last executing test programs:

4.17266857s ago: executing program 1 (id=3925):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
mkdirat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x1ff)
mkdirat$cgroup(r0, &(0x7f0000000040)='syz1\x00', 0x1ff)
r1 = openat$cgroup(r0, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48)
r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYBLOB], 0x0, 0x8000000}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000800)={r3, 0xe0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x8, &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xed, &(0x7f0000000580)=[{}], 0x8, 0x10, &(0x7f00000005c0), &(0x7f0000000600), 0x8, 0xd2, 0x8, 0x8, &(0x7f00000006c0)}}, 0x10)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={r2, 0x58, &(0x7f0000000340)}, 0x10)
openat$cgroup_ro(r1, &(0x7f0000000200)='blkio.bfq.time\x00', 0x0, 0x0)
r4 = openat$cgroup_type(r1, &(0x7f0000000180), 0x2, 0x0)
write$cgroup_type(r4, &(0x7f0000000280), 0x9)

4.093633257s ago: executing program 1 (id=3926):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = syz_open_dev$cec(&(0x7f0000000340), 0x0, 0x0)
ioctl$CEC_DQEVENT(r3, 0xc0506107, 0x0)
ioctl$CEC_DQEVENT(r3, 0xc0506107, 0x0)
ioctl$IOC_PR_PREEMPT(r3, 0x40046109, &(0x7f0000000040)={0xd0})

2.958851978s ago: executing program 1 (id=3930):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040)=0xc, 0x4)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)

2.004944296s ago: executing program 1 (id=3941):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0xb, 0x801, 0x0, 0x0, {0xa}, [@NFTA_COMPAT_NAME={0x5, 0x1, '\x00'}, @NFTA_COMPAT_REV={0x5192b310db075dd6, 0x2, 0x1, 0x0, 0x2}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x2c}}, 0x0)

2.004593323s ago: executing program 1 (id=3942):
syz_mount_image$btrfs(&(0x7f0000000380), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f00000000c0)={[{@compress_algo={'compress', 0x3d, 'zstd'}}, {@compress_algo={'compress', 0x3d, 'no'}}]}, 0x1, 0x559a, &(0x7f0000005600)="$eJzs3X2QVWUdB/Bzd1lYZGI3BMGBFShfQEIhpVRS7kBBuDJtkjU2GQtioaAwzBI1ii04WLgam1kz5QxCiwjDUmszGmXlygyQk9PWjIPIgjLThjG9SMXEFjU2e+99Lveey+5eyVxfPh9m99zn/s7znOeeOX/c72WfcyMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIoujgjtr/rB1ZV75+06hFt199cPSq0RNWVDWdHHWg+rzdl/absWjovuntdw6b0bH6SPX65tsu6IyiRKpfItN/3vSPX/+FufPmlIcBaz+Z3lZWdnfIdNfD6Ub/vCe7+uX/zI+iqCw2QGlmu7s0p52IHyBaXjhgj8pmbVsycEGyduvmp+ouX7J1XOFLp0t5X0+gr2Suq45T11Iy9bsktke2nXPpJfIu0XT/+AX3prwIAOB1mVST2mTfjmbe4mbb9fF6rJ2MtRtj7fAOoTG3cSbS4/bvbp5j4vU+mmcyHRUGdDvPWD1z/rPtmnj/WDsWNV7HPPN3zUSa8u7muSxW76t5AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALyVvFa3Ys34z714sOyX549bvfLk4WvLL3zoq/8uWXrzS68dqlnzl7ah+6a33zlsRsfqI9Xrm2+7oDOKKlP9EunuiWknXr1kYvWcUeuf+N7ETc+OP16aGTds++XsHO0PD66siKIFOZWOMOzRwVFUk19INaPvFhZuTT2YHQoAAAC8k5yb+l2SbafjYFleO5FKk4nUvyAdFstmbVsycEGyduvmp+ouX7J13JmPV9PNeMnTjpdtV576SeQE4xB/4+OdqoddlxeM07P4iPE8P+X5l1+oGHHtT5+pOu+mlde/NPKax9tmfnP48UX7K+8YtGrc2CsK8n9lz/k/nDn5HwAAgP+F/B8fp2e95f/PzK+75Y5HvnJszD2HVw66+8H9G4eVH7nplsn7/jj8hosvvqz2xoL8PybvkAX5P8w45P+S6MzyPwAAALyV/b/zf7JgnJ71lv/bhzff/MB7Di2sbOt4evtlK/b0X3j1RUMOPHTR3In3XjdozPkNBfl/UnH5v1/utMOTz4UJL66IoknFn1QAAAAgT/h/91MfLYS8nv7kIJ7XW+dtGd3y6swvTxj78KH6P1Vtnvj5jUMe37lh5jd2PXf3/RPbzi7I/8ni8n/Zm/NyAQAAgCI0HTpnxNBPJ38e3X/01vnf/+yuR+9b+sWrLtnbOWvC2l9UP72jviD/1xSX/wf0zcsBAAAATuPE+GsW/mPnkd9e1/yJ+5qO/v5Lq0p/NaNp9/62hqZ/bh81e/XkgvxfW1z+Pyuzzax8SHfaE/4K4VsVUVTe9WBZurA3apyWLQAAAABvkJDT75ryfMm9A6edu2Xub06Me+KFPZ/aN3vxhnPWTGp69n2tiz9y4WMF+X9Zz/f/D3c6COv/8+7/V7D+P6eQvuvfVDcGAAAA4N2ocD1/uD1++psLuvv+/WLX///w6xv+mqiqf/ID8342q/P9zT/Z2zr1wZNVf5hz/OGW5MgnL32xIP/XF5f/S3O3b+T3/wEAAMAZeLt9/9+NBeP0rLf7/7c980j1o1d+6GtXza2buuN3H77iz68Mn9qwPXpl+UfbFx342K5fF+T/xuLyf9gOyn15reH83FMRRSO6HmTuJrgtTHdxrNBSllNIn/hYj7mhR6bQMiCnkLIs1uODFVE0tutBfazw3lBojBWODc4UNsYKbaGQuR6yhR/ECq3hSvvO4Mx044Ufh0JmgUVLWEExKLskItbj79316Cqctkd79uAAAADvKiE8Z7JsWX4zikfZlkRvO5zV2w4lve1Q2tsO/WI7xHfs7vmoNr8Qnv/Rt294ecBdD2yom7Jl04KqhrPX/euxyZNuX7Z2Z93SziF/W7euIP9vLC7/h1PRP73pbv1/FNb/Z77XMLv+vzYUKmOFllCoid8xoCYcIx12G8IxKmsyPY6NyBYAAADgHS18LlDax/MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/7J373FW1nXiwL8zzIUZhplRMS+RISaKwTCMKYaZID/TnwQOq6WFJgSDjgxCXEzQTUTd1VzB2+ZtE0jdtIwoNbVUeGnekspLsKl5SfHSK41lS5Js133NnPM9nPOcOc5BQBn3/f5jzvecz/f6nMuc7/M85/sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/N2z85GVfeHmfj/xg3cKBi1eP+krfI4cMn3DMNTceu/jhb0/e777f//8+aw575sydR60955XRi245de+3QmjuKFeSKl5y6F/XNQwePabvotuvGbz0kYF/qUjXm46HXu1/StN3zoutru0dwh0lIZQlA4NrUoHy9P2aWF/fmhB2CJsCmRIt1akSyYbDA1UhLAmbApmq7qoKoSYrcOwT9624uD1xRVUIe4cQKpNtPFuZaqMqGRhQkQpUJwPTy1KBv76TkgncWZoKwBaLb4bMi355c26G+s7LFXj9lW+1jn2wksPrERP1hfO9MXIbdypLRfKB5i162vKqY5vIe3us9G7rBu+2vO18iact+4tU+hvKO5tClaF0csuUiXPaZsdHSkNDQ49CNW2j5/np9WdN2px0t3kdxg7Ub5XX4aoLe49d/OhRw2+tG35Dn0ELN25pNwtt3m2tMqRfc93meYxG+DzpBm+/vG9J/XzpCiHsf9v42798wcs3L7h87K4HPbHTsDc+u/vdLT+75YTxxx++fsVXf//jvPl//bvP/+PLOd6W5uSOrb5dm5qbx0dqYmJdbWpuDgAAAN1Gd9hr+srq/5722X3HDX185OrqW2+659SL7/v8tT9r3a/t4bE77fj8vvN+lDf/71fc8f94yL8me7QrQxjRkTi3LoRdOx5PBW6O3flqXQh7dqSacwMjE4GVIezWkRiYqSpRomcs0S8ReLU2HRiRCDwYA82JwI0xcEkicF4MLE8EJsXAykTgsBgIrbnj2K82PY6iA1UxMCG1EZfHsxD+XBtbS2yrZzJVAQAAbCXp2WF57t2scx22NEOcXi6v6ipDPAO7YIbKRA3JGWxmWlWwhrKuaijtqobMuOe/+/Dzai7pqua80zBKcjNcWXXLpT8aNumNu2e8tOG0Iz7x2quP1S/96afXXfPGU9Mr79/j8ofz5v+N7z7/r+ykIyV5x/9DGNfxN+YuTUfaMvEJzTkZAAAAgC3w1sADvvydsq/NfeH3jwz75K+vfez1lQ9/dO8zb1v7/Bk/+NZ3au4fnTf/H1Hc+f9xn0iPrMxhVdwNMbUuhMbcQKrag/MDqaPevdIBAAAA6A4yx+Mzx8Jb07epU7ST8+n8/M2bmT8e+B/Raf7131p2/Y6feGT2Q7W3zXhqw+NfWTl64bEz3xh05dmP7HvoQU+N/Gze/L+5uPP/q3NvU514MPbi8roQemYFHoq9bA906BcDLxyaG0iP/8G4AS6KVaVPTMhUdVEsMSEGGhOBJYVKPJYpsWtuIP1kZRo/NzOO1nSJrAAAAAC87+LugHhcPp7/v2LBXZf9x41/umzVgUtnnzz98de+V1H5zknL7zyxzwX39li008hJefP/CZt3/n/HPDjv9P62XiEMKQuhR/KHAauqUwsDxkBNSTpxT3Wqrh7JqhZUh3Bw+8CSVb2YXv+/LLnG4JNVqapiYNf+N60f0J64oSqEIdmBNeOXHtCemJMIZBr/YlUIH28fbbLxn/RMNV6ebPyqniHskRXIVDWpZwjtjVUkq7q/Mn0dg2RVyytD2CkrkKlqWGUIcwMA3VX8Xzo5+8FZc+dNndjW1jJzGybiTvyqMKW1raVh0vS2yZUF+jQ50eecdYzOyR9TsZe++V16jaLVx0ytKyad+aFgY3Zb6R35eWcOpu/HL0PlHeNsKs+5u39yyPvuld9EyPoqVWjIpdt4yNXZlWx6EvPqj/krQq/Qc86slpkNZ0ycPXvm0NTfYrM3pf7G40ypbTU0ua2qO+tbES+PgstlJbzXbTUgu5Ihs6fNGDJr7rzBrdMmntxycstpwz7VNKxp6P5NjUPaB5X+28VIB3RWc2Kk7ywtclhbcaS7l2VV8n58aEhISHS3xE2Xj39m0UcXV3538UmXPHH++WefcvrOt1057ft9p48fdOXnlkz9et78f8a7z//jp0784E+vz1Do+H99PMyfenzTYf4JMbCk2OP/9YWO5mdODOiXCMyPgfkO8wMAAPDhEHdHxr2Zcad07SvfOP1/Tjii9NA/HP2LpqGDdrnw1qkDbnx94+kf23vekmvLKvKv/ze/uN//b6X1/zNL1x9VaJn/gbFEY6H1/5PL/GfW/59faP3/5DL/mfX/l3wA6//PyQQSm+TP1v8HAAA+DN6/9f+7XN4/eYGAvAxdLu+fvEBAXoYul/Ev9gIBm73+/89/XrbDx47YrW/ZF56YuNedB/7mpGkP7vKjUVev+3RT/TfPWPPzZXnz/0uKm/9buB8AAAC2Hyfs+6UBC14a8vVzpj/ww8Ezdn7purOfH3HPL4/75MYxfddVr+v76bz5/5Li5v/v//p/odD5//0KBZoLLQxo/T8AAAC6qULr//3t42d987p+O24Y1O/M29+6emrJ8L2fO/XXbRc9NOrwj435xyWTrs2b/y8vbv4fT7sozckde/N2bWpNu5Bc025dbeYnAwAAANA9lIaGhvIi8+YsjDryvbf5dHop0HdLZ9vtE6vWnHvvdX8fcvP5C9Ydf3rtQUf+oeyQOydf99KCU/boX/Pc2rz5/8ri5v85v8tYdWHvsYsfPWr427fWDb+hz6CFGzcd/wcAAAC2nWL3SwAAAAAAAAAAAAAAAB+8Y1b95Kz/+uWY4+4cNu/qR3d+/OT//PqsM1on/aLtiHUHPLv0hk/tk/f7/zCuo1yh3//H6/7F3xf0yckdW+16/b/0/WNHL5vbsWThqtoQ9soOTF0wdYeQvjb/PtmBFScO3KU9sSBZ4u7nDnu5PXFSMnDk4B03tCc+kwhMiIsk7pYMxKsqbuidCMTlFZ9MBuL2WJ4MVKQDF/ZOjaMkua3+UJPaViXJbfV0TQh1WYHMtrqjJtVGSXKAVyQCmQF+LRmIAxybDpQme7WsV6pXMVATiy7uleoVAADbrfgtsDxMaW1raYxf4ePt7mW5t1HOkmXn5FdbUmTzv0svTbb6mKl1xaR7JL+LbrrWeHmobB/C0Lyvq9lZSjpGuXVq6WLT9Skw5K5WeystUC5pczddReERVaVG1DBpetvk8i4Hvn/XWZrKuswyNG+yk52ltGOTFlFLEX0pYkRFbpsiuhzvl4aGhh6JXMNjsD7k6OoVUezv9bPX+Sv0KsjOs3zUQQOOW/bcgRMWPXnQtKnhI5e9M2Li5FmHXPHiU0vnjxw0oUfe/L++uPl/Zfa4NqQvBjA/Xlnv4LoQJhQ5IgAAAPjwO+W05y674P5LX32hecDL04dcuuK3c6+aV1Z783mHP3336W+OX3jSlsYHDHtj6Kl3/ebcjU2jHrqy99X3X7PTkXU//H/Vvea+tWLQmy/cvVfe/L9fcfP/uAcrfSg4tbdjZbz+/7l1IXRcWr8+Fbg5DverdSHs2ZFqjiVSF9Q/KpZoTAVujjtMBsYSE5pzq+oZA8sTgVdr04GVicCDMZDeS3FTSO/KubQ2hAM6UuNyS8yIJeoTgaNjoF8i0BADjYlA7xgYkQi83jsdaE4EHo2B0Jq7rW7tnd5WAAAAmyM9zyrPvRuS87zlZV1lKOkqQ3VXGUq7ylDZVYZCo4j3fxwzlCdOXinJylSerLUqUUtehngx/M3uV16G8FhuzmTBvKbj+QeZ8w1KcjNccWbF9Dc/33/R8UPGrB/ftPhzc38a/uHtOW9d8OYvz6977pqNJXnz/8bi5v/Vubep1h+M8/9N1/9LBR6K3bs8njreLwZeODQ3kN4x8GCc7F6Uqao5XSI9ab8olhgRA/0SgRkxMCIRmDAuHViyS24gPdPONH5upvHWdImsAAAAALzv4g6CuJsmzv+fXTv+iWnjf3vQZX1nLzx/+VFffvrXx736i3t73v3d/osebitZuzpv/j+iuPl/bK9XdmPnxd6s7R3CHSWbepMJDK5JBeJ+jJr48/i+NSHskLWDI1OipTpVoiLRcHigKvUL9YpkVXdVpdYYiPePfeK+FRe3J66oCmHvrL0vmTaerUy1UZUMDKhIBaqTgellqUDc85MJ3FmaCsAWy+wVjC+o9KkuGfWdlyvw+vuwXBM0Oby8faCd5OvsN1fbSmXygfQ+1YzNe9ryqmObyHt7rPRu647vtnrvtuwvUulvKO9sClWG0sktUybOaZsdH8n+JWuebfQ8Z/9KtZj0Vngdzn/vve1aZbIDjYmPj8bOy3X+OiyJ1a26sPfYxY8eNfzWuuE39Bm0cGPR3Sgg/lB45rCr6rM377ZWGdKvuW73edLs86Q7/hvo52kLIYy7d+xFjYfcuHDSiP7X73xH7fDLvzT4lkMbnx1XM2eXw8e89sV5efP/5uLm/2WJ2w4b48acVRfCvlkbd1Xc/KPqUp+DWYHUp+RO+YHUIfeXagt+cgIAAMDWltndkdlf0Jq+TZ0Qnpwn5+dv3sz8cX/FiE7zF9vv/lecsnL0hAN/23f8XoccvM9Zdy04er+/Tbz+tT9Wj5z0wPd+tfr6vPn/hHef//dMdNPxf8f/2UYc/+/U9r4rumfygflbtCs6rzq2Ccf/O7W9v9sc/++U4/+O/3fG8f8uOP7fqe39acv7ljTDl64Qwr9f/vm/vX3Pbv02LC393pQH5vU//rLvL1r2k52f+efH/mn69H33/FXe/H9GcfN/6/91vmhfZv2/CYXW/5tRaP2/+db/AwAAtqkCC80l53l5q/flZUiu3peXocsFArtcYtD6f5u9/t+L/3Lpgr2mjv3GiWc9dnDvR+tHrRkz6O8nvbrnmuuevHLoIyf8/dt58//5xc3/48uhV3br3WX9v37jClR1SQzMsDAgAAAA26NCOwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4YJ31xynnjVjw+J+ap39l/fLx32nd8fGHprzefMQPRy87es0pu5xyb581hz1z5s6j1p7zyuhFt5y691shtHaUK0kVLzn0r+saBo8e03fR7dcMXvrIwL9UpustT99+NCd3bPXt2hCWZD1SExPratvvbAocO3rZ3LL2xKraEPbKDkxdMHWH9sSNtSHskx1YceLAXdoTC5Il7n7usJfbEyclA0cO3nFDe+Iz6UBJsrv/1jvV3ZJkdy/uHUJdViDT3VN751aVaeOIdKA02cZ3a1JtxEBNLHpVTaqNGGiLJVp7hjCkLIQeyaoeqUxV1SNZ1U8rU1X1SFZ1dmUIB4cQypJVPV+RqqosOfLHKlJVxcCu/W9aP6A9sbQihCHZgTXjlx7QnpiZCGQaP6YihI+3v2SSjd9anmq8PNn4v5aHsEcIoSJZ4s2yVImKZIkXy0LYKSuwaSOWhTA38OEQP30mZz84a+68qRPb2lpmbsNERbqtqjClta2lYdL0tsmViT4VUpKVfuec9z72360/a1L77epjptYVky5Llyvv6HJTec7d/bf33sd+VWdXsun5yKs/5q8IvULPObNaZjacMXH27JlDU3+Lzd6U+tsjHU1tq6HdZVsNyK5kyOxpM4bMmjtvcOu0iSe3nNxy2rBPNQ1rGrp/U+OQ9kGl/26NkS59/0e6e1lWJe/H+19CQqK7JUpzPt0at/fP8bwv+ps6Wh4qOz6g86YV2VlKOka5NQY98j2O+L18TelyREPzJg55WZq6zrJ/3mRiU5aqVJaOr3V5k8Psmko7Nmm8XxoaGnoU2g71uXezN+8bW7B5n05vumLTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwv+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwLAAAAAAgzN86jJ4NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAD//+GI8JI=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0)
write(r0, &(0x7f0000000540)="953820a61a166fd5dd4b4b", 0xfdef)
creat(&(0x7f0000000240)='./file1\x00', 0x0)

1.639108158s ago: executing program 1 (id=3947):
mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x6083, 0x3)
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f0000000200)='\x00\x00')
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000008ac050f024000010203010902240001014bc004"], 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8b2b, &(0x7f0000000040)={'wlan1\x00', @random="8dffffff06ff"})
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x30f4, 0x0)
syz_create_resource$binfmt(&(0x7f0000000040)='./file0\x00')
setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x6d93, 0x4)
sendmsg$sock(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000300)=@in6={0xa, 0x4e23, 0x401, @loopback, 0x4}, 0x80, 0x0, 0x0, &(0x7f0000000700)=[@mark={{0x14, 0x1, 0x51, 0xfffffffb}}], 0x18}, 0xff00)

1.124035846s ago: executing program 0 (id=3957):
clock_adjtime(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x40000000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd})

1.046741299s ago: executing program 0 (id=3958):
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x62, 0x11cfa, 0x0, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x7cce8c743ee810df})
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x40505330, &(0x7f00000001c0)={0x800000, 0x80, 0xfdfffffd, 0x5, 0x3ffd, 0x7})
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/clients\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000004ec0)=[{&(0x7f0000004bc0)=""/68, 0x44}], 0x1, 0x8000, 0x0)

1.043766217s ago: executing program 0 (id=3960):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r3, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10)
connect$inet(r3, &(0x7f0000000280)={0x2, 0x4, @multicast1}, 0x10)
sendmmsg$inet(r3, &(0x7f0000004540)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x7e1f, 0x0}, 0xee0000b0}, {{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001100)="15b26f226e2966667482d50903b0a8d92ccd9e69d5cc4cb3d467a670b237a9225fb56c0f7ea725dee27c4bb43bb50c6748c83b71d59f0537405dfab648c096607340fac939a2efd31cbe2f8ca29c409e87ea0974b7bceff9afef5d07d691575f5115f2f961ad488e3386036913e98181a6034febaab853a3e928b9035b0e3a8e1cb393c70f6d0448970e0af2476f8b923ee09c19deca55d58f70e8eeff55dda6381cb96afe97196c0af0a8fd450a1447a1a521e2c211fb84cbcf4aebd31298972ec6bea1764fbde5500fa30c5f2459cff4d7f123ab94cfd5762d586ec7a28abc2f8c9e608f8f964b96ecb0883d60d444f317834a3d734cb304051a60d1a084a84da8f9a23a1b9d4951c0a81985c63ae193f40e9deb358b2f08553324fd6086be9e70e5061568abefebcda50e70f4dab2e4dc0cf6d85aced044d7005326922886194895267165f7f592036ebe11dcf1cad98f5cda766eaea90fb4cb5e793525126c7594f8599055192d63a81d3cd26aadd50983f1c3f1d4655c1b5f59e80f733e3abc4792b760729fd26298ef15141cf76cc4", 0xc3}, {&(0x7f0000000d80)="7d68e6de85f9b0cbc9d710267f321ec64eab043ecad9af7e01e9463218ec45924a99867163e468d36a682fadd749caa325e685d75559a87139e02fae7271be8f55671cfd32a09896278d1941370174720838039d0989bc3394b8a4c4f4a30f0496be313d6d60fe47966c634a3ee1f659e8ef310647725bda0130d5de5028220a4cf5fc808a75694738ee26cb21302b4bba4265b845a5d5dce706d9820c6936b122f9658446d74a9016b94424971dd443a6907eb5c73b6b200e92b23f2c36a214729b0bc231511e4c", 0xc8}, {&(0x7f0000000380)="73fd71361e8d6c80ae1bc9953e2a4aeac7a314273066fc7f65a51969b46df1774bb0be94ccd4824f2d57ad2cd37242b1258402395481f9f07e067652e52aa8ccefcd0962ba0c48757b68d493f3ad702e65d4daa7dfc1605a173185472ae12470eea64c70ef4e64793b8a830447de0f423bef3964934eef4243cac42939ba6fa68d821b9373b5f3e2c26e7ca75ed8fb3203aef3a6637cecdd0251532b99537e02f604058f50e66c8a657d59beeed127695475f082d3d2b9790181fc987ad000ac00887d1506be89f388ecb405660b4ea196ee8f5a92b12ec43bbf49567db613d478ebe2358364f7600bf4f80ef4b2756fb13416c4fa22880cc96a03f07888575aedb001d5a74bb2f906797912b5ac080a0a3d361425f1a92ab03bbe65d5dcb235f43b5ad1162a16ebdc647baac013bf076945126cdd5a080853976a97ad55184601102fbb8df86b21aa8162858d74465c5fb7dc766602a3567f6eaf441f85ec50ca7fb3a4fdb450d1420531da25d01a412958a5e3895c59542238cf8e188e7fb5641eb24a5f1819bf8d2e9dd6c1d0e93564d723e311db9cd268bb1e477036e822b135cdbaf40f812aa7db01d22c829ab01ae24997dae96ddeed49e62d285701d5419e3f94a8b95790cf5a296ed15bffae1f71470c6a6eda872528844a2df42590d898630263cab5cccec57b7cea365ad8c91bfbe7cb419635ce6bf340a56115c0ad922b6fade9538e543bc5def2a85d35ab16d20c219c4733837be2c14ba4d3d32c3a6882ce6857626f55109b4cdcb634425d710bf3108f9b31b4af0cc17a58e49e871a56126dd8bed08e038ba64008587237b3442d28032e52fc9fae1a5784ba59d0edfa03d38352724903ed6f6970b3f4dfa6e40bf933b6765c6ee648174765f1e8ec71b80cac86abd065a3005b40a43a665707cc590997c5048183006a9dd8026d39def05950183b3d4f12f4e1644ef78cddac7c5569985c2c232bb350f28857675339e53f63a868704d2e0b38993dc57a02d3e297fc9a5b9384622841018c303a05bac25d509df5a2d0e3232927283fcc3ec67e4fa7b71d22f115cf693851dcceab4bce38cbfbb32829e211cdcb6a359e14fe416663541050d340aef2555dbd292bd9cbab8fcf20378149cc994569c2bc95fb33fd2d9321b8ac8e5160b02e202492f470eb719a8f2ac3a4be37ea0918b54b14789b7aa228d47f7b13fd9af608740c5a8fe02109a7cc0e555b22628ef790e513ecadfd338d30aed8ca219e64ee4fb0bd0e21e5101bf2072ffa071eb1aa0454caccc015ff1e166813f819a142b56a22e4ff387bb319288a0ef747c6fc8fdee3a0e193b0d086eb816e97e0322fcdaa30da61cd26ac9d8d0748fccd911ce0fd4adc953e9486e137fe66bc8aedfd5b78c562ebfc578ac9f96a453311766564541e16955e30b95914e9411a0b4cd95e0d8732d5ff7a4f921ef41d986a195334266585353b16b9449955523913a30c087532bcb899f733af3abea59baea174cf04359547a633b5f8a582ae3ef12a1d0125bef8c6e8c9fb589d3597c5ab3879491b0c5e3607203f06836a6805d3f7979c4325f9fecb2aceddedb272237132460cda812ef7d613a585898d59f92ef68ec95f12b47b440f6d899ecbfab48055e0c1605ba4cd9dbc17c4cbfec8a953ebbd38c45a6737a57ee58e21a20e530171137968ae4f0d0366cdb0b9d6a4667b011fcd7cd9e77364e5221989d8f0d80793260e748e3bd394849c090c744f6044328304cd6f02e941c5405647daffc1fd2f2864b37f92bbf4931c8e4a7c6bafd0ea79d39d330e70e6776bf6a926de227e5a43653bba04883e98d67bb64aa86e8bf271ba87604bc598e47f2992c7618ad25068860a481554b53352c7339de7e79c3bd1aed5bef8f398432858c888a5d8651969ea40eb3d486e9fe61d49b20500fdfd1548f567da970103d36730657c35d03d2c36b142665f62203b1fb12d616478cfef6f38b34cda87a634dd06d359f33e98b94a5e5b46b2a8d73126352d1d5b65af75055455cc903e384c41876fbdff935d047284d9d203b147a6ba0e9cb50beef7798886c33d2f2f0c0d9abe0e32c7c809f8b0b28fc59471987353c862a311776b8275bf319d5cb9a59f8f103b6e567ef5dd8859973cc3fe41e356bf5bd3186240e49286977eca36a8ad44185973b276cd7958b73e14a221b7fd567818bebf54ad27ee95161bd2aeeb356482ff467500a7d36f0464f58a591ec6b728f984ec78d0abe14c6d3411ac3ffc4c3179d1f95d029f26cceb545723519d3d4209a2b1243e78767273c13dc2bd320512674b6f1a50313bae7b9d16aebb476dbc829e8fd8dd46a1696efaff5795cf75de57c90f05ed9ef4a5cdfbf20d3d9ed95fb4114b1d5c9ade0856212e7ba330ce5bccf2c993dff89112b28bd3b17d3fcfacef7590f62bf948977dd79e2d8025946c80bf263e34035409b5ba1443d4929727180761bd56d258c3670a0aa4de21111fc3172367582de2d164ff3a18d0696b8dd8e5c1423b2ea1e2c0cfe141e4cf04f8cdaed48976b94c40d6a581300458661bbdbfeeb4969af6319eb1798843d0872f68f0c6537bbc9c7dd1e9b0564bf442d8d25f8aa884aba1df074d374f99750d9227bb821ba0355f60de2829a5c8cd47c89d29a2e3d7d53d59db5c3ace8f484664202c210c68a3b33076fb00d59938e84fbad6d6618c0bb89cf94035fa2de4da351e0d71df416450ea7ec3af33aa5c0313c63e654bd79c73b39dc1933636956761058d76648746daca469f8fce62c17a8160cdefc6a927eef9ec4a8dd684e46f35282546ce2362ab8afedd39bf699fd7c2cde538f52ea43c08558f42ba77b2986b800c45fa76a130b30919b3e1d504573e3c1e7dd2dc5d81379df53d736511f1da4ad8791e46adb27bb5c38129e89edda0aed99dcc03fe400f7d05d48e3e9e17744e8487f8ac464c86f7332211fb9799e9d27a6832d5f17ccd1a2da255f6da047e4728dd80860c04391bca4b7833f0346866401ec20033bcf6dfa85fd1520de5a03b4f9f6f5d2f8d7b6e7d7df1cbe5c05e23e080cf335639c94c48aaeb0bfebbe79530d67d35fb101c91839954c0e50dd4b90a86428b22b0be1e906fee30f68d7ce4bf9c68eafe695f07f5e4e4d473d77104b7b1b5dcfeb84e8c83624c0068d4e1cccfe740f8e5d5699603f8481ef2a1f2d4b8fd2314c5cb1985fe34cf8ede7d2e8bddea269422490903489c7f5951114d7ccb29a19455a987d538955712a460243105b25ccb6e6f34c370a6bbb234bee150dbcea5188e45305253f1014f7c0b5d60d517d2d05707f5ca9249a921d6c5307caf41deca0509b49102d801320db65c00f6e1c05fb8c2e1cc554673bf6168dd64086b19af28eec508fd0c304837e802173ac9947c4d73929c61d9632ab929a25f2a04350954612c2de705c1c25215284fe933fc8ccfd30ab3fc9ff5e04dd68d4720d95a29d6da176ac9d332c9ce77358f3c262777ea828fe6473638bc77be2aa586a3733e275744bc42c3742c1ad8f89d25c31958902f2f498c58fc85e9b78fb7a331734cb081cfa9ccfd262df927c0ff46983f8765af4add3532de2b91f2436df028", 0x9fd}], 0x3}}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)="a6", 0x1}], 0x300}}], 0x3, 0x0)

196.591087ms ago: executing program 2 (id=3968):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae8000000000a01010000000000000000050000000900010073797a3000000000ba000600e9eec003775c64e64f439fc0b5fb34bcd039590bba579a25436e11f718b64e3e01796b9e930a3d8eefa0bccf8429a311f3ce5ec5a0a7bb9e08c60e03cbcdd726725fb9b1bd1000cf2a77ab6ab91f2294634073ea59b8de2361cdd8045c5fdb81611e843cb814e4cfe672542287ebd3b2ed48dca1a08690b05bb9bbbcc05551bd05e4c6e0625fcae04323e0f29dbad3c57456d2ca020462188e1236ebe6da1442c71ab0a8ebfaacef2710111417370a0f8cd19c5f9e1a00000900010073797a3000000000b0000000030a01030000000000000000050000000900010073797a300000000008000540000000004c0008800c000240000000000000ffff0c00024000000000000000000c00024000000000000016cc0c00014000000000000100010c00024000000000000000140c00014000000000000000090900030073797a32000000000b00070066696c746553000024000480080002406b10a621080001"], 0x1d4}}, 0x0)

126.81482ms ago: executing program 2 (id=3969):
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
sendmmsg$inet6(r0, &(0x7f0000003040)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0x4459, @remote, 0x8e12}, 0x1c, 0x0, 0x0, &(0x7f0000000d80), 0x5}}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000340)="966cea", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f00000008c0)="5d4cf745bfeb196c", 0x8}], 0x1}}], 0x3, 0x8000)

126.560171ms ago: executing program 2 (id=3970):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x20)
r1 = accept4$alg(r0, 0x0, 0x0, 0x0)
sendmmsg$sock(r1, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000400)="539ae4", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000f00)="8f", 0x1}], 0x117, &(0x7f0000001380)=[@mark={{0x14, 0x1, 0x24, 0x7}}], 0x18}}], 0x2, 0x20008004)

55.542463ms ago: executing program 0 (id=3971):
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x14)

55.349712ms ago: executing program 2 (id=3972):
msgctl$MSG_INFO(0x0, 0xc, &(0x7f0000000b00)=""/183)

55.125208ms ago: executing program 0 (id=3973):
clock_gettime(0xb, &(0x7f0000000040))

3.888216ms ago: executing program 2 (id=3974):
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[], 0x48)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x800000000000001, 0x0, 0x2, 0x0)
socket$packet(0x11, 0x3, 0x300)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x64, r2, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @remote}}, @L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x64}}, 0x0)

3.72139ms ago: executing program 0 (id=3975):
syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0)
unshare(0x2a020400)
r0 = syz_io_uring_setup(0x10b, &(0x7f00000000c0)={0x0, 0x46ad, 0x400, 0x3, 0x108}, &(0x7f0000000040)=<r1=>0x0, &(0x7f0000000140)=<r2=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4)
r3 = socket$inet6(0x10, 0x3, 0x0)
syz_io_uring_submit(r1, r2, &(0x7f00000004c0)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x4c, 0x0, r3, 0x0, 0x0, 0x0, 0x40010020})
io_uring_enter(r0, 0x8aa, 0x0, 0x0, 0x0, 0x0)
io_uring_register$IORING_REGISTER_SYNC_CANCEL(r0, 0x18, &(0x7f0000000000)={0x0, r3, 0x33, {0x27fffffffffffff, 0x800000008}, 0x54}, 0x1)

0s ago: executing program 2 (id=3976):
syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x8108c4, &(0x7f0000000300)={[{@resv_level={'resv_level', 0x3d, 0x400}}, {@heartbeat_none}, {@resv_level={'resv_level', 0x3d, 0x1}}, {@coherency_full}, {@err_ro}, {@localalloc={'localalloc', 0x3d, 0x1}}, {@intr}, {@localalloc}]}, 0x1, 0x442f, &(0x7f000000e480)="$eJzs3c9PHGUfAPBnBvoW+rZ9oW8PfZP3sIlNNGoI9KTSREppKbRYU21jvGwX2LbowjawNSb2gLcmnkw8GA+NJt44NfwD9ejRi8d6bqIHLyYmjZjdnQVm2A0rYUHq53NgmOc3+5159pnD8MSJyp25pdzcUq6wkCvP3Fo6k/uoXLo3XwzxHmna/6G965/2dOI62e9r75/s6vmL79w4E8J3sz8+XVtbWwtV3aGpoU2///br/ZnNx4Y4U6fabvPWdsv7IYSTW8ZV1RVCeC+EEIUQziVpo8mxN4RwLMm7cf+zm7ldGs2jJ8Wz+WdTD1aHT0+uPFxt/bdHIXxV+t+rt+d/fqFr+KeXd6l7AAAAAAAAAAAAAAAAAAAOuPFrV6+/PTgUHkeheyXa+r7ueHJs9X7s2q75vvN/LAAAAAAAAAAAAAAAAAAAAPxNbbz/n4tONHn/fyw5jrSov/Zm58dI50y8dXXswuBQsv97tCX/tSTpl3Ndob/Jvu/Z/d/PZeo33/99az871Rhfo9++EMUDqfM4HhgI4Ztk4/dT0ZG4VF6qvHKr3BVmd20YB1Y6/vXd+1PRSTb0bzf+o5n2O7///3+3XE3V85u7d4k919Lx72pZ7ttPo7bifz5Tby/iz86l499dS+vdXGCkPgFU4/959/bxH8u036n4Hw8h5KLqWHOpGaC6hqmmt1qvkJaO/6FaWmrqTD7IVvf/75n4X8i0v1/z/3L2i6jmk84O5QBKx/9ftbSeVImN+78/3v7+v5hpfz/iXx3/su//tqTjf7ie2J0qUvsk253/xzPtdyr+1+NknMej1BWwEtXTW/2/OtLS8e/Zkr/x/Be3tf67lKm/V89/jX4bz3+N6f+lqP78R3Pp+Pe2LNfu/T+Rqdfp+X+ktv5jp9LxP1JLS6+d+2o/243/ZKb9TsW/tirpacR/Yz7543A9/eum6z+y0vH/dz0x3lxiufaztv6Ltl//X860vx/rv+r4l+PO9vq8SMf/aMty1fj/0Mb3/5VMvc7HP4RBa/0dS8f/WMtytfu/Z/v4T2XqdTr+L3aycQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIADYDQ59oUoHkidx/HAQAjnk/NT4Ug0XZjNT5fKMx8uhTCWpOfCieh2qTxdKOXnFsqzxXyhVCrPhHAhyT8ZeqKlUrmSny/cvbjeVm90p1hYrEwXC5UQwniS/v9wrNHW9FxlvnA3hHBpPe8/cXnx7p3CQn52bvGNwcHBwTCxPob+qPhxpbhQqfdezw1hcr1uX7RpcLXsy+tjORp9UL63uFAo1dKvbKpTKs8USpvqTCV5X4T+qLJ4b2GmUCnmS+Xbjf7200hyHJu49u61K0Nb8m9G9ePo3g4LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgL/o8fDrX4YQuutncQhhpPFL1Kz8oyfFs/lnUw9Wh09PrjxcfdqqHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPzJDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbpGKWBIAoD8JuxUDuPYbXsdrYrimjhiuAJ9BgeRo/iJbxDihRpU4RAMgthswvbJNX3NQ/mZ+Y9mAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADM8/TefbzVTUSKq81lxN/X/+Iwfyn15378/sUZZuR0nl+7h8e6Kf+ejvK7crRs8y5dr74/Y6T2fgd7Mtynvb7P9eRcU/s2NV/f9yZSriKiLfltyrmq5r0FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsGUHDgQAAAAAgPxfG6GqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoKO3AsAAAAACDM3zqKvg0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAXwEAAP//zQceng==")
open(&(0x7f00000000c0)='./file2\x00', 0x108843, 0x29)

kernel console output (not intermixed with test programs):

 inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  196.942459][ T9973] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  196.947098][ T9973] F2FS-fs (loop1): inject page alloc in f2fs_grab_cache_folio of __get_meta_folio+0x157/0x4f0
[  196.954465][ T9973] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5
[  197.081215][ T9973] F2FS-fs (loop1): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x1d9/0xa40
[  197.097514][ T9973] F2FS-fs (loop1): inject dquot initialize in f2fs_dquot_initialize of f2fs_new_inode+0x509/0x1050
[  197.112900][ T9973] F2FS-fs (loop1): inject slab alloc in f2fs_alloc_inode of alloc_inode+0x6a/0x1b0
[  197.121728][ T9973] F2FS-fs (loop1): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x1d9/0xa40
[  197.192338][ T5872] F2FS-fs (loop1): inject inconsistent footer in sanity_check_node_footer of f2fs_get_dnode_of_data+0xab1/0x1cf0
[  197.198380][ T5872] F2FS-fs (loop1): inconsistent node block, node_type:0, nid:17, node_footer[nid:17,ino:3,ofs:249659,cpver:0,blkaddr:0]
[  197.214208][ T5872] syz-executor: attempt to access beyond end of device
[  197.214208][ T5872] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  197.224131][ T5872] CPU: 0 UID: 0 PID: 5872 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
[  197.224150][ T5872] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  197.224159][ T5872] Call Trace:
[  197.224182][ T5872]  <TASK>
[  197.224189][ T5872]  dump_stack_lvl+0x189/0x250
[  197.224210][ T5872]  ? __pfx_dump_stack_lvl+0x10/0x10
[  197.224225][ T5872]  ? __pfx_queue_work_on+0x10/0x10
[  197.224236][ T5872]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  197.224253][ T5872]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  197.224275][ T5872]  f2fs_handle_critical_error+0x37c/0x540
[  197.224296][ T5872]  f2fs_write_end_io+0x886/0xb60
[  197.224319][ T5872]  __submit_merged_bio+0x27a/0x6a0
[  197.224340][ T5872]  __submit_merged_write_cond+0x255/0x530
[  197.224360][ T5872]  f2fs_write_data_pages+0x261d/0x3000
[  197.224400][ T5872]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  197.224470][ T5872]  ? __pfx_preempt_schedule_irq+0x10/0x10
[  197.224485][ T5872]  ? __lock_acquire+0xab9/0xd20
[  197.224505][ T5872]  ? irqentry_exit+0x74/0x90
[  197.224520][ T5872]  ? lockdep_hardirqs_on+0x9c/0x150
[  197.224539][ T5872]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  197.224560][ T5872]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  197.224578][ T5872]  do_writepages+0x32e/0x550
[  197.224602][ T5872]  ? do_raw_spin_unlock+0x4d/0x240
[  197.224618][ T5872]  filemap_fdatawrite+0x199/0x240
[  197.224634][ T5872]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  197.224682][ T5872]  ? do_raw_spin_unlock+0x4d/0x240
[  197.224699][ T5872]  f2fs_sync_dirty_inodes+0x31f/0x830
[  197.224720][ T5872]  f2fs_write_checkpoint+0x95a/0x1df0
[  197.224748][ T5872]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  197.224792][ T5872]  ? kill_f2fs_super+0x298/0x6c0
[  197.224808][ T5872]  kill_f2fs_super+0x2c3/0x6c0
[  197.224824][ T5872]  ? __pfx_kill_f2fs_super+0x10/0x10
[  197.224833][ T5872]  ? radix_tree_delete_item+0x2b6/0x400
[  197.224854][ T5872]  ? shrinker_free+0x2ce/0x3e0
[  197.224868][ T5872]  deactivate_locked_super+0xbc/0x130
[  197.224883][ T5872]  cleanup_mnt+0x425/0x4c0
[  197.224896][ T5872]  ? lockdep_hardirqs_on+0x9c/0x150
[  197.224938][ T5872]  task_work_run+0x1d4/0x260
[  197.224955][ T5872]  ? __pfx_task_work_run+0x10/0x10
[  197.224969][ T5872]  ? __x64_sys_umount+0x122/0x160
[  197.224986][ T5872]  ? exit_to_user_mode_loop+0x40/0x110
[  197.225005][ T5872]  exit_to_user_mode_loop+0xec/0x110
[  197.225020][ T5872]  do_syscall_64+0x2bd/0x3b0
[  197.225035][ T5872]  ? lockdep_hardirqs_on+0x9c/0x150
[  197.225050][ T5872]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  197.225061][ T5872]  ? exc_page_fault+0x9f/0xf0
[  197.225077][ T5872]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  197.225089][ T5872] RIP: 0033:0x7f753c98ff17
[  197.225100][ T5872] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  197.225109][ T5872] RSP: 002b:00007ffe0ffe6ab8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  197.225122][ T5872] RAX: 0000000000000000 RBX: 00007f753ca11c05 RCX: 00007f753c98ff17
[  197.225130][ T5872] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe0ffe6b70
[  197.225137][ T5872] RBP: 00007ffe0ffe6b70 R08: 0000000000000000 R09: 0000000000000000
[  197.225144][ T5872] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe0ffe7c00
[  197.225151][ T5872] R13: 00007f753ca11c05 R14: 000000000003019f R15: 00007ffe0ffe7c40
[  197.225171][ T5872]  </TASK>
[  197.225234][ T5872] F2FS-fs (loop1): Stopped filesystem due to reason: 3
[  198.176992][ T5931] usb 3-1: new high-speed USB device number 17 using dummy_hcd
[  198.327917][ T1272] usb 2-1: new high-speed USB device number 16 using dummy_hcd
[  198.330507][ T5931] usb 3-1: Using ep0 maxpacket: 32
[  198.335598][ T5931] usb 3-1: config 0 has an invalid interface number: 16 but max is 0
[  198.341961][ T5931] usb 3-1: config 0 has no interface number 0
[  198.346948][ T5931] usb 3-1: config 0 interface 16 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  198.351050][ T5931] usb 3-1: config 0 interface 16 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8
[  198.358437][ T5931] usb 3-1: New USB device found, idVendor=0499, idProduct=102a, bcdDevice=85.2d
[  198.362233][ T5931] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  198.366697][ T5931] usb 3-1: Product: syz
[  198.369318][ T5931] usb 3-1: Manufacturer: syz
[  198.371459][ T5931] usb 3-1: SerialNumber: syz
[  198.378225][ T5931] usb 3-1: config 0 descriptor??
[  198.380834][T10011] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  198.383740][T10011] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  198.389964][ T5931] usb 3-1: Quirk or no altset; falling back to MIDI 1.0
[  198.557083][ T1272] usb 2-1: Using ep0 maxpacket: 16
[  198.566272][ T1272] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  198.577513][ T1272] usb 2-1: config 0 interface 0 has no altsetting 0
[  198.580591][ T1272] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00
[  198.584567][ T1272] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  198.833316][ T1272] usb 2-1: config 0 descriptor??
[  198.851593][ T5931] usb 3-1: USB disconnect, device number 17
[  199.307223][ T1272] nzxt-smart2 0003:1E71:2009.0006: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.1-1/input0
[  199.681052][   T24] usb 2-1: USB disconnect, device number 16
[  200.176153][T10057] loop2: detected capacity change from 0 to 32768
[  200.180288][T10057] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.1659 (10057)
[  200.193720][T10057] BTRFS info (device loop2): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2
[  200.199416][T10057] BTRFS info (device loop2): using xxhash64 (xxhash64-generic) checksum algorithm
[  200.203297][T10057] BTRFS warning (device loop2): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2
[  200.401684][T10057] BTRFS info (device loop2): rebuilding free space tree
[  200.419795][T10057] BTRFS info (device loop2): disabling free space tree
[  200.422797][T10057] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  200.437698][T10057] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  200.448732][T10057] BTRFS info (device loop2): allowing degraded mounts
[  200.451650][T10057] BTRFS info (device loop2): enabling ssd optimizations
[  200.454831][T10057] BTRFS info (device loop2): enabling disk space caching
[  200.458162][T10057] BTRFS info (device loop2): force clearing of disk cache
[  200.461258][T10057] BTRFS info (device loop2): use zlib compression, level 3
[  200.463409][ T5879] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 34861 - 0
[  200.473095][ T5879] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 34861 - 0
[  200.476663][ T5879] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 34861 - 0
[  200.491240][ T5879] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 34861 - 0
[  200.513241][T10057] BTRFS info (device loop2): balance: start -sprofiles=data|system|metadata|single|raid0|raid1|dup|raid10|raid5|raid6|raid1c3|raid1c4|0xfffefffffffff800,usage=2305843009213694464,usage=512..536870912,devid=0
[  200.523123][T10057] BTRFS info (device loop2): balance: ended with status: 0
[  200.577443][ T5931] usb 2-1: new high-speed USB device number 17 using dummy_hcd
[  200.588728][ T5873] BTRFS info (device loop2): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2
[  200.767379][ T5931] usb 2-1: Using ep0 maxpacket: 8
[  200.774967][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9
[  200.783581][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  200.792446][ T5931] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  200.799481][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024
[  200.804426][ T5931] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024
[  200.812598][ T5931] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58
[  200.816614][ T5931] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  200.835736][ T5931] usb 2-1: config 0 descriptor??
[  200.844384][T10067] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  200.974383][  T791] IPVS: starting estimator thread 0...
[  201.057167][T10099] IPVS: using max 54 ests per chain, 129600 per kthread
[  201.335648][  T791] usb 2-1: USB disconnect, device number 17
[  201.343257][ T5870] Bluetooth: hci3: Opcode 0x0c03 failed: -71
[  201.373732][T10098] loop2: detected capacity change from 0 to 32768
[  201.542962][T10101] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1670'.
[  201.554288][T10101] vlan2: entered promiscuous mode
[  201.556421][T10101] gretap0: entered promiscuous mode
[  202.089404][T10117] loop1: detected capacity change from 0 to 4096
[  202.162272][   T33] audit: type=1400 audit(1756315638.089:38): apparmor="DENIED" operation="change_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=3A30206B420A4C617A79467265653A202020202020202020202020202030206B420A416E6F6E4875676550616765733A20202020202020202030206B420A53686D656D506D644D61707065643A202020202020202030206B420A46696C65506D644D61707065643A20202020202020202030206B420A5368617265645F48756765746C623A202020202020202030206B420A507269766174 pid=10118 comm="syz.1.1678"
[  202.344102][T10129] ip6tnl0: Caught tx_queue_len zero misconfig
[  202.455068][T10133] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1685'.
[  202.468157][T10133] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1685'.
[  202.495812][T10137] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes.
[  203.793521][T10186] netlink: 'syz.2.1707': attribute type 7 has an invalid length.
[  203.802881][T10186] : entered promiscuous mode
[  203.899993][T10190] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1708'.
[  203.941175][T10192] program syz.2.1709 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  203.980770][T10194] loop2: detected capacity change from 0 to 2048
[  204.018880][ T5851]  loop2: p1 < > p4 < >
[  204.030536][T10194]  loop2: p1 < > p4 < >
[  204.106245][ T5851] udevd[5851]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory
[  204.108317][ T5956] udevd[5956]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory
[  204.160218][ T5956] udevd[5956]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory
[  204.352017][T10209] loop1: detected capacity change from 0 to 1024
[  204.383426][T10209] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  204.436567][ T5872] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  205.951240][T10271] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1724'.
[  206.294534][T10294] loop1: detected capacity change from 0 to 256
[  206.328452][T10294] exFAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  206.332970][T10294] exFAT-fs (loop1): Medium has reported failures. Some data may be lost.
[  206.342188][T10294] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  206.805172][T10308] loop1: detected capacity change from 0 to 8
[  206.807733][T10308] MTD: Attempt to mount non-MTD device "/dev/loop1"
[  206.819919][T10308] cramfs: Error -3 while decompressing!
[  206.822471][T10308] cramfs: ffffffff99bec668(26)->ffff88811dfea000(4096)
[  206.825420][T10308] cramfs: Error -3 while decompressing!
[  206.829192][T10308] cramfs: ffffffff99bec682(26)->ffff88811dfeb000(4096)
[  206.831866][T10308] cramfs: Error -3 while decompressing!
[  206.833846][T10308] cramfs: ffffffff99bec69c(16)->ffff88811dfec000(4096)
[  206.837750][T10308] cramfs: Error -3 while decompressing!
[  206.840020][T10308] cramfs: ffffffff99bec668(26)->ffff88811dfea000(4096)
[  206.893383][T10312] netlink: 'syz.1.1742': attribute type 1 has an invalid length.
[  206.896256][T10312] netlink: 'syz.1.1742': attribute type 2 has an invalid length.
[  207.096209][T10322] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  207.209127][T10326] netlink: 'syz.0.1749': attribute type 21 has an invalid length.
[  207.212377][T10326] netlink: 'syz.0.1749': attribute type 15 has an invalid length.
[  207.215865][T10326] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1749'.
[  207.220478][T10326] IPv6: NLM_F_CREATE should be specified when creating new route
[  207.224982][T10326] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  207.228006][T10326] IPv6: NLM_F_CREATE should be set when creating new route
[  207.231003][T10326] IPv6: NLM_F_CREATE should be set when creating new route
[  207.234014][T10326] IPv6: NLM_F_CREATE should be set when creating new route
[  207.346772][T10320] loop1: detected capacity change from 0 to 40427
[  207.355268][T10320] F2FS-fs (loop1): Invalid log blocks per segment (4278190089)
[  207.364357][T10333] overlayfs: failed to resolve './file0': -2
[  207.364919][T10320] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock
[  207.375729][T10320] F2FS-fs (loop1): invalid crc value
[  207.433694][T10320] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  207.441511][T10320] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0
[  207.444575][T10320] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5
[  207.475728][T10320] F2FS-fs (loop1): Corrupted max_depth of 3: 255
[  207.481690][T10320] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix.
[  207.710229][T10351] loop1: detected capacity change from 0 to 2048
[  207.724571][T10351] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  207.919038][T10353] loop1: detected capacity change from 0 to 32768
[  207.928982][T10353] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  207.954549][T10353] XFS (loop1): Ending clean mount
[  207.964106][T10353] XFS (loop1): Quotacheck needed: Please wait.
[  207.991497][T10353] XFS (loop1): Quotacheck: Done.
[  208.008886][ T5872] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  209.114499][T10381] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  209.290246][T10385] loop1: detected capacity change from 0 to 32768
[  209.297987][T10385] 
[  209.297987][T10385]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  209.297987][T10385] 
[  209.314430][T10385] ERROR: (device loop1): diWrite: ixpxd invalid
[  209.314430][T10385] 
[  209.320074][T10385] ERROR: (device loop1): txCommit: 
[  209.320074][T10385] 
[  209.324106][T10385] ERROR: (device loop1): dtReadFirst: btstack overrun
[  209.324106][T10385] 
[  209.329582][T10385] btstack dump:
[  209.331045][T10385] bn = 0, index = 0
[  209.332418][T10385] bn = 0, index = 0
[  209.333945][T10385] bn = 0, index = 0
[  209.335533][T10385] bn = 0, index = 0
[  209.337717][T10385] bn = 0, index = 0
[  209.339303][T10385] bn = 0, index = 0
[  209.340986][T10385] bn = 0, index = 0
[  209.342556][T10385] bn = 0, index = 0
[  209.863266][   T52] ERROR: (device loop1): diWrite: ixpxd invalid
[  209.863266][   T52] 
[  209.868825][   T52] ERROR: (device loop1): txCommit: 
[  209.868825][   T52] 
[  209.872927][   T52] jfs_write_inode: jfs_commit_inode failed!
[  209.875859][ T5872] 
[  209.875859][ T5872]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  209.875859][ T5872] 
[  209.883373][ T5872] 
[  209.883373][ T5872]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  209.883373][ T5872] 
[  210.190038][T10403] overlayfs: missing 'workdir'
[  210.277105][ T5910] usb 2-1: new high-speed USB device number 18 using dummy_hcd
[  210.433298][ T5910] usb 2-1: Using ep0 maxpacket: 32
[  210.442819][ T5910] usb 2-1: config 0 has an invalid interface number: 16 but max is 0
[  210.448380][ T5910] usb 2-1: config 0 has no interface number 0
[  210.451399][ T5910] usb 2-1: config 0 interface 16 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  210.455756][ T5910] usb 2-1: config 0 interface 16 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  210.469760][ T5910] usb 2-1: New USB device found, idVendor=0499, idProduct=102a, bcdDevice=85.2d
[  210.473981][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  210.477866][ T5910] usb 2-1: Product: syz
[  210.479861][ T5910] usb 2-1: Manufacturer: syz
[  210.481983][ T5910] usb 2-1: SerialNumber: syz
[  210.493081][ T5910] usb 2-1: config 0 descriptor??
[  210.500070][T10393] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  210.526009][ T5910] usb 2-1: Quirk or no altset; falling back to MIDI 1.0
[  210.532413][ T5910] usb 2-1: invalid MIDI in EP 0
[  210.610019][ T5910] snd-usb-audio 2-1:0.16: probe with driver snd-usb-audio failed with error -22
[  210.730224][ T6111] udevd[6111]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.16/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  210.741679][ T5910] usb 2-1: USB disconnect, device number 18
[  211.492966][T10419] loop1: detected capacity change from 0 to 164
[  211.808698][T10434] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1792'.
[  212.810508][T10450] loop1: detected capacity change from 0 to 4096
[  212.815921][T10450] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512).
[  212.822277][T10450] ntfs3(loop1): It is recommened to use chkdsk.
[  212.869187][T10456] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1800'.
[  212.885534][T10458] loop1: detected capacity change from 0 to 24
[  212.889057][T10456] tc_dump_action: action bad kind
[  212.893010][T10458] MTD: Attempt to mount non-MTD device "/dev/loop1"
[  212.915310][T10458] romfs: Mounting image 'rom 637cf1fa' through the block layer
[  212.946259][T10458] romfs: read error for inode 0x70040
[  213.148905][T10473] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1808'.
[  213.290167][T10478] netlink: 4280 bytes leftover after parsing attributes in process `syz.1.1803'.
[  213.294458][T10478] netlink: 4280 bytes leftover after parsing attributes in process `syz.1.1803'.
[  213.334993][T10480] loop2: detected capacity change from 0 to 8
[  213.349610][T10480] SQUASHFS error: xz decompression failed, data probably corrupt
[  213.352378][T10480] SQUASHFS error: Failed to read block 0x108: -5
[  213.354563][T10480] SQUASHFS error: Unable to read metadata cache entry [106]
[  213.357404][T10480] SQUASHFS error: Unable to read inode 0x11f
[  213.958307][T10489] loop1: detected capacity change from 0 to 1024
[  213.961952][T10489] EXT4-fs: Ignoring removed nobh option
[  213.975246][T10489] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  214.012397][ T5872] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  214.287075][    T9] usb 2-1: new full-speed USB device number 19 using dummy_hcd
[  214.450093][    T9] usb 2-1: unable to get BOS descriptor or descriptor too short
[  214.453913][    T9] usb 2-1: not running at top speed; connect to a high speed hub
[  214.458943][    T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  214.465838][    T9] usb 2-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31
[  214.477005][    T9] usb 2-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3
[  214.480521][    T9] usb 2-1: Product: syz
[  214.482336][    T9] usb 2-1: Manufacturer: syz
[  214.484289][    T9] usb 2-1: SerialNumber: syz
[  214.493054][    T9] usb 2-1: config 0 descriptor??
[  214.707960][    T9] usb 2-1: USB disconnect, device number 19
[  215.655171][T10515] Invalid ELF header magic: != ELF
[  215.749171][T10519] loop1: detected capacity change from 0 to 2048
[  215.759015][T10519] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  215.982283][T10527] raw_sendmsg: syz.0.1829 forgot to set AF_INET. Fix it!
[  216.421850][T10536] netlink: 'syz.0.1833': attribute type 4 has an invalid length.
[  216.962083][T10542] loop2: detected capacity change from 0 to 4096
[  216.985689][T10542] ntfs3(loop2): Different NTFS sector size (4096) and media sector size (512).
[  217.026345][T10542] ntfs3(loop2): Failed to initialize $Extend/$Reparse.
[  217.142328][T10548] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8)
[  217.144979][T10548] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless)
[  217.154631][T10548] vhci_hcd vhci_hcd.0: Device attached
[  217.360665][T10554] capability: warning: `syz.0.1840' uses 32-bit capabilities (legacy support in use)
[  217.368671][ T5910] vhci_hcd: vhci_device speed not set
[  217.437371][ T5910] usb 37-1: new full-speed USB device number 2 using vhci_hcd
[  217.628437][T10562] Bluetooth: MGMT ver 1.23
[  217.630740][T10549] vhci_hcd: connection reset by peer
[  217.646340][ T5744] vhci_hcd: stop threads
[  217.649762][ T5744] vhci_hcd: release socket
[  217.666961][ T5744] vhci_hcd: disconnect device
[  218.002362][T10572] netlink: 'syz.0.1849': attribute type 2 has an invalid length.
[  218.005660][T10572] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1849'.
[  218.081097][T10574] IPVS: persistence engine module ip_vs_pe_s not found
[  218.652440][T10603] netlink: 'syz.2.1863': attribute type 1 has an invalid length.
[  218.657091][T10605] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1864'.
[  218.696948][  T791] usb 2-1: new high-speed USB device number 20 using dummy_hcd
[  219.151537][  T791] usb 2-1: Using ep0 maxpacket: 8
[  219.181307][  T791] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea
[  219.185884][  T791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  219.189552][  T791] usb 2-1: Product: syz
[  219.191535][  T791] usb 2-1: Manufacturer: syz
[  219.193589][  T791] usb 2-1: SerialNumber: syz
[  219.199962][  T791] usb 2-1: config 0 descriptor??
[  219.430926][  T791] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state
[  221.141755][T10650] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1881'.
[  221.145746][T10650] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1881'.
[  221.392799][  T791] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71
[  221.401561][  T791] usb 2-1: USB disconnect, device number 20
[  222.394407][T10673] netlink: 14593 bytes leftover after parsing attributes in process `syz.1.1891'.
[  222.420369][T10675] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  222.425827][    T9] lo speed is unknown, defaulting to 1000
[  222.528039][ T5910] vhci_hcd: vhci_device speed not set
[  222.653272][T10684] syz_tun: entered allmulticast mode
[  222.667854][T10684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1896'.
[  222.972004][T10692] loop1: detected capacity change from 0 to 4096
[  223.022564][T10694] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  223.337090][   T54] Bluetooth: hci2: command 0x0405 tx timeout
[  224.007973][ T5910] usb 2-1: new high-speed USB device number 21 using dummy_hcd
[  224.187453][ T5910] usb 2-1: Using ep0 maxpacket: 32
[  224.191477][ T5910] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  224.195699][ T5910] usb 2-1: config 1 interface 0 altsetting 12 has 0 endpoint descriptors, different from the interface descriptor's value: 2
[  224.202500][ T5910] usb 2-1: config 1 interface 0 has no altsetting 0
[  224.207791][ T5910] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  224.211473][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  224.214874][ T5910] usb 2-1: Product: syz
[  224.216716][ T5910] usb 2-1: Manufacturer: 톲폻稀뢇
[  224.219953][ T5910] usb 2-1: SerialNumber: syz
[  224.368421][ T5931] usb 3-1: new high-speed USB device number 18 using dummy_hcd
[  224.441306][ T5910] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22
[  224.454599][ T5910] usb 2-1: USB disconnect, device number 21
[  224.511615][T10730] netlink: 'syz.0.1917': attribute type 13 has an invalid length.
[  224.525617][T10730] gretap0: refused to change device tx_queue_len
[  224.529676][T10730] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[  224.539818][ T5931] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  224.544281][ T5931] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  224.556897][ T5931] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  224.562462][ T5931] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  224.568074][ T5931] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  224.574219][ T5931] usb 3-1: config 0 descriptor??
[  225.014850][ T5931] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0
[  225.256277][T10750] loop1: detected capacity change from 0 to 32768
[  225.807060][   T24] usb 2-1: new high-speed USB device number 22 using dummy_hcd
[  225.959610][   T24] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  225.963573][   T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  225.967498][   T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  225.971065][   T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  225.975771][   T24] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  225.979951][   T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  225.985339][   T24] usb 2-1: config 0 descriptor??
[  226.402912][   T24] plantronics 0003:047F:FFFF.0008: hiddev1,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0
[  227.127939][ T5903] usb 3-1: reset high-speed USB device number 18 using dummy_hcd
[  227.135558][ T5903] usb 3-1: device reset changed ep0 maxpacket size!
[  227.144995][ T5917] usb 3-1: USB disconnect, device number 18
[  227.287811][ T5917] usb 3-1: new high-speed USB device number 19 using dummy_hcd
[  227.436935][ T5917] usb 3-1: Using ep0 maxpacket: 8
[  227.441127][ T5917] usb 3-1: config 0 has an invalid interface number: 193 but max is 1
[  227.444543][ T5917] usb 3-1: config 0 has an invalid interface number: 4 but max is 1
[  227.448097][ T5917] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  227.452129][ T5917] usb 3-1: config 0 has no interface number 0
[  227.454664][ T5917] usb 3-1: config 0 has no interface number 1
[  227.459082][ T5917] usb 3-1: config 0 interface 193 altsetting 147 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  227.464489][ T5917] usb 3-1: config 0 interface 4 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 11
[  227.474734][ T5917] usb 3-1: config 0 interface 193 has no altsetting 0
[  227.478767][ T5917] usb 3-1: config 0 interface 4 has no altsetting 0
[  227.484054][ T5917] usb 3-1: New USB device found, idVendor=1f38, idProduct=0001, bcdDevice=7d.6a
[  227.487770][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  227.491053][ T5917] usb 3-1: Product: syz
[  227.492848][ T5917] usb 3-1: Manufacturer: syz
[  227.494784][ T5917] usb 3-1: SerialNumber: syz
[  227.499133][ T5917] usb 3-1: config 0 descriptor??
[  227.712382][ T5917] usb 3-1: unknown interface protocol 0x4f, assuming v1
[  227.715214][ T5917] usb 3-1: 193:2 : does not exist
[  227.720137][ T5917] usb 3-1: unknown interface protocol 0x5, assuming v1
[  227.722959][ T5917] usb 3-1: 4:0 : does not exist
[  227.732667][ T5917] usb 3-1: USB disconnect, device number 19
[  227.754004][ T5851] udevd[5851]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.193/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  228.331757][T10805] loop2: detected capacity change from 0 to 4096
[  228.388444][   T52] ntfs3(loop2): ino=5, mi_enum_attr
[  228.648213][ T5917] usb 2-1: USB disconnect, device number 22
[  228.672309][T10815] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1955'.
[  228.676222][T10815] netlink: 'syz.0.1955': attribute type 2 has an invalid length.
[  229.060822][   T33] audit: type=1326 audit(1756315664.989:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.070245][   T33] audit: type=1326 audit(1756315665.009:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.078866][   T33] audit: type=1326 audit(1756315665.009:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.087934][   T33] audit: type=1326 audit(1756315665.009:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.096351][   T33] audit: type=1326 audit(1756315665.009:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.105073][   T33] audit: type=1326 audit(1756315665.009:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.113618][   T33] audit: type=1326 audit(1756315665.009:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.125851][   T33] audit: type=1326 audit(1756315665.009:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=128 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.134404][   T33] audit: type=1326 audit(1756315665.059:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.142745][   T33] audit: type=1326 audit(1756315665.059:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10820 comm="syz.0.1957" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  229.271742][T10823] loop1: detected capacity change from 0 to 32768
[  229.326663][T10839] netlink: 'syz.0.1962': attribute type 3 has an invalid length.
[  229.339382][T10823] bcachefs (loop1): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,foreground_target=invalid label 767,background_target=invalid device 7,nojournal_transaction_names
[  229.339400][T10823]   allowing incompatible features above 0.0: (unknown version)
[  229.339408][T10823]   features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[  229.357972][T10823] bcachefs (loop1): Using encoding defined by superblock: utf8-12.1.0
[  229.360855][T10823] bcachefs (loop1): initializing new filesystem
[  229.369327][T10823] bcachefs (loop1): going read-write
[  229.373936][T10839] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1962'.
[  229.440040][T10823] bcachefs (loop1): marking superblocks
[  229.453289][T10823] bcachefs (loop1): initializing freespace
[  229.496479][T10823] bcachefs (loop1): done initializing freespace
[  229.504224][T10823] bcachefs (loop1): reading snapshots table
[  229.506432][T10823] bcachefs (loop1): reading snapshots done
[  229.525664][T10823] bcachefs (loop1): done starting filesystem
[  229.707689][ T5872] bcachefs (loop1): shutting down
[  229.715180][ T5872] bcachefs (loop1): going read-only
[  229.720019][ T5872] bcachefs (loop1): finished waiting for writes to stop
[  229.729762][ T5872] bcachefs (loop1): flushing journal and stopping allocators, journal seq 3
[  229.991976][ T5872] bcachefs (loop1): flushing journal and stopping allocators complete, journal seq 3
[  229.995558][T10868] syz.2.1973 uses old SIOCAX25GETINFO
[  229.997973][ T5872] bcachefs (loop1): clean shutdown complete, journal seq 4
[  229.998456][ T5872] bcachefs (loop1): marking filesystem clean
[  230.022977][ T5872] bcachefs (loop1): shutdown complete
[  231.059517][T10889] comedi comedi4: bad chanlist[0]=0x0000b8eb chan=47339 range length=2
[  231.793063][T10893] loop2: detected capacity change from 0 to 131072
[  231.797221][T10893] F2FS-fs (loop2): Wrong CP boundary, start(512) end(1536) blocks(0)
[  231.800617][T10893] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock
[  231.805775][T10893] F2FS-fs (loop2): invalid crc value
[  231.856372][T10893] F2FS-fs (loop2): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  231.864870][T10893] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0
[  231.869095][T10893] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4
[  232.597680][T10933] loop1: detected capacity change from 0 to 32768
[  232.613263][T10933] (syz.1.2000,10933,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  232.622752][T10933] (syz.1.2000,10933,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  232.642209][T10933] JBD2: Ignoring recovery information on journal
[  232.679533][T10933] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  232.743163][ T5872] ocfs2: Unmounting device (7,1) on (node local)
[  233.851376][T10967] Invalid ELF header magic: != ELF
[  234.695923][T11006] loop2: detected capacity change from 0 to 16
[  234.878871][T11006] erofs (device loop2): mounted with root inode @ nid 36.
[  235.589819][T11024] loop1: detected capacity change from 0 to 32768
[  236.913468][T11056] dns_resolver: Unsupported server list version (0)
[  237.162763][T11077] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2059'.
[  238.440576][T11092] ALSA: mixer_oss: invalid OSS volume '49'
[  238.443085][T11092] ALSA: mixer_oss: invalid OSS volume 'Invalid'
[  238.540072][T11098] loop1: detected capacity change from 0 to 164
[  238.556294][T11098] rock: corrupted directory entry. extent=28, offset=16056320, size=0
[  238.626811][T11086] loop2: detected capacity change from 0 to 32768
[  238.646081][T11086] BTRFS warning: excessive commit interval 2147483647, use with care
[  238.653574][T11086] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.2062 (11086)
[  239.628786][T11086] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  239.633011][T11086] BTRFS info (device loop2): using crc32c (crc32c-lib) checksum algorithm
[  239.790199][T11086] BTRFS info (device loop2): rebuilding free space tree
[  239.821384][T11086] BTRFS info (device loop2): disabling free space tree
[  239.824236][T11086] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  239.844678][T11086] BTRFS info (device loop2): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  239.895021][T11086] BTRFS info (device loop2): checking UUID tree
[  239.911126][T11086] BTRFS info (device loop2): setting nodatasum
[  239.913790][T11086] BTRFS info (device loop2): enabling ssd optimizations
[  239.916649][T11086] BTRFS info (device loop2): turning off barriers
[  239.922799][T11086] BTRFS info (device loop2): turning on flush-on-commit
[  239.925717][T11086] BTRFS info (device loop2): force clearing of disk cache
[  239.929921][T11086] BTRFS info (device loop2): doing ref verification
[  239.932955][T11086] BTRFS info (device loop2): max_inline set to 0
[  240.035268][ T5873] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  240.101967][T11150] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2084'.
[  240.158817][T11150] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2084'.
[  240.586810][   T33] kauditd_printk_skb: 1 callbacks suppressed
[  240.591803][   T33] audit: type=1326 audit(1756315676.509:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11173 comm="syz.1.2093" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f753c98ebe9 code=0x0
[  240.638311][T11177] loop1: detected capacity change from 0 to 1024
[  240.644889][T11177] EXT4-fs: Ignoring removed nobh option
[  240.654590][T11177] EXT4-fs: Ignoring removed bh option
[  240.670041][T11177] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  240.677162][ T5917] usb 3-1: new high-speed USB device number 20 using dummy_hcd
[  240.755618][T11184] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4183: comm syz.1.2093: Allocating blocks 385-513 which overlap fs metadata
[  240.850075][ T5917] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc
[  240.854198][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  240.859399][ T5917] usb 3-1: Product: syz
[  240.861321][ T5917] usb 3-1: Manufacturer: syz
[  240.863449][ T5917] usb 3-1: SerialNumber: syz
[  240.876595][ T5917] usb 3-1: config 0 descriptor??
[  240.907827][ T5917] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 020
[  241.093292][ T5917]  (null): failure setting delay to 10us
[  241.100337][ T5917] i2c-tiny-usb 3-1:0.0: probe with driver i2c-tiny-usb failed with error -5
[  241.130573][ T5917] usb 3-1: USB disconnect, device number 20
[  241.431214][T11173] EXT4-fs (loop1): pa ffff88802aa7fe80: logic 16, phys. 129, len 24
[  241.434823][T11173] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:5434: group 0, free 0, pa_free 8
[  242.040430][ T5872] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  242.653913][T11232] loop2: detected capacity change from 0 to 512
[  242.666797][T11232] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[  242.676009][T11232] EXT4-fs (loop2): 1 truncate cleaned up
[  242.684721][T11232] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  243.487717][T11239] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2119'.
[  243.945093][T11257] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2124'.
[  244.020254][ T5873] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  244.366037][T11268] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2132'.
[  244.714927][ T5903] libceph: connect (1)[c::]:6789 error -101
[  244.720722][ T5903] libceph: mon0 (1)[c::]:6789 connect error
[  244.735497][T11280] ceph: No mds server is up or the cluster is laggy
[  244.741365][T11283] /dev/nullb0: Can't lookup blockdev
[  244.917511][ T5903] usb 3-1: new high-speed USB device number 21 using dummy_hcd
[  244.991280][   T24] libceph: connect (1)[c::]:6789 error -101
[  245.004972][   T24] libceph: mon0 (1)[c::]:6789 connect error
[  245.107620][ T5903] usb 3-1: Using ep0 maxpacket: 8
[  245.116630][ T5903] usb 3-1: config index 0 descriptor too short (expected 1821, got 853)
[  245.122575][ T5903] usb 3-1: config 0 has an invalid interface number: 103 but max is 2
[  245.126054][ T5903] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  245.132135][ T5903] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 3
[  245.140014][ T5903] usb 3-1: config 0 has no interface number 1
[  245.145157][ T5903] usb 3-1: config 0 interface 103 altsetting 9 endpoint 0x7 has an invalid bInterval 0, changing to 7
[  245.159674][ T5903] usb 3-1: config 0 interface 103 altsetting 9 endpoint 0xE has invalid maxpacket 1024, setting to 64
[  245.164959][ T5903] usb 3-1: config 0 interface 103 altsetting 9 has a duplicate endpoint with address 0x8, skipping
[  245.169577][ T5903] usb 3-1: config 0 interface 103 altsetting 9 has a duplicate endpoint with address 0x4, skipping
[  245.174135][ T5903] usb 3-1: config 0 interface 103 has no altsetting 0
[  245.181468][ T5903] usb 3-1: New USB device found, idVendor=04b4, idProduct=1002, bcdDevice=cd.b4
[  245.188820][ T5903] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  245.192457][ T5903] usb 3-1: Product: syz
[  245.194544][ T5903] usb 3-1: Manufacturer: syz
[  245.196633][ T5903] usb 3-1: SerialNumber: syz
[  245.215624][ T5903] usb 3-1: config 0 descriptor??
[  245.494983][ T5903] videodev: could not get a free minor
[  245.498551][ T5903] dsbr100 3-1:0.0: couldn't register video device
[  245.503176][ T5903] dsbr100 3-1:0.0: probe with driver dsbr100 failed with error -23
[  245.510418][ T5903] usb 3-1: USB disconnect, device number 21
[  246.656213][T11325] tmpfs: Bad value for 'mpol'
[  246.838207][T11332] 9pnet: p9_errstr2errno: server reported unknown error @cDB0xffffffffffffffff
[  246.882952][T11334] loop1: detected capacity change from 0 to 47
[  246.897058][T11334] MINIX-fs: bad superblock
[  247.009274][T11338] loop1: detected capacity change from 0 to 256
[  247.036609][T11338] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[  247.089607][T11338] FAT-fs (loop1): Directory bread(block 64) failed
[  247.092337][T11338] FAT-fs (loop1): Directory bread(block 65) failed
[  247.110378][T11338] FAT-fs (loop1): Directory bread(block 66) failed
[  247.112990][T11338] FAT-fs (loop1): Directory bread(block 67) failed
[  247.117374][T11338] FAT-fs (loop1): Directory bread(block 68) failed
[  247.120171][T11338] FAT-fs (loop1): Directory bread(block 69) failed
[  247.123032][T11338] FAT-fs (loop1): Directory bread(block 70) failed
[  247.125820][T11338] FAT-fs (loop1): Directory bread(block 71) failed
[  247.149799][T11338] FAT-fs (loop1): Directory bread(block 72) failed
[  247.169129][T11338] FAT-fs (loop1): Directory bread(block 73) failed
[  247.204076][T11350] dummy0: mtu less than device minimum
[  247.267116][   T33] audit: type=1326 audit(1756315683.189:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11352 comm="syz.0.2167" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x0
[  247.302369][T11356] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2170'.
[  247.305850][T11356] netlink: 'syz.2.2170': attribute type 1 has an invalid length.
[  247.398929][T11366] loop1: detected capacity change from 0 to 512
[  247.420712][T11366] EXT4-fs: journaled quota format not specified
[  247.505136][T11376] loop1: detected capacity change from 0 to 128
[  247.537760][T11376] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  247.543064][T11376] ext4 filesystem being mounted at /614/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  247.562862][ T5872] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  247.611796][T11383] loop2: detected capacity change from 0 to 128
[  247.621489][T11383] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a842c018, mo2=0002]
[  247.628427][T11383] System zones: 1-3, 19-19, 35-36
[  247.636051][T11383] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  247.669363][T11383] ext4 filesystem being mounted at /618/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  247.694990][ T5873] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  247.805592][T11396] overlayfs: upper fs does not support file handles, falling back to index=off.
[  247.989968][T11410] use of bytesused == 0 is deprecated and will be removed in the future,
[  248.007060][T11410] use the actual size instead.
[  248.228428][ T5931] usb 3-1: new high-speed USB device number 22 using dummy_hcd
[  248.383115][ T5931] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7
[  248.388491][ T5931] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  248.393202][ T5931] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0
[  248.398244][ T5931] usb 3-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94
[  248.402351][ T5931] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  248.411358][ T5931] usb 3-1: config 0 descriptor??
[  248.419762][ T5931] em28xx 3-1:0.0: error: skipping audio endpoint 0x83, because it uses bulk transfers !
[  248.613912][T11421] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2198'.
[  248.672085][ T5903] usb 3-1: USB disconnect, device number 22
[  249.291716][T11436] loop2: detected capacity change from 0 to 128
[  249.657719][T11438] syz.2.2206: attempt to access beyond end of device
[  249.657719][T11438] loop2: rw=2049, sector=145, nr_sectors = 896 limit=128
[  250.177105][ T5931] usb 2-1: new high-speed USB device number 23 using dummy_hcd
[  250.327078][ T5931] usb 2-1: Using ep0 maxpacket: 16
[  250.335300][ T5931] usb 2-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35
[  250.343059][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  250.349626][ T5931] usb 2-1: Product: syz
[  250.351343][ T5931] usb 2-1: Manufacturer: syz
[  250.359332][ T5931] usb 2-1: SerialNumber: syz
[  250.367609][ T5931] usb 2-1: config 0 descriptor??
[  250.384320][ T5931] as10x_usb: device has been detected
[  250.388262][ T5931] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led))
[  250.420431][ T5931] usb 2-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))...
[  250.459501][ T5931] as10x_usb: error during firmware upload part1
[  250.462663][ T5931] Registered device Sky IT Digital Key (green led)
[  250.589057][ T5917] usb 2-1: USB disconnect, device number 23
[  250.629000][ T5917] Unregistered device Sky IT Digital Key (green led)
[  250.632469][ T5917] as10x_usb: device has been disconnected
[  250.952740][T11452] batman_adv: batadv0: Adding interface: dummy0
[  250.955485][T11452] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  250.969717][T11452] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active
[  251.220551][T11466] loop2: detected capacity change from 0 to 8192
[  251.232405][   T33] audit: type=1800 audit(1756315687.159:52): pid=11466 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2219" name="file1" dev="loop2" ino=1048615 res=0 errno=0
[  251.299099][   T33] audit: type=1800 audit(1756315687.229:53): pid=11467 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2219" name="file1" dev="loop2" ino=1048615 res=0 errno=0
[  251.387581][ T5903] usb 2-1: new high-speed USB device number 24 using dummy_hcd
[  251.547869][ T5903] usb 2-1: Using ep0 maxpacket: 16
[  251.553181][ T5903] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping
[  251.556737][ T5903] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[  251.561437][ T5903] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[  251.567959][ T5903] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  251.571996][ T5903] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  251.577386][ T5903] usb 2-1: Product: syz
[  251.579393][ T5903] usb 2-1: Manufacturer: syz
[  251.581440][ T5903] usb 2-1: SerialNumber: syz
[  251.814206][T11462] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2217'.
[  251.827606][ T5903] usb 2-1: 0:2 : does not exist
[  251.856185][ T5903] usb 2-1: USB disconnect, device number 24
[  251.892300][ T5851] udevd[5851]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  253.529607][T11490] loop1: detected capacity change from 0 to 32768
[  253.596598][T11490] bcachefs (loop1): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,erasure_code,degraded=yes,no_splitbrain_check,fsck,norecovery,nojournal_transaction_names,reconstruct_alloc,nocow
[  253.596617][T11490]   allowing incompatible features above 0.0: (unknown version)
[  253.596625][T11490]   features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[  253.616260][T11490] bcachefs (loop1): Using encoding defined by superblock: utf8-12.1.0
[  253.620513][T11490] bcachefs (loop1): recovering from clean shutdown, journal seq 10
[  253.624048][T11490] bcachefs (loop1): Version upgrade required:
[  253.624048][T11490] Version upgrade from 0.24: unwritten_extents to 1.7: mi_btree_bitmap incomplete
[  253.624048][T11490] Doing incompatible version upgrade from 0.24: unwritten_extents to 1.28: inode_has_case_insensitive
[  253.624048][T11490]   running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,check_rebalance_work,set_fs_needs_rebalance
[  253.656728][T11490] bcachefs (loop1): dropping and reconstructing all alloc info
[  253.677816][T11490] bcachefs (loop1): accounting_read... done
[  253.683517][T11490] bcachefs (loop1): alloc_read... done
[  253.686171][T11490] bcachefs (loop1): snapshots_read... done
[  253.686714][T11500] loop2: detected capacity change from 0 to 40427
[  253.689582][T11490] bcachefs (loop1): done starting filesystem
[  253.697756][T11500] F2FS-fs: inline xattr size is out of range: 6 ~ 903
[  253.775056][ T5872] bcachefs (loop1): shutting down
[  253.782120][T11510] loop2: detected capacity change from 0 to 512
[  253.804785][ T5872] bcachefs (loop1): shutdown complete
[  253.814713][T11510] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  253.840064][T11510] ext4 filesystem being mounted at /638/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  253.955001][ T5873] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  254.237000][ T5903] usb 3-1: new high-speed USB device number 23 using dummy_hcd
[  254.390967][ T5903] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac
[  254.394287][ T5903] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  254.398508][ T5903] usb 3-1: Product: syz
[  254.400145][ T5903] usb 3-1: Manufacturer: syz
[  254.402207][ T5903] usb 3-1: SerialNumber: syz
[  254.409088][ T5903] usb 3-1: config 0 descriptor??
[  254.413422][ T5903] gspca_main: sunplus-2.14.0 probing 055f:c230
[  254.917310][T11535] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2245'.
[  255.043644][    T9] usb 3-1: USB disconnect, device number 23
[  255.084878][T11541] binder: 11540:11541 ioctl c0306201 200000000040 returned -14
[  255.342447][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  255.344843][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  255.450776][T11555] loop1: detected capacity change from 0 to 32768
[  255.457273][T11555] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.2254 (11555)
[  255.482125][T11555] BTRFS info (device loop1): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  255.494937][T11555] BTRFS info (device loop1): using sha256 (sha256-lib) checksum algorithm
[  255.541018][T11555] BTRFS info (device loop1): enabling ssd optimizations
[  255.543812][T11555] BTRFS info (device loop1): enabling free space tree
[  255.554083][T11587] /dev/nullb0: Can't lookup blockdev
[  255.625171][ T5872] BTRFS info (device loop1): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  255.826637][T11605] netlink: 'syz.1.2270': attribute type 29 has an invalid length.
[  255.840757][T11605] netlink: 'syz.1.2270': attribute type 29 has an invalid length.
[  255.885949][T11609] genirq: Flags mismatch irq 4. 00200000 (pcl818) vs. 00200080 (ttyS0)
[  256.253768][T11615] loop1: detected capacity change from 0 to 40427
[  256.260238][T11615] F2FS-fs (loop1): invalid crc value
[  256.338383][T11615] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[  256.342745][T11615] F2FS-fs (loop1): Start checkpoint disabled!
[  256.355078][T11615] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6
[  256.402286][ T1118] kworker/u10:9: attempt to access beyond end of device
[  256.402286][ T1118] loop1: rw=2049, sector=40960, nr_sectors = 16 limit=40427
[  256.413803][ T1118] CPU: 1 UID: 0 PID: 1118 Comm: kworker/u10:9 Not tainted syzkaller #0 PREEMPT(full) 
[  256.413822][ T1118] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  256.413829][ T1118] Workqueue: writeback wb_workfn (flush-7:1)
[  256.413849][ T1118] Call Trace:
[  256.413854][ T1118]  <TASK>
[  256.413860][ T1118]  dump_stack_lvl+0x189/0x250
[  256.413877][ T1118]  ? __pfx_dump_stack_lvl+0x10/0x10
[  256.413896][ T1118]  ? __pfx_queue_work_on+0x10/0x10
[  256.413907][ T1118]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  256.413922][ T1118]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  256.413943][ T1118]  f2fs_handle_critical_error+0x37c/0x540
[  256.413963][ T1118]  f2fs_write_end_io+0x886/0xb60
[  256.413986][ T1118]  __submit_merged_bio+0x27a/0x6a0
[  256.414000][ T1118]  ? up_write+0x1c4/0x420
[  256.414015][ T1118]  __submit_merged_write_cond+0x44c/0x530
[  256.414034][ T1118]  f2fs_sync_node_pages+0x1479/0x15e0
[  256.414061][ T1118]  ? __pfx_f2fs_sync_node_pages+0x10/0x10
[  256.414074][ T1118]  ? __percpu_counter_sum+0x1c2/0x1e0
[  256.414108][ T1118]  ? do_raw_spin_lock+0x121/0x290
[  256.414122][ T1118]  ? rcu_is_watching+0x15/0xb0
[  256.414133][ T1118]  ? blk_start_plug+0x52/0x1b0
[  256.414148][ T1118]  f2fs_write_node_pages+0x303/0x6e0
[  256.414166][ T1118]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  256.414186][ T1118]  ? rcu_is_watching+0x15/0xb0
[  256.414198][ T1118]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  256.414212][ T1118]  do_writepages+0x32e/0x550
[  256.414230][ T1118]  ? reacquire_held_locks+0x127/0x1d0
[  256.414240][ T1118]  ? writeback_sb_inodes+0x384/0x1010
[  256.414259][ T1118]  __writeback_single_inode+0x145/0xff0
[  256.414273][ T1118]  ? do_raw_spin_unlock+0x4d/0x240
[  256.414289][ T1118]  writeback_sb_inodes+0x6c7/0x1010
[  256.414301][ T1118]  ? lockdep_hardirqs_on+0x9c/0x150
[  256.414361][ T1118]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  256.414402][ T1118]  ? rcu_is_watching+0x15/0xb0
[  256.414419][ T1118]  wb_writeback+0x43b/0xaf0
[  256.414438][ T1118]  ? queue_io+0x3d1/0x590
[  256.414453][ T1118]  ? __pfx_wb_writeback+0x10/0x10
[  256.414472][ T1118]  ? _raw_spin_unlock_irq+0x23/0x50
[  256.414489][ T1118]  wb_workfn+0x409/0xef0
[  256.414509][ T1118]  ? __pfx_wb_workfn+0x10/0x10
[  256.414524][ T1118]  ? __lock_acquire+0xab9/0xd20
[  256.414547][ T1118]  ? process_scheduled_works+0x9ef/0x17b0
[  256.414561][ T1118]  ? _raw_spin_unlock_irq+0x23/0x50
[  256.414573][ T1118]  ? process_scheduled_works+0x9ef/0x17b0
[  256.414583][ T1118]  ? process_scheduled_works+0x9ef/0x17b0
[  256.414595][ T1118]  process_scheduled_works+0xae1/0x17b0
[  256.414625][ T1118]  ? __pfx_process_scheduled_works+0x10/0x10
[  256.414647][ T1118]  worker_thread+0x8a0/0xda0
[  256.414660][ T1118]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  256.414679][ T1118]  ? __kthread_parkme+0x7b/0x200
[  256.414697][ T1118]  kthread+0x711/0x8a0
[  256.414712][ T1118]  ? __pfx_worker_thread+0x10/0x10
[  256.414722][ T1118]  ? __pfx_kthread+0x10/0x10
[  256.414736][ T1118]  ? _raw_spin_unlock_irq+0x23/0x50
[  256.414748][ T1118]  ? lockdep_hardirqs_on+0x9c/0x150
[  256.414761][ T1118]  ? __pfx_kthread+0x10/0x10
[  256.414774][ T1118]  ret_from_fork+0x3fc/0x770
[  256.414788][ T1118]  ? __pfx_ret_from_fork+0x10/0x10
[  256.414803][ T1118]  ? __switch_to_asm+0x39/0x70
[  256.414815][ T1118]  ? __switch_to_asm+0x33/0x70
[  256.414827][ T1118]  ? __pfx_kthread+0x10/0x10
[  256.414840][ T1118]  ret_from_fork_asm+0x1a/0x30
[  256.414864][ T1118]  </TASK>
[  256.414868][ T1118] F2FS-fs (loop1): Stopped filesystem due to reason: 3
[  256.546188][ T1118] CPU: 1 UID: 0 PID: 1118 Comm: kworker/u10:9 Not tainted syzkaller #0 PREEMPT(full) 
[  256.546199][ T1118] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  256.546204][ T1118] Workqueue: writeback wb_workfn (flush-7:1)
[  256.546218][ T1118] Call Trace:
[  256.546221][ T1118]  <TASK>
[  256.546225][ T1118]  dump_stack_lvl+0x189/0x250
[  256.546237][ T1118]  ? __pfx_dump_stack_lvl+0x10/0x10
[  256.546246][ T1118]  ? __pfx_queue_work_on+0x10/0x10
[  256.546253][ T1118]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  256.546262][ T1118]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  256.546276][ T1118]  f2fs_handle_critical_error+0x37c/0x540
[  256.546289][ T1118]  f2fs_write_end_io+0x886/0xb60
[  256.546304][ T1118]  __submit_merged_bio+0x27a/0x6a0
[  256.546579][ T1118]  ? up_write+0x1c4/0x420
[  256.546591][ T1118]  __submit_merged_write_cond+0x44c/0x530
[  256.546604][ T1118]  f2fs_sync_node_pages+0x1479/0x15e0
[  256.546622][ T1118]  ? __pfx_f2fs_sync_node_pages+0x10/0x10
[  256.546631][ T1118]  ? __percpu_counter_sum+0x1c2/0x1e0
[  256.546653][ T1118]  ? do_raw_spin_lock+0x121/0x290
[  256.546662][ T1118]  ? rcu_is_watching+0x15/0xb0
[  256.546670][ T1118]  ? blk_start_plug+0x52/0x1b0
[  256.546681][ T1118]  f2fs_write_node_pages+0x303/0x6e0
[  256.546693][ T1118]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  256.546705][ T1118]  ? rcu_is_watching+0x15/0xb0
[  256.546713][ T1118]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  256.546722][ T1118]  do_writepages+0x32e/0x550
[  256.546735][ T1118]  ? reacquire_held_locks+0x127/0x1d0
[  256.546742][ T1118]  ? writeback_sb_inodes+0x384/0x1010
[  256.546755][ T1118]  __writeback_single_inode+0x145/0xff0
[  256.546763][ T1118]  ? do_raw_spin_unlock+0x4d/0x240
[  256.546774][ T1118]  writeback_sb_inodes+0x6c7/0x1010
[  256.546782][ T1118]  ? lockdep_hardirqs_on+0x9c/0x150
[  256.546803][ T1118]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  256.546848][ T1118]  ? rcu_is_watching+0x15/0xb0
[  256.546861][ T1118]  wb_writeback+0x43b/0xaf0
[  256.546874][ T1118]  ? queue_io+0x3d1/0x590
[  256.546888][ T1118]  ? __pfx_wb_writeback+0x10/0x10
[  256.546901][ T1118]  ? _raw_spin_unlock_irq+0x23/0x50
[  256.546912][ T1118]  wb_workfn+0x409/0xef0
[  256.546927][ T1118]  ? __pfx_wb_workfn+0x10/0x10
[  256.546937][ T1118]  ? __lock_acquire+0xab9/0xd20
[  256.546951][ T1118]  ? process_scheduled_works+0x9ef/0x17b0
[  256.546962][ T1118]  ? _raw_spin_unlock_irq+0x23/0x50
[  256.546969][ T1118]  ? process_scheduled_works+0x9ef/0x17b0
[  256.546975][ T1118]  ? process_scheduled_works+0x9ef/0x17b0
[  256.546983][ T1118]  process_scheduled_works+0xae1/0x17b0
[  256.547004][ T1118]  ? __pfx_process_scheduled_works+0x10/0x10
[  256.547019][ T1118]  worker_thread+0x8a0/0xda0
[  256.547027][ T1118]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  256.547040][ T1118]  ? __kthread_parkme+0x7b/0x200
[  256.547052][ T1118]  kthread+0x711/0x8a0
[  256.547062][ T1118]  ? __pfx_worker_thread+0x10/0x10
[  256.547069][ T1118]  ? __pfx_kthread+0x10/0x10
[  256.547078][ T1118]  ? _raw_spin_unlock_irq+0x23/0x50
[  256.547086][ T1118]  ? lockdep_hardirqs_on+0x9c/0x150
[  256.547095][ T1118]  ? __pfx_kthread+0x10/0x10
[  256.547103][ T1118]  ret_from_fork+0x3fc/0x770
[  256.547113][ T1118]  ? __pfx_ret_from_fork+0x10/0x10
[  256.547123][ T1118]  ? __switch_to_asm+0x39/0x70
[  256.547131][ T1118]  ? __switch_to_asm+0x33/0x70
[  256.547139][ T1118]  ? __pfx_kthread+0x10/0x10
[  256.547148][ T1118]  ret_from_fork_asm+0x1a/0x30
[  256.547164][ T1118]  </TASK>
[  256.711923][ T1118] F2FS-fs (loop1): Stopped filesystem due to reason: 3
[  257.298648][T11651] tmpfs: Bad value for 'mpol'
[  257.413169][T11661] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  257.967371][ T5931] usb 2-1: new high-speed USB device number 25 using dummy_hcd
[  258.118776][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  258.122689][ T5931] usb 2-1: New USB device found, idVendor=054c, idProduct=0ba0, bcdDevice= 0.00
[  258.125981][ T5931] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  258.131647][ T5931] usb 2-1: config 0 descriptor??
[  258.373749][T11681] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2303'.
[  258.381891][T11681] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  258.407809][T11681] batman_adv: batadv0: Removing interface: batadv_slave_1
[  258.546519][ T5931] playstation 0003:054C:0BA0.0009: unknown main item tag 0x0
[  258.553823][ T5931] playstation 0003:054C:0BA0.0009: hidraw0: USB HID v0.00 Device [HID 054c:0ba0] on usb-dummy_hcd.1-1/input0
[  258.745420][ T5931] playstation 0003:054C:0BA0.0009: Invalid reportID received, expected 18 got 158
[  258.751382][ T5931] playstation 0003:054C:0BA0.0009: Failed to retrieve DualShock4 pairing info: -22
[  258.757661][ T5931] playstation 0003:054C:0BA0.0009: Failed to get MAC address from DualShock4
[  258.762328][ T5931] playstation 0003:054C:0BA0.0009: Failed to create dualshock4.
[  258.771000][ T5931] playstation 0003:054C:0BA0.0009: probe with driver playstation failed with error -22
[  258.803451][T11706] loop2: detected capacity change from 0 to 128
[  258.813213][T11706] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  258.820812][T11706] ext4 filesystem being mounted at /658/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  258.949556][ T5931] usb 2-1: USB disconnect, device number 25
[  259.629717][T11733] loop1: detected capacity change from 0 to 512
[  259.633522][T11733] EXT4-fs (loop1): Test dummy encryption mode enabled
[  259.636341][T11733] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode
[  259.643670][T11733] EXT4-fs (loop1): 1 truncate cleaned up
[  259.647868][T11733] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  259.744809][ T5873] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  259.797404][T11733] fscrypt: AES-256-XTS using implementation "xts(ecb(aes-fixed-time))"
[  259.806221][T11740] fscrypt: AES-256-CBC-CTS using implementation "cts(cbc(ecb(aes-fixed-time)))"
[  259.858115][ T5872] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  260.431809][ T5879] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!
[  260.642342][T11811] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2357'.
[  260.914995][   T33] audit: type=1326 audit(1756315696.829:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11813 comm="syz.0.2358" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x0
[  261.551896][T11830] netlink: 'syz.1.2363': attribute type 11 has an invalid length.
[  261.616127][T11832] loop1: detected capacity change from 0 to 2048
[  261.622379][T11832] NILFS (loop1): broken superblock, retrying with spare superblock (blocksize = 1024)
[  261.635140][T11835] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  261.647557][T11832] kAFS: unable to lookup cell '̅?ۛkմ]-״8ވ>~OC1sߘi?Ϯaya<C'
[  261.885696][T11849] loop1: detected capacity change from 0 to 128
[  261.893724][T11849] qnx6: unable to set blocksize
[  262.328239][   T33] audit: type=1326 audit(1756315698.249:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11826 comm="syz.2.2362" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b8cd8ebe9 code=0x7fc00000
[  263.546915][ T5910] usb 2-1: new high-speed USB device number 26 using dummy_hcd
[  263.713332][ T5910] usb 2-1: Using ep0 maxpacket: 32
[  263.726217][ T5910] usb 2-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92
[  263.729479][ T5910] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  263.735582][ T5910] usb 2-1: config 0 descriptor??
[  263.741066][ T5910] gspca_main: nw80x-2.14.0 probing 055f:d001
[  263.835753][T11915] 9pnet_fd: p9_fd_create_tcp (11915): problem connecting socket to 127.0.0.1
[  264.040112][ T5910] gspca_nw80x: reg_w err -71
[  264.042082][ T5910] nw80x 2-1:0.0: probe with driver nw80x failed with error -71
[  264.045709][ T5910] usb 2-1: USB disconnect, device number 26
[  264.857603][    C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!
[  265.231295][T11948] overlayfs: failed to clone upperpath
[  265.723802][T11967] overlayfs: failed to clone upperpath
[  266.461862][T11984] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2427'.
[  266.508077][T11988] syzkaller1: entered allmulticast mode
[  266.805027][T11990] loop1: detected capacity change from 0 to 32768
[  266.834778][T11990] XFS (loop1): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  266.853298][T11990] XFS (loop1): Ending clean mount
[  266.873640][T11990] XFS (loop1): Quotacheck needed: Please wait.
[  266.899370][T11990] XFS (loop1): Quotacheck: Done.
[  266.937056][ T5872] XFS (loop1): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  267.330703][T12029] netlink: 'syz.2.2444': attribute type 4 has an invalid length.
[  267.334317][T12029] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2444'.
[  267.434628][T12041] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2449'.
[  267.719366][T12047] netlink: 'syz.0.2448': attribute type 1 has an invalid length.
[  269.138168][T12082] openvswitch: netlink: Message has 4 unknown bytes.
[  269.691648][T12107] loop1: detected capacity change from 0 to 128
[  270.107671][T12112] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2479'.
[  270.111390][T12112] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2479'.
[  270.685156][T12135] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2489'.
[  270.803720][   T33] audit: type=1326 audit(1756315706.729:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12145 comm="syz.0.2494" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  270.833488][   T33] audit: type=1326 audit(1756315706.729:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12145 comm="syz.0.2494" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  270.843584][   T33] audit: type=1326 audit(1756315706.749:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12145 comm="syz.0.2494" exe="/syz-executor" sig=0 arch=c000003e syscall=155 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  270.866932][   T33] audit: type=1326 audit(1756315706.749:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12145 comm="syz.0.2494" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  271.099296][T12175] loop1: detected capacity change from 0 to 64
[  271.654923][T12200] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  271.658211][T12200] IPv6: NLM_F_CREATE should be set when creating new route
[  271.661429][T12200] IPv6: NLM_F_CREATE should be set when creating new route
[  271.829374][T12202] loop1: detected capacity change from 0 to 32768
[  271.832264][T12202] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.2520 (12202)
[  271.837475][T12202] BTRFS info (device loop1): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  271.840497][T12202] BTRFS info (device loop1): using sha256 (sha256-lib) checksum algorithm
[  271.903868][T12202] BTRFS info (device loop1): rebuilding free space tree
[  271.917637][T12202] BTRFS info (device loop1): enabling ssd optimizations
[  271.920058][T12202] BTRFS info (device loop1): turning on sync discard
[  271.922444][T12202] BTRFS info (device loop1): enabling free space tree
[  271.926904][T12202] BTRFS info (device loop1): force clearing of disk cache
[  271.929484][T12202] BTRFS info (device loop1): enabling auto defrag
[  271.931657][T12202] BTRFS info (device loop1): max_inline set to 0
[  272.006336][ T5872] BTRFS info (device loop1): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  272.205929][T12236] cgroup: Bad value for 'name'
[  273.368163][T12267] Process accounting resumed
[  273.897247][    C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!
[  274.362490][    C0] vcan0: j1939_tp_rxtimer: 0xffff888031000c00: rx timeout, send abort
[  274.867925][    C0] vcan0: j1939_tp_rxtimer: 0xffff888031000c00: abort rx timeout. Force session deactivation
[  275.062789][T12307] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2562'.
[  275.066494][T12307] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2562'.
[  275.765623][T12330] tipc: Started in network mode
[  275.768205][T12330] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711
[  275.771517][T12330] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb
[  275.775062][T12330] tipc: Enabled bearer <udp:syz0>, priority 10
[  276.897290][ T5903] tipc: Node number set to 1
[  277.261773][T12360] netlink: 129704 bytes leftover after parsing attributes in process `syz.0.2587'.
[  278.295762][ T5903] usb 2-1: new high-speed USB device number 27 using dummy_hcd
[  278.450617][ T5903] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33
[  278.454007][ T5903] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  278.462019][ T5903] usb 2-1: config 0 descriptor??
[  278.670618][ T5903] usb 2-1: Cannot read MAC address
[  278.673076][ T5903] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71
[  278.679510][ T5903] usb 2-1: USB disconnect, device number 27
[  279.996944][ T5910] usb 2-1: new low-speed USB device number 28 using dummy_hcd
[  280.162343][ T5910] usb 2-1: config 32 has 1 interface, different from the descriptor's value: 2
[  280.167572][ T5910] usb 2-1: config 32 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  280.172140][ T5910] usb 2-1: config 32 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  280.176010][ T5910] usb 2-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7
[  280.182317][ T5910] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  280.403364][ T5910] usb 2-1: string descriptor 0 read error: -71
[  280.437067][ T5910] usb 2-1: USB disconnect, device number 28
[  280.902334][T12451] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2626'.
[  281.089453][T12455] overlay: Unknown parameter '\'
[  281.326020][T12468] kAFS: No cell specified
[  281.925028][T12506] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2650'.
[  282.094483][T12512] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2653'.
[  282.874838][T12526] netlink: 'syz.1.2655': attribute type 9 has an invalid length.
[  282.878690][T12526] netlink: 'syz.1.2655': attribute type 7 has an invalid length.
[  282.882038][T12526] netlink: 'syz.1.2655': attribute type 8 has an invalid length.
[  283.192389][T12538] mmap: syz.2.2661 (12538): VmData 175878144 exceed data ulimit 5. Update limits or use boot option ignore_rlimit_data.
[  283.523644][T12542] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2663'.
[  283.528020][T12542] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2663'.
[  284.465689][T12573] netlink: 'syz.2.2678': attribute type 1 has an invalid length.
[  284.741476][T12594] 8021q: adding VLAN 0 to HW filter on device ipvlan2
[  284.891813][T12606] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2694'.
[  284.896981][T12606] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2694'.
[  285.297084][ T5903] usb 2-1: new high-speed USB device number 29 using dummy_hcd
[  285.655077][ T5903] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  285.658580][ T5903] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2
[  285.663478][ T5903] usb 2-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5
[  285.667246][ T5903] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  285.670363][ T5903] usb 2-1: Product: syz
[  285.671930][ T5903] usb 2-1: Manufacturer: syz
[  285.673502][ T5903] usb 2-1: SerialNumber: syz
[  285.676469][ T5903] usb 2-1: config 0 descriptor??
[  285.890323][ T5903] usb 2-1: USB disconnect, device number 29
[  286.280682][T12646] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2712'.
[  286.366466][T12652] bond0: (slave bond_slave_1): Releasing backup interface
[  286.673050][T12666] loop1: detected capacity change from 0 to 40427
[  286.675994][T12666] F2FS-fs (loop1): Invalid Fs Meta Ino: node(1) meta(2) root(0)
[  286.678727][T12666] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock
[  286.681907][T12666] F2FS-fs (loop1): build fault injection rate: 18446
[  286.685060][T12666] F2FS-fs (loop1): invalid crc value
[  286.725158][T12666] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[  286.738574][T12666] F2FS-fs (loop1): Start checkpoint disabled!
[  286.742629][T12666] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0
[  286.744935][T12666] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6
[  286.762245][   T52] kworker/u9:2: attempt to access beyond end of device
[  286.762245][   T52] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  286.767558][   T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full) 
[  286.767570][   T52] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  286.767575][   T52] Workqueue: writeback wb_workfn (flush-7:1)
[  286.767589][   T52] Call Trace:
[  286.767592][   T52]  <TASK>
[  286.767595][   T52]  dump_stack_lvl+0x189/0x250
[  286.767608][   T52]  ? __pfx_dump_stack_lvl+0x10/0x10
[  286.767616][   T52]  ? __pfx_queue_work_on+0x10/0x10
[  286.767624][   T52]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  286.767633][   T52]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  286.767647][   T52]  f2fs_handle_critical_error+0x37c/0x540
[  286.767660][   T52]  f2fs_write_end_io+0x886/0xb60
[  286.767675][   T52]  __submit_merged_bio+0x27a/0x6a0
[  286.767687][   T52]  __submit_merged_write_cond+0x255/0x530
[  286.767700][   T52]  f2fs_write_data_pages+0x261d/0x3000
[  286.767725][   T52]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  286.767741][   T52]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[  286.767763][   T52]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[  286.767773][   T52]  ? look_up_lock_class+0x74/0x170
[  286.767788][   T52]  ? trace_f2fs_writepages+0x7f/0x200
[  286.767798][   T52]  ? f2fs_write_node_pages+0x478/0x6e0
[  286.767810][   T52]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  286.767825][   T52]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  286.767836][   T52]  do_writepages+0x32e/0x550
[  286.767848][   T52]  ? reacquire_held_locks+0x127/0x1d0
[  286.767856][   T52]  ? writeback_sb_inodes+0x384/0x1010
[  286.767868][   T52]  __writeback_single_inode+0x145/0xff0
[  286.767877][   T52]  ? do_raw_spin_unlock+0x4d/0x240
[  286.767890][   T52]  writeback_sb_inodes+0x6c7/0x1010
[  286.767921][   T52]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  286.767961][   T52]  ? rcu_is_watching+0x15/0xb0
[  286.767973][   T52]  wb_writeback+0x43b/0xaf0
[  286.767985][   T52]  ? queue_io+0x3d1/0x590
[  286.767995][   T52]  ? __pfx_wb_writeback+0x10/0x10
[  286.768035][   T52]  ? _raw_spin_unlock_irq+0x23/0x50
[  286.768054][   T52]  wb_workfn+0x409/0xef0
[  286.768078][   T52]  ? __pfx_wb_workfn+0x10/0x10
[  286.768093][   T52]  ? __lock_acquire+0xab9/0xd20
[  286.768108][   T52]  ? process_scheduled_works+0x9ef/0x17b0
[  286.768118][   T52]  ? _raw_spin_unlock_irq+0x23/0x50
[  286.768126][   T52]  ? process_scheduled_works+0x9ef/0x17b0
[  286.768132][   T52]  ? process_scheduled_works+0x9ef/0x17b0
[  286.768139][   T52]  process_scheduled_works+0xae1/0x17b0
[  286.768159][   T52]  ? __pfx_process_scheduled_works+0x10/0x10
[  286.768174][   T52]  worker_thread+0x8a0/0xda0
[  286.768186][   T52]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  286.768206][   T52]  ? __kthread_parkme+0x7b/0x200
[  286.768226][   T52]  kthread+0x711/0x8a0
[  286.768238][   T52]  ? __pfx_worker_thread+0x10/0x10
[  286.768245][   T52]  ? __pfx_kthread+0x10/0x10
[  286.768254][   T52]  ? _raw_spin_unlock_irq+0x23/0x50
[  286.768262][   T52]  ? lockdep_hardirqs_on+0x9c/0x150
[  286.768270][   T52]  ? __pfx_kthread+0x10/0x10
[  286.768279][   T52]  ret_from_fork+0x3fc/0x770
[  286.768288][   T52]  ? __pfx_ret_from_fork+0x10/0x10
[  286.768298][   T52]  ? __switch_to_asm+0x39/0x70
[  286.768306][   T52]  ? __switch_to_asm+0x33/0x70
[  286.768317][   T52]  ? __pfx_kthread+0x10/0x10
[  286.768330][   T52]  ret_from_fork_asm+0x1a/0x30
[  286.768358][   T52]  </TASK>
[  286.768363][   T52] F2FS-fs (loop1): Stopped filesystem due to reason: 3
[  289.305126][T12727] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2748'.
[  289.434775][T12738] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  289.551058][T12750] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2760'.
[  290.543157][    C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!
[  290.559183][T12779] pim6reg: entered allmulticast mode
[  290.565012][T12779] pim6reg: left allmulticast mode
[  290.677525][T12781] loop1: detected capacity change from 0 to 4096
[  290.680708][T12781] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512).
[  290.698399][T12781] ntfs3(loop1): Mark volume as dirty due to NTFS errors
[  290.701129][T12781] ntfs3(loop1): ino=1a, mi_enum_attr
[  290.704177][T12781] ntfs3(loop1): Failed to initialize $Extend/$ObjId.
[  290.727536][T12781] ntfs3(loop1): ino=5, "/" ntfs_readdir
[  290.935649][T12801] dlm: plock device version mismatch: kernel (1.2.0), user (1.4.8)
[  292.961372][T12853] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2805'.
[  294.709464][T12904] tmpfs: Unknown parameter 'no'
[  294.987188][    T9] usb 2-1: new high-speed USB device number 30 using dummy_hcd
[  295.156969][    T9] usb 2-1: Using ep0 maxpacket: 8
[  295.162344][    T9] usb 2-1: config 4 has an invalid interface number: 244 but max is 0
[  295.166415][    T9] usb 2-1: config 4 has no interface number 0
[  295.169808][    T9] usb 2-1: config 4 interface 244 altsetting 1 endpoint 0x1 has an invalid bInterval 41, changing to 7
[  295.174338][    T9] usb 2-1: config 4 interface 244 altsetting 1 endpoint 0x2 has invalid wMaxPacketSize 0
[  295.179042][    T9] usb 2-1: config 4 interface 244 has no altsetting 0
[  295.188669][    T9] usb 2-1: New USB device found, idVendor=05ac, idProduct=fa33, bcdDevice=cb.aa
[  295.197028][    T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  295.200348][    T9] usb 2-1: Product: syz
[  295.202120][    T9] usb 2-1: Manufacturer: syz
[  295.204244][    T9] usb 2-1: SerialNumber: syz
[  295.246667][T12925] netlink: 'syz.0.2835': attribute type 1 has an invalid length.
[  295.725128][    T9] ipheth 2-1:4.244: Unable to find endpoints
[  295.737116][    T9] usb 2-1: USB disconnect, device number 30
[  296.209120][   T33] audit: type=1800 audit(1756315732.139:60): pid=12956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2848" name="file1" dev="tmpfs" ino=4534 res=0 errno=0
[  296.987071][   T33] audit: type=1326 audit(1756315732.889:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12994 comm="syz.2.2866" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b8cd8ebe9 code=0x7ffc0000
[  297.011548][   T33] audit: type=1326 audit(1756315732.889:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12994 comm="syz.2.2866" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b8cd8ebe9 code=0x7ffc0000
[  297.038786][   T33] audit: type=1326 audit(1756315732.899:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12994 comm="syz.2.2866" exe="/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7f5b8cd8ebe9 code=0x7ffc0000
[  297.072474][   T33] audit: type=1326 audit(1756315732.899:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12994 comm="syz.2.2866" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5b8cd8ebe9 code=0x7ffc0000
[  297.330105][T13011] netlink: 'syz.1.2874': attribute type 10 has an invalid length.
[  297.333885][T13011] team0: Port device wlan1 added
[  298.006000][T13045] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant.
[  298.006000][T13045] The task syz.1.2890 (13045) triggered the difference, watch for misbehavior.
[  298.909515][T13055] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration
[  299.269856][T13062] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  299.509590][T13080] futex_wake_op: syz.2.2906 tries to shift op by -1; fix this program
[  299.551689][   T24] libceph: connect (1)[c::]:6789 error -101
[  299.554342][   T24] libceph: mon0 (1)[c::]:6789 connect error
[  299.595196][T13082] ceph: No mds server is up or the cluster is laggy
[  299.943384][T13110] loop1: detected capacity change from 0 to 64
[  301.174053][T13145] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2936'.
[  301.206470][T13149] Option '    ' to dns_resolver key: bad/missing value
[  301.682283][T13169] loop1: detected capacity change from 0 to 32768
[  302.363357][T13190] loop1: detected capacity change from 0 to 32768
[  302.369126][T13190] (syz.1.2957,13190,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  302.374808][T13190] (syz.1.2957,13190,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  302.385917][T13190] JBD2: Ignoring recovery information on journal
[  302.413531][T13190] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  302.444250][T13196] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2958'.
[  302.477174][T13196] syz_tun (unregistering): left allmulticast mode
[  302.486079][ T5872] ocfs2: Unmounting device (7,1) on (node local)
[  302.908068][T13214] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2966'.
[  302.939683][T13216] netlink: 'syz.2.2967': attribute type 12 has an invalid length.
[  302.939918][T13214] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2966'.
[  303.155983][T13221] overlayfs: failed to clone upperpath
[  303.236053][T13226] loop1: detected capacity change from 0 to 512
[  303.243350][T13226] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem
[  303.256174][T13226] EXT4-fs (loop1): orphan cleanup on readonly fs
[  303.262519][T13226] EXT4-fs error (device loop1): mb_free_blocks:2017: group 0, inode 11: block 64:freeing already freed block (bit 63); block bitmap corrupt.
[  303.271816][T13226] EXT4-fs (loop1): Remounting filesystem read-only
[  303.275174][T13226] EXT4-fs (loop1): 1 truncate cleaned up
[  303.282440][T13226] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none.
[  303.316567][ T5872] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  303.683571][T13244] ieee802154 phy0 wpan0: encryption failed: -22
[  304.486790][T13266] loop1: detected capacity change from 0 to 32768
[  304.492527][T13266] (syz.1.2989,13266,1):ocfs2_check_dir_entry:325 ERROR: bad entry in directory #66: rec_len is too small for name_len - offset=132, inode=71, rec_len=16, name_len=13
[  304.501795][T13266] (syz.1.2989,13266,1):ocfs2_init_global_system_inodes:465 ERROR: status = -22
[  304.505664][T13266] (syz.1.2989,13266,1):ocfs2_init_global_system_inodes:467 ERROR: Unable to load system inode 4, possibly corrupt fs?
[  304.505683][T13266] (syz.1.2989,13266,1):ocfs2_init_global_system_inodes:476 ERROR: status = -22
[  304.515108][T13266] (syz.1.2989,13266,1):ocfs2_initialize_super:2198 ERROR: status = -22
[  304.520451][T13266] (syz.1.2989,13266,1):ocfs2_fill_super:1177 ERROR: status = -22
[  306.747701][T13306] overlayfs: failed to clone upperpath
[  307.734726][T13325] PKCS7: Unknown OID: [5] (bad)
[  307.737072][T13325] PKCS7: Only support pkcs7_signedData type
[  307.991386][T13338] loop1: detected capacity change from 0 to 32768
[  307.998031][T13338] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.3018 (13338)
[  308.006507][T13338] BTRFS info (device loop1): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  308.010626][T13338] BTRFS info (device loop1): using sha256 (sha256-lib) checksum algorithm
[  308.056875][T13338] BTRFS info (device loop1): rebuilding free space tree
[  308.063091][T13338] BTRFS info (device loop1): enabling ssd optimizations
[  308.065741][T13338] BTRFS info (device loop1): turning on sync discard
[  308.083317][T13338] BTRFS info (device loop1): enabling free space tree
[  308.085669][T13338] BTRFS info (device loop1): force clearing of disk cache
[  308.089598][T13338] BTRFS info (device loop1): enabling auto defrag
[  308.091746][T13338] BTRFS info (device loop1): doing ref verification
[  308.094100][T13338] BTRFS info (device loop1): max_inline set to 0
[  308.167430][ T5872] BTRFS info (device loop1): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  308.470603][T13397] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3040'.
[  308.574319][T13395] loop1: detected capacity change from 0 to 32768
[  308.581683][T13395] (syz.1.3039,13395,0):ocfs2_initialize_super:2093 ERROR: couldn't mount RDWR because of unsupported optional features (ffffff00).
[  308.586605][T13395] (syz.1.3039,13395,0):ocfs2_fill_super:1177 ERROR: status = -22
[  308.708258][T13413] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3048'.
[  310.011593][T13447] netlink: 136 bytes leftover after parsing attributes in process `syz.0.3061'.
[  310.272413][T13453] netlink: 248 bytes leftover after parsing attributes in process `syz.2.3064'.
[  310.277410][T13453] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3064'.
[  310.366986][T13457] IPVS: sh: UDP 224.0.0.2:0 - no destination available
[  310.589875][T13470] loop1: detected capacity change from 0 to 32768
[  310.607246][T13470] jfs_lookup: iget failed on inum 4
[  310.609858][T13470] jfs_lookup: iget failed on inum 4
[  310.997728][T13502] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3080'.
[  311.005054][T13504] netlink: 'syz.2.3088': attribute type 2 has an invalid length.
[  311.007573][T13504] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3088'.
[  311.010645][T13504] nbd: must specify a device to reconfigure
[  311.088285][T13507] IPVS: fo: SCTP 172.20.20.187:0 - no destination available
[  312.060499][T13539] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  312.245727][T13553] bridge_slave_0: invalid flags given to default FDB implementation
[  312.594120][   T33] audit: type=1326 audit(1756316004.422:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  312.644045][   T33] audit: type=1326 audit(1756316004.422:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  312.652876][   T33] audit: type=1326 audit(1756316004.432:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  312.662075][   T33] audit: type=1326 audit(1756316004.432:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  312.670174][   T33] audit: type=1326 audit(1756316004.432:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  312.683888][   T33] audit: type=1326 audit(1756316004.432:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  312.691607][   T33] audit: type=1326 audit(1756316004.432:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  312.725081][   T33] audit: type=1326 audit(1756316004.442:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  312.733112][   T33] audit: type=1326 audit(1756316004.442:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=59 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  312.752320][   T33] audit: type=1326 audit(1756316004.452:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13550 comm="syz.0.3107" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  313.209938][T13579] overlayfs: failed to clone upperpath
[  314.163250][   T24] usb 2-1: new high-speed USB device number 31 using dummy_hcd
[  314.366635][   T24] usb 2-1: config 0 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 129, changing to 11
[  314.371337][   T24] usb 2-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0
[  314.375817][   T24] usb 2-1: config 0 interface 0 has no altsetting 0
[  314.378654][   T24] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00
[  314.382473][   T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  314.388555][   T24] usb 2-1: config 0 descriptor??
[  314.465236][T13644] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3149'.
[  314.511535][T13648] netlink: 'syz.2.3151': attribute type 1 has an invalid length.
[  314.515604][T13648] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3151'.
[  314.520396][T13650] tipc: Enabled bearer <eth:batadv0>, priority 10
[  314.548873][T13652] dummy0: entered allmulticast mode
[  314.553782][T13652] dummy0: left allmulticast mode
[  314.810631][   T24] kovaplus 0003:1E7D:2D50.000A: unknown main item tag 0x0
[  314.819349][   T24] kovaplus 0003:1E7D:2D50.000A: unknown main item tag 0x0
[  314.821772][   T24] kovaplus 0003:1E7D:2D50.000A: unknown main item tag 0x0
[  314.827504][   T24] kovaplus 0003:1E7D:2D50.000A: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.1-1/input0
[  315.016573][   T24] usb 2-1: USB disconnect, device number 31
[  315.570483][T13705] loop1: detected capacity change from 0 to 128
[  315.577155][T13705] EXT4-fs (loop1): Test dummy encryption mode enabled
[  315.587530][T13705] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  315.597355][T13705] ext4 filesystem being mounted at /854/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  315.645893][ T5872] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  315.687419][T13714] loop1: detected capacity change from 0 to 128
[  316.777856][ T1364] ieee802154 phy0 wpan0: encryption failed: -22
[  316.780554][ T1364] ieee802154 phy1 wpan1: encryption failed: -22
[  316.988697][T13760] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3203'.
[  317.306986][T13767] xt_policy: neither incoming nor outgoing policy selected
[  317.400395][T13771] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  317.608963][T13787] netlink: 'syz.2.3215': attribute type 21 has an invalid length.
[  318.031422][T13765] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512)
[  318.256217][T13807] loop1: detected capacity change from 0 to 4096
[  318.271951][T13807] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  318.297431][ T5872] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  318.427915][T13822] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3229'.
[  318.656440][T13842] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3240'.
[  320.556981][T13926] loop1: detected capacity change from 0 to 1024
[  320.564913][T13926] EXT4-fs: Ignoring removed orlov option
[  320.568016][T13926] EXT4-fs (loop1): stripe (5) is not aligned with cluster size (16), stripe is disabled
[  320.584397][T13926] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  320.604616][T13926] EXT4-fs error (device loop1): ext4_check_all_de:659: inode #12: block 7: comm syz.1.3277: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=108 fake=0
[  320.623641][T13926] EXT4-fs error (device loop1): ext4_check_all_de:659: inode #12: block 7: comm syz.1.3277: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=108 fake=0
[  320.658882][ T5872] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  320.969804][    T9] usb 2-1: new high-speed USB device number 32 using dummy_hcd
[  321.119777][    T9] usb 2-1: Using ep0 maxpacket: 16
[  321.124372][    T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11
[  321.128866][    T9] usb 2-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00
[  321.134567][    T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  321.140143][    T9] usb 2-1: config 0 descriptor??
[  321.484614][T13967] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3296'.
[  321.488260][T13967] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3296'.
[  321.507843][T13969] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3297'.
[  321.512692][T13969] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  321.747337][T13995] netlink: 88 bytes leftover after parsing attributes in process `syz.2.3310'.
[  321.764294][T13995] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3310'.
[  321.776642][    T9] usb 2-1: USB disconnect, device number 32
[  322.116532][T14033] netdevsim netdevsim0 netdevsim0: entered promiscuous mode
[  322.124305][T14033] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  322.332302][T14051] netlink: 'syz.0.3336': attribute type 14 has an invalid length.
[  322.435298][T14061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3342'.
[  322.539035][    C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!
[  322.745717][ T5870] Bluetooth: hci1: unexpected event for opcode 0x2041
[  323.142064][T14115] bridge0: port 2(bridge_slave_1) entered disabled state
[  323.146182][T14115] bridge_slave_1: left allmulticast mode
[  323.153271][ T5910] usb 2-1: new high-speed USB device number 33 using dummy_hcd
[  323.160528][T14115] bridge_slave_1: left promiscuous mode
[  323.163136][T14115] bridge0: port 2(bridge_slave_1) entered disabled state
[  323.171157][T14115] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check.
[  323.308732][ T5910] usb 2-1: Using ep0 maxpacket: 32
[  323.313062][ T5910] usb 2-1: config 0 has an invalid interface number: 12 but max is 0
[  323.316024][ T5910] usb 2-1: config 0 has no interface number 0
[  323.317939][ T5910] usb 2-1: config 0 interface 12 has no altsetting 0
[  323.323385][ T5910] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40
[  323.326996][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  323.331530][ T5910] usb 2-1: Product: syz
[  323.333396][ T5910] usb 2-1: Manufacturer: syz
[  323.335217][ T5910] usb 2-1: SerialNumber: syz
[  323.338045][ T5910] usb 2-1: config 0 descriptor??
[  323.544690][ T5910] f81534 2-1:0.12: f81534_set_register: reg: 1002 data: 3 failed: -71
[  323.548219][ T5910] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71
[  323.551322][ T5910] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71
[  323.554234][ T5910] f81534 2-1:0.12: probe with driver f81534 failed with error -71
[  323.559547][ T5910] usb 2-1: USB disconnect, device number 33
[  324.075538][T14149] loop1: detected capacity change from 0 to 16
[  324.077921][T14149] MTD: Attempt to mount non-MTD device "/dev/loop1"
[  324.281952][T14163] netlink: 'syz.0.3393': attribute type 10 has an invalid length.
[  324.284654][T14163] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3393'.
[  324.293215][T14163] team0: Port device geneve0 added
[  324.295934][ T5879] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  324.300167][ T5879] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  324.303218][ T5879] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  324.306029][ T5879] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  324.378146][   T24] usb 2-1: new high-speed USB device number 34 using dummy_hcd
[  324.538152][   T24] usb 2-1: Using ep0 maxpacket: 8
[  324.542825][   T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  324.547053][   T24] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22
[  324.552965][   T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  324.561456][   T24] usb 2-1: config 0 descriptor??
[  324.566006][   T24] iowarrior 2-1:0.0: no interrupt-in endpoint found
[  324.778577][   T24] usb 2-1: USB disconnect, device number 34
[  325.968730][ T5910] usb 2-1: new high-speed USB device number 35 using dummy_hcd
[  326.063711][T14254] virtio-fs: tag </dev/md0> not found
[  326.117334][ T5910] usb 2-1: Using ep0 maxpacket: 32
[  326.121258][ T5910] usb 2-1: config 76 has an invalid descriptor of length 0, skipping remainder of the config
[  326.129648][ T5910] usb 2-1: New USB device found, idVendor=069a, idProduct=0001, bcdDevice=51.c5
[  326.137313][ T5910] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  326.140681][ T5910] usb 2-1: Product: syz
[  326.142444][ T5910] usb 2-1: Manufacturer: syz
[  326.144329][ T5910] usb 2-1: SerialNumber: syz
[  326.160411][ T5910] pwc: Askey VC010 type 1 USB webcam detected.
[  326.290913][T14269] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.3438'.
[  326.333107][T14271] netlink: 'syz.2.3439': attribute type 3 has an invalid length.
[  326.365179][ T5910] pwc: send_video_command error -71
[  326.368167][ T5910] pwc: Failed to set video mode CIF@30 fps; return code = -71
[  326.371974][ T5910] Philips webcam 2-1:76.0: probe with driver Philips webcam failed with error -71
[  326.378605][ T5910] usb 2-1: USB disconnect, device number 35
[  326.473938][ T5870] Bluetooth: hci2: unexpected event for opcode 0x080d
[  326.677751][T14291] openvswitch: netlink: Either Ethernet header or EtherType is required.
[  326.762446][T14297] netlink: 'syz.2.3451': attribute type 21 has an invalid length.
[  326.766012][T14297] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3451'.
[  326.843805][T14301] netlink: 'syz.2.3453': attribute type 9 has an invalid length.
[  326.954353][T14305] netlink: 'syz.1.3455': attribute type 10 has an invalid length.
[  326.958401][T14305] syz_tun: entered promiscuous mode
[  326.965901][T14305] bond0: (slave syz_tun): Enslaving as an active interface with an up link
[  327.075710][T14311] ip6tnl1: entered promiscuous mode
[  327.636476][   T24] usb 2-1: new high-speed USB device number 36 using dummy_hcd
[  327.796510][   T24] usb 2-1: Using ep0 maxpacket: 16
[  327.802552][   T24] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87
[  327.807759][   T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7
[  327.871669][T14323] overlayfs: failed to clone upperpath
[  328.175907][   T24] usb 2-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89
[  328.179771][   T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  328.239119][   T24] usb 2-1: Product: syz
[  328.240532][   T24] usb 2-1: Manufacturer: syz
[  328.242116][   T24] usb 2-1: SerialNumber: syz
[  328.245203][   T24] usb 2-1: config 0 descriptor??
[  328.259550][T14331] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3465'.
[  328.516357][   T24] appledisplay 2-1:0.0: Error while getting initial brightness: -110
[  328.520318][   T24] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -110
[  328.630998][T14350] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3474'.
[  328.968028][ T5931] usb 2-1: USB disconnect, device number 36
[  329.006754][T14368] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3482'.
[  329.009918][T14368] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3482'.
[  329.013744][T14368] netlink: 'syz.1.3482': attribute type 13 has an invalid length.
[  329.080519][T14373] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  329.615506][ T5931] usb 2-1: new full-speed USB device number 37 using dummy_hcd
[  329.768910][ T5931] usb 2-1: config 8 has an invalid interface number: 177 but max is 0
[  329.772391][ T5931] usb 2-1: config 8 has no interface number 0
[  329.774511][ T5931] usb 2-1: config 8 interface 177 altsetting 9 has an endpoint descriptor with address 0xE8, changing to 0x88
[  329.778615][ T5931] usb 2-1: config 8 interface 177 altsetting 9 endpoint 0x88 has invalid maxpacket 1023, setting to 64
[  329.782884][ T5931] usb 2-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0
[  329.787115][ T5931] usb 2-1: config 8 interface 177 has no altsetting 0
[  329.789495][ T5931] usb 2-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1
[  329.792639][ T5931] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  329.797825][T14376] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  330.008005][ T5931] usb 2-1: string descriptor 0 read error: -71
[  330.010917][ T5931] ir_toy 2-1:8.177: required endpoints not found
[  330.014783][ T5931] usb 2-1: USB disconnect, device number 37
[  330.532068][ T5870] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0
[  330.536809][ T5870] Bluetooth: hci2: Injecting HCI hardware error event
[  330.544486][ T5870] Bluetooth: hci2: hardware error 0x00
[  331.166917][T14459] loop1: detected capacity change from 0 to 32768
[  331.218080][T14459] bcachefs (loop1): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,foreground_target=invalid label 767,background_target=invalid device 7,nojournal_transaction_names
[  331.218093][T14459]   allowing incompatible features above 0.0: (unknown version)
[  331.218097][T14459]   features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[  331.234375][T14459] bcachefs (loop1): Using encoding defined by superblock: utf8-12.1.0
[  331.249839][T14459] bcachefs (loop1): initializing new filesystem
[  331.256674][T14459] bcachefs (loop1): going read-write
[  331.279078][T14459] bcachefs (loop1): marking superblocks
[  331.293777][T14459] bcachefs (loop1): initializing freespace
[  331.300255][T14459] bcachefs (loop1): done initializing freespace
[  331.313162][T14459] bcachefs (loop1): reading snapshots table
[  331.317071][T14459] bcachefs (loop1): reading snapshots done
[  331.336662][T14459] bcachefs (loop1): done starting filesystem
[  331.486537][T14459] bcachefs (loop1): Cannot offline required disk
[  331.545435][ T5872] bcachefs (loop1): shutting down
[  331.547652][ T5872] bcachefs (loop1): going read-only
[  331.549892][ T5872] bcachefs (loop1): finished waiting for writes to stop
[  331.555772][ T5872] bcachefs (loop1): flushing journal and stopping allocators, journal seq 2
[  331.589926][ T5872] bcachefs (loop1): flushing journal and stopping allocators complete, journal seq 3
[  331.594661][ T5872] bcachefs (loop1): clean shutdown complete, journal seq 4
[  331.598239][ T5872] bcachefs (loop1): marking filesystem clean
[  331.629329][ T5872] bcachefs (loop1): shutdown complete
[  332.344634][T14493] unsupported nla_type 52263
[  332.607200][ T5870] Bluetooth: hci2: Opcode 0x0c03 failed: -110
[  332.839741][T14519] ufs: You didn't specify the type of your ufs filesystem
[  332.839741][T14519] 
[  332.839741][T14519] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ...
[  332.839741][T14519] 
[  332.839741][T14519] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old
[  332.849947][T14519] ufs: ufstype=old is supported read-only
[  332.856803][T14519] I/O error, dev loop5, sector 16 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1
[  334.097293][T14560] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3562'.
[  334.438411][T14572] lo speed is unknown, defaulting to 1000
[  334.441855][T14572] lo speed is unknown, defaulting to 1000
[  334.452735][T14572] lo speed is unknown, defaulting to 1000
[  334.479322][T14572] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[  334.525345][T14572] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98
[  334.694269][T14572] lo speed is unknown, defaulting to 1000
[  334.698105][T14572] lo speed is unknown, defaulting to 1000
[  334.701799][T14572] lo speed is unknown, defaulting to 1000
[  335.470998][T14595] netlink: 'syz.0.3577': attribute type 20 has an invalid length.
[  336.411348][ T5870] Bluetooth: Unexpected continuation frame (len 16)
[  336.657857][T14627] loop1: detected capacity change from 0 to 1024
[  336.808210][T14627] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  336.829502][T14627] ext4 filesystem being mounted at /936/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  336.917379][T14627] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters
[  336.955872][T14627] EXT4-fs (loop1): Remounting filesystem read-only
[  337.046686][ T5872] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  337.133238][T14638] ntfs3(loop1): try to read out of volume at offset 0x0
[  337.168706][T14640] geneve2: entered promiscuous mode
[  337.519234][T14656] netlink: 148 bytes leftover after parsing attributes in process `syz.2.3603'.
[  337.525027][T14656] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check.
[  338.227833][   T33] kauditd_printk_skb: 1 callbacks suppressed
[  338.227848][   T33] audit: type=1326 audit(1756316030.175:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14687 comm="syz.0.3618" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  338.252947][   T33] audit: type=1326 audit(1756316030.175:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14687 comm="syz.0.3618" exe="/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  338.269007][   T33] audit: type=1326 audit(1756316030.175:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14687 comm="syz.0.3618" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  338.277848][   T33] audit: type=1326 audit(1756316030.175:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14687 comm="syz.0.3618" exe="/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  338.290861][   T33] audit: type=1326 audit(1756316030.175:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14687 comm="syz.0.3618" exe="/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7faa84f8ebe9 code=0x7ffc0000
[  338.302300][T14690] overlayfs: failed to clone upperpath
[  338.338575][T14692] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3620'.
[  338.740845][   T24] usb 2-1: new high-speed USB device number 38 using dummy_hcd
[  338.890870][   T24] usb 2-1: Using ep0 maxpacket: 16
[  338.896681][   T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  338.901337][   T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  338.906037][   T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  338.909948][   T24] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  338.916155][   T24] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  338.924976][   T24] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  338.931232][   T24] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  338.935157][   T24] usb 2-1: Manufacturer: syz
[  338.950857][   T24] usb 2-1: config 0 descriptor??
[  339.212743][   T24] rc_core: IR keymap rc-hauppauge not found
[  339.215073][   T24] Registered IR keymap rc-empty
[  339.217015][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.240899][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.264142][   T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0
[  339.270231][   T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input8
[  339.278422][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.304742][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.333196][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.360665][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.384383][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.410745][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.433003][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.450611][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.471794][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.493302][   T24] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  339.516399][T14722] overlayfs: failed to clone upperpath
[  339.523312][   T24] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  339.527370][   T24] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  339.632469][   T24] usb 2-1: USB disconnect, device number 38
[  339.737151][T14734] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3640'.
[  339.949739][T14748] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!
[  339.950450][ T5879] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!
[  340.302132][T14771] loop1: detected capacity change from 0 to 1024
[  340.305982][T14771] EXT4-fs (loop1): stripe (8) is not aligned with cluster size (4096), stripe is disabled
[  340.311208][T14771] EXT4-fs (loop1): revision level too high, forcing read-only mode
[  340.314293][T14771] EXT4-fs (loop1): orphan cleanup on readonly fs
[  340.317128][T14771] EXT4-fs warning (device loop1): ext4_enable_quotas:7172: Failed to enable quota tracking (type=0, err=-22, ino=3). Please run e2fsck to fix.
[  340.323646][T14771] EXT4-fs (loop1): Cannot turn on quotas: error -22
[  340.326272][T14771] EXT4-fs error (device loop1): ext4_free_blocks:6696: comm syz.1.3658: Freeing blocks not in datazone - block = 0, count = 4096
[  340.335183][T14771] EXT4-fs (loop1): Remounting filesystem read-only
[  340.337376][T14771] EXT4-fs (loop1): 1 orphan inode deleted
[  340.339896][T14771] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[  340.438372][ T5872] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  340.648595][T14785] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3664'.
[  340.699873][   T24] usb 2-1: new high-speed USB device number 39 using dummy_hcd
[  340.870091][   T24] usb 2-1: Using ep0 maxpacket: 8
[  340.876208][   T24] usb 2-1: unable to get BOS descriptor or descriptor too short
[  340.884855][   T24] usb 2-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice=2b.cd
[  340.888894][   T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  340.894207][   T24] usb 2-1: Product: syz
[  340.896112][   T24] usb 2-1: Manufacturer: syz
[  340.898208][   T24] usb 2-1: SerialNumber: syz
[  341.113293][   T24] kalmia 2-1:1.0: probe with driver kalmia failed with error -22
[  341.127305][   T24] usb 2-1: USB disconnect, device number 39
[  342.491832][   T24] lo speed is unknown, defaulting to 1000
[  342.494518][   T24] syz0: Port: 1 Link DOWN
[  343.790044][   T24] usb 2-1: new full-speed USB device number 40 using dummy_hcd
[  343.952398][   T24] usb 2-1: unable to read config index 0 descriptor/start: -71
[  343.958245][   T24] usb 2-1: can't read configurations, error -71
[  344.128294][    C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!
[  344.683960][T14916] loop1: detected capacity change from 0 to 2048
[  344.690879][T14916] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  345.444497][T14952] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3742'.
[  345.509666][   T33] audit: type=1800 audit(1756316037.459:81): pid=14916 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3725" name="file1" dev="loop1" ino=1415 res=0 errno=0
[  347.900869][T15003] fuse: Bad value for 'fd'
[  348.048076][   T33] audit: type=1326 audit(1756316039.710:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14996 comm="syz.1.3761" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f753c98ebe9 code=0x0
[  348.096011][T15011] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.3766'.
[  348.129883][T15013] netlink: 'syz.0.3767': attribute type 7 has an invalid length.
[  348.133529][T15013] netlink: 'syz.0.3767': attribute type 8 has an invalid length.
[  348.539699][T15029] loop1: detected capacity change from 0 to 4096
[  348.543569][T15029] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512).
[  348.564560][T15029] ntfs3(loop1): ino=19, mi_enum_attr
[  348.567515][T15029] ntfs3(loop1): Mark volume as dirty due to NTFS errors
[  348.773866][T15056] netlink: 'syz.1.3788': attribute type 11 has an invalid length.
[  348.881214][T15061] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3790'.
[  348.885140][T15061] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3790'.
[  349.707709][T15086] overlayfs: missing 'lowerdir'
[  349.935826][    T9] usb 2-1: new high-speed USB device number 42 using dummy_hcd
[  350.086954][    T9] usb 2-1: config 0 has an invalid interface number: 153 but max is 0
[  350.090531][    T9] usb 2-1: config 0 has no interface number 0
[  350.092968][    T9] usb 2-1: too many endpoints for config 0 interface 153 altsetting 255: 255, using maximum allowed: 30
[  350.105210][    T9] usb 2-1: config 0 interface 153 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255
[  350.120987][    T9] usb 2-1: config 0 interface 153 has no altsetting 0
[  350.126639][    T9] usb 2-1: New USB device found, idVendor=1199, idProduct=6852, bcdDevice=57.34
[  350.131677][    T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  350.140295][    T9] usb 2-1: Product: syz
[  350.142231][    T9] usb 2-1: Manufacturer: syz
[  350.144318][    T9] usb 2-1: SerialNumber: syz
[  350.221443][    T9] usb 2-1: config 0 descriptor??
[  350.320153][    T9] hub 2-1:0.153: bad descriptor, ignoring hub
[  350.331542][    T9] hub 2-1:0.153: probe with driver hub failed with error -5
[  350.381338][    T9] sierra 2-1:0.153: Sierra USB modem converter detected
[  350.518782][    T9] usb 2-1: USB disconnect, device number 42
[  350.522785][    T9] sierra 2-1:0.153: device disconnected
[  350.551980][T15118] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3817'.
[  351.941603][T15159] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3833'.
[  352.303397][T15180] netlink: 5376 bytes leftover after parsing attributes in process `syz.0.3844'.
[  352.306952][T15180] netlink: 5376 bytes leftover after parsing attributes in process `syz.0.3844'.
[  352.446336][ T5870] Bluetooth: hci1: unexpected event for opcode 0x0008
[  352.594156][    C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!
[  352.819937][T15221] nftables ruleset with unbound set
[  353.304881][ T5931] usb 2-1: new high-speed USB device number 43 using dummy_hcd
[  353.455243][ T5931] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  353.459105][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  353.462824][ T5931] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  353.468724][ T5931] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  353.474984][ T5931] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  353.478873][ T5931] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  353.484989][ T5931] usb 2-1: config 0 descriptor??
[  353.895786][ T5931] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0
[  353.902552][ T5931] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0
[  354.138096][T15268] bond0: option lacp_active: mode dependency failed, not supported in mode balance-rr(0)
[  354.163460][  T791] usb 2-1: USB disconnect, device number 43
[  354.896544][T15290] loop1: detected capacity change from 0 to 32768
[  354.900323][T15290] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.3887 (15290)
[  354.907792][T15290] BTRFS info (device loop1): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2
[  354.911510][T15290] BTRFS info (device loop1): using xxhash64 (xxhash64-generic) checksum algorithm
[  354.914723][T15290] BTRFS warning (device loop1): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2
[  354.938745][T15290] BTRFS info (device loop1): rebuilding free space tree
[  354.946168][T15290] BTRFS info (device loop1): disabling free space tree
[  354.948672][T15290] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  354.952241][T15290] BTRFS info (device loop1): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  354.957370][T15290] BTRFS info (device loop1): enabling ssd optimizations
[  354.959669][T15290] BTRFS info (device loop1): turning off barriers
[  354.961802][T15290] BTRFS info (device loop1): enabling disk space caching
[  354.964705][T15290] BTRFS info (device loop1): force clearing of disk cache
[  354.967600][T15290] BTRFS info (device loop1): doing ref verification
[  354.970054][T15290] BTRFS info (device loop1): force zlib compression, level 3
[  354.998473][ T5872] BTRFS info (device loop1): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2
[  355.294575][T15315] loop1: detected capacity change from 0 to 8192
[  355.299674][T15315] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  355.370112][T15321] sctp: [Deprecated]: syz.2.3896 (pid 15321) Use of struct sctp_assoc_value in delayed_ack socket option.
[  355.370112][T15321] Use struct sctp_sack_info instead
[  355.501872][T15330] loop1: detected capacity change from 0 to 512
[  355.506579][T15330] EXT4-fs (loop1): Test dummy encryption mode enabled
[  355.509001][T15330] EXT4-fs (loop1): ext4_check_descriptors: Inode table for group 0 not in group (block 0)!
[  355.512652][T15330] EXT4-fs (loop1): group descriptors corrupted!
[  355.542102][T15334] loop1: detected capacity change from 0 to 256
[  355.552058][T15334] FAT-fs (loop1): Directory bread(block 64) failed
[  355.557025][T15334] FAT-fs (loop1): Directory bread(block 65) failed
[  355.559933][T15334] FAT-fs (loop1): Directory bread(block 66) failed
[  355.563030][T15334] FAT-fs (loop1): Directory bread(block 67) failed
[  355.565752][T15334] FAT-fs (loop1): Directory bread(block 68) failed
[  355.568607][T15334] FAT-fs (loop1): Directory bread(block 69) failed
[  355.571369][T15334] FAT-fs (loop1): Directory bread(block 70) failed
[  355.576700][T15334] FAT-fs (loop1): Directory bread(block 71) failed
[  355.580158][T15334] FAT-fs (loop1): Directory bread(block 72) failed
[  355.583051][T15334] FAT-fs (loop1): Directory bread(block 73) failed
[  355.626989][T15340] netlink: 260 bytes leftover after parsing attributes in process `syz.1.3906'.
[  355.630110][T15340] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3906'.
[  355.826888][T15354] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3912'.
[  355.830414][T15354] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3912'.
[  355.926875][T15345] loop1: detected capacity change from 0 to 32768
[  355.945554][T15345] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  355.991974][ T5872] ocfs2: Unmounting device (7,1) on (node local)
[  358.484654][T15427] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3941'.
[  358.708706][T15429] loop1: detected capacity change from 0 to 32768
[  358.713348][T15429] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop1 (7:1) scanned by syz.1.3942 (15429)
[  358.723498][T15429] BTRFS info (device loop1): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  358.727709][T15429] BTRFS info (device loop1): using blake2b (blake2b-256-generic) checksum algorithm
[  358.774220][T15429] BTRFS info (device loop1): enabling ssd optimizations
[  358.777192][T15429] BTRFS info (device loop1): enabling free space tree
[  358.902623][ T5872] BTRFS info (device loop1): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  359.408834][T15474] macvlan2: entered promiscuous mode
[  359.422387][T15474] bond0: (slave macvlan2): Enslaving as an active interface with an up link
[  359.502399][ T5931] usb 2-1: new high-speed USB device number 44 using dummy_hcd
[  359.660518][ T5931] usb 2-1: Using ep0 maxpacket: 8
[  359.665331][ T5931] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  359.668991][ T5931] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1
[  359.677209][ T5931] usb 2-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.40
[  359.680700][ T5931] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  359.690554][ T5931] usb 2-1: Product: syz
[  359.692316][ T5931] usb 2-1: Manufacturer: syz
[  359.694019][ T5931] usb 2-1: SerialNumber: syz
[  360.134973][T15492] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3963'.
[  360.166740][ T5931] usb 2-1: USB disconnect, device number 44
[  360.296463][T15502] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3968'.
[  360.324959][T15502] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3968'.
[  360.736053][T15523] ==================================================================
[  360.739438][T15523] BUG: KASAN: slab-use-after-free in __xfrm_state_lookup+0x6ad/0x8d0
[  360.742874][T15523] Read of size 2 at addr ffff8880289b97c2 by task syz.1.3978/15523
[  360.747455][T15523] 
[  360.748483][T15523] CPU: 1 UID: 0 PID: 15523 Comm: syz.1.3978 Not tainted syzkaller #0 PREEMPT(full) 
[  360.748501][T15523] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  360.748508][T15523] Call Trace:
[  360.748515][T15523]  <TASK>
[  360.748520][T15523]  dump_stack_lvl+0x189/0x250
[  360.748539][T15523]  ? __kasan_check_byte+0x12/0x40
[  360.748557][T15523]  ? __pfx_dump_stack_lvl+0x10/0x10
[  360.748570][T15523]  ? lock_release+0x4b/0x3e0
[  360.748589][T15523]  ? __virt_addr_valid+0x4a5/0x5c0
[  360.748605][T15523]  print_report+0xca/0x240
[  360.748616][T15523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  360.748627][T15523]  kasan_report+0x118/0x150
[  360.748641][T15523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  360.748655][T15523]  __xfrm_state_lookup+0x6ad/0x8d0
[  360.748668][T15523]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  360.748680][T15523]  ? xfrm_state_lookup+0x45/0x1e0
[  360.748692][T15523]  xfrm_state_lookup+0x11e/0x1e0
[  360.748707][T15523]  ipcomp4_init_state+0x205/0xb20
[  360.748720][T15523]  ? __xfrm_init_state+0x7ef/0x13f0
[  360.748734][T15523]  __xfrm_init_state+0xa76/0x13f0
[  360.748747][T15523]  ? __xfrm_init_state+0x7ef/0x13f0
[  360.748761][T15523]  xfrm_add_sa+0x2f5b/0x4070
[  360.748776][T15523]  ? __pfx_xfrm_add_sa+0x10/0x10
[  360.748787][T15523]  ? apparmor_capable+0x137/0x1b0
[  360.748802][T15523]  ? __nla_parse+0x40/0x60
[  360.748820][T15523]  xfrm_user_rcv_msg+0x7a3/0xab0
[  360.748835][T15523]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  360.748856][T15523]  ? __pfx___mutex_trylock_common+0x10/0x10
[  360.748870][T15523]  ? rcu_is_watching+0x15/0xb0
[  360.748881][T15523]  ? trace_contention_end+0x39/0x120
[  360.748893][T15523]  ? __mutex_lock+0x335/0x1350
[  360.748911][T15523]  netlink_rcv_skb+0x208/0x470
[  360.748930][T15523]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  360.748942][T15523]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  360.748962][T15523]  ? netlink_deliver_tap+0x2e/0x1b0
[  360.748976][T15523]  ? netlink_deliver_tap+0x2e/0x1b0
[  360.748992][T15523]  xfrm_netlink_rcv+0x79/0x90
[  360.749004][T15523]  netlink_unicast+0x82f/0x9e0
[  360.749022][T15523]  ? __pfx_netlink_unicast+0x10/0x10
[  360.749036][T15523]  ? netlink_sendmsg+0x642/0xb30
[  360.749051][T15523]  ? skb_put+0x11b/0x210
[  360.749070][T15523]  netlink_sendmsg+0x805/0xb30
[  360.749089][T15523]  ? __pfx_netlink_sendmsg+0x10/0x10
[  360.749106][T15523]  ? aa_sock_msg_perm+0xf1/0x1d0
[  360.749118][T15523]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  360.749131][T15523]  ? __pfx_netlink_sendmsg+0x10/0x10
[  360.749147][T15523]  __sock_sendmsg+0x21c/0x270
[  360.749162][T15523]  ____sys_sendmsg+0x505/0x830
[  360.749174][T15523]  ? __pfx_____sys_sendmsg+0x10/0x10
[  360.749189][T15523]  ? import_iovec+0x74/0xa0
[  360.749202][T15523]  ___sys_sendmsg+0x21f/0x2a0
[  360.749212][T15523]  ? __pfx____sys_sendmsg+0x10/0x10
[  360.749232][T15523]  ? __fget_files+0x2a/0x420
[  360.749248][T15523]  ? __fget_files+0x3a0/0x420
[  360.749266][T15523]  __x64_sys_sendmsg+0x19b/0x260
[  360.749305][T15523]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  360.749321][T15523]  ? rcu_is_watching+0x15/0xb0
[  360.749335][T15523]  ? do_syscall_64+0xbe/0x3b0
[  360.749354][T15523]  do_syscall_64+0xfa/0x3b0
[  360.749368][T15523]  ? lockdep_hardirqs_on+0x9c/0x150
[  360.749383][T15523]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  360.749394][T15523]  ? exc_page_fault+0x9f/0xf0
[  360.749409][T15523]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  360.749420][T15523] RIP: 0033:0x7f753c98ebe9
[  360.749432][T15523] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  360.749442][T15523] RSP: 002b:00007f753d8c9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  360.749455][T15523] RAX: ffffffffffffffda RBX: 00007f753cbb5fa0 RCX: 00007f753c98ebe9
[  360.749465][T15523] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003
[  360.749472][T15523] RBP: 00007f753ca11e19 R08: 0000000000000000 R09: 0000000000000000
[  360.749479][T15523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  360.749486][T15523] R13: 00007f753cbb6038 R14: 00007f753cbb5fa0 R15: 00007ffe0ffe7828
[  360.749499][T15523]  </TASK>
[  360.749503][T15523] 
[  360.914738][T15523] Allocated by task 9267:
[  360.916529][T15523]  kasan_save_track+0x3e/0x80
[  360.918500][T15523]  __kasan_slab_alloc+0x6c/0x80
[  360.920529][T15523]  kmem_cache_alloc_noprof+0x1c1/0x3c0
[  360.922792][T15523]  xfrm_state_alloc+0x24/0x2f0
[  360.924777][T15523]  __find_acq_core+0x8a7/0x1c00
[  360.926779][T15523]  xfrm_find_acq+0x78/0xa0
[  360.928624][T15523]  xfrm_alloc_userspi+0x6b3/0xc90
[  360.930693][T15523]  xfrm_user_rcv_msg+0x7a3/0xab0
[  360.932640][T15523]  netlink_rcv_skb+0x208/0x470
[  360.934553][T15523]  xfrm_netlink_rcv+0x79/0x90
[  360.936422][T15523]  netlink_unicast+0x82f/0x9e0
[  360.938393][T15523]  netlink_sendmsg+0x805/0xb30
[  360.940341][T15523]  __sock_sendmsg+0x21c/0x270
[  360.942326][T15523]  ____sys_sendmsg+0x505/0x830
[  360.944266][T15523]  ___sys_sendmsg+0x21f/0x2a0
[  360.946303][T15523]  __x64_sys_sendmsg+0x19b/0x260
[  360.948398][T15523]  do_syscall_64+0xfa/0x3b0
[  360.950349][T15523]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  360.952867][T15523] 
[  360.953881][T15523] Freed by task 5931:
[  360.955588][T15523]  kasan_save_track+0x3e/0x80
[  360.957595][T15523]  kasan_save_free_info+0x46/0x50
[  360.959730][T15523]  __kasan_slab_free+0x5b/0x80
[  360.961683][T15523]  kmem_cache_free+0x18f/0x400
[  360.963600][T15523]  xfrm_state_gc_task+0x52d/0x6b0
[  360.965716][T15523]  process_scheduled_works+0xae1/0x17b0
[  360.967993][T15523]  worker_thread+0x8a0/0xda0
[  360.969911][T15523]  kthread+0x711/0x8a0
[  360.971625][T15523]  ret_from_fork+0x3fc/0x770
[  360.973568][T15523]  ret_from_fork_asm+0x1a/0x30
[  360.975538][T15523] 
[  360.976550][T15523] The buggy address belongs to the object at ffff8880289b9680
[  360.976550][T15523]  which belongs to the cache xfrm_state of size 928
[  360.982232][T15523] The buggy address is located 322 bytes inside of
[  360.982232][T15523]  freed 928-byte region [ffff8880289b9680, ffff8880289b9a20)
[  360.987690][T15523] 
[  360.988661][T15523] The buggy address belongs to the physical page:
[  360.991248][T15523] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880289b9200 pfn:0x289b8
[  360.995190][T15523] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  360.998502][T15523] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
[  361.001861][T15523] page_type: f5(slab)
[  361.003508][T15523] raw: 00fff00000000240 ffff888104d56b40 ffff88801c3c0708 ffffea0000c4eb10
[  361.007036][T15523] raw: ffff8880289b9200 00000000000e0003 00000000f5000000 0000000000000000
[  361.010535][T15523] head: 00fff00000000240 ffff888104d56b40 ffff88801c3c0708 ffffea0000c4eb10
[  361.014050][T15523] head: ffff8880289b9200 00000000000e0003 00000000f5000000 0000000000000000
[  361.017534][T15523] head: 00fff00000000002 ffffea0000a26e01 00000000ffffffff 00000000ffffffff
[  361.021093][T15523] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
[  361.024655][T15523] page dumped because: kasan: bad access detected
[  361.027307][T15523] page_owner tracks the page as allocated
[  361.029589][T15523] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5958, tgid 5957 (syz.0.19), ts 67655454655, free_ts 67549011697
[  361.037051][T15523]  post_alloc_hook+0x240/0x2a0
[  361.039027][T15523]  get_page_from_freelist+0x21e4/0x22c0
[  361.041328][T15523]  __alloc_frozen_pages_noprof+0x181/0x370
[  361.043768][T15523]  alloc_pages_mpol+0x232/0x4a0
[  361.045808][T15523]  allocate_slab+0x8a/0x370
[  361.047777][T15523]  ___slab_alloc+0xbeb/0x1410
[  361.049761][T15523]  kmem_cache_alloc_noprof+0x283/0x3c0
[  361.052026][T15523]  xfrm_state_alloc+0x24/0x2f0
[  361.054019][T15523]  xfrm_add_acquire+0xf7/0xb20
[  361.055985][T15523]  xfrm_user_rcv_msg+0x7a3/0xab0
[  361.057977][T15523]  netlink_rcv_skb+0x208/0x470
[  361.059961][T15523]  xfrm_netlink_rcv+0x79/0x90
[  361.061963][T15523]  netlink_unicast+0x82f/0x9e0
[  361.063969][T15523]  netlink_sendmsg+0x805/0xb30
[  361.065965][T15523]  __sock_sendmsg+0x21c/0x270
[  361.067894][T15523]  ____sys_sendmsg+0x505/0x830
[  361.069825][T15523] page last free pid 5910 tgid 5910 stack trace:
[  361.072408][T15523]  __free_frozen_pages+0xbc4/0xd30
[  361.074484][T15523]  stack_depot_save_flags+0x436/0x860
[  361.076614][T15523]  kasan_save_track+0x4f/0x80
[  361.078503][T15523]  __kasan_slab_alloc+0x6c/0x80
[  361.080463][T15523]  kmem_cache_alloc_node_noprof+0x1bb/0x3c0
[  361.082823][T15523]  __alloc_skb+0x112/0x2d0
[  361.084671][T15523]  __pskb_copy_fclone+0xa8/0xfb0
[  361.086691][T15523]  hsr_create_tagged_frame+0x227/0xc30
[  361.088924][T15523]  hsr_forward_skb+0x1013/0x2860
[  361.091021][T15523]  hsr_dev_xmit+0x1a5/0x220
[  361.092850][T15523]  dev_hard_start_xmit+0x2d7/0x830
[  361.094844][T15523]  __dev_queue_xmit+0x1b8d/0x3b50
[  361.096936][T15523]  ip6_finish_output2+0x11fe/0x16a0
[  361.099082][T15523]  NF_HOOK+0x9e/0x380
[  361.100754][T15523]  mld_sendpack+0x800/0xd80
[  361.102660][T15523]  mld_dad_work+0x46/0x490
[  361.104534][T15523] 
[  361.105564][T15523] Memory state around the buggy address:
[  361.107811][T15523]  ffff8880289b9680: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  361.111163][T15523]  ffff8880289b9700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  361.114475][T15523] >ffff8880289b9780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  361.117780][T15523]                                            ^
[  361.120254][T15523]  ffff8880289b9800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  361.123546][T15523]  ffff8880289b9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  361.126875][T15523] ==================================================================
[  361.165698][T15523] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  361.168705][T15523] CPU: 1 UID: 0 PID: 15523 Comm: syz.1.3978 Not tainted syzkaller #0 PREEMPT(full) 
[  361.172635][T15523] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  361.176803][T15523] Call Trace:
[  361.178220][T15523]  <TASK>
[  361.179471][T15523]  dump_stack_lvl+0x99/0x250
[  361.181360][T15523]  ? __asan_memcpy+0x40/0x70
[  361.183249][T15523]  ? __pfx_dump_stack_lvl+0x10/0x10
[  361.185423][T15523]  ? __pfx__printk+0x10/0x10
[  361.187311][T15523]  vpanic+0x281/0x750
[  361.188981][T15523]  ? preempt_schedule+0xae/0xc0
[  361.191006][T15523]  ? __pfx_vpanic+0x10/0x10
[  361.192880][T15523]  ? preempt_schedule_common+0x83/0xd0
[  361.195118][T15523]  ? preempt_schedule+0xae/0xc0
[  361.197140][T15523]  ? __pfx_preempt_schedule+0x10/0x10
[  361.199302][T15523]  panic+0xb9/0xc0
[  361.200862][T15523]  ? __pfx_panic+0x10/0x10
[  361.202749][T15523]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[  361.205184][T15523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  361.207376][T15523]  check_panic_on_warn+0x89/0xb0
[  361.209438][T15523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  361.211651][T15523]  end_report+0x78/0x160
[  361.213389][T15523]  kasan_report+0x129/0x150
[  361.215298][T15523]  ? __xfrm_state_lookup+0x6ad/0x8d0
[  361.217411][T15523]  __xfrm_state_lookup+0x6ad/0x8d0
[  361.219539][T15523]  ? __pfx___xfrm_state_lookup+0x10/0x10
[  361.221785][T15523]  ? xfrm_state_lookup+0x45/0x1e0
[  361.223829][T15523]  xfrm_state_lookup+0x11e/0x1e0
[  361.225780][T15523]  ipcomp4_init_state+0x205/0xb20
[  361.227853][T15523]  ? __xfrm_init_state+0x7ef/0x13f0
[  361.229928][T15523]  __xfrm_init_state+0xa76/0x13f0
[  361.232018][T15523]  ? __xfrm_init_state+0x7ef/0x13f0
[  361.234185][T15523]  xfrm_add_sa+0x2f5b/0x4070
[  361.236049][T15523]  ? __pfx_xfrm_add_sa+0x10/0x10
[  361.238136][T15523]  ? apparmor_capable+0x137/0x1b0
[  361.240216][T15523]  ? __nla_parse+0x40/0x60
[  361.242121][T15523]  xfrm_user_rcv_msg+0x7a3/0xab0
[  361.244168][T15523]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  361.246334][T15523]  ? __pfx___mutex_trylock_common+0x10/0x10
[  361.248680][T15523]  ? rcu_is_watching+0x15/0xb0
[  361.250648][T15523]  ? trace_contention_end+0x39/0x120
[  361.252855][T15523]  ? __mutex_lock+0x335/0x1350
[  361.254855][T15523]  netlink_rcv_skb+0x208/0x470
[  361.256816][T15523]  ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[  361.258998][T15523]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  361.261160][T15523]  ? netlink_deliver_tap+0x2e/0x1b0
[  361.263292][T15523]  ? netlink_deliver_tap+0x2e/0x1b0
[  361.265438][T15523]  xfrm_netlink_rcv+0x79/0x90
[  361.267339][T15523]  netlink_unicast+0x82f/0x9e0
[  361.269291][T15523]  ? __pfx_netlink_unicast+0x10/0x10
[  361.271442][T15523]  ? netlink_sendmsg+0x642/0xb30
[  361.273543][T15523]  ? skb_put+0x11b/0x210
[  361.275298][T15523]  netlink_sendmsg+0x805/0xb30
[  361.277235][T15523]  ? __pfx_netlink_sendmsg+0x10/0x10
[  361.279405][T15523]  ? aa_sock_msg_perm+0xf1/0x1d0
[  361.281423][T15523]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  361.283613][T15523]  ? __pfx_netlink_sendmsg+0x10/0x10
[  361.285755][T15523]  __sock_sendmsg+0x21c/0x270
[  361.287634][T15523]  ____sys_sendmsg+0x505/0x830
[  361.289566][T15523]  ? __pfx_____sys_sendmsg+0x10/0x10
[  361.291716][T15523]  ? import_iovec+0x74/0xa0
[  361.293605][T15523]  ___sys_sendmsg+0x21f/0x2a0
[  361.295551][T15523]  ? __pfx____sys_sendmsg+0x10/0x10
[  361.297662][T15523]  ? __fget_files+0x2a/0x420
[  361.299558][T15523]  ? __fget_files+0x3a0/0x420
[  361.301505][T15523]  __x64_sys_sendmsg+0x19b/0x260
[  361.303587][T15523]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  361.305791][T15523]  ? rcu_is_watching+0x15/0xb0
[  361.307740][T15523]  ? do_syscall_64+0xbe/0x3b0
[  361.309655][T15523]  do_syscall_64+0xfa/0x3b0
[  361.311461][T15523]  ? lockdep_hardirqs_on+0x9c/0x150
[  361.313675][T15523]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  361.316144][T15523]  ? exc_page_fault+0x9f/0xf0
[  361.318066][T15523]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  361.320488][T15523] RIP: 0033:0x7f753c98ebe9
[  361.322347][T15523] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  361.330165][T15523] RSP: 002b:00007f753d8c9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  361.333654][T15523] RAX: ffffffffffffffda RBX: 00007f753cbb5fa0 RCX: 00007f753c98ebe9
[  361.336935][T15523] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003
[  361.340152][T15523] RBP: 00007f753ca11e19 R08: 0000000000000000 R09: 0000000000000000
[  361.343477][T15523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  361.346648][T15523] R13: 00007f753cbb6038 R14: 00007f753cbb5fa0 R15: 00007ffe0ffe7828
[  361.349767][T15523]  </TASK>
[  361.351818][T15523] Kernel Offset: disabled
[  361.353657][T15523] Rebooting in 86400 seconds..

VM DIAGNOSIS:
17:25:40  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000000 RBX=ffff888023d49cc0 RCX=0000000000000038 RDX=0000000000001bc0
RSI=0000000000000000 RDI=ffff888023d4aa40 RBP=00000000ffffff00 RSP=ffffc900069978e8
R8 =00000000b722f254 R9 =0000000000000000 R10=ffff888023d49cc0 R11=ffffffff81ac3820
R12=0000000000001bc0 R13=ffff888023d49cc0 R14=0000000000000cc0 R15=ffff88810000f500
RIP=ffffffff8b79cce6 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000555574174500 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000555574187588 CR3=0000000029030000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f5b8cf87498 00007f5b8cf87470 XMM03=00007f5b8cf874a8 00007f5b8cf874a0
XMM04=00007f5b8daed100 00007f5b8cf87460 XMM05=00007f5b8cf87478 00007f5b8cf874c0
XMM06=00007f5b8cf874b8 00007f5b8cf874b0 XMM07=00007f5b8cf874a8 00007f5b8cf874a0
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 00007f5b8ce12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000038 RBX=0000000000000038 RCX=0000000000000000 RDX=00000000000003f8
RSI=000000000000120e RDI=000000000000120f RBP=00000000000003f8 RSP=ffffc90003bb6930
R8 =ffff888021908237 R9 =1ffff11004321046 R10=dffffc0000000000 R11=ffffffff854f3440
R12=dffffc0000000000 R13=ffffffff99afa8f8 R14=ffffffff99def420 R15=0000000000000000
RIP=ffffffff854f34bc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f753d8c96c0 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000200000000300 CR3=00000001109f2000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=00007f753cb87498 00007f753cb87470 XMM03=00007f753cb874a8 00007f753cb874a0
XMM04=00007f753d6ed100 00007f753cb87460 XMM05=00007f753cb87478 00007f753cb874c0
XMM06=00007f753cb874b8 00007f753cb874b0 XMM07=00007f753cb874a8 00007f753cb874a0
XMM08=6161616161616161 6161616161616161 XMM09=0000000000000000 00007f753ca12fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
