, 0xc, 0x4, 0x6], 0x1, 0x0, 0x0, [{}]}, 0x88)

19.293480767s ago: executing program 4 (id=44):
socket(0x11, 0x3, 0x0)
socket$key(0xf, 0x3, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
fsopen(0x0, 0x0)
syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0)
mq_notify(0xffffffffffffffff, 0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, "810000cc2b000000000000fa25ffff00ffffff"})
r2 = syz_open_pts(r1, 0x141601)
write(r2, &(0x7f0000000000)="d5", 0xfffffedf)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000100)=0x19)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$usbfs(0x0, 0x800000001fe, 0x82)

18.805931875s ago: executing program 5 (id=46):
socket$nl_route(0x10, 0x3, 0x0)
socket$inet6(0xa, 0x5, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x80)
mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
socket$netlink(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=<r2=>0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = dup(r3)
syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0x1, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0)

17.442852326s ago: executing program 3 (id=47):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$inet6(0xa, 0x80002, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c)
setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080), 0x4)
r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
fcntl$setstatus(r2, 0x4, 0x800)
ioctl(r2, 0x8934, &(0x7f00000002c0)="657468310000000000000000000000cf06000000c40ff3075b04dc727a8b9bc395a2e0f662de91f6b95cfbf004c8bcf76d2bba4f29276179f5ebe0d3a4f3f508a34cc0015792690151925b083904b755ffaf8415d5ef35b2493f5f97b125c30dd2e8148024e60cb8646ccf3e8366fd7469577f7ca0419d1e0dc47d7a3ebebe4a082cb14e418d3362f11cf5a9abaeb32c5c7ec13b30f73137654dcbcd47d417c366a317c4a41a13a00483208bd603042496419eb89e36febeae1a31dc8d9a717905c1b4a09e8689719b2f1332e09f336f2a4c49")
ioctl(r2, 0x8914, &(0x7f00000000c0)="6c61706230000000000000000000000001000000")
ioctl(r2, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0\x00\x00\x00\x00\x00\x00\x00')
r3 = socket$kcm(0x2, 0x200000000000001, 0x106)
sendmmsg(r3, &(0x7f000000ad40)=[{{0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000000040)="66bfdcf8156709246ddd266fa0f213eb5a3351", 0x13}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4020044)
bind$x25(r2, &(0x7f0000000080), 0x12)
connect$x25(r2, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r5 = openat$cgroup_procs(r4, &(0x7f0000000400)='cgroup.procs\x00', 0x2, 0x0)
write$cgroup_pid(r5, &(0x7f0000000c40), 0x12)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
syz_clone3(&(0x7f000000dd80)={0xa04400, 0x0, 0x0, 0x0, {0x12}, 0x0, 0x0, 0x0, 0x0}, 0x58)
r7 = openat$cgroup_procs(r6, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0)
write$cgroup_pid(r7, &(0x7f0000000240), 0x12)
pread64(r5, &(0x7f0000000340)=""/69, 0x45, 0x9)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x1c0}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094)
r8 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x2)
ioctl$FE_SET_FRONTEND(r8, 0x40246f4c, &(0x7f0000000440)={0xf4243, 0x2, @qpsk={0x7, 0x13}})

17.44075999s ago: executing program 2 (id=59):
close(0xffffffffffffffff)
r0 = socket$inet6(0xa, 0x80002, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x0, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x51}})
mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0)
socket$inet6(0xa, 0x800000000000002, 0x0)
munmap(&(0x7f0000001000/0x3000)=nil, 0x3000)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, 0x0, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14)
r4 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00')
read$midi(r4, &(0x7f00000001c0)=""/70, 0xffffffd8)

16.628459929s ago: executing program 2 (id=48):
bpf$PROG_BIND_MAP(0xa, &(0x7f00000005c0), 0xc)
r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
connect$llc(r0, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10)
sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0)
r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0xa1001)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}})
r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200002})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000040)={0x0, 0x0, {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8}, 0x76e0})
dup2(r2, r1)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r3 = socket$key(0xf, 0x3, 0x2)
setsockopt$sock_int(r3, 0x1, 0x4, &(0x7f00000001c0)=0x4, 0x4)
sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="020a000002"], 0x10}}, 0x0)
close(r3)
getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f0000000200)=""/170, &(0x7f0000000300)=0xaa)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x5)
r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0x511e36599023629, 0x100408, 0x1b35, 0x8, 0x2, 0x2002, 0x0, 0x0, 0x0, 0x1})
writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
syz_io_uring_setup(0xf00, &(0x7f0000000600)={0x0, 0xe188, 0x400, 0x0, 0x4e}, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)

16.419159812s ago: executing program 1 (id=49):
timer_create(0xfffffff9, 0x0, &(0x7f0000000040)=<r0=>0x0)
timer_settime(r0, 0x0, &(0x7f00000001c0)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r1=>0xffffffffffffffff})
gettid()
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0)
bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
capget(&(0x7f0000000040)={0x20071026, r2}, &(0x7f00000000c0)={0x9, 0x7, 0x8000, 0xa9c, 0x13, 0x101})
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
unshare(0x22020600)
r5 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0)
read$FUSE(0xffffffffffffffff, &(0x7f0000004000)={0x2020, 0x0, 0x0, <r6=>0x0, <r7=>0x0}, 0x2020)
r8 = socket$inet6(0xa, 0x2, 0x0)
sendmmsg$inet6(r8, &(0x7f00000065c0)=[{{&(0x7f0000000440)={0xa, 0x4e23, 0x0, @local, 0xfffffffc}, 0x1b, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="12000000000000001100000067"], 0x22}}], 0x1, 0x800)
close_range(r1, 0xffffffffffffffff, 0x0)
setitimer(0x1, &(0x7f0000001d80)={{0x77359400}, {0x0, 0x2710}}, 0x0)
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000100)='./file2\x00', 0x20005e, &(0x7f0000000480)={[{@abort}, {@errors_continue}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x40}}, {@errors_remount}, {@barrier_val={'barrier', 0x3d, 0x1000}}, {@resgid={'resgid', 0x3d, r7}}, {@nolazytime}, {@noquota}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x6}}, {@data_journal}, {@init_itable_val={'init_itable', 0x3d, 0x5}}], [{@appraise_type}, {@euid_lt={'euid<', r6}}]}, 0x1, 0x476, &(0x7f0000000700)="$eJzs3MtvVNUfAPDvvX3w4/XriPjgoVTRSDS2tKCycAFGExeamOgCl7UtBCnU0JoIIVpc4NKQuDcuTfwLXOnGqCsTt7o3JMSwAV1dc2fu7WM6MxmGgWmZzye59Jz7yDnfnntmzj2H2wD61mj+TxKxIyL+iIiRWnbtCaO1H7dvXp7+5+bl6SSy7N2/k+p5t25eni5PLa/bXmaWavl9DcpduHjp7NTc3OyFIj++eO6j8YWLl148c27q9Ozp2fOTx44dPTLxysuTLzWvfNJ+nHmdbu39dH7/njffv/b29MlrH/zyXVLGXxdHl4w22DdQJp7tcmG9tnNVOhksEgM9qgxty5sob66hav8fiYEYXD42Em983tPKAfdUlmXZlmYHk1jKgAdYEr2uAdAb5Vd9/vxbbvdt8LEB3DhRewDK475dbLUjg5EW5wzVPd92U/60dXLp36/zLe7NPAQAwBo/nKj9XD/+S+PRVecdL9aGKhHxUETsioiHI2J3RDwSUT33sYh4fOWSrJ3lmfpFkvXjn/R6h6G1JR//vVqsba0d/5Wjv6gMFLmd1fiHklNn5mYPR8T/I+JQDG3J8xMtyvjx9d+/bHZsNCIrx3/5lpdfjgWLeqT118xMLU51HvFaN65E7B1sFH+yvBKQt+OeiNh7oLMyzjz/7f5mx0ZXjX8bx9/CYGf1WS37JuK5WvsvRV38paT1+uT4/2Ju9vB4eVes9+tvV99pVv5dxd8Feftva3j/L8dfSVav1y5U9627J1u5+ucXDZ9phtqKP70+WDdBnd//w8l71fRwse+TqcXFCxMRw8lbxf7jK/snV64t8+X5efyHDjbu/7ti5TexLyLym/iJiHgyIg4UdX8qIp6OiIMt4v/5tWc+bHZsI7T/zB21/50nBs7+9P2aQist4k+iQfsfraYOFXva+fxrXp2VOY88rE5/bwAAALCZpBGxI5J0bDmdpmNjtf8vvzu2pXPzC4svnJr/+PxM7R2BSgyl5UzXyKr50IlixqDMTxaP+WX+SDFv/NXA1mp+bHp+bqbXwUOf296k/+f+8v4GPPi6sI4GbFKd9v8syz7rclWA+8z3P/Qv/R/6V4P+v7Uu3/RvBACbW6Pvfw/20B+M/6F/6f/Qv/R/6F/6P/Slu3mvv0hcafGyfXuJ/PPnrqtxHxNZ1qPSh3sf+3Ii0g1RjXuViMpGqEald6X3+pMJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgO/4LAAD//wYf47Q=")

16.418903044s ago: executing program 4 (id=50):
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10043, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
sched_setattr(0x0, 0x0, 0x0)
syz_ublk_setup_io_uring(0x471, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x1, 0x158}, &(0x7f0000000780), &(0x7f0000000280), 0x0)
syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000080)=<r2=>0x0, &(0x7f0000000180)=<r3=>0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4040080)
r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
bind$nfc_llcp(r4, &(0x7f00000001c0)={0x27, 0x0, 0x0, 0x2, 0x0, 0x49, "c46e9fd1a84b7fa0bf2cca6beb9363a680b652a86bcf56a1b9ca5386103a5ccbe47b7b9aa6d8d701a3ba00000000b97800001022f987617c318500", 0x3a}, 0x60)
sendmmsg(r4, 0x0, 0x0, 0x4008000)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000240)={0x0, @multicast1, @private}, &(0x7f0000000340)=0xc)
ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000400)={0x3, 0xffffffffffffffff, 0x2})
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000540)={'wlan0\x00'})
sendmsg$NL80211_CMD_NEW_KEY(r5, 0x0, 0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000000)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x4d2c11947fe9151f})
capset(&(0x7f0000000000)={0x19980330}, 0x0)

16.140396692s ago: executing program 0 (id=51):
syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
sendmsg$key(0xffffffffffffffff, 0x0, 0x0)
getpid()
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000d00)='/sys/power/mem_sleep', 0x122102, 0x0)
times(0xfffffffffffffffe)
syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301)
ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000040)={0x2, 0x8, 0xd780, 0xa1, 0x0, 0x6, 0x0})
sendmsg$nl_route(r1, 0x0, 0x4054)
setns(0xc9, 0x0)
r3 = socket$rds(0x15, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000200), 0x4)
bind$rds(r3, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10)
r4 = socket$rds(0x15, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000240), 0x4)
bind$rds(r4, &(0x7f0000000440)={0x2, 0x4e22, @loopback}, 0x10)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
io_uring_setup(0x5ba8, &(0x7f0000000000)={0x0, 0xfca0, 0x10, 0x1, 0x4})
exit(0x1ff)

16.138345822s ago: executing program 5 (id=52):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c)
gettimeofday(0x0, 0x0)
r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'macvlan0\x00', <r5=>0x0})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x4c, 0x10, 0x503, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x220, 0x4000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x10, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x1}}]}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x4c}}, 0x20000090)
pselect6(0x40, &(0x7f0000000680)={0x8, 0x7, 0x0, 0xfffffffffffffff9, 0x916, 0xae3, 0x7, 0x8}, 0x0, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a, 0x3}, 0x9c)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
ptrace$getregset(0x4204, 0x0, 0x6, &(0x7f0000000480)={&(0x7f00000008c0)=""/203, 0x118})
shutdown(r3, 0x2)

14.54148052s ago: executing program 3 (id=53):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @empty, 0x4}, 0x1c)
listen(r0, 0x5)
setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1ff, 0xf806, 0x5, 0x0, 0x1}, 0x14)
socket(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x2)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
getsockopt$sock_buf(r1, 0x1, 0x3d, &(0x7f0000000300)=""/77, &(0x7f0000000380)=0x4d)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
fadvise64(0xffffffffffffffff, 0x88, 0x0, 0x3)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000a80)=@bpf_ext={0x1c, 0x3, 0x0, &(0x7f00000000c0)='GPL\x00', 0x6, 0x18, &(0x7f0000000400)=""/24, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000900)={0xa, 0x1}, 0x8, 0x10, 0x0, 0x0, 0xe8b5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94)
socket$inet6_icmp(0xa, 0x2, 0x3a)
syz_open_dev$loop(0x0, 0x7, 0x10c062)
fstat(0xffffffffffffffff, 0x0)
r5 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x7f000001}}, 0x1c)

13.363584503s ago: executing program 1 (id=54):
prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
syz_mount_image$ocfs2(&(0x7f00000026c0), &(0x7f0000004780)='./file0\x00', 0x2010080, &(0x7f0000000340)=ANY=[@ANYBLOB="6a6f75726e616c5f6173796e635f636f6d6d69742c636f686572656e63793d66756c6c2c6572726f72733d636f6e74696e75652c6865617274626561743d6e6f6e652c6572726f72733d636f6e74696e75652c6e6f696e74722c67727071756f74612c001796fa694353e3807803df5ea6fd4d6e6a2613d336eb62b863dcd89e37b45f8bd04199a14c48b3e553e035ab300ba3c60c27682a8ab5656969d829535c0862f6e3a35f15fe4d50c0d5c74631344625d6224c436474bb101ff47a14c51e342ca291c09c35d9d31b06b6b86cb9dccae387b5f1e7c5e1d445d52845a3fa4c77234ea9d37c8a277c85e69a85cc6ffeb225bebbca91b569b80ee303c9a21c58db5d96fb87f1713e0e9b896e37becae2e7a978259a0847e9fb08dcb8b9f84f616463da2507db1b3489769e99"], 0x1, 0x4703, &(0x7f000000c7c0)="$eJzs212IXFcBB/BzZ1ezmybb/UibpOnHJBFctCybPlXrQ1yrNpo2H9pWU2Wd3Ww3q7M76+6MFgxSgyAKghIEFT+oCqUvtSAG+lKLUPADaRVKRdH6IlKogg8GbaArM3Nvdu6d2d7JTtLS9veDdvaee8+5Z/a/99w590wKseqphdXiwmqxtFSszN6/ekvxc5VybXEuFF4lr/X56c6VyEn2r50j7/vAR+65JYQ/HPvah9bW1tZC3XDo6EDLz+f/fXq29TVRyNSpt9u5taY/1h556edveaUj8pwIIexo61ddXwjhY78IYUsIYSQuG41fB0MI20IIUQjh0d/868cDvXShxdl7X3ju2JnD+85MPf7YMxfmj254YBTCd8u7b55ffHF/323Pv+MynR4AAF7RB48fufvo5IHwZBSGzvW3f17fGb8mn4/vfNun7nq4f33/Gt3pexVDBQAAgIz1+f9w9HKH9bpkZS1ZEnzigRN3PxWt7zexfX07dNeR298/eSBe/43a9t8aF/3zvX2NNdTsum92/XckU7/z+u/6eR7+6rO/XHrr5vuf9C8573CIChOp7UJhYiKEY1PN7V3R1kK5slp95/2V2tLJzZ/3jSKdf3b1fn1Bv9v8RzPV89b/d3/i8z8b7O/lHYyF7F9tfbvY/qdMB+n8Nx7Lf/KlqKv8xzL18vK/4+nt53+1pZd3kD0jlyKdf/NC3Nd6QLE5ANTz/2Z/fv47Mu3n5f/9qXOPntjE93/q48xwVO/rQGoEeDku3+ArTGSk828GkRo641/kRtf//zL5X5NpPy//Oyv/+N3ferj/bzT+j0/10uabRzr/ZhDF1BHr1/9IIf/6vzbTfl7+vz3152c/2dO9uj3/ev/H3f+7ks4/vhGnB8/Gb7Lb8X9npv28/HeN3ffQwib6/eHBuJ9DURhr+dbpufotbGh9vboxpanvXt7ESd4E0vk3f2upS2eo+dK4/ofzx/9dmfbz8n9oz9ffc7qn7/92Hv8njf9dSec/2Ci7lPxfyuS/O9N+Xv4/PP33v9x3mcf/+vZB+Xclnf/Wtv3rz38KXc3/rsvUz3v+s2/0qUf+2sP8P+lfct7k+U/yHGI8aj7/obN0/ldteFy39/89mXp51/+3/vP80/t7Gf+jAU8AepDOf1uzsMMEsNv8r8+0n5f/F+758sf/tIn5X+MT30CSf8v8f0uz/Kjxvyvp/Lc3C1P/GOrBxv8b9/+oPff/ZvK/IdN+Xv4XDk30f+Uy3//r/R/v8Cibdun8hzY8rp7/77u4/9+YqZeX/xf3/vTFm3v6/B/CpLn+pqXzv3rD4xrX/0B+/jdl6uXl/51v/PqJB3vo/9t7qEs2/+a9PnU5xZ/Nu53/FzPt5+X/o/HzZ/dfgfnfre7/XUnn31w1v5T8s/P/vZn28/L/3pEfrPRfgec/d8gfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgU0bj1+EQFSZS24XCxEQIY/H2rrA1mimdnJ4pV2Y/sxrCjri8GEaj+XJlplSeXliqnJybLpXLldkQron37wgD0Wq5Up1eLC1fe7GtwejUXGmlOjNXqoYQdsbl14ftSVszC9XF0nLj2KTOVVHps7VKtTRRW51bCbsvlm9LyudXKrXl6y62dXWhsrJ8qrQ0fXJh5d2Tk5OTYc/FPo9Ecw9U55aqzd4299brJHWHo5Y309h9Q8v5Pl2prSyVyo3yG1vqlCuzpXJLnZtazlddqS3Nlqpz0+XKfHK+YkvdlvfW2L033jceRlLvL6mbdTB+vf3Q8Y8eP3ygbX8xSue9VFucm9ze+W8CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDeuJ29717dDCH3NrUII4WDyQxT/l3L23heeO3bm8L4zU48/9syF+aOdjgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVh535equjiOACfGd/7WiCltBFyGRgiojsJC/pFJJXXyJZtWge1SsigKDCMaFkQBEHtooKgVVD5F0QtXLaqNrVoYRBBxehMXu4IN7zQMed5YDgzzL1nvjBw78z5HA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD6cXbHYlfWXtq1eWnr7g+hMz/3fwhhNFne/7y3I/SEEL5+mTkdVmkLPU39v5mcGy9fNfm9t3/84fXRZO31F98trtsdknSo4XhnkqZDQ2vvf6O6M/hsejAJIY1dCFEsjD05UwshdMQuhCh+fpy/mP2+/xe7EKLo/3C3K7v/tdiFEMXW3Z/6avkzHtVzvn5hsPG/v9UjeBuP6KxDb09eeZe6qZX3Mn//T/LN+2A1zJ448v557CKIZnZu6mjsGgAAgL/rXIv8P2xZ3r9/OQk93eXc/1tT/t/b1P/q+f+Ke9tvjM20FUJsK41NZsfD+9rpc+M7NXD19uua8Z6qkv9Xm/y/2uT/1Sb/rzb5f7XJ/8m8kv9X0uObexZfxC6CaOT/AABQPYeOT0zVh0eyl/9NPzrLeX1f3tbzPP3BremBRw3jRvLDf9vhYxMHDg6P5Pe9PCC4sv5DunT2ez7fo7ktTDbNu2i1/kPv04X5a53lT9T/cP5GUV9xXes/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC/2J17GgbBKAyj321F1EarogkLPwk+0MCIAKQwowEdTBiAgRBQwEDOWe5NnuUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnu9f5XXx/aUx0muNSFPZZdf+OZ5mP3PfDsv77HHjVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjYgQMZAAAAAGH+1nm0HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKcCAAD//wTsyzo=")
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
mkdirat(0xffffffffffffff9c, 0x0, 0x51)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
creat(0x0, 0x6a)
r1 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0)
landlock_restrict_self(r1, 0x4)
truncate(&(0x7f0000000240)='./file0\x00', 0x1)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r2 = geteuid()
syz_mount_image$vfat(&(0x7f0000000480), &(0x7f00000004c0)='./file1\x00', 0x2000884, &(0x7f0000000700)={[{@shortname_winnt}, {@shortname_mixed}, {@shortname_lower}, {@iocharset={'iocharset', 0x3d, 'cp852'}}, {@shortname_winnt}, {@shortname_winnt}, {@shortname_winnt}, {@utf8}, {@nonumtail}, {@fat=@sys_immutable}, {}, {@shortname_lower}, {@iocharset={'iocharset', 0x3d, 'macgreek'}}, {@utf8}, {@numtail}, {@utf8no}], [{@smackfsdef}, {@uid_gt={'uid>', r2}}, {@smackfstransmute={'smackfstransmute', 0x3d, '@+B\''}}, {@euid_gt={'euid>', r2}}, {@fsname={'fsname', 0x3d, 'nonumtail=0'}}, {@euid_gt}, {@permit_directio}, {@appraise}, {@rootcontext={'rootcontext', 0x3d, 'root'}}, {@subj_type={'subj_type', 0x3d, 'shortname=lower'}}]}, 0x1, 0x289, &(0x7f0000000cc0)="$eJzs3c1qA1UUAOAzzaRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE7hx6/O4EV/AB1Dc2YU4ks7kTyctkbQp+n2bHs69J/fM3KHtZm4+eWVwfnpxdXbz5c/RbCaxdRAHcZtEJ7Zi4uuo9NOv1XkA4Jm7zfP4LS80itT14oz6ksp069GbAwAexfzf/033AgA8jfc/+PCdw+Pjo/eyrBkx+GbYTaL4WYwfnsVn0Y9e7EU7/ojIp4r4rbePjyLNxjrx2mA07I4rBx//UH7+4S8Rd/X70Y5Odf1+VpirHw279XihXP+gH713v492vFRd/8as/jYv66O7Ha+/Otf/brTjx0/jIvpxGsX/OpP6r/az7M3829+/+GicHdcno2G3EacLdyqvPfXeAAAAAAAAAAAAAAAAAAAAAADw37WbTXUWz9+ZHPx/z/g95wON5s7n2cuyLE+K+bP6NF5OI93ktQMAAAAAAAAAAAAAAAAAAMBzcXX9+flJv9+7XGswea2/Yij+XMw0ImLJ56QPr7WzaodRK1vrJxGrXVc9GneVD0+urXjHWuN+epdJGuvbgmSaac0P7USx1jjTKoK5zGpLfPfPjWvGXTB5us5PkmWbOwmaVQ/JGoK84vGrLa3a/numVV5BxeTWPatvv/ives7bS4aSiKhPb2Y51KqeXF/vPXy630EAAAAAAAAAAAAAAAAAAEBh9tJvxeDNBhoCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgA2Yff//CsGoLF42J6+NgzTKzIYvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BvwIAAP//XAxp4w==")
getdents(0xffffffffffffffff, 0x0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x24040084)

13.318349473s ago: executing program 5 (id=55):
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
syz_open_procfs(0x0, 0x0)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x101, 0x0)
writev(r1, &(0x7f0000000540), 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv6/conf/all/forwarding\x00', 0x1, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x1)
r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/net/ipv6/conf/default/forwarding\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='1\x00', 0x1)
syz_emit_ethernet(0x50, &(0x7f0000000880)={@link_local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "01044a", 0x1a, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @remote, [{0x2}]}}}}}}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0)
r4 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
r5 = syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0xb4)
write$cgroup_pid(0xffffffffffffffff, &(0x7f00000005c0)=r5, 0x12)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080), 0xc)

13.307729717s ago: executing program 0 (id=56):
r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
setrlimit(0x0, 0x0)
mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x80, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, 0x0, 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5)
bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200200, @loopback, 0xffffffff}, 0x1c)
sendto$inet6(r4, 0x0, 0x0, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0x8, @loopback, 0xa8e}, 0x1c)
mount$tmpfs(0x0, &(0x7f0000000400)='./sys\x00', 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="b639"])
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="acbdddbce2b5d668ea5e68f23b8b814fd4eb1f146da844cb8b3298b90eb2f20be469d3a87ec3623e4e3ee06af93706b95a08a63eaadc0b11ca23456a5fff780c7a732149953a97403b25f7c689e209f15de00ca67112631f4a57d62f8cdad38b53180b0c", @ANYRESHEX=r0, @ANYRESOCT=r3], 0x48)
ioprio_set$uid(0x3, 0x0, 0x6000)
socket$inet6_sctp(0xa, 0x1, 0x84)
mount(0x0, &(0x7f00000001c0)='./sys\x00', 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./configfs\x00', &(0x7f0000000140)='configfs\x00', 0x1000000, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./configfs/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./configfs/usb_gadget/g1/functions/uvc.0/control/extensions/ext0\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./configfs/usb_gadget/g1/functions/uvc.0/control/extensions/ext0/bmControls\x00', 0x1, 0x0)
write$FUSE_INIT(r5, &(0x7f0000000440)={0x50, 0x0, 0x0, {0x7, 0x29, 0xfffffffd, 0x0, 0x0, 0x2, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x1}}, 0x50)

13.304938652s ago: executing program 4 (id=57):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c)
gettimeofday(0x0, 0x0)
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macvlan0\x00', <r3=>0x0})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x4c, 0x10, 0x503, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x220, 0x4000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x10, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x1}}]}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x4c}}, 0x20000090)
pselect6(0x40, &(0x7f0000000680)={0x8, 0x7, 0x0, 0xfffffffffffffff9, 0x916, 0xae3, 0x7, 0x8}, 0x0, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a, 0x3}, 0x9c)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
ptrace$getregset(0x4204, 0x0, 0x6, &(0x7f0000000480)={&(0x7f00000008c0)=""/203, 0x118})
shutdown(r1, 0x2)

12.281923404s ago: executing program 3 (id=58):
timer_create(0xfffffff9, 0x0, &(0x7f0000000040)=<r0=>0x0)
timer_settime(r0, 0x0, &(0x7f00000001c0)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r1=>0xffffffffffffffff})
r2 = gettid()
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0)
bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
r3 = getpid()
sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
unshare(0x22020600)
fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
read$FUSE(0xffffffffffffffff, &(0x7f0000004000)={0x2020, 0x0, 0x0, <r6=>0x0, <r7=>0x0}, 0x2020)
socket$inet6(0xa, 0x2, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
setitimer(0x1, 0x0, 0x0)
prlimit64(r2, 0x0, &(0x7f0000000080)={0x1ff, 0x2}, 0x0)
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000100)='./file2\x00', 0x20005e, &(0x7f0000000480)={[{@abort}, {@errors_continue}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x40}}, {@errors_remount}, {@barrier_val={'barrier', 0x3d, 0x1000}}, {@resgid={'resgid', 0x3d, r7}}, {@nolazytime}, {@noquota}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x6}}, {@data_journal}, {@init_itable_val={'init_itable', 0x3d, 0x5}}], [{@appraise_type}, {@euid_lt={'euid<', r6}}]}, 0x1, 0x476, &(0x7f0000000700)="$eJzs3MtvVNUfAPDvvX3w4/XriPjgoVTRSDS2tKCycAFGExeamOgCl7UtBCnU0JoIIVpc4NKQuDcuTfwLXOnGqCsTt7o3JMSwAV1dc2fu7WM6MxmGgWmZzye59Jz7yDnfnntmzj2H2wD61mj+TxKxIyL+iIiRWnbtCaO1H7dvXp7+5+bl6SSy7N2/k+p5t25eni5PLa/bXmaWavl9DcpduHjp7NTc3OyFIj++eO6j8YWLl148c27q9Ozp2fOTx44dPTLxysuTLzWvfNJ+nHmdbu39dH7/njffv/b29MlrH/zyXVLGXxdHl4w22DdQJp7tcmG9tnNVOhksEgM9qgxty5sob66hav8fiYEYXD42Em983tPKAfdUlmXZlmYHk1jKgAdYEr2uAdAb5Vd9/vxbbvdt8LEB3DhRewDK475dbLUjg5EW5wzVPd92U/60dXLp36/zLe7NPAQAwBo/nKj9XD/+S+PRVecdL9aGKhHxUETsioiHI2J3RDwSUT33sYh4fOWSrJ3lmfpFkvXjn/R6h6G1JR//vVqsba0d/5Wjv6gMFLmd1fiHklNn5mYPR8T/I+JQDG3J8xMtyvjx9d+/bHZsNCIrx3/5lpdfjgWLeqT118xMLU51HvFaN65E7B1sFH+yvBKQt+OeiNh7oLMyzjz/7f5mx0ZXjX8bx9/CYGf1WS37JuK5WvsvRV38paT1+uT4/2Ju9vB4eVes9+tvV99pVv5dxd8Feftva3j/L8dfSVav1y5U9627J1u5+ucXDZ9phtqKP70+WDdBnd//w8l71fRwse+TqcXFCxMRw8lbxf7jK/snV64t8+X5efyHDjbu/7ti5TexLyLym/iJiHgyIg4UdX8qIp6OiIMt4v/5tWc+bHZsI7T/zB21/50nBs7+9P2aQist4k+iQfsfraYOFXva+fxrXp2VOY88rE5/bwAAALCZpBGxI5J0bDmdpmNjtf8vvzu2pXPzC4svnJr/+PxM7R2BSgyl5UzXyKr50IlixqDMTxaP+WX+SDFv/NXA1mp+bHp+bqbXwUOf296k/+f+8v4GPPi6sI4GbFKd9v8syz7rclWA+8z3P/Qv/R/6V4P+v7Uu3/RvBACbW6Pvfw/20B+M/6F/6f/Qv/R/6F/6P/Slu3mvv0hcafGyfXuJ/PPnrqtxHxNZ1qPSh3sf+3Ii0g1RjXuViMpGqEald6X3+pMJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgO/4LAAD//wYf47Q=")

10.339877037s ago: executing program 0 (id=60):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0x100000001, 0x4)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @dev={0xfe, 0x80, '\x00', 0x11}, 0x1}, 0x1c)
socket$nl_route(0x10, 0x3, 0x0)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0)
bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f0000000300)={0x0, &(0x7f0000000380)}, 0x10)
syz_emit_ethernet(0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
socket$inet6(0xa, 0x3, 0x7)
openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, <r4=>0x0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000dc0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20, 0x0, 0x0, {0x1}}}, 0x58}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000080)={0x48, 0x2, r4, 0x0, <r6=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r4, 0x0, &(0x7f0000003000/0x1000)=nil, 0x1000, 0x7ffffffe})
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1})
socket$inet6_sctp(0xa, 0x5, 0x84)
ioctl$IOMMU_DESTROY$stdev(r3, 0x3b80, &(0x7f0000000180)={0x8, r6})

8.900028563s ago: executing program 2 (id=61):
close(0xffffffffffffffff)
r0 = socket$inet6(0xa, 0x80002, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x51}})
mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0)
socket$inet6(0xa, 0x800000000000002, 0x0)
munmap(&(0x7f0000001000/0x3000)=nil, 0x3000)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, 0x0, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00')
read$midi(r2, &(0x7f00000001c0)=""/70, 0xffffffd8)

7.721215868s ago: executing program 1 (id=62):
socket$inet6_sctp(0xa, 0x1, 0x84)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
socket$inet6_sctp(0xa, 0x5, 0x84)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$tipc(0x1e, 0x5, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000100)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0xc)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f00000007c0)=[@in6={0xa, 0x4e20, 0x0, @loopback, 0x4b26e94}], 0x1c)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0)
setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000080)=0x6, 0x4)
setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42}, 0x10)
setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88)
sendmsg$tipc(r0, &(0x7f0000000c80)={&(0x7f0000000980)=@id, 0x10, 0x0}, 0x0)
r4 = socket$inet(0x2, 0x3, 0x1)
setsockopt$sock_int(r4, 0x1, 0x5, &(0x7f0000000340)=0x6, 0x4)
sendmsg$inet(r4, &(0x7f0000001040)={&(0x7f0000000000)={0x2, 0x4e20, @empty=0xe0000000}, 0x10, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000940b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0x20000004)

7.587615976s ago: executing program 4 (id=63):
socket$can_j1939(0x1d, 0x2, 0x7)
fsopen(&(0x7f0000000200)='9p\x00', 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0)
r4 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000080)="13", 0x1, 0xfffffffffffffffd)
keyctl$read(0xb, r4, &(0x7f0000000240)=""/112, 0x349b7f55)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={0x0, 0xf4}}, 0x4080)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00'})
r6 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000040)={0x4, 0x0, 0x0, 0xb, 0x4})
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c)
sendto$inet6(r0, &(0x7f0000000180)="9a", 0x1, 0x800, &(0x7f00000002c0)={0xa, 0x4e23, 0x20000000, @loopback}, 0x1c)
ioctl$BTRFS_IOC_BALANCE_CTL(r0, 0x40049421, 0x1)
unshare(0x22020600)
capset(&(0x7f0000000040)={0x19980330}, 0x0)
socket$netlink(0x10, 0x3, 0x0)

7.334252517s ago: executing program 3 (id=64):
mkdirat(0xffffffffffffff9c, &(0x7f0000000050)='./sys\x00', 0x1ed)
mount(0x0, 0x0, &(0x7f0000000070)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='usbip-vud', 0x9)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed)
mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0)
write(r2, &(0x7f0000000b00)='0x01', 0x4)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed)
mkdirat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ed)
symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ed)
mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ed)
symlinkat(&(0x7f0000001900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd\x00', 0x4f)
mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000400)='nfsd\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd/portlist\x00', 0x1, 0x0)
write(r3, 0x0, 0x0)
symlinkat(&(0x7f0000001b00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000001d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed)
symlinkat(&(0x7f0000001e00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001f00)='./config/usb_gadget/g1/configs/c.1/uvc.usb0\x00')
openat(0xffffffffffffff9c, &(0x7f0000002000)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r3, &(0x7f0000000300)="18a2b93d1236e859bd1a228a1359541e517cc234f93c8aa9de54f947e3d652d1bd77938d4195cd1aa34f9bfbf6db08a8ff78b655f963236efa2bcd9f308708fdf78ef16da397480edab18b34984983c7eb8a72c933a9a6b5b9508ab16b0c953873a323ce0f3ca1877634669432e48216732120d0e3c783ff894cc3711d08a83a72c400283b8e9f79d0c45901c77a762e33fe67a22331a504d655b14c505e0e652dbb7d677815ac68fe5e27331c765a2dd823b98c1d35dcd93e210759ae2bbd29b72ae004dd56708828c0a5332dd4f59c36d73f1caaaf641fb81cb0f168f059fcdf", 0xe1)

6.535164141s ago: executing program 2 (id=65):
r0 = socket(0x2, 0x80805, 0x0)
poll(&(0x7f0000000380)=[{r0, 0x112b}], 0x1, 0xfa2)
ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, 0x0)
r1 = syz_open_dev$dri(0x0, 0x1, 0x60a40)
ioctl$VIDIOC_ENUMOUTPUT(0xffffffffffffffff, 0xc0485630, 0x0)
r2 = openat$6lowpan_control(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000080)={0x0, 0x80000, <r3=>r2})
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r5, &(0x7f000000b1c0)={0x2020, 0x0, <r6=>0x0, <r7=>0x0, <r8=>0x0}, 0x2020)
syz_fuse_handle_req(r5, &(0x7f00000042c0)="9ab1446569aa24b774753c9e994c09c24df9d42fa5a228e469b44cecf6f9f5ce5f77c93b1895aaac9cf34b37415f11fe22d6fa0162aa743b242e8fe0a8659e32fb543d7969d6513136a9f332a8074f8ee1e445277ddd5859eb5ac3321eb710be880a441031da9b31f791d54fb3c97cd8ee92b00cbf962be8eb5fd0b7cab207645f59cf87a8c41e2739dd8386b6bb84b627cbf5e09bac876ad4b215f0e510a853c5e8b9f7822b26771d72972290a1f9a6f0a46942be0d0eb7aa5145ff368863b14e9845926088f9f92d554e572926290dc6e6b574aea8c500fbe5697f881c0cec48282c6d07619248da0c3b9aa6f7c778525d1760051e4ba8ef31d3c8d3e1d4214ffa5261ce1fdbc12eba889968137f5c06fea233000296cf18df494b4e7b1bee7dc2f3751c37415d46f6d7ffb3d0f788f2100ee41266e6fba75b61af22e1d7b286507ff100cc34ed28d5a2c8be3231446874bbbde6f3c367ca802d64192ffcce1ea41b2cbc57f7500fc4f8f12fe02690c1c9785bbc35542b59d05600783cf4f4633b374101d8ed395303392b238d198f9f68c8ae928cbf3b558deec6d38ebaa526e749ac4e47dd5b838ec34f2820a1134252ae60159d4e030cf5e5d6f8de799a31e12ae57cfe5a1a3ded525c6e71271271d35a0056265362387a361f21ea0f4b6d46f6a83a8512687e43b31e11b1396d6e9e49cf42b693732e226b55d21a1203022f6be9f8ecccb68de3bf4ce99689514bd752f4e60bd2f8e376d7fae5b5fc8db0f53db8c52746671e361b9319419c1b3f3168b4797ebd2d118ee42dda4bc59dd0251236195c8cdafc0546354eeb28f4c7e71e8245a6ccaddfb858f61039c0ccf5acd924680aab38dd061fc7b123f24ac7f3d3c0cee43b61045bb1efea25af86088a0591f166e2f11ea4089860893b17ca5e3d99ec75131268e2e4e290c2bf15e4dde23284e4bdf6e549c096ce221d9c8a6c0fc78aa6a1c8b547c0e10738de2a1e8663e03ab0ce4594e244989f75b6672de1eee97ba7e6467a0da51c0e75d5866c405b03c4744d8d3fbb01eddba5a0361662269154c2f0e61a9433982eb904ff562896cbfa692eb1e6c644fcf6cbc103a76b712af706a47608d3e2f5d54d47d8e9906ab37ddf04004d32ce00200fc3c274666aeb618b27424d87b6a4b0262de4436b9e6f150bc798394c298b25a2c318fbe786185464057c0bcfcd1917230d78ee1a49eca12068fa676852c1099096c6cb98dfda27fedac41826516e42cc116f0cbb68f0f810418258dc5a65c0e1ada296176e17f8d762894c80542a79383cc1674a4f3d6520633ce80baba214c20628899f9ac826484c887713aed9c5caf13b40a598cb1e81f7b18dae39efc22dc99ff497e11f158edc2716ebe3bcd593691aa26523efc168e1394ab439c9a9270575ef34eeee9084b0a31b2d81d47c964ac61e600f75d9321d7474dde45bb8d0cc46510488ab68486d3ba6cc9c3ddb6f66f2e5d251ee285121e1645a2f5167fc5fb8ac4491c0d9d0423c7a8452efea2f5a30096a0fa47173f3a68500a5c755ea939c838d3be126a87ff6baa5a1fba638a5c64767d17f04201b935fcb1cb6afa175594f410f2ff773194c703e623876051e46bb0850a5016e65f8fa34b96bafdfe851a0756fe26fb63d52113c0935b0867f7dc8a94d887484b15e8f92b6a316a22c04a985cc94e432cd43f44001bcdbd48efcd463c402d3d181298e96db60fdb714b82e146567af5ae3fc0c3f9d241471b4d129f928d286f780facb1e84434610ab3379dfff0f64d57b4a1c2e96c98b693de952d26773d24e7a95eddbc450f79932d5332d27991c7bfbd3bc35bfeb9496fbebccb5e4c35c368e021dea643cb292d794d3d3bbcc960f989bef09763dc73d83cbf907485635265e81f87b712d958a66719230fc6466615a0e3bb998d48159e9e9c51959354a545966bcffa298c7673b4d32b991c886a997236642c0f104f6795feab9f48d0ffc74667f3f3e82473ac892ad25f4b13029b0b27fb1d86991ddc42bbc3fe584ed364e769f3bc72ed8749e7a654ec1a2ec7a01bd2d5caccdc6241a1b1ef2726db54d2c34ab47020b4c729b5994b43deb00ad959950e0051d2c0f27217397055e78f1dd3bd867a45e06c2134ae8981021aae881cc7b2049fe7c82d2127ec81d6430c8116355c8d0ab8b9291c688ed9b8dbb1ed6f1a99bb58a1be8d5737acbf9461b142c8982f52481195d35ef82aed4fa52385ea4ed00a739d01cad7af9f7c27d357748e24f28d22065ccb37300e8f5d8dae5ca79af7a50edc3e05184d1a2a6d59784d5ceeb1f1550a44ea03bee4dc5c27eb78f0032593c7d082e59211f83a8b91aa78bfb7e959328ee63af26a37b79ce5e5139eeebd12e28b2a26ad2fcbdca652524d036b324782d54247a48b9f8200b2d6d2c091c41366d677e3be6e136cec6c3080d608849135c6e3c7d695d2e226ae1ce999d730d7f79116ab85762e55a3e5a66a690ce0a4bb4fd1560c796e2797414b544ef78e29d55e4853fdbf3362085a65c46105f32c360a0a9867b984a5d0297fe0b06a45684ac801a8e66294cef6e5f3c48648884fbb2422fa00488df33a9a0ff1039c81f1939f2cd2f5fe8aa805af2d2332ac37244ed4a7b50265af8062752b0c16511e5f25e8aa2b60645675bc826557bb75474ca4787f6b584b2f83bc25192579104aa0baae79f396df0d31121f90db9acea9695ee0fe0c22df4db503ec8b2437b05f5d35a65722fa82eebd2aff4bcd3316a5cffc4b31913fd02f82130c77f320bf04bf8fa873d0e3f62122d6a5f87d3e908bedafed4a3cb6d9f73ff546f5a2b74a2493b1753e89b682352bb3166563518dcb190c7b3d9fd667c57978a670b192641a674dc92c2401d067b6767aa632ce32a401175c98200a52ab5d80dffa719746d0bff8a84bac4a56e0ab8124fc332b64ea662d01e1b73231a6638f01cf4d699448da228c16951149c8d3dab9a7e3be9a16c7d1ffb061818f8f9cb2b42739fae4a0d70c0701c8dceee785d36ef6413162de1917df01c693ef3e1f517e7fc46245209fee52f5c6a2f50ab3f56d67d1cd987282b24071d8ebb1bc5cd635957b2a7ad92d0650abd5bbc24b75885b6119592a3d715392718e52f9124c4ac95be3582abba4ac3a4049ee49fa8ceb9b59d4e1e2a069c9d482879fd8d27d5ac22ef870542453be22c2ec4ebf1472c19fbfb56aa0a3671297b020e3fe49d201a82a04420e90bda43691dacf92347bcbcae3742cc4abad4c8010c0afa15278795d4d76c482461ae78f30569e1dcf87b9b150d07a2bd81676ec6022422d490759ae1e861a6c4cd1f733bd772d60975a59356c385a4a390429f3d2131e7f616015261df6db3cc3ec261a53be10c4f197e71878984fee00e6d1069f79825194b7af434fb6bb86db18e11977f82928be35054543060cea94ebb4015d061f20f8454e056e7b6e4f9a1621ef2377d77659c20bf358c817519f1801be15ae3b5b42adfab367777a6789635a0dcdd1f2b97edecea0210768af67601d1b95a8850dddb6b1f4b0c2f52c835b0833d81966ad19e49ceb9dc9c729cd8334bc3ee5bb8c74186f5cc3e765b9fdd91d79baaab3d2ab64c15d655d1af7de9cf8d5d7c1baef24577843ce142331743b45b06104b6d0d4392e61ca8c07507ff5f831bbf720854db4debf64182aaebf899ba57626a48748fc2dcf016013d575595d24d383eef2da0ff0c9f6fe9c64b186cd4617e3f37635d7dacb58ec297f3ddb48ce4a5e00cc127267e18a1fdf209e098f2cb2e9c0630d15ec9b867b2b95ecf82ad2c0ba39df9c4d36d492bc9a55c4b767da966e4fd7f4d2fef5e91d0575177c05d240b50757031c76333d43bcc828ab2f0376e29d12d1261ce104a8ea488091326bc451c120c8c04d3e64835c893f55b312e248ad8fc1c32429d68e6b67bf45ab8a1cc3db22f9f01a2266b8349046d3d3e081eaa7f7020c73c0762d11a33b517b8f081da3c61ef63e1d40cd87d69c7ac7491fb61bb57c1fe2d218aff6d39b3e1fc847f0ed894e2f0b4d6a4ad03ba42e28bb1dfab645081f548e64ceb8ce15d2214bd66a14fe594aa447c3537eb493299fef0f9326236ea5dae44e23b34801fe06ee16c79545feaf2528421d6e7f9a256a7914d86bd053dc33c8c2043ba73714f5ff5f0507097a56c40b2190e77877d43be849ee2ac129e582930ced06d359eebb49eda4edb13819f91cecc449c9613d9659906179f8fefa34fecb7d21cdaf09a1ce8d094421da80796c97c02fc56171aaba53fd8a7f55de059044717df164f3571028f16995d51fc8829534cdf58dd134def1e43a34e4f5f372fa8e19d3b85881e99ecd45faa4fccfdb47e094ab06955f3960fac71294dd965f24a97cff36b9966cf1a4c3e96c3e14a3951dcc8a3e9371f7e1ae9df77ddb1a99172174adbee8ea57a0c9872a6d677c2875da88a6a7234bebf68a3cc0532a9809a4de4b4d419bff67b0ba825a7ae6e999087155378357ae67e2dd98697f1d10ffa4497dde6582571670456db995228b97d0ecb2fb30c2ba6c16038c40059815c56b35666cc1c5090f6c38e0f4c12abf79919951b85a2734d32dd12b239912d541f9163387a4aa0be0b7a12d9c6b56dbcf1e9aadcfd72e2664a84d6c5147c72bffe7c3560ccd8c447b748dcd26cc9ca2a85cded742a8dccdfd8e78c96e78d405a19faab9e57183b37583f94b3d416b2920c6b746427ed75c08dc3be02720c1edc4743229153c48f1239b222b9fe2e21c0ae28122bc44f9dc78a59f3485ac8057eb21f0857bcfea2d9ebbbcc197e7880d81515bb1cb7192d97c4258c09926d137e245977db40812b253f99a504bb68137d8d73ca4e7c808d50f1dcc600e6a6db90238ff44e075932fe668c066e6988a6a8b4a8485120c8e4d6511268a75d8f9b0f06689aac8cd621e90c62af1e59aa9efe928e9ea098661b408a2825c4f9aac1efd9d54d163a651054b9ab32719d2be3b176f6795ddad0f1310b9237181689f2f9dd34a41d4d4cd2d7569bf56e6a80bc24d90df3bdde0f9649e699f4ef70c4f3faf9553a231215416bba26c29f17861e0f265e9641b2307ed43d6fde23a378669f4ade874e54c20a5e902205dcaa79a3e8584a3f78a86e703451115a1717df882507c607297afac0a056a0f3509a57502fd2ffff6035d04b91f72f5e1a69ddafaf80f7b2f7a13f38c683988436585e6bc7fc2da328449675c234ec0acf5294ce06c72442beba15e65d6a3e1b5dc3c8f115e1005798383f79b0194f6b7d4b1b32371acbf22340af6e5ee3ea840f7ed451226daef3041fc194e051af2fb450022b394c774273b9575c974c324ecd7268435176ee28c54bb54c8e829232ca636f3bdef60ed460b5ff425936626dd16a3f436f08a863582a79f393378f60f6c8ecdd13d83073bfda2e9f8d0c74a841021cbb8c148e70bfc585627449cdd9fb3045db3ea08a96108b52ee8a4f5048a5d910355789f4bb85c1362955e267e719581c38a2648eaa0b516db6277d2ee3c6e1e1090df3f53a31b747d99887e337dadddab16a297d9e56797007a3d18ce333311c70bb1bf45bdae517ffc589419af643773bb30a1fbff7ecd4a8ae7456a608fe73547c2eda4f070d57dc70b65d867526c946a435ea581497da18646ce569eaf6ccf3474cd6e7aa3d6d4732836ff4167c9153757ce58a34864be6d479f7b4ea1d6480b9ac16c5bff346a74e74133234744df867e16b3d2f1f7db4b21b89019b520917ef863e60f52999d6946b9e09cb60054f49d8a255f02e4b62fff6e6adb9a167ea70a177d00b26f56e29b63138a2ebc30b956161a4ab25d5da1c207c3f762714f651341ae771e17d84fa1c86685f2fcb0a128c2e1208d1930e7ff0d8d55299154112af574b881be8b69cc1721d548ad4dc02632e184c47f9b394bf4a834e60fbead8c8bfbf5087f8454513b0b086ac97bbbb9aa342af9def758fe88f1e4570e65f93fd4a9868665d08fac0cf6ebde786995c433504ca01cdf83311aaae20cc76f819a4344a8ee4e26c1094cb00d2c8a67c733fffcd89e97534cacb08a64d75e8594fa31f0dcfcafb0d1bc184c7067fec6a48ddefd580d4d9a4128d8f70f6fc6562da683904766e982ecd0286064db6844131bb7962a0a497f7b97fefad88a0b128bdf8cca774b1c32cb4af259bfebccda036e7e4ea8962838dbb5c04ffab0a2f1481848a27f06171645daf5246a2e563f3ed60097a9d7023d6ba5c8a58d39f733b12baf0863d82c427460f51cf9e3f77281a42221725b7bb75c2116ab31f704661f090d3eeddd2aa6efc619946b4933c398b635fd04ba3758294965c568997e1ef44b0562804e6c64558f6cfa87662a988c321a856ead51c848528a4954f9ff1948d517d67bc11db66801648848bfb7ee12296428bc3ffec863e9c77ff31ee386197679adab2a0e93bbe0c66ffe9c4b09b636f6216faa373aa8271678cc57ad46898222df7e2d8b14a5b70130596c0430997c4c04d9b5187fd9bb26b71fd19aacc8e08a3239f0eebca7b2873062a19f327a4a282012ebf9898a5ab6310b8623c864d4dada3ded00ad201ce8f3973f90396f5edc1ba466e16247fe6b0ee98acfd53792cc0fea33647b841596655b8d9efbc14b50fe0b588e4c41e2cbd0a700529e7ca91122d3d1b26e52bf44a0c9fe37cdbc352357f13b2adc68e78a00f6dc88a8e6ea54bd0b2c8276f9e1bfebc8655a1f47b72c25ffa97f4463630cc21428ca3bb381a6d3171d28bb946f746f820247bf3f7bb69caaeb5c47026ca9997e586e657a9e1569312bb443299ef4cfeacc9aaf4fc3aaa4a77a21579234d2aab6fd0234398ae07ca7c57ac6d6a51e025744b1430abce27f7f9b0d0e45c051e34d20db95cadcc0e4e327dbd979166b33e39a3951d0b8dd62c0d1542b69583cfc07b127243cac4b052cb29ccb3592972698fa4cd84633d222d78b8741d5f903f8636d95cddfe2ef13829df9ce32705edfda51ded2f0ef38f60a33a2e00373107eef56a01acb5e05d849279b5987343c8bbc73ea660ceaf7c9b90c0a8e1412ff3f517cef8fe604d7a26e085170a76e1bf43f5d1bb77ee771fe841d59fe2cc2874d25bf991b4af6bf9ffe1bfbf3a5587006b60bab5bdfd5a3192e82d474ecab0ab656967856c84cba9469c5823c1d1bf104d2a21c071bb08b2a137883dd9c8f545d6958db8efa45263ae303de76e70f2f6a10e1858e6654004f2a099dc31950ee730c465e0a1822935e309d41650fba489aa3050eedbf3f058d24d1f04fc340966e42d72052d84a66789ccf75000c3fc83b8842badd6b22ddaaaf53ed34e25c1b638e3630d66a7903405052902cf8e7395d54679e2f4a2bf7c8c89b0dc38969376ea164fe97b37b1172e6e8f05a929aa373108e891a64e38e18b432a115a44d754811e03c4f4ae7c525a6b9b92aab0d16967ee1a64eeeb2207c094f6aa96f126d058eff22435a4ae76c31f888ee13b327d2cab4ab5a56abf4cae88c583dd67129271708aa17f4f10886ead0e12734314bd4a49e64349beba4abdf94a1fb23a72cf7e16b5af2f1706d9646a5ff7dbf5c7b1cb2c3781346167b15d4625841d9f3d14392db1d39101d37175c42c522229db0708544058d75cebf3e399cd443d1b943c6f3017a898bd49836a8d92519deb810712aed76602682ef0df2be270734eeda7f289a76f4684baf75702a1ac3da005e62b83f794b934cf882db5d50e5ed4aca868e300d690c0b10daf0a47486e9f49d1b08eac6cf5090ddd2443b1459b2df86ab3447b2b5c6afe8aadb410de6a84b640e326eb882832d1a9cb12e0b8f13aef579f404af8631cdd5a30a031dad19cdf247575dd223229330f19fe4d88c51242217397acf66b86c743de283d5df7212fce59af17eb702eccab192f56f054a33709d41841e4a39638e02b4210559593f9b5c44fd22d9da637ef1a3a0a41c40469990dc4beec30a05b67931c0560d9a59fa875f3e26fd1eb32655aa30c7a1cd3d541716fdaacdda206328f3cbc8f16fc2be26690f18963a16febbaf2cb6c199330579ca067c60b54cbdd211c1350e066448fb50ae28ed58788ac98f0ded3414c8735ab90639916e26ab29102cc2609035e56d9b9d2dbc98118835bcf0e437c77052efe2293d9f19b7197aa1b94b10997b0b1efdef251de8945a97fec885f032c3bee2447335230b866d7aef515b04664d0c59e18233f9a229969e3e17d69716413ca3bc55f5959e340627ea803f7b26f4a74295b295344a3685287093998a1ce75b1ed5d730c9aec812617b4c200a0250c9ef8ef7d2fcfc59ef97422eca746bc6451a5b77307d14c1cfa0ea2c8eb7cf7819644577a6456efec0af058a0e3c8ec371019009462bfe174a11368b57fbe3090208a57b2236b97edc32cda5c6fc988cbaaf91c4020a06a7ad45519eaa761e045fc84d3219b287206282347a031ef1e7b7dbc67de738fa8f9fe71c44201fd1d548f8aebe93bf502d64d4b5f470a419e3fcd87f0616b9813048311ed20ac2efd7f18dcd6889542208b50c28c8c0700f73fa33a964e38d699819cab2098c6ff081266721cdced87ff41948c84037485f30d38a99eeeb3ff4c3049742a29eb09bb35c358e732546267c165a62fee9e25abdafdb8a48785bd432d160797e7a41d580f59d7d8e59b3e6b954d39f86db33b8f7cabde43e8e04cac1fcf9aa6fdbe4326e0d9c782d9a630055b36f85c2b8efebf18f42ef14ee5eb1d33ca322db69704f8bb90bf30eb05908b8d8ed169580923f53a6539cc3b55baa47718053d2ff103c23d90f9cb49ddc7d759950f605bafabcb7953c042c0523b84da994529a87ad68fc6f0709fd7af5fc20e53a17d3f5fd4d25fc5ff6598c6ddfc34668a08ee5e066d81a65e7979c50c08febf76dc5a3a405f551bb8449d94ea0dfdad6dd6dd6d6e4486f4ae1d2523c05f46198d8af4da12873ebdf7d6b5f2d0f1b2d29759ab0d78e34ae6f17b7ab83518cf8b18836ea5630ee934e5ecc123f0d3fe6b803ae1f735d65dcadcaaf6660e02ecad0290f6ead0594733a10b2b1654a44244424fa8b3180b551ac401828203e61603b017106e2256f01b9f26db33897167d9defb54ddfe49334150574493895370bad46cc658667aa9a8ed333c86f112b2a542936af92e2f933254b6fb0b1a599eec3bf2e476ae6714e2486dd31b29e4d26838d84bd7a62c62beab3ba71642278ecaf2e50d70670d9fdff105019791d36321bc57fdfd8f65f2ea1cb188035ecabf6140e777b7e6d2177ac29e9a1a2f87dd54d96184bb1a855bd9efdadfc606f13621f40e07cd8be9c2435c8c90b4ccba5eb7ddcf8cf1f76617c9a9e011abf4a63ffe31df63ecacb8b1d2d653e613cb399ce079392f9ca2e226c60b6e8103447c24c1f80d42e1ee747997602ae3ccff8f9f98ce9b56f6f3e3c0ba507df8b2169539cfc946c42da72644feb9b3b582ce332f8b2eda02192958194903d17b3e9b4bd60d08cd9a7989d946ece6d8dc01d6b66a7851bb11e4b075d38081d3ce7bf1875fec9daf47a589abdb72763c9747b83a28389238b0279c8e41db6521130420851acac463664a97be2190aff921923475f2c1f8a87d1169229e5f10dd0a92221e61358b156020f2c9ca2cb6580743a8d5e3c59e6fd97a7a246211450c7c62f1891cedb434102f8794d81c1caf2c1b4ae18b7c4b9c88de5c51da33e3343cef76da0d00341c2e60c4562c162e41a7efa8290cc9061f3d6a592d5f104c5018f31bcaf912bdd37370fbf8fedf0aa9026c1142299197d67ab026756927b5864ea42c45a82c23c275697d31a1b7900670c9a3c967d12974543c11f20c367a336bea9b9ebe480f9c806528138dff35c5f56b1199b75748e9c5cf50e6a32397dc3eeb04c3636c0848a5e13df8a9758bacea231f34cba13b466360b0dec69f74f8bf9a2dcf3dd94fa3a7d27e8caae00240559d75875ef9c619416593ca0072e7f38caae5a530c62dbe00e38c12cb8b924d63fca4d5c3a4c8f50e8f4f86fc1fe2b163219c46c21eb783e587e18e07ab7e1927a646c4f154c5000cb65ce9528457c3c66f43d9ab7d61580df0ecfb31cb38e4cbcdc3dafcca57311abec6b74048c8b74505ba678a4db07ed7243c70a821aee66a487bf91fd273418f8ef657d1eeb9ea6f095d47641e9f9fa30599e8b9c6b4453a1a5e8afd86fcafb46dd095fa4a98a2b26470e2c799b08c6000f5c3c4e28961463724377f37813f3922484fda986eb7c93ae8365baf648acbb344ca7e044d7ba93e7ba35c31085f3f99c5fdb2f9f2845f00b8590395e8ff730b86f5dd7f52297b8ecd5d5a6bb452bcd12b98d6adb27e7ef0e84b9567c66093ca3edab7e64ac4f56360501d81823ea2b1595f934c5f61c8558304c16154109a983a2af8725c7af91b5bc57e555768aa8115236a6ccc921d472b608eb6b82c4ba3747d79027d7856fae5369aa325df6a76138a5b41a94377eeeb251087e0b8510d8890e3f7a0cffaeddb9d2c29bc89f952489f82ee2e2b485cd297e6d30683701623cf73ee9ee606baeae9c3afba287eff57731b9cfaf034b1f56c8b31a32a1078c4fcab298c3f925a8e7cacceb9edf7ba2e54d31033a25462021e4a3c0bf5af341b462ee4417024da7c12c7f385de3af129aef1338a9c1fd68323d07ff47ec8bcca66b44300624d02c9202a2d093c3c85fd922b57b3bd14162c8ca5690734b7e4e4b8980b73a8e9908a9fa3dd508b30e3b1e1fd4ec388affa27c4bc26ca2820e0a902d51ff94984e8894fa5fca7b8704b7600ca6d6b1b1527ea999fcdf8fe3b290ec0036cad222f92cf8a5a54d0fa91de6e74ef61f60a233c9f15fdc86226c3f688de15ed8f0c3f1bc3afcad87cee47a19384afc6a804f197339ebce4aca211dbe0504a000755d18f20c4ecacd4123acdff7653cbb26456499495662508c8186afb883f5481c6bdf88cf137e263bde9d62f054573e0d1454cc119c95d4d9011332bd77682f79debcf5c21f0be7e9a83a58cec34e7cfb17a8122e030669228e4d3d9e274a678c5b77e6180aacc2fa8eb9952c5b04de6b2c7bee591badab96a3c3248c275b5b8faf5394eacc427a840570033be5006c33ce2d2c6e54f08681c3f74ad2fe54bca6dc62a9d84f6c58509c1e5dd5cfcc7a358493d428de48dfc1bc3f74154801c97e6aae38445045320b4cf66c1e56eb6ea2c1218de65f120b463c5cfb9255b3a25eb6e848cbd977f0605d71c561c2a754f5761c31f84101ee8178782cc8cf70b41a2204c5cb2f3134d572327fe4bbc1792249dfcf0ae7ba5d81fb5ae4a7978d044085f3b7f2e398c05733e2bf456cae898f8b5a81e9c79179bb5ca716713fce643dabe21eaee4386e646e25ad3adc5a4ad40f9bd6743f5f742efb1a674ffdbd2ced56c646ae590eb8f10283b47f57e6f96ad76adebecb24df74020b096fdee3c8d780d563a915f73c8b0246b861cd3a8580d5cf75798e8cf1c5875724661a39277e7165fe48ed8d5e6a20d68239f626fe8ea434a4e6e03ea434ec68c4b92a0fc2af15a135d6cbaeeca39a0c1896dab33daac", 0x2000, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
write$FUSE_INIT(r5, &(0x7f0000000400)={0x50, 0x0, r6, {0x7, 0x2b, 0x10, 0x1c20040, 0x0, 0x0, 0xc0000000, 0x1, 0x0, 0x0, 0x100}}, 0x50)
syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0xfffffffffffffff5, 0xffffffffffffffff, {0x0, 0x0, 0x0, 0x8, 0x80002, 0x5, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x6000, 0xd, r7, 0x0, 0x800000}}}, 0x0, 0x0, 0x0, 0x0, 0x0})
r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000d80)={0x0, 0x0}, 0x28)
r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x9, 0x4, 0x4, 0x2, 0x80, 0x1, 0x0, '\x00', 0x0, r9, 0x1, 0x1}, 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xd, 0x4, 0x4, 0xa8, 0x0, r10, 0x0, '\x00', 0x0, r9, 0x0, 0x5}, 0x48)
syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x3, {0x5, 0x0, 0xd04, 0xfffffffffffffffc, 0x0, 0x100000, {0x0, 0x8, 0xfffffffffffffffd, 0x3, 0xffffffffffffffff, 0x0, 0x4, 0x4, 0x4, 0x2000, 0x101, r7, r8, 0xf0ee, 0xb}}}, 0x0, 0x0, 0x0, 0x0, 0x0})
open(&(0x7f00000001c0)='./file0/file0\x00', 0x1802, 0x40)
mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000200)='pvfs2\x00', 0x800004, 0x0)
setreuid(0x0, 0xee00)
shmctl$SHM_UNLOCK(0x0, 0xc)
close_range(r4, 0xffffffffffffffff, 0x0)
ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f0000000100)={0xc})
ioctl$IOMMU_IOAS_UNMAP(r3, 0x3b86, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, 0x0)
ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, 0x0)

5.127660124s ago: executing program 1 (id=66):
bind$inet(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0)
connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
sendto$inet(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x2004c015, 0x0, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x18, 0x0, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1)
r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200)
ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000080)={&(0x7f0000000040)=[0x0], 0x1, 0x7fff})
r1 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x48050)
readv(r0, &(0x7f0000000040), 0x2000000000000213)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/midi2.usb0/iface_name\x00', 0x1, 0x0)
linkat(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', r2, &(0x7f0000000440)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1400)
ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0186405, &(0x7f0000000540)={0x76, 0xff, {}, {0xee00}, 0x4, 0x9})
write(r2, &(0x7f00000001c0)='my_midi_interface\x00', 0x12)

4.536976933s ago: executing program 5 (id=67):
timer_create(0xfffffff9, 0x0, &(0x7f0000000040)=<r0=>0x0)
timer_settime(r0, 0x0, &(0x7f00000001c0)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r1=>0xffffffffffffffff})
r2 = gettid()
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0)
bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
r3 = getpid()
sched_setscheduler(r3, 0x1, &(0x7f0000000200)=0x7)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
unshare(0x22020600)
r5 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0)
read$FUSE(0xffffffffffffffff, &(0x7f0000004000)={0x2020, 0x0, 0x0, <r6=>0x0, <r7=>0x0}, 0x2020)
socket$inet6(0xa, 0x2, 0x0)
close_range(r1, 0xffffffffffffffff, 0x0)
setitimer(0x1, 0x0, 0x0)
prlimit64(r2, 0x0, &(0x7f0000000080)={0x1ff, 0x2}, 0x0)
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000100)='./file2\x00', 0x20005e, &(0x7f0000000480)={[{@abort}, {@errors_continue}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x40}}, {@errors_remount}, {@barrier_val={'barrier', 0x3d, 0x1000}}, {@resgid={'resgid', 0x3d, r7}}, {@nolazytime}, {@noquota}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x6}}, {@data_journal}, {@init_itable_val={'init_itable', 0x3d, 0x5}}], [{@appraise_type}, {@euid_lt={'euid<', r6}}]}, 0x1, 0x476, &(0x7f0000000700)="$eJzs3MtvVNUfAPDvvX3w4/XriPjgoVTRSDS2tKCycAFGExeamOgCl7UtBCnU0JoIIVpc4NKQuDcuTfwLXOnGqCsTt7o3JMSwAV1dc2fu7WM6MxmGgWmZzye59Jz7yDnfnntmzj2H2wD61mj+TxKxIyL+iIiRWnbtCaO1H7dvXp7+5+bl6SSy7N2/k+p5t25eni5PLa/bXmaWavl9DcpduHjp7NTc3OyFIj++eO6j8YWLl148c27q9Ozp2fOTx44dPTLxysuTLzWvfNJ+nHmdbu39dH7/njffv/b29MlrH/zyXVLGXxdHl4w22DdQJp7tcmG9tnNVOhksEgM9qgxty5sob66hav8fiYEYXD42Em983tPKAfdUlmXZlmYHk1jKgAdYEr2uAdAb5Vd9/vxbbvdt8LEB3DhRewDK475dbLUjg5EW5wzVPd92U/60dXLp36/zLe7NPAQAwBo/nKj9XD/+S+PRVecdL9aGKhHxUETsioiHI2J3RDwSUT33sYh4fOWSrJ3lmfpFkvXjn/R6h6G1JR//vVqsba0d/5Wjv6gMFLmd1fiHklNn5mYPR8T/I+JQDG3J8xMtyvjx9d+/bHZsNCIrx3/5lpdfjgWLeqT118xMLU51HvFaN65E7B1sFH+yvBKQt+OeiNh7oLMyzjz/7f5mx0ZXjX8bx9/CYGf1WS37JuK5WvsvRV38paT1+uT4/2Ju9vB4eVes9+tvV99pVv5dxd8Feftva3j/L8dfSVav1y5U9627J1u5+ucXDZ9phtqKP70+WDdBnd//w8l71fRwse+TqcXFCxMRw8lbxf7jK/snV64t8+X5efyHDjbu/7ti5TexLyLym/iJiHgyIg4UdX8qIp6OiIMt4v/5tWc+bHZsI7T/zB21/50nBs7+9P2aQist4k+iQfsfraYOFXva+fxrXp2VOY88rE5/bwAAALCZpBGxI5J0bDmdpmNjtf8vvzu2pXPzC4svnJr/+PxM7R2BSgyl5UzXyKr50IlixqDMTxaP+WX+SDFv/NXA1mp+bHp+bqbXwUOf296k/+f+8v4GPPi6sI4GbFKd9v8syz7rclWA+8z3P/Qv/R/6V4P+v7Uu3/RvBACbW6Pvfw/20B+M/6F/6f/Qv/R/6F/6P/Slu3mvv0hcafGyfXuJ/PPnrqtxHxNZ1qPSh3sf+3Ii0g1RjXuViMpGqEald6X3+pMJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgO/4LAAD//wYf47Q=")

4.35130015s ago: executing program 3 (id=68):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c)
gettimeofday(0x0, 0x0)
r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'macvlan0\x00', <r5=>0x0})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x4c, 0x10, 0x503, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x220, 0x4000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x10, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x1}}]}]}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x4c}}, 0x20000090)
pselect6(0x40, &(0x7f0000000680)={0x8, 0x7, 0x0, 0xfffffffffffffff9, 0x916, 0xae3, 0x7, 0x8}, 0x0, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a, 0x3}, 0x9c)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
ptrace$getregset(0x4204, 0x0, 0x6, &(0x7f0000000480)={&(0x7f00000008c0)=""/203, 0x118})
shutdown(r3, 0x2)

3.206508003s ago: executing program 3 (id=69):
timer_create(0xfffffff9, 0x0, &(0x7f0000000040)=<r0=>0x0)
timer_settime(r0, 0x0, &(0x7f00000001c0)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r1=>0xffffffffffffffff})
gettid()
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0)
bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
capget(&(0x7f0000000040)={0x20071026, r2}, &(0x7f00000000c0)={0x9, 0x7, 0x8000, 0xa9c, 0x13, 0x101})
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
unshare(0x22020600)
r5 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0)
read$FUSE(0xffffffffffffffff, &(0x7f0000004000)={0x2020, 0x0, 0x0, <r6=>0x0, <r7=>0x0}, 0x2020)
r8 = socket$inet6(0xa, 0x2, 0x0)
sendmmsg$inet6(r8, &(0x7f00000065c0)=[{{&(0x7f0000000440)={0xa, 0x4e23, 0x0, @local, 0xfffffffc}, 0x1b, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="12000000000000001100000067"], 0x22}}], 0x1, 0x800)
close_range(r1, 0xffffffffffffffff, 0x0)
setitimer(0x1, &(0x7f0000001d80)={{0x77359400}, {0x0, 0x2710}}, 0x0)
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000100)='./file2\x00', 0x20005e, &(0x7f0000000480)={[{@abort}, {@errors_continue}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x40}}, {@errors_remount}, {@barrier_val={'barrier', 0x3d, 0x1000}}, {@resgid={'resgid', 0x3d, r7}}, {@nolazytime}, {@noquota}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x6}}, {@data_journal}, {@init_itable_val={'init_itable', 0x3d, 0x5}}], [{@appraise_type}, {@euid_lt={'euid<', r6}}]}, 0x1, 0x476, &(0x7f0000000700)="$eJzs3MtvVNUfAPDvvX3w4/XriPjgoVTRSDS2tKCycAFGExeamOgCl7UtBCnU0JoIIVpc4NKQuDcuTfwLXOnGqCsTt7o3JMSwAV1dc2fu7WM6MxmGgWmZzye59Jz7yDnfnntmzj2H2wD61mj+TxKxIyL+iIiRWnbtCaO1H7dvXp7+5+bl6SSy7N2/k+p5t25eni5PLa/bXmaWavl9DcpduHjp7NTc3OyFIj++eO6j8YWLl148c27q9Ozp2fOTx44dPTLxysuTLzWvfNJ+nHmdbu39dH7/njffv/b29MlrH/zyXVLGXxdHl4w22DdQJp7tcmG9tnNVOhksEgM9qgxty5sob66hav8fiYEYXD42Em983tPKAfdUlmXZlmYHk1jKgAdYEr2uAdAb5Vd9/vxbbvdt8LEB3DhRewDK475dbLUjg5EW5wzVPd92U/60dXLp36/zLe7NPAQAwBo/nKj9XD/+S+PRVecdL9aGKhHxUETsioiHI2J3RDwSUT33sYh4fOWSrJ3lmfpFkvXjn/R6h6G1JR//vVqsba0d/5Wjv6gMFLmd1fiHklNn5mYPR8T/I+JQDG3J8xMtyvjx9d+/bHZsNCIrx3/5lpdfjgWLeqT118xMLU51HvFaN65E7B1sFH+yvBKQt+OeiNh7oLMyzjz/7f5mx0ZXjX8bx9/CYGf1WS37JuK5WvsvRV38paT1+uT4/2Ju9vB4eVes9+tvV99pVv5dxd8Feftva3j/L8dfSVav1y5U9627J1u5+ucXDZ9phtqKP70+WDdBnd//w8l71fRwse+TqcXFCxMRw8lbxf7jK/snV64t8+X5efyHDjbu/7ti5TexLyLym/iJiHgyIg4UdX8qIp6OiIMt4v/5tWc+bHZsI7T/zB21/50nBs7+9P2aQist4k+iQfsfraYOFXva+fxrXp2VOY88rE5/bwAAALCZpBGxI5J0bDmdpmNjtf8vvzu2pXPzC4svnJr/+PxM7R2BSgyl5UzXyKr50IlixqDMTxaP+WX+SDFv/NXA1mp+bHp+bqbXwUOf296k/+f+8v4GPPi6sI4GbFKd9v8syz7rclWA+8z3P/Qv/R/6V4P+v7Uu3/RvBACbW6Pvfw/20B+M/6F/6f/Qv/R/6F/6P/Slu3mvv0hcafGyfXuJ/PPnrqtxHxNZ1qPSh3sf+3Ii0g1RjXuViMpGqEald6X3+pMJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgO/4LAAD//wYf47Q=")

3.206281485s ago: executing program 4 (id=70):
ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f0000000040)={0x0, 0xffff, 0x0, 0x0, <r0=>0x0})
syz_open_procfs(r0, &(0x7f00000000c0)='net/ip_mr_vif\x00')
r1 = syz_open_dev$vim2m(&(0x7f0000000400), 0x8, 0x2)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
io_uring_setup(0x3eae, &(0x7f0000000d00)={0x0, 0x0, 0x20000, 0x3, 0x1a1})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
r2 = getpid()
sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448d4, 0x0)
mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0)
mount(&(0x7f0000000000)=@nullb, &(0x7f0000000a00)='.\x00', &(0x7f0000000040)='gfs2\x00', 0x800, 0x0)
mount(&(0x7f0000000000)=@nullb, &(0x7f0000000a00)='.\x00', &(0x7f0000000040)='hpfs\x00', 0x800, 0x0)
bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@generic={&(0x7f0000000100)='./file0\x00', 0x0, 0x8}, 0x18)
socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x4)
lseek(r1, 0x4, 0x0)
write(r5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_G_FMT(r1, 0xc0d05604, &(0x7f0000000440)={0x2, @pix_mp={0x10001, 0x7dd, 0x20323159, 0x1, 0x2, [{0xaa84, 0xa}, {0x4, 0x7fff}, {0xfffffffb, 0x6}, {0x10001, 0x7}, {}, {0xfffffffd, 0x420000}, {0x3}, {0x6, 0xf}], 0x7, 0x5, 0x4}})

3.186119001s ago: executing program 0 (id=81):
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00"/13], 0x48)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
close(r2)
listen(0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040), 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff)
symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00')

3.185630579s ago: executing program 1 (id=71):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @empty, 0x4}, 0x1c)
listen(r0, 0x5)
setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1ff, 0xf806, 0x5, 0x0, 0x1}, 0x14)
socket(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x2)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
getsockopt$sock_buf(r1, 0x1, 0x3d, &(0x7f0000000300)=""/77, &(0x7f0000000380)=0x4d)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
fadvise64(0xffffffffffffffff, 0x88, 0x0, 0x3)
syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000)
socket$inet6_icmp(0xa, 0x2, 0x3a)
syz_open_dev$loop(0x0, 0x7, 0x10c062)
fstat(0xffffffffffffffff, 0x0)
r5 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x7f000001}}, 0x1c)

3.185330486s ago: executing program 2 (id=72):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={<r1=>0x0}, 0x0)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000080)={r1, 0x4, 0x20, 0x100000000, 0x5}, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x5, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffd}, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r5 = socket$inet6(0xa, 0x3, 0x5)
syz_emit_ethernet(0x66, &(0x7f0000005a40)={@multicast, @random="6076b5cad4f6", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "75e700", 0x30, 0x3a, 0x0, @rand_addr=' \x01\x00', @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "a3579e", 0x0, 0x2b, 0x0, @mcast1, @remote}}}}}}}, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x62], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588)
r6 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r6, &(0x7f0000000380)={0xa, 0x14e24, 0x0, @loopback}, 0x1c)
connect$inet6(r6, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0x0)

1.326441019s ago: executing program 1 (id=73):
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10)
r2 = socket$inet(0xa, 0x801, 0x84)
connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10)
listen(r2, 0x8)
r3 = accept4(r2, 0x0, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e20, 0x8, @empty, 0x8001}}, 0x1, 0xc7}, &(0x7f0000000140)=0x90)
setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={<r4=>0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10)
r5 = socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0}, 0x10)
landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, &(0x7f0000000240)={0x3, 0x3}, 0x0)
landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c0000006800010003001000fdffff7f00000000000000000c0002000100000015000000060002"], 0x2c}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x48, 0x24, 0xf0b, 0x70bd2e, 0x400000, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x298c, 0x2, 0x0, 0x401}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x3c000001}, 0x0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@gettaction={0xf0, 0x32, 0xe72c5f922f23cad9, 0x70bd2a, 0x25dfdbf7}, 0xf0}, 0x1, 0x0, 0x0, 0x8080}, 0x10000084)
sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYBLOB="0000000000000070e367f1c3040008000400440000000800da366ce3aa8bfc25469f228c3c94be2e9a8e67a67234cc6c4756e0b83d985e4bc9599cb92fb4fea8beb6852637e2b4bb84cdd119697eddccd7457eb54fe1b17a95ac59c062790b818455065b4debffd97ee0f531767d0eec005504b54d26de4ec16a1465aedcde2394810605b6f8ed995084ab97ec65bc55e7c8957b12786857b8b80a7bae1b11881f14f678c749a163965a80e891f1de5e2bb46ddf76cb1ae54422a98723190c8516097e49c2978b1ecc8d7bd597f0952669af3c0a64d881620ff3f638e8c116213ec464dae157ab198c40a2d4"], 0x30}}, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000840)={r4, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c)

531.344254ms ago: executing program 5 (id=74):
bind$inet(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4)
connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="44001d000000000000ffff", 0xb, 0x2004c015, 0x0, 0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x18, 0x0, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1)
r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200)
ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000080)={&(0x7f0000000040)=[0x0], 0x1, 0x7fff})
r1 = socket$kcm(0x10, 0x3, 0x10)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x48050)
readv(r0, &(0x7f0000000040), 0x2000000000000213)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/midi2.usb0/iface_name\x00', 0x1, 0x0)
r3 = open$dir(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/midi2.usb0/iface_name\x00', 0x40280, 0x41)
linkat(r3, &(0x7f0000000400)='./file0\x00', r2, &(0x7f0000000440)='./config/usb_gadget/g1/functions/midi2.usb0\x00', 0x1400)
ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0186405, &(0x7f0000000540)={0x76, 0xff, {}, {0xee00}, 0x4, 0x9})
write(r2, &(0x7f00000001c0)='my_midi_interface\x00', 0x12)

426.703293ms ago: executing program 0 (id=75):
prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
syz_mount_image$ocfs2(&(0x7f00000026c0), &(0x7f0000004780)='./file0\x00', 0x2010080, &(0x7f0000000340)=ANY=[@ANYBLOB="6a6f75726e616c5f6173796e635f636f6d6d69742c636f686572656e63793d66756c6c2c6572726f72733d636f6e74696e75652c6865617274626561743d6e6f6e652c6572726f72733d636f6e74696e75652c6e6f696e74722c67727071756f74612c001796fa694353e3807803df5ea6fd4d6e6a2613d336eb62b863dcd89e37b45f8bd04199a14c48b3e553e035ab300ba3c60c27682a8ab5656969d829535c0862f6e3a35f15fe4d50c0d5c74631344625d6224c436474bb101ff47a14c51e342ca291c09c35d9d31b06b6b86cb9dccae387b5f1e7c5e1d445d52845a3fa4c77234ea9d37c8a277c85e69a85cc6ffeb225bebbca91b569b80ee303c9a21c58db5d96fb87f1713e0e9b896e37becae2e7a978259a0847e9fb08dcb8b9f84f616463da2507db1b3489769e99"], 0x1, 0x4703, &(0x7f000000c7c0)="$eJzs212IXFcBB/BzZ1ezmybb/UibpOnHJBFctCybPlXrQ1yrNpo2H9pWU2Wd3Ww3q7M76+6MFgxSgyAKghIEFT+oCqUvtSAG+lKLUPADaRVKRdH6IlKogg8GbaArM3Nvdu6d2d7JTtLS9veDdvaee8+5Z/a/99w590wKseqphdXiwmqxtFSszN6/ekvxc5VybXEuFF4lr/X56c6VyEn2r50j7/vAR+65JYQ/HPvah9bW1tZC3XDo6EDLz+f/fXq29TVRyNSpt9u5taY/1h556edveaUj8pwIIexo61ddXwjhY78IYUsIYSQuG41fB0MI20IIUQjh0d/868cDvXShxdl7X3ju2JnD+85MPf7YMxfmj254YBTCd8u7b55ffHF/323Pv+MynR4AAF7RB48fufvo5IHwZBSGzvW3f17fGb8mn4/vfNun7nq4f33/Gt3pexVDBQAAgIz1+f9w9HKH9bpkZS1ZEnzigRN3PxWt7zexfX07dNeR298/eSBe/43a9t8aF/3zvX2NNdTsum92/XckU7/z+u/6eR7+6rO/XHrr5vuf9C8573CIChOp7UJhYiKEY1PN7V3R1kK5slp95/2V2tLJzZ/3jSKdf3b1fn1Bv9v8RzPV89b/d3/i8z8b7O/lHYyF7F9tfbvY/qdMB+n8Nx7Lf/KlqKv8xzL18vK/4+nt53+1pZd3kD0jlyKdf/NC3Nd6QLE5ANTz/2Z/fv47Mu3n5f/9qXOPntjE93/q48xwVO/rQGoEeDku3+ArTGSk828GkRo641/kRtf//zL5X5NpPy//Oyv/+N3ferj/bzT+j0/10uabRzr/ZhDF1BHr1/9IIf/6vzbTfl7+vz3152c/2dO9uj3/ev/H3f+7ks4/vhGnB8/Gb7Lb8X9npv28/HeN3ffQwib6/eHBuJ9DURhr+dbpufotbGh9vboxpanvXt7ESd4E0vk3f2upS2eo+dK4/ofzx/9dmfbz8n9oz9ffc7qn7/92Hv8njf9dSec/2Ci7lPxfyuS/O9N+Xv4/PP33v9x3mcf/+vZB+Xclnf/Wtv3rz38KXc3/rsvUz3v+s2/0qUf+2sP8P+lfct7k+U/yHGI8aj7/obN0/ldteFy39/89mXp51/+3/vP80/t7Gf+jAU8AepDOf1uzsMMEsNv8r8+0n5f/F+758sf/tIn5X+MT30CSf8v8f0uz/Kjxvyvp/Lc3C1P/GOrBxv8b9/+oPff/ZvK/IdN+Xv4XDk30f+Uy3//r/R/v8Cibdun8hzY8rp7/77u4/9+YqZeX/xf3/vTFm3v6/B/CpLn+pqXzv3rD4xrX/0B+/jdl6uXl/51v/PqJB3vo/9t7qEs2/+a9PnU5xZ/Nu53/FzPt5+X/o/HzZ/dfgfnfre7/XUnn31w1v5T8s/P/vZn28/L/3pEfrPRfgec/d8gfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgU0bj1+EQFSZS24XCxEQIY/H2rrA1mimdnJ4pV2Y/sxrCjri8GEaj+XJlplSeXliqnJybLpXLldkQron37wgD0Wq5Up1eLC1fe7GtwejUXGmlOjNXqoYQdsbl14ftSVszC9XF0nLj2KTOVVHps7VKtTRRW51bCbsvlm9LyudXKrXl6y62dXWhsrJ8qrQ0fXJh5d2Tk5OTYc/FPo9Ecw9U55aqzd4299brJHWHo5Y309h9Q8v5Pl2prSyVyo3yG1vqlCuzpXJLnZtazlddqS3Nlqpz0+XKfHK+YkvdlvfW2L033jceRlLvL6mbdTB+vf3Q8Y8eP3ygbX8xSue9VFucm9ze+W8CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDeuJ29717dDCH3NrUII4WDyQxT/l3L23heeO3bm8L4zU48/9syF+aOdjgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVh535equjiOACfGd/7WiCltBFyGRgiojsJC/pFJJXXyJZtWge1SsigKDCMaFkQBEHtooKgVVD5F0QtXLaqNrVoYRBBxehMXu4IN7zQMed5YDgzzL1nvjBw78z5HA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD6cXbHYlfWXtq1eWnr7g+hMz/3fwhhNFne/7y3I/SEEL5+mTkdVmkLPU39v5mcGy9fNfm9t3/84fXRZO31F98trtsdknSo4XhnkqZDQ2vvf6O6M/hsejAJIY1dCFEsjD05UwshdMQuhCh+fpy/mP2+/xe7EKLo/3C3K7v/tdiFEMXW3Z/6avkzHtVzvn5hsPG/v9UjeBuP6KxDb09eeZe6qZX3Mn//T/LN+2A1zJ448v557CKIZnZu6mjsGgAAgL/rXIv8P2xZ3r9/OQk93eXc/1tT/t/b1P/q+f+Ke9tvjM20FUJsK41NZsfD+9rpc+M7NXD19uua8Z6qkv9Xm/y/2uT/1Sb/rzb5f7XJ/8m8kv9X0uObexZfxC6CaOT/AABQPYeOT0zVh0eyl/9NPzrLeX1f3tbzPP3BremBRw3jRvLDf9vhYxMHDg6P5Pe9PCC4sv5DunT2ez7fo7ktTDbNu2i1/kPv04X5a53lT9T/cP5GUV9xXes/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC/2J17GgbBKAyj321F1EarogkLPwk+0MCIAKQwowEdTBiAgRBQwEDOWe5NnuUFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnu9f5XXx/aUx0muNSFPZZdf+OZ5mP3PfDsv77HHjVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjYgQMZAAAAAGH+1nm0HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKcCAAD//wTsyzo=")
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
mkdirat(0xffffffffffffff9c, 0x0, 0x51)
mount(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0)
creat(0x0, 0x6a)
r1 = landlock_create_ruleset(0x0, 0x0, 0x0)
landlock_restrict_self(r1, 0x4)
truncate(&(0x7f0000000240)='./file0\x00', 0x1)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r2 = geteuid()
syz_mount_image$vfat(&(0x7f0000000480), &(0x7f00000004c0)='./file1\x00', 0x2000884, &(0x7f0000000700)={[{@shortname_winnt}, {@shortname_mixed}, {@shortname_lower}, {@iocharset={'iocharset', 0x3d, 'cp852'}}, {@shortname_winnt}, {@shortname_winnt}, {@shortname_winnt}, {@utf8}, {@nonumtail}, {@fat=@sys_immutable}, {}, {@shortname_lower}, {@iocharset={'iocharset', 0x3d, 'macgreek'}}, {@utf8}, {@numtail}, {@utf8no}], [{@smackfsdef}, {@uid_gt={'uid>', r2}}, {@smackfstransmute={'smackfstransmute', 0x3d, '@+B\''}}, {@euid_gt={'euid>', r2}}, {@fsname={'fsname', 0x3d, 'nonumtail=0'}}, {@euid_gt}, {@permit_directio}, {@appraise}, {@rootcontext={'rootcontext', 0x3d, 'root'}}, {@subj_type={'subj_type', 0x3d, 'shortname=lower'}}]}, 0x1, 0x289, &(0x7f0000000cc0)="$eJzs3c1qA1UUAOAzzaRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE7hx6/O4EV/AB1Dc2YU4ks7kTyctkbQp+n2bHs69J/fM3KHtZm4+eWVwfnpxdXbz5c/RbCaxdRAHcZtEJ7Zi4uuo9NOv1XkA4Jm7zfP4LS80itT14oz6ksp069GbAwAexfzf/033AgA8jfc/+PCdw+Pjo/eyrBkx+GbYTaL4WYwfnsVn0Y9e7EU7/ojIp4r4rbePjyLNxjrx2mA07I4rBx//UH7+4S8Rd/X70Y5Odf1+VpirHw279XihXP+gH713v492vFRd/8as/jYv66O7Ha+/Otf/brTjx0/jIvpxGsX/OpP6r/az7M3829+/+GicHdcno2G3EacLdyqvPfXeAAAAAAAAAAAAAAAAAAAAAADw37WbTXUWz9+ZHPx/z/g95wON5s7n2cuyLE+K+bP6NF5OI93ktQMAAAAAAAAAAAAAAAAAAMBzcXX9+flJv9+7XGswea2/Yij+XMw0ImLJ56QPr7WzaodRK1vrJxGrXVc9GneVD0+urXjHWuN+epdJGuvbgmSaac0P7USx1jjTKoK5zGpLfPfPjWvGXTB5us5PkmWbOwmaVQ/JGoK84vGrLa3a/numVV5BxeTWPatvv/ives7bS4aSiKhPb2Y51KqeXF/vPXy630EAAAAAAAAAAAAAAAAAAEBh9tJvxeDNBhoCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgA2Yff//CsGoLF42J6+NgzTKzIYvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BvwIAAP//XAxp4w==")
getdents(0xffffffffffffffff, 0x0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x24040084)

192.18617ms ago: executing program 4 (id=76):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c)
gettimeofday(0x0, 0x0)
r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macvlan0\x00', <r3=>0x0})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x4c, 0x10, 0x503, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x220, 0x4000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x10, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x1}}]}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x4c}}, 0x20000090)
pselect6(0x40, &(0x7f0000000680)={0x8, 0x7, 0x0, 0xfffffffffffffff9, 0x916, 0xae3, 0x7, 0x8}, 0x0, 0x0, 0x0, 0x0)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a, 0x3}, 0x9c)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
ptrace$getregset(0x4204, 0x0, 0x6, &(0x7f0000000480)={&(0x7f00000008c0)=""/203, 0x118})
shutdown(r1, 0x2)

0s ago: executing program 2 (id=77):
close(0xffffffffffffffff)
r0 = socket$inet6(0xa, 0x80002, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r1, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x51}})
mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0)
socket$inet6(0xa, 0x800000000000002, 0x0)
munmap(&(0x7f0000001000/0x3000)=nil, 0x3000)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, 0x0, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffd, 0x6b}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x44001}, 0x4000054)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00')
read$midi(r2, &(0x7f00000001c0)=""/70, 0xffffffd8)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.77' (ED25519) to the list of known hosts.
[   91.266775][ T1125] cfg80211: failed to load regulatory.db
[   92.676930][ T5594] cgroup: Unknown subsys name 'net'
[   92.807931][ T5594] cgroup: Unknown subsys name 'cpuset'
[   92.817424][ T5594] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   94.545212][ T5594] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   97.213615][ T5618] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   97.221643][ T5618] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   97.235390][ T5622] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   97.257665][ T5624] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   97.266008][ T5630] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   97.272925][ T5624] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   97.274376][ T5624] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   97.282782][ T5630] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   97.296003][ T5630] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   97.299737][ T5631] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   97.304982][ T5630] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   97.314116][ T5624] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   97.328057][ T5624] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   97.336345][ T5633] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   97.336558][ T5624] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   97.344210][ T5633] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   97.352527][ T5624] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   97.357587][ T5630] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   97.367562][ T5624] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   97.374090][ T5630] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   97.379731][ T5624] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   97.385374][ T5633] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   97.395614][ T5624] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   97.400142][ T5633] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   97.408416][ T5617] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   97.415134][ T5633] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   97.422953][ T5617] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   97.436783][ T5617] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   97.445459][ T5633] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   97.452911][ T5633] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   99.504223][ T5623] Bluetooth: hci5: command tx timeout
[   99.510773][ T4924] Bluetooth: hci4: command tx timeout
[   99.516723][   T50] Bluetooth: hci2: command tx timeout
[   99.516803][ T5622] Bluetooth: hci1: command tx timeout
[   99.524016][ T5617] Bluetooth: hci3: command tx timeout
[   99.534389][ T5633] Bluetooth: hci0: command tx timeout
[  100.085369][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state
[  100.093445][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state
[  100.100799][ T5615] bridge_slave_0: entered allmulticast mode
[  100.109357][ T5615] bridge_slave_0: entered promiscuous mode
[  100.174011][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state
[  100.181214][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state
[  100.188451][ T5615] bridge_slave_1: entered allmulticast mode
[  100.196050][ T5615] bridge_slave_1: entered promiscuous mode
[  100.228868][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state
[  100.236095][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state
[  100.243419][ T5613] bridge_slave_0: entered allmulticast mode
[  100.250970][ T5613] bridge_slave_0: entered promiscuous mode
[  100.323304][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state
[  100.330639][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state
[  100.337926][ T5613] bridge_slave_1: entered allmulticast mode
[  100.345572][ T5613] bridge_slave_1: entered promiscuous mode
[  100.353339][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state
[  100.360469][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state
[  100.367695][ T5614] bridge_slave_0: entered allmulticast mode
[  100.375342][ T5614] bridge_slave_0: entered promiscuous mode
[  100.418828][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  100.448260][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state
[  100.456536][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state
[  100.463807][ T5614] bridge_slave_1: entered allmulticast mode
[  100.471310][ T5614] bridge_slave_1: entered promiscuous mode
[  100.491115][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state
[  100.498413][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state
[  100.505800][ T5616] bridge_slave_0: entered allmulticast mode
[  100.513551][ T5616] bridge_slave_0: entered promiscuous mode
[  100.523982][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  100.591932][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state
[  100.599215][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state
[  100.606430][ T5616] bridge_slave_1: entered allmulticast mode
[  100.614055][ T5616] bridge_slave_1: entered promiscuous mode
[  100.643204][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  100.665513][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state
[  100.672646][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state
[  100.680241][ T5611] bridge_slave_0: entered allmulticast mode
[  100.687956][ T5611] bridge_slave_0: entered promiscuous mode
[  100.710047][ T5615] team0: Port device team_slave_0 added
[  100.732500][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  100.745071][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  100.754388][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state
[  100.761552][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state
[  100.768898][ T5611] bridge_slave_1: entered allmulticast mode
[  100.776595][ T5611] bridge_slave_1: entered promiscuous mode
[  100.798969][ T5615] team0: Port device team_slave_1 added
[  100.833420][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  100.858192][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  100.880650][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state
[  100.888015][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state
[  100.895843][ T5612] bridge_slave_0: entered allmulticast mode
[  100.903558][ T5612] bridge_slave_0: entered promiscuous mode
[  100.954695][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  100.976911][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state
[  100.984334][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state
[  100.991478][ T5612] bridge_slave_1: entered allmulticast mode
[  100.999363][ T5612] bridge_slave_1: entered promiscuous mode
[  101.008681][ T5613] team0: Port device team_slave_0 added
[  101.029886][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  101.052752][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0
[  101.059742][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.085910][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  101.114065][ T5613] team0: Port device team_slave_1 added
[  101.135455][ T5614] team0: Port device team_slave_0 added
[  101.144413][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  101.180572][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1
[  101.187689][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.213655][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  101.241379][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  101.253403][ T5614] team0: Port device team_slave_1 added
[  101.275704][ T5616] team0: Port device team_slave_0 added
[  101.305233][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  101.329337][ T5611] team0: Port device team_slave_0 added
[  101.337530][ T5616] team0: Port device team_slave_1 added
[  101.345369][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0
[  101.352333][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.378628][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  101.418457][ T5611] team0: Port device team_slave_1 added
[  101.450952][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1
[  101.458142][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.484328][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  101.511649][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0
[  101.518646][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.545196][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  101.583217][ T5617] Bluetooth: hci1: command tx timeout
[  101.593594][ T5617] Bluetooth: hci3: command tx timeout
[  101.593995][ T5633] Bluetooth: hci0: command tx timeout
[  101.599033][ T5622] Bluetooth: hci2: command tx timeout
[  101.599160][ T5622] Bluetooth: hci4: command tx timeout
[  101.604722][   T50] Bluetooth: hci5: command tx timeout
[  101.617197][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0
[  101.628178][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.654456][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  101.677725][ T5612] team0: Port device team_slave_0 added
[  101.684166][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1
[  101.691172][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.717691][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  101.756050][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1
[  101.763128][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.789310][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  101.804253][ T5612] team0: Port device team_slave_1 added
[  101.819113][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0
[  101.826222][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.852154][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  101.871099][ T5615] hsr_slave_0: entered promiscuous mode
[  101.877745][ T5615] hsr_slave_1: entered promiscuous mode
[  101.922382][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1
[  101.929425][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  101.955385][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  102.006451][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0
[  102.013474][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  102.039924][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  102.117938][ T5613] hsr_slave_0: entered promiscuous mode
[  102.124732][ T5613] hsr_slave_1: entered promiscuous mode
[  102.130995][ T5613] debugfs: 'hsr0' already exists in 'hsr'
[  102.137364][ T5613] Cannot create hsr debugfs directory
[  102.143838][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1
[  102.150854][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  102.177170][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  102.242282][ T5614] hsr_slave_0: entered promiscuous mode
[  102.249138][ T5614] hsr_slave_1: entered promiscuous mode
[  102.256403][ T5614] debugfs: 'hsr0' already exists in 'hsr'
[  102.262124][ T5614] Cannot create hsr debugfs directory
[  102.306852][ T5616] hsr_slave_0: entered promiscuous mode
[  102.313670][ T5616] hsr_slave_1: entered promiscuous mode
[  102.319905][ T5616] debugfs: 'hsr0' already exists in 'hsr'
[  102.326126][ T5616] Cannot create hsr debugfs directory
[  102.363201][ T5611] hsr_slave_0: entered promiscuous mode
[  102.369742][ T5611] hsr_slave_1: entered promiscuous mode
[  102.376114][ T5611] debugfs: 'hsr0' already exists in 'hsr'
[  102.381836][ T5611] Cannot create hsr debugfs directory
[  102.590915][ T5612] hsr_slave_0: entered promiscuous mode
[  102.597682][ T5612] hsr_slave_1: entered promiscuous mode
[  102.604155][ T5612] debugfs: 'hsr0' already exists in 'hsr'
[  102.609875][ T5612] Cannot create hsr debugfs directory
[  103.165018][ T5615] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  103.182179][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  103.199956][ T5615] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  103.209959][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  103.218754][ T5615] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  103.230634][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  103.248585][ T5615] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  103.259354][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  103.337188][ T5616] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  103.348411][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  103.358232][ T5616] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  103.369432][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  103.378412][ T5616] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  103.388957][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  103.410680][ T5616] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  103.420669][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  103.512054][ T5614] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  103.522577][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  103.539838][ T5614] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  103.550505][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  103.561723][ T5614] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  103.572626][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  103.581692][ T5614] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  103.591996][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  103.663407][ T5617] Bluetooth: hci3: command tx timeout
[  103.663615][ T4924] Bluetooth: hci5: command tx timeout
[  103.668850][ T5622] Bluetooth: hci4: command tx timeout
[  103.668886][ T5622] Bluetooth: hci2: command tx timeout
[  103.668919][ T5622] Bluetooth: hci1: command tx timeout
[  103.691692][ T5633] Bluetooth: hci0: command tx timeout
[  103.735768][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0
[  103.749318][ T5611] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  103.760200][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  103.768507][ T5611] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  103.779205][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  103.788145][ T5611] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  103.798815][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  103.808336][ T5611] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  103.818533][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  103.907543][ T5615] 8021q: adding VLAN 0 to HW filter on device team0
[  103.961336][   T47] bridge0: port 1(bridge_slave_0) entered blocking state
[  103.968847][   T47] bridge0: port 1(bridge_slave_0) entered forwarding state
[  104.009135][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0
[  104.035571][ T5613] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  104.049949][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  104.058808][ T5613] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  104.072070][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  104.080370][ T5613] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  104.092356][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  104.102600][   T47] bridge0: port 2(bridge_slave_1) entered blocking state
[  104.109733][   T47] bridge0: port 2(bridge_slave_1) entered forwarding state
[  104.130100][ T5613] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  104.140907][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  104.237650][ T5616] 8021q: adding VLAN 0 to HW filter on device team0
[  104.279111][ T1142] bridge0: port 1(bridge_slave_0) entered blocking state
[  104.286291][ T1142] bridge0: port 1(bridge_slave_0) entered forwarding state
[  104.334134][   T13] bridge0: port 2(bridge_slave_1) entered blocking state
[  104.341323][   T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[  104.351696][ T5612] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  104.362251][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  104.370784][ T5612] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  104.381259][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  104.389767][ T5612] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  104.400353][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  104.412572][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0
[  104.427717][ T5612] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  104.437958][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  104.551039][ T5614] 8021q: adding VLAN 0 to HW filter on device team0
[  104.594738][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0
[  104.611073][   T13] bridge0: port 1(bridge_slave_0) entered blocking state
[  104.618381][   T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[  104.672180][   T13] bridge0: port 2(bridge_slave_1) entered blocking state
[  104.679424][   T13] bridge0: port 2(bridge_slave_1) entered forwarding state
[  104.792922][ T5611] 8021q: adding VLAN 0 to HW filter on device team0
[  104.866536][ T1142] bridge0: port 1(bridge_slave_0) entered blocking state
[  104.873748][ T1142] bridge0: port 1(bridge_slave_0) entered forwarding state
[  104.928153][ T1142] bridge0: port 2(bridge_slave_1) entered blocking state
[  104.935373][ T1142] bridge0: port 2(bridge_slave_1) entered forwarding state
[  104.961207][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0
[  105.056467][ T5613] 8021q: adding VLAN 0 to HW filter on device team0
[  105.111573][   T47] bridge0: port 1(bridge_slave_0) entered blocking state
[  105.118979][   T47] bridge0: port 1(bridge_slave_0) entered forwarding state
[  105.172095][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0
[  105.248530][   T47] bridge0: port 2(bridge_slave_1) entered blocking state
[  105.255740][   T47] bridge0: port 2(bridge_slave_1) entered forwarding state
[  105.329990][ T5612] 8021q: adding VLAN 0 to HW filter on device team0
[  105.372022][  T672] bridge0: port 1(bridge_slave_0) entered blocking state
[  105.379236][  T672] bridge0: port 1(bridge_slave_0) entered forwarding state
[  105.476727][  T145] bridge0: port 2(bridge_slave_1) entered blocking state
[  105.483944][  T145] bridge0: port 2(bridge_slave_1) entered forwarding state
[  105.710139][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0
[  105.743687][ T5633] Bluetooth: hci0: command tx timeout
[  105.749148][   T50] Bluetooth: hci3: command tx timeout
[  105.749216][ T5623] Bluetooth: hci4: command tx timeout
[  105.755106][ T4924] Bluetooth: hci5: command tx timeout
[  105.760283][ T5622] Bluetooth: hci2: command tx timeout
[  105.771336][ T5617] Bluetooth: hci1: command tx timeout
[  106.028076][ T5615] veth0_vlan: entered promiscuous mode
[  106.106055][ T5615] veth1_vlan: entered promiscuous mode
[  106.155286][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0
[  106.360491][ T5615] veth0_macvtap: entered promiscuous mode
[  106.428400][ T5615] veth1_macvtap: entered promiscuous mode
[  106.522444][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0
[  106.572066][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1
[  106.601206][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0
[  106.636826][ T5616] veth0_vlan: entered promiscuous mode
[  106.712636][ T5616] veth1_vlan: entered promiscuous mode
[  106.835025][  T672] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  106.890575][  T145] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  106.955333][   T47] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  107.100557][   T47] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  107.113550][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0
[  107.135304][   T47] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  107.148835][ T5616] veth0_macvtap: entered promiscuous mode
[  107.231049][ T5616] veth1_macvtap: entered promiscuous mode
[  107.305032][   T36] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  107.316014][  T145] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  107.356193][  T145] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  107.384055][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0
[  107.427984][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0
[  107.495050][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1
[  107.573778][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0
[  107.589843][ T5615] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[  107.645750][ T1005] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  107.677762][ T1142] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  107.743781][   T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  107.777119][ T5612] veth0_vlan: entered promiscuous mode
[  107.851060][ T5612] veth1_vlan: entered promiscuous mode
[  107.968752][ T5614] veth0_vlan: entered promiscuous mode
[  108.000283][  T672] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  108.013831][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  108.018643][  T672] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  108.037056][ T5614] veth1_vlan: entered promiscuous mode
[  108.085308][ T5613] veth0_vlan: entered promiscuous mode
[  108.153353][ T5613] veth1_vlan: entered promiscuous mode
[  108.182686][ T1005] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  108.192367][ T1005] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  108.204741][ T5612] veth0_macvtap: entered promiscuous mode
[  108.275770][ T5612] veth1_macvtap: entered promiscuous mode
[  108.316535][ T5614] veth0_macvtap: entered promiscuous mode
[  108.327710][ T5611] veth0_vlan: entered promiscuous mode
[  108.382572][ T5614] veth1_macvtap: entered promiscuous mode
[  108.432175][ T5613] veth0_macvtap: entered promiscuous mode
[  108.704902][ T5611] veth1_vlan: entered promiscuous mode
[  109.300977][ T5611] veth0_macvtap: entered promiscuous mode
[  109.468951][ T5611] veth1_macvtap: entered promiscuous mode
[  109.481733][ T5613] veth1_macvtap: entered promiscuous mode
[  109.624887][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0
[  109.649092][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0
[  109.924223][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1
[  110.745594][ T5862] overlay: Unknown parameter '/'
[  110.875914][ T5864] input: syz0 as /devices/virtual/input/input5
[  110.948507][  T145] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  111.076071][   T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  111.304966][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0
[  111.318904][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1
[  111.366696][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0
[  111.409023][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1
[  111.467256][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1
[  111.566828][ T1142] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  111.752033][ T3368] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  111.814241][  T145] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  111.835412][ T5875] Zero length message leads to an empty skb
[  111.880766][  T145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  111.898242][   T30] audit: type=1804 audit(1786364300.352:2): pid=5875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.15" name="/newroot/4/config/usb_gadget/g1/functions/midi2.usb0/iface_name" dev="configfs" ino=9017 res=1 errno=0
[  111.926799][   T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  111.932646][  T145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.946938][   T30] audit: type=1800 audit(1786364300.352:3): pid=5875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.15" name="iface_name" dev="configfs" ino=9017 res=0 errno=0
[  111.968280][   T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  112.011405][ T3368] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  112.019758][   T65] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  112.029379][   T65] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  112.040353][ T3368] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  112.051597][   T65] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  112.067253][   T65] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  112.076652][   T65] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  112.086881][   T65] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  112.230791][   T65] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  112.247223][   T65] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  112.256127][   T65] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  112.273443][  T145] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  112.289411][  T145] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  112.417174][   T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  112.447845][   T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  112.490610][   T65] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  112.531893][ T1142] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  112.540503][ T1142] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  112.550636][   T65] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  112.581029][ T5881] capability: warning: `syz.0.17' uses deprecated v2 capabilities in a way that may be insecure
[  113.220777][ T3368] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  113.251853][ T3368] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  113.308126][   T47] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  113.333386][   T47] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  114.912439][ T5895] loop3: detected capacity change from 0 to 32768
[  114.941825][ T5895] (syz.3.21,5895,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  114.959415][ T5895] (syz.3.21,5895,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  115.008747][ T5895] JBD2: Ignoring recovery information on journal
[  115.132287][ T5895] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode.
[  116.085025][ T5912] loop5: detected capacity change from 0 to 32768
[  116.101661][ T5912] (syz.5.22,5912,0):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  116.115874][ T5912] (syz.5.22,5912,0):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  116.263627][ T5894] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  116.301847][ T5912] debugfs: '9357E9D751824C228242B9B0D0FB6750' already exists in 'ocfs2'
[  116.523357][ T5912] JBD2: Ignoring recovery information on journal
[  116.884943][ T5912] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode.
[  116.962313][   T30] audit: type=1800 audit(1786364305.392:4): pid=5910 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.20" name="zoned" dev="configfs" ino=7921 res=0 errno=0
[  116.989192][   T30] audit: type=1800 audit(1786364305.402:5): pid=5907 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.20" name="power" dev="configfs" ino=9735 res=0 errno=0
[  117.477511][   T30] audit: type=1800 audit(1786364305.712:6): pid=5910 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.20" name="power" dev="configfs" ino=7932 res=0 errno=0
[  117.636086][ T5615] ocfs2: Unmounting device (7,3) on (node local)
[  117.983871][ T5923] syz.4.24 calls setitimer() with new_value NULL pointer. Misfeature support will be removed
[  118.052388][ T5923] loop4: detected capacity change from 0 to 512
[  118.066365][ T5923] =======================================================
[  118.066365][ T5923] WARNING: The mand mount option has been deprecated and
[  118.066365][ T5923]          and is ignored by this kernel. Remove the mand
[  118.066365][ T5923]          option from the mount to silence this warning.
[  118.066365][ T5923] =======================================================
[  118.748389][ T5923] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[  118.808682][ T5923] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters
[  118.833137][    C0] EXT4-fs (loop4): error count since last fsck: 1
[  118.840049][    C0] EXT4-fs (loop4): initial error at time 1786364307: ext4_mb_generate_buddy:1314
[  118.849214][    C0] EXT4-fs (loop4): last error at time 1786364307: ext4_mb_generate_buddy:1314
[  118.858222][ T5923] EXT4-fs (loop4): Remounting filesystem read-only
[  118.865999][ T5923] EXT4-fs (loop4): 1 truncate cleaned up
[  118.873600][ T5923] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  119.056651][ T5614] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  119.143142][ T5611] ocfs2: Unmounting device (7,5) on (node local)
[  123.402521][ T5954] loop2: detected capacity change from 0 to 512
[  124.421522][ T5954] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters
[  124.436719][ T5954] EXT4-fs (loop2): Remounting filesystem read-only
[  124.443279][    C1] EXT4-fs (loop2): error count since last fsck: 1
[  124.443308][    C1] EXT4-fs (loop2): initial error at time 1786364312: ext4_mb_generate_buddy:1314
[  124.443339][    C1] EXT4-fs (loop2): last error at time 1786364312: ext4_mb_generate_buddy:1314
[  124.470349][ T5954] EXT4-fs (loop2): 1 truncate cleaned up
[  124.477929][ T5954] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  125.416827][ T5954] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  125.884215][    T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!!
[  126.293348][    T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!!
[  128.443344][    T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!!
[  129.348203][ T5988] loop1: detected capacity change from 0 to 32768
[  129.372899][ T5988] (syz.1.36,5988,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  129.394777][ T5988] (syz.1.36,5988,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  129.502715][ T5988] JBD2: Ignoring recovery information on journal
[  129.554648][ T5988] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  130.662246][ T6015] netlink: 28 bytes leftover after parsing attributes in process `syz.2.39'.
[  131.473182][  T977] IPVS: starting estimator thread 0...
[  131.563853][ T6021] IPVS: using max 30 ests per chain, 72000 per kthread
[  131.577822][ T5613] ocfs2: Unmounting device (7,1) on (node local)
[  132.240202][ T1301] ieee802154 phy0 wpan0: encryption failed: -22
[  132.429314][ T1301] ieee802154 phy1 wpan1: encryption failed: -22
[  132.698710][ T6033] process 'syz.1.42' launched '/dev/fd/7' with NULL argv: empty string added
[  132.841259][ T6037] random: crng reseeded on system resumption
[  133.564227][    T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!!
[  134.381632][ T6049] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 1000003 out of range (51000000..2150000000)
[  135.663636][ T6062] loop1: detected capacity change from 0 to 512
[  135.711141][ T6062] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters
[  135.732986][    C0] EXT4-fs (loop1): error count since last fsck: 1
[  135.739457][    C0] EXT4-fs (loop1): initial error at time 1786364324: ext4_mb_generate_buddy:1314
[  135.748632][    C0] EXT4-fs (loop1): last error at time 1786364324: ext4_mb_generate_buddy:1314
[  135.859829][ T6063] capability: warning: `syz.4.50' uses 32-bit capabilities (legacy support in use)
[  135.988567][ T6062] EXT4-fs (loop1): Remounting filesystem read-only
[  135.995491][ T6062] EXT4-fs (loop1): 1 truncate cleaned up
[  136.002831][ T6062] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  137.002015][ T6062] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  138.931582][ T6088] loop1: detected capacity change from 0 to 32768
[  139.940522][ T6088] (syz.1.54,6088,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  140.013158][ T6088] (syz.1.54,6088,1):ocfs2_block_check_validate:400 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  140.383353][ T6088] JBD2: Ignoring recovery information on journal
[  140.920852][ T6088] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  141.836099][ T6105] loop3: detected capacity change from 0 to 512
[  142.970389][ T6105] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters
[  142.992977][    C1] EXT4-fs (loop3): error count since last fsck: 1
[  142.999543][    C1] EXT4-fs (loop3): initial error at time 1786364331: ext4_mb_generate_buddy:1314
[  143.008825][    C1] EXT4-fs (loop3): last error at time 1786364331: ext4_mb_generate_buddy:1314
[  143.017890][ T6105] EXT4-fs (loop3): Remounting filesystem read-only
[  143.024786][ T6105] EXT4-fs (loop3): 1 truncate cleaned up
[  143.034517][ T6105] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  143.376864][ T6105] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  143.394592][ T5613] ocfs2: Unmounting device (7,1) on (node local)
[  143.710151][ T6118] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  146.575201][ T5622] Bluetooth: hci3: link tx timeout
[  146.582936][ T5622] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa
[  147.368630][ T5623] Bluetooth: hci3: link tx timeout
[  147.374077][ T5623] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa
[  147.425793][ T5623] Bluetooth: hci3: link tx timeout
[  147.431324][ T5623] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa
[  147.537070][ T6143] loop5: detected capacity change from 0 to 512
[  147.588839][ T6143] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters
[  147.612983][    C0] EXT4-fs (loop5): error count since last fsck: 1
[  147.619450][    C0] EXT4-fs (loop5): initial error at time 1786364336: ext4_mb_generate_buddy:1314
[  147.628639][    C0] EXT4-fs (loop5): last error at time 1786364336: ext4_mb_generate_buddy:1314
[  147.670332][ T6143] EXT4-fs (loop5): Remounting filesystem read-only
[  147.677258][ T6143] EXT4-fs (loop5): 1 truncate cleaned up
[  147.683540][ T5623] Bluetooth: hci3: link tx timeout
[  147.685300][ T6143] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  147.689282][ T5623] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa
[  147.845478][ T5623] Bluetooth: hci3: link tx timeout
[  147.850692][ T5623] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa
[  148.672232][ T6161] xt_hashlimit: size too large, truncated to 1048576
[  148.952786][ T5623] Bluetooth: hci3: command 0x0406 tx timeout
[  148.995599][ T5623] Bluetooth: hci3: link tx timeout
[  149.000775][ T5623] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa
[  149.478002][ T6143] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  149.763074][ T6156] loop3: detected capacity change from 0 to 512
[  150.185361][ T6154] gfs2: not a GFS2 filesystem
[  150.195275][ T6154] hpfs: Bad magic ... probably not HPFS
[  150.267121][ T6156] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters
[  150.268619][ T6156] EXT4-fs (loop3): Remounting filesystem read-only
[  150.268868][ T6156] EXT4-fs (loop3): 1 truncate cleaned up
[  150.271236][ T6156] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  150.373185][ T6156] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  150.987433][ T6177] netlink: 220 bytes leftover after parsing attributes in process `syz.1.73'.
[  150.996618][ T6177] tc_dump_action: action bad kind
[  151.704025][ T6176] ==================================================================
[  151.712125][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  151.719069][ T6176] Read of size 1 at addr ffff88802b4c1780 by task syz.5.74/6176
[  151.726688][ T6176] 
[  151.729000][ T6176] CPU: 1 UID: 0 PID: 6176 Comm: syz.5.74 Not tainted syzkaller #0 PREEMPT(full) 
[  151.729035][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  151.729054][ T6176] Call Trace:
[  151.729064][ T6176]  <TASK>
[  151.729074][ T6176]  dump_stack_lvl+0x100/0x190
[  151.729109][ T6176]  print_report+0x13d/0x4b0
[  151.729153][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.729189][ T6176]  ? __virt_addr_valid+0x239/0x430
[  151.729228][ T6176]  ? string+0x471/0x4d0
[  151.729264][ T6176]  kasan_report+0xdf/0x1c0
[  151.729297][ T6176]  ? string+0x471/0x4d0
[  151.729338][ T6176]  string+0x471/0x4d0
[  151.729382][ T6176]  ? __pfx_string+0x10/0x10
[  151.729418][ T6176]  ? find_held_lock+0x2b/0x80
[  151.729464][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  151.729511][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.729548][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.729588][ T6176]  vsnprintf+0x422/0x1300
[  151.729635][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  151.729702][ T6176]  scnprintf+0xdb/0x150
[  151.729754][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  151.729800][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.729836][ T6176]  ? down_read+0x13b/0x4c0
[  151.729864][ T6176]  ? __pfx_down_read+0x10/0x10
[  151.729915][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  151.729954][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0
[  151.729992][ T6176]  configfs_read_iter+0x426/0x6f0
[  151.730023][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.730063][ T6176]  __kernel_read+0x397/0xad0
[  151.730102][ T6176]  ? __pfx___kernel_read+0x10/0x10
[  151.730158][ T6176]  integrity_kernel_read+0x7e/0xb0
[  151.730205][ T6176]  ? __pfx_integrity_kernel_read+0x10/0x10
[  151.730252][ T6176]  ? ima_calc_file_hash_tfm+0x236/0x350
[  151.730294][ T6176]  ima_calc_file_hash_tfm+0x25e/0x350
[  151.730334][ T6176]  ? __pfx_ima_calc_file_hash_tfm+0x10/0x10
[  151.730403][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.730440][ T6176]  ? ima_alloc_tfm+0x21a/0x2e0
[  151.730478][ T6176]  ima_calc_file_hash+0x1e3/0x380
[  151.730515][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.730554][ T6176]  ima_collect_measurement+0x94f/0xb30
[  151.730599][ T6176]  ? __pfx_ima_collect_measurement+0x10/0x10
[  151.730639][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.730672][ T6176]  ? lockdep_hardirqs_on+0x78/0x100
[  151.730727][ T6176]  ? xattr_resolve_name+0x256/0x3f0
[  151.730784][ T6176]  ? xattr_resolve_name+0x259/0x3f0
[  151.730840][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.730879][ T6176]  ? is_bad_inode+0xd/0x40
[  151.730915][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.730947][ T6176]  ? xattr_resolve_name+0x27d/0x3f0
[  151.730991][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.731024][ T6176]  ? vfs_getxattr_alloc+0xec/0x350
[  151.731071][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.731104][ T6176]  ? ima_get_hash_algo+0x241/0x400
[  151.731132][ T6176]  ? __pfx_ima_get_hash_algo+0x10/0x10
[  151.731159][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.731197][ T6176]  ? process_measurement+0xdfe/0x2350
[  151.731227][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.731260][ T6176]  process_measurement+0xdfe/0x2350
[  151.731299][ T6176]  ? __pfx_process_measurement+0x10/0x10
[  151.731331][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.731379][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.731431][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.731464][ T6176]  ? __configfs_open_file+0x6ca/0x9c0
[  151.731490][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.731526][ T6176]  ima_file_check+0xcc/0x120
[  151.731558][ T6176]  ? __pfx_ima_file_check+0x10/0x10
[  151.731595][ T6176]  security_file_post_open+0xc4/0x210
[  151.731631][ T6176]  path_openat+0x985/0x4280
[  151.731681][ T6176]  ? __pfx_path_openat+0x10/0x10
[  151.731728][ T6176]  do_file_open+0x20e/0x430
[  151.731767][ T6176]  ? __lock_acquire+0x49f/0x1a40
[  151.731800][ T6176]  ? __pfx_do_file_open+0x10/0x10
[  151.731861][ T6176]  ? _raw_spin_unlock+0x28/0x50
[  151.731908][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.731948][ T6176]  ? alloc_fd+0x471/0x7a0
[  151.731995][ T6176]  do_sys_openat2+0x10f/0x1e0
[  151.732022][ T6176]  ? __pfx_do_sys_openat2+0x10/0x10
[  151.732050][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.732090][ T6176]  __x64_sys_open+0xfe/0x1d0
[  151.732117][ T6176]  ? __pfx___x64_sys_open+0x10/0x10
[  151.732148][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  151.732185][ T6176]  do_syscall_64+0x115/0x870
[  151.732228][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  151.732257][ T6176] RIP: 0033:0x7f2f8859e0d9
[  151.732279][ T6176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  151.732305][ T6176] RSP: 002b:00007f2f89418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  151.732331][ T6176] RAX: ffffffffffffffda RBX: 00007f2f88825fa0 RCX: 00007f2f8859e0d9
[  151.732354][ T6176] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0
[  151.732372][ T6176] RBP: 00007f2f88635024 R08: 0000000000000000 R09: 0000000000000000
[  151.732389][ T6176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  151.732406][ T6176] R13: 00007f2f88826038 R14: 00007f2f88825fa0 R15: 00007ffd99a1bec8
[  151.732435][ T6176]  </TASK>
[  151.732445][ T6176] 
[  151.753202][   T30] audit: type=1804 audit(1786364339.902:7): pid=6176 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.74" name="/newroot/10/config/usb_gadget/g1/functions/midi2.usb0/iface_name" dev="configfs" ino=10338 res=1 errno=0
[  151.754827][ T6176] Allocated by task 6135:
[  151.754845][ T6176]  kasan_save_stack+0x30/0x50
[  152.275426][ T6176]  kasan_save_track+0x14/0x30
[  152.280113][ T6176]  __kasan_kmalloc+0xaa/0xb0
[  152.284729][ T6176]  __kmalloc_node_track_caller_noprof+0x331/0x830
[  152.291173][ T6176]  kstrndup+0x64/0x120
[  152.295262][ T6176]  f_midi2_opts_str_store.constprop.0+0xbf/0x240
[  152.301601][ T6176]  configfs_write_iter+0x302/0x4e0
[  152.306717][ T6176]  vfs_write+0x6ac/0x1050
[  152.311059][ T6176]  ksys_write+0x12a/0x250
[  152.315398][ T6176]  do_syscall_64+0x115/0x870
[  152.320007][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  152.325901][ T6176] 
[  152.328211][ T6176] Freed by task 6179:
[  152.332181][ T6176]  kasan_save_stack+0x30/0x50
[  152.336887][ T6176]  kasan_save_track+0x14/0x30
[  152.341568][ T6176]  kasan_save_free_info+0x3b/0x70
[  152.346609][ T6176]  __kasan_slab_free+0x5f/0x80
[  152.351389][ T6176]  kfree+0x22b/0x6c0
[  152.355296][ T6176]  f_midi2_opts_str_store.constprop.0+0xf0/0x240
[  152.361636][ T6176]  configfs_write_iter+0x302/0x4e0
[  152.366751][ T6176]  vfs_write+0x6ac/0x1050
[  152.371095][ T6176]  ksys_write+0x12a/0x250
[  152.375438][ T6176]  do_syscall_64+0x115/0x870
[  152.380049][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  152.385950][ T6176] 
[  152.388267][ T6176] The buggy address belongs to the object at ffff88802b4c1780
[  152.388267][ T6176]  which belongs to the cache kmalloc-32 of size 32
[  152.402142][ T6176] The buggy address is located 0 bytes inside of
[  152.402142][ T6176]  freed 32-byte region [ffff88802b4c1780, ffff88802b4c17a0)
[  152.415679][ T6176] 
[  152.417994][ T6176] The buggy address belongs to the physical page:
[  152.424393][ T6176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b4c1
[  152.433151][ T6176] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  152.440256][ T6176] page_type: f5(slab)
[  152.444238][ T6176] raw: 00fff00000000000 ffff88813fe1f780 dead000000000100 dead000000000122
[  152.452827][ T6176] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  152.461404][ T6176] page dumped because: kasan: bad access detected
[  152.467807][ T6176] page_owner tracks the page as allocated
[  152.473511][ T6176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11758506710, free_ts 0
[  152.492453][ T6176]  post_alloc_hook+0xfd/0x120
[  152.497147][ T6176]  get_page_from_freelist+0xf48/0x3530
[  152.502624][ T6176]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  152.508541][ T6176]  new_slab+0xa2/0x640
[  152.512627][ T6176]  refill_objects+0xe3/0x410
[  152.517236][ T6176]  __pcs_replace_empty_main+0x376/0x680
[  152.522802][ T6176]  __kmalloc_cache_noprof+0x479/0x6c0
[  152.528196][ T6176]  usb_get_device_descriptor+0x45/0xe0
[  152.533672][ T6176]  register_root_hub+0x146/0x639
[  152.538622][ T6176]  usb_add_hcd.cold+0xccd/0x1158
[  152.543584][ T6176]  dummy_hcd_probe+0x189/0x2fa
[  152.548393][ T6176]  platform_probe+0x106/0x1d0
[  152.553075][ T6176]  really_probe+0x241/0xa60
[  152.557601][ T6176]  __driver_probe_device+0x20e/0x450
[  152.562900][ T6176]  driver_probe_device+0x4a/0x140
[  152.567946][ T6176]  __device_attach_driver+0x1df/0x320
[  152.573340][ T6176] page_owner free stack trace missing
[  152.578694][ T6176] 
[  152.581004][ T6176] Memory state around the buggy address:
[  152.586625][ T6176]  ffff88802b4c1680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  152.594684][ T6176]  ffff88802b4c1700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  152.602741][ T6176] >ffff88802b4c1780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  152.610793][ T6176]                    ^
[  152.614859][ T6176]  ffff88802b4c1800: fa fb fb fb fc fc fc fc 00 00 00 01 fc fc fc fc
[  152.622918][ T6176]  ffff88802b4c1880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  152.630976][ T6176] ==================================================================
[  152.713751][    T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!!
[  153.482817][ T6176] Disabling lock debugging due to kernel taint
[  153.817555][ T6176] ==================================================================
[  153.825664][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  153.832619][ T6176] Read of size 1 at addr ffff88802b4c1781 by task syz.5.74/6176
[  153.840251][ T6176] 
[  153.842575][ T6176] CPU: 0 UID: 0 PID: 6176 Comm: syz.5.74 Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  153.842622][ T6176] Tainted: [B]=BAD_PAGE
[  153.842634][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  153.842654][ T6176] Call Trace:
[  153.842664][ T6176]  <TASK>
[  153.842676][ T6176]  dump_stack_lvl+0x100/0x190
[  153.842716][ T6176]  print_report+0x13d/0x4b0
[  153.842765][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.842806][ T6176]  ? __virt_addr_valid+0x239/0x430
[  153.842848][ T6176]  ? string+0x471/0x4d0
[  153.842888][ T6176]  kasan_report+0xdf/0x1c0
[  153.842925][ T6176]  ? string+0x471/0x4d0
[  153.842973][ T6176]  string+0x471/0x4d0
[  153.843015][ T6176]  ? __pfx_string+0x10/0x10
[  153.843053][ T6176]  ? find_held_lock+0x2b/0x80
[  153.843105][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  153.843171][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.843211][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.843255][ T6176]  vsnprintf+0x422/0x1300
[  153.843306][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  153.843362][ T6176]  scnprintf+0xdb/0x150
[  153.843407][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  153.843456][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.843496][ T6176]  ? down_read+0x13b/0x4c0
[  153.843525][ T6176]  ? __pfx_down_read+0x10/0x10
[  153.843581][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  153.843623][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0
[  153.843665][ T6176]  configfs_read_iter+0x426/0x6f0
[  153.843698][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.843741][ T6176]  __kernel_read+0x397/0xad0
[  153.843785][ T6176]  ? __pfx___kernel_read+0x10/0x10
[  153.843844][ T6176]  integrity_kernel_read+0x7e/0xb0
[  153.843896][ T6176]  ? __pfx_integrity_kernel_read+0x10/0x10
[  153.843947][ T6176]  ? ima_calc_file_hash_tfm+0x236/0x350
[  153.843992][ T6176]  ima_calc_file_hash_tfm+0x25e/0x350
[  153.844034][ T6176]  ? __pfx_ima_calc_file_hash_tfm+0x10/0x10
[  153.844103][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.844143][ T6176]  ? ima_alloc_tfm+0x21a/0x2e0
[  153.844185][ T6176]  ima_calc_file_hash+0x1e3/0x380
[  153.844224][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.844266][ T6176]  ima_collect_measurement+0x94f/0xb30
[  153.844315][ T6176]  ? __pfx_ima_collect_measurement+0x10/0x10
[  153.844363][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.844402][ T6176]  ? lockdep_hardirqs_on+0x78/0x100
[  153.844467][ T6176]  ? xattr_resolve_name+0x256/0x3f0
[  153.844516][ T6176]  ? xattr_resolve_name+0x259/0x3f0
[  153.844562][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.844602][ T6176]  ? is_bad_inode+0xd/0x40
[  153.844644][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.844684][ T6176]  ? xattr_resolve_name+0x27d/0x3f0
[  153.844735][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.844775][ T6176]  ? vfs_getxattr_alloc+0xec/0x350
[  153.844832][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.844871][ T6176]  ? ima_get_hash_algo+0x241/0x400
[  153.844904][ T6176]  ? __pfx_ima_get_hash_algo+0x10/0x10
[  153.844937][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.844981][ T6176]  ? process_measurement+0xdfe/0x2350
[  153.845017][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.845057][ T6176]  process_measurement+0xdfe/0x2350
[  153.845102][ T6176]  ? __pfx_process_measurement+0x10/0x10
[  153.845141][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.845190][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.845250][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.845290][ T6176]  ? __configfs_open_file+0x6ca/0x9c0
[  153.845321][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.845368][ T6176]  ima_file_check+0xcc/0x120
[  153.845406][ T6176]  ? __pfx_ima_file_check+0x10/0x10
[  153.845449][ T6176]  security_file_post_open+0xc4/0x210
[  153.845492][ T6176]  path_openat+0x985/0x4280
[  153.845551][ T6176]  ? __pfx_path_openat+0x10/0x10
[  153.845606][ T6176]  do_file_open+0x20e/0x430
[  153.845653][ T6176]  ? __lock_acquire+0x49f/0x1a40
[  153.845693][ T6176]  ? __pfx_do_file_open+0x10/0x10
[  153.845758][ T6176]  ? _raw_spin_unlock+0x28/0x50
[  153.845798][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.845838][ T6176]  ? alloc_fd+0x471/0x7a0
[  153.845895][ T6176]  do_sys_openat2+0x10f/0x1e0
[  153.845928][ T6176]  ? __pfx_do_sys_openat2+0x10/0x10
[  153.845961][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.846008][ T6176]  __x64_sys_open+0xfe/0x1d0
[  153.846040][ T6176]  ? __pfx___x64_sys_open+0x10/0x10
[  153.846078][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  153.846122][ T6176]  do_syscall_64+0x115/0x870
[  153.846172][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  153.846206][ T6176] RIP: 0033:0x7f2f8859e0d9
[  153.846232][ T6176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  153.846264][ T6176] RSP: 002b:00007f2f89418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  153.846295][ T6176] RAX: ffffffffffffffda RBX: 00007f2f88825fa0 RCX: 00007f2f8859e0d9
[  153.846318][ T6176] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0
[  153.846343][ T6176] RBP: 00007f2f88635024 R08: 0000000000000000 R09: 0000000000000000
[  153.846364][ T6176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  153.846384][ T6176] R13: 00007f2f88826038 R14: 00007f2f88825fa0 R15: 00007ffd99a1bec8
[  153.846418][ T6176]  </TASK>
[  153.846429][ T6176] 
[  154.361265][ T6176] Allocated by task 6135:
[  154.365586][ T6176]  kasan_save_stack+0x30/0x50
[  154.370291][ T6176]  kasan_save_track+0x14/0x30
[  154.374967][ T6176]  __kasan_kmalloc+0xaa/0xb0
[  154.379577][ T6176]  __kmalloc_node_track_caller_noprof+0x331/0x830
[  154.386018][ T6176]  kstrndup+0x64/0x120
[  154.390104][ T6176]  f_midi2_opts_str_store.constprop.0+0xbf/0x240
[  154.396441][ T6176]  configfs_write_iter+0x302/0x4e0
[  154.401550][ T6176]  vfs_write+0x6ac/0x1050
[  154.405886][ T6176]  ksys_write+0x12a/0x250
[  154.410224][ T6176]  do_syscall_64+0x115/0x870
[  154.414832][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  154.420730][ T6176] 
[  154.423037][ T6176] Freed by task 6179:
[  154.427003][ T6176]  kasan_save_stack+0x30/0x50
[  154.431699][ T6176]  kasan_save_track+0x14/0x30
[  154.436378][ T6176]  kasan_save_free_info+0x3b/0x70
[  154.441438][ T6176]  __kasan_slab_free+0x5f/0x80
[  154.446231][ T6176]  kfree+0x22b/0x6c0
[  154.450142][ T6176]  f_midi2_opts_str_store.constprop.0+0xf0/0x240
[  154.456481][ T6176]  configfs_write_iter+0x302/0x4e0
[  154.461596][ T6176]  vfs_write+0x6ac/0x1050
[  154.465938][ T6176]  ksys_write+0x12a/0x250
[  154.470289][ T6176]  do_syscall_64+0x115/0x870
[  154.474902][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  154.480807][ T6176] 
[  154.483118][ T6176] The buggy address belongs to the object at ffff88802b4c1780
[  154.483118][ T6176]  which belongs to the cache kmalloc-32 of size 32
[  154.497009][ T6176] The buggy address is located 1 bytes inside of
[  154.497009][ T6176]  freed 32-byte region [ffff88802b4c1780, ffff88802b4c17a0)
[  154.510548][ T6176] 
[  154.512863][ T6176] The buggy address belongs to the physical page:
[  154.519260][ T6176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b4c1
[  154.528017][ T6176] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  154.535122][ T6176] page_type: f5(slab)
[  154.539108][ T6176] raw: 00fff00000000000 ffff88813fe1f780 dead000000000100 dead000000000122
[  154.547694][ T6176] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  154.556268][ T6176] page dumped because: kasan: bad access detected
[  154.562670][ T6176] page_owner tracks the page as allocated
[  154.568377][ T6176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11758506710, free_ts 0
[  154.587321][ T6176]  post_alloc_hook+0xfd/0x120
[  154.592019][ T6176]  get_page_from_freelist+0xf48/0x3530
[  154.597495][ T6176]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  154.603407][ T6176]  new_slab+0xa2/0x640
[  154.607491][ T6176]  refill_objects+0xe3/0x410
[  154.612094][ T6176]  __pcs_replace_empty_main+0x376/0x680
[  154.617651][ T6176]  __kmalloc_cache_noprof+0x479/0x6c0
[  154.623037][ T6176]  usb_get_device_descriptor+0x45/0xe0
[  154.628509][ T6176]  register_root_hub+0x146/0x639
[  154.633463][ T6176]  usb_add_hcd.cold+0xccd/0x1158
[  154.638412][ T6176]  dummy_hcd_probe+0x189/0x2fa
[  154.643191][ T6176]  platform_probe+0x106/0x1d0
[  154.647874][ T6176]  really_probe+0x241/0xa60
[  154.652390][ T6176]  __driver_probe_device+0x20e/0x450
[  154.657688][ T6176]  driver_probe_device+0x4a/0x140
[  154.662729][ T6176]  __device_attach_driver+0x1df/0x320
[  154.668118][ T6176] page_owner free stack trace missing
[  154.673473][ T6176] 
[  154.675785][ T6176] Memory state around the buggy address:
[  154.681412][ T6176]  ffff88802b4c1680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  154.689471][ T6176]  ffff88802b4c1700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  154.697529][ T6176] >ffff88802b4c1780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  154.705581][ T6176]                    ^
[  154.709637][ T6176]  ffff88802b4c1800: fa fb fb fb fc fc fc fc 00 00 00 01 fc fc fc fc
[  154.717693][ T6176]  ffff88802b4c1880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  154.725747][ T6176] ==================================================================
[  154.859343][ T6176] ==================================================================
[  154.867430][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  154.874376][ T6176] Read of size 1 at addr ffff88802b4c1782 by task syz.5.74/6176
[  154.881992][ T6176] 
[  154.884313][ T6176] CPU: 1 UID: 0 PID: 6176 Comm: syz.5.74 Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  154.884369][ T6176] Tainted: [B]=BAD_PAGE
[  154.884383][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  154.884406][ T6176] Call Trace:
[  154.884418][ T6176]  <TASK>
[  154.884432][ T6176]  dump_stack_lvl+0x100/0x190
[  154.884478][ T6176]  print_report+0x13d/0x4b0
[  154.884536][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.884584][ T6176]  ? __virt_addr_valid+0x239/0x430
[  154.884634][ T6176]  ? string+0x471/0x4d0
[  154.884680][ T6176]  kasan_report+0xdf/0x1c0
[  154.884722][ T6176]  ? string+0x471/0x4d0
[  154.884772][ T6176]  string+0x471/0x4d0
[  154.884818][ T6176]  ? __pfx_string+0x10/0x10
[  154.884867][ T6176]  ? find_held_lock+0x2b/0x80
[  154.884924][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  154.884980][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.885025][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.885073][ T6176]  vsnprintf+0x422/0x1300
[  154.885129][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  154.885186][ T6176]  scnprintf+0xdb/0x150
[  154.885237][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  154.885291][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.885335][ T6176]  ? down_read+0x13b/0x4c0
[  154.885368][ T6176]  ? __pfx_down_read+0x10/0x10
[  154.885429][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  154.885477][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0
[  154.885522][ T6176]  configfs_read_iter+0x426/0x6f0
[  154.885559][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.885607][ T6176]  __kernel_read+0x397/0xad0
[  154.885655][ T6176]  ? __pfx___kernel_read+0x10/0x10
[  154.885721][ T6176]  integrity_kernel_read+0x7e/0xb0
[  154.885778][ T6176]  ? __pfx_integrity_kernel_read+0x10/0x10
[  154.885840][ T6176]  ? ima_calc_file_hash_tfm+0x236/0x350
[  154.885891][ T6176]  ima_calc_file_hash_tfm+0x25e/0x350
[  154.885937][ T6176]  ? __pfx_ima_calc_file_hash_tfm+0x10/0x10
[  154.886014][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.886058][ T6176]  ? ima_alloc_tfm+0x21a/0x2e0
[  154.886105][ T6176]  ima_calc_file_hash+0x1e3/0x380
[  154.886150][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.886197][ T6176]  ima_collect_measurement+0x94f/0xb30
[  154.886251][ T6176]  ? __pfx_ima_collect_measurement+0x10/0x10
[  154.886299][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.886343][ T6176]  ? lockdep_hardirqs_on+0x78/0x100
[  154.886410][ T6176]  ? xattr_resolve_name+0x256/0x3f0
[  154.886464][ T6176]  ? xattr_resolve_name+0x259/0x3f0
[  154.886516][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.886560][ T6176]  ? is_bad_inode+0xd/0x40
[  154.886606][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.886650][ T6176]  ? xattr_resolve_name+0x27d/0x3f0
[  154.886707][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.886752][ T6176]  ? vfs_getxattr_alloc+0xec/0x350
[  154.886814][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.886864][ T6176]  ? ima_get_hash_algo+0x241/0x400
[  154.886901][ T6176]  ? __pfx_ima_get_hash_algo+0x10/0x10
[  154.886938][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.886987][ T6176]  ? process_measurement+0xdfe/0x2350
[  154.887031][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.887075][ T6176]  process_measurement+0xdfe/0x2350
[  154.887125][ T6176]  ? __pfx_process_measurement+0x10/0x10
[  154.887169][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.887225][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.887291][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.887335][ T6176]  ? __configfs_open_file+0x6ca/0x9c0
[  154.887370][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.887418][ T6176]  ima_file_check+0xcc/0x120
[  154.887460][ T6176]  ? __pfx_ima_file_check+0x10/0x10
[  154.887509][ T6176]  security_file_post_open+0xc4/0x210
[  154.887557][ T6176]  path_openat+0x985/0x4280
[  154.887624][ T6176]  ? __pfx_path_openat+0x10/0x10
[  154.887687][ T6176]  do_file_open+0x20e/0x430
[  154.887740][ T6176]  ? __lock_acquire+0x49f/0x1a40
[  154.887784][ T6176]  ? __pfx_do_file_open+0x10/0x10
[  154.887863][ T6176]  ? _raw_spin_unlock+0x28/0x50
[  154.887907][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.887951][ T6176]  ? alloc_fd+0x471/0x7a0
[  154.888013][ T6176]  do_sys_openat2+0x10f/0x1e0
[  154.888049][ T6176]  ? __pfx_do_sys_openat2+0x10/0x10
[  154.888086][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.888136][ T6176]  __x64_sys_open+0xfe/0x1d0
[  154.888168][ T6176]  ? __pfx___x64_sys_open+0x10/0x10
[  154.888206][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  154.888249][ T6176]  do_syscall_64+0x115/0x870
[  154.888303][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  154.888339][ T6176] RIP: 0033:0x7f2f8859e0d9
[  154.888367][ T6176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  154.888401][ T6176] RSP: 002b:00007f2f89418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  154.888433][ T6176] RAX: ffffffffffffffda RBX: 00007f2f88825fa0 RCX: 00007f2f8859e0d9
[  154.888458][ T6176] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0
[  154.888478][ T6176] RBP: 00007f2f88635024 R08: 0000000000000000 R09: 0000000000000000
[  154.888500][ T6176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  154.888521][ T6176] R13: 00007f2f88826038 R14: 00007f2f88825fa0 R15: 00007ffd99a1bec8
[  154.888558][ T6176]  </TASK>
[  154.888570][ T6176] 
[  155.402472][ T6176] Allocated by task 6135:
[  155.406793][ T6176]  kasan_save_stack+0x30/0x50
[  155.411503][ T6176]  kasan_save_track+0x14/0x30
[  155.416177][ T6176]  __kasan_kmalloc+0xaa/0xb0
[  155.420795][ T6176]  __kmalloc_node_track_caller_noprof+0x331/0x830
[  155.427234][ T6176]  kstrndup+0x64/0x120
[  155.431323][ T6176]  f_midi2_opts_str_store.constprop.0+0xbf/0x240
[  155.437671][ T6176]  configfs_write_iter+0x302/0x4e0
[  155.442781][ T6176]  vfs_write+0x6ac/0x1050
[  155.447119][ T6176]  ksys_write+0x12a/0x250
[  155.451460][ T6176]  do_syscall_64+0x115/0x870
[  155.456068][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  155.461967][ T6176] 
[  155.464284][ T6176] Freed by task 6179:
[  155.468259][ T6176]  kasan_save_stack+0x30/0x50
[  155.472974][ T6176]  kasan_save_track+0x14/0x30
[  155.477657][ T6176]  kasan_save_free_info+0x3b/0x70
[  155.482699][ T6176]  __kasan_slab_free+0x5f/0x80
[  155.487466][ T6176]  kfree+0x22b/0x6c0
[  155.491376][ T6176]  f_midi2_opts_str_store.constprop.0+0xf0/0x240
[  155.497717][ T6176]  configfs_write_iter+0x302/0x4e0
[  155.502835][ T6176]  vfs_write+0x6ac/0x1050
[  155.507175][ T6176]  ksys_write+0x12a/0x250
[  155.511515][ T6176]  do_syscall_64+0x115/0x870
[  155.516156][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  155.522054][ T6176] 
[  155.524390][ T6176] The buggy address belongs to the object at ffff88802b4c1780
[  155.524390][ T6176]  which belongs to the cache kmalloc-32 of size 32
[  155.538280][ T6176] The buggy address is located 2 bytes inside of
[  155.538280][ T6176]  freed 32-byte region [ffff88802b4c1780, ffff88802b4c17a0)
[  155.551827][ T6176] 
[  155.554141][ T6176] The buggy address belongs to the physical page:
[  155.560539][ T6176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b4c1
[  155.569293][ T6176] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  155.576402][ T6176] page_type: f5(slab)
[  155.580394][ T6176] raw: 00fff00000000000 ffff88813fe1f780 dead000000000100 dead000000000122
[  155.588982][ T6176] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  155.597555][ T6176] page dumped because: kasan: bad access detected
[  155.603956][ T6176] page_owner tracks the page as allocated
[  155.609655][ T6176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11758506710, free_ts 0
[  155.628594][ T6176]  post_alloc_hook+0xfd/0x120
[  155.633291][ T6176]  get_page_from_freelist+0xf48/0x3530
[  155.638773][ T6176]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  155.644683][ T6176]  new_slab+0xa2/0x640
[  155.648766][ T6176]  refill_objects+0xe3/0x410
[  155.653373][ T6176]  __pcs_replace_empty_main+0x376/0x680
[  155.658952][ T6176]  __kmalloc_cache_noprof+0x479/0x6c0
[  155.664363][ T6176]  usb_get_device_descriptor+0x45/0xe0
[  155.669847][ T6176]  register_root_hub+0x146/0x639
[  155.674812][ T6176]  usb_add_hcd.cold+0xccd/0x1158
[  155.679774][ T6176]  dummy_hcd_probe+0x189/0x2fa
[  155.684556][ T6176]  platform_probe+0x106/0x1d0
[  155.689242][ T6176]  really_probe+0x241/0xa60
[  155.693758][ T6176]  __driver_probe_device+0x20e/0x450
[  155.699062][ T6176]  driver_probe_device+0x4a/0x140
[  155.704101][ T6176]  __device_attach_driver+0x1df/0x320
[  155.709488][ T6176] page_owner free stack trace missing
[  155.714841][ T6176] 
[  155.717158][ T6176] Memory state around the buggy address:
[  155.722776][ T6176]  ffff88802b4c1680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  155.730837][ T6176]  ffff88802b4c1700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  155.738899][ T6176] >ffff88802b4c1780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  155.746952][ T6176]                    ^
[  155.751006][ T6176]  ffff88802b4c1800: fa fb fb fb fc fc fc fc 00 00 00 01 fc fc fc fc
[  155.759067][ T6176]  ffff88802b4c1880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  155.767119][ T6176] ==================================================================
[  155.880071][ T6176] ==================================================================
[  155.888198][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  155.895158][ T6176] Read of size 1 at addr ffff88802b4c1783 by task syz.5.74/6176
[  155.902786][ T6176] 
[  155.905111][ T6176] CPU: 0 UID: 0 PID: 6176 Comm: syz.5.74 Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  155.905159][ T6176] Tainted: [B]=BAD_PAGE
[  155.905171][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  155.905190][ T6176] Call Trace:
[  155.905203][ T6176]  <TASK>
[  155.905216][ T6176]  dump_stack_lvl+0x100/0x190
[  155.905257][ T6176]  print_report+0x13d/0x4b0
[  155.905306][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.905351][ T6176]  ? __virt_addr_valid+0x239/0x430
[  155.905394][ T6176]  ? string+0x471/0x4d0
[  155.905433][ T6176]  kasan_report+0xdf/0x1c0
[  155.905470][ T6176]  ? string+0x471/0x4d0
[  155.905515][ T6176]  string+0x471/0x4d0
[  155.905556][ T6176]  ? __pfx_string+0x10/0x10
[  155.905595][ T6176]  ? find_held_lock+0x2b/0x80
[  155.905647][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  155.905697][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.905737][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.905781][ T6176]  vsnprintf+0x422/0x1300
[  155.905831][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  155.905883][ T6176]  scnprintf+0xdb/0x150
[  155.905928][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  155.905977][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.906017][ T6176]  ? down_read+0x13b/0x4c0
[  155.906046][ T6176]  ? __pfx_down_read+0x10/0x10
[  155.906101][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  155.906144][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0
[  155.906185][ T6176]  configfs_read_iter+0x426/0x6f0
[  155.906218][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.906261][ T6176]  __kernel_read+0x397/0xad0
[  155.906305][ T6176]  ? __pfx___kernel_read+0x10/0x10
[  155.906402][ T6176]  integrity_kernel_read+0x7e/0xb0
[  155.906454][ T6176]  ? __pfx_integrity_kernel_read+0x10/0x10
[  155.906504][ T6176]  ? ima_calc_file_hash_tfm+0x236/0x350
[  155.906550][ T6176]  ima_calc_file_hash_tfm+0x25e/0x350
[  155.906592][ T6176]  ? __pfx_ima_calc_file_hash_tfm+0x10/0x10
[  155.906661][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.906701][ T6176]  ? ima_alloc_tfm+0x21a/0x2e0
[  155.906743][ T6176]  ima_calc_file_hash+0x1e3/0x380
[  155.906782][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.906827][ T6176]  ima_collect_measurement+0x94f/0xb30
[  155.906877][ T6176]  ? __pfx_ima_collect_measurement+0x10/0x10
[  155.906920][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.906959][ T6176]  ? lockdep_hardirqs_on+0x78/0x100
[  155.907019][ T6176]  ? xattr_resolve_name+0x256/0x3f0
[  155.907067][ T6176]  ? xattr_resolve_name+0x259/0x3f0
[  155.907114][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907153][ T6176]  ? is_bad_inode+0xd/0x40
[  155.907196][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907239][ T6176]  ? xattr_resolve_name+0x27d/0x3f0
[  155.907290][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907330][ T6176]  ? vfs_getxattr_alloc+0xec/0x350
[  155.907409][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907449][ T6176]  ? ima_get_hash_algo+0x241/0x400
[  155.907483][ T6176]  ? __pfx_ima_get_hash_algo+0x10/0x10
[  155.907516][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907560][ T6176]  ? process_measurement+0xdfe/0x2350
[  155.907596][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907636][ T6176]  process_measurement+0xdfe/0x2350
[  155.907681][ T6176]  ? __pfx_process_measurement+0x10/0x10
[  155.907720][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907770][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907829][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907869][ T6176]  ? __configfs_open_file+0x6ca/0x9c0
[  155.907901][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.907944][ T6176]  ima_file_check+0xcc/0x120
[  155.907982][ T6176]  ? __pfx_ima_file_check+0x10/0x10
[  155.908025][ T6176]  security_file_post_open+0xc4/0x210
[  155.908069][ T6176]  path_openat+0x985/0x4280
[  155.908128][ T6176]  ? __pfx_path_openat+0x10/0x10
[  155.908183][ T6176]  do_file_open+0x20e/0x430
[  155.908230][ T6176]  ? __lock_acquire+0x49f/0x1a40
[  155.908270][ T6176]  ? __pfx_do_file_open+0x10/0x10
[  155.908335][ T6176]  ? _raw_spin_unlock+0x28/0x50
[  155.908380][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.908419][ T6176]  ? alloc_fd+0x471/0x7a0
[  155.908473][ T6176]  do_sys_openat2+0x10f/0x1e0
[  155.908506][ T6176]  ? __pfx_do_sys_openat2+0x10/0x10
[  155.908539][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.908586][ T6176]  __x64_sys_open+0xfe/0x1d0
[  155.908618][ T6176]  ? __pfx___x64_sys_open+0x10/0x10
[  155.908656][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  155.908699][ T6176]  do_syscall_64+0x115/0x870
[  155.908750][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  155.908785][ T6176] RIP: 0033:0x7f2f8859e0d9
[  155.908811][ T6176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  155.908843][ T6176] RSP: 002b:00007f2f89418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  155.908875][ T6176] RAX: ffffffffffffffda RBX: 00007f2f88825fa0 RCX: 00007f2f8859e0d9
[  155.908897][ T6176] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0
[  155.908919][ T6176] RBP: 00007f2f88635024 R08: 0000000000000000 R09: 0000000000000000
[  155.908939][ T6176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  155.908960][ T6176] R13: 00007f2f88826038 R14: 00007f2f88825fa0 R15: 00007ffd99a1bec8
[  155.908993][ T6176]  </TASK>
[  155.909004][ T6176] 
[  156.428119][ T6176] Allocated by task 6135:
[  156.432442][ T6176]  kasan_save_stack+0x30/0x50
[  156.437148][ T6176]  kasan_save_track+0x14/0x30
[  156.441828][ T6176]  __kasan_kmalloc+0xaa/0xb0
[  156.446444][ T6176]  __kmalloc_node_track_caller_noprof+0x331/0x830
[  156.452884][ T6176]  kstrndup+0x64/0x120
[  156.456977][ T6176]  f_midi2_opts_str_store.constprop.0+0xbf/0x240
[  156.463313][ T6176]  configfs_write_iter+0x302/0x4e0
[  156.468478][ T6176]  vfs_write+0x6ac/0x1050
[  156.472816][ T6176]  ksys_write+0x12a/0x250
[  156.477155][ T6176]  do_syscall_64+0x115/0x870
[  156.481766][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  156.487661][ T6176] 
[  156.489977][ T6176] Freed by task 6179:
[  156.493954][ T6176]  kasan_save_stack+0x30/0x50
[  156.498661][ T6176]  kasan_save_track+0x14/0x30
[  156.503338][ T6176]  kasan_save_free_info+0x3b/0x70
[  156.508388][ T6176]  __kasan_slab_free+0x5f/0x80
[  156.513186][ T6176]  kfree+0x22b/0x6c0
[  156.517097][ T6176]  f_midi2_opts_str_store.constprop.0+0xf0/0x240
[  156.523438][ T6176]  configfs_write_iter+0x302/0x4e0
[  156.528553][ T6176]  vfs_write+0x6ac/0x1050
[  156.532898][ T6176]  ksys_write+0x12a/0x250
[  156.539162][ T6176]  do_syscall_64+0x115/0x870
[  156.543778][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  156.549686][ T6176] 
[  156.552002][ T6176] The buggy address belongs to the object at ffff88802b4c1780
[  156.552002][ T6176]  which belongs to the cache kmalloc-32 of size 32
[  156.565882][ T6176] The buggy address is located 3 bytes inside of
[  156.565882][ T6176]  freed 32-byte region [ffff88802b4c1780, ffff88802b4c17a0)
[  156.579428][ T6176] 
[  156.581743][ T6176] The buggy address belongs to the physical page:
[  156.588141][ T6176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b4c1
[  156.596904][ T6176] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  156.604012][ T6176] page_type: f5(slab)
[  156.607998][ T6176] raw: 00fff00000000000 ffff88813fe1f780 dead000000000100 dead000000000122
[  156.616810][ T6176] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  156.625421][ T6176] page dumped because: kasan: bad access detected
[  156.631837][ T6176] page_owner tracks the page as allocated
[  156.637544][ T6176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11758506710, free_ts 0
[  156.656504][ T6176]  post_alloc_hook+0xfd/0x120
[  156.661207][ T6176]  get_page_from_freelist+0xf48/0x3530
[  156.666686][ T6176]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  156.672603][ T6176]  new_slab+0xa2/0x640
[  156.676686][ T6176]  refill_objects+0xe3/0x410
[  156.681294][ T6176]  __pcs_replace_empty_main+0x376/0x680
[  156.686864][ T6176]  __kmalloc_cache_noprof+0x479/0x6c0
[  156.692253][ T6176]  usb_get_device_descriptor+0x45/0xe0
[  156.697723][ T6176]  register_root_hub+0x146/0x639
[  156.702670][ T6176]  usb_add_hcd.cold+0xccd/0x1158
[  156.707620][ T6176]  dummy_hcd_probe+0x189/0x2fa
[  156.712406][ T6176]  platform_probe+0x106/0x1d0
[  156.717087][ T6176]  really_probe+0x241/0xa60
[  156.721603][ T6176]  __driver_probe_device+0x20e/0x450
[  156.726902][ T6176]  driver_probe_device+0x4a/0x140
[  156.731940][ T6176]  __device_attach_driver+0x1df/0x320
[  156.737327][ T6176] page_owner free stack trace missing
[  156.742678][ T6176] 
[  156.744987][ T6176] Memory state around the buggy address:
[  156.750606][ T6176]  ffff88802b4c1680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  156.758661][ T6176]  ffff88802b4c1700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  156.766718][ T6176] >ffff88802b4c1780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  156.774766][ T6176]                    ^
[  156.778822][ T6176]  ffff88802b4c1800: fa fb fb fb fc fc fc fc 00 00 00 01 fc fc fc fc
[  156.786883][ T6176]  ffff88802b4c1880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  156.794937][ T6176] ==================================================================
[  156.865133][ T6176] ==================================================================
[  156.873333][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  156.880313][ T6176] Read of size 1 at addr ffff88802b4c1784 by task syz.5.74/6176
[  156.887942][ T6176] 
[  156.890269][ T6176] CPU: 0 UID: 0 PID: 6176 Comm: syz.5.74 Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  156.890315][ T6176] Tainted: [B]=BAD_PAGE
[  156.890327][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  156.890347][ T6176] Call Trace:
[  156.890357][ T6176]  <TASK>
[  156.890369][ T6176]  dump_stack_lvl+0x100/0x190
[  156.890416][ T6176]  print_report+0x13d/0x4b0
[  156.890465][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.890506][ T6176]  ? __virt_addr_valid+0x239/0x430
[  156.890548][ T6176]  ? string+0x471/0x4d0
[  156.890588][ T6176]  kasan_report+0xdf/0x1c0
[  156.890625][ T6176]  ? string+0x471/0x4d0
[  156.890670][ T6176]  string+0x471/0x4d0
[  156.890712][ T6176]  ? __pfx_string+0x10/0x10
[  156.890750][ T6176]  ? find_held_lock+0x2b/0x80
[  156.890802][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  156.890853][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.890893][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.890936][ T6176]  vsnprintf+0x422/0x1300
[  156.890987][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  156.891038][ T6176]  scnprintf+0xdb/0x150
[  156.891083][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  156.891132][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.891172][ T6176]  ? down_read+0x13b/0x4c0
[  156.891201][ T6176]  ? __pfx_down_read+0x10/0x10
[  156.891257][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  156.891299][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0
[  156.891341][ T6176]  configfs_read_iter+0x426/0x6f0
[  156.891374][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.891421][ T6176]  __kernel_read+0x397/0xad0
[  156.891465][ T6176]  ? __pfx___kernel_read+0x10/0x10
[  156.891524][ T6176]  integrity_kernel_read+0x7e/0xb0
[  156.891575][ T6176]  ? __pfx_integrity_kernel_read+0x10/0x10
[  156.891626][ T6176]  ? ima_calc_file_hash_tfm+0x236/0x350
[  156.891672][ T6176]  ima_calc_file_hash_tfm+0x25e/0x350
[  156.891714][ T6176]  ? __pfx_ima_calc_file_hash_tfm+0x10/0x10
[  156.891783][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.891823][ T6176]  ? ima_alloc_tfm+0x21a/0x2e0
[  156.891864][ T6176]  ima_calc_file_hash+0x1e3/0x380
[  156.891904][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.891946][ T6176]  ima_collect_measurement+0x94f/0xb30
[  156.891995][ T6176]  ? __pfx_ima_collect_measurement+0x10/0x10
[  156.892038][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892077][ T6176]  ? lockdep_hardirqs_on+0x78/0x100
[  156.892136][ T6176]  ? xattr_resolve_name+0x256/0x3f0
[  156.892184][ T6176]  ? xattr_resolve_name+0x259/0x3f0
[  156.892230][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892270][ T6176]  ? is_bad_inode+0xd/0x40
[  156.892312][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892352][ T6176]  ? xattr_resolve_name+0x27d/0x3f0
[  156.892408][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892447][ T6176]  ? vfs_getxattr_alloc+0xec/0x350
[  156.892503][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892543][ T6176]  ? ima_get_hash_algo+0x241/0x400
[  156.892576][ T6176]  ? __pfx_ima_get_hash_algo+0x10/0x10
[  156.892609][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892654][ T6176]  ? process_measurement+0xdfe/0x2350
[  156.892690][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892730][ T6176]  process_measurement+0xdfe/0x2350
[  156.892775][ T6176]  ? __pfx_process_measurement+0x10/0x10
[  156.892813][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892862][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892922][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.892965][ T6176]  ? __configfs_open_file+0x6ca/0x9c0
[  156.892996][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.893039][ T6176]  ima_file_check+0xcc/0x120
[  156.893077][ T6176]  ? __pfx_ima_file_check+0x10/0x10
[  156.893120][ T6176]  security_file_post_open+0xc4/0x210
[  156.893168][ T6176]  path_openat+0x985/0x4280
[  156.893227][ T6176]  ? __pfx_path_openat+0x10/0x10
[  156.893282][ T6176]  do_file_open+0x20e/0x430
[  156.893330][ T6176]  ? __lock_acquire+0x49f/0x1a40
[  156.893369][ T6176]  ? __pfx_do_file_open+0x10/0x10
[  156.893438][ T6176]  ? _raw_spin_unlock+0x28/0x50
[  156.893478][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.893517][ T6176]  ? alloc_fd+0x471/0x7a0
[  156.893572][ T6176]  do_sys_openat2+0x10f/0x1e0
[  156.893604][ T6176]  ? __pfx_do_sys_openat2+0x10/0x10
[  156.893638][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.893684][ T6176]  __x64_sys_open+0xfe/0x1d0
[  156.893716][ T6176]  ? __pfx___x64_sys_open+0x10/0x10
[  156.893754][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  156.893797][ T6176]  do_syscall_64+0x115/0x870
[  156.893848][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  156.893882][ T6176] RIP: 0033:0x7f2f8859e0d9
[  156.893907][ T6176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  156.893939][ T6176] RSP: 002b:00007f2f89418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  156.893970][ T6176] RAX: ffffffffffffffda RBX: 00007f2f88825fa0 RCX: 00007f2f8859e0d9
[  156.893993][ T6176] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0
[  156.894014][ T6176] RBP: 00007f2f88635024 R08: 0000000000000000 R09: 0000000000000000
[  156.894034][ T6176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  156.894055][ T6176] R13: 00007f2f88826038 R14: 00007f2f88825fa0 R15: 00007ffd99a1bec8
[  156.894088][ T6176]  </TASK>
[  156.894099][ T6176] 
[  157.407902][ T6176] Allocated by task 6135:
[  157.412219][ T6176]  kasan_save_stack+0x30/0x50
[  157.416923][ T6176]  kasan_save_track+0x14/0x30
[  157.421687][ T6176]  __kasan_kmalloc+0xaa/0xb0
[  157.426300][ T6176]  __kmalloc_node_track_caller_noprof+0x331/0x830
[  157.432746][ T6176]  kstrndup+0x64/0x120
[  157.436832][ T6176]  f_midi2_opts_str_store.constprop.0+0xbf/0x240
[  157.443178][ T6176]  configfs_write_iter+0x302/0x4e0
[  157.448293][ T6176]  vfs_write+0x6ac/0x1050
[  157.452650][ T6176]  ksys_write+0x12a/0x250
[  157.457014][ T6176]  do_syscall_64+0x115/0x870
[  157.461628][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  157.467530][ T6176] 
[  157.469842][ T6176] Freed by task 6179:
[  157.473809][ T6176]  kasan_save_stack+0x30/0x50
[  157.478529][ T6176]  kasan_save_track+0x14/0x30
[  157.483209][ T6176]  kasan_save_free_info+0x3b/0x70
[  157.488245][ T6176]  __kasan_slab_free+0x5f/0x80
[  157.493006][ T6176]  kfree+0x22b/0x6c0
[  157.496909][ T6176]  f_midi2_opts_str_store.constprop.0+0xf0/0x240
[  157.503248][ T6176]  configfs_write_iter+0x302/0x4e0
[  157.508449][ T6176]  vfs_write+0x6ac/0x1050
[  157.512790][ T6176]  ksys_write+0x12a/0x250
[  157.517132][ T6176]  do_syscall_64+0x115/0x870
[  157.521741][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  157.527638][ T6176] 
[  157.529950][ T6176] The buggy address belongs to the object at ffff88802b4c1780
[  157.529950][ T6176]  which belongs to the cache kmalloc-32 of size 32
[  157.543825][ T6176] The buggy address is located 4 bytes inside of
[  157.543825][ T6176]  freed 32-byte region [ffff88802b4c1780, ffff88802b4c17a0)
[  157.557371][ T6176] 
[  157.559683][ T6176] The buggy address belongs to the physical page:
[  157.566080][ T6176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b4c1
[  157.574841][ T6176] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  157.581947][ T6176] page_type: f5(slab)
[  157.585929][ T6176] raw: 00fff00000000000 ffff88813fe1f780 dead000000000100 dead000000000122
[  157.594517][ T6176] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  157.603091][ T6176] page dumped because: kasan: bad access detected
[  157.609496][ T6176] page_owner tracks the page as allocated
[  157.615198][ T6176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11758506710, free_ts 0
[  157.634144][ T6176]  post_alloc_hook+0xfd/0x120
[  157.638843][ T6176]  get_page_from_freelist+0xf48/0x3530
[  157.644323][ T6176]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  157.650253][ T6176]  new_slab+0xa2/0x640
[  157.654349][ T6176]  refill_objects+0xe3/0x410
[  157.658956][ T6176]  __pcs_replace_empty_main+0x376/0x680
[  157.664518][ T6176]  __kmalloc_cache_noprof+0x479/0x6c0
[  157.669905][ T6176]  usb_get_device_descriptor+0x45/0xe0
[  157.675385][ T6176]  register_root_hub+0x146/0x639
[  157.680334][ T6176]  usb_add_hcd.cold+0xccd/0x1158
[  157.685288][ T6176]  dummy_hcd_probe+0x189/0x2fa
[  157.690069][ T6176]  platform_probe+0x106/0x1d0
[  157.694751][ T6176]  really_probe+0x241/0xa60
[  157.699279][ T6176]  __driver_probe_device+0x20e/0x450
[  157.704581][ T6176]  driver_probe_device+0x4a/0x140
[  157.709623][ T6176]  __device_attach_driver+0x1df/0x320
[  157.715011][ T6176] page_owner free stack trace missing
[  157.720367][ T6176] 
[  157.722680][ T6176] Memory state around the buggy address:
[  157.728306][ T6176]  ffff88802b4c1680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  157.736365][ T6176]  ffff88802b4c1700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  157.744513][ T6176] >ffff88802b4c1780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  157.752564][ T6176]                    ^
[  157.756622][ T6176]  ffff88802b4c1800: fa fb fb fb fc fc fc fc 00 00 00 01 fc fc fc fc
[  157.764679][ T6176]  ffff88802b4c1880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  157.772731][ T6176] ==================================================================
[  157.797077][ T6176] ==================================================================
[  157.805331][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  157.812300][ T6176] Read of size 1 at addr ffff88802b4c1785 by task syz.5.74/6176
[  157.819933][ T6176] 
[  157.822257][ T6176] CPU: 1 UID: 0 PID: 6176 Comm: syz.5.74 Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  157.822304][ T6176] Tainted: [B]=BAD_PAGE
[  157.822316][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  157.822340][ T6176] Call Trace:
[  157.822351][ T6176]  <TASK>
[  157.822364][ T6176]  dump_stack_lvl+0x100/0x190
[  157.822405][ T6176]  print_report+0x13d/0x4b0
[  157.822456][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.822497][ T6176]  ? __virt_addr_valid+0x239/0x430
[  157.822540][ T6176]  ? string+0x471/0x4d0
[  157.822579][ T6176]  kasan_report+0xdf/0x1c0
[  157.822616][ T6176]  ? string+0x471/0x4d0
[  157.822660][ T6176]  string+0x471/0x4d0
[  157.822702][ T6176]  ? __pfx_string+0x10/0x10
[  157.822740][ T6176]  ? find_held_lock+0x2b/0x80
[  157.822792][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  157.822843][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.822883][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.822927][ T6176]  vsnprintf+0x422/0x1300
[  157.822981][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  157.823040][ T6176]  scnprintf+0xdb/0x150
[  157.823091][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  157.823145][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.823210][ T6176]  ? down_read+0x13b/0x4c0
[  157.823245][ T6176]  ? __pfx_down_read+0x10/0x10
[  157.823312][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  157.823372][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0
[  157.823421][ T6176]  configfs_read_iter+0x426/0x6f0
[  157.823462][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.823514][ T6176]  __kernel_read+0x397/0xad0
[  157.823568][ T6176]  ? __pfx___kernel_read+0x10/0x10
[  157.823641][ T6176]  integrity_kernel_read+0x7e/0xb0
[  157.823703][ T6176]  ? __pfx_integrity_kernel_read+0x10/0x10
[  157.823759][ T6176]  ? ima_calc_file_hash_tfm+0x236/0x350
[  157.823809][ T6176]  ima_calc_file_hash_tfm+0x25e/0x350
[  157.823856][ T6176]  ? __pfx_ima_calc_file_hash_tfm+0x10/0x10
[  157.823932][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.823976][ T6176]  ? ima_alloc_tfm+0x21a/0x2e0
[  157.824022][ T6176]  ima_calc_file_hash+0x1e3/0x380
[  157.824066][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.824112][ T6176]  ima_collect_measurement+0x94f/0xb30
[  157.824166][ T6176]  ? __pfx_ima_collect_measurement+0x10/0x10
[  157.824213][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.824257][ T6176]  ? lockdep_hardirqs_on+0x78/0x100
[  157.824324][ T6176]  ? xattr_resolve_name+0x256/0x3f0
[  157.824382][ T6176]  ? xattr_resolve_name+0x259/0x3f0
[  157.824434][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.824478][ T6176]  ? is_bad_inode+0xd/0x40
[  157.824525][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.824568][ T6176]  ? xattr_resolve_name+0x27d/0x3f0
[  157.824625][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.824668][ T6176]  ? vfs_getxattr_alloc+0xec/0x350
[  157.824729][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.824772][ T6176]  ? ima_get_hash_algo+0x241/0x400
[  157.824806][ T6176]  ? __pfx_ima_get_hash_algo+0x10/0x10
[  157.824839][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.824883][ T6176]  ? process_measurement+0xdfe/0x2350
[  157.824920][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.824959][ T6176]  process_measurement+0xdfe/0x2350
[  157.825005][ T6176]  ? __pfx_process_measurement+0x10/0x10
[  157.825044][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.825093][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.825153][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.825193][ T6176]  ? __configfs_open_file+0x6ca/0x9c0
[  157.825224][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.825267][ T6176]  ima_file_check+0xcc/0x120
[  157.825305][ T6176]  ? __pfx_ima_file_check+0x10/0x10
[  157.825354][ T6176]  security_file_post_open+0xc4/0x210
[  157.825397][ T6176]  path_openat+0x985/0x4280
[  157.825456][ T6176]  ? __pfx_path_openat+0x10/0x10
[  157.825511][ T6176]  do_file_open+0x20e/0x430
[  157.825559][ T6176]  ? __lock_acquire+0x49f/0x1a40
[  157.825600][ T6176]  ? __pfx_do_file_open+0x10/0x10
[  157.825665][ T6176]  ? _raw_spin_unlock+0x28/0x50
[  157.825705][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.825745][ T6176]  ? alloc_fd+0x471/0x7a0
[  157.825800][ T6176]  do_sys_openat2+0x10f/0x1e0
[  157.825832][ T6176]  ? __pfx_do_sys_openat2+0x10/0x10
[  157.825866][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.825913][ T6176]  __x64_sys_open+0xfe/0x1d0
[  157.825945][ T6176]  ? __pfx___x64_sys_open+0x10/0x10
[  157.825982][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  157.826026][ T6176]  do_syscall_64+0x115/0x870
[  157.826077][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  157.826111][ T6176] RIP: 0033:0x7f2f8859e0d9
[  157.826136][ T6176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  157.826168][ T6176] RSP: 002b:00007f2f89418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  157.826199][ T6176] RAX: ffffffffffffffda RBX: 00007f2f88825fa0 RCX: 00007f2f8859e0d9
[  157.826221][ T6176] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0
[  157.826242][ T6176] RBP: 00007f2f88635024 R08: 0000000000000000 R09: 0000000000000000
[  157.826263][ T6176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  157.826283][ T6176] R13: 00007f2f88826038 R14: 00007f2f88825fa0 R15: 00007ffd99a1bec8
[  157.826317][ T6176]  </TASK>
[  157.826328][ T6176] 
[  158.341325][ T6176] Allocated by task 6135:
[  158.345653][ T6176]  kasan_save_stack+0x30/0x50
[  158.350357][ T6176]  kasan_save_track+0x14/0x30
[  158.355037][ T6176]  __kasan_kmalloc+0xaa/0xb0
[  158.359651][ T6176]  __kmalloc_node_track_caller_noprof+0x331/0x830
[  158.366095][ T6176]  kstrndup+0x64/0x120
[  158.370183][ T6176]  f_midi2_opts_str_store.constprop.0+0xbf/0x240
[  158.376517][ T6176]  configfs_write_iter+0x302/0x4e0
[  158.381630][ T6176]  vfs_write+0x6ac/0x1050
[  158.385975][ T6176]  ksys_write+0x12a/0x250
[  158.390318][ T6176]  do_syscall_64+0x115/0x870
[  158.394934][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  158.400828][ T6176] 
[  158.403139][ T6176] Freed by task 6179:
[  158.407121][ T6176]  kasan_save_stack+0x30/0x50
[  158.411823][ T6176]  kasan_save_track+0x14/0x30
[  158.416494][ T6176]  kasan_save_free_info+0x3b/0x70
[  158.421530][ T6176]  __kasan_slab_free+0x5f/0x80
[  158.426293][ T6176]  kfree+0x22b/0x6c0
[  158.430206][ T6176]  f_midi2_opts_str_store.constprop.0+0xf0/0x240
[  158.436540][ T6176]  configfs_write_iter+0x302/0x4e0
[  158.441650][ T6176]  vfs_write+0x6ac/0x1050
[  158.445990][ T6176]  ksys_write+0x12a/0x250
[  158.450358][ T6176]  do_syscall_64+0x115/0x870
[  158.454967][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  158.460864][ T6176] 
[  158.463176][ T6176] The buggy address belongs to the object at ffff88802b4c1780
[  158.463176][ T6176]  which belongs to the cache kmalloc-32 of size 32
[  158.477183][ T6176] The buggy address is located 5 bytes inside of
[  158.477183][ T6176]  freed 32-byte region [ffff88802b4c1780, ffff88802b4c17a0)
[  158.490727][ T6176] 
[  158.493041][ T6176] The buggy address belongs to the physical page:
[  158.499440][ T6176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b4c1
[  158.508195][ T6176] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  158.515301][ T6176] page_type: f5(slab)
[  158.519282][ T6176] raw: 00fff00000000000 ffff88813fe1f780 dead000000000100 dead000000000122
[  158.527866][ T6176] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  158.536443][ T6176] page dumped because: kasan: bad access detected
[  158.542847][ T6176] page_owner tracks the page as allocated
[  158.548547][ T6176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11758506710, free_ts 0
[  158.567506][ T6176]  post_alloc_hook+0xfd/0x120
[  158.572216][ T6176]  get_page_from_freelist+0xf48/0x3530
[  158.577696][ T6176]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  158.583608][ T6176]  new_slab+0xa2/0x640
[  158.587690][ T6176]  refill_objects+0xe3/0x410
[  158.592296][ T6176]  __pcs_replace_empty_main+0x376/0x680
[  158.597860][ T6176]  __kmalloc_cache_noprof+0x479/0x6c0
[  158.603251][ T6176]  usb_get_device_descriptor+0x45/0xe0
[  158.608723][ T6176]  register_root_hub+0x146/0x639
[  158.613667][ T6176]  usb_add_hcd.cold+0xccd/0x1158
[  158.618611][ T6176]  dummy_hcd_probe+0x189/0x2fa
[  158.623389][ T6176]  platform_probe+0x106/0x1d0
[  158.628074][ T6176]  really_probe+0x241/0xa60
[  158.632586][ T6176]  __driver_probe_device+0x20e/0x450
[  158.637892][ T6176]  driver_probe_device+0x4a/0x140
[  158.642933][ T6176]  __device_attach_driver+0x1df/0x320
[  158.648331][ T6176] page_owner free stack trace missing
[  158.653687][ T6176] 
[  158.655998][ T6176] Memory state around the buggy address:
[  158.661617][ T6176]  ffff88802b4c1680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  158.669675][ T6176]  ffff88802b4c1700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  158.677736][ T6176] >ffff88802b4c1780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  158.685787][ T6176]                    ^
[  158.689849][ T6176]  ffff88802b4c1800: fa fb fb fb fc fc fc fc 00 00 00 01 fc fc fc fc
[  158.697906][ T6176]  ffff88802b4c1880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  158.705959][ T6176] ==================================================================
[  158.752054][ T6176] ==================================================================
[  158.760249][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  158.767233][ T6176] Read of size 1 at addr ffff88802b4c1786 by task syz.5.74/6176
[  158.774891][ T6176] 
[  158.777225][ T6176] CPU: 0 UID: 0 PID: 6176 Comm: syz.5.74 Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  158.777277][ T6176] Tainted: [B]=BAD_PAGE
[  158.777291][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  158.777312][ T6176] Call Trace:
[  158.777324][ T6176]  <TASK>
[  158.777337][ T6176]  dump_stack_lvl+0x100/0x190
[  158.777382][ T6176]  print_report+0x13d/0x4b0
[  158.777436][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.777482][ T6176]  ? __virt_addr_valid+0x239/0x430
[  158.777528][ T6176]  ? string+0x471/0x4d0
[  158.777572][ T6176]  kasan_report+0xdf/0x1c0
[  158.777614][ T6176]  ? string+0x471/0x4d0
[  158.777663][ T6176]  string+0x471/0x4d0
[  158.777710][ T6176]  ? __pfx_string+0x10/0x10
[  158.777754][ T6176]  ? find_held_lock+0x2b/0x80
[  158.777812][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  158.777876][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.777921][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.777970][ T6176]  vsnprintf+0x422/0x1300
[  158.778027][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  158.778085][ T6176]  scnprintf+0xdb/0x150
[  158.778139][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  158.778194][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.778239][ T6176]  ? down_read+0x13b/0x4c0
[  158.778271][ T6176]  ? __pfx_down_read+0x10/0x10
[  158.778334][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  158.778382][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0
[  158.778428][ T6176]  configfs_read_iter+0x426/0x6f0
[  158.778465][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.778512][ T6176]  __kernel_read+0x397/0xad0
[  158.778562][ T6176]  ? __pfx___kernel_read+0x10/0x10
[  158.778628][ T6176]  integrity_kernel_read+0x7e/0xb0
[  158.778685][ T6176]  ? __pfx_integrity_kernel_read+0x10/0x10
[  158.778742][ T6176]  ? ima_calc_file_hash_tfm+0x236/0x350
[  158.778793][ T6176]  ima_calc_file_hash_tfm+0x25e/0x350
[  158.778846][ T6176]  ? __pfx_ima_calc_file_hash_tfm+0x10/0x10
[  158.778924][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.778969][ T6176]  ? ima_alloc_tfm+0x21a/0x2e0
[  158.779016][ T6176]  ima_calc_file_hash+0x1e3/0x380
[  158.779060][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.779107][ T6176]  ima_collect_measurement+0x94f/0xb30
[  158.779162][ T6176]  ? __pfx_ima_collect_measurement+0x10/0x10
[  158.779210][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.779255][ T6176]  ? lockdep_hardirqs_on+0x78/0x100
[  158.779320][ T6176]  ? xattr_resolve_name+0x256/0x3f0
[  158.779375][ T6176]  ? xattr_resolve_name+0x259/0x3f0
[  158.779428][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.779473][ T6176]  ? is_bad_inode+0xd/0x40
[  158.779524][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.779569][ T6176]  ? xattr_resolve_name+0x27d/0x3f0
[  158.779627][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.779672][ T6176]  ? vfs_getxattr_alloc+0xec/0x350
[  158.779736][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.779781][ T6176]  ? ima_get_hash_algo+0x241/0x400
[  158.779819][ T6176]  ? __pfx_ima_get_hash_algo+0x10/0x10
[  158.779863][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.779913][ T6176]  ? process_measurement+0xdfe/0x2350
[  158.779954][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.779999][ T6176]  process_measurement+0xdfe/0x2350
[  158.780050][ T6176]  ? __pfx_process_measurement+0x10/0x10
[  158.780095][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.780156][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.780223][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.780269][ T6176]  ? __configfs_open_file+0x6ca/0x9c0
[  158.780304][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.780353][ T6176]  ima_file_check+0xcc/0x120
[  158.780396][ T6176]  ? __pfx_ima_file_check+0x10/0x10
[  158.780445][ T6176]  security_file_post_open+0xc4/0x210
[  158.780493][ T6176]  path_openat+0x985/0x4280
[  158.780560][ T6176]  ? __pfx_path_openat+0x10/0x10
[  158.780623][ T6176]  do_file_open+0x20e/0x430
[  158.780676][ T6176]  ? __lock_acquire+0x49f/0x1a40
[  158.780720][ T6176]  ? __pfx_do_file_open+0x10/0x10
[  158.780800][ T6176]  ? _raw_spin_unlock+0x28/0x50
[  158.780850][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.780895][ T6176]  ? alloc_fd+0x471/0x7a0
[  158.780956][ T6176]  do_sys_openat2+0x10f/0x1e0
[  158.780993][ T6176]  ? __pfx_do_sys_openat2+0x10/0x10
[  158.781030][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.781081][ T6176]  __x64_sys_open+0xfe/0x1d0
[  158.781116][ T6176]  ? __pfx___x64_sys_open+0x10/0x10
[  158.781158][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  158.781206][ T6176]  do_syscall_64+0x115/0x870
[  158.781261][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  158.781299][ T6176] RIP: 0033:0x7f2f8859e0d9
[  158.781326][ T6176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  158.781362][ T6176] RSP: 002b:00007f2f89418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  158.781396][ T6176] RAX: ffffffffffffffda RBX: 00007f2f88825fa0 RCX: 00007f2f8859e0d9
[  158.781421][ T6176] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0
[  158.781444][ T6176] RBP: 00007f2f88635024 R08: 0000000000000000 R09: 0000000000000000
[  158.781468][ T6176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  158.781491][ T6176] R13: 00007f2f88826038 R14: 00007f2f88825fa0 R15: 00007ffd99a1bec8
[  158.781529][ T6176]  </TASK>
[  158.781542][ T6176] 
[  159.295746][ T6176] Allocated by task 6135:
[  159.300056][ T6176]  kasan_save_stack+0x30/0x50
[  159.304756][ T6176]  kasan_save_track+0x14/0x30
[  159.309523][ T6176]  __kasan_kmalloc+0xaa/0xb0
[  159.314120][ T6176]  __kmalloc_node_track_caller_noprof+0x331/0x830
[  159.320544][ T6176]  kstrndup+0x64/0x120
[  159.324620][ T6176]  f_midi2_opts_str_store.constprop.0+0xbf/0x240
[  159.330945][ T6176]  configfs_write_iter+0x302/0x4e0
[  159.336225][ T6176]  vfs_write+0x6ac/0x1050
[  159.340555][ T6176]  ksys_write+0x12a/0x250
[  159.344885][ T6176]  do_syscall_64+0x115/0x870
[  159.349569][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  159.355456][ T6176] 
[  159.357763][ T6176] Freed by task 6179:
[  159.361720][ T6176]  kasan_save_stack+0x30/0x50
[  159.366417][ T6176]  kasan_save_track+0x14/0x30
[  159.371093][ T6176]  kasan_save_free_info+0x3b/0x70
[  159.376123][ T6176]  __kasan_slab_free+0x5f/0x80
[  159.380878][ T6176]  kfree+0x22b/0x6c0
[  159.384778][ T6176]  f_midi2_opts_str_store.constprop.0+0xf0/0x240
[  159.391110][ T6176]  configfs_write_iter+0x302/0x4e0
[  159.396209][ T6176]  vfs_write+0x6ac/0x1050
[  159.400536][ T6176]  ksys_write+0x12a/0x250
[  159.404864][ T6176]  do_syscall_64+0x115/0x870
[  159.409461][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  159.415436][ T6176] 
[  159.417747][ T6176] The buggy address belongs to the object at ffff88802b4c1780
[  159.417747][ T6176]  which belongs to the cache kmalloc-32 of size 32
[  159.431618][ T6176] The buggy address is located 6 bytes inside of
[  159.431618][ T6176]  freed 32-byte region [ffff88802b4c1780, ffff88802b4c17a0)
[  159.445143][ T6176] 
[  159.447452][ T6176] The buggy address belongs to the physical page:
[  159.453849][ T6176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b4c1
[  159.462622][ T6176] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  159.469721][ T6176] page_type: f5(slab)
[  159.473703][ T6176] raw: 00fff00000000000 ffff88813fe1f780 dead000000000100 dead000000000122
[  159.482278][ T6176] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  159.490842][ T6176] page dumped because: kasan: bad access detected
[  159.497236][ T6176] page_owner tracks the page as allocated
[  159.502939][ T6176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11758506710, free_ts 0
[  159.521899][ T6176]  post_alloc_hook+0xfd/0x120
[  159.526586][ T6176]  get_page_from_freelist+0xf48/0x3530
[  159.532052][ T6176]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  159.537951][ T6176]  new_slab+0xa2/0x640
[  159.542021][ T6176]  refill_objects+0xe3/0x410
[  159.546623][ T6176]  __pcs_replace_empty_main+0x376/0x680
[  159.552181][ T6176]  __kmalloc_cache_noprof+0x479/0x6c0
[  159.557553][ T6176]  usb_get_device_descriptor+0x45/0xe0
[  159.563014][ T6176]  register_root_hub+0x146/0x639
[  159.567962][ T6176]  usb_add_hcd.cold+0xccd/0x1158
[  159.572921][ T6176]  dummy_hcd_probe+0x189/0x2fa
[  159.577742][ T6176]  platform_probe+0x106/0x1d0
[  159.582419][ T6176]  really_probe+0x241/0xa60
[  159.586936][ T6176]  __driver_probe_device+0x20e/0x450
[  159.592235][ T6176]  driver_probe_device+0x4a/0x140
[  159.597274][ T6176]  __device_attach_driver+0x1df/0x320
[  159.602659][ T6176] page_owner free stack trace missing
[  159.608010][ T6176] 
[  159.610326][ T6176] Memory state around the buggy address:
[  159.615996][ T6176]  ffff88802b4c1680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  159.624043][ T6176]  ffff88802b4c1700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  159.632111][ T6176] >ffff88802b4c1780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  159.640180][ T6176]                    ^
[  159.644244][ T6176]  ffff88802b4c1800: fa fb fb fb fc fc fc fc 00 00 00 01 fc fc fc fc
[  159.652351][ T6176]  ffff88802b4c1880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  159.660509][ T6176] ==================================================================
[  159.674317][ T6176] ==================================================================
[  159.682394][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  159.689361][ T6176] Read of size 1 at addr ffff88802b4c1787 by task syz.5.74/6176
[  159.697008][ T6176] 
[  159.699340][ T6176] CPU: 0 UID: 0 PID: 6176 Comm: syz.5.74 Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  159.699405][ T6176] Tainted: [B]=BAD_PAGE
[  159.699419][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  159.699441][ T6176] Call Trace:
[  159.699453][ T6176]  <TASK>
[  159.699465][ T6176]  dump_stack_lvl+0x100/0x190
[  159.699510][ T6176]  print_report+0x13d/0x4b0
[  159.699564][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.699610][ T6176]  ? __virt_addr_valid+0x239/0x430
[  159.699657][ T6176]  ? string+0x471/0x4d0
[  159.699702][ T6176]  kasan_report+0xdf/0x1c0
[  159.699742][ T6176]  ? string+0x471/0x4d0
[  159.699791][ T6176]  string+0x471/0x4d0
[  159.699836][ T6176]  ? __pfx_string+0x10/0x10
[  159.699880][ T6176]  ? find_held_lock+0x2b/0x80
[  159.699938][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  159.699994][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.700039][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.700089][ T6176]  vsnprintf+0x422/0x1300
[  159.700146][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  159.700204][ T6176]  scnprintf+0xdb/0x150
[  159.700255][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  159.700310][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.700354][ T6176]  ? down_read+0x13b/0x4c0
[  159.700396][ T6176]  ? __pfx_down_read+0x10/0x10
[  159.700459][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  159.700506][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0
[  159.700552][ T6176]  configfs_read_iter+0x426/0x6f0
[  159.700588][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.700635][ T6176]  __kernel_read+0x397/0xad0
[  159.700683][ T6176]  ? __pfx___kernel_read+0x10/0x10
[  159.700747][ T6176]  integrity_kernel_read+0x7e/0xb0
[  159.700805][ T6176]  ? __pfx_integrity_kernel_read+0x10/0x10
[  159.700861][ T6176]  ? ima_calc_file_hash_tfm+0x236/0x350
[  159.700912][ T6176]  ima_calc_file_hash_tfm+0x25e/0x350
[  159.700960][ T6176]  ? __pfx_ima_calc_file_hash_tfm+0x10/0x10
[  159.701037][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.701081][ T6176]  ? ima_alloc_tfm+0x21a/0x2e0
[  159.701126][ T6176]  ima_calc_file_hash+0x1e3/0x380
[  159.701170][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.701216][ T6176]  ima_collect_measurement+0x94f/0xb30
[  159.701268][ T6176]  ? __pfx_ima_collect_measurement+0x10/0x10
[  159.701314][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.701357][ T6176]  ? lockdep_hardirqs_on+0x78/0x100
[  159.701430][ T6176]  ? xattr_resolve_name+0x256/0x3f0
[  159.701484][ T6176]  ? xattr_resolve_name+0x259/0x3f0
[  159.701536][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.701584][ T6176]  ? is_bad_inode+0xd/0x40
[  159.701632][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.701677][ T6176]  ? xattr_resolve_name+0x27d/0x3f0
[  159.701734][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.701778][ T6176]  ? vfs_getxattr_alloc+0xec/0x350
[  159.701840][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.701883][ T6176]  ? ima_get_hash_algo+0x241/0x400
[  159.701919][ T6176]  ? __pfx_ima_get_hash_algo+0x10/0x10
[  159.701955][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.702004][ T6176]  ? process_measurement+0xdfe/0x2350
[  159.702045][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.702090][ T6176]  process_measurement+0xdfe/0x2350
[  159.702141][ T6176]  ? __pfx_process_measurement+0x10/0x10
[  159.702184][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.702240][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.702307][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.702352][ T6176]  ? __configfs_open_file+0x6ca/0x9c0
[  159.702395][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.702443][ T6176]  ima_file_check+0xcc/0x120
[  159.702485][ T6176]  ? __pfx_ima_file_check+0x10/0x10
[  159.702535][ T6176]  security_file_post_open+0xc4/0x210
[  159.702582][ T6176]  path_openat+0x985/0x4280
[  159.702649][ T6176]  ? __pfx_path_openat+0x10/0x10
[  159.702711][ T6176]  do_file_open+0x20e/0x430
[  159.702763][ T6176]  ? __lock_acquire+0x49f/0x1a40
[  159.702806][ T6176]  ? __pfx_do_file_open+0x10/0x10
[  159.702878][ T6176]  ? _raw_spin_unlock+0x28/0x50
[  159.702921][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.702966][ T6176]  ? alloc_fd+0x471/0x7a0
[  159.703027][ T6176]  do_sys_openat2+0x10f/0x1e0
[  159.703064][ T6176]  ? __pfx_do_sys_openat2+0x10/0x10
[  159.703102][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.703174][ T6176]  __x64_sys_open+0xfe/0x1d0
[  159.703210][ T6176]  ? __pfx___x64_sys_open+0x10/0x10
[  159.703251][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  159.703300][ T6176]  do_syscall_64+0x115/0x870
[  159.703357][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  159.703402][ T6176] RIP: 0033:0x7f2f8859e0d9
[  159.703431][ T6176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  159.703467][ T6176] RSP: 002b:00007f2f89418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  159.703502][ T6176] RAX: ffffffffffffffda RBX: 00007f2f88825fa0 RCX: 00007f2f8859e0d9
[  159.703528][ T6176] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0
[  159.703552][ T6176] RBP: 00007f2f88635024 R08: 0000000000000000 R09: 0000000000000000
[  159.703575][ T6176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  159.703598][ T6176] R13: 00007f2f88826038 R14: 00007f2f88825fa0 R15: 00007ffd99a1bec8
[  159.703636][ T6176]  </TASK>
[  159.703649][ T6176] 
[  160.217846][ T6176] Allocated by task 6135:
[  160.222166][ T6176]  kasan_save_stack+0x30/0x50
[  160.226871][ T6176]  kasan_save_track+0x14/0x30
[  160.231551][ T6176]  __kasan_kmalloc+0xaa/0xb0
[  160.236162][ T6176]  __kmalloc_node_track_caller_noprof+0x331/0x830
[  160.242607][ T6176]  kstrndup+0x64/0x120
[  160.246695][ T6176]  f_midi2_opts_str_store.constprop.0+0xbf/0x240
[  160.253030][ T6176]  configfs_write_iter+0x302/0x4e0
[  160.258140][ T6176]  vfs_write+0x6ac/0x1050
[  160.262477][ T6176]  ksys_write+0x12a/0x250
[  160.266814][ T6176]  do_syscall_64+0x115/0x870
[  160.271422][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  160.277314][ T6176] 
[  160.279624][ T6176] Freed by task 6179:
[  160.283592][ T6176]  kasan_save_stack+0x30/0x50
[  160.288298][ T6176]  kasan_save_track+0x14/0x30
[  160.292976][ T6176]  kasan_save_free_info+0x3b/0x70
[  160.298019][ T6176]  __kasan_slab_free+0x5f/0x80
[  160.302783][ T6176]  kfree+0x22b/0x6c0
[  160.306686][ T6176]  f_midi2_opts_str_store.constprop.0+0xf0/0x240
[  160.313023][ T6176]  configfs_write_iter+0x302/0x4e0
[  160.318135][ T6176]  vfs_write+0x6ac/0x1050
[  160.322473][ T6176]  ksys_write+0x12a/0x250
[  160.326812][ T6176]  do_syscall_64+0x115/0x870
[  160.331424][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  160.337322][ T6176] 
[  160.339636][ T6176] The buggy address belongs to the object at ffff88802b4c1780
[  160.339636][ T6176]  which belongs to the cache kmalloc-32 of size 32
[  160.353511][ T6176] The buggy address is located 7 bytes inside of
[  160.353511][ T6176]  freed 32-byte region [ffff88802b4c1780, ffff88802b4c17a0)
[  160.367050][ T6176] 
[  160.369363][ T6176] The buggy address belongs to the physical page:
[  160.375766][ T6176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b4c1
[  160.384528][ T6176] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  160.391637][ T6176] page_type: f5(slab)
[  160.395626][ T6176] raw: 00fff00000000000 ffff88813fe1f780 dead000000000100 dead000000000122
[  160.404211][ T6176] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  160.412782][ T6176] page dumped because: kasan: bad access detected
[  160.419179][ T6176] page_owner tracks the page as allocated
[  160.424877][ T6176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11758506710, free_ts 0
[  160.443819][ T6176]  post_alloc_hook+0xfd/0x120
[  160.448515][ T6176]  get_page_from_freelist+0xf48/0x3530
[  160.453991][ T6176]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  160.459921][ T6176]  new_slab+0xa2/0x640
[  160.464021][ T6176]  refill_objects+0xe3/0x410
[  160.468628][ T6176]  __pcs_replace_empty_main+0x376/0x680
[  160.474189][ T6176]  __kmalloc_cache_noprof+0x479/0x6c0
[  160.479575][ T6176]  usb_get_device_descriptor+0x45/0xe0
[  160.485047][ T6176]  register_root_hub+0x146/0x639
[  160.489993][ T6176]  usb_add_hcd.cold+0xccd/0x1158
[  160.494939][ T6176]  dummy_hcd_probe+0x189/0x2fa
[  160.499715][ T6176]  platform_probe+0x106/0x1d0
[  160.504398][ T6176]  really_probe+0x241/0xa60
[  160.508913][ T6176]  __driver_probe_device+0x20e/0x450
[  160.514211][ T6176]  driver_probe_device+0x4a/0x140
[  160.519249][ T6176]  __device_attach_driver+0x1df/0x320
[  160.524637][ T6176] page_owner free stack trace missing
[  160.529992][ T6176] 
[  160.532302][ T6176] Memory state around the buggy address:
[  160.537919][ T6176]  ffff88802b4c1680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  160.545982][ T6176]  ffff88802b4c1700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  160.554048][ T6176] >ffff88802b4c1780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  160.562100][ T6176]                    ^
[  160.566156][ T6176]  ffff88802b4c1800: fa fb fb fb fc fc fc fc 00 00 00 01 fc fc fc fc
[  160.574212][ T6176]  ffff88802b4c1880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  160.582264][ T6176] ==================================================================
[  160.636858][ T6176] ==================================================================
[  160.644949][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  160.651906][ T6176] Read of size 1 at addr ffff88802b4c1788 by task syz.5.74/6176
[  160.659535][ T6176] 
[  160.661857][ T6176] CPU: 0 UID: 0 PID: 6176 Comm: syz.5.74 Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  160.661904][ T6176] Tainted: [B]=BAD_PAGE
[  160.661916][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  160.661936][ T6176] Call Trace:
[  160.661947][ T6176]  <TASK>
[  160.661959][ T6176]  dump_stack_lvl+0x100/0x190
[  160.662000][ T6176]  print_report+0x13d/0x4b0
[  160.662049][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.662089][ T6176]  ? __virt_addr_valid+0x239/0x430
[  160.662132][ T6176]  ? string+0x471/0x4d0
[  160.662172][ T6176]  kasan_report+0xdf/0x1c0
[  160.662208][ T6176]  ? string+0x471/0x4d0
[  160.662253][ T6176]  string+0x471/0x4d0
[  160.662299][ T6176]  ? __pfx_string+0x10/0x10
[  160.662338][ T6176]  ? find_held_lock+0x2b/0x80
[  160.662395][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  160.662445][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.662485][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.662529][ T6176]  vsnprintf+0x422/0x1300
[  160.662580][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  160.662632][ T6176]  scnprintf+0xdb/0x150
[  160.662678][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  160.662727][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.662766][ T6176]  ? down_read+0x13b/0x4c0
[  160.662795][ T6176]  ? __pfx_down_read+0x10/0x10
[  160.662852][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  160.662894][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0
[  160.662936][ T6176]  configfs_read_iter+0x426/0x6f0
[  160.662972][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.663015][ T6176]  __kernel_read+0x397/0xad0
[  160.663059][ T6176]  ? __pfx___kernel_read+0x10/0x10
[  160.663118][ T6176]  integrity_kernel_read+0x7e/0xb0
[  160.663184][ T6176]  ? __pfx_integrity_kernel_read+0x10/0x10
[  160.663235][ T6176]  ? ima_calc_file_hash_tfm+0x236/0x350
[  160.663280][ T6176]  ima_calc_file_hash_tfm+0x25e/0x350
[  160.663327][ T6176]  ? __pfx_ima_calc_file_hash_tfm+0x10/0x10
[  160.663449][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.663489][ T6176]  ? ima_alloc_tfm+0x21a/0x2e0
[  160.663530][ T6176]  ima_calc_file_hash+0x1e3/0x380
[  160.663570][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.663612][ T6176]  ima_collect_measurement+0x94f/0xb30
[  160.663660][ T6176]  ? __pfx_ima_collect_measurement+0x10/0x10
[  160.663704][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.663744][ T6176]  ? lockdep_hardirqs_on+0x78/0x100
[  160.663803][ T6176]  ? xattr_resolve_name+0x256/0x3f0
[  160.663852][ T6176]  ? xattr_resolve_name+0x259/0x3f0
[  160.663899][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.663939][ T6176]  ? is_bad_inode+0xd/0x40
[  160.663981][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.664021][ T6176]  ? xattr_resolve_name+0x27d/0x3f0
[  160.664072][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.664112][ T6176]  ? vfs_getxattr_alloc+0xec/0x350
[  160.664168][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.664208][ T6176]  ? ima_get_hash_algo+0x241/0x400
[  160.664250][ T6176]  ? __pfx_ima_get_hash_algo+0x10/0x10
[  160.664283][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.664328][ T6176]  ? process_measurement+0xdfe/0x2350
[  160.664369][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.664408][ T6176]  process_measurement+0xdfe/0x2350
[  160.664453][ T6176]  ? __pfx_process_measurement+0x10/0x10
[  160.664492][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.664542][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.664601][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.664641][ T6176]  ? __configfs_open_file+0x6ca/0x9c0
[  160.664672][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.664715][ T6176]  ima_file_check+0xcc/0x120
[  160.664753][ T6176]  ? __pfx_ima_file_check+0x10/0x10
[  160.664797][ T6176]  security_file_post_open+0xc4/0x210
[  160.664840][ T6176]  path_openat+0x985/0x4280
[  160.664899][ T6176]  ? __pfx_path_openat+0x10/0x10
[  160.664955][ T6176]  do_file_open+0x20e/0x430
[  160.665003][ T6176]  ? __lock_acquire+0x49f/0x1a40
[  160.665043][ T6176]  ? __pfx_do_file_open+0x10/0x10
[  160.665108][ T6176]  ? _raw_spin_unlock+0x28/0x50
[  160.665148][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.665188][ T6176]  ? alloc_fd+0x471/0x7a0
[  160.665243][ T6176]  do_sys_openat2+0x10f/0x1e0
[  160.665275][ T6176]  ? __pfx_do_sys_openat2+0x10/0x10
[  160.665309][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.665361][ T6176]  __x64_sys_open+0xfe/0x1d0
[  160.665393][ T6176]  ? __pfx___x64_sys_open+0x10/0x10
[  160.665430][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  160.665474][ T6176]  do_syscall_64+0x115/0x870
[  160.665526][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  160.665560][ T6176] RIP: 0033:0x7f2f8859e0d9
[  160.665585][ T6176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  160.665623][ T6176] RSP: 002b:00007f2f89418028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[  160.665654][ T6176] RAX: ffffffffffffffda RBX: 00007f2f88825fa0 RCX: 00007f2f8859e0d9
[  160.665677][ T6176] RDX: 0000000000000041 RSI: 0000000000040280 RDI: 00002000000003c0
[  160.665698][ T6176] RBP: 00007f2f88635024 R08: 0000000000000000 R09: 0000000000000000
[  160.665718][ T6176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  160.665739][ T6176] R13: 00007f2f88826038 R14: 00007f2f88825fa0 R15: 00007ffd99a1bec8
[  160.665772][ T6176]  </TASK>
[  160.665784][ T6176] 
[  161.180427][ T6176] Allocated by task 6135:
[  161.184746][ T6176]  kasan_save_stack+0x30/0x50
[  161.189449][ T6176]  kasan_save_track+0x14/0x30
[  161.194125][ T6176]  __kasan_kmalloc+0xaa/0xb0
[  161.198740][ T6176]  __kmalloc_node_track_caller_noprof+0x331/0x830
[  161.205186][ T6176]  kstrndup+0x64/0x120
[  161.209276][ T6176]  f_midi2_opts_str_store.constprop.0+0xbf/0x240
[  161.215610][ T6176]  configfs_write_iter+0x302/0x4e0
[  161.220723][ T6176]  vfs_write+0x6ac/0x1050
[  161.225068][ T6176]  ksys_write+0x12a/0x250
[  161.229429][ T6176]  do_syscall_64+0x115/0x870
[  161.234047][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  161.239943][ T6176] 
[  161.242258][ T6176] Freed by task 6179:
[  161.246227][ T6176]  kasan_save_stack+0x30/0x50
[  161.250927][ T6176]  kasan_save_track+0x14/0x30
[  161.255601][ T6176]  kasan_save_free_info+0x3b/0x70
[  161.260635][ T6176]  __kasan_slab_free+0x5f/0x80
[  161.265400][ T6176]  kfree+0x22b/0x6c0
[  161.269307][ T6176]  f_midi2_opts_str_store.constprop.0+0xf0/0x240
[  161.275642][ T6176]  configfs_write_iter+0x302/0x4e0
[  161.280751][ T6176]  vfs_write+0x6ac/0x1050
[  161.285088][ T6176]  ksys_write+0x12a/0x250
[  161.289428][ T6176]  do_syscall_64+0x115/0x870
[  161.294034][ T6176]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  161.299929][ T6176] 
[  161.302242][ T6176] The buggy address belongs to the object at ffff88802b4c1780
[  161.302242][ T6176]  which belongs to the cache kmalloc-32 of size 32
[  161.316115][ T6176] The buggy address is located 8 bytes inside of
[  161.316115][ T6176]  freed 32-byte region [ffff88802b4c1780, ffff88802b4c17a0)
[  161.329652][ T6176] 
[  161.331967][ T6176] The buggy address belongs to the physical page:
[  161.338362][ T6176] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b4c1
[  161.347289][ T6176] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  161.354414][ T6176] page_type: f5(slab)
[  161.358401][ T6176] raw: 00fff00000000000 ffff88813fe1f780 dead000000000100 dead000000000122
[  161.366985][ T6176] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  161.375556][ T6176] page dumped because: kasan: bad access detected
[  161.381956][ T6176] page_owner tracks the page as allocated
[  161.387659][ T6176] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11758506710, free_ts 0
[  161.406687][ T6176]  post_alloc_hook+0xfd/0x120
[  161.411379][ T6176]  get_page_from_freelist+0xf48/0x3530
[  161.416862][ T6176]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  161.422781][ T6176]  new_slab+0xa2/0x640
[  161.426864][ T6176]  refill_objects+0xe3/0x410
[  161.431468][ T6176]  __pcs_replace_empty_main+0x376/0x680
[  161.437024][ T6176]  __kmalloc_cache_noprof+0x479/0x6c0
[  161.442407][ T6176]  usb_get_device_descriptor+0x45/0xe0
[  161.447879][ T6176]  register_root_hub+0x146/0x639
[  161.453087][ T6176]  usb_add_hcd.cold+0xccd/0x1158
[  161.458036][ T6176]  dummy_hcd_probe+0x189/0x2fa
[  161.462815][ T6176]  platform_probe+0x106/0x1d0
[  161.467497][ T6176]  really_probe+0x241/0xa60
[  161.472014][ T6176]  __driver_probe_device+0x20e/0x450
[  161.477334][ T6176]  driver_probe_device+0x4a/0x140
[  161.482399][ T6176]  __device_attach_driver+0x1df/0x320
[  161.487793][ T6176] page_owner free stack trace missing
[  161.493148][ T6176] 
[  161.495458][ T6176] Memory state around the buggy address:
[  161.501075][ T6176]  ffff88802b4c1680: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  161.509129][ T6176]  ffff88802b4c1700: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  161.517185][ T6176] >ffff88802b4c1780: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  161.525238][ T6176]                       ^
[  161.529558][ T6176]  ffff88802b4c1800: fa fb fb fb fc fc fc fc 00 00 00 01 fc fc fc fc
[  161.537614][ T6176]  ffff88802b4c1880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  161.545669][ T6176] ==================================================================
[  161.573967][ T6176] ==================================================================
[  161.582043][ T6176] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  161.589027][ T6176] Read of size 1 at addr ffff88802b4c1789 by task syz.5.74/6176
[  161.596666][ T6176] 
[  161.598995][ T6176] CPU: 0 UID: 0 PID: 6176 Comm: syz.5.74 Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  161.599051][ T6176] Tainted: [B]=BAD_PAGE
[  161.599065][ T6176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  161.599090][ T6176] Call Trace:
[  161.599102][ T6176]  <TASK>
[  161.599115][ T6176]  dump_stack_lvl+0x100/0x190
[  161.599164][ T6176]  print_report+0x13d/0x4b0
[  161.599222][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  161.599271][ T6176]  ? __virt_addr_valid+0x239/0x430
[  161.599322][ T6176]  ? string+0x471/0x4d0
[  161.599372][ T6176]  kasan_report+0xdf/0x1c0
[  161.599416][ T6176]  ? string+0x471/0x4d0
[  161.599472][ T6176]  string+0x471/0x4d0
[  161.599522][ T6176]  ? __pfx_string+0x10/0x10
[  161.599572][ T6176]  ? find_held_lock+0x2b/0x80
[  161.599633][ T6176]  ? debug_mutex_remove_waiter+0xa0/0x320
[  161.599694][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  161.599742][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  161.599795][ T6176]  vsnprintf+0x422/0x1300
[  161.599861][ T6176]  ? __pfx_vsnprintf+0x10/0x10
[  161.599924][ T6176]  scnprintf+0xdb/0x150
[  161.599978][ T6176]  ? __pfx_scnprintf+0x10/0x10
[  161.600036][ T6176]  ? srso_alias_return_thunk+0x5/0xfbef5
[  161.600083][ T6176]  ? down_read+0x13b/0x4c0
[  161.600118][ T6176]  ? __pfx_down_read+0x10/0x10
[  161.600186][ T6176]  ? __pfx_f_midi2_opts_iface_name_show+0x10/0x10
[  161.600237][ T6176]  f_midi2_opts_iface_name_show+0x6e/0xa0