last executing test programs:

1m54.57354747s ago: executing program 1 (id=378):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0}, 0x10)
mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000fff000/0x1000)=nil)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000)
close_range(r0, 0xffffffffffffffff, 0x0)

1m52.990475941s ago: executing program 1 (id=384):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), r0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', <r2=>0x0})
sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x303, 0x0, 0x0, {0x6}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0)

1m52.809440163s ago: executing program 1 (id=385):
r0 = socket(0x400000000010, 0x3, 0x0)
write(r0, &(0x7f0000000040)="3a03000019002551075c0165ff0ffc02802000030004000500e1000c0400070280000f00", 0x33a)

1m52.669872762s ago: executing program 1 (id=386):
syz_mount_image$minix(&(0x7f0000000540), &(0x7f00000002c0)='./file1\x00', 0x8040, &(0x7f0000000c00)=ANY=[@ANYRES16=0x0], 0xfd, 0x1d0, &(0x7f0000000300)="$eJzs3O9uk1AYx/EftIXNP/H/G99qom8cdiYSXxi3O3Hp2Fxkaqxv2jSxxivxRrwVb6BN7A2IAVoKqBVRoK3fT7LsPPQczvM0oZzThArAf+uqJEOGOpKCIHj/4m5wpemcANQj0LegqKeLMQC2ROvrH3U3pHFluQCo0/SwZUY39bH0ZTbqTeZ/ndw6YTcTtZPW9DAefiBpkhpvFVx/TD8Y0f/b7ex4W9JOkfXLp3j8vcX8YWqzUS+Tb76Y/Pze5zhIzX+hcP5x/ffvZPO/KOmSpMthIfay/zVJ139S/3H2/bNvFZwf+BuG9vJx5oCpkzPfe5jEHZ1Y8rpJbEWv7+fiR0lsR/Fe77V/XFUJAEoyf7j+n5vpuKVwwb+8/tvR9dytL0EAlekPhi+PfN97W6ZhjIt1NspPQaOehrUeaZRohJu7NUgj1/ho/oPz7NSac7hzTh3JfVAU3dAD2BjOu/M3Tn8wfHB2fnTqnXqv9t0nrit1H7tOtPN3svv/2Iov1ABsjMXdf7fpRAAAAAAAAAAAAAAAQGk3JN1chgdN5gIAAACgWr97MEjzn/tZ+fDQs/nJftGn4RIBAAAAAAAAAAAAAAAAAACArfE9AAD//zpGOPg=")
syz_mount_image$bfs(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', 0x808000, &(0x7f00000002c0)=ANY=[@ANYBLOB="00cd067ca5fe94f358a97d3799d10d6a0f0d49553970899fa347aa76be1b2509f63779954a38f01042f578e036051ee7d6d1fb7e07c209e650464433ce970000000900000014c931bb00000000", @ANYRESOCT=0x0], 0x1, 0xa0, &(0x7f0000000000)="$eJzs17GJAlEUBdC7s8vuGjgNGNiBNdiKGGpmpAhWZCuWIIgVmInJyDgziHagngP/Py43fcnbXbaDlEm1Saoni+VqNpk3f/p5MA7voEjyl+Q/ybBs8u+tObRbkOxP62n36ubr3DUAAMArKTKqx3cbj/fmJ0mvvQOaBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPCJrgEAAP//sjg1uA==")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
lstat(&(0x7f00000034c0)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0)

1m52.357456906s ago: executing program 1 (id=387):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x68, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_INNER_NUM={0x8}, @NFTA_INNER_EXPR={0x34, 0x5, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x27}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0xb9}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x8}]}}}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xc0}, 0x1, 0x0, 0x0, 0x8000}, 0x0)

1m51.587984085s ago: executing program 1 (id=391):
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000340)="0a000300010000", 0x7)
setsockopt$sock_int(r0, 0x1, 0x1d, 0x0, 0x0)
recvmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x10040, 0x0)
syz_usb_connect(0x0, 0x5b, &(0x7f0000000080)=ANY=[@ANYBLOB="120100001a75ed2099042e159ab4010203010902240001000010000904ff0002ffc3100009050602"], 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x1f, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x80}, [@call={0x85, 0x0, 0x0, 0x93}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffff}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0xd, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)

1m51.421060902s ago: executing program 32 (id=391):
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000340)="0a000300010000", 0x7)
setsockopt$sock_int(r0, 0x1, 0x1d, 0x0, 0x0)
recvmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x10040, 0x0)
syz_usb_connect(0x0, 0x5b, &(0x7f0000000080)=ANY=[@ANYBLOB="120100001a75ed2099042e159ab4010203010902240001000010000904ff0002ffc3100009050602"], 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x1f, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x80}, [@call={0x85, 0x0, 0x0, 0x93}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffff}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0xd, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)

1m16.150705146s ago: executing program 2 (id=755):
r0 = io_uring_setup(0x3efa, &(0x7f0000000000)={0x0, 0x0, 0x1840, 0x2})
io_uring_register$IORING_REGISTER_RESTRICTIONS(r0, 0xb, &(0x7f0000000080)=[@ioring_restriction_register_op={0x0, 0xb}], 0x1)
io_uring_register$IORING_REGISTER_ENABLE_RINGS(r0, 0xc, 0x0, 0x0)
io_uring_register$IORING_REGISTER_RESTRICTIONS(r0, 0xb, 0x0, 0x0)

1m16.080079269s ago: executing program 2 (id=758):
r0 = socket$netlink(0x10, 0x3, 0x8000000004)
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48)
writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200040010000800014004000000", 0x58}], 0x1)

1m16.079561252s ago: executing program 2 (id=760):
syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000000)='./file1\x00', 0x810, &(0x7f00000001c0)={[{@treelog}, {@nodatacow}, {@max_inline={'max_inline', 0x3d, [0x6d, 0x38, 0x78, 0x39, 0x65, 0x36]}}, {@space_cache}, {@nodatasum}, {@nobarrier}, {@flushoncommit}, {@noautodefrag}, {@ref_verify}, {@noenospc_debug}, {@clear_cache}, {@commit={'commit', 0x3d, 0x3}}, {@ssd}, {@nobarrier}, {@max_inline={'max_inline', 0x3d, [0x38, 0x0, 0x38, 0x35, 0x32, 0x25]}}]}, 0xff, 0x50f3, &(0x7f000000a2c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTtRq2fvz3mQI6xdW8rsJfhMPtyspzI8VCh2tpMe22CMvzI8XCh1zSY/NkyE8uLCyPyn8PxbaSeHK2rxwJCmcjoX8fOgWjiWFE/FM+3xtPt208H0s5BdYzMcrKNZ0L4lIelzt12OhcMMeZ7sHBwAAuKfE8Jxn2bHeZkij7Hxt0A6rB+0wMmiH+qAdRpMd0h37bQ+zvYW4vX1m49Ke/39kuPwf34pV2aLf9f8hXv+fP9ewe/3/bCw0ksJ8LLTSOwa04jGysPtxPEajlfe4sr5bAAAAgLta/F6gvsLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5h715j5KruA4CffY734fVCUoXQKNkkNY6beL22gUQtVdaUqhEpzbqhoCqi2NhrsnjBjm1KjEJkbCIaIShtkJIPRRhFUc0HqBWISAoIFymOUHlEVEUBBAqtIQoipSQRaYIUqtl7z+ydc3cefqzx0t9P8s6Z+Z/nnYfn3HvnXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/h4Feu+dtm8Ud/e96zL1w8fsWetRe/et15pz4ZwsTM4x1ZuKP/xtvHf373uffseWD1HfcdPv+jvXm5PB4Gqn868zs3xFoPLw7h/o4QutPAisEs0JPfH4z1vW8whFPCbKBWYrI/K5E2HL7fF8K+MBuoVfW9vhAGC4ELn3rk4Zuridv6QlgaQqikbTxfydroSwNn9GaB/jSwtTsL/OqtTC3w3c4sAMcsvhlqL/oDE/UZhucu1+D113PcOvb2SofXFRPDjfP9bO08d6qgN31g4pietlJ1zIvS2+Ogd9sCeLeVtvOtnrbiF6n8G8pbs6FK6Nw0uXnD1dM74yOdYXS0q1FN8/Q8P/P6lzYeSXrBvA5jB4aPy+vwlieW3t21/ILH71ux9OX9H9v7yrF280eFTVpMz7dKyF9zC+Z5jMZ9niyAt1/pW9KIL10hhM2f/73PNIuX5v/Dzef/8eUcbzvrcsda3xzK5ubxkcGYeG0om5sDAADAgrEQ9ppuHX3oE83qK83/R9o7/h8P+eeT+Wy0B0MYn0nsXRLCaTOPZ4G7YnOXLQnhgzOpifrA2iRwMIT3ziSW16pKSiyKJUaSwE+G8sB4EjgUAxNJ4FsxcGsSuCEGDiSBjTFwMAmcGwNhqn4cvz+Uj6PtQF8MrM824oF4FsIvhmJrybZ6rlYVAADAcZLPDnvq7xbOdTjWDHF6eaCvVYZ4BnbDDJWkhnQGW5tWNayhu1UNna1qqI17d/Phl2ruaFVz6TSMjvoMt//ybz4bmijN/8eaz/8rc3Sko3T8P4R1M39j7s48Ml2Lr5+oywAAAAAcg4H/ffGbzeKl+f94e+f/x30iXYXM4bG4G2LLkhDG6gNZtX9YDmRHvQfyAAAAACwEtePxtWPhU/ltdop2Op8u5584wvzxwP/4nPl7Dz64vll/S/P/ifbO/++vv806cSj24mtLQlhUCPwg9rIamDESAz/+ZH0gH/+huAFuilXlJybUqropllgfA2NJYF+jEj+slTitPpA/WbXG99bGMZWXKAQAAADghIu7A+Jx+Xj+/4d+s/qaZuVK8//1R3b+/8w8uHR6//RACCu7Q+hKfxjwWH+2MGAMDHbkiYf6s7q60qqu7w/hnOrA0qpezNf/707XGHyqL6sqBk770P7Xz6gmvtkXwspi4OnP3XlWNbEzCdQa/8u+ED5QHW3a+HcWZY33pI1/fVEI7y8EalVdtiiEamO9aVWPVPLrGKRV/XMlhHcVArWqzq6EsCsAsEDF/0o3FR/csevaLRumpye3z2Mi7sPvC5unpidHN26d3lRp0KdNSZ/rljG6vjymdq9881y+RNFF964bbCdd+53gWLGtfD9+6cTB/H78LtQzM87VPXV316RD/siHy02EwjepRkPunOch9xcrmX0SS/XH/L1hICy6esfk9tEvbti5c/uq7G+72Vdnf+NhpmxbrUq3Vf9cfWvj5dFwtazE0W6rZcVKVu68ctvKHbuuXTF15YbLJy+fvGrV2avHzhxbM/bxM1dWRzWW/W0x1GVzVZ0M9a072xzXcRzq6d2FSk7Ep4aEhMRCS2wdWNb0/+TS/H9b8/l//NSJn/z5+gyNjv8Px8P82eOzh/nXx8C+do//Dzc6ml87MWAkCeyOgd0O8wMAAPDOECf5cW9m3Cv90+XfeblZudL8f3d7v/8/Tuv/15auP7/RMv/LY4mxRuv/p8v819b/391o/f90mf/a+v/73ob1/6+uBZJN8gvr/wMAAO8EJ279/5bL+6cXCChlaLm8f3qBgFKGlsv4t3uBgCNe///5//yr/w5NlOb/t7Y3/7dwPwAAAJw8vvxn1/xOs3hp/r+vvfn/iV//LzQ6/3+kUWCi0cKA1v8DAABggWq0/t/wjf2XNitXmv8faG/+H0+76KzLHWt9cyhb0y6ka9q9NlT7yQAAAAAsDJ1hdLSnzbx1K6OuPfo2n8mXAm2WLnrxTw4f2fn/B9ub/9f9LuOWJ5be3bX8gsffvG/F0pf3f2zvK7PH/wEAAID50+5+CQAAAAAAAAAAAAAA4O334n/sWdMsXvr9f1g383ij3//H6/7F3xe8uy53rLX1+n/5/Qs/fc+umSULHxsK4cPFwJY9W04J+bX5lxUDD1+y/D3VxJ60xIMvnPtSNXFpGvjUilPfqCbOSQLr4yKJ700D8aqKbyxOAnF5xX9PA3F7HEgDvXngq4uzcXSk2+qng9m26ki31bODISwpBGrb6v7BrI2OdIC3JYHaAL+QBuIA/zwPdKa9umcg61UMDMaidwxkvQIA4KQVvwX2hM1T05Nj8St8vD29u/42qluy7PpytR1tNv9cvjTZRfeuG2wn3ZV+F5291nhPqFSHsKr0dbWYpWNmlMenlhab7t0NhtxqtbfOBuVSR7rpehuPqC8b0ejGrdObeloOfE3rLKu7W2ZZVZrsFLN0zmzSNmppoy9tjKjNbdNGl+P9zjA62pXk+oMYHA51Wr0i2v29fnGdv0avgmKeqw7v/VWz+krz/+H25v+V4rjeyC8GsDteWe/vlljmHwAAAObXV9f++hvx32dvfPTpZnlL8/+R9ub/cQ9Wfig429txMF7/f++SEGYurT+cBe6KzV22JIQPzqQmYonsgvrnxxJjWeCuuMNkeSyxfqK+qkUxcCAJ/GQoDxxMAodiIN9LsT/ku3L+fiiEs2ZS6+pLbIslhpPAZ2JgJAmMxsBYElgcA+NJ4NXFeWAiCfxbDISp+m117+J8WwEAAByJfJ7VU383pPO8A92tMnS0ytDfKkNnqwyVVhkajSLe/3bM0JOcvNJRyNST1tqX1FLKEC+Gf8T9KmUIP6zPmRYsNR3PP6idb9BRn+GBT3RXQhOl+f9Ye/P//vrbrPVDcf4/e/2/LPCD2L2vxVPHR2Lgx5+sD+Q7Bg7Fye5Ntaom8hL5pP2mWGI8BkaSwLYYGE8C69flgX3vqQ/kM+1a43trjU/lJQoBAAAAOOHiDoK4mybO/+/Y8ZWBZuVK8//x9ub/sb2BYmM3xFoPLw7h/o7Z3tQCKwazQNyPMRh/Hv++wRBOKezgqJWY7M9K9CYNh+/3Zb9Q702r+l5f9uODeP/Cpx55+OZq4ra+EJYW9r7U2ni+krXRlwbO6M0C/Wlga3cWiHt+aoHvdmYBOGa1vYLxBZWf6lIzPHe5Bq+/d8o1QdPhlfaBzpFvrt9czZfSDtd8n2rNkT1tTfffctyU3h4HvdsW4rtt2Lut+EUq/4by1myoEjo3TW7ecPX0zvhI8ZesJfP0PBd/pdpO+ji8DncffW9bq6QdGEs+PsbmLjf367AjVnfLE0vv7lp+weP3rVj68v6P7X2l7W40EH8o/Mh1/zr4o8LmnW+VkL/mFtznyYTPk4X438CIpy2EsO7Vr9/ULF6a/0+0N//vTm5n/DpuzB1LQvhIYeM+Fjf/Hy/JPgcLgexT8l3lQHbI/b+GGn5yAgAAwPFW291R218wld9mJ4Sn8+Ry/okjzB/3V4zPmb/dfvf/9SVLm8VL8//1zef/i5JuOv7v+D/zxPH/OZ3su6IXpQ/sPqZd0aXqmBeO/8/pZH+3Of4/J8f/Hf+fi+P/LTj+P6eT/WkrfUva5ktXCOHlP3ro2Wbx0vx/W3vzf+v/zb1oX239v/WN1v/b1mj9v93W/wMAAOZVg4Xm0nleafW+UoZ09b5ShpYLBLZcYtD6f0e8/t9Lpz//m9BEaf6/u735f3w5DBRbXyjr/42sa1DVrTGwzcKAAAAAnIwa7SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg7fXAP/zPpmbxR3973rMvXDx+xZ61F7963XmnPhnC1MzjHVm4o//G28d/fve59+x5YPUd9x0+/6OVvFxPfvu7dbljrW8OhbCv8MhgTLw2VL0zG7jw0/fs6q4mHhsK4cPFwJY9W06pJr41FMKyYuDhS5a/p5rYk5Z48IVzX6omLk0Dn1px6hvVxDl5oCPt7j8uzrrbkXb35sUhLCkEat29YnF9VbU2/jQPdKZt/NNg1kYMDMai3xjM2oiB6VhialEIK7tD6EqrerSSVdWVVvUvlayqrrSqL1dCOCeE0J1W9UJvVlV3OvIne7OqYuC0D+1//YxqYl9vCCuLgac/d+dZ1cQXkkCt8b/oDeED1ZdM2vi3e7LGe9LGb+sJ4f0hhN60xC+7sxK9aYkXu0N4VyFQa/zz3SHsCrwjxA+fuk+0Hbuu3bJhenpy+zwmevO2+sLmqenJ0Y1bpzdVkj410lFIv3X90Y/9ude/tLF6e9G96wbbSXfn5Xpmury6p+7umpO997Ff/cVKZp+PUv0xf28YCIuu3jG5ffSLG3bu3L4q+9tu9tXZ3648mm2rVQtlWy0rVrJy55XbVu7Yde2KqSs3XD55+eRVq85ePXbm2Jqxj5+5sjqqsezv8RjqnSd+qKd3Fyo5ER8AEhISCy3RWffpNnayf5CXvujPdrQnVGY+oEvTimKWjplRHo9Brz3KER/N95SWI1pVmjiUsqyeI8v19VnWlCYTs7X0ZVlmvteVJofFxjpnNmm83xlGR7sabYfh+rvFzfuzY9i8z+Sbrt00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/HDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwA8cCAAAAAML8rcPo2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEsBAAD//+erI4o=")
renameat2(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x22)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0)
pwrite64(r1, &(0x7f0000000000)='2', 0x1, 0x4fed0)
pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xfecc)

1m14.536649856s ago: executing program 2 (id=774):
r0 = syz_open_dev$cec(&(0x7f0000000d00), 0x0, 0xc2b02)
ioctl$CEC_ADAP_G_LOG_ADDRS(r0, 0x805c6103, &(0x7f0000000300))
r1 = syz_mount_image$iso9660(&(0x7f0000000240), &(0x7f0000000140)='./file1\x00', 0x1000c01, &(0x7f0000000040)=ANY=[], 0x5, 0x811, &(0x7f0000002380)="$eJzs3U1sHHcVAPA3rp04jkirgkoUpekkKVIiUndtty5WD2W7HjvT2rvW7holqlAbNU6J4vRTVWmEaHNpASEhThxLOVa99AZCAokDcEKiBy4ckCr1hAoCCYEAyWhnd+O1Y6/z5Vi0v5/Vndn/vJl5/9npvJ3NzmwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJFUpkulsSTm8uriqXRzlel6bb7P9O7yfrlm0Ge9EUnrvxgejv3tpv1fWJ18T+vhSBxsPzsYw63BcFzae89dj35+cKA7f5+EbtThzScN9T5JIt5sJXXhzPLy0svbkMht9L2fd0aGexp3RfTZvv9aaT3OZtW8Ucvny7NZmjdq6dTkZOnBkzONdCafyxqnG81sPq3Us3KzVk+PVY6nY1NTE2k2erq2WJ2dLs9l3cZHHhgvlSbTJ0YXsnK9Uas++MRoo3Iyn5vLq7NFzHjptWjFPNLaEZ/Mm2kzK8+n6bnzy0sTW/WuFTS2pmX3mo4dvP+uj1/96O/nl1o75GYLSTo75vjY2Pj42OTDUw8/UioNjpfG1zaU1okrETEQ0YrYlp2WnbV3g7bBzh5z1YSIlTtvzcEbbtJAp/7HXORRjcU4FWmkMVA8rv4NRSWmox61mG89/8PQuulpdA6Q3fr/pQf/8rt+6+2t/90qv3918oEo6v+h9rNDm9X/q7K4/r+xO681svp+O5vetlfi9bgUF+JMLMdyLMXLN5LDrvVL3ca/gVu7vNnIohp5NKIWecxHuWhJOy1pTMVkTEYpno6TMRN7Io2ZyGMusmjE6WhEM7Jij6pEPbIoRzNqUY80jkUljrdenZiKqZiINLIYjdNRi8WoxmxMR7lYyrk4X2z3iXV53fPtZ3723O8/fqc1fiVorE9HktabuVbQ3/oEXVXur6P+dyPU/0+b4c4x61rjb+nxG27GSlH/B699hv/8ZDvTAQAAALZBUnz6nkTEUNxbjM3kc9lTO50WAAAAcAsVX9s72BoMtcbujaR1/l/aIPLD254bAAAAcGskxTV2SUSMxH3tse7lUht9CAAAAAD8Hyr+/f9QazAS8UbR4PwfAAAAPmW+s9k99j/a1bnHbmNhd/KLv0a9PpRcXrkyX/niHe2RzuBrV6Y0Zw4k+zoLKQaTg5f2JhExWMkOJt27X/53d3v4SfF4YPUGhJvd6z8pElg4dX9ysbxRAtE/geJZfD8Ot2MOn20Pz3antNcyMpPPZaOV2tyjY0nnw5Hmq8+f/2YU3f9udX5fEufOLy+NPvvC8tkil8utpVy+2Ln7cdKdK6J9QUWfXFY6WyDu3bjHQ8WFGJ31jrTXW+rt/0B79oH+/U961/lWHGnHHBlpD0fW9n+4tc6x0UfHolzeN9DMTjVfXenpfSeLsXbP31zT8+t4Fd6Ko+2Yo8eOtgcbZDG+Jovnr85ivHf7X9u2uOYs3jn8xql//LqWZBNbZTFxk1kA7JRzxV1/VqvQnqIK/XulrVXQ1tXdPd05r+cod271XUZ3/p5aNxhXVff0Rqr7W3GsHXOs/X5i8MAGdaW0wRH9xfMv/qZzRH/ovR/9+OuHfvvBurp+HVm8F8fbMZ1B3P2rTWpsfeXO5BtPra2q77bmeHfT9TbmxpO4o7URix8fiksPnL945rml55aeHx+fmCw9VCo9PB5DxVuFzmCTTFUegM+2Pr+x0yq9yQffuhK62a/wJA9tcVZ995WvFIzGs/FCLMfZOFFcbRAR92281JGeryGc2OKsdaTnF15ObHFuuRo7vj5299Ek9kbEBrETPVvsiz8sBv/cphcEAG6DI1vU4aT7DuG1z3XmWBdxR5Kc2OK8e20tP94+d+2eHcfmtXwjX9nm7QEAnwVZ/ZNkpPl2Uq/nC0+PTU2NlZsns7ReqzyZ1vPp2SzNq82sXjlZrs5m6UK91qxVuh8dT2eNtLG4sFCrN9OZWj1dqDXyU8Uvv6edn35vZPPlajOvNBbmsnIjSyu1arNcaabTeaOSLiw+Ppc3Tmb1YubGQlbJZ/JKuZnXqmmjtlivZKNp2siynsB8Oqs285k8G0rzarpQz+fL9csRMbc4n6XTWaNSzxeatfYCu+vKqzO1+nyx2NEi7Zd6u//nndjmALDTXnn90oUzy8tLL9/YyB+vJXin+wgArLVBld6zowkBAAAAAAAAAAAAAABXufpyvVbrmpbh6H+R31Dc8OWDr+yOm7n68NM38uX32y/LzS/wvpduZjl7YnnXasuuzs6y89vnukeeeeyxC6styWDv5n38jf0n/5RFt3d9lrPx/ykbXer69r6IXT/9Qbvlq5sEJ4O3uKcfRsQNzL6S9Im5/cciAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjK/wIAAP//BPFR5w==")
mkdirat(0xffffffffffffff9c, 0x0, 0x0)
futex_waitv(0x0, 0x0, 0x0, 0x0, 0x1)
syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x800)
r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00')
r3 = epoll_create1(0x0)
clock_gettime(0x0, &(0x7f0000000100)={<r4=>0x0, <r5=>0x0})
ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc0585609, &(0x7f0000000280)={0x0, 0x2, 0x4, 0x8, 0x2, {r4, r5/1000+10000}, {0x4, 0xc, 0x5, 0x1, 0x6, 0xff, "0be8c911"}, 0x90e5344, 0x4, {<r6=>0xffffffffffffffff}, 0xe, 0x0, r1})
epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r6, &(0x7f0000000040))
r7 = syz_init_net_socket$netrom(0x6, 0x5, 0x0)
getsockopt$netrom_NETROM_N2(r7, 0x103, 0x3, 0x0, 0x0)
epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r2, &(0x7f0000000c40)={0x8000203d})
pipe2$9p(&(0x7f0000000240)={<r8=>0xffffffffffffffff, <r9=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r9, &(0x7f0000000180)=ANY=[@ANYBLOB="1500000065ffff097b00000800395032303030"], 0x15)
r10 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r10)
ptrace(0x19, r10)
r11 = dup(r9)
read$FUSE(r11, &(0x7f0000004c00)={0x2020, 0x0, <r12=>0x0, 0x0, 0x0, <r13=>0x0}, 0x2020)
write$FUSE_BMAP(r11, &(0x7f0000000000)={0x18, 0x0, r12, {0xfffffffffffffffc}}, 0x18)
write$FUSE_DIRENTPLUS(r11, &(0x7f0000000440)=ANY=[@ANYBLOB="b0"], 0xb0)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r8, @ANYBLOB=',wfdno=', @ANYRESHEX=r11, @ANYBLOB=',directio,access=user,cache=mmap,vession=9p2000,cache=none,version=9p2000.u,obj_type=trans=fd,,\x00'])
newfstatat(0xffffffffffffff9c, &(0x7f0000000e80)='./file1\x00', &(0x7f0000000f00), 0x800)
r14 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x200, 0x20, 0xa}, 0x18)
kcmp(r13, r10, 0x0, r9, r14)

1m13.676918057s ago: executing program 2 (id=779):
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x83, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c800, 0x8, 0xc1})
io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0)

1m13.370555655s ago: executing program 2 (id=780):
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x5, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x4a10c000)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
readahead(0xffffffffffffffff, 0xe, 0x8)

1m12.790631005s ago: executing program 33 (id=780):
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x5, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x4a10c000)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
readahead(0xffffffffffffffff, 0xe, 0x8)

2.210310649s ago: executing program 3 (id=1587):
unshare(0x28000600)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff})
vmsplice(r0, &(0x7f00000001c0)=[{&(0x7f0000000640)="ec", 0x1}], 0x100000000000029d, 0xf)

2.089306215s ago: executing program 3 (id=1588):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa10000000000000701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0500000004000000080000000a"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x11, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000006687000000000000000000850000007b00000095"], 0x0}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r1}, 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x7a, 0xa, 0x0, 0xff00, 0x0, 0x71, 0x10, 0x43}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80)

1.956580013s ago: executing program 3 (id=1590):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x500, 0x0, 0x1c, {[@window={0xb, 0x3}, @timestamp={0x5, 0x2, 0xfffe, 0x88000}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e)

1.56291167s ago: executing program 3 (id=1593):
socket$inet6_sctp(0xa, 0x0, 0x84)
r0 = socket(0x15, 0x5, 0x0)
connect$l2tp6(r0, 0x0, 0x0)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x18, 0x3b, 0x92, 0x20, 0x13b1, 0x42, 0x5816, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0xe6, 0x9, 0xe, 0x0, [], [{{0x9, 0x5, 0xb, 0x0, 0x400}}]}}]}}]}}, 0x0)
syz_emit_ethernet(0x22, &(0x7f0000000000)={@random="e90c610faca2", @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x11, 0x14, 0x68, 0x0, 0x2, 0x0, 0x0, @rand_addr=0x64010101, @multicast1}}}}}, 0x0)

1.288937899s ago: executing program 4 (id=1594):
syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000500)={[{@data_err_abort}, {@nojournal_checksum}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@init_itable_val={'init_itable', 0x3d, 0x1}}, {@data_err_ignore}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x4}}, {@data_err_ignore}, {@journal_dev={'journal_dev', 0x3d, 0x800}}, {@nobh}, {@inlinecrypt}, {@data_err_ignore}, {@dioread_nolock}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==")

1.209866671s ago: executing program 0 (id=1595):
r0 = socket(0x1d, 0x2, 0x6)
setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x6a, 0x4, 0x20000000, 0x2)

1.109761413s ago: executing program 4 (id=1596):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='contention_end\x00', r0}, 0x18)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCSIFBR(r1, 0x890c, &(0x7f0000000200)=@generic={0x2, 0x10000000000002, 0x1})

1.109567363s ago: executing program 0 (id=1597):
r0 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0)
write$binfmt_script(r0, &(0x7f00000001c0)={'#! ', './file0'}, 0xb)
pwrite64(r0, &(0x7f0000000040)="0a1ed5", 0x3, 0x2)
execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000)

1.109409293s ago: executing program 4 (id=1598):
r0 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$DRM_IOCTL_VERSION(r0, 0xc0406441, &(0x7f0000000280)={0x34, 0x0, 0x3, 0xffffffffffffff91, 0x0, 0x0, 0x0, 0xfffffffffffffcb3, 0x0})

1.028297641s ago: executing program 4 (id=1599):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="01012abd7000000008002b00000008000300", @ANYRES32=r2, @ANYBLOB="040046000a0034000202020202020000080026006c0900004c0051802c0000800800030005ac0f00040005000500020003000000110001"], 0x80}, 0x1, 0x0, 0x0, 0x80}, 0x4804)

1.027637582s ago: executing program 0 (id=1600):
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x3fe3aa0262d8c583, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xf}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0xfffffffc, 0x27, 0x8, 0xb}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc083}, 0x2000400c)
sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0)

1.026980697s ago: executing program 4 (id=1601):
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0)
fcntl$lock(r0, 0x5, &(0x7f0000000080)={0x1, 0x1, 0x87f9, 0xfffffffffffffff6})

950.265361ms ago: executing program 0 (id=1602):
r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
ioctl$DRM_IOCTL_GET_MAGIC(r0, 0x80046402, 0x0)
ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000200)=0x80000001)

950.014981ms ago: executing program 4 (id=1603):
syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x6d, 0x33, 0x95, 0x8, 0xfe9, 0xdb51, 0x5e35, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0xd4, 0x40, 0x0, [{{0x9, 0x4, 0x22, 0x0, 0x0, 0x8f, 0x53, 0x4e, 0x1}}]}}]}}, 0x0)

884.071055ms ago: executing program 0 (id=1604):
r0 = socket$inet6(0xa, 0x805, 0x0)
getsockopt$bt_hci(r0, 0x84, 0xd, &(0x7f0000001080)=""/4082, &(0x7f0000000040)=0xff2)

789.835924ms ago: executing program 0 (id=1605):
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x0, 0x0)
sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt(r5, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f0000000080)={0x0, 0x5, 0x1, "fd"}, 0x9)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f0000000140)={0x0, 0x9, 0x1, "eb"}, 0x9)
setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x23, 0x0, 0x0)
r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, r6, 0x1}, 0x14}}, 0x0)
sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)

99.984136ms ago: executing program 3 (id=1606):
syz_mount_image$cramfs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="00af268263b121dc03d7d9b98b9cdb76841d31005b31fdfd141b652968fbeae7aac982a517703dc5950f6728aecf5ec337b119ffd66d0a02970718ba573db352906385cece74366e628b6a775c9a6f6fff046416c6240e39a647186c4cf0b360bd17d4cdbd912dc61fd24e6f17d8"], 0x1, 0x152, &(0x7f00000007c0)="$eJzs0E1LKnEUx/Hf3Bnlcq/eBzKwFia0aEjMacRatdBIEtKBwk0rwSYKFCOhXBrRrkXQ1oXlVnwLlrWxRgh7E23cBS0n/o7Rw67977MZ5nsOh2FWlnoqgoAMx3KpuLdvlsvmVnDdSCc3ntrtuOhuAD8/zZ39qziwI54KMDgCRL7xAtu7BXMuXyqI90EcUAEkfjtdg7P7SzSf0+YhSaKp00Bn3Gn6aO9ji47apAIk/r7fsy+AGXHv/9s94BlApRZquZCxbNu2xfeepEJTY5LTm3cZq5sKzwbMUz050fD4ZWTN20skhvPHSDf8EGk1+z0rvWakjV5U1xeimqJpsb5xb6Vi1TMoq54DYPPLPTf8ASULHEvA+XA2uJa8ADr1F6P4Z7E++tfVQzkISJVaPud3NXK+fz8gq5BARERERERERERERERERET0Xa8BAAD//wFeZcY=")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f00000001c0)='./file0\x00')
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040), &(0x7f0000000240)=ANY=[], 0x25, 0x2)

0s ago: executing program 3 (id=1607):
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./bus\x00', 0x41, &(0x7f0000000340)={[{@errors_remount}, {@noload}, {@bh}, {@acl}, {@noblock_validity}, {@usrquota}, {@stripe={'stripe', 0x3d, 0x66}}, {@acl}, {@resgid}, {@resuid}, {@acl}, {@journal_dev={'journal_dev', 0x3d, 0x3}}], [], 0x3d}, 0x1, 0x536, &(0x7f0000000740)="$eJzs3UFsI1cZAOB/HHu7yaZNChygEqXQouwK1k4a2kY9lCIhOFUCyn0JiRNFceIodtokqmhWHDgiIQRInMqFCxInTkioEheOCKkSnEGAQAi2cEBa6CDb4zSbjJOwceLd+Puk8bz3PPP+9xzNZN7MaCaAofVURLwcEe+laXojIiay8kI2xV5nai337p03FlpTEmn66t+TSLKybl1p2yNxLVvtakR85YsRX0+Oxm3s7K7O12rVzSxfaa5tVBo7uzdX1uaXq8vV9dnZmefnXph7bm66L/0cj4iXPv/n7337x1946Reffv0Pt/56/RtJVh6H+vF/Kh73ZafrpfZvcXCFzfsM9qC5m6Zpsd3DzGjeUiNHSm6fc7sAAOjtAxHxiYi4ERMxcvzhLAAAAPAQSj87Hv9JutfujrjSoxwAAAB4iBTa98AmhXJ2v+94FArlcrTv4f1QjBVq9UbzU0v1rfXFzr2yk1EqLK3UqtPZvcKTUUpa+Zl2+v38s4fysxHxeER8d2K0nS8v1GuLgz75AQAAAEPi2qHx/78mOuN/AAAA4JKZHHQDAAAAgHNn/A8AAACXn/E/AAAAXGpfeuWV1pR233+9+NrO1mr9tZuL1cZqeW1robxQ39woL9fry+1n9q2dVF+tXt/4TKxvbVea1Uaz0tjZvbVW31pv3lq55xXYAAAAwAV6/GNv/y6JiL0XR9tTy5XTrXrKxYAHVXE/lWTzzma9PXZgod8/1pn/qfXhNB5cFiODbgAwMMVBNwAYmNKgGwAMXHLC9z1H/b/O5h8/UPZmf9oEAAD019RH8q//n3xecK9wAc0DzpHrfzC8bP8wvNrH+ae9k9cRP1wqJUcAMPTOfP3/RGl6ukgAAMB5GW9PSaGcnd4bj0KhXI54tP1agFKytFKrTkfEYxHx24nSI638THvNxJE8AAAAAAAAAAAAAAAAAAAAAAAAAJxSmiaRAgAAAJdaROEvyS87z/Kfmnhm/PD5gSvJvycie0Xo6z989fvb883m5kyr/B/75c0fZOXPDuIMBgAAAAyFYm5pj5fzdcfp3XE8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPTTu3feWOhOFxn3b5+LiMm8+MW42p5fjVJEjP0zieKB9ZKIGOlD/NHWx4fz4ietZu2HzIs/+tbZ4+/dPjZ+TGa/Ql78a2cPD0Pt7db+5+W87a8QT7Xn+dtfMeKe/P3qvf+L/f3fSI/t/9FTxnjinZ9Wesa/HfFEMX//042f9Ij/dF6FP/vWkaKvfXV3t1f89K2Iqdz/P8k9sSrNtY1KY2f35sra/HJ1ubo+Ozvz/NwLc8/NTVeWVmrV7DM3xnc++vP3juv/WI/4kyf0/5mc+q7klP33ne07H+wkS3nxrz+dE/9XP8qWOBq/kP3v+2SWbn0/1U3vddIHPfmT3zx5XP8Xe/T/pL//9V6VHnLjy9/84ykXBQAuQGNnd3W+VqtuPhiJF6PvNbdG+APv18OXuJsOJPrdNE0vLuibfa0wTdO0tU2doZ4kLu4HT45v6qD3TAAAQL+9f9A/6JYAAAAAAAAAAAAAAAAAAADA8DqH54p1q+75ZIG9/VTSj0doAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD0xf8CAAD//6Uy48E=")
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00')
read$FUSE(r0, &(0x7f00000029c0)={0x2020}, 0x2020)

kernel console output (not intermixed with test programs):

t pyra_device
[  115.324944][ T6007] pyra 0003:1E7D:2CF6.0003: couldn't install mouse
[  115.337601][ T6007] pyra 0003:1E7D:2CF6.0003: probe with driver pyra failed with error -71
[  115.358784][ T6007] usb 3-1: USB disconnect, device number 6
[  115.627132][ T5915] usb 1-1: new high-speed USB device number 8 using dummy_hcd
[  115.787024][ T5915] usb 1-1: config 0 has an invalid interface number: 117 but max is 0
[  115.790620][ T5915] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  115.795514][ T5915] usb 1-1: config 0 has no interface number 0
[  115.798065][ T5915] usb 1-1: too many endpoints for config 0 interface 117 altsetting 0: 239, using maximum allowed: 30
[  115.802588][ T5915] usb 1-1: config 0 interface 117 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 239
[  115.811672][ T5915] usb 1-1: New USB device found, idVendor=0742, idProduct=2009, bcdDevice=61.46
[  115.816336][ T5915] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  115.819980][ T5915] usb 1-1: Product: syz
[  115.821728][ T5915] usb 1-1: Manufacturer: syz
[  115.823707][ T5915] usb 1-1: SerialNumber: syz
[  115.828714][ T5915] usb 1-1: config 0 descriptor??
[  115.844607][ T5915] HFC-S_USB 1-1:0.117: probe with driver HFC-S_USB failed with error -5
[  115.901945][ T7201] loop3: detected capacity change from 0 to 40427
[  115.924556][ T7201] F2FS-fs (loop3): Insane cp_payload (553648128 >= 504)
[  115.939810][ T7201] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock
[  115.943216][ T7201] F2FS-fs (loop3): build fault injection rate: 17008
[  115.948279][ T7201] F2FS-fs (loop3): build fault injection type: 0x1f8
[  115.980298][ T7201] F2FS-fs (loop3): invalid crc value
[  116.040962][ T7201] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  116.054346][  T792] usb 1-1: USB disconnect, device number 8
[  116.059238][ T7201] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0
[  116.061924][ T7201] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
[  116.140356][ T7217] loop2: detected capacity change from 0 to 1024
[  116.161600][ T7217] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  116.199792][ T5859] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  116.321799][ T7201] syz.3.480: attempt to access beyond end of device
[  116.321799][ T7201] loop3: rw=2049, sector=45096, nr_sectors = 24 limit=40427
[  116.328344][ T7201] CPU: 0 UID: 0 PID: 7201 Comm: syz.3.480 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  116.328365][ T7201] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  116.328374][ T7201] Call Trace:
[  116.328379][ T7201]  <TASK>
[  116.328385][ T7201]  dump_stack_lvl+0x189/0x250
[  116.328411][ T7201]  ? __pfx_dump_stack_lvl+0x10/0x10
[  116.328427][ T7201]  ? __pfx_queue_work_on+0x10/0x10
[  116.328441][ T7201]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  116.328456][ T7201]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  116.328479][ T7201]  f2fs_handle_critical_error+0x37c/0x540
[  116.328501][ T7201]  f2fs_write_end_io+0x886/0xb60
[  116.328530][ T7201]  __submit_merged_bio+0x27a/0x6a0
[  116.328552][ T7201]  __submit_merged_write_cond+0x255/0x530
[  116.328573][ T7201]  f2fs_write_data_pages+0x261d/0x3000
[  116.328617][ T7201]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  116.328668][ T7201]  ? check_path+0x21/0x40
[  116.328679][ T7201]  ? check_noncircular+0xe0/0x160
[  116.328730][ T7201]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  116.328748][ T7201]  do_writepages+0x32e/0x550
[  116.328772][ T7201]  ? do_raw_spin_unlock+0x4d/0x240
[  116.328788][ T7201]  filemap_fdatawrite+0x199/0x240
[  116.328803][ T7201]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  116.328885][ T7201]  ? do_raw_spin_unlock+0x4d/0x240
[  116.328905][ T7201]  f2fs_sync_dirty_inodes+0x31f/0x830
[  116.328936][ T7201]  f2fs_write_checkpoint+0x95a/0x1df0
[  116.328977][ T7201]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  116.329026][ T7201]  ? down_write+0x162/0x1f0
[  116.329042][ T7201]  ? __pfx_down_write+0x10/0x10
[  116.329068][ T7201]  f2fs_issue_checkpoint+0x3ac/0x570
[  116.329088][ T7201]  ? __pfx_f2fs_issue_checkpoint+0x10/0x10
[  116.329112][ T7201]  ? do_raw_spin_lock+0x121/0x290
[  116.329135][ T7201]  ? __up_read+0x280/0x680
[  116.329157][ T7201]  ? f2fs_sync_fs+0x200/0x3d0
[  116.329174][ T7201]  f2fs_do_sync_file+0x869/0x1860
[  116.329200][ T7201]  ? __pfx_f2fs_do_sync_file+0x10/0x10
[  116.329247][ T7201]  ? __pfx_down_write+0x10/0x10
[  116.329262][ T7201]  ? sb_start_write+0x114/0x1c0
[  116.329276][ T7201]  ? mnt_want_write_file+0x164/0x200
[  116.329290][ T7201]  __f2fs_ioctl+0x485a/0xb610
[  116.329320][ T7201]  ? file_ioctl+0x22d/0x780
[  116.329336][ T7201]  ? __pfx_file_ioctl+0x10/0x10
[  116.329359][ T7201]  ? kasan_quarantine_put+0xdd/0x220
[  116.329376][ T7201]  ? __pfx___f2fs_ioctl+0x10/0x10
[  116.329394][ T7201]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  116.329409][ T7201]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  116.329425][ T7201]  ? do_vfs_ioctl+0xb33/0x1430
[  116.329439][ T7201]  ? __pfx_do_vfs_ioctl+0x10/0x10
[  116.329455][ T7201]  ? do_mprotect_pkey+0xb00/0xce0
[  116.329473][ T7201]  ? __lock_acquire+0xab9/0xd20
[  116.329505][ T7201]  ? __fget_files+0x2a/0x420
[  116.329523][ T7201]  ? __fget_files+0x2a/0x420
[  116.329537][ T7201]  ? __fget_files+0x3a0/0x420
[  116.329551][ T7201]  ? __fget_files+0x2a/0x420
[  116.329568][ T7201]  ? f2fs_ioctl+0x135/0x250
[  116.329584][ T7201]  ? __pfx_f2fs_ioctl+0x10/0x10
[  116.329599][ T7201]  __se_sys_ioctl+0xfc/0x170
[  116.329614][ T7201]  do_syscall_64+0xfa/0x3b0
[  116.329627][ T7201]  ? lockdep_hardirqs_on+0x9c/0x150
[  116.329639][ T7201]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  116.329650][ T7201]  ? exc_page_fault+0x9f/0xf0
[  116.329665][ T7201]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  116.329675][ T7201] RIP: 0033:0x7f3e7e38ebe9
[  116.329687][ T7201] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  116.329697][ T7201] RSP: 002b:00007f3e7f110038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  116.329711][ T7201] RAX: ffffffffffffffda RBX: 00007f3e7e5b5fa0 RCX: 00007f3e7e38ebe9
[  116.329719][ T7201] RDX: 0000000000000000 RSI: 000000000000f502 RDI: 0000000000000006
[  116.329725][ T7201] RBP: 00007f3e7e411e19 R08: 0000000000000000 R09: 0000000000000000
[  116.329732][ T7201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  116.329738][ T7201] R13: 00007f3e7e5b6038 R14: 00007f3e7e5b5fa0 R15: 00007ffc40d983f8
[  116.329759][ T7201]  </TASK>
[  116.329764][ T7201] F2FS-fs (loop3): Stopped filesystem due to reason: 3
[  116.497270][ T7201] CPU: 0 UID: 0 PID: 7201 Comm: syz.3.480 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  116.497292][ T7201] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  116.497301][ T7201] Call Trace:
[  116.497306][ T7201]  <TASK>
[  116.497311][ T7201]  dump_stack_lvl+0x189/0x250
[  116.497337][ T7201]  ? __pfx_dump_stack_lvl+0x10/0x10
[  116.497352][ T7201]  ? __pfx_queue_work_on+0x10/0x10
[  116.497365][ T7201]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  116.497380][ T7201]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  116.497404][ T7201]  f2fs_handle_critical_error+0x37c/0x540
[  116.497425][ T7201]  f2fs_write_end_io+0x886/0xb60
[  116.497460][ T7201]  __submit_merged_bio+0x27a/0x6a0
[  116.497481][ T7201]  __submit_merged_write_cond+0x255/0x530
[  116.497500][ T7201]  f2fs_write_data_pages+0x261d/0x3000
[  116.497541][ T7201]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  116.497591][ T7201]  ? check_path+0x21/0x40
[  116.497604][ T7201]  ? check_noncircular+0xe0/0x160
[  116.497655][ T7201]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  116.497674][ T7201]  do_writepages+0x32e/0x550
[  116.497701][ T7201]  ? do_raw_spin_unlock+0x4d/0x240
[  116.497718][ T7201]  filemap_fdatawrite+0x199/0x240
[  116.497733][ T7201]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  116.497784][ T7201]  ? do_raw_spin_unlock+0x4d/0x240
[  116.497800][ T7201]  f2fs_sync_dirty_inodes+0x31f/0x830
[  116.497828][ T7201]  f2fs_write_checkpoint+0x95a/0x1df0
[  116.497893][ T7201]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  116.497950][ T7201]  ? down_write+0x162/0x1f0
[  116.497964][ T7201]  ? __pfx_down_write+0x10/0x10
[  116.497987][ T7201]  f2fs_issue_checkpoint+0x3ac/0x570
[  116.498005][ T7201]  ? __pfx_f2fs_issue_checkpoint+0x10/0x10
[  116.498027][ T7201]  ? do_raw_spin_lock+0x121/0x290
[  116.498049][ T7201]  ? __up_read+0x280/0x680
[  116.498071][ T7201]  ? f2fs_sync_fs+0x200/0x3d0
[  116.498088][ T7201]  f2fs_do_sync_file+0x869/0x1860
[  116.498114][ T7201]  ? __pfx_f2fs_do_sync_file+0x10/0x10
[  116.498163][ T7201]  ? __pfx_down_write+0x10/0x10
[  116.498180][ T7201]  ? sb_start_write+0x114/0x1c0
[  116.498195][ T7201]  ? mnt_want_write_file+0x164/0x200
[  116.498210][ T7201]  __f2fs_ioctl+0x485a/0xb610
[  116.498240][ T7201]  ? file_ioctl+0x22d/0x780
[  116.498256][ T7201]  ? __pfx_file_ioctl+0x10/0x10
[  116.498279][ T7201]  ? kasan_quarantine_put+0xdd/0x220
[  116.498297][ T7201]  ? __pfx___f2fs_ioctl+0x10/0x10
[  116.498323][ T7201]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  116.498345][ T7201]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  116.498367][ T7201]  ? do_vfs_ioctl+0xb33/0x1430
[  116.498388][ T7201]  ? __pfx_do_vfs_ioctl+0x10/0x10
[  116.498411][ T7201]  ? do_mprotect_pkey+0xb00/0xce0
[  116.498436][ T7201]  ? __lock_acquire+0xab9/0xd20
[  116.498473][ T7201]  ? __fget_files+0x2a/0x420
[  116.498491][ T7201]  ? __fget_files+0x2a/0x420
[  116.498505][ T7201]  ? __fget_files+0x3a0/0x420
[  116.498519][ T7201]  ? __fget_files+0x2a/0x420
[  116.498536][ T7201]  ? f2fs_ioctl+0x135/0x250
[  116.498552][ T7201]  ? __pfx_f2fs_ioctl+0x10/0x10
[  116.498568][ T7201]  __se_sys_ioctl+0xfc/0x170
[  116.498583][ T7201]  do_syscall_64+0xfa/0x3b0
[  116.498595][ T7201]  ? lockdep_hardirqs_on+0x9c/0x150
[  116.498607][ T7201]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  116.498618][ T7201]  ? exc_page_fault+0x9f/0xf0
[  116.498633][ T7201]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  116.498643][ T7201] RIP: 0033:0x7f3e7e38ebe9
[  116.498654][ T7201] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  116.498663][ T7201] RSP: 002b:00007f3e7f110038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  116.498677][ T7201] RAX: ffffffffffffffda RBX: 00007f3e7e5b5fa0 RCX: 00007f3e7e38ebe9
[  116.498686][ T7201] RDX: 0000000000000000 RSI: 000000000000f502 RDI: 0000000000000006
[  116.498693][ T7201] RBP: 00007f3e7e411e19 R08: 0000000000000000 R09: 0000000000000000
[  116.498700][ T7201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  116.498708][ T7201] R13: 00007f3e7e5b6038 R14: 00007f3e7e5b5fa0 R15: 00007ffc40d983f8
[  116.498730][ T7201]  </TASK>
[  116.498735][ T7201] F2FS-fs (loop3): Stopped filesystem due to reason: 3
[  116.665739][ T7201] CPU: 0 UID: 0 PID: 7201 Comm: syz.3.480 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  116.665763][ T7201] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  116.665771][ T7201] Call Trace:
[  116.665776][ T7201]  <TASK>
[  116.665781][ T7201]  dump_stack_lvl+0x189/0x250
[  116.665806][ T7201]  ? __pfx_dump_stack_lvl+0x10/0x10
[  116.665820][ T7201]  ? __pfx_queue_work_on+0x10/0x10
[  116.665863][ T7201]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  116.665881][ T7201]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  116.665904][ T7201]  f2fs_handle_critical_error+0x37c/0x540
[  116.665927][ T7201]  f2fs_write_end_io+0x886/0xb60
[  116.665966][ T7201]  __submit_merged_bio+0x27a/0x6a0
[  116.665985][ T7201]  __submit_merged_write_cond+0x255/0x530
[  116.666004][ T7201]  f2fs_write_data_pages+0x261d/0x3000
[  116.666045][ T7201]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  116.666096][ T7201]  ? check_path+0x21/0x40
[  116.666107][ T7201]  ? check_noncircular+0xe0/0x160
[  116.666160][ T7201]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  116.666177][ T7201]  do_writepages+0x32e/0x550
[  116.666203][ T7201]  ? do_raw_spin_unlock+0x4d/0x240
[  116.666220][ T7201]  filemap_fdatawrite+0x199/0x240
[  116.666235][ T7201]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  116.666286][ T7201]  ? do_raw_spin_unlock+0x4d/0x240
[  116.666302][ T7201]  f2fs_sync_dirty_inodes+0x31f/0x830
[  116.666330][ T7201]  f2fs_write_checkpoint+0x95a/0x1df0
[  116.666364][ T7201]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  116.666409][ T7201]  ? down_write+0x162/0x1f0
[  116.666423][ T7201]  ? __pfx_down_write+0x10/0x10
[  116.666446][ T7201]  f2fs_issue_checkpoint+0x3ac/0x570
[  116.666464][ T7201]  ? __pfx_f2fs_issue_checkpoint+0x10/0x10
[  116.666486][ T7201]  ? do_raw_spin_lock+0x121/0x290
[  116.666507][ T7201]  ? __up_read+0x280/0x680
[  116.666526][ T7201]  ? f2fs_sync_fs+0x200/0x3d0
[  116.666542][ T7201]  f2fs_do_sync_file+0x869/0x1860
[  116.666566][ T7201]  ? __pfx_f2fs_do_sync_file+0x10/0x10
[  116.666613][ T7201]  ? __pfx_down_write+0x10/0x10
[  116.666628][ T7201]  ? sb_start_write+0x114/0x1c0
[  116.666642][ T7201]  ? mnt_want_write_file+0x164/0x200
[  116.666657][ T7201]  __f2fs_ioctl+0x485a/0xb610
[  116.666686][ T7201]  ? file_ioctl+0x22d/0x780
[  116.666702][ T7201]  ? __pfx_file_ioctl+0x10/0x10
[  116.666725][ T7201]  ? kasan_quarantine_put+0xdd/0x220
[  116.666743][ T7201]  ? __pfx___f2fs_ioctl+0x10/0x10
[  116.666761][ T7201]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  116.666776][ T7201]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  116.666792][ T7201]  ? do_vfs_ioctl+0xb33/0x1430
[  116.666807][ T7201]  ? __pfx_do_vfs_ioctl+0x10/0x10
[  116.666823][ T7201]  ? do_mprotect_pkey+0xb00/0xce0
[  116.666869][ T7201]  ? __lock_acquire+0xab9/0xd20
[  116.666905][ T7201]  ? __fget_files+0x2a/0x420
[  116.666926][ T7201]  ? __fget_files+0x2a/0x420
[  116.666947][ T7201]  ? __fget_files+0x3a0/0x420
[  116.666965][ T7201]  ? __fget_files+0x2a/0x420
[  116.666983][ T7201]  ? f2fs_ioctl+0x135/0x250
[  116.666999][ T7201]  ? __pfx_f2fs_ioctl+0x10/0x10
[  116.667014][ T7201]  __se_sys_ioctl+0xfc/0x170
[  116.667030][ T7201]  do_syscall_64+0xfa/0x3b0
[  116.667043][ T7201]  ? lockdep_hardirqs_on+0x9c/0x150
[  116.667055][ T7201]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  116.667068][ T7201]  ? exc_page_fault+0x9f/0xf0
[  116.667082][ T7201]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  116.667093][ T7201] RIP: 0033:0x7f3e7e38ebe9
[  116.667106][ T7201] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  116.667115][ T7201] RSP: 002b:00007f3e7f110038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  116.667129][ T7201] RAX: ffffffffffffffda RBX: 00007f3e7e5b5fa0 RCX: 00007f3e7e38ebe9
[  116.667138][ T7201] RDX: 0000000000000000 RSI: 000000000000f502 RDI: 0000000000000006
[  116.667146][ T7201] RBP: 00007f3e7e411e19 R08: 0000000000000000 R09: 0000000000000000
[  116.667153][ T7201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  116.667160][ T7201] R13: 00007f3e7e5b6038 R14: 00007f3e7e5b5fa0 R15: 00007ffc40d983f8
[  116.667182][ T7201]  </TASK>
[  116.667187][ T7201] F2FS-fs (loop3): Stopped filesystem due to reason: 3
[  116.671539][ T7232] loop0: detected capacity change from 0 to 512
[  116.906733][ T7232] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  116.920459][ T7238] loop2: detected capacity change from 0 to 1024
[  116.930559][ T7232] ext4 filesystem being mounted at /179/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  116.961523][ T7238] EXT4-fs (loop2): stripe (3) is not aligned with cluster size (16), stripe is disabled
[  116.982550][ T7238] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  116.994403][ T7238] EXT4-fs (loop2): re-mounted 00000000-0000-0000-0000-000000000000.
[  117.007724][ T7238] EXT4-fs error (device loop2): ext4_xattr_inode_iget:437: inode #11: comm syz.2.494: missing EA_INODE flag
[  117.031018][ T7238] EXT4-fs (loop2): Remounting filesystem read-only
[  117.035671][ T7238] EXT4-fs warning (device loop2): ext4_expand_extra_isize_ea:2848: Unable to expand inode 15. Delete some EAs or run e2fsck.
[  117.042684][ T5851] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  117.106880][ T5859] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  117.263894][ T7250] loop2: detected capacity change from 0 to 128
[  117.363566][ T7252] sp0: Synchronizing with TNC
[  117.496089][ T7246] loop3: detected capacity change from 0 to 32768
[  117.527823][ T7246] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode.
[  117.682902][ T6906] ocfs2: Unmounting device (7,3) on (node local)
[  117.838691][ T7273] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0)
[  117.906665][ T7263] loop0: detected capacity change from 0 to 32768
[  117.923499][ T7263] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.501 (7263)
[  117.975282][ T7282] tipc: Started in network mode
[  117.977077][ T7282] tipc: Node identity 624d88d4ff1c, cluster identity 4711
[  117.980797][ T7282] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  117.987870][ T7282] syzkaller0: entered promiscuous mode
[  117.988047][ T7263] BTRFS info (device loop0): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  117.989724][ T7282] syzkaller0: entered allmulticast mode
[  117.993602][ T7263] BTRFS info (device loop0): using blake2b (blake2b-256-generic) checksum algorithm
[  118.027026][ T7263] BTRFS info (device loop0): using free-space-tree
[  118.062154][ T7282] tipc: Resetting bearer <eth:syzkaller0>
[  118.070585][ T7281] tipc: Resetting bearer <eth:syzkaller0>
[  118.109434][ T7281] tipc: Disabling bearer <eth:syzkaller0>
[  118.263118][ T5851] BTRFS info (device loop0): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  118.355135][   T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[  118.538553][   T10] usb 4-1: config 0 has an invalid interface number: 255 but max is 0
[  118.542054][   T10] usb 4-1: config 0 has no interface number 0
[  118.560625][   T10] usb 4-1: config 0 interface 255 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  118.570714][   T10] usb 4-1: config 0 interface 255 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0
[  118.580029][   T10] usb 4-1: New USB device found, idVendor=10cf, idProduct=8065, bcdDevice=91.79
[  118.585181][   T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  118.592073][   T10] usb 4-1: Product: syz
[  118.593917][   T10] usb 4-1: Manufacturer: syz
[  118.599753][ T7321] kernel read not supported for file /ٓ㎀Dg@]eh (pid: 7321 comm: syz.0.515)
[  118.603643][   T33] audit: type=1800 audit(1755049639.156:22): pid=7321 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.515" name=D99310E38E804467405DA6A29A65F1CE1868 dev="mqueue" ino=11685 res=0 errno=0
[  118.611926][   T10] usb 4-1: SerialNumber: syz
[  118.615604][   T10] usb 4-1: config 0 descriptor??
[  118.628743][   T10] vmk80xx 4-1:0.255: driver 'vmk80xx' failed to auto-configure device.
[  118.633375][   T10] vmk80xx 4-1:0.255: probe with driver vmk80xx failed with error -22
[  118.819987][ T7334] loop2: detected capacity change from 0 to 128
[  118.865574][  T792] usb 4-1: USB disconnect, device number 3
[  119.024694][ T7341] loop0: detected capacity change from 0 to 16
[  119.048002][ T7341] erofs (device loop0): negative i_size @ nid 36
[  119.244177][ T7351] netlink: 48 bytes leftover after parsing attributes in process `syz.0.527'.
[  119.290413][ T7354] loop0: detected capacity change from 0 to 128
[  119.296175][ T7354] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256
[  119.479965][ T7366] vxcan3: entered allmulticast mode
[  119.621007][ T7374] loop0: detected capacity change from 0 to 16
[  119.631171][ T7374] erofs (device loop0): mounted with root inode @ nid 36.
[  119.650608][ T7375] program syz.3.537 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  119.806556][ T7381] loop6: detected capacity change from 0 to 524287999
[  119.816167][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.819907][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.823329][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.829918][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.834253][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.853718][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.861043][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.891781][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.896166][ T7381] ldm_validate_partition_table(): Disk read failed.
[  119.898992][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.902541][ T7381] Buffer I/O error on dev loop6, logical block 0, async page read
[  119.906991][ T7381] Dev loop6: unable to read RDB block 0
[  119.909972][ T7381]  loop6: unable to read partition table
[  119.928844][ T7381] loop_reread_partitions: partition scan of loop6 ($) failed (rc=-5)
[  120.795425][ T7397] netlink: 24 bytes leftover after parsing attributes in process `syz.0.547'.
[  121.165169][ T6007] usb 1-1: new high-speed USB device number 9 using dummy_hcd
[  121.213078][ T7407] loop3: detected capacity change from 0 to 4096
[  121.220463][ T7407] ntfs3(loop3): ino=3, Correct links count -> 2.
[  121.345111][ T6007] usb 1-1: Using ep0 maxpacket: 8
[  121.353362][ T6007] usb 1-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config
[  121.368811][ T7415] loop3: detected capacity change from 0 to 512
[  121.374787][ T6007] usb 1-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config
[  121.387353][ T6007] usb 1-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config
[  121.404058][ T6007] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e
[  121.408563][ T6007] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  121.416439][ T6007] usb 1-1: Product: syz
[  121.418785][ T6007] usb 1-1: Manufacturer: syz
[  121.432719][ T6007] usb 1-1: SerialNumber: syz
[  121.435601][ T7415] EXT4-fs error (device loop3): ext4_validate_block_bitmap:441: comm syz.3.555: bg 0: block 248: padding at end of block bitmap is not set
[  121.450689][ T7415] Quota error (device loop3): write_blk: dquota write failed
[  121.454043][ T7415] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota
[  121.459547][ T7415] EXT4-fs error (device loop3): ext4_acquire_dquot:6933: comm syz.3.555: Failed to acquire dquot type 1
[  121.468633][ T7422] loop2: detected capacity change from 0 to 4096
[  121.468788][ T7415] EXT4-fs (loop3): 1 truncate cleaned up
[  121.487403][ T7415] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  121.492747][ T7423] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  121.493554][ T7415] ext4 filesystem being mounted at /27/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  121.522704][ T7415] Quota error (device loop3): find_tree_dqentry: Cycle in quota tree detected: block 2 index 2
[  121.529241][ T7415] Quota error (device loop3): qtree_read_dquot: Can't read quota structure for id 131074
[  121.533315][ T7415] EXT4-fs error (device loop3): ext4_acquire_dquot:6933: comm syz.3.555: Failed to acquire dquot type 1
[  121.584746][ T6906] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  121.632674][ T7425] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd
[  121.664296][ T6007] adutux 1-1:168.0: interrupt endpoints not found
[  121.676766][ T6007] usb 1-1: USB disconnect, device number 9
[  122.291088][ T7440] loop3: detected capacity change from 0 to 256
[  122.373577][ T7440] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xb107716d, utbl_chksum : 0xe619d30d)
[  122.881523][ T7461] netlink: 176 bytes leftover after parsing attributes in process `syz.2.572'.
[  123.112871][ T7472] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only
[  123.125646][ T7472] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[  124.133576][ T7499] loop3: detected capacity change from 0 to 164
[  124.172639][ T7502] misc userio: The device must be registered before sending interrupts
[  124.546128][ T2203] usb 3-1: new high-speed USB device number 7 using dummy_hcd
[  124.581551][ T7523] loop3: detected capacity change from 0 to 512
[  124.622095][ T7523] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  124.635789][ T7523] ext4 filesystem being mounted at /44/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  124.688774][ T6906] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  124.718548][ T2203] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  124.722434][ T2203] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  124.737930][ T2203] usb 3-1: config 0 descriptor??
[  124.742149][ T2203] cp210x 3-1:0.0: cp210x converter detected
[  125.158722][ T2203] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32
[  125.178155][ T2203] usb 3-1: cp210x converter now attached to ttyUSB0
[  125.239622][ T7548] could not allocate digest TFM handle sm3
[  125.275029][ T5915] usb 1-1: new high-speed USB device number 10 using dummy_hcd
[  125.375754][  T792] usb 3-1: USB disconnect, device number 7
[  125.419603][  T792] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  125.435253][ T5915] usb 1-1: Using ep0 maxpacket: 16
[  125.442020][ T5915] usb 1-1: config 1 interface 0 altsetting 36 endpoint 0x81 has an invalid bInterval 255, changing to 11
[  125.447276][  T792] cp210x 3-1:0.0: device disconnected
[  125.452256][ T5915] usb 1-1: config 1 interface 0 has no altsetting 0
[  125.460067][ T5915] usb 1-1: New USB device found, idVendor=056a, idProduct=0045, bcdDevice= 0.40
[  125.463999][ T5915] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  125.531344][ T7555] netlink: 'syz.3.595': attribute type 2 has an invalid length.
[  125.812172][ T5915] usb 1-1: Product: syz
[  125.814046][ T5915] usb 1-1: Manufacturer: syz
[  125.816392][ T5915] usb 1-1: SerialNumber: syz
[  126.050980][ T7562] capability: warning: `syz.2.596' uses 32-bit capabilities (legacy support in use)
[  126.059993][ T5915] usbhid 1-1:1.0: can't add hid device: -71
[  126.062651][ T5915] usbhid 1-1:1.0: probe with driver usbhid failed with error -71
[  126.083528][ T5915] usb 1-1: USB disconnect, device number 10
[  126.325118][ T7577] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3)
[  126.328032][ T7577] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless)
[  126.333673][ T7577] vhci_hcd vhci_hcd.0: Device attached
[  126.515112][   T10] vhci_hcd: vhci_device speed not set
[  126.585056][   T10] usb 37-1: new full-speed USB device number 2 using vhci_hcd
[  126.615706][ T2203] usb 3-1: new low-speed USB device number 8 using dummy_hcd
[  127.061188][ T2203] usb 3-1: config 0 has no interfaces?
[  127.063651][ T2203] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22
[  127.069171][ T2203] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  127.086866][ T2203] usb 3-1: config 0 descriptor??
[  127.245034][  T792] usb 4-1: new high-speed USB device number 4 using dummy_hcd
[  127.295753][ T5887] usb 3-1: USB disconnect, device number 8
[  127.298521][ T7578] vhci_hcd: connection reset by peer
[  127.307645][ T5879] vhci_hcd: stop threads
[  127.310306][ T5879] vhci_hcd: release socket
[  127.313768][ T5879] vhci_hcd: disconnect device
[  127.375010][   T10] vhci_hcd: vhci_device speed not set
[  127.395073][  T792] usb 4-1: Using ep0 maxpacket: 16
[  127.399317][  T792] usb 4-1: config 5 has an invalid interface number: 206 but max is 0
[  127.402853][  T792] usb 4-1: config 5 has no interface number 0
[  127.405912][  T792] usb 4-1: config 5 interface 206 has no altsetting 0
[  127.412774][  T792] usb 4-1: New USB device found, idVendor=1a0a, idProduct=0103, bcdDevice=60.44
[  127.417168][  T792] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  127.420645][  T792] usb 4-1: Product: syz
[  127.422493][  T792] usb 4-1: Manufacturer: syz
[  127.424521][  T792] usb 4-1: SerialNumber: syz
[  127.648535][  T792] usb_ehset_test 4-1:5.206: probe with driver usb_ehset_test failed with error -32
[  127.655567][  T792] usb 4-1: USB disconnect, device number 4
[  127.831104][ T7602] netlink: 'syz.2.611': attribute type 21 has an invalid length.
[  127.834539][ T7602] netlink: 132 bytes leftover after parsing attributes in process `syz.2.611'.
[  127.869761][ T7604] netlink: 12 bytes leftover after parsing attributes in process `syz.2.612'.
[  127.873011][ T7604] netlink: 8 bytes leftover after parsing attributes in process `syz.2.612'.
[  128.008101][ T7612] loop0: detected capacity change from 0 to 16
[  128.013377][ T7612] erofs (device loop0): mounted with root inode @ nid 36.
[  128.023371][ T7612] erofs (device loop0): read error -22 @ 43 of nid 36
[  129.293156][ T7661] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993
[  129.393050][ T7663] loop0: detected capacity change from 0 to 512
[  129.399252][ T7663] EXT4-fs: Ignoring removed nomblk_io_submit option
[  129.404148][ T7663] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
[  129.423386][ T7663] EXT4-fs (loop0): 1 truncate cleaned up
[  129.427823][ T7663] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  129.441030][   T33] audit: type=1800 audit(129.297:23): pid=7663 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.640" name="file1" dev="loop0" ino=15 res=0 errno=0
[  129.473194][ T5851] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  129.602210][ T7674] openvswitch: netlink: Tunnel attr 5 has unexpected len 4 expected 0
[  130.058272][ T7697] overlayfs: conflicting options: metacopy=on,redirect_dir=nofollow
[  130.149248][   T33] audit: type=1326 audit(130.007:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7700 comm="syz.3.656" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3e7e38ebe9 code=0x0
[  131.142268][ T7711] overlayfs: failed to decode file handle (len=6, type=251, flags=0, err=-22)
[  131.293767][ T7714] loop3: detected capacity change from 0 to 256
[  131.321456][ T7714] FAT-fs (loop3): Directory bread(block 64) failed
[  131.324126][ T7714] FAT-fs (loop3): Directory bread(block 65) failed
[  131.330569][ T7714] FAT-fs (loop3): Directory bread(block 66) failed
[  131.333408][ T7714] FAT-fs (loop3): Directory bread(block 67) failed
[  131.338167][ T7714] FAT-fs (loop3): Directory bread(block 68) failed
[  131.341262][ T7714] FAT-fs (loop3): Directory bread(block 69) failed
[  131.343828][ T7714] FAT-fs (loop3): Directory bread(block 70) failed
[  131.347629][ T7714] FAT-fs (loop3): Directory bread(block 71) failed
[  131.350149][ T7714] FAT-fs (loop3): Directory bread(block 72) failed
[  131.352512][ T7714] FAT-fs (loop3): Directory bread(block 73) failed
[  131.375805][   T33] audit: type=1800 audit(131.237:25): pid=7714 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.661" name="bus" dev="loop3" ino=1048604 res=0 errno=0
[  131.825061][ T5236] Bluetooth: hci3: command 0x1003 tx timeout
[  131.828911][ T5854] Bluetooth: hci3: Opcode 0x1003 failed: -110
[  132.454012][ T7725] loop0: detected capacity change from 0 to 4096
[  132.471896][ T7725] EXT4-fs (loop0): Test dummy encryption mode enabled
[  132.488524][ T7725] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0003]
[  132.491707][ T7725] System zones: 0-5
[  132.576589][ T7728] loop2: detected capacity change from 0 to 764
[  132.600347][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[  132.602643][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[  132.613648][ T7728] rock: directory entry would overflow storage
[  132.616116][ T7728] rock: sig=0x5245, size=8, remaining=5
[  133.072263][ T7725] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  133.209796][ T5851] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  133.384607][ T7731] loop3: detected capacity change from 0 to 32768
[  133.508633][ T7731] bcachefs (loop3): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,foreground_target=invalid label 767,background_target=invalid device 7,nojournal_transaction_names
[  133.508646][ T7731]   allowing incompatible features above 0.0: (unknown version)
[  133.508651][ T7731]   features: 
[  133.522238][ T7731] bcachefs (loop3): Using encoding defined by superblock: utf8-12.1.0
[  133.525066][ T7731] bcachefs (loop3): initializing new filesystem
[  133.538178][ T7731] bcachefs (loop3): going read-write
[  133.558136][ T7731] bcachefs (loop3): marking superblocks
[  133.586858][ T7731] bcachefs (loop3): initializing freespace
[  133.597382][ T7731] bcachefs (loop3): done initializing freespace
[  133.603322][ T7731] bcachefs (loop3): reading snapshots table
[  133.606927][ T7731] bcachefs (loop3): reading snapshots done
[  133.641009][ T7731] bcachefs (loop3): done starting filesystem
[  133.722537][ T7731] syz.3.668 (7731) used greatest stack depth: 15896 bytes left
[  133.735622][ T6906] bcachefs (loop3): shutting down
[  133.738255][ T6906] bcachefs (loop3): going read-only
[  133.741953][ T6906] bcachefs (loop3): finished waiting for writes to stop
[  133.748851][ T6906] bcachefs (loop3): flushing journal and stopping allocators, journal seq 2
[  133.808210][ T6906] bcachefs (loop3): flushing journal and stopping allocators complete, journal seq 3
[  133.816897][ T6906] bcachefs (loop3): clean shutdown complete, journal seq 4
[  133.820016][ T6906] bcachefs (loop3): marking filesystem clean
[  133.839741][ T6906] bcachefs (loop3): shutdown complete
[  134.364289][ T7772] netlink: 8 bytes leftover after parsing attributes in process `syz.2.681'.
[  134.598996][ T7785] sit1: entered promiscuous mode
[  134.601229][ T7785] sit1: entered allmulticast mode
[  134.971523][ T7790] loop2: detected capacity change from 0 to 1024
[  135.366988][ T7793] loop3: detected capacity change from 0 to 256
[  135.376197][ T7793] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xf6dff195, utbl_chksum : 0xe619d30d)
[  135.520035][ T7801] loop3: detected capacity change from 0 to 512
[  135.524204][ T7801] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode
[  135.535890][ T7801] EXT4-fs (loop3): 1 truncate cleaned up
[  135.539821][ T7801] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  135.612633][ T6906] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  135.621193][   T32] hfsplus: b-tree write err: -5, ino 4
[  135.704486][ T7805] loop2: detected capacity change from 0 to 256
[  136.162888][ T7825] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  136.280821][ T7831] befs: (nullb0): No write support. Marking filesystem read-only
[  136.297019][ T7831] befs: (nullb0): invalid magic header
[  136.661369][   T33] audit: type=1326 audit(136.517:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7835 comm="syz.0.708" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6c6ef8ebe9 code=0x0
[  137.168442][ T7857] loop3: detected capacity change from 0 to 2048
[  137.173547][ T7857] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  137.667720][ T7884] loop0: detected capacity change from 0 to 2048
[  137.673081][ T7884] EXT4-fs: Ignoring removed nobh option
[  137.698063][ T7884] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  137.771363][ T5851] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  139.016871][   T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd
[  139.247583][   T10] usb 4-1: config 0 has no interfaces?
[  139.252397][   T10] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  139.257787][   T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  139.306343][   T10] usb 4-1: config 0 descriptor??
[  139.568913][ T7926] loop2: detected capacity change from 0 to 1024
[  139.719645][ T7912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  139.724797][ T7912] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  139.729208][ T6007] usb 4-1: USB disconnect, device number 5
[  139.951807][ T7935] netlink: 'syz.0.752': attribute type 1 has an invalid length.
[  139.956786][ T7935] netlink: 'syz.0.752': attribute type 11 has an invalid length.
[  139.959635][ T7935] netlink: 224 bytes leftover after parsing attributes in process `syz.0.752'.
[  140.006528][ T7937] loop0: detected capacity change from 0 to 128
[  140.027518][ T7937] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  140.062475][ T5851] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  140.142607][ T7933] loop2: detected capacity change from 0 to 32768
[  140.149488][ T7933] (syz.2.751,7933,0):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #66: rec_len is smaller than minimal - offset=88, inode=69, rec_len=8, name_len=8
[  140.156711][ T7933] (syz.2.751,7933,0):ocfs2_init_global_system_inodes:465 ERROR: status = -22
[  140.161073][ T7933] (syz.2.751,7933,0):ocfs2_init_global_system_inodes:467 ERROR: Unable to load system inode 2, possibly corrupt fs?
[  140.161093][ T7933] (syz.2.751,7933,0):ocfs2_init_global_system_inodes:476 ERROR: status = -22
[  140.168979][ T7933] (syz.2.751,7933,0):ocfs2_initialize_super:2198 ERROR: status = -22
[  140.171705][ T7933] (syz.2.751,7933,0):ocfs2_fill_super:1177 ERROR: status = -22
[  140.327905][ T7949] loop0: detected capacity change from 0 to 4096
[  140.347340][ T7949] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  140.514204][ T7959] netlink: 104 bytes leftover after parsing attributes in process `syz.3.762'.
[  141.010665][ T7953] loop2: detected capacity change from 0 to 32768
[  141.020876][ T7953] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.760 (7953)
[  141.032181][ T7971] binder: 7970:7971 ioctl c0306201 200000000640 returned -22
[  141.060371][ T7953] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  141.071267][ T7953] BTRFS info (device loop2): using crc32c (crc32c-lib) checksum algorithm
[  141.074555][ T7953] BTRFS info (device loop2): disk space caching is enabled
[  141.080845][ T7953] BTRFS warning (device loop2): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2
[  141.190200][ T5851] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  141.296465][ T7953] BTRFS info (device loop2): rebuilding free space tree
[  141.359515][ T7953] BTRFS info (device loop2): disabling free space tree
[  141.374966][ T7953] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  141.379201][ T7953] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  141.884263][ T5859] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  142.361327][ T7999] loop3: detected capacity change from 0 to 32768
[  142.365646][ T7999] bcachefs (/dev/loop3): error validating superblock: Invalid superblock section clean: entry type btree_keys overruns end of section
[  142.365646][ T7999] clean (size 2912):
[  142.365646][ T7999] flags:          0
[  142.365646][ T7999] journal_seq:    8
[  142.365646][ T7999] prio_ptrs: 
[  142.365646][ T7999] usage: type=key_version v=0
[  142.365646][ T7999] usage: type=reserved v=0
[  142.365646][ T7999] usage: type=reserved v=0
[  142.365646][ T7999] usage: type=reserved v=0
[  142.365646][ T7999] usage: type=reserved v=0
[  142.365646][ T7999] data_usage: btree: 1/1 [0]=2816
[  142.365646][ T7999] data_usage: journal: 1/1 [0]=0
[  142.365646][ T7999] data_usage: user: 1/1 [0]=32
[  142.365646][ T7999] dev_usage: dev=0  
[  142.365646][ T7999]   free: buckets=83 sectors=0 fragmented=0
[  142.365646][ T7999]   sb: buckets=25 sectors=6152 fragmented=248
[  142.365646][ T7999]   journal: buckets=8 sectors=2048 fragmented=0
[  142.365646][ T7999]   btree: buckets=11 sectors=2816 fragmented=0
[  142.365646][ T7999]   user: buckets=1 sectors=32 fragmented=224
[  142.365646][ T7999]   cached: buckets=0 sectors=0 fragmented=0
[  142.365646][ T7999]   parity: buckets=0 sectors=0 fragmented=786432
[  142.365646][ T7999]   stripe: buckets=0 sectors=0 fragmented=0
[  142.365646][ T7999]   need_gc_gens: buckets=0 sectors=0 fragmented=0
[  142.365646][ T7999]   need_discard: buckets=0 sectors=0 fragmented=0
[  142.365646][ T7999] clock: read=0
[  142.365646][ T7999] clock: write=1288
[  142.365646][ T7999] btree_root: btree=extents level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 249e7ae2a
[  142.365775][ T7999] bcachefs: bch2_fs_get_tree() error: invalid_sb_clean
[  142.512151][ T8007] loop3: detected capacity change from 0 to 1024
[  142.525538][ T8007] EXT4-fs: Ignoring removed nobh option
[  142.527502][ T8007] EXT4-fs: Ignoring removed bh option
[  142.531823][ T8005] loop2: detected capacity change from 0 to 764
[  142.565312][ T8007] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  142.597401][ T8007] EXT4-fs error (device loop3): mb_free_blocks:2017: group 0, inode 15: block 129:freeing already freed block (bit 8); block bitmap corrupt.
[  142.673826][ T8009] loop0: detected capacity change from 0 to 32768
[  142.717560][ T6906] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  142.809816][ T8009] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,foreground_target=invalid label 767,background_target=invalid device 7,nojournal_transaction_names
[  142.809832][ T8009]   allowing incompatible features above 0.0: (unknown version)
[  142.809836][ T8009]   features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[  142.825926][ T8009] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0
[  142.828657][ T8009] bcachefs (loop0): initializing new filesystem
[  142.838425][ T8009] bcachefs (loop0): going read-write
[  142.852836][ T8009] bcachefs (loop0): marking superblocks
[  142.860071][ T8009] bcachefs (loop0): initializing freespace
[  142.863816][ T8009] bcachefs (loop0): done initializing freespace
[  142.867046][ T8009] bcachefs (loop0): reading snapshots table
[  142.869376][ T8009] bcachefs (loop0): reading snapshots done
[  142.901820][ T8009] bcachefs (loop0): done starting filesystem
[  143.092961][   T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  143.247620][   T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  143.383361][   T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  143.499660][   T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  144.383282][   T13] bridge_slave_1: left allmulticast mode
[  144.395616][   T13] bridge_slave_1: left promiscuous mode
[  144.405621][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  144.421259][   T13] bridge_slave_0: left allmulticast mode
[  144.424135][   T13] bridge_slave_0: left promiscuous mode
[  144.428976][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  144.884147][ T5236] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  144.890777][ T5236] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  144.907158][ T5236] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  144.912928][ T5236] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  144.919798][ T5236] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  145.245669][ T5851] bcachefs (loop0): shutting down
[  145.248037][ T5851] bcachefs (loop0): going read-only
[  145.250417][ T5851] bcachefs (loop0): finished waiting for writes to stop
[  145.257304][ T5851] bcachefs (loop0): flushing journal and stopping allocators, journal seq 4
[  145.270888][ T5851] bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 5
[  145.278192][ T5851] bcachefs (loop0): clean shutdown complete, journal seq 6
[  145.283636][ T5851] bcachefs (loop0): marking filesystem clean
[  145.340325][ T5851] bcachefs (loop0): shutdown complete
[  145.441405][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  145.448459][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  145.453098][   T13] bond0 (unregistering): Released all slaves
[  145.579309][   T13] tipc: Left network mode
[  146.349585][ T8035] chnl_net:caif_netlink_parms(): no params data found
[  146.379325][   T13] hsr_slave_0: left promiscuous mode
[  146.382349][   T13] hsr_slave_1: left promiscuous mode
[  146.386978][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  146.389783][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  146.408181][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  146.457157][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  146.488023][   T13] veth1_macvtap: left promiscuous mode
[  146.489924][   T13] veth0_macvtap: left promiscuous mode
[  146.491862][   T13] veth1_vlan: left promiscuous mode
[  146.493979][   T13] veth0_vlan: left promiscuous mode
[  147.000982][ T5236] Bluetooth: hci2: command tx timeout
[  147.516761][ T8063] mmap: syz.0.785 (8063) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[  147.581481][   T13] team0 (unregistering): Port device team_slave_1 removed
[  147.696290][   T13] team0 (unregistering): Port device team_slave_0 removed
[  147.870979][ T8068] loop3: detected capacity change from 0 to 32768
[  147.881983][ T8068] bcachefs: bch2_fs_parse_param() Error parsing option compression: option_value
[  148.271979][ T8093] netlink: 8 bytes leftover after parsing attributes in process `syz.0.801'.
[  148.539488][ T8035] bridge0: port 1(bridge_slave_0) entered blocking state
[  148.542740][ T8035] bridge0: port 1(bridge_slave_0) entered disabled state
[  148.546016][ T8035] bridge_slave_0: entered allmulticast mode
[  148.549964][ T8035] bridge_slave_0: entered promiscuous mode
[  148.555732][ T8035] bridge0: port 2(bridge_slave_1) entered blocking state
[  148.560406][ T8035] bridge0: port 2(bridge_slave_1) entered disabled state
[  148.563597][ T8035] bridge_slave_1: entered allmulticast mode
[  148.580041][ T8035] bridge_slave_1: entered promiscuous mode
[  149.021344][ T8035] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  149.050348][ T8035] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  149.079083][ T5236] Bluetooth: hci2: command tx timeout
[  149.122279][ T8035] team0: Port device team_slave_0 added
[  149.130269][ T8035] team0: Port device team_slave_1 added
[  149.181335][ T8035] batman_adv: batadv0: Adding interface: batadv_slave_0
[  149.184406][ T8035] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  149.197833][ T8035] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  149.284435][ T8035] batman_adv: batadv0: Adding interface: batadv_slave_1
[  149.293229][ T8035] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  149.303392][ T8035] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  149.351323][   T13] IPVS: stop unused estimator thread 0...
[  149.399046][ T8035] hsr_slave_0: entered promiscuous mode
[  149.403050][ T8035] hsr_slave_1: entered promiscuous mode
[  149.418825][ T8035] debugfs: 'hsr0' already exists in 'hsr'
[  149.421340][ T8035] Cannot create hsr debugfs directory
[  149.758660][ T8035] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  149.773081][ T8035] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  149.792686][ T8035] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  149.801580][ T8035] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  149.920856][ T8035] 8021q: adding VLAN 0 to HW filter on device bond0
[  149.942153][ T8035] 8021q: adding VLAN 0 to HW filter on device team0
[  149.953437][ T6884] bridge0: port 1(bridge_slave_0) entered blocking state
[  149.956639][ T6884] bridge0: port 1(bridge_slave_0) entered forwarding state
[  150.016627][ T6884] bridge0: port 2(bridge_slave_1) entered blocking state
[  150.019729][ T6884] bridge0: port 2(bridge_slave_1) entered forwarding state
[  150.129972][   T33] audit: type=1326 audit(149.987:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8154 comm="syz.0.815" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6c6ef8ebe9 code=0x7ffc0000
[  150.165540][   T33] audit: type=1326 audit(149.987:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8154 comm="syz.0.815" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6c6ef8ebe9 code=0x7ffc0000
[  150.196864][   T33] audit: type=1326 audit(150.007:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8154 comm="syz.0.815" exe="/syz-executor" sig=0 arch=c000003e syscall=306 compat=0 ip=0x7f6c6ef8ebe9 code=0x7ffc0000
[  150.212525][   T33] audit: type=1326 audit(150.007:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8154 comm="syz.0.815" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6c6ef8ebe9 code=0x7ffc0000
[  150.352857][ T8035] 8021q: adding VLAN 0 to HW filter on device batadv0
[  150.708916][ T8189] netlink: 96 bytes leftover after parsing attributes in process `syz.3.824'.
[  150.814491][ T8035] veth0_vlan: entered promiscuous mode
[  150.833236][ T8035] veth1_vlan: entered promiscuous mode
[  150.895662][ T8035] veth0_macvtap: entered promiscuous mode
[  150.901950][ T8035] veth1_macvtap: entered promiscuous mode
[  150.914764][ T8035] batman_adv: batadv0: Interface activated: batadv_slave_0
[  150.924637][ T8035] batman_adv: batadv0: Interface activated: batadv_slave_1
[  150.944408][ T5880] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  150.951582][ T5880] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  150.954785][ T5880] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  150.969263][ T5880] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  151.093029][   T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  151.102638][   T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  151.142576][   T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  151.146147][   T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  151.155147][ T5236] Bluetooth: hci2: command tx timeout
[  151.910278][ T8251] netlink: 'syz.0.842': attribute type 11 has an invalid length.
[  152.096168][ T8237] loop4: detected capacity change from 0 to 32768
[  152.138412][ T8237] jfs_strtoUCS: char2uni returned -22.
[  152.140895][ T8237] charset = iso8859-7, char = 0xa4
[  152.296374][ T8271] loop0: detected capacity change from 0 to 256
[  152.329385][ T8273] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0)
[  152.465072][  T792] usb 4-1: new high-speed USB device number 6 using dummy_hcd
[  152.593241][ T8289] netlink: 52 bytes leftover after parsing attributes in process `syz.4.856'.
[  152.630815][  T792] usb 4-1: Using ep0 maxpacket: 16
[  152.647349][  T792] usb 4-1: config 0 has an invalid interface number: 249 but max is 0
[  152.650921][  T792] usb 4-1: config 0 has no interface number 0
[  152.653543][  T792] usb 4-1: config 0 interface 249 altsetting 2 bulk endpoint 0x1 has invalid maxpacket 64
[  152.656478][ T8291] loop0: detected capacity change from 0 to 4096
[  152.679415][  T792] usb 4-1: config 0 interface 249 has no altsetting 0
[  152.685146][  T792] usb 4-1: New USB device found, idVendor=16ca, idProduct=1502, bcdDevice= 5.c1
[  152.688626][  T792] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  152.691397][  T792] usb 4-1: Product: syz
[  152.693167][  T792] usb 4-1: Manufacturer: syz
[  152.715635][  T792] usb 4-1: SerialNumber: syz
[  152.726438][  T792] usb 4-1: config 0 descriptor??
[  152.730457][ T8265] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  152.736489][  T792] aircable 4-1:0.249: aircable converter detected
[  152.749296][  T792] usb 4-1: aircable converter now attached to ttyUSB0
[  152.885138][    T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[  152.943021][  T792] usb 4-1: USB disconnect, device number 6
[  152.965566][  T792] aircable ttyUSB0: aircable converter now disconnected from ttyUSB0
[  152.969712][  T792] aircable 4-1:0.249: device disconnected
[  153.035283][    T9] usb 5-1: Using ep0 maxpacket: 8
[  153.038379][    T9] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b
[  153.041765][    T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  153.057288][    T9] pvrusb2: Hardware description: Terratec Grabster AV400
[  153.060270][    T9] pvrusb2: **********
[  153.062975][    T9] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[  153.067320][    T9] pvrusb2: Important functionality might not be entirely working.
[  153.069945][    T9] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[  153.073592][    T9] pvrusb2: **********
[  153.152859][ T8297] loop0: detected capacity change from 0 to 32768
[  153.164029][ T8297] XFS: attr2 mount option is deprecated.
[  153.215373][ T8297] XFS (loop0): DAX unsupported by block device. Turning off DAX.
[  153.218524][ T8297] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  153.230830][ T8297] XFS (loop0): Ending clean mount
[  153.235133][ T5236] Bluetooth: hci2: command tx timeout
[  153.256355][ T2394] pvrusb2: Invalid write control endpoint
[  153.280332][ T5851] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  153.329089][ T2394] pvrusb2: Invalid write control endpoint
[  153.331197][ T2394] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work.
[  153.334444][ T2394] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device.
[  153.339385][ T2394] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups.
[  153.343825][ T2394] pvrusb2: Device being rendered inoperable
[  153.368723][ T2394] cx25840 2-0044: Unable to detect h/w, assuming cx23887
[  153.373649][ T2394] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
[  153.391864][ T2394] pvrusb2: Attached sub-driver cx25840
[  153.395190][ T2394] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  153.400105][ T2394] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  153.475800][   T10] usb 5-1: USB disconnect, device number 2
[  153.837382][ T8322] loop0: detected capacity change from 0 to 32768
[  153.842659][ T8322] bcachefs (/dev/loop0): error validating superblock: Invalid superblock section clean: entry type btree_keys overruns end of section
[  153.842659][ T8322] clean (size 2912):
[  153.842659][ T8322] flags:          0
[  153.842659][ T8322] journal_seq:    10
[  153.842659][ T8322] usage: type=inodes v=8
[  153.842659][ T8322] usage: type=key_version v=0
[  153.842659][ T8322] usage: type=reserved v=0
[  153.842659][ T8322] usage: type=reserved v=0
[  153.842659][ T8322] usage: type=reserved v=0
[  153.842659][ T8322] usage: type=reserved v=0
[  153.842659][ T8322] data_usage: btree: 1/1 [0]=2816
[  153.842659][ T8322] data_usage: journal: 1/1 [0]=0
[  153.842659][ T8322] data_usage: user: 1/1 [0]=16
[  153.842659][ T8322] dev_usage: dev=0  
[  153.842659][ T8322]   free: buckets=83 sectors=0 fragmented=0
[  153.842659][ T8322]   sb: buckets=25 sectors=6152 fragmented=248
[  153.842659][ T8322]   journal: buckets=8 sectors=2048 fragmented=0
[  153.842659][ T8322]   btree: buckets=11 sectors=2816 fragmented=0
[  153.842659][ T8322]   user: buckets=1 sectors=16 fragmented=240
[  153.842659][ T8322]   cached: buckets=0 sectors=0 fragmented=13565952
[  153.842659][ T8322]   parity: buckets=0 sectors=0 fragmented=0
[  153.842659][ T8322]   stripe: buckets=0 sectors=0 fragmented=0
[  153.842659][ T8322]   need_gc_gens: buckets=0 sectors=0 fragmented=0
[  153.842659][ T8322]   need_discard: buckets=0 sectors=0 fragmented=0
[  153.842659][ T8322] clock: read=0
[  153.842659][ T8322] blacklist_v2: start=1 end=1280
[  153.842659][ T8322] btree_root: btree=extents level=0 u64s 11 type xattr SPOS_MAX len 0 
[  153.842892][ T8322] bcachefs: bch2_fs_get_tree() error: invalid_sb_clean
[  156.153081][ T8368] netlink: 56 bytes leftover after parsing attributes in process `syz.3.887'.
[  156.162946][ T8368] netlink: 8 bytes leftover after parsing attributes in process `syz.3.887'.
[  156.326964][ T8374] syz.3.890: attempt to access beyond end of device
[  156.326964][ T8374] nbd3: rw=0, sector=2, nr_sectors = 2 limit=0
[  156.333191][ T8373] ieee802154 phy0 wpan0: encryption failed: -22
[  156.353892][ T8374] MINIX-fs: unable to read superblock
[  156.700409][ T8382] loop0: detected capacity change from 0 to 128
[  157.180744][ T8394] binder: 8393:8394 ioctl 400c620e 200000000000 returned -22
[  157.224766][ T8386] loop3: detected capacity change from 0 to 32768
[  157.236900][ T8386] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.895 (8386)
[  157.252754][ T8386] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  157.260685][ T8386] BTRFS info (device loop3): using crc32c (crc32c-lib) checksum algorithm
[  157.270834][ T8386] BTRFS info (device loop3): using free-space-tree
[  157.350425][ T8413] netlink: 36 bytes leftover after parsing attributes in process `syz.0.903'.
[  157.370152][ T8413] vlan2: entered promiscuous mode
[  157.372272][ T8413] bridge0: entered promiscuous mode
[  157.410543][   T32] BTRFS warning (device loop3): checksum verify failed on logical 5255168 mirror 1 wanted 0x9df47653 found 0xf07e2bd0 level 1
[  157.422281][ T8386] BTRFS warning (device loop3): failed to read fs tree: -5
[  157.477211][ T8426] loop4: detected capacity change from 0 to 128
[  157.498882][ T8386] BTRFS error (device loop3): open_ctree failed: -5
[  157.533015][ T8426] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  157.623880][ T8432] EXT4-fs (loop4): shut down requested (1)
[  157.682503][ T8035] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  157.792382][ T8436] netlink: 132 bytes leftover after parsing attributes in process `syz.4.909'.
[  158.154492][ T8457] loop3: detected capacity change from 0 to 2048
[  158.164360][ T8457] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024)
[  158.201171][ T8458] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  158.788496][ T8471] loop0: detected capacity change from 0 to 40427
[  158.824265][ T8471] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12
[  158.837991][ T8471] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[  158.976951][ T8471] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  158.983346][ T8471] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0
[  158.990863][ T8471] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
[  159.419306][ T8471] syz.0.923 (8471): drop_caches: 2
[  159.661208][ T8496] loop3: detected capacity change from 0 to 4096
[  159.710787][ T8500] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  160.532093][ T8506] loop3: detected capacity change from 0 to 65536
[  160.558193][ T8506] XFS (loop3): Mounting V5 Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2
[  160.656939][ T8506] XFS (loop3): Ending clean mount
[  160.902361][ T6906] XFS (loop3): Unmounting Filesystem d6f69dbd-8c5d-46be-b88e-92c0ae88ceb2
[  160.960846][ T8518] loop4: detected capacity change from 0 to 32768
[  160.999520][ T8518] bcachefs (/dev/loop4): error validating superblock: Invalid superblock section members_v2: device 0: not enough buckets (got 0, max 64)
[  160.999520][ T8518] members_v2 (size 152):
[  160.999520][ T8518] Device:                        0
[  160.999520][ T8518]   Label:                       (none)
[  160.999520][ T8518]   UUID:                        7af6772b-00de-4159-84cd-1faead7f0000
[  160.999520][ T8518]   Size:                        0
[  160.999520][ T8518]   read errors:                 0
[  160.999520][ T8518]   write errors:                0
[  160.999520][ T8518]   checksum errors:             0
[  160.999520][ T8518]   seqread iops:                0
[  160.999520][ T8518]   seqwrite iops:               0
[  160.999520][ T8518]   randread iops:               0
[  160.999520][ T8518]   randwrite iops:              0
[  160.999520][ T8518]   Bucket size:                 131072
[  160.999520][ T8518]   First bucket:                0
[  160.999520][ T8518]   Buckets:                     0
[  160.999520][ T8518]   Last mount:                  1714681267
[  160.999520][ T8518]   Last superblock write:       83886122
[  160.999520][ T8518]   State:                       rw
[  160.999520][ T8518]   Data allowed:                journal,btree,user
[  160.999520][ T8518]   Has data:                    (none)
[  160.999520][ T8518]   Btree allocated bitmap blocksize:256
[  160.999520][ T8518]   Btree allocated bitmap:      0000000000000000000001000010000010011000000000000000000000000000
[  160.999520][ T8518]   Durability:   
[  160.999741][ T8518] bcachefs: bch2_fs_get_tree() error: invalid_sb_members
[  161.295544][ T8522] vcan0: tx drop: invalid da for name 0x0000000000000001
[  161.438317][ T8532] netlink: 'syz.0.944': attribute type 2 has an invalid length.
[  161.509176][ T8536] loop3: detected capacity change from 0 to 2048
[  161.515699][ T8536] UDF-fs: warning (device loop3): udf_fill_super: No fileset found
[  161.607186][ T8544] netlink: 4 bytes leftover after parsing attributes in process `syz.3.950'.
[  161.642017][ T8546] netlink: 'syz.0.949': attribute type 30 has an invalid length.
[  161.914133][ T8560] loop0: detected capacity change from 0 to 1024
[  161.930263][ T8560] hfsplus: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended.  mounting read-only.
[  161.962065][ T8560] hfsplus: filesystem was not cleanly unmounted, running fsck.hfsplus is recommended.  leaving read-only.
[  162.032396][ T8566] loop0: detected capacity change from 0 to 2048
[  162.056758][ T8566] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  162.973145][ T5851] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  163.575285][ T8621] loop3: detected capacity change from 0 to 256
[  163.629166][ T8621] FAT-fs (loop3): Directory bread(block 64) failed
[  163.632696][ T8621] FAT-fs (loop3): Directory bread(block 65) failed
[  163.638806][ T8621] FAT-fs (loop3): Directory bread(block 66) failed
[  163.641874][ T8621] FAT-fs (loop3): Directory bread(block 67) failed
[  163.646520][ T8621] FAT-fs (loop3): Directory bread(block 68) failed
[  163.649801][ T8621] FAT-fs (loop3): Directory bread(block 69) failed
[  163.653030][ T8621] FAT-fs (loop3): Directory bread(block 70) failed
[  163.658585][ T8621] FAT-fs (loop3): Directory bread(block 71) failed
[  163.669625][ T8621] FAT-fs (loop3): Directory bread(block 72) failed
[  163.672413][ T8621] FAT-fs (loop3): Directory bread(block 73) failed
[  164.345911][ T8639] loop4: detected capacity change from 0 to 2048
[  164.413616][ T8641] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  164.546216][ T8645] loop0: detected capacity change from 0 to 65
[  164.582610][ T8645] BFS-fs: bfs_fill_super(): NOTE: filesystem loop0 was created with 512 inodes, the real maximum is 511, mounting anyway
[  164.604791][ T8645] BFS-fs: bfs_fill_super(): Inode 0x00000002 corrupted on loop0
[  164.862602][ T8668] netlink: 8 bytes leftover after parsing attributes in process `syz.0.986'.
[  165.175581][ T8682] loop3: detected capacity change from 0 to 1024
[  165.181069][ T8682] hfsplus: Unknown parameter 'nodecompose'
[  165.183364][ T8661] loop4: detected capacity change from 0 to 32768
[  165.391918][ T8661] ocfs2: Slot 0 on device (7,4) was already allocated to this node!
[  165.454172][ T8661] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode.
[  165.672173][ T8035] ocfs2: Unmounting device (7,4) on (node local)
[  167.831953][ T8709] loop3: detected capacity change from 0 to 32768
[  167.859019][ T8709] XFS (loop3): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  167.933284][ T8709] XFS (loop3): Ending clean mount
[  167.936255][ T8719] loop0: detected capacity change from 0 to 32768
[  167.951468][ T8709] XFS (loop3): Quotacheck needed: Please wait.
[  167.975849][ T8719] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[  167.998067][   T13] (kworker/u8:1,13,0):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #72: rec_len % 4 != 0 - offset=16, inode=66, rec_len=491, name_len=2
[  168.024676][ T8709] XFS (loop3): Quotacheck: Done.
[  168.102194][ T6906] XFS (loop3): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  168.117581][ T5851] ocfs2: Unmounting device (7,0) on (node local)
[  169.282310][ T8749] loop0: detected capacity change from 0 to 32768
[  169.297754][ T8749] XFS: noattr2 mount option is deprecated.
[  169.316205][ T8749] XFS (loop0): attr2 and noattr2 cannot both be specified.
[  169.584470][ T8763] loop0: detected capacity change from 0 to 8
[  169.619984][ T8763] SQUASHFS error: lzo decompression failed, data probably corrupt
[  169.635792][ T8763] SQUASHFS error: Failed to read block 0x28d: -5
[  169.648914][ T8763] SQUASHFS error: Unable to read metadata cache entry [28b]
[  169.661229][ T8763] SQUASHFS error: Unable to read inode 0x11f
[  169.787578][ T8776] netlink: 172 bytes leftover after parsing attributes in process `syz.0.1020'.
[  169.974943][   T10] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[  170.064934][    T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd
[  170.136939][   T10] usb 5-1: config 0 has no interfaces?
[  170.141439][   T10] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f
[  170.145743][   T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  170.149134][   T10] usb 5-1: Product: syz
[  170.150993][   T10] usb 5-1: Manufacturer: syz
[  170.152948][   T10] usb 5-1: SerialNumber: syz
[  170.157152][   T10] usb 5-1: config 0 descriptor??
[  170.214982][    T9] usb 1-1: Using ep0 maxpacket: 32
[  170.218783][    T9] usb 1-1: config 0 has an invalid interface number: 12 but max is 0
[  170.222373][    T9] usb 1-1: config 0 has no interface number 0
[  170.224750][    T9] usb 1-1: config 0 interface 12 has no altsetting 0
[  170.230006][    T9] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=70.40
[  170.233427][    T9] usb 1-1: New USB device strings: Mfr=231, Product=2, SerialNumber=3
[  170.236919][    T9] usb 1-1: Product: syz
[  170.238766][    T9] usb 1-1: Manufacturer: syz
[  170.240639][    T9] usb 1-1: SerialNumber: syz
[  170.244358][    T9] usb 1-1: config 0 descriptor??
[  170.371132][   T10] usb 5-1: USB disconnect, device number 3
[  170.854978][ T5915] usb 4-1: new high-speed USB device number 7 using dummy_hcd
[  170.914645][ T8788] openvswitch: netlink: Message has 8 unknown bytes.
[  170.917939][ T8788] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  171.005008][ T5915] usb 4-1: Using ep0 maxpacket: 32
[  171.010273][ T5915] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  171.021696][ T5915] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00
[  171.025757][ T5915] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  171.035701][ T5915] usb 4-1: config 0 descriptor??
[  171.404401][ T8804] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1034'.
[  171.455200][ T5915] koneplus 0003:1E7D:2D51.0004: unknown main item tag 0x0
[  171.459081][ T5915] koneplus 0003:1E7D:2D51.0004: unknown main item tag 0x0
[  171.467779][ T5915] koneplus 0003:1E7D:2D51.0004: unknown main item tag 0x0
[  171.470773][ T5915] koneplus 0003:1E7D:2D51.0004: unknown main item tag 0x0
[  171.473769][ T5915] koneplus 0003:1E7D:2D51.0004: unknown main item tag 0x0
[  171.497341][ T5915] koneplus 0003:1E7D:2D51.0004: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.3-1/input0
[  171.671827][    T9] f81534 1-1:0.12: f81534_set_register: reg: 1002 data: 2f failed: -71
[  171.675571][    T9] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71
[  171.678763][    T9] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71
[  171.682190][    T9] f81534 1-1:0.12: probe with driver f81534 failed with error -71
[  171.690503][    T9] usb 1-1: USB disconnect, device number 11
[  171.710648][ T8786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  171.714093][ T8786] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  171.731525][ T5915] koneplus 0003:1E7D:2D51.0004: couldn't init struct koneplus_device
[  171.738714][ T5915] koneplus 0003:1E7D:2D51.0004: couldn't install mouse
[  171.749831][ T5915] koneplus 0003:1E7D:2D51.0004: probe with driver koneplus failed with error -71
[  171.763231][ T5915] usb 4-1: USB disconnect, device number 7
[  171.907474][ T8815] loop4: detected capacity change from 0 to 2048
[  171.919756][ T8816] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  171.951195][ T8815] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=12)
[  171.961651][ T8815] Remounting filesystem read-only
[  171.964056][ T8815] NILFS error (device loop4): nilfs_bmap_lookup_contig: broken bmap (inode number=12)
[  171.985461][ T8035] NILFS (loop4): disposed unprocessed dirty file(s) when detaching log writer
[  172.904406][ T8848] loop0: detected capacity change from 0 to 256
[  172.924437][ T8848] exFAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  172.938244][ T8848] exFAT-fs (loop0): Medium has reported failures. Some data may be lost.
[  172.962715][ T8848] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  173.178065][ T8846] loop3: detected capacity change from 0 to 32768
[  173.202249][ T8846] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  173.265457][ T8846] XFS (loop3): Ending clean mount
[  173.277307][ T8846] XFS (loop3): Quotacheck needed: Please wait.
[  173.326071][ T8846] XFS (loop3): Quotacheck: Done.
[  173.428874][ T6906] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  173.738216][ T8876] netlink: 'syz.3.1063': attribute type 1 has an invalid length.
[  174.016524][ T8886] loop4: detected capacity change from 0 to 256
[  174.019379][ T8886] exfat: Deprecated parameter 'utf8'
[  174.043128][ T8886] exfat: Deprecated parameter 'utf8'
[  174.056733][ T8886] exfat: Deprecated parameter 'utf8'
[  174.069980][ T8886] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xabf88b1f, utbl_chksum : 0xe619d30d)
[  174.301709][ T8899] loop0: detected capacity change from 0 to 4096
[  174.311102][ T8899] ntfs3(loop0): Different NTFS sector size (4096) and media sector size (512).
[  174.405874][ T8899] ntfs3(loop0): ino=19, mi_enum_attr
[  174.708683][ T8913] loop0: detected capacity change from 0 to 1024
[  174.735103][ T8913] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  174.770196][ T8913] EXT4-fs error (device loop0): ext4_xattr_inode_iget:437: comm syz.0.1078: inode #218: comm syz.0.1078: iget: illegal inode #
[  174.782175][ T8913] EXT4-fs error (device loop0): ext4_xattr_inode_iget:442: comm syz.0.1078: error while reading EA inode 218 err=-117
[  174.831175][ T5851] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  176.574675][ T8931] kexec: Could not allocate control_code_buffer
[  176.630940][ T8951] netlink: 'syz.0.1095': attribute type 64 has an invalid length.
[  176.644953][ T8951] netlink: 'syz.0.1095': attribute type 4 has an invalid length.
[  176.648371][ T8951] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1095'.
[  176.713839][ T8957] RDS: rds_bind could not find a transport for fc02::1, load rds_tcp or rds_rdma?
[  176.822172][ T8963] netdevsim netdevsim0 netdevsim0: entered promiscuous mode
[  176.825647][ T8965] loop3: detected capacity change from 0 to 512
[  176.831621][ T8963] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  176.837423][ T8965] EXT4-fs (loop3): mounting ext2 file system using the ext4 subsystem
[  176.857149][ T8965] EXT4-fs error (device loop3): ext4_validate_block_bitmap:432: comm syz.3.1101: bg 0: block 104: invalid block bitmap
[  176.863192][ T8965] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6657: Corrupt filesystem
[  176.869531][ T8965] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.1101: invalid indirect mapped block 1 (level 1)
[  176.884364][ T8965] EXT4-fs (loop3): 1 truncate cleaned up
[  176.890108][ T8965] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  176.942489][ T6906] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  177.024989][ T8968] loop0: detected capacity change from 0 to 40427
[  177.027805][ T8968] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12
[  177.030258][ T8968] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[  177.032846][ T8972] Bluetooth: MGMT ver 1.23
[  177.033966][ T8968] F2FS-fs (loop0): invalid crc value
[  177.081466][ T8968] F2FS-fs (loop0): access invalid blkaddr:0
[  177.083708][ T8968] CPU: 1 UID: 0 PID: 8968 Comm: syz.0.1103 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  177.083720][ T8968] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  177.083725][ T8968] Call Trace:
[  177.083728][ T8968]  <TASK>
[  177.083732][ T8968]  dump_stack_lvl+0x189/0x250
[  177.083747][ T8968]  ? __pfx_dump_stack_lvl+0x10/0x10
[  177.083764][ T8968]  __f2fs_is_valid_blkaddr+0xe52/0x14f0
[  177.083779][ T8968]  sanity_check_extent_cache+0x1a3/0x620
[  177.083796][ T8968]  f2fs_iget+0x3a7f/0x5550
[  177.083817][ T8968]  f2fs_fill_super+0x494a/0x6ff0
[  177.083847][ T8968]  get_tree_bdev_flags+0x40e/0x4d0
[  177.083859][ T8968]  ? __pfx_f2fs_fill_super+0x10/0x10
[  177.083870][ T8968]  ? __pfx_get_tree_bdev_flags+0x10/0x10
[  177.083885][ T8968]  vfs_get_tree+0x92/0x2b0
[  177.083897][ T8968]  do_new_mount+0x2a2/0x9e0
[  177.083910][ T8968]  ? ns_capable+0x8a/0xf0
[  177.083918][ T8968]  ? __pfx_do_new_mount+0x10/0x10
[  177.083928][ T8968]  ? path_mount+0x61c/0xfe0
[  177.083937][ T8968]  ? user_path_at+0x44/0x60
[  177.083949][ T8968]  __se_sys_mount+0x317/0x410
[  177.083963][ T8968]  ? __pfx___se_sys_mount+0x10/0x10
[  177.083976][ T8968]  ? do_syscall_64+0xbe/0x3b0
[  177.083985][ T8968]  ? __x64_sys_mount+0x20/0xc0
[  177.083996][ T8968]  do_syscall_64+0xfa/0x3b0
[  177.084004][ T8968]  ? lockdep_hardirqs_on+0x9c/0x150
[  177.084012][ T8968]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  177.084019][ T8968]  ? exc_page_fault+0x9f/0xf0
[  177.084028][ T8968]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  177.084035][ T8968] RIP: 0033:0x7f6c6ef9038a
[  177.084043][ T8968] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  177.084049][ T8968] RSP: 002b:00007f6c6fdcfe68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[  177.084059][ T8968] RAX: ffffffffffffffda RBX: 00007f6c6fdcfef0 RCX: 00007f6c6ef9038a
[  177.084065][ T8968] RDX: 0000200000000280 RSI: 0000200000000040 RDI: 00007f6c6fdcfeb0
[  177.084070][ T8968] RBP: 0000200000000280 R08: 00007f6c6fdcfef0 R09: 0000000000000000
[  177.084075][ T8968] R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000000040
[  177.084080][ T8968] R13: 00007f6c6fdcfeb0 R14: 000000000000559f R15: 0000200000000340
[  177.084091][ T8968]  </TASK>
[  177.168341][ T8968] F2FS-fs (loop0): sanity_check_extent_cache: inode (ino=3) extent info [0, 0, 1280] is incorrect, run fsck to fix
[  177.173409][ T8968] F2FS-fs (loop0): Failed to read root inode
[  177.934222][ T9010] loop3: detected capacity change from 0 to 1024
[  177.960730][ T9010] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  177.971741][   T33] audit: type=1800 audit(177.827:31): pid=9010 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1120" name="file1" dev="loop3" ino=15 res=0 errno=0
[  178.013272][ T6906] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  178.309883][ T9018] netlink: 'syz.4.1122': attribute type 3 has an invalid length.
[  178.381427][ T9024] netlink: 'syz.4.1124': attribute type 1 has an invalid length.
[  178.722166][ T9040] loop3: detected capacity change from 0 to 4096
[  178.732851][ T9040] ntfs3(loop3): Different NTFS sector size (4096) and media sector size (512).
[  178.767668][ T9040] ntfs3(loop3): ino=1a, mi_enum_attr
[  178.770009][ T9040] ntfs3(loop3): Mark volume as dirty due to NTFS errors
[  178.778146][ T9040] ntfs3(loop3): ino=1a, mi_enum_attr
[  178.780481][ T9040] ntfs3(loop3): Failed to initialize $Extend/$Reparse.
[  178.811813][ T9042] loop4: detected capacity change from 0 to 4096
[  178.839752][ T9042] ntfs3(loop4): ino=19, mi_enum_attr
[  178.842106][ T9042] ntfs3(loop4): Mark volume as dirty due to NTFS errors
[  179.052496][ T9055] sctp: [Deprecated]: syz.4.1138 (pid 9055) Use of struct sctp_assoc_value in delayed_ack socket option.
[  179.052496][ T9055] Use struct sctp_sack_info instead
[  179.075083][ T5854] Bluetooth: hci2: command 0x0401 tx timeout
[  179.080536][ T5236] Bluetooth: hci2: Opcode 0x0401 failed: -110
[  179.177647][ T5236] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201'
[  179.181596][ T5236] CPU: 0 UID: 0 PID: 5236 Comm: kworker/u11:1 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  179.181615][ T5236] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  179.181623][ T5236] Workqueue: hci2 hci_rx_work
[  179.181641][ T5236] Call Trace:
[  179.181647][ T5236]  <TASK>
[  179.181653][ T5236]  dump_stack_lvl+0x189/0x250
[  179.181672][ T5236]  ? __pfx_dump_stack_lvl+0x10/0x10
[  179.181686][ T5236]  ? __pfx__printk+0x10/0x10
[  179.181707][ T5236]  ? kernfs_path_from_node+0x250/0x290
[  179.181720][ T5236]  ? kernfs_path_from_node+0x2f/0x290
[  179.181741][ T5236]  sysfs_create_dir_ns+0x259/0x280
[  179.181756][ T5236]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  179.181769][ T5236]  ? do_raw_spin_unlock+0x4d/0x240
[  179.181786][ T5236]  kobject_add_internal+0x59f/0xb40
[  179.181806][ T5236]  kobject_add+0x155/0x220
[  179.181823][ T5236]  ? __pfx_kobject_add+0x10/0x10
[  179.181837][ T5236]  ? _raw_spin_unlock+0x28/0x50
[  179.181851][ T5236]  ? get_device_parent+0x366/0x3a0
[  179.181869][ T5236]  device_add+0x408/0xb50
[  179.181887][ T5236]  hci_conn_add_sysfs+0xd5/0x1e0
[  179.181905][ T5236]  le_conn_complete_evt+0xc3a/0x1220
[  179.181927][ T5236]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  179.181941][ T5236]  ? __mutex_unlock_slowpath+0x1a1/0x760
[  179.181953][ T5236]  ? __asan_memcpy+0x40/0x70
[  179.181970][ T5236]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  179.181982][ T5236]  ? skb_pull_data+0xfb/0x200
[  179.181997][ T5236]  hci_le_conn_complete_evt+0x187/0x450
[  179.182014][ T5236]  hci_event_packet+0x78f/0x1200
[  179.182033][ T5236]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  179.182046][ T5236]  ? __pfx_hci_event_packet+0x10/0x10
[  179.182063][ T5236]  ? kcov_remote_start+0x4d3/0x7f0
[  179.182077][ T5236]  ? lockdep_hardirqs_on+0x90/0x150
[  179.182092][ T5236]  ? hci_send_to_monitor+0xe2/0x570
[  179.182107][ T5236]  hci_rx_work+0x46a/0xe80
[  179.182122][ T5236]  ? process_scheduled_works+0x9ef/0x17b0
[  179.182137][ T5236]  process_scheduled_works+0xae1/0x17b0
[  179.182168][ T5236]  ? __pfx_process_scheduled_works+0x10/0x10
[  179.182197][ T5236]  worker_thread+0x8a0/0xda0
[  179.182210][ T5236]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  179.182227][ T5236]  ? __kthread_parkme+0x7b/0x200
[  179.182244][ T5236]  kthread+0x711/0x8a0
[  179.182259][ T5236]  ? __pfx_worker_thread+0x10/0x10
[  179.182269][ T5236]  ? __pfx_kthread+0x10/0x10
[  179.182284][ T5236]  ? _raw_spin_unlock_irq+0x23/0x50
[  179.182295][ T5236]  ? lockdep_hardirqs_on+0x9c/0x150
[  179.182305][ T5236]  ? __pfx_kthread+0x10/0x10
[  179.182318][ T5236]  ret_from_fork+0x3fc/0x770
[  179.182332][ T5236]  ? __pfx_ret_from_fork+0x10/0x10
[  179.182347][ T5236]  ? __switch_to_asm+0x39/0x70
[  179.182360][ T5236]  ? __switch_to_asm+0x33/0x70
[  179.182372][ T5236]  ? __pfx_kthread+0x10/0x10
[  179.182385][ T5236]  ret_from_fork_asm+0x1a/0x30
[  179.182409][ T5236]  </TASK>
[  179.182429][ T5236] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  179.261102][ T9067] loop0: detected capacity change from 0 to 1024
[  179.262232][ T5236] Bluetooth: hci2: failed to register connection device
[  179.350930][ T1089] hfsplus: b-tree write err: -5, ino 4
[  179.402965][ T5915] usb 4-1: new high-speed USB device number 8 using dummy_hcd
[  179.432052][ T5236] Bluetooth: hci2: unexpected event for opcode 0x2035
[  179.565053][ T5915] usb 4-1: Using ep0 maxpacket: 32
[  179.576633][ T5915] usb 4-1: config 0 interface 0 has no altsetting 0
[  179.581864][ T5915] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e
[  179.586688][ T5915] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  179.590144][ T5915] usb 4-1: Product: syz
[  179.592128][ T5915] usb 4-1: Manufacturer: syz
[  179.594185][ T5915] usb 4-1: SerialNumber: syz
[  179.604489][ T5915] usb 4-1: config 0 descriptor??
[  179.747603][ T9079] loop0: detected capacity change from 0 to 32768
[  179.759288][ T9079] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.1149 (9079)
[  179.772876][ T9079] BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  179.777009][ T9079] BTRFS info (device loop0): using sha256 (sha256-lib) checksum algorithm
[  179.780300][ T9079] BTRFS info (device loop0): using free-space-tree
[  179.891221][ T5851] BTRFS info (device loop0): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  180.033459][ T5915] gs_usb 4-1:0.0: Configuring for 84 interfaces
[  180.036373][ T5915] gs_usb 4-1:0.0: Driver cannot handle more that 3 CAN interfaces
[  180.039656][ T5915] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -22
[  180.084506][ T9100] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1150'.
[  180.102631][ T9100] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1150'.
[  180.237401][   T10] usb 4-1: USB disconnect, device number 8
[  180.434218][ T9118] loop4: detected capacity change from 0 to 1024
[  180.474127][ T9118] EXT4-fs (loop4): Can't support bigalloc feature without extents feature
[  180.474127][ T9118] 
[  180.479127][ T9118] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities
[  180.565263][ T9126] loop0: detected capacity change from 0 to 1024
[  180.611605][   T27] hfsplus: b-tree write err: -5, ino 4
[  180.730971][ T9134] syzkaller1: entered promiscuous mode
[  180.733409][ T9134] syzkaller1: entered allmulticast mode
[  180.828990][ T9140] netlink: 'syz.0.1172': attribute type 1 has an invalid length.
[  180.833127][ T9140] netlink: 'syz.0.1172': attribute type 4 has an invalid length.
[  180.978652][ T9152] loop4: detected capacity change from 0 to 256
[  180.991353][ T9152] exFAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  180.999228][ T9156] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.1179'.
[  181.003079][ T9152] exFAT-fs (loop4): Medium has reported failures. Some data may be lost.
[  181.015604][ T9152] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  181.083358][ T9158] loop0: detected capacity change from 0 to 256
[  181.087942][ T9158] exfat: Deprecated parameter 'utf8'
[  181.107769][ T9159] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  181.114333][ T9158] exFAT-fs (loop0): error, data size is invalid(34359738378)
[  181.127505][ T9159] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  181.302658][ T9166] loop4: detected capacity change from 0 to 512
[  181.455281][ T5901] usb 1-1: new high-speed USB device number 12 using dummy_hcd
[  181.605061][ T5901] usb 1-1: Using ep0 maxpacket: 16
[  181.622964][ T5901] usb 1-1: New USB device found, idVendor=0458, idProduct=704a, bcdDevice=3a.55
[  181.638800][ T5901] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  181.641640][ T5901] usb 1-1: Product: syz
[  181.643105][ T5901] usb 1-1: Manufacturer: syz
[  181.655715][ T5901] usb 1-1: SerialNumber: syz
[  181.668463][ T5901] usb 1-1: config 0 descriptor??
[  181.685747][ T5901] gspca_main: gspca_sn9c20x-2.14.0 probing 0458:704a
[  182.092122][ T5901] gspca_sn9c20x: Write register 1001 failed -71
[  182.094312][ T5901] gspca_sn9c20x: Device initialization failed
[  182.098323][ T5901] gspca_sn9c20x 1-1:0.0: probe with driver gspca_sn9c20x failed with error -71
[  182.107424][ T5901] usb 1-1: USB disconnect, device number 12
[  182.230520][ T9176] loop4: detected capacity change from 0 to 512
[  182.254615][ T9176] EXT4-fs (loop4): Test dummy encryption mode enabled
[  182.257867][ T9176] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  182.271088][ T9176] EXT4-fs error (device loop4): ext4_orphan_get:1418: comm syz.4.1188: bad orphan inode 131083
[  182.283744][ T9176] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  182.508981][ T9176] fscrypt: AES-256-XTS using implementation "xts(ecb(aes-fixed-time))"
[  182.542903][ T8035] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  183.297848][ T9213] loop4: detected capacity change from 0 to 512
[  183.306308][ T9213] ext4: Unknown parameter ''
[  183.478693][ T5854] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0
[  183.483862][ T5854] Bluetooth: hci2: Injecting HCI hardware error event
[  183.582252][ T9221] loop0: detected capacity change from 0 to 4096
[  183.607340][ T9222] fuse: Unknown parameter '0xffffffffffffffff0000000000000000000000000000000000000000'
[  183.631531][ T9223] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  184.223537][ T9235] loop0: detected capacity change from 0 to 256
[  184.249522][ T9235] exfat: Deprecated parameter 'utf8'
[  184.301840][ T9235] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x5441951d, utbl_chksum : 0xe619d30d)
[  185.223678][ T9251] netlink: 'syz.4.1210': attribute type 29 has an invalid length.
[  185.235423][ T9251] netlink: 'syz.4.1210': attribute type 29 has an invalid length.
[  185.395244][ T5236] Bluetooth: hci2: hardware error 0x00
[  185.415067][ T5854] Bluetooth: hci2: command 0x0401 tx timeout
[  185.459328][ T9270] sctp: [Deprecated]: syz.3.1215 (pid 9270) Use of int in max_burst socket option.
[  185.459328][ T9270] Use struct sctp_assoc_value instead
[  185.564974][ T5915] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[  185.719321][ T5915] usb 5-1: config 0 has an invalid descriptor of length 97, skipping remainder of the config
[  185.723495][ T5915] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81
[  185.725050][ T5901] usb 4-1: new high-speed USB device number 9 using dummy_hcd
[  185.728181][ T5915] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  185.728213][ T5915] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  185.728227][ T5915] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x61, changing to 0x1
[  185.728245][ T5915] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has an invalid bInterval 97, changing to 7
[  185.728261][ T5915] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 24929, setting to 1024
[  185.736614][ T5915] usb 5-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=d1.41
[  185.755647][ T5915] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  185.759047][ T5915] usb 5-1: Product: syz
[  185.760863][ T5915] usb 5-1: Manufacturer: syz
[  185.762848][ T5915] usb 5-1: SerialNumber: syz
[  185.767296][ T5915] usb 5-1: config 0 descriptor??
[  185.889975][ T5901] usb 4-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac
[  185.894282][ T5901] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  185.897927][ T5901] usb 4-1: Product: syz
[  185.899794][ T5901] usb 4-1: Manufacturer: syz
[  185.901789][ T5901] usb 4-1: SerialNumber: syz
[  185.906447][ T5901] usb 4-1: config 0 descriptor??
[  185.916220][ T5901] gspca_main: sunplus-2.14.0 probing 055f:c230
[  185.952674][ T9285] loop0: detected capacity change from 0 to 128
[  186.028821][ T5915] usb 5-1: ucan: probing device on interface #0
[  186.033355][ T5915] usb 5-1: ucan: invalid endpoint configuration
[  186.037346][ T5915] usb 5-1: ucan: probe failed; try to update the device firmware
[  186.057619][ T5915] usb 5-1: USB disconnect, device number 4
[  187.232086][ T5915] usb 4-1: USB disconnect, device number 9
[  187.499930][ T9293] netlink: 'syz.0.1223': attribute type 10 has an invalid length.
[  187.517436][ T9293] syz_tun: entered promiscuous mode
[  187.555200][ T5236] Bluetooth: hci2: Opcode 0x0c03 failed: -110
[  187.570411][ T9294] netlink: 'syz.0.1223': attribute type 10 has an invalid length.
[  187.571945][ T9293] bond0: (slave syz_tun): Enslaving as an active interface with an up link
[  187.602336][ T9294] 8021q: adding VLAN 0 to HW filter on device bond0
[  187.614574][ T9294] team0: Port device bond0 added
[  188.252187][ T9307] loop0: detected capacity change from 0 to 8
[  188.260215][ T9307] squashfs image failed sanity check
[  188.487689][ T9323] loop4: detected capacity change from 0 to 4096
[  188.505863][ T9321] CUSE: unknown device info ""
[  188.507918][ T9321] CUSE: unknown device info ""
[  188.510004][ T9321] CUSE: unknown device info ""
[  188.516381][ T9323] ntfs3(loop4): Different NTFS sector size (4096) and media sector size (512).
[  188.523803][ T9321] CUSE: unknown device info ""
[  188.526757][ T9321] CUSE: zero length info key specified
[  188.707203][ T9330] netlink: 348 bytes leftover after parsing attributes in process `syz.3.1239'.
[  188.873160][ T9323] ntfs3(loop4): Mark volume as dirty due to NTFS errors
[  188.887811][ T9323] ntfs3(loop4): ino=19, mi_enum_attr
[  188.899737][ T9323] ntfs3(loop4): failed to convert "c46c" to cp857
[  188.913172][ T9323] ntfs3(loop4): ino=20, mi_enum_attr
[  189.108665][ T9345] loop4: detected capacity change from 0 to 32768
[  189.139300][ T9345] XFS (loop4): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  189.157039][ T9345] XFS (loop4): Ending clean mount
[  189.185226][ T8035] XFS (loop4): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  189.427639][ T9369] loop0: detected capacity change from 0 to 128
[  189.451568][ T9373] netlink: 'syz.4.1254': attribute type 15 has an invalid length.
[  189.464568][ T9369] EXT4-fs: Ignoring removed nomblk_io_submit option
[  189.471394][ T9369] EXT4-fs: Ignoring removed nomblk_io_submit option
[  189.476572][ T9369] EXT4-fs (loop0): Test dummy encryption mode enabled
[  189.500683][ T9369] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  189.622593][ T5851] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  189.802289][ T9393] loop4: detected capacity change from 0 to 512
[  189.833938][ T9393] EXT4-fs (loop4): orphan cleanup on readonly fs
[  189.837310][   T10] usb 4-1: new high-speed USB device number 10 using dummy_hcd
[  189.843814][ T9393] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -13
[  189.848454][ T9393] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters
[  189.872181][ T9393] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #13: comm syz.4.1263: attempt to clear invalid blocks 2 len 1
[  189.872853][ T9398] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1265'.
[  189.887703][ T9393] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #13: comm syz.4.1263: invalid indirect mapped block 1819239214 (level 0)
[  189.892577][ T9398] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1265'.
[  189.898310][ T9393] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #13: comm syz.4.1263: invalid indirect mapped block 1819239214 (level 1)
[  189.908563][ T9393] EXT4-fs (loop4): 1 truncate cleaned up
[  189.912182][ T9393] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[  189.959251][ T8035] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  190.002047][   T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  190.016805][   T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3
[  190.033813][   T10] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  190.042897][   T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  190.055049][   T10] usb 4-1: SerialNumber: syz
[  190.071878][ T9406] netlink: 372 bytes leftover after parsing attributes in process `syz.0.1269'.
[  190.264923][   T47] usb 5-1: new high-speed USB device number 5 using dummy_hcd
[  190.279113][   T10] usb 4-1: 0:2 : does not exist
[  190.281298][   T10] usb 4-1: unit 9 not found!
[  190.305119][   T10] usb 4-1: USB disconnect, device number 10
[  190.334554][ T5927] udevd[5927]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  190.367204][ T9410] loop0: detected capacity change from 0 to 32768
[  190.389914][ T9410] JBD2: Ignoring recovery information on journal
[  190.418786][   T47] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  190.422445][   T47] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[  190.441011][   T47] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  190.447973][   T47] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  190.451562][   T47] usb 5-1: SerialNumber: syz
[  190.454542][ T9410] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[  190.483711][ T9410] (syz.0.1271,9410,1):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #65: directory entry too close to end - offset=32, inode=17057, rec_len=280, name_len=10
[  190.517249][ T5851] ocfs2: Unmounting device (7,0) on (node local)
[  190.679576][   T47] usb 5-1: 0:2 : does not exist
[  190.700004][   T47] usb 5-1: USB disconnect, device number 5
[  190.728077][ T5927] udevd[5927]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  190.893688][ T9418] tipc: Failed to remove unknown binding: 66,1,1/0:1392600807/1392600809
[  191.490559][ T9448] tmpfs: Bad value for 'mpol'
[  191.662905][ T9452] ieee802154 phy0 wpan0: encryption failed: -22
[  191.755889][ T9444] loop0: detected capacity change from 0 to 32768
[  191.801297][ T9444] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  191.836432][ T9444] XFS (loop0): Ending clean mount
[  191.841983][ T9466] netlink: 136 bytes leftover after parsing attributes in process `syz.4.1294'.
[  191.849963][ T9444] XFS (loop0): Quotacheck needed: Please wait.
[  191.885217][ T9444] XFS (loop0): Quotacheck: Done.
[  191.958044][ T9470] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[  191.965739][ T5851] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  191.973175][ T9470] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db
[  192.206323][ T9458] loop3: detected capacity change from 0 to 40427
[  192.210738][ T9458] F2FS-fs (loop3): Wrong SIT boundary, start(1536) end(50334208) blocks(1024)
[  192.214553][ T9458] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock
[  192.229676][ T9458] F2FS-fs (loop3): invalid crc value
[  192.341471][ T9458] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  192.349287][ T9458] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0
[  192.354912][ T9458] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
[  192.572176][ T9489] loop0: detected capacity change from 0 to 1024
[  192.576248][ T9489] EXT4-fs: inline encryption not supported
[  192.592957][ T9489] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  192.633880][ T5851] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  192.854926][    T9] usb 4-1: new high-speed USB device number 11 using dummy_hcd
[  192.924028][ T9498] fanotify: failed to encode fid (type=0, len=0, err=-2)
[  193.007258][    T9] usb 4-1: config 0 has an invalid interface number: 228 but max is 0
[  193.010133][    T9] usb 4-1: config 0 has no interface number 0
[  193.012225][    T9] usb 4-1: config 0 interface 228 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0
[  193.022787][ T9509] program syz.4.1312 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  193.037255][    T9] usb 4-1: New USB device found, idVendor=057c, idProduct=2200, bcdDevice=34.b1
[  193.040279][    T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  193.042992][    T9] usb 4-1: Product: syz
[  193.044403][    T9] usb 4-1: Manufacturer: syz
[  193.046069][ T9511] overlayfs: failed to decode file handle (len=4, type=251, flags=0, err=-22)
[  193.065819][    T9] usb 4-1: SerialNumber: syz
[  193.080628][    T9] usb 4-1: config 0 descriptor??
[  193.093924][    T9] bfusb 4-1:0.228: probe with driver bfusb failed with error -5
[  193.172629][ T9518] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_to_hsr, syncid = 0, id = 0
[  193.218715][ T9520] sg_write: data in/out 16514940/4 bytes for SCSI command 0x1c-- guessing data in;
[  193.218715][ T9520]    program syz.0.1316 not setting count and/or reply_len properly
[  193.303818][   T10] usb 4-1: USB disconnect, device number 11
[  193.344115][ T9524] loop0: detected capacity change from 0 to 8192
[  193.665268][    T9] usb 1-1: new high-speed USB device number 13 using dummy_hcd
[  193.835495][    T9] usb 1-1: Using ep0 maxpacket: 8
[  193.844050][    T9] usb 1-1: unable to get BOS descriptor or descriptor too short
[  193.852438][    T9] usb 1-1: config 1 interface 0 has no altsetting 0
[  193.859428][    T9] usb 1-1: New USB device found, idVendor=056a, idProduct=0027, bcdDevice= 0.40
[  193.864117][    T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  193.871484][    T9] usb 1-1: Product: syz
[  193.873539][    T9] usb 1-1: Manufacturer: syz
[  193.876029][    T9] usb 1-1: SerialNumber: syz
[  194.044682][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[  194.047590][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[  194.113153][    T9] usbhid 1-1:1.0: can't add hid device: -71
[  194.125100][    T9] usbhid 1-1:1.0: probe with driver usbhid failed with error -71
[  194.131546][    T9] usb 1-1: USB disconnect, device number 13
[  194.162481][ T9540] netlink: 100 bytes leftover after parsing attributes in process `syz.3.1327'.
[  194.279146][ T9546] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1329'.
[  194.705637][    T9] usb 4-1: new high-speed USB device number 12 using dummy_hcd
[  194.874340][ T9576] loop4: detected capacity change from 0 to 1024
[  194.895275][    T9] usb 4-1: Using ep0 maxpacket: 32
[  194.901353][    T9] usb 4-1: config 0 has an invalid interface number: 85 but max is 0
[  194.912590][    T9] usb 4-1: config 0 has no interface number 0
[  194.920407][    T9] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  194.947885][    T9] usb 4-1: config 0 interface 85 has no altsetting 0
[  195.112231][    T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72
[  195.125216][ T9576] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none.
[  195.135776][    T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  195.157645][    T9] usb 4-1: Product: syz
[  195.160686][    T9] usb 4-1: Manufacturer: syz
[  195.162457][    T9] usb 4-1: SerialNumber: syz
[  195.166766][    T9] usb 4-1: config 0 descriptor??
[  195.178168][ T9576] EXT4-fs error (device loop4): ext4_free_blocks:6696: comm syz.4.1342: Freeing blocks not in datazone - block = 0, count = 16
[  195.188264][ T9576] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters
[  195.196893][ T9576] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 63 with max blocks 65 with error 28
[  195.203571][ T9576] EXT4-fs (loop4): This should not happen!! Data will be lost
[  195.203571][ T9576] 
[  195.208314][ T9576] EXT4-fs (loop4): Total free blocks count 0
[  195.210948][ T9576] EXT4-fs (loop4): Free/Dirty block details
[  195.213555][ T9576] EXT4-fs (loop4): free_blocks=4293918720
[  195.216270][ T9576] EXT4-fs (loop4): dirty_blocks=80
[  195.218569][ T9576] EXT4-fs (loop4): Block reservation details
[  195.221157][ T9576] EXT4-fs (loop4): i_reserved_data_blocks=5
[  195.235955][ T9576] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 65 with error 28
[  195.411470][ T9585] loop4: detected capacity change from 0 to 128
[  195.437546][ T9585] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  195.468101][ T8035] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  195.815055][    T9] appletouch 4-1:0.85: Geyser mode initialized.
[  195.822350][    T9] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.85/input/input10
[  196.029525][   T47] usb 4-1: USB disconnect, device number 12
[  196.072378][   T47] appletouch 4-1:0.85: input: appletouch disconnected
[  196.113093][ T9622] loop0: detected capacity change from 0 to 512
[  196.118664][ T9622] EXT4-fs: Ignoring removed orlov option
[  196.141970][ T9622] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  196.208409][ T5851] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  196.319553][ T9634] syzkaller1: entered promiscuous mode
[  196.321638][ T9634] syzkaller1: entered allmulticast mode
[  196.691669][ T9652] A link change request failed with some changes committed already. Interface veth1_to_bond may have been left with an inconsistent configuration, please check.
[  196.909482][ T9660] loop0: detected capacity change from 0 to 4096
[  196.956950][ T9667] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  197.085699][ T9673] 8021q: adding VLAN 0 to HW filter on device bond1
[  197.096572][ T9675] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link
[  197.111464][ T9673] Bluetooth: hci0: Opcode 0x0c1a failed: -22
[  197.170832][ T5693] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  197.294791][   T13] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond
[  197.411558][ T9697] netlink: 'syz.0.1397': attribute type 3 has an invalid length.
[  197.414083][ T9697] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  197.498684][ T9702] loop4: detected capacity change from 0 to 1764
[  197.520888][ T9702] ISOFS: Unable to identify CD-ROM format.
[  197.662898][ T9704] loop0: detected capacity change from 0 to 32768
[  197.666791][ T9704] bcachefs (/dev/loop0): error reading default superblock: checksum error, type none: got  should be 
[  197.670735][ T9704] bcachefs (/dev/loop0): error validating superblock: Invalid superblock section clean: entry type (unknown jset_entry_type 255) overruns end of section
[  197.670735][ T9704] clean (size 2912):
[  197.670735][ T9704] flags:          0
[  197.670735][ T9704] journal_seq:    10
[  197.670735][ T9704] usage: type=inodes v=8
[  197.670735][ T9704] usage: type=key_version v=0
[  197.670735][ T9704] usage: type=reserved v=0
[  197.670735][ T9704] usage: type=reserved v=0
[  197.670735][ T9704] usage: type=reserved v=0
[  197.670735][ T9704] usage: type=reserved v=0
[  197.670735][ T9704] data_usage: btree: 1/1 [0]=2816
[  197.670735][ T9704] data_usage: journal: 1/1 [0]=0
[  197.670735][ T9704] data_usage: user: 1/1 [0]=16
[  197.670735][ T9704] dev_usage: dev=0  
[  197.670735][ T9704]   free: buckets=83 sectors=0 fragmented=0
[  197.670735][ T9704]   sb: buckets=25 sectors=6152 fragmented=248
[  197.670735][ T9704]   journal: buckets=8 sectors=2048 fragmented=0
[  197.670735][ T9704]   btree: buckets=11 sectors=2816 fragmented=0
[  197.670735][ T9704]   user: buckets=1 sectors=16 fragmented=240
[  197.670735][ T9704]   cached: buckets=0 sectors=0 fragmented=0
[  197.670735][ T9704]   parity: buckets=432345564227567616 sectors=0 fragmented=0
[  197.670735][ T9704]   stripe: buckets=0 sectors=0 fragmented=0
[  197.670735][ T9704]   need_gc_gens: buckets=0 sectors=0 fragmented=0
[  197.670735][ T9704]   need_discard: buckets=0 sectors=0 fragmented=0
[  197.670735][ T9704] clock: read=0
[  197.670735][ T9704] clock: write=1280
[  197.670735][ T9704] log_bkey: btree=extents level=0 u64s 11 type btree_p
[  197.670818][ T9704] bcachefs: bch2_fs_get_tree() error: invalid_sb_clean
[  197.845002][   T47] usb 4-1: new high-speed USB device number 13 using dummy_hcd
[  197.965019][    T9] usb 5-1: new low-speed USB device number 6 using dummy_hcd
[  197.994980][   T47] usb 4-1: Using ep0 maxpacket: 16
[  197.999856][   T47] usb 4-1: config 1 has an invalid interface number: 105 but max is 0
[  198.003299][   T47] usb 4-1: config 1 has no interface number 0
[  198.006034][   T47] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16
[  198.009758][   T47] usb 4-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64
[  198.013208][   T47] usb 4-1: config 1 interface 105 has no altsetting 0
[  198.033054][   T47] usb 4-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d
[  198.037255][   T47] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  198.040699][   T47] usb 4-1: Product: syz
[  198.042472][   T47] usb 4-1: Manufacturer: syz
[  198.044521][   T47] usb 4-1: SerialNumber: syz
[  198.050614][ T9706] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  198.053595][ T9706] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  198.127564][    T9] usb 5-1: unable to get BOS descriptor or descriptor too short
[  198.131956][    T9] usb 5-1: config 0 has an invalid interface number: 105 but max is 0
[  198.144889][    T9] usb 5-1: config 0 has no interface number 0
[  198.147593][    T9] usb 5-1: config 0 interface 105 altsetting 10 endpoint 0xE is Bulk; changing to Interrupt
[  198.151607][    T9] usb 5-1: config 0 interface 105 has no altsetting 0
[  198.158289][    T9] usb 5-1: string descriptor 0 read error: -22
[  198.161414][    T9] usb 5-1: New USB device found, idVendor=1943, idProduct=2250, bcdDevice= 0.01
[  198.167964][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  198.176562][    T9] usb 5-1: config 0 descriptor??
[  198.180832][ T9710] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  198.187389][    T9] usb 5-1: Found UVC 0.00 device <unnamed> (1943:2250)
[  198.190410][    T9] usb 5-1: No valid video chain found.
[  198.192601][    T9] go7007 5-1:0.105: Sensoray 2250 found
[  198.194612][    T9] go7007 5-1:0.105: probe with driver go7007 failed with error -12
[  198.392585][    T9] usb 5-1: USB disconnect, device number 6
[  198.467335][ T9706] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  198.470624][ T9706] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  198.679758][   T47] aqc111 4-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x20) reg index 0x0000: -71
[  198.691820][   T47] aqc111 4-1:1.105: probe with driver aqc111 failed with error -71
[  198.703890][   T47] usb 4-1: USB disconnect, device number 13
[  199.054749][ T9731] sp0: Synchronizing with TNC
[  199.062947][ T9730] [U] `
[  199.156080][ T5236] Bluetooth: hci0: command tx timeout
[  199.167921][ T9733] netlink: 'syz.0.1413': attribute type 13 has an invalid length.
[  199.185173][   T47] usb 5-1: new high-speed USB device number 7 using dummy_hcd
[  199.246288][ T9737] loop3: detected capacity change from 0 to 256
[  199.251419][ T9737] exFAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  199.255027][ T9737] exFAT-fs (loop3): Medium has reported failures. Some data may be lost.
[  199.267808][ T9737] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xe5674ec2, utbl_chksum : 0xe619d30d)
[  199.347898][   T47] usb 5-1: Using ep0 maxpacket: 16
[  199.352136][   T47] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 78, changing to 10
[  199.362438][   T47] usb 5-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00
[  199.375075][   T47] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  199.381220][   T47] usb 5-1: config 0 descriptor??
[  199.464957][ T9743] sp0: Synchronizing with TNC
[  199.474161][ T9742] [U] 
[  199.900198][   T47] holtek 0003:1241:5015.0005: item fetching failed at offset 2/5
[  199.904011][   T47] holtek 0003:1241:5015.0005: parse failed
[  199.906852][   T47] holtek 0003:1241:5015.0005: probe with driver holtek failed with error -22
[  200.287458][   T47] usb 5-1: USB disconnect, device number 7
[  201.047176][ T9789] netlink: 'syz.0.1439': attribute type 1 has an invalid length.
[  201.139526][ T9791] loop3: detected capacity change from 0 to 4096
[  201.148500][ T9791] ntfs3(loop3): Different NTFS sector size (1024) and media sector size (512).
[  201.205030][ T9791] ntfs3(loop3): ino=5, mi_enum_attr
[  201.211001][ T9791] ntfs3(loop3): Mark volume as dirty due to NTFS errors
[  201.404921][ T9811] loop3: detected capacity change from 0 to 1024
[  201.428454][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.431808][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.434428][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.440072][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.442553][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.445185][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.447664][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.450214][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.452649][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.484194][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.491124][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.493526][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.526667][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.529100][ T9811] hfsplus: request for non-existent node 16777216 in B*Tree
[  201.551884][ T9821] vlan3: entered promiscuous mode
[  201.555712][   T33] audit: type=1800 audit(201.407:32): pid=9811 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1449" name="file1" dev="loop3" ino=20 res=0 errno=0
[  202.285880][ T9845] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  202.787449][ T9870] loop3: detected capacity change from 0 to 4096
[  202.805260][ T9872] sctp: [Deprecated]: syz.4.1475 (pid 9872) Use of struct sctp_assoc_value in delayed_ack socket option.
[  202.805260][ T9872] Use struct sctp_sack_info instead
[  202.824155][ T9870] ntfs3(loop3): ino=1a, mi_enum_attr
[  202.827560][ T9870] ntfs3(loop3): Mark volume as dirty due to NTFS errors
[  203.023675][ T9884] loop3: detected capacity change from 0 to 128
[  203.029911][ T9884] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256
[  203.039247][ T9884] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  203.160213][ T9888] bridge0: port 2(bridge_slave_1) entered forwarding state
[  203.935404][ T9895] loop4: detected capacity change from 0 to 4096
[  203.975351][ T9898] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  204.081040][ T9900] loop4: detected capacity change from 0 to 512
[  204.084491][ T9900] EXT4-fs: Ignoring removed nomblk_io_submit option
[  204.090429][ T9900] EXT4-fs: Ignoring removed i_version option
[  204.121227][ T9900] EXT4-fs (loop4): 1 orphan inode deleted
[  204.126989][ T9900] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  204.166780][ T8035] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  204.195097][ T5887] usb 1-1: new high-speed USB device number 14 using dummy_hcd
[  204.230990][ T9907] loop3: detected capacity change from 0 to 128
[  204.239716][ T9907] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[  204.265326][ T9907] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1)
[  204.866019][ T5887] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[  204.877019][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  204.881833][ T5887] usb 1-1: Product: syz
[  204.883815][ T5887] usb 1-1: Manufacturer: syz
[  204.887938][ T5887] usb 1-1: SerialNumber: syz
[  204.956670][ T5887] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[  205.007346][ T5887] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[  205.140157][ T4254] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1)
[  205.288365][ T2203] usb 1-1: USB disconnect, device number 14
[  205.303649][ T9919] loop4: detected capacity change from 0 to 256
[  205.318863][ T9919] exFAT-fs (loop4): failed to load upcase table (idx : 0x00011d5f, chksum : 0x09863542, utbl_chksum : 0x000cd30d)
[  205.457244][ T9926] netlink: 'syz.4.1495': attribute type 1 has an invalid length.
[  206.037144][ T5887] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive
[  206.042025][ T5887] ath9k_htc: Failed to initialize the device
[  206.050946][ T2203] usb 1-1: ath9k_htc: USB layer deinitialized
[  207.626104][ T5887] usb 4-1: new high-speed USB device number 14 using dummy_hcd
[  207.775056][ T5887] usb 4-1: Using ep0 maxpacket: 32
[  207.797689][ T5887] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  207.814724][ T5887] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  207.829549][ T5887] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  207.847186][ T5887] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  207.897854][ T5887] usb 4-1: config 0 descriptor??
[  207.916151][ T5887] hub 4-1:0.0: USB hub found
[  208.132031][ T5887] hub 4-1:0.0: config failed, hub doesn't have any ports! (err -19)
[  208.369970][ T5887] usbhid 4-1:0.0: can't add hid device: -71
[  208.393210][ T5887] usbhid 4-1:0.0: probe with driver usbhid failed with error -71
[  208.447835][ T5887] usb 4-1: USB disconnect, device number 14
[  208.957076][ T5887] usb 1-1: new full-speed USB device number 15 using dummy_hcd
[  209.067826][ T9993] loop4: detected capacity change from 0 to 40427
[  209.071311][ T9993] F2FS-fs (loop4): Image doesn't support compression
[  209.073779][ T9993] F2FS-fs (loop4): build fault injection rate: 14
[  209.077144][ T9993] F2FS-fs (loop4): build fault injection type: 0x1
[  209.081295][ T9993] F2FS-fs (loop4): invalid crc value
[  209.084488][ T9993] F2FS-fs (loop4): inject kmalloc in f2fs_kmalloc of f2fs_build_segment_manager+0x30ed/0x49f0
[  209.088242][ T9993] F2FS-fs (loop4): Failed to initialize F2FS segment manager (-12)
[  209.106670][ T5887] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 65535, setting to 64
[  209.119854][ T5887] usb 1-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice=7e.66
[  209.123675][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  209.133571][ T5887] usb 1-1: Product: syz
[  209.136739][ T5887] usb 1-1: Manufacturer: syz
[  209.138492][ T5887] usb 1-1: SerialNumber: syz
[  209.161235][ T9995] loop3: detected capacity change from 0 to 32768
[  209.164391][ T5887] usb 1-1: config 0 descriptor??
[  209.178273][ T9989] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  209.188488][ T5887] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -71
[  209.212322][ T9995] XFS (loop3): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  209.240339][ T9995] XFS (loop3): Ending clean mount
[  209.254367][ T9995] XFS (loop3): Quotacheck needed: Please wait.
[  209.300707][ T9995] XFS (loop3): Quotacheck: Done.
[  209.351950][ T6906] XFS (loop3): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  209.360544][T10006] loop4: detected capacity change from 0 to 256
[  209.400465][    T9] usb 1-1: USB disconnect, device number 15
[  209.409504][T10006] FAT-fs (loop4): Directory bread(block 64) failed
[  209.412281][T10006] FAT-fs (loop4): Directory bread(block 65) failed
[  209.440777][T10006] FAT-fs (loop4): Directory bread(block 66) failed
[  209.450014][T10006] FAT-fs (loop4): Directory bread(block 67) failed
[  209.452799][T10006] FAT-fs (loop4): Directory bread(block 68) failed
[  209.466327][T10006] FAT-fs (loop4): Directory bread(block 69) failed
[  209.469194][T10006] FAT-fs (loop4): Directory bread(block 70) failed
[  209.471919][T10006] FAT-fs (loop4): Directory bread(block 71) failed
[  209.474695][T10006] FAT-fs (loop4): Directory bread(block 72) failed
[  209.486795][T10006] FAT-fs (loop4): Directory bread(block 73) failed
[  209.517680][T10006] FAT-fs (loop4): error, fat_free_clusters: deleting FAT entry beyond EOF
[  209.544665][T10008] loop3: detected capacity change from 0 to 2048
[  209.559212][T10008] hpfs: filesystem error: dir band size mismatch: dir_band_start==7b318cc2, dir_band_end==7b318cc3, n_dir_band==00000000; already mounted read-only
[  209.702750][T10016] netlink: 'syz.3.1532': attribute type 29 has an invalid length.
[  209.724337][T10016] netlink: 'syz.3.1532': attribute type 29 has an invalid length.
[  209.733790][T10016] netlink: 'syz.3.1532': attribute type 29 has an invalid length.
[  209.741314][T10016] netlink: 'syz.3.1532': attribute type 29 has an invalid length.
[  209.994343][T10025] syz_tun: entered allmulticast mode
[  210.000642][T10024] syz_tun: left allmulticast mode
[  210.535956][    T9] usb 1-1: new high-speed USB device number 16 using dummy_hcd
[  210.719716][    T9] usb 1-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f
[  210.723846][    T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  210.733978][    T9] usb 1-1: Product: syz
[  210.742001][    T9] usb 1-1: Manufacturer: syz
[  210.748262][    T9] usb 1-1: SerialNumber: syz
[  210.757852][    T9] usb 1-1: config 0 descriptor??
[  210.803876][T10042] loop3: detected capacity change from 0 to 256
[  210.958975][T10046] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1547'.
[  210.964185][    T9] usb 1-1: USB disconnect, device number 16
[  211.087022][T10052] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input11
[  211.656725][T10064] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1554'.
[  212.575863][T10081] loop3: detected capacity change from 0 to 4096
[  212.607594][T10081] ntfs3(loop3): $Secure::$SDH is corrupted.
[  212.613671][T10081] ntfs3(loop3): Failed to initialize $Secure (-22).
[  212.678856][T10077] loop0: detected capacity change from 0 to 32768
[  212.693014][T10077] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.1560 (10077)
[  212.738248][T10077] BTRFS info (device loop0): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  212.753365][T10077] BTRFS info (device loop0): using sha256 (sha256-lib) checksum algorithm
[  212.869510][T10077] BTRFS info (device loop0): rebuilding free space tree
[  212.891466][T10077] BTRFS info (device loop0): disabling free space tree
[  212.908352][T10077] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  212.911615][T10077] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  212.969225][T10113] loop3: detected capacity change from 0 to 512
[  212.999338][T10113] EXT4-fs: Ignoring removed oldalloc option
[  213.020765][ T5851] BTRFS info (device loop0): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  213.041101][T10113] EXT4-fs error (device loop3): ext4_orphan_get:1392: comm syz.3.1569: inode #13: comm syz.3.1569: iget: illegal inode #
[  213.057717][T10113] EXT4-fs error (device loop3): ext4_orphan_get:1397: comm syz.3.1569: couldn't read orphan inode 13 (err -117)
[  213.125233][T10113] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  213.162016][T10113] EXT4-fs error (device loop3): ext4_resize_begin:60: comm syz.3.1569: resize_inode disabled but reserved GDT blocks non-zero
[  213.272246][ T6906] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  213.470111][T10130] loop0: detected capacity change from 0 to 4096
[  213.483122][T10130] ntfs3(loop0): Different NTFS sector size (1024) and media sector size (512).
[  213.695781][T10145] loop0: detected capacity change from 0 to 8
[  213.837510][T10148] SQUASHFS error: lzo decompression failed, data probably corrupt
[  213.847519][T10148] SQUASHFS error: Failed to read block 0x71: -5
[  213.856608][T10148] SQUASHFS error: lzo decompression failed, data probably corrupt
[  213.859763][T10148] SQUASHFS error: Failed to read block 0x71: -5
[  213.862367][   T33] audit: type=1800 audit(213.717:33): pid=10148 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1582" name="file0" dev="loop0" ino=3 res=0 errno=0
[  214.930366][T10168] can0: slcan on ttyS3.
[  214.996911][T10167] can0 (unregistered): slcan off ttyS3.
[  215.169511][T10175] loop4: detected capacity change from 0 to 1024
[  215.179091][T10175] EXT4-fs: mb_optimize_scan should be set to 0 or 1.
[  215.265671][ T5915] usb 4-1: new high-speed USB device number 15 using dummy_hcd
[  215.435145][ T5915] usb 4-1: Using ep0 maxpacket: 32
[  215.447488][ T5915] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 1024, setting to 64
[  215.468343][ T5915] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16
[  215.472199][ T5915] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  215.481845][ T5915] usb 4-1: Product: syz
[  215.483712][ T5915] usb 4-1: Manufacturer: syz
[  215.486892][ T5915] usb 4-1: SerialNumber: syz
[  215.491113][ T5915] usb 4-1: config 0 descriptor??
[  215.503155][ T5915] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work!
[  215.665122][    T9] usb 5-1: new full-speed USB device number 8 using dummy_hcd
[  215.711674][ T5880] usb 4-1: Failed to submit usb control message: -71
[  215.717194][ T5880] usb 4-1: unable to send the bmi data to the device: -71
[  215.720184][ T5880] usb 4-1: unable to get target info from device
[  215.720311][ T2203] usb 4-1: USB disconnect, device number 15
[  215.722881][ T5880] usb 4-1: could not get target info (-71)
[  215.722922][ T5880] usb 4-1: could not probe fw (-71)
[  216.168047][    T9] usb 5-1: config 7 has an invalid interface number: 34 but max is 0
[  216.171384][    T9] usb 5-1: config 7 has no interface number 0
[  216.176539][    T9] usb 5-1: New USB device found, idVendor=0fe9, idProduct=db51, bcdDevice=5e.35
[  216.180349][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  216.183632][    T9] usb 5-1: Product: syz
[  216.185594][    T9] usb 5-1: Manufacturer: syz
[  216.187533][    T9] usb 5-1: SerialNumber: syz
[  216.266867][T10204] loop3: detected capacity change from 0 to 16
[  216.271834][T10204] MTD: Attempt to mount non-MTD device "/dev/loop3"
[  216.309435][T10204] cramfs: Error -3 while decompressing!
[  216.311995][T10204] cramfs: ffffffff99be35d8(42)->ffff8880281b0000(4096)
[  216.477051][T10056] ==================================================================
[  216.480340][T10056] BUG: KASAN: slab-use-after-free in __mutex_lock+0x7fc/0x1360
[  216.483428][T10056] Read of size 8 at addr ffff888035b000a0 by task khidpd_15c25886/10056
[  216.487803][T10056] 
[  216.488779][T10056] CPU: 0 UID: 0 PID: 10056 Comm: khidpd_15c25886 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  216.488795][T10056] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  216.488802][T10056] Call Trace:
[  216.488808][T10056]  <TASK>
[  216.488814][T10056]  dump_stack_lvl+0x189/0x250
[  216.488829][T10056]  ? __kasan_check_byte+0x12/0x40
[  216.488845][T10056]  ? __pfx_dump_stack_lvl+0x10/0x10
[  216.488856][T10056]  ? lock_release+0x4b/0x3e0
[  216.488871][T10056]  ? __virt_addr_valid+0x4a5/0x5c0
[  216.488884][T10056]  print_report+0xca/0x240
[  216.488893][T10056]  ? __mutex_lock+0x7fc/0x1360
[  216.488904][T10056]  kasan_report+0x118/0x150
[  216.488917][T10056]  ? __mutex_lock+0x7fc/0x1360
[  216.488930][T10056]  __mutex_lock+0x7fc/0x1360
[  216.488943][T10056]  ? __mutex_lock+0x5b6/0x1360
[  216.488955][T10056]  ? l2cap_unregister_user+0x6a/0x1b0
[  216.488966][T10056]  ? __pfx___mutex_lock+0x10/0x10
[  216.488979][T10056]  ? __pfx___timer_delete_sync+0x10/0x10
[  216.488994][T10056]  l2cap_unregister_user+0x6a/0x1b0
[  216.489005][T10056]  hidp_session_thread+0x3c9/0x410
[  216.489016][T10056]  ? __pfx_hidp_session_thread+0x10/0x10
[  216.489025][T10056]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  216.489036][T10056]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  216.489047][T10056]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  216.489057][T10056]  ? __kthread_parkme+0x7b/0x200
[  216.489067][T10056]  ? __kthread_parkme+0x1a1/0x200
[  216.489079][T10056]  kthread+0x711/0x8a0
[  216.489090][T10056]  ? __pfx_hidp_session_thread+0x10/0x10
[  216.489099][T10056]  ? __pfx_kthread+0x10/0x10
[  216.489111][T10056]  ? _raw_spin_unlock_irq+0x23/0x50
[  216.489121][T10056]  ? lockdep_hardirqs_on+0x9c/0x150
[  216.489134][T10056]  ? __pfx_kthread+0x10/0x10
[  216.489145][T10056]  ret_from_fork+0x3fc/0x770
[  216.489156][T10056]  ? __pfx_ret_from_fork+0x10/0x10
[  216.489167][T10056]  ? __switch_to_asm+0x39/0x70
[  216.489179][T10056]  ? __switch_to_asm+0x33/0x70
[  216.489191][T10056]  ? __pfx_kthread+0x10/0x10
[  216.489202][T10056]  ret_from_fork_asm+0x1a/0x30
[  216.489219][T10056]  </TASK>
[  216.489223][T10056] 
[  216.567526][T10056] Allocated by task 6906:
[  216.569277][T10056]  kasan_save_track+0x3e/0x80
[  216.571260][T10056]  __kasan_kmalloc+0x93/0xb0
[  216.573131][T10056]  __kmalloc_noprof+0x27a/0x4f0
[  216.575064][T10056]  hci_alloc_dev_priv+0x28/0x2060
[  216.577100][T10056]  vhci_create_device+0x120/0x6e0
[  216.579153][T10056]  vhci_write+0x3ce/0x4a0
[  216.580973][T10056]  vfs_write+0x54b/0xa90
[  216.582725][T10056]  ksys_write+0x145/0x250
[  216.584476][T10056]  do_syscall_64+0xfa/0x3b0
[  216.586295][T10056]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  216.588663][T10056] 
[  216.589675][T10056] Freed by task 8175:
[  216.591330][T10056]  kasan_save_track+0x3e/0x80
[  216.593291][T10056]  kasan_save_free_info+0x46/0x50
[  216.595341][T10056]  __kasan_slab_free+0x5b/0x80
[  216.597292][T10056]  kfree+0x18e/0x440
[  216.598867][T10056]  bt_host_release+0x82/0x90
[  216.600741][T10056]  device_release+0x9c/0x1c0
[  216.602584][T10056]  kobject_put+0x22b/0x480
[  216.604385][T10056]  vhci_release+0x88/0xd0
[  216.606132][T10056]  __fput+0x44c/0xa70
[  216.607780][T10056]  task_work_run+0x1d4/0x260
[  216.609775][T10056]  do_exit+0x6b5/0x2300
[  216.611610][T10056]  do_group_exit+0x21c/0x2d0
[  216.613573][T10056]  get_signal+0x1286/0x1340
[  216.615451][T10056]  arch_do_signal_or_restart+0x9a/0x750
[  216.617662][T10056]  exit_to_user_mode_loop+0x75/0x110
[  216.619827][T10056]  do_syscall_64+0x2bd/0x3b0
[  216.621782][T10056]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  216.624171][T10056] 
[  216.625180][T10056] Last potentially related work creation:
[  216.627516][T10056]  kasan_save_stack+0x3e/0x60
[  216.629479][T10056]  kasan_record_aux_stack+0xbd/0xd0
[  216.631637][T10056]  insert_work+0x3d/0x330
[  216.633444][T10056]  __queue_work+0xcd2/0xfb0
[  216.635279][T10056]  queue_work_on+0x181/0x270
[  216.637154][T10056]  hci_recv_frame+0x5c9/0x720
[  216.639087][T10056]  vhci_write+0x358/0x4a0
[  216.640944][T10056]  vfs_write+0x54b/0xa90
[  216.642739][T10056]  ksys_write+0x145/0x250
[  216.644537][T10056]  do_syscall_64+0xfa/0x3b0
[  216.646365][T10056]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  216.648834][T10056] 
[  216.649821][T10056] Second to last potentially related work creation:
[  216.652491][T10056]  kasan_save_stack+0x3e/0x60
[  216.654365][T10056]  kasan_record_aux_stack+0xbd/0xd0
[  216.656457][T10056]  insert_work+0x3d/0x330
[  216.658212][T10056]  __queue_work+0xcd2/0xfb0
[  216.660118][T10056]  queue_work_on+0x181/0x270
[  216.661985][T10056]  hci_recv_frame+0x5c9/0x720
[  216.663853][T10056]  vhci_write+0x358/0x4a0
[  216.665607][T10056]  vfs_write+0x54b/0xa90
[  216.667291][T10056]  ksys_write+0x145/0x250
[  216.669023][T10056]  do_syscall_64+0xfa/0x3b0
[  216.670856][T10056]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  216.673225][T10056] 
[  216.674206][T10056] The buggy address belongs to the object at ffff888035b00000
[  216.674206][T10056]  which belongs to the cache kmalloc-8k of size 8192
[  216.679872][T10056] The buggy address is located 160 bytes inside of
[  216.679872][T10056]  freed 8192-byte region [ffff888035b00000, ffff888035b02000)
[  216.685295][T10056] 
[  216.686305][T10056] The buggy address belongs to the physical page:
[  216.688841][T10056] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x35b00
[  216.692289][T10056] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  216.695721][T10056] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  216.698783][T10056] page_type: f5(slab)
[  216.700503][T10056] raw: 00fff00000000040 ffff88801a442280 ffffea00009a1400 dead000000000003
[  216.703948][T10056] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  216.707333][T10056] head: 00fff00000000040 ffff88801a442280 ffffea00009a1400 dead000000000003
[  216.710784][T10056] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  216.714202][T10056] head: 00fff00000000003 ffffea0000d6c001 00000000ffffffff 00000000ffffffff
[  216.717652][T10056] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  216.721108][T10056] page dumped because: kasan: bad access detected
[  216.723720][T10056] page_owner tracks the page as allocated
[  216.725946][T10056] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5990, tgid 5990 (udevd), ts 70053994851, free_ts 70053195555
[  216.733757][T10056]  post_alloc_hook+0x240/0x2a0
[  216.735700][T10056]  get_page_from_freelist+0x21e4/0x22c0
[  216.737974][T10056]  __alloc_frozen_pages_noprof+0x181/0x370
[  216.740381][T10056]  alloc_pages_mpol+0x232/0x4a0
[  216.742521][T10056]  allocate_slab+0x8a/0x370
[  216.744431][T10056]  ___slab_alloc+0xbeb/0x1410
[  216.746314][T10056]  __kmalloc_cache_noprof+0x296/0x3d0
[  216.748509][T10056]  tomoyo_init_log+0x111f/0x1f70
[  216.750577][T10056]  tomoyo_supervisor+0x340/0x1480
[  216.752618][T10056]  tomoyo_env_perm+0x149/0x1e0
[  216.754546][T10056]  tomoyo_find_next_domain+0x15cf/0x1aa0
[  216.756937][T10056]  tomoyo_bprm_check_security+0x11c/0x180
[  216.759336][T10056]  security_bprm_check+0x89/0x270
[  216.761544][T10056]  bprm_execve+0x8ee/0x1450
[  216.763433][T10056]  do_execveat_common+0x510/0x6a0
[  216.765553][T10056]  __x64_sys_execve+0x94/0xb0
[  216.767579][T10056] page last free pid 5990 tgid 5990 stack trace:
[  216.770174][T10056]  __free_frozen_pages+0xbc4/0xd30
[  216.772323][T10056]  __put_partials+0x156/0x1a0
[  216.774300][T10056]  put_cpu_partial+0x17c/0x250
[  216.776268][T10056]  __slab_free+0x2d5/0x3c0
[  216.778115][T10056]  qlist_free_all+0x97/0x140
[  216.780045][T10056]  kasan_quarantine_reduce+0x148/0x160
[  216.782273][T10056]  __kasan_slab_alloc+0x22/0x80
[  216.784197][T10056]  __kmalloc_cache_noprof+0x1be/0x3d0
[  216.786429][T10056]  tomoyo_init_log+0x111f/0x1f70
[  216.788493][T10056]  tomoyo_supervisor+0x340/0x1480
[  216.790575][T10056]  tomoyo_env_perm+0x149/0x1e0
[  216.792583][T10056]  tomoyo_find_next_domain+0x15cf/0x1aa0
[  216.794911][T10056]  tomoyo_bprm_check_security+0x11c/0x180
[  216.797117][T10056]  security_bprm_check+0x89/0x270
[  216.799110][T10056]  bprm_execve+0x8ee/0x1450
[  216.801002][T10056]  do_execveat_common+0x510/0x6a0
[  216.803120][T10056] 
[  216.804166][T10056] Memory state around the buggy address:
[  216.806521][T10056]  ffff888035afff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  216.809885][T10056]  ffff888035b00000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  216.813244][T10056] >ffff888035b00080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  216.815838][T10056]                                ^
[  216.817547][T10056]  ffff888035b00100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  216.820176][T10056]  ffff888035b00180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  216.822814][T10056] ==================================================================
[  216.827037][T10056] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  216.829942][T10056] CPU: 0 UID: 0 PID: 10056 Comm: khidpd_15c25886 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  216.834919][T10056] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  216.838490][T10056] Call Trace:
[  216.839823][T10056]  <TASK>
[  216.840920][T10056]  dump_stack_lvl+0x99/0x250
[  216.842584][T10056]  ? __asan_memcpy+0x40/0x70
[  216.844468][T10056]  ? __pfx_dump_stack_lvl+0x10/0x10
[  216.846618][T10056]  ? __pfx__printk+0x10/0x10
[  216.848263][T10056]  vpanic+0x281/0x750
[  216.849680][T10056]  ? __pfx_vpanic+0x10/0x10
[  216.851202][T10056]  ? irqentry_exit+0x74/0x90
[  216.852715][T10056]  panic+0xb9/0xc0
[  216.854014][T10056]  ? __pfx_panic+0x10/0x10
[  216.855641][T10056]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  216.857753][T10056]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  216.859888][T10056]  ? __mutex_lock+0x7fc/0x1360
[  216.861589][T10056]  check_panic_on_warn+0x89/0xb0
[  216.863376][T10056]  ? __mutex_lock+0x7fc/0x1360
[  216.865039][T10056]  end_report+0x78/0x160
[  216.866680][T10056]  kasan_report+0x129/0x150
[  216.868582][T10056]  ? __mutex_lock+0x7fc/0x1360
[  216.870612][T10056]  __mutex_lock+0x7fc/0x1360
[  216.872581][T10056]  ? __mutex_lock+0x5b6/0x1360
[  216.874424][T10056]  ? l2cap_unregister_user+0x6a/0x1b0
[  216.876429][T10056]  ? __pfx___mutex_lock+0x10/0x10
[  216.878131][T10056]  ? __pfx___timer_delete_sync+0x10/0x10
[  216.879986][T10056]  l2cap_unregister_user+0x6a/0x1b0
[  216.881682][T10056]  hidp_session_thread+0x3c9/0x410
[  216.883325][T10056]  ? __pfx_hidp_session_thread+0x10/0x10
[  216.885576][T10056]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  216.887696][T10056]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  216.890016][T10056]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  216.892651][T10056]  ? __kthread_parkme+0x7b/0x200
[  216.894722][T10056]  ? __kthread_parkme+0x1a1/0x200
[  216.896839][T10056]  kthread+0x711/0x8a0
[  216.898596][T10056]  ? __pfx_hidp_session_thread+0x10/0x10
[  216.900947][T10056]  ? __pfx_kthread+0x10/0x10
[  216.902926][T10056]  ? _raw_spin_unlock_irq+0x23/0x50
[  216.904964][T10056]  ? lockdep_hardirqs_on+0x9c/0x150
[  216.906969][T10056]  ? __pfx_kthread+0x10/0x10
[  216.908657][T10056]  ret_from_fork+0x3fc/0x770
[  216.910532][T10056]  ? __pfx_ret_from_fork+0x10/0x10
[  216.912186][T10056]  ? __switch_to_asm+0x39/0x70
[  216.913832][T10056]  ? __switch_to_asm+0x33/0x70
[  216.915784][T10056]  ? __pfx_kthread+0x10/0x10
[  216.917294][T10056]  ret_from_fork_asm+0x1a/0x30
[  216.918923][T10056]  </TASK>
[  216.921025][T10056] Kernel Offset: disabled
[  216.922452][T10056] Rebooting in 86400 seconds..

VM DIAGNOSIS:
01:48:57  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000061 RBX=0000000000000061 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90004b6f370
R8 =ffff8881076f0237 R9 =1ffff11020ede046 R10=dffffc0000000000 R11=ffffffff854e72a0
R12=dffffc0000000000 R13=ffffffff99af1904 R14=ffffffff99de64e0 R15=0000000000000000
RIP=ffffffff854e731c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8624000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b32f20ff8 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffff8167983b ffffffff8167983b
XMM02=00007f7892787498 ffffffff8167983b XMM03=00007f78927874a8 00007f78927874a0
XMM04=00007f78932ed100 00007f7892787460 XMM05=00007f7892787478 00007f78927874c0
XMM06=00007f78927874b8 00007f78927874b0 XMM07=00007f78927874a8 00007f78927874a0
XMM08=0000000000000000 00007f7892612ee7 XMM09=0000000000000000 00007f7892612fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000056201 RBX=0000000000000f86 RCX=0000000000056201 RDX=ffffffff93a38358
RSI=ffffffff93a38358 RDI=ffffffff9354a3d0 RBP=ffffffff93a787b0 RSP=ffffc9000601f578
R8 =0000000000000000 R9 =ffffffff81aa82d8 R10=dffffc0000000000 R11=fffffbfff1f46847
R12=0000000000011ea7 R13=fffffffffffffff8 R14=ffffffff92b347d2 R15=0000000000056261
RIP=ffffffff819dd465 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f3e7f1106c0 ffffffff 00c00000
GS =0000 ffff8881a3c24000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055556429c5c8 CR3=0000000026db8000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00ff000000000000 ff00000000000000 XMM05=0000000000000021 000000002f316963
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffffff00 ffffffff00000000 XMM09=706e692f3030323a 316963682f316963
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
