last executing test programs:

3m40.362106771s ago: executing program 0 (id=768):
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200), 0x40281, 0x0)
ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000000)=0x1)

3m40.361922844s ago: executing program 0 (id=769):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x5}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000200)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

3m40.361841767s ago: executing program 0 (id=770):
r0 = fsopen(&(0x7f0000000040)='afs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='source', &(0x7f0000000840)='%\\/:\x85X\\\x03\xa6\xd7}\xcd\xeb*\xb1\xa8\xb7\x81\xc8\xcbR\xa8?\x97 \xcbz&\x17\xa4\xfd^\xe1I\x11X\x90\x03\xb7W\x05\xb0\x99\x10F0\xb5YP9\xc3\xe2M\xaa\x81\xfev:\xe40\x9e\xdb\x98\xb4\xd0\xdcE\x14\x910\x1b.G\xab\x86\xdfy\xe6\xde11_H]\xe2\xc3\xb2fa\x7f\x8c\xf3\xc6\x85\xc9\xd6j\xff\xaa\xdbWD\x87\xe3\\mUSy\x0f\x82qW\fE\xd15ec>:D+', 0x0)

3m40.301024761s ago: executing program 0 (id=771):
syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0xe, &(0x7f00000005c0)={[{@bh}, {@errors_remount}]}, 0x3, 0x445, &(0x7f0000000b00)="$eJzs28+PE1UcAPDvTLeLCLgr4g9+qKto3PhjlwVUDh7UaOIBExM96HGzuxCksIZdEyFEwRg8GWPi3Xj0X/CkF2M8mXjVuyEhhgvgqWbaGbYtbdktLUX6+SQD78282fe+nXnte/PaAEbWVPZPErE1Iv6MiIl6trnAVP2/q5fPLly7fHYhiWr13X+SWrkrl88uFEWL87bkmek0Iv0iid1t6l05feb4fKWydCrPz66e+Gh25fSZF46dmD+6dHTp5P5Dhw4emHv5pf0v9iXOrE1Xdn26vGfnWx988/bhr5rib4mjT6a6HXy6Wu1zdcO1rSGdjA2xIWxIKSKyy1Wu9f+JKMXaxZuINz8fauOAgapWq9UtnQ+fqwJ3sSSa87o8jIrigz6b/xZb6yDg1cENP4bu0mv1CVAW99V8qx8ZizQvU26Z3/bTVES8f+7f77ItBvMcAgCgyU/Z+Of5duO/NB5qKHdfvjY0GRH3R8T2iHggInZExIMRtbIPR8QjG6y/dZHkxvFPerGnwNYpG/+9kq9tNY//itFfTJby3LZa/OXkyLHK0r78NZmO8qYsP9eljp/f+OPrTscax3/ZltVfjAXzdlwc29R8zuL86vytxNzo0vmIXWPt4k+urwQkEbEzInb1WMexZ3/Y0+nYzePvog/rTNXvI56pX/9z0RJ/Iem+Pjl7T1SW9s0Wd8WNfvv9wjud6r+l+Psgu/73tr3/r8c/mTSu165svI4Lf33ZcU7T6/0/nrxXS4/n+z6ZX109NRcxnhyuN7px//61c4t8UT6Lf3pv+/6/PdZeid0Rkd3Ej0bEYxHxeN72JyLiyYjY2yX+X19/6sPe4x+sLP7FDV3/tcR4tO5pnygd/+XHpkonb4j/Wvfrf7CWms73rOf9bz3t6u1uBgAAgP+fNCK2RpLOXE+n6cxM/fvyOyLSyvLK6nNHlj8+uVj/jcBklNPiSddEw/PQuXxaX8+fj4j6VwuK4wfy58bfljbX8jMLy5XFYQcPI25Lh/6f+bs07NYBA+f3WjC69H8YXfo/jC79H0ZXm/6/eRjtAG6/dp//nw2hHcDt19L/LfvBCDH/h9Gl/8Po0v9hJK1sjpv/SL5rovhLPZ5+1yaifEc0Y2CJSO+IZkgMKDHc9yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB++S8AAP///fHg0g==")
syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0)
mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x200000, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]})
linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0xffffffffffffff9c, 0x0, 0x1000)

3m40.221352897s ago: executing program 0 (id=773):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x18, 0x3f, 0x107, 0x3, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}]}, 0x18}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)

3m39.820088368s ago: executing program 0 (id=777):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000500)="7c5331fc9356b5b1000600008100", 0x0, 0xd5a2, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50)

3m39.555311575s ago: executing program 32 (id=777):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000500)="7c5331fc9356b5b1000600008100", 0x0, 0xd5a2, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50)

2m34.129638283s ago: executing program 2 (id=1417):
r0 = syz_open_dev$tty20(0xc, 0x4, 0x0)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000000c0)=0xff)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0x9)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x7f)

2m34.030590737s ago: executing program 2 (id=1418):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r0}, 0x10)
r1 = socket$key(0xf, 0x3, 0x2)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="85000000540000001600ffff8000fdff95000000000000006884d1d9fe4c9ce4c8b7a8e93bb957f5ac915f7683352dbbdb85d8965f40a9372a85319dc353a5b7b7bf0365836f54ae60375c46827cb4d9f8a15bddba79096be7d495c19b3afaa67d2aea409ea69c67cc026d1f0d509b0055e7a371960c7eef346408d031b1249592ccc129485120730762afd7006f54bd541f8be0902162f15e7539ad6623a985526464b4539a3c1d1514fe832e9c47f1c53ca2614ff008000000000000009a86746c75adf63fe215c2b2ca38e4f62f682ef561ee6352c07f000000000000008f31663bd222d47fd495ad27124c6b0ccd410400000000000000eb2b31bb3d0bb8aebfc7ee0200000000000000f0c100e80c53d628404a42176fb1462bddb96075082e486e0d4907d5764185ce2ebfc911064c1f41425fa8fa3eb9848fb36c85ad4e23b580773e82a135107a73be0d78b5eced63b5e0ad7d6b97b8aedf0f33bc79f3a07034b54afbe4ca46e0f64222976090809c7912fa0c112ac3d25141472a7ba550d62c34abc4915fa6cbf0da8d9c3139a6d5b3c8b371c4c25c53350edc8521676bbec5ad4ed0b7eca73574fddbfbccfbed5c9da52fe1"], 0x0, 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_skb}, 0x94)
sendmsg$key(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020a000907000000000000000000400005001a00"], 0x38}}, 0x0)

2m33.935015328s ago: executing program 2 (id=1419):
capset(&(0x7f0000000c00)={0x20080522}, &(0x7f0000000280)={0x0, 0x3, 0x7, 0x0, 0x10040, 0x8f})
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x4b, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0}, 0x50)
syz_io_uring_setup(0x5e75, &(0x7f0000000400)={0x0, 0x6aa3, 0x4002, 0x0, 0x2b1}, 0x0, 0x0)

2m33.801322117s ago: executing program 2 (id=1422):
syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000300)={[{@init_itable_val}, {@jqfmt_vfsold}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@jqfmt_vfsold}, {@minixdf}, {@quota}]}, 0x3, 0x43b, &(0x7f0000000440)="$eJzs3MtvG0UYAPBv7TglfZC0Ko+mBQIFEfFImlBKDxwAgcQBJCQ4lGNI0irUbVATJFpFEBAqR1SJO+KIxF/ACS4IOCFxhTuqVKFcWjgZrb2b2I6dJqlTl/r3k7ae2R1r5vPu2DM73QTQs0bSf5KIvRHxR0QM1rKNBUZqLzdWlqb/WVmaTqJSefvvpFru+srSdF40f9+ePNMXUfg8icMt6l24eOnsVLk8eyHLjy+e+2B84eKlZ+fOTZ2ZPTN7fvLkyePPTbxwYvL5jsSZxnV9+OP5I4def/fKm9Onrrz3y3dJHn9THB0ystHBJyqVDlfXXfvq0klfFxvClhRr3TRK1f4/GMVYO3mD8dpnXW0csKMqlUrl/vaHlyvAXSyJbrcA6I78hz6d/+bbbRp63BGuvVybAKVx38i22pG+KGRlSk3z204aiYhTy/9+nW6xM/chAAAa/JCOf55pNf4rRP19oXuzNZShiNgfEQci4kREHIyI+yKqZR+IiAe3WH/zIsn68U/h6rYC26R0/PditrbVOP7LR38xVMxy+6rxl5LTc+XZY9lnMhqlXWl+YoM6fnz19y+b9w1kr/Xjv3RL68/Hglk7rvbtanzvzNTi1K3Gnbv2acRwX6v4k9WVgCQiDkXE8DbrmHvq2yPtjt08/g10YJ2p8k3Ek7XzvxxN8eeSjdcnx++J8uyx8fyqWO/X3y6/1a7+W4q/A9Lzv7vl9b8a/1BSv167sPU6Lv/5Rds5zXav//7knYZ9H00tLl6YiOhP3qg1un7/ZFO5ybXyafyjR1v3/wOx9kkcjoj0In4oIh6OiEeytj8aEY9FxNEN4v/5lcff3378OyuNf2ZL538t0R/Ne1onimd/+r6h0qGtxJ+e/+PV1Gi2ZzPff5tp1/auZgAAAPj/KUTE3kgKY6vpQmFsrPZ/+A/G7kJ5fmHx6dPzH56fqT0jMBSlQn6na7DufuhENq3P85P1+Zdqde2PiK+KA9XjY9Pz5ZluBw89bk+b/p/6q9jt1gE7zvNa0Lv0f+hd+j/0Lv0feleL/j9QvbsP3PVa/f5/0oV2ALdfU/+37Ac9xPwfepf+D71L/4eetDAQN39IXkJiXSIKd0QzOpcotfkzFz2a6PY3EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQGf8FwAA//8/beQW")
open(&(0x7f0000000180)='./bus\x00', 0x14937e, 0x111)
mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0)
r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x8005, 0x0, 0x0, 0x15, 0x0, "ef359f413bb93852f7d6a4ae6dddfbd1ce5d29c2ee5e5ca9000ff8ee09e737ff0edf110ff4117639c2eb4b78c660e677df701905b9aafab4afaaf755a3f6a004", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a311ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000000000000001", [0x200]})
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x91)

2m33.557818019s ago: executing program 2 (id=1426):
r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000140)=0x2000)
ppoll(&(0x7f0000000040)=[{r0, 0x20}], 0x1, 0x0, 0x0, 0x0)
mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r0, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x4000)

2m33.1588754s ago: executing program 2 (id=1436):
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]})
r0 = io_uring_setup(0x54a0, &(0x7f0000000000)={0x0, 0xe0f5, 0x2, 0x2, 0xf2})
io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r0, 0x12, 0x0, 0x0)

2m33.006649899s ago: executing program 33 (id=1436):
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]})
r0 = io_uring_setup(0x54a0, &(0x7f0000000000)={0x0, 0xe0f5, 0x2, 0x2, 0xf2})
io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r0, 0x12, 0x0, 0x0)

1m39.100495346s ago: executing program 3 (id=2008):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000070000100000000000000000007"], 0x44}}, 0x0)

1m39.02088745s ago: executing program 3 (id=2009):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r0)
sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c80)={0x34, r1, 0x1, 0x70bd25, 0x0, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @private=0xa010101}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x0)

1m39.020669275s ago: executing program 3 (id=2010):
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
getsockopt$X25_QBITINCL(r0, 0x106, 0x1, 0x0, 0x0)

1m38.935039388s ago: executing program 3 (id=2011):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2145c99, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0)
mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0)
mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0)
open_tree(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x901)

1m38.934916013s ago: executing program 3 (id=2012):
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="640000001900010000000000fbdbdf251d010900500012"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0)

1m38.669502146s ago: executing program 3 (id=2013):
r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x410, 0x2)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000340)={0x0, 0x4005, 0x1, {0x1, @win={{}, 0x0, 0xfffffff8, 0x0, 0x0, 0x0}}})
ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000140)=0x1)

1m38.537316765s ago: executing program 34 (id=2013):
r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x410, 0x2)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000340)={0x0, 0x4005, 0x1, {0x1, @win={{}, 0x0, 0xfffffff8, 0x0, 0x0, 0x0}}})
ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000140)=0x1)

43.193239849s ago: executing program 1 (id=2624):
syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file3\x00', 0xcc0, &(0x7f00000001c0)=ANY=[@ANYBLOB="61636c2c6865617274626561743d6e6f6e652c6865617274626561743d6e6f6e652c636f686572656e63793d66756c6c2c636f686572656e63793d66756c6c2c636f686572656e63793d62756666657265642c6572726f72733d636f6e74696e75652c757365725f78617474722c626172726965723d30303030303030303030303030303032363131352c6469725f726573765f6c6576656c3d30303030303030303030303030303030303030362c696e74722c6a6f75726e616c5f6173796e635f636f6d6d69742c00535d4e036013ec9e6e7ecdee3849b40884b95e94f35cec9600cd19beb0"], 0x1, 0x442a, &(0x7f0000008940)="$eJzs3c9PHGUfAPBnBvoW+rZ9oW8PfZM3cRObaNQQ6EmliZTSUmixptrGeNkusG3RhW1gMR56wFsTTyYejIdGE2+cGg5e65/gxWM9N9GDFxOTRszuzgIz7IaVsGDr53NgmOc3+5159pnD8MSJyp25pdzcUq6wkCvP3Fo6k/u4XFqeL4Z4nzTt/9D+9U97OnGdHPS190929fzFd2+cCeH72R+frK+vr4eq7tDU0Jbff/v13szWY0OcqVNtt3lre+WDEMLJbeOq6gohvP9dCFEI4VySNpoce0MIx0I978a9z27m9mg0Dx8Xz+afTt1fGz49ufpgrfXfHoXwVel/r92e//nFruGfXtmj7gEAAAAAAAAAAAAAAAAAeMaNX7t6/Z3BofAoCt2r0fb3dceTY6v3Y9f3zAud/2MBAAAAAAAAAAAAAAAAAADgb2rz/f9cdKLJ+/9jyXGkRf31tzo/Rjpn4u2rYxcGh5L936Nt+a8nSb+c6wr9TfZ9z+7/fi5Tv/n+79v72a3G+Br99oUoHkidx/HAQAjfJBu/n4qOxKXyUuXVW+Xlhdk9G8YzKx3/+u79qegkG/q3G//RTPud3///v9uupur5zb27xJ5r6fh3tSz37adRW/E/n6m3H/Fn99Lx766l9W4tMFKfAKrx/7x75/iPZdrvVPyPhxByUXWsudQMUF3DVNNbrVdIS8f/UC0tNXUmH2Sr+//3TPwvZNo/qPl/JftFRFPp+P+rltaTKrF5//fHO9//FzPtH0T8q+Nf8f3flnT8D9cTu1NFap9ku/P/eKb9TsX/epyM83iUugJWo3p6q/9XR1o6/j3b8jef/+K21n+XMvX36/mv0W/j+a8x/b8c1Z//aC4d/96W5dq9/ycy9To9/4/U1n/sVjr+R2pp6bVzX+1nu/GfzLTfqfjXViU9jfhvzid/HK6nf23915Z0/P9dT4y3llip/ayt/6Kd1/+XM+0fxPqvOv6VuLO9Pi/S8T/aslw1/j+08f1/JVOv8/EPYdBaf9fS8T/Wslzt/u/ZOf5TmXqdjv9LnWwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Bkwmhz7QhQPpM7jeGAghPPJ+alwJJouzOanS+WZj5ZCGEvSc+FEdLtUni6U8nML5dlivlAqlWdCuJDknww90VKpXMnPF+5e3GirN7pTLCxWpouFSghhPEn/fzjWaGt6rjJfuBtCuLSR95+4vHj3TmEhPzu3+Obg4OBgmNgYQ39U/KRSXKjUe6/nhjC5Ubcv2jK4WvbljbEcjT4sLy8uFEq19Ctb6pTKM4XSljpTSd4XoT+qLC4vzBQqxXypfLvR30EaSY5jE9feu3ZlaFv+zah+HN3fYQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwFz0afuPLEEJ3/SwOIYw0fomalX/4uHg2/3Tq/trw6cnVB2tPWpUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+JMdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7NIxSgNBFAbgN2Ohdh7DatntbFcU0cIVwRPoMTyMHsVLeIcUKdKmCIFkFsJmF7ZJqu9rHszPzHswDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHme3ruPt7qJSHG1uYz4+/pfHOYvpf7cj9+/OMOMnM7za/fwWDfl39NRfleOlm3epevV92eM1N7vYE+G+7TX97menGtq36bm6/veRMpVRLQlv005V9W8twAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgyw4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24FgAAAAAQJi/dRR9GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPArAAD///4CHxA=")
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000006, 0x31, 0xffffffffffffffff, 0xd0fb6000)
r0 = open(&(0x7f00000005c0)='./bus\x00', 0x167842, 0x19)
pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0xffffffe4}], 0x1, 0x1400, 0x0, 0x0)

42.902352488s ago: executing program 1 (id=2626):
r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
ioctl$TCGETA(r0, 0x5405, 0x0)

42.763603809s ago: executing program 1 (id=2628):
syz_mount_image$ext4(&(0x7f00000007c0)='ext4\x00', &(0x7f00000006c0)='./file1\x00', 0x40, &(0x7f0000000000)={[{@user_xattr}, {@errors_remount}]}, 0x1, 0x576, &(0x7f0000000140)="$eJzs3T1sG2UfAPD/neO3X3nf9JXeVwLUoQKkIlV1kn5AYWpXRKVKHZBYIHLcqIoTV7EDTZQh3StEBwSoS9lgYAQxMCAWRlYWEDNSRSOQmg5g5K80TZzglDouud9POvuee87+P8+d/499pzs5gMw62nhII56OiItJxMi6uqFoVx5trbe6slS8v7JUTKJev/RLEklE3FtZKnbWT9rPhyJiOSKeiohv8hHH081xqwuL0xPlcmmuXR6tzVwdrS4snrgyMzFVmirNnnrp5TNnT58ZPzm+/mX36+tL+Z319caPN9+98d2rt29++tmR5eL7E0mci+F23fp+PE6tbZKPcxuWn+5HsAFKBt0AHkmuneeNVPp/jESunfXd1Ed2tWlAn9X3RdSBjErkP2RU53dA4/i3M+3m748751sHII24q+2pVTPUOjcR+5vHJgd/TR46Mmkcbx7ezYayJy1fj4ixoaHNn/+k/fl7dGOPo4H01dfnWztq8/5P18af6DL+DHfOnf5NnfFvddP49yB+bovx72KPMX5/46ePtox/PeKZrvGTtfhJl/hpRLzVY/xbr395dqu6+scRx6J7/I5k+/PDo5evlEtjrceuMb46duSV7fp/cIv4rXO2+5tfM922f5fT2l198e3nzy5vE/+F57bf/922/4GIeK/H+P+998lrW9XduZ7cbfwK2On+TyIft3uM/+K5oz/0uCoAAAAAAAAAALADafNatiQtrM2naaHQuof3f3EwLVeqteOXK/Ozk61r3g5HPu1caTXSKieN8nj7etxO+eSG8qlcO2DuQLNcKFbKkwPuOwAAAAAAAAAAAAAAAAAAADwpDm24//+3XPP+/41/Vw3sVVv/5Tew18l/yK6H8z8ZWDuA3ef7HzKrLv8hu+Q/ZJf8h+yS/5Bd8h+yS/5Ddsl/AAAAAAAAAAAAAAAAAAAAAAAAAADoi4sXLjSm+v2VpWKjPDm0MD9defvEZKk6XZiZLxaKlbmrhalKZapcKhQrM3/1fkmlcnUsZuevjdZK1dpodWHxzZnK/GznP0VL+b73CAAAAAAAAAAAAAAAAAAAAP55hptTkhYiIm3Op2mhEPHviDicRHL5Srk0FhH/iYjvc/l9jfL4oBsNAAAAAAAAAAAAAAAAAAAAe0x1YXF6olwuzWVkZmgnK0fE8uNtRuMdd/yqfHtfPSnb0EwWZgY8MAEAAAAAAAAAAAAAAAAAQAY9uOm311f80d8GAQAAAAAAAAAAAAAAAAAAQCalPycR0ZiOjTw/vLH2X8lqrvkcEe/cuvTBtYlabW68sfzu2vLah+3lJwfRfqBXnTzt5DEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwQHVhcXqiXC7N9XFm0H0EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeBR/BgAA///eANcP")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r0, 0x0)
truncate(&(0x7f0000000900)='./file1\x00', 0xbf39)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x802, 0xa2)
ioctl$FIBMAP(r1, 0x1, &(0x7f0000000000)=0x4)

42.701664585s ago: executing program 1 (id=2629):
syz_mount_image$cramfs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="00af268263b121dc03d7d9b98b9cdb76841d31005b31fdfd141b652968fbeae7aac982a517703dc5950f6728aecf5ec337b119ffd66d0a02970718ba573db352906385cece74366e628b6a775c9a6f6fff046416c6240e39a647186c4cf0b360bd17d4cdbd912dc61fd24e6f17d8"], 0x1, 0x152, &(0x7f00000007c0)="$eJzs0E1LKnEUx/Hf3Bnlcq/eBzKwFia0aEjMacRatdBIEtKBwk0rwSYKFCOhXBrRrkXQ1oXlVnwLlrWxRgh7E23cBS0n/o7Rw67977MZ5nsOh2FWlnoqgoAMx3KpuLdvlsvmVnDdSCc3ntrtuOhuAD8/zZ39qziwI54KMDgCRL7xAtu7BXMuXyqI90EcUAEkfjtdg7P7SzSf0+YhSaKp00Bn3Gn6aO9ji47apAIk/r7fsy+AGXHv/9s94BlApRZquZCxbNu2xfeepEJTY5LTm3cZq5sKzwbMUz050fD4ZWTN20skhvPHSDf8EGk1+z0rvWakjV5U1xeimqJpsb5xb6Vi1TMoq54DYPPLPTf8ASULHEvA+XA2uJa8ADr1F6P4Z7E++tfVQzkISJVaPud3NXK+fz8gq5BARERERERERERERERERET0Xa8BAAD//wFeZcY=")
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
chdir(&(0x7f00000001c0)='./file0\x00')
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040), &(0x7f0000000240)=ANY=[], 0x25, 0x2)

42.550121672s ago: executing program 1 (id=2630):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='cdg\x00', 0x4)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback, 0x4}, 0x1c)
connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c)
sendmmsg$inet6(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)="12", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000000240)=' ', 0x1}], 0x1}}], 0x2, 0x48800)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='veno\x00', 0x5)
write$tun(r0, &(0x7f0000000b40)=ANY=[], 0x10a)

42.417961193s ago: executing program 1 (id=2631):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000010000000000000000000000a5000000a000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xb9)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x7, 0x8, 0x22}, 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="05"], 0x10)
r2 = socket(0x2, 0x2, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f0000000240), &(0x7f00000000c0)=@tcp=r2, 0x2}, 0x20)

42.349860256s ago: executing program 35 (id=2631):
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000010000000000000000000000a5000000a000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xb9)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x7, 0x8, 0x22}, 0x48)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="05"], 0x10)
r2 = socket(0x2, 0x2, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f0000000240), &(0x7f00000000c0)=@tcp=r2, 0x2}, 0x20)

3.453485727s ago: executing program 6 (id=3004):
syz_pidfd_open(0x0, 0x0)
r0 = syz_mount_image$hfsplus(&(0x7f00000000c0), &(0x7f0000000980)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x1200800, &(0x7f00000008c0)=ANY=[@ANYBLOB="706172743d3078303030303030303030303030303031302c6e6c733d69736f383835392d332c747970653d78fa42012c666f7263652c6769643d", @ANYRESHEX=0x0, @ANYBLOB="00000000f5", @ANYRESHEX=0x0, @ANYBLOB="056c"], 0x3, 0x6ae, &(0x7f0000000e40)="$eJzs3U9sHFcdB/DvbDbrbJBSt03TgJBqNVIFjUjsrEqChNSAEMohQhFcerUSp7GySSvHRWmEyAYoSJw4oR44FKFw6AkhhFQOCFHOSEhcOOUeiRuHHABXM7O7Xtsbx25ir9t+PtJ43ts3773f/DJ/dsexNsBn1rnXsr+XIueOn79Z1u/d7XTv3e1cG5STTCVpJM16laKdFB8mZ1Mv+Xz5Yn+44mHzvHL/g6L57vudutbsL9X2jc36bTB2y15yYFjZl2SmLv53y8NuGK9aqnEuro73cFObNRbDuMuEHRskDiZtZYPeamPjkd23ft4Ce9bt+r65wXRyMPXdtbrF9a8Oj74yTN6m16be7sUBAAAAO2XsZ/lRTz3Ig9zMod0JBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4divo7A4v+0hiUZ1IMvv+/NfKd+q0Jh/uY3rlcrb771KQDAQAAAAAAAIDH8sKDPMjNHBrUV4rqd/4vVpXD1c/P5a3cyEKWciI3M5/lLGcpc0mmRwZq3ZxfXl6a29jzlyl7rqys3O73PDW256m1cfXWBzrufxps2AgAAAAAAAAAPrN+lHOrv/8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC9oEj21atqOTwoT6fRTHIgSauYGW7emmiwT8BfJh0AAAAA7Lx2f32o+H9dWCmqz/xHqs/9B/JWrmc5i1lONwu5VD0LqD/1N/7R63Tv3e1cK5eNA3/j39uKoxox9bOH8TPPVls8N+xxLt/O93I8M7mQpSzm+5nPchYyk29VpfkUme4/vZi+d7edQawb4z27pnZhfWwvjJTL+I5WkbRzOYtVbCdysTUIvdHf7ujIbH9sJetmvFNmp3i1b4s5utRfl3v0i/56b5iu9nz/MCOz/dyX2Xh6NO8bc7/N42T9THNpDJ9BHV6dpayun+lj5fxgf13m+qc7m/NtPkpbm4nez8va4Og7snnOky//868XrjSuX71y+cbxvXMYfUzrj4nOSCae31ImumUmeo+RiQOPE/+T0+pno76Kbu9q+WLV91AW8528kUtZyOnMZi5nMpuv5VQ6OTWS1+c2z2t1rjW2d64d+1K/UN6TfjZyb9o1Uw9rKPP69EheR69001Xb6CurWXpmC1kqWhmfpX+NDaX5hX6hnOPHI3ecyVufibmRTDy7eSZ+/b+VJDe6168uXZl/c5M5bv354EuD8qBQnrbvrL02/+ZJ7tc29He3PF6eKf+xUt82Ro+Osu3ZQVudr6KZ1X6Hh21r73OtVqrzuW571JlajnTkzriR6rbnx87SqdqOjrSteZeTN9IdvgsBYA87+PLBVvt+++/t99o/aV9pnz/wzakzU19sZf/fmn/a97vGbxtfL17Oe/lhDk06UgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+DS48fatq/Pd7sLSHiyk8YQHvDO2aZCK+pXW3tj3T2pharMj6vdJNunemkTM7SR7InVp7sJcUxnTdH74SjtpDONJcnWPfMEdsBNOLl978+SNt299ZfHa/OsLry9cP3Xm9KunO1+du33y8mJ3Ybb+OekogZ2w+jZg0pEAAAAAAAAAAAAAW7Ubf94wZtqiN4F9BQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD6Zzr2W/b0UmZs9MVvW793tdMtlUF7dspmkkaT4QVJ8mJxNvWR6ZLjiYfO8cv+DX7307vud1bGag+0b6/r94T8rK9vci15/yUySff31o01tabyLI+P1thlYrRjuYZmwY4PEwaR9FAAA///howfX")
syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e)
sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
add_key(&(0x7f0000000040)='ceph\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffd)
r5 = fsopen(&(0x7f0000000100)='binder\x00', 0x0)
fsconfig$FSCONFIG_SET_FLAG(r5, 0x0, &(0x7f0000000000)='rw\x00', 0x0, 0x0)
memfd_create(0x0, 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0)
ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405668, &(0x7f0000000080)={0xb, 0x1, 0x0, "1c13ebdaf2f20d55800000000000000000000009234700", 0x584e4f53})
fsmount(r5, 0x0, 0x1)
fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0)
syz_mount_image$fuse(0x0, &(0x7f00000001c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4000, &(0x7f0000000340)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x7000}}, 0x0, 0x0, 0x0)

2.477556262s ago: executing program 6 (id=3008):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=@gettaction={0x48, 0x32, 0x400, 0x70bd2a, 0x25cfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4000009}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f7}}, {0x5, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040810)
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c00000010000304000000d9ff00000000000400", @ANYRES32=r1, @ANYBLOB="60bc010004a701003c00128009000100626f6e64000000002c"], 0x5c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044)

2.409527797s ago: executing program 6 (id=3009):
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]})
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b40)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}}, 0x0)
sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x14, 0x15, 0xa, 0x201}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x24040808)
close_range(r0, 0xffffffffffffffff, 0x0)

2.409321116s ago: executing program 6 (id=3010):
syz_mount_image$hfsplus(&(0x7f0000000100), &(0x7f00000009c0)='./file1\x00', 0x10400, &(0x7f0000000a00)={[{@barrier}, {@gid}, {@barrier}, {@creator={'creator', 0x3d, "ff60f383"}}, {@nobarrier}, {@nls={'nls', 0x3d, 'cp1255'}}, {}]}, 0x1, 0x6e4, &(0x7f0000000240)="$eJzs3U1sHGcZAOB31uu1N5XcbZu0BSHFakQEDSS2l5IgIREQQj5UKBKXXk3iNFbWbmRvkRMhsgUKRzihHHooQubQE+oBqYgDIpyRkLii3CNxjziwaGZn1rtre72b+CcJzyON55uZ7+ed1zOfd2cTbQD/txbficlWJLF47u3NdPvBVr3xYKu+WpQjYioiShHlziqStYjkfsTl6CzxuXRn3l2y1zhvPfzso7P3Pql3tsr5ktUvDWu3rT1khFa+xGxETOTrMZX36u/qLv3dHavrpBt3mrAzReLguLV3aI3TfIT7Fnja3Y2YmNxlfy3iRERM568DIp8dSkcc3oEba5YDAACAp9PEfhVefBSPYjNmjiYcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeD4kne8MTPKlVJRnIym+/7+S70tVKscc73Bf2ef4h9ePKBAAAAAAAAAAOBSf5h/cn34Uj2IzZor97ST7zP+NbONk9vOFeD82YjnW43xsxlI0oxnrMR8xOdPTYWVzqdlcn9/Z8jeRtmy323fzlgsRUdvRcuEIThoAAAAAAAAAnl8/jcWYOe4gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgVxIx0Vlly8miXItSOSKmI6KS1mtF/LkoP8v+ctwBAAAAwOGr5uuZ5L+dQjvJ3vO/mr3vn473Yy2asRLNaMRyXMueBXTe9Zf+0ao3HmzVV9NlZ8ff/vdYcWQ9RsREfLDHyHNZjVPdFovxvfhBnIvZuBLrsRI/iqVoxnLMRjU9iViKJGrVztOLWhHn7vFe7tu6Mhjb6YHt17NIqnE9VrLYzsfVSnQem2TnkI75es9of6xEDIz4QZqd5Fu5EXN0ref39ev8uUyu/eKIfRyOWnbmk92MzKW5z7Px0vDcj3mdDI40H6XuM6iT26Okm4MjFTn/4Tg5P5Gv01z/oj/nB23MR2mDmViIUn71Rbzan/NbX7z3cn/jL//zr1dulNZu3ri+ce4QT+lQTRaFwUzUezLx2vCrL89EI81Ea/RMTA7umH6C8zhAlTwb2VQ04mz53ay0FG/0XILvxbVYjosxF/NxKebiG7EQ9b4r7FRfXsv11f6cZPdaaef8Vh0S/Jkv9VT65T6Vj1aal5d68to709WyY/mey7+KuZ4svTz86hv7r0A6/ufzcjrGz7p/cZ4GfZnI5+YiuleGZ+K37fTnRmPt5vqNpVsjjnc2X6e37Yf9c/PvDuJ8Hl96vaQzbjnbynJSLa6X9Ngr3Wj781XJP3HptCvtOHaqe6wWM7ES39/zTq3kr+F29tQ59lrvsX9tz5yV/PVNcazvVU68F43sVciA2aPJKgAjO/HmiUr1YfXv1Y+rP6/eqL49/Z2pS1NfqMTk38p/mvhD6felbyZvxsfxk5g57kgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB5sHH7zs2lRmN5vVuI6cE9T1qo7DnW8EKU9q2z9cJoHUYtYvhYSV6oHOy5P4uFahxSz59GxJA6lSceIhn7Ghu7kF7IB9Jh8cVp2Z72xBjNy0Wr3euUY2N6r9/g1PZdELWbS43/tPvqVKPnlgGecxeaq7cubNy+89WV1aV3l99dXlu4dPHSxfrX57924fpKY3mu8/O4owQOw8btOxPHHQMAAAAAAAAAAAAwnvxf/zcf+z8zlPepU1nf2H3k00d9qgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAzavGdmGxFEvNz5+fS7Qdb9Ua6FOXtmuWIKEVE8uOI5H7E5egsUevpLtlrnLcefvbR2Xuf1Lf7Khf1S8PajaaVLzEbERP5en9Tu3Szs7+rPf21Hiu8pHuGacLOFImD4/a/AAAA//+vgfmP")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000001f80)=""/4102, 0x1006)

2.336167282s ago: executing program 6 (id=3011):
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
fsopen(0x0, 0x1)
sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x0, 0x0, 0x2, 0x9, 0x8, 0x40, 0x3}, 0x0)
syz_open_procfs(0xffffffffffffffff, 0x0)
openat$sysfs(0xffffff9c, 0x0, 0x42, 0x0)
io_submit(0x0, 0x0, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
keyctl$instantiate(0xc, 0x0, &(0x7f00000002c0)=@encrypted_update={'update ', 'default', 0x20, 'user:', '({]{]%@'}, 0x1c, 0xfffffffffffffff9)
keyctl$clear(0x7, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[], 0x1a, 0xffffffffffffffff)
setsockopt(r2, 0x84, 0x81, &(0x7f0000000280)="1a0000000200", 0x6)
setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, 0x0, 0x0)
socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x1, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x41480}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x401}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x5}, 0x0)

1.921898462s ago: executing program 4 (id=3013):
syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000080)='./file5\x00', 0x10c02, &(0x7f0000000140)={[{@barrier}, {@force}, {@nobarrier}, {@creator={'creator', 0x3d, "02a601b4"}}, {@force}, {@nls={'nls', 0x3d, 'macceltic'}}, {@session={'session', 0x3d, 0x2}}]}, 0x1, 0x6e4, &(0x7f0000001640)="$eJzs3U1sHGcZAOB31uu1N5XcbZu0BSHFakQEDSS2l5IgIREQQj5UKBKXXk3iNFbWbmRvkRMhsgUKRzihHHooQubQE+oBqYgDIpyRkLii3CNxjziwaGZn1rtre72b+CcJzyON55uZ7+ed1zOfd2cTbQD/txbficlWJLF47u3NdPvBVr3xYKu+WpQjYioiShHlziqStYjkfsTl6CzxuXRn3l2y1zhvPfzso7P3Pql3tsr5ktUvDWu3rT1khFa+xGxETOTrMZX36u/qLv3dHavrpBt3mrAzReLguLV3aI3TfIT7Fnja3Y2YmNxlfy3iRERM568DIp8dSkcc3oEba5YDAACAp9PEfhVefBSPYjNmjiYcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeD4kne8MTPKlVJRnIym+/7+S70tVKscc73Bf2ef4h9ePKBAAAAAAAAAAOBSf5h/cn34Uj2IzZor97ST7zP+NbONk9vOFeD82YjnW43xsxlI0oxnrMR8xOdPTYWVzqdlcn9/Z8jeRtmy323fzlgsRUdvRcuEIThoAAAAAAAAAnl8/jcWYOe4gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgVxIx0Vlly8miXItSOSKmI6KS1mtF/LkoP8v+ctwBAAAAwOGr5uuZ5L+dQjvJ3vO/mr3vn473Yy2asRLNaMRyXMueBXTe9Zf+0ao3HmzVV9NlZ8ff/vdYcWQ9RsREfLDHyHNZjVPdFovxvfhBnIvZuBLrsRI/iqVoxnLMRjU9iViKJGrVztOLWhHn7vFe7tu6Mhjb6YHt17NIqnE9VrLYzsfVSnQem2TnkI75es9of6xEDIz4QZqd5Fu5EXN0ref39ev8uUyu/eKIfRyOWnbmk92MzKW5z7Px0vDcj3mdDI40H6XuM6iT26Okm4MjFTn/4Tg5P5Gv01z/oj/nB23MR2mDmViIUn71Rbzan/NbX7z3cn/jL//zr1dulNZu3ri+ce4QT+lQTRaFwUzUezLx2vCrL89EI81Ea/RMTA7umH6C8zhAlTwb2VQ04mz53ay0FG/0XILvxbVYjosxF/NxKebiG7EQ9b4r7FRfXsv11f6cZPdaaef8Vh0S/Jkv9VT65T6Vj1aal5d68to709WyY/mey7+KuZ4svTz86hv7r0A6/ufzcjrGz7p/cZ4GfZnI5+YiuleGZ+K37fTnRmPt5vqNpVsjjnc2X6e37Yf9c/PvDuJ8Hl96vaQzbjnbynJSLa6X9Ngr3Wj781XJP3HptCvtOHaqe6wWM7ES39/zTq3kr+F29tQ59lrvsX9tz5yV/PVNcazvVU68F43sVciA2aPJKgAjO/HmiUr1YfXv1Y+rP6/eqL49/Z2pS1NfqMTk38p/mvhD6felbyZvxsfxk5g57kgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB5sHH7zs2lRmN5vVuI6cE9T1qo7DnW8EKU9q2z9cJoHUYtYvhYSV6oHOy5P4uFahxSz59GxJA6lSceIhn7Ghu7kF7IB9Jh8cVp2Z72xBjNy0Wr3euUY2N6r9/g1PZdELWbS43/tPvqVKPnlgGecxeaq7cubNy+89WV1aV3l99dXlu4dPHSxfrX57924fpKY3mu8/O4owQOw8btOxPHHQMAAAAAAAAAAAAwnvxf/zcf+z8zlPepU1nf2H3k00d9qgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAzavGdmGxFEvNz5+fS7Qdb9Ua6FOXtmuWIKEVE8uOI5H7E5egsUevpLtlrnLcefvbR2Xuf1Lf7Khf1S8PajaaVLzEbERP5en9Tu3Szs7+rPf21Hiu8pHuGacLOFImD4/a/AAAA//+vgfmP")
syz_mount_image$msdos(&(0x7f00000011c0), &(0x7f0000001280)='./file0\x00', 0x4, &(0x7f00000012c0)=ANY=[@ANYBLOB="6e6f646f74732c6e6f646f5d028000000000003128073e006f74732c646f8a25c42c962dab9c56aa65aa9e2623ee78d581b4c7305c5928c40f18c65a6eca2db4b6fd57ad7afa21c9902539279c67284c8badf7222821cbe0b9c3d5eb4a57f45ef53073faf2f0687fa6a52e4e4d330e"], 0x2, 0x11c0, &(0x7f0000000000)="$eJzs3E1LfFUcB/Dff9K0MU17sHTToTa1GdJFi2gjoRAOFOoEGgRXHGuYaWaYO4uZCHLdqt5GtGwXVG/At9CqnQRRG1fdyFF8oAczU/rz+WzmC98zcA7zAOdyzz16/bMPm/t5ZT/rRykeRKkbkY5TpCjFmYN4+dvXfvl0c3tnfaVaXd1IaW1la+nVlNLM89+8+/GXL3zXn3rnq5mvJ+Jw9r2jn5Z/OJw/XDj6deuDRp4aeWp3+ilLu51OP9tt1dNeI29WUnq7Vc/yemq083rvUr/f6nS7w5S196bL3V49z1PWHqZmfZj6ndTvDVP2ftZop0qlkqbLwb9R++K4KIqIohiPR6MoiuKxKMdUPB7TMRNPxGzMxZPxVDwdz8R8PBvPxcLJqPueNwAAAAAAAAAAAAAAAAAAADxc/un5/wfO/wMAAAAAAAAAAAAAAAAAAMCt29zeWV+pVlc3UpqM+PFgUBvURq+jfu3N6uor6cTs+bt+Hnwe5/3SqE8X+0FtIsqn/fIf9pPx0ouj/vfujbeqV/rF2Ls0Uw8dAAAAgJtLZy7t7we1R05SpfJn/ShduD5wZf8+Fotjd7YIbigfftTMWq16TxD+V2HOt/cmYfzvfvil03DPf0zcifNP/1rDv//PJwQAAAAAAAAAAMC13NZ9hZ/8xZj7XiMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL+xA8cCAAAAAML8rdPo2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL4KAAD//8w9dAc=")
mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1)
syz_open_dev$ttys(0xc, 0x2, 0x1)
r0 = syz_open_dev$ptys(0xc, 0x3, 0x1)
ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0xf83, 0x13, 0x80, 0x5, 0x15})
r1 = dup(r0)
write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f00000000c0)={0x7, 0xffffffffffffffa0, 0xfa00, {0xffffffffffffffff, 0x10c}}, 0xfffffd88)

1.408560591s ago: executing program 6 (id=3014):
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
sendfile(r0, r0, 0x0, 0x200000)

907.854847ms ago: executing program 4 (id=3019):
mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1000, 0x103)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80800, 0x0)
r1 = signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x5]}, 0x8)
mount$9p_fd(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000240), 0x10, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1])
open(&(0x7f00000001c0)='./file1\x00', 0x4002, 0x10)

827.709268ms ago: executing program 5 (id=3020):
r0 = socket$inet6(0xa, 0x2, 0x3a)
connect$inet6(r0, &(0x7f0000000640)={0xa, 0x8000, 0x0, @mcast1, 0x46}, 0x1c)
sendto$inet6(r0, &(0x7f0000000000)="80003796a8a814ce", 0x8, 0x0, &(0x7f0000000380)={0xa, 0x4e23, 0x1009, @mcast2, 0x400003c}, 0x1c)

708.759755ms ago: executing program 5 (id=3021):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10)
r1 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003d000b08d25a80648c7494f90224fc605800024004000400050082c137153e3719ac0180feff0000d1bd", 0x33fe0}], 0x1}, 0x0)

596.391991ms ago: executing program 4 (id=3022):
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x10c95, &(0x7f0000000a40)=ANY=[@ANYBLOB="666c7573682c756e695f786c6174653d312c6e6f6e756d7461696c3d302c726f6469722c757466383d312c6e6f6e756d7461696c3d302c756e695f786c6174653d312c6e6f6e756d7461696c3d302c756e695f786c6174653d302c757466383d312c756e695f786c6174653d302c757466383d312c756e695f786c6174653d312c6e6f6e756d7461696c3d302c646f733178666c6f7070792c726f6469722c756e695f786c6174653d312c71756965742c00aaed2e6322e12ca43d55f4e47d9fb6f319fab9c81cd7b9b508d5df5619dad30ed85701f46d5bb2b85a6aecd28cb992054878a859b15b1598ee0b05192ff4df579d2dd32fb9a6a092bb22740cfe0636a3d8ff4e975e21fc6d6e2d6ece2beac2098361fe652ea69917e6d47463ceb0b35bc7a2f8799debe5e7b6e82c84ab25d06157c08f006d90e62a8026a845835dbf4ac25eec51c3ec73c82014eee15eaaa123084415546ca2e37c23d441b343cec1f74e52bc1f21eb18053a9b98d3a304fba3751bd0121940bc9d276f1e5352b9f4e674bb80ffeaaff6843ef1c8a7a7e0d592893a77ae91e025a35840e7ff4fdb3571d1986ed6f5a23d9ee6bf1cec94fb17af0627c04bf47586ce288a466c039a1ead7fd99feacc51d9f7a2e67f46a0b86b45e5d7cb4affc1c539a764f5"], 0xf5, 0x30a, &(0x7f0000000480)="$eJzs3c9rE00YwPEnaZM07du3Pb28iMJQQRTp0hS8ebBIC2JAaRvBCsLWbjVkm5RsKETE9iB49eyhB48iiODNi4jXXvwL/HXrpTcLFkc2+6NpsmxjpbWt38+hme48z+zszmybTpPN+sUnC6V5x/iuu6WFXvYLK3Lu/eqnU1Pv/vG+V2pibDo3qlRSRG49eDH0ttZ34/W/bzKyNnh7fWP069rJaZEf0/ckqYqOKmuttZqtVGoJN3mu6JQMpa7blulYqlh2rGpNmY16c9a21LxdWVysK7M819+7WLUcR5nluipZdVWrqFq1rsy7ZrGsDMNQ/b2tff47DYalZFtdIi6x8HxTa9lwByizIlrriOiVoJDyHzO/11kcJi3jHxvbNjm69rNnOAibujsc//Qu44/jx7v+Pz/t5PrH8TN1c+bqWD4/PqlUj8jC46XCUsF79Oo/9klRbLFkdfL8zJa4c8QnCffrxJX8+IhqGJQzC8t+/vJSwfvlMDbv5+dkwH2e0pQvQX7Oy1c781PS25QfPOmIyh8N8iXZlJ+Ws6eb9m/IgHy4IxWxZa7Rznb+w5xSl6/lW/afbcQBAAAAAAAAAHAUGSq0vX6fCP/VmzWMTOMVH2F91t3sxnkB4fr6iAzIVvT6/Ejk+n63nGh7yQkAAAAAANgPTv1+ybRtq/rrBekgputZNmYXKRFxCyKPhtzOxDb4n9/jliq3jYistIi0t9PVSZ/9QvaCt7+Xk37HZK8nah8LSRFp3uK9WcM9ePtVEJONOj9OMn4CNOoS4TkcTrefedO2ew70kJuPVLTWkcHSs7eJnYk8wE4Kia1gy/+RMTphp3ZrR5tBTHBh7rb3S9GXQ3whnAnu6Hsj2Hqihr947doxPzS+hUt8AAAAAI6Qpj+cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAH7KnO7EF9+3fWSX+R8S335Kt9XPiue8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEPoZwAAAP//k0Cqiw==")

596.211822ms ago: executing program 5 (id=3023):
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4)
recvmmsg(r0, &(0x7f0000004f80)=[{{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000002b00)=""/152, 0x98}], 0x1}, 0x10}], 0x1, 0x20, 0x0)

405.344659ms ago: executing program 4 (id=3024):
mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$cgroup_subtree(r0, &(0x7f0000000200), 0x2, 0x0)
rmdir(&(0x7f0000000080)='./cgroup/../file0\x00')
openat$cgroup_subtree(r0, &(0x7f00000003c0), 0x2, 0x0)

266.33955ms ago: executing program 5 (id=3025):
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x2, &(0x7f00000011c0)=[{0x54}, {0x6}]})

218.381874ms ago: executing program 4 (id=3026):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r1)
sendmsg$NLBL_MGMT_C_REMOVE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004001}, 0x840)

128.761041ms ago: executing program 5 (id=3027):
openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00')
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040))
epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000c40)={0x8000203d})

69.01624ms ago: executing program 4 (id=3028):
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0x8a, &(0x7f0000000200)={[{@jqfmt_vfsold}, {@usrjquota}, {@jqfmt_vfsv0}, {@noload}, {@data_err_ignore}, {@usrjquota, 0x22}, {@init_itable_val={'init_itable', 0x3d, 0x601}}, {@init_itable_val={'init_itable', 0x3d, 0x101}}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x3}}]}, 0xfe, 0x451, &(0x7f00000016c0)="$eJzs3M9PHFUcAPDv7rK0tEWw/iy2ilYj8QcU+sMevNRo4kETEz3UeEKgDXZbTMHENkTRAx5NE+/Go4l/gRfrxagnE696NybEcLF6WjO7M3SBXVhgYWv380kG3tv3Nu99Z+btvn2zswF0rMHkTy7iUET8FhF91ezqCoPVf7eW5yf+WZ6fyEW5/OZfuUq9v5fnJ7Kq2fMOVjPl8gbtLr4TMV4qTV1N8yNzl98fmb12/fnpy+MXpy5OXRk7e/bUyWPdZ8ZOtyTO3qSvAx/NHD3y6ts3Xp84f+Pdn75J+nsoLa+No1UGq3u3rqda3Vib9dakc11t7AhbUoiI5HAVK+O/LwrRs1LWF6982tbOAbuqXM6X9zUuXigDd7Fkog50ouyNPvn8m217NPW4Iyydi5V1jFvpVi3pinxap5h+RtoNgxFxfuHfL5MtdmkdAgCg1s1zEfFcvflfPh6sqXdPem2oPyLujYjDEXFfRNwfEQ9EVOo+FBEPb7H9tVdI1s9/yn3bCqxJyfzvxfTa1ur5Xzb7i/5CmuutxF/MXZguTZ1I98lQFPcl+dEN2vj+5V8/b1RWO/9LtqT9bC6Y9uPPrjULdJPjc+M7ibnW0icRA1314s+tzHmT+fGRiBjYZhvTz3x9tFFZ/6bxb6AFk/LyVxFPV4//QqyJP5NreH1y9IUzY6dH9kdp6sRIdlas9/Mvi280an/z47+7lm6W40Dd838l/v7c/ojZa9cvVa7Xzm69jcXfP2v4mWa753937q1Kujt97MPxubmroxHdudfWPz52+7lZPqufnP9Dx+uP/8Nxe088EhHJSXwsIh6NiMfSvj8eEU9ExPEN4v/xpSff23r8G6zKt1AS/+Rmxz9qj//WE4VLP3xbt/Fis8f/VCU1lD7SzOtfsx3c4e4DAACA/4V85TvwufzwSjqfHx6OWKis7R7Il2Zm5569MPPBlcnqd+X7o5jPVrr6atZDR9O1vCw/tiZ/Ml03/qLQU8kPT8yUJtsdPHS4g9n4L6we/4k/Cu3uHbDr3K8Fncv4h85l/EPnMv6hcxn/0Lnqjf+P29APYO9t8v7fs1f9APae+T90LuMfOpfxDx2p4b3x+R3d8i/RpsR33Tv7rYbmE5G/Q0K+axLFqFvU1fSPWWwzsa9uUbtfmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFrjvwAAAP//gk3jgQ==")

0s ago: executing program 5 (id=3029):
ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, &(0x7f0000000200)="b117c1094e206c98804d43698b727424422169c4f3ef3356c71eea01d438679d29eb27bbb1973f92b2ecd066dca9ddd8e76674590b83c28c74390028a7da8dc1ccc2b24a694cdc6a165f35950d93b6c6ed536db2a2107d36a7f163cb3b1bb3c8cd56e7b17966a8d92227fafc6c6a00c5d6e68e5724eb7be489fd5064a86dd9bb6ae382cd5e97605d27c450145fe7eb683b794df6413a7d94b75306d585fca6496aef35e9fe6384e4375b74711ab94deb3653479e6a5da5529f49f2de550e08d49349dec742fd7f3cce839fa7e637ca35b8e9b02f72268489313e2c18cc06d2ddb165f662d2b0060880ede61691da67b4e101494bc7143fe439664b494faeec6d")
r0 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x80000)
ioctl$EVIOCGLED(r0, 0x5452, &(0x7f0000000240)=""/77)
ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x57, 0x0, 0x0, {0xfffe, 0x1}, {0x74, 0x2}, @const={0x6, {0x7f, 0x0, 0x8000, 0xfffd}}})
r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0x78, 0x822b01)
write$char_usb(r1, &(0x7f0000000040)="e2", 0x1068)

kernel console output (not intermixed with test programs):

2048
[  257.202411][T11411] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  257.210970][T11411] EXT4-fs error (device loop3): ext4_find_dest_de:2052: inode #12: block 9: comm syz.3.2007: bad entry in directory: rec_len % 4 != 0 - offset=0, inode=13, rec_len=21, size=56 fake=0
[  257.224013][T11411] EXT4-fs (loop3): Remounting filesystem read-only
[  257.242007][ T7972] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  257.268454][    C0] vkms_vblank_simulate: vblank timer overrun
[  257.294092][T11415] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2008'.
[  258.046020][   T24] usb 5-1: USB disconnect, device number 9
[  258.080793][   T54] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  258.092800][   T54] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  258.106286][   T54] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  258.109441][   T54] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  258.112189][   T54] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  258.151000][T11424] loop1: detected capacity change from 0 to 32768
[  258.169922][T11424] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  258.182444][T11424] OCFS2: ERROR (device loop1): int ocfs2_validate_dx_root(struct super_block *, struct buffer_head *): Dir Index Root # 28549323745621536 has bad signature 
[  258.194645][T11424] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[  258.204898][T11424] OCFS2: File system is now read-only.
[  258.207764][T11424] (syz.1.2015,11424,0):ocfs2_find_entry_dx:1037 ERROR: status = -30
[  258.224666][T11424] OCFS2: ERROR (device loop1): int ocfs2_validate_dx_root(struct super_block *, struct buffer_head *): Dir Index Root # 28549323745621536 has bad signature 
[  258.232402][T11424] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[  258.237781][T11424] (syz.1.2015,11424,0):ocfs2_find_entry_dx:1037 ERROR: status = -30
[  258.268017][ T5849] ocfs2: Unmounting device (7,1) on (node local)
[  258.316709][T11427] chnl_net:caif_netlink_parms(): no params data found
[  258.374161][T11427] bridge0: port 1(bridge_slave_0) entered blocking state
[  258.377054][T11427] bridge0: port 1(bridge_slave_0) entered disabled state
[  258.379749][T11427] bridge_slave_0: entered allmulticast mode
[  258.382965][T11427] bridge_slave_0: entered promiscuous mode
[  258.388474][T11427] bridge0: port 2(bridge_slave_1) entered blocking state
[  258.391294][T11427] bridge0: port 2(bridge_slave_1) entered disabled state
[  258.393857][T11427] bridge_slave_1: entered allmulticast mode
[  258.396917][T11427] bridge_slave_1: entered promiscuous mode
[  258.421946][T11427] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  258.429460][T11427] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  258.453256][T11440] netlink: 6 bytes leftover after parsing attributes in process `syz.1.2018'.
[  258.460186][T11440] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  258.486821][T11427] team0: Port device team_slave_0 added
[  258.493877][T11427] team0: Port device team_slave_1 added
[  258.532786][T11427] batman_adv: batadv0: Adding interface: batadv_slave_0
[  258.537451][T11427] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  258.549465][T11427] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  258.563094][T11427] batman_adv: batadv0: Adding interface: batadv_slave_1
[  258.566631][T11427] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  258.579492][T11427] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  258.633625][T11427] hsr_slave_0: entered promiscuous mode
[  258.641729][T11427] hsr_slave_1: entered promiscuous mode
[  258.644954][T11427] debugfs: 'hsr0' already exists in 'hsr'
[  258.648165][T11427] Cannot create hsr debugfs directory
[  259.127061][T11427] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  259.139534][T11427] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  259.149489][T11427] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  259.162576][T11427] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  259.280877][T11427] 8021q: adding VLAN 0 to HW filter on device bond0
[  259.305814][T11427] 8021q: adding VLAN 0 to HW filter on device team0
[  259.323070][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[  259.326306][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[  259.342913][ T1095] bridge0: port 2(bridge_slave_1) entered blocking state
[  259.345896][ T1095] bridge0: port 2(bridge_slave_1) entered forwarding state
[  259.543310][T11427] 8021q: adding VLAN 0 to HW filter on device batadv0
[  259.769171][T11427] veth0_vlan: entered promiscuous mode
[  259.785581][T11427] veth1_vlan: entered promiscuous mode
[  259.803921][T11427] veth0_macvtap: entered promiscuous mode
[  259.816166][T11427] veth1_macvtap: entered promiscuous mode
[  259.839249][T11427] batman_adv: batadv0: Interface activated: batadv_slave_0
[  259.845283][T11427] batman_adv: batadv0: Interface activated: batadv_slave_1
[  259.861208][ T5903] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  259.865029][ T5903] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  259.872002][ T5903] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  259.917678][ T5903] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  260.002770][T11471] loop1: detected capacity change from 0 to 32768
[  260.006617][T11480] loop4: detected capacity change from 0 to 16
[  260.009486][T11480] MTD: Attempt to mount non-MTD device "/dev/loop4"
[  260.027002][T11471] jfs_strtoUCS: char2uni returned -22.
[  260.035964][   T69] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  260.039364][   T69] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  260.044780][T11471] charset = cp936, char = 0xd4
[  260.095295][   T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  260.102161][   T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  260.197402][   T54] Bluetooth: hci0: command tx timeout
[  260.250838][T11494] loop5: detected capacity change from 0 to 128
[  260.361647][T11505] loop4: detected capacity change from 0 to 64
[  260.863021][T11525] loop4: detected capacity change from 0 to 32768
[  261.049938][T11529] netlink: 292 bytes leftover after parsing attributes in process `syz.1.2052'.
[  261.240716][T11545] loop1: detected capacity change from 0 to 256
[  261.340406][T11550] dlm: non-version read from control device 36
[  261.414564][T11554] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  261.417827][T11554] IPv6: NLM_F_CREATE should be set when creating new route
[  261.484600][T11558] loop4: detected capacity change from 0 to 64
[  261.488171][T11558] BFS-fs: bfs_fill_super(): loop4 is unclean, continuing
[  261.788729][T11561] loop4: detected capacity change from 0 to 2048
[  261.793906][T11561] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  261.857162][T11563] loop4: detected capacity change from 0 to 8
[  261.859791][T11563] MTD: Attempt to mount non-MTD device "/dev/loop4"
[  262.092694][T11565] cramfs: Error -3 while decompressing!
[  262.095363][T11565] cramfs: ffffffff99be7628(26)->ffff88803df99000(4096)
[  262.098062][T11565] cramfs: Error -3 while decompressing!
[  262.100368][T11565] cramfs: ffffffff99be7642(26)->ffff88803df98000(4096)
[  262.102902][T11565] cramfs: Error -3 while decompressing!
[  262.105438][T11565] cramfs: ffffffff99be765c(16)->ffff8880485a9000(4096)
[  262.108301][T11565] cramfs: Error -3 while decompressing!
[  262.110571][T11565] cramfs: ffffffff99be7628(26)->ffff88803df99000(4096)
[  262.276388][   T54] Bluetooth: hci0: command tx timeout
[  263.719559][T11595] smc: net device bond0 applied user defined pnetid SYZ2
[  264.366073][   T54] Bluetooth: hci0: command tx timeout
[  264.437188][ T5904] usb 2-1: new high-speed USB device number 27 using dummy_hcd
[  264.919602][ T5904] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  264.928141][ T5904] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  264.934035][ T5904] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  264.939790][ T5904] usb 2-1: New USB device found, idVendor=12ba, idProduct=0100, bcdDevice= 0.00
[  264.943057][ T5904] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  264.948069][ T5904] usb 2-1: config 0 descriptor??
[  265.040125][T11630] loop5: detected capacity change from 0 to 4096
[  265.064221][T11630] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  265.110459][T11427] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  265.406827][T11634] loop5: detected capacity change from 0 to 32768
[  265.410933][ T5904] sony 0003:12BA:0100.000D: item fetching failed at offset 5/7
[  265.415037][ T5904] sony 0003:12BA:0100.000D: parse failed
[  265.417962][ T5904] sony 0003:12BA:0100.000D: probe with driver sony failed with error -22
[  265.598988][ T5905] usb 2-1: USB disconnect, device number 27
[  265.961763][    T9] IPVS: starting estimator thread 0...
[  265.962046][T11661] IPVS: fo: UDP 224.0.0.2:0 - no destination available
[  266.056920][T11669] 9pnet_virtio: no channels available for device syz
[  266.072250][T11666] IPVS: using max 43 ests per chain, 103200 per kthread
[  266.360594][T11675] loop4: detected capacity change from 0 to 2048
[  266.413281][T11675]  loop4: p1 p2 < > p3 < p5 >
[  266.415481][T11675] loop4: partition table partially beyond EOD, truncated
[  266.419355][T11675] loop4: p1 size 917504 extends beyond EOD, truncated
[  266.429090][T11675] loop4: p2 start 4278190080 is beyond EOD, truncated
[  266.435921][   T54] Bluetooth: hci0: command tx timeout
[  266.440516][T11675] loop4: p5 size 917504 extends beyond EOD, truncated
[  266.706441][T11681] loop1: detected capacity change from 0 to 8
[  266.863426][T11682] SQUASHFS error: zlib decompression failed, data probably corrupt
[  266.876858][T11682] SQUASHFS error: Failed to read block 0x4e8: -5
[  266.915825][   T33] audit: type=1800 audit(2000000140.510:115): pid=11682 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2117" name="file1" dev="loop1" ino=5 res=0 errno=0
[  267.483013][T11687] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2119'.
[  267.770233][T11692] loop5: detected capacity change from 0 to 512
[  267.781523][T11692] EXT4-fs: Ignoring removed oldalloc option
[  267.868272][T11692] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  267.883642][T11692] ext4 filesystem being mounted at /29/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  268.242004][T11700] EXT4-fs error (device loop5): ext4_empty_dir:3081: inode #12: comm syz.5.2121: invalid size
[  268.338592][T11704] input: syz0 as /devices/virtual/input/input16
[  268.734053][T11427] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  269.702467][T11730] loop1: detected capacity change from 0 to 8
[  269.705248][T11730] MTD: Attempt to mount non-MTD device "/dev/loop1"
[  269.931503][   T51] usb 6-1: new full-speed USB device number 2 using dummy_hcd
[  269.958668][T11735] loop4: detected capacity change from 0 to 16
[  269.970385][T11735] erofs (device loop4): mounted with root inode @ nid 36.
[  270.041732][T11741] loop4: detected capacity change from 0 to 256
[  270.051183][T11741] FAT-fs (loop4): Directory bread(block 64) failed
[  270.053436][T11741] FAT-fs (loop4): Directory bread(block 65) failed
[  270.057659][T11741] FAT-fs (loop4): Directory bread(block 66) failed
[  270.061215][T11741] FAT-fs (loop4): Directory bread(block 67) failed
[  270.063556][T11741] FAT-fs (loop4): Directory bread(block 68) failed
[  270.068132][T11741] FAT-fs (loop4): Directory bread(block 69) failed
[  270.070641][T11741] FAT-fs (loop4): Directory bread(block 70) failed
[  270.073051][T11741] FAT-fs (loop4): Directory bread(block 71) failed
[  270.075380][T11741] FAT-fs (loop4): Directory bread(block 72) failed
[  270.079429][T11741] FAT-fs (loop4): Directory bread(block 73) failed
[  270.090605][T11741] bio_check_eod: 6 callbacks suppressed
[  270.090618][T11741] syz.4.2135: attempt to access beyond end of device
[  270.090618][T11741] loop4: rw=524288, sector=1192, nr_sectors = 4 limit=256
[  270.101470][T11741] syz.4.2135: attempt to access beyond end of device
[  270.101470][T11741] loop4: rw=0, sector=1192, nr_sectors = 4 limit=256
[  270.107722][   T33] audit: type=1800 audit(2000000143.710:116): pid=11741 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2135" name="file1" dev="loop4" ino=1048662 res=0 errno=0
[  270.117653][   T51] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  270.121107][   T51] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2
[  270.124248][   T51] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8
[  270.146691][   T51] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  270.156463][   T51] usb 6-1: config 0 descriptor??
[  270.163174][   T51] dvb-usb: found a 'Artec T1 USB2.0' in warm state.
[  270.172058][   T51] dvb-usb: bulk message failed: -22 (3/0)
[  270.177618][   T51] dvb-usb: will use the device's hardware PID filter (table count: 16).
[  270.185534][   T51] dvbdev: DVB: registering new adapter (Artec T1 USB2.0)
[  270.189228][   T51] usb 6-1: media controller created
[  270.194182][   T51] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  270.204715][   T51] dvb-usb: bulk message failed: -22 (6/0)
[  270.208321][   T51] dvb-usb: no frontend was attached by 'Artec T1 USB2.0'
[  270.212327][   T51] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input17
[  270.219228][   T51] dvb-usb: schedule remote query interval to 150 msecs.
[  270.222010][   T51] dvb-usb: Artec T1 USB2.0 successfully initialized and connected.
[  270.504538][   T24] dvb-usb: bulk message failed: -22 (1/0)
[  270.511862][   T24] dvb-usb: error while querying for an remote control event.
[  270.594737][   T24] usb 6-1: USB disconnect, device number 2
[  270.631975][   T24] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected.
[  271.319755][   T54] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201'
[  271.324551][   T54] CPU: 0 UID: 0 PID: 54 Comm: kworker/u11:0 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  271.324577][   T54] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  271.324588][   T54] Workqueue: hci1 hci_rx_work
[  271.324610][   T54] Call Trace:
[  271.324618][   T54]  <TASK>
[  271.324627][   T54]  dump_stack_lvl+0x189/0x250
[  271.324651][   T54]  ? __pfx_dump_stack_lvl+0x10/0x10
[  271.324666][   T54]  ? __pfx__printk+0x10/0x10
[  271.324692][   T54]  ? kernfs_path_from_node+0x250/0x290
[  271.324710][   T54]  ? kernfs_path_from_node+0x2f/0x290
[  271.324729][   T54]  sysfs_create_dir_ns+0x259/0x280
[  271.324747][   T54]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  271.324761][   T54]  ? do_raw_spin_unlock+0x4d/0x240
[  271.324784][   T54]  kobject_add_internal+0x59f/0xb40
[  271.324811][   T54]  kobject_add+0x155/0x220
[  271.324834][   T54]  ? __pfx_kobject_add+0x10/0x10
[  271.324851][   T54]  ? _raw_spin_unlock+0x28/0x50
[  271.324868][   T54]  ? get_device_parent+0x366/0x3a0
[  271.324891][   T54]  device_add+0x408/0xb50
[  271.324915][   T54]  hci_conn_add_sysfs+0xd5/0x1e0
[  271.324939][   T54]  le_conn_complete_evt+0xc3a/0x1220
[  271.324966][   T54]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  271.324983][   T54]  ? __mutex_unlock_slowpath+0x1a1/0x760
[  271.325005][   T54]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  271.325020][   T54]  ? skb_pull_data+0xfb/0x200
[  271.325038][   T54]  hci_le_enh_conn_complete_evt+0x189/0x470
[  271.325057][   T54]  ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10
[  271.325076][   T54]  hci_event_packet+0x78f/0x1200
[  271.325098][   T54]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  271.325115][   T54]  ? __pfx_hci_event_packet+0x10/0x10
[  271.325134][   T54]  ? kcov_remote_start+0x4d3/0x7f0
[  271.325151][   T54]  ? lockdep_hardirqs_on+0x90/0x150
[  271.325168][   T54]  ? hci_send_to_monitor+0xe2/0x570
[  271.325186][   T54]  hci_rx_work+0x46a/0xe80
[  271.325205][   T54]  ? process_scheduled_works+0x9ef/0x17b0
[  271.325221][   T54]  process_scheduled_works+0xae1/0x17b0
[  271.325253][   T54]  ? __pfx_process_scheduled_works+0x10/0x10
[  271.325315][   T54]  worker_thread+0x8a0/0xda0
[  271.325348][   T54]  kthread+0x711/0x8a0
[  271.325368][   T54]  ? __pfx_worker_thread+0x10/0x10
[  271.325387][   T54]  ? __pfx_kthread+0x10/0x10
[  271.325404][   T54]  ? _raw_spin_unlock_irq+0x23/0x50
[  271.325419][   T54]  ? lockdep_hardirqs_on+0x9c/0x150
[  271.325431][   T54]  ? __pfx_kthread+0x10/0x10
[  271.325446][   T54]  ret_from_fork+0x3fc/0x770
[  271.325463][   T54]  ? __pfx_ret_from_fork+0x10/0x10
[  271.325479][   T54]  ? __switch_to_asm+0x39/0x70
[  271.325494][   T54]  ? __switch_to_asm+0x33/0x70
[  271.325509][   T54]  ? __pfx_kthread+0x10/0x10
[  271.325523][   T54]  ret_from_fork_asm+0x1a/0x30
[  271.325550][   T54]  </TASK>
[  271.325583][   T54] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  271.465351][   T54] Bluetooth: hci1: failed to register connection device
[  272.592866][T11817] loop5: detected capacity change from 0 to 512
[  272.599823][T11817] EXT4-fs (loop5): corrupt root inode, run e2fsck
[  272.603314][T11817] EXT4-fs (loop5): mount failed
[  272.679197][T11824] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  273.084646][T11834] loop5: detected capacity change from 0 to 2048
[  273.089638][T11834] NILFS (loop5): broken superblock, retrying with spare superblock (blocksize = 1024)
[  273.102540][T11835] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  273.286051][   T24] usb 5-1: new high-speed USB device number 10 using dummy_hcd
[  273.445915][   T24] usb 5-1: Using ep0 maxpacket: 8
[  273.454007][   T24] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 7
[  273.460556][   T24] usb 5-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b
[  273.464577][   T24] usb 5-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3
[  273.469204][   T24] usb 5-1: Product: syz
[  273.471219][   T24] usb 5-1: Manufacturer: syz
[  273.473173][   T24] usb 5-1: SerialNumber: syz
[  273.477512][T11841] loop5: detected capacity change from 0 to 32768
[  273.483998][T11841] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.2177 (11841)
[  273.523908][T11841] BTRFS info (device loop5): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  273.531474][T11841] BTRFS info (device loop5): using sha256 (sha256-lib) checksum algorithm
[  273.536643][T11841] BTRFS info (device loop5): using free-space-tree
[  273.596600][   T33] audit: type=1800 audit(2000000403.202:117): pid=11841 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2177" name="file1" dev="loop5" ino=260 res=0 errno=0
[  273.665214][T11427] BTRFS info (device loop5): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  273.695990][   T24] usb 5-1: palm_os_3_probe - error -71 getting connection information
[  273.702942][   T24] visor 5-1:1.0: probe with driver visor failed with error -71
[  273.723613][   T24] usb 5-1: USB disconnect, device number 10
[  273.798806][ T5905] usb 2-1: new high-speed USB device number 28 using dummy_hcd
[  273.955822][ T5905] usb 2-1: Using ep0 maxpacket: 32
[  273.970182][ T5905] usb 2-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  273.976607][ T5905] usb 2-1: config 0 interface 0 has no altsetting 0
[  273.984975][ T5905] usb 2-1: New USB device found, idVendor=6666, idProduct=8801, bcdDevice= 0.00
[  273.989916][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  273.999055][ T5905] usb 2-1: config 0 descriptor??
[  274.430156][ T5905] smartjoyplus 0003:6666:8801.000E: unknown main item tag 0x2
[  274.458642][ T5905] smartjoyplus 0003:6666:8801.000E: hidraw0: USB HID vf.fe Device [HID 6666:8801] on usb-dummy_hcd.1-1/input0
[  274.468013][ T5905] smartjoyplus 0003:6666:8801.000E: no output reports found
[  274.627799][ T5905] usb 2-1: USB disconnect, device number 28
[  275.935268][T11887] loop5: detected capacity change from 0 to 256
[  276.003890][T11887] exFAT-fs (loop5): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x53fda505, utbl_chksum : 0xe619d30d)
[  276.011581][T11887] exFAT-fs (loop5): bogus allocation bitmap size(need : 2, cur : 17179869186)
[  276.063736][   T33] audit: type=1800 audit(2000000405.662:118): pid=11887 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2191" name="file0" dev="loop5" ino=1048664 res=0 errno=0
[  276.072498][T11885] loop1: detected capacity change from 0 to 32768
[  276.113271][T11885] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  276.246785][T11885] XFS (loop1): Ending clean mount
[  276.279409][T11885] XFS (loop1): Quotacheck needed: Please wait.
[  276.377952][T11885] XFS (loop1): Quotacheck: Done.
[  276.424532][T11901] loop5: detected capacity change from 0 to 1024
[  276.438866][T11901] hfsplus: bad catalog entry type
[  276.463755][   T26] hfsplus: b-tree write err: -5, ino 4
[  276.642319][ T5849] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  276.854367][T11917] loop1: detected capacity change from 0 to 256
[  276.858263][T11917] exfat: Deprecated parameter 'namecase'
[  276.861006][T11917] exfat: Deprecated parameter 'utf8'
[  276.871263][T11917] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d)
[  277.202834][ T5904] kernel read not supported for file /dsp1 (pid: 5904 comm: kworker/0:6)
[  277.498489][   T33] audit: type=1326 audit(2000000407.102:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11943 comm="syz.4.2215" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b0b38ebe9 code=0x7ffc0000
[  277.509911][   T33] audit: type=1326 audit(2000000407.102:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11943 comm="syz.4.2215" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b0b38ebe9 code=0x7ffc0000
[  277.528849][   T33] audit: type=1326 audit(2000000407.102:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11943 comm="syz.4.2215" exe="/syz-executor" sig=0 arch=c000003e syscall=104 compat=0 ip=0x7f0b0b38ebe9 code=0x7ffc0000
[  277.539069][   T33] audit: type=1326 audit(2000000407.102:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11943 comm="syz.4.2215" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b0b38ebe9 code=0x7ffc0000
[  277.886218][   T33] audit: type=1326 audit(2000000407.102:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11943 comm="syz.4.2215" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b0b38ebe9 code=0x7ffc0000
[  278.359643][ T5904] usb 5-1: new full-speed USB device number 11 using dummy_hcd
[  278.517630][ T5904] usb 5-1: config 0 has an invalid interface number: 31 but max is 0
[  278.520867][ T5904] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  278.524339][ T5904] usb 5-1: config 0 has no interface number 0
[  278.528862][ T5904] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16
[  278.531909][ T5904] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  278.534617][ T5904] usb 5-1: Product: syz
[  278.536334][ T5904] usb 5-1: Manufacturer: syz
[  278.538359][ T5904] usb 5-1: SerialNumber: syz
[  278.541577][ T5904] usb 5-1: config 0 descriptor??
[  278.544864][ T5904] hub 5-1:0.31: bad descriptor, ignoring hub
[  278.547088][ T5904] hub 5-1:0.31: probe with driver hub failed with error -5
[  278.551030][ T5904] usb 5-1: Found UVC 0.04 device syz (046d:08c3)
[  278.558767][ T5904] uvcvideo 5-1:0.31: Entity type for entity Output 6 was not initialized!
[  278.562751][ T5904] usb 5-1: Failed to create links for entity 6
[  278.564866][ T5904] usb 5-1: Failed to register entities (-22).
[  278.826011][T11964] loop1: detected capacity change from 0 to 16
[  278.831555][T11964] erofs (device loop1): mounted with root inode @ nid 36.
[  278.866927][   T51] usb 5-1: USB disconnect, device number 11
[  279.072704][T11980] loop1: detected capacity change from 0 to 16
[  279.081649][T11980] erofs (device loop1): rootino(nid 36) is not a directory(i_mode 127766)
[  279.133771][T11982] loop1: detected capacity change from 0 to 16
[  279.138669][T11982] erofs (device loop1): mounted with root inode @ nid 36.
[  279.453390][   T33] audit: type=1800 audit(2000000409.022:124): pid=11987 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2231" name="file1" dev="loop1" ino=86 res=0 errno=0
[  279.738612][T11991] loop5: detected capacity change from 0 to 512
[  279.743185][T11991] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended
[  279.762329][T11991] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  279.795356][T11427] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  280.089475][T12015] libceph: resolve '4..' (ret=-3): failed
[  280.129572][T12019] loop1: detected capacity change from 0 to 256
[  280.160069][T12019] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x53fda505, utbl_chksum : 0xe619d30d)
[  280.172834][T12019] exFAT-fs (loop1): bogus allocation bitmap size(need : 2, cur : 17179869186)
[  280.489870][T12033] loop5: detected capacity change from 0 to 256
[  281.476132][    T9] usb 5-1: new high-speed USB device number 12 using dummy_hcd
[  281.681599][    T9] usb 5-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7
[  281.689106][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  281.692175][    T9] usb 5-1: Product: syz
[  281.693912][    T9] usb 5-1: Manufacturer: syz
[  281.696943][    T9] usb 5-1: SerialNumber: syz
[  281.718872][    T9] usb 5-1: config 0 descriptor??
[  282.064756][    T9] usb 5-1: f81604_read: reg: 105 failed: -EPROTO
[  282.068700][    T9] f81604 5-1:0.0: Setting termination of CH#0 failed: -EPROTO
[  282.071449][    T9] f81604 5-1:0.0: probe with driver f81604 failed with error -71
[  282.077624][    T9] usb 5-1: USB disconnect, device number 12
[  282.125980][T12054] loop5: detected capacity change from 0 to 512
[  282.129340][T12054] EXT4-fs: inline encryption not supported
[  282.132472][T12054] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode
[  282.139420][T12054] EXT4-fs (loop5): Number of reserved GDT blocks insanely large: 65280
[  282.188000][T12058] loop5: detected capacity change from 0 to 64
[  282.303302][T12064] loop5: detected capacity change from 0 to 4096
[  282.307873][T12064] ntfs3(loop5): Different NTFS sector size (4096) and media sector size (512).
[  282.598858][T12091] random: crng reseeded on system resumption
[  282.930938][T12098] loop4: detected capacity change from 0 to 8
[  282.953092][T12098] SQUASHFS error: zlib decompression failed, data probably corrupt
[  282.958327][T12098] SQUASHFS error: Failed to read block 0x9b: -5
[  282.963321][T12098] SQUASHFS error: Unable to read metadata cache entry [99]
[  282.968606][T12098] SQUASHFS error: Unable to read inode 0x127
[  283.272034][T12102] loop4: detected capacity change from 0 to 1764
[  283.328440][T12102] iso9660: Corrupted directory entry in block 2 of inode 1920
[  283.805478][  T791] usb 5-1: new low-speed USB device number 13 using dummy_hcd
[  283.924086][T12110] loop1: detected capacity change from 0 to 1024
[  283.975485][T12110] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  283.991677][  T791] usb 5-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config
[  283.998110][  T791] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8
[  284.003398][  T791] usb 5-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  284.019484][  T791] usb 5-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config
[  284.031135][  T791] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8
[  284.070912][  T791] usb 5-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  284.079234][  T791] usb 5-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config
[  284.083797][  T791] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8
[  284.093106][  T791] usb 5-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  284.103027][  T791] usb 5-1: string descriptor 0 read error: -22
[  284.107669][  T791] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e
[  284.111922][  T791] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  284.161499][  T791] adutux 5-1:168.0: interrupt endpoints not found
[  284.388715][  T791] usb 5-1: USB disconnect, device number 13
[  284.541137][T12115] loop5: detected capacity change from 0 to 40427
[  284.545563][T12115] F2FS-fs (loop5): Small segment_count (9 < 1 * 24)
[  284.548555][T12115] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock
[  284.614464][T12115] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  284.627127][T12115] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0
[  284.630161][T12115] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5
[  284.666126][T11427] syz-executor: attempt to access beyond end of device
[  284.666126][T11427] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  284.671911][T11427] CPU: 1 UID: 0 PID: 11427 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  284.671933][T11427] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  284.671941][T11427] Call Trace:
[  284.671946][T11427]  <TASK>
[  284.671952][T11427]  dump_stack_lvl+0x189/0x250
[  284.671977][T11427]  ? __pfx_dump_stack_lvl+0x10/0x10
[  284.671990][T11427]  ? __pfx_queue_work_on+0x10/0x10
[  284.672002][T11427]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  284.672016][T11427]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  284.672037][T11427]  f2fs_handle_critical_error+0x37c/0x540
[  284.672058][T11427]  f2fs_write_end_io+0x886/0xb60
[  284.672098][T11427]  __submit_merged_bio+0x27a/0x6a0
[  284.672118][T11427]  __submit_merged_write_cond+0x255/0x530
[  284.672138][T11427]  f2fs_write_data_pages+0x261d/0x3000
[  284.672182][T11427]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  284.672266][T11427]  ? ktime_get+0x3e/0x1f0
[  284.672282][T11427]  ? ktime_get+0x3e/0x1f0
[  284.672310][T11427]  ? __lock_acquire+0xab9/0xd20
[  284.672336][T11427]  ? do_raw_spin_lock+0x121/0x290
[  284.672359][T11427]  ? do_raw_spin_unlock+0x4d/0x240
[  284.672372][T11427]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  284.672389][T11427]  do_writepages+0x32e/0x550
[  284.672414][T11427]  ? do_raw_spin_unlock+0x4d/0x240
[  284.672430][T11427]  filemap_fdatawrite+0x199/0x240
[  284.672445][T11427]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  284.672494][T11427]  ? do_raw_spin_unlock+0x4d/0x240
[  284.672510][T11427]  f2fs_sync_dirty_inodes+0x31f/0x830
[  284.672539][T11427]  f2fs_write_checkpoint+0x95a/0x1df0
[  284.672575][T11427]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  284.672628][T11427]  ? call_rcu+0x6ff/0x9c0
[  284.672640][T11427]  ? lockdep_hardirqs_on+0x9c/0x150
[  284.672654][T11427]  ? kill_f2fs_super+0x298/0x6c0
[  284.672674][T11427]  kill_f2fs_super+0x2c3/0x6c0
[  284.672695][T11427]  ? __pfx_kill_f2fs_super+0x10/0x10
[  284.672709][T11427]  ? radix_tree_delete_item+0x2b6/0x400
[  284.672729][T11427]  ? shrinker_free+0x2ce/0x3e0
[  284.672745][T11427]  deactivate_locked_super+0xbc/0x130
[  284.672761][T11427]  cleanup_mnt+0x425/0x4c0
[  284.672774][T11427]  ? lockdep_hardirqs_on+0x9c/0x150
[  284.672789][T11427]  task_work_run+0x1d4/0x260
[  284.672811][T11427]  ? __pfx_task_work_run+0x10/0x10
[  284.672825][T11427]  ? __x64_sys_umount+0x122/0x160
[  284.672846][T11427]  ? exit_to_user_mode_loop+0x40/0x110
[  284.672867][T11427]  exit_to_user_mode_loop+0xec/0x110
[  284.672884][T11427]  do_syscall_64+0x2bd/0x3b0
[  284.672899][T11427]  ? lockdep_hardirqs_on+0x9c/0x150
[  284.672913][T11427]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  284.672927][T11427]  ? exc_page_fault+0x9f/0xf0
[  284.672945][T11427]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  284.672958][T11427] RIP: 0033:0x7f5d8178ff17
[  284.672973][T11427] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  284.672984][T11427] RSP: 002b:00007ffd66835648 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  284.673001][T11427] RAX: 0000000000000000 RBX: 00007f5d81811c05 RCX: 00007f5d8178ff17
[  284.673010][T11427] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd66835700
[  284.673019][T11427] RBP: 00007ffd66835700 R08: 0000000000000000 R09: 0000000000000000
[  284.673027][T11427] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd66836790
[  284.673036][T11427] R13: 00007f5d81811c05 R14: 000000000004577e R15: 00007ffd668367d0
[  284.673061][T11427]  </TASK>
[  284.673077][T11427] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  284.885575][ T5849] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  285.285431][   T51] usb 2-1: new full-speed USB device number 29 using dummy_hcd
[  285.596146][   T51] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  285.610165][   T51] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64
[  285.651179][   T51] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40
[  285.655415][   T51] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  285.661767][   T51] usb 2-1: config 0 descriptor??
[  285.665662][T12121] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  285.670773][   T51] hub 2-1:0.0: USB hub found
[  285.685361][ T1822] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[  285.841160][ T1822] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  285.850597][ T1822] usb 6-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49
[  285.853887][ T1822] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  285.857464][ T1822] usb 6-1: Product: syz
[  285.859397][ T1822] usb 6-1: Manufacturer: syz
[  285.861351][ T1822] usb 6-1: SerialNumber: syz
[  285.867605][ T1822] usb 6-1: config 0 descriptor??
[  285.894695][   T51] hub 2-1:0.0: 2 ports detected
[  285.896055][T12133] ceph: No mds server is up or the cluster is laggy
[  286.077324][ T5904] usb 6-1: USB disconnect, device number 3
[  286.086761][   T51] hub 2-1:0.0: hub_hub_status failed (err = -71)
[  286.089720][   T51] hub 2-1:0.0: config failed, can't get hub status (err -71)
[  286.097358][   T51] usbhid 2-1:0.0: can't add hid device: -71
[  286.101099][   T51] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[  286.125892][   T51] usb 2-1: USB disconnect, device number 29
[  287.143594][T12160] loop1: detected capacity change from 0 to 2048
[  287.173858][T12160] NILFS (loop1): invalid segment: Checksum error in super root
[  287.177575][T12160] NILFS (loop1): error -22 while loading super root
[  287.571054][T12170] loop4: detected capacity change from 0 to 4096
[  287.590051][T12171] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  287.832732][T12196] loop4: detected capacity change from 0 to 512
[  287.897320][T12198] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) !
[  287.935069][   T24] usb 2-1: new high-speed USB device number 30 using dummy_hcd
[  288.024996][   T51] usb 6-1: new low-speed USB device number 4 using dummy_hcd
[  288.085046][   T24] usb 2-1: Using ep0 maxpacket: 8
[  288.088974][   T24] usb 2-1: config 0 has an invalid interface number: 25 but max is 0
[  288.091610][   T24] usb 2-1: config 0 has no interface number 0
[  288.093569][   T24] usb 2-1: config 0 interface 25 altsetting 0 endpoint 0xE has an invalid bInterval 0, changing to 7
[  288.100645][   T24] usb 2-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice= f.2b
[  288.104328][   T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  288.107835][   T24] usb 2-1: Product: syz
[  288.109649][   T24] usb 2-1: Manufacturer: syz
[  288.111599][   T24] usb 2-1: SerialNumber: syz
[  288.115974][   T24] usb 2-1: config 0 descriptor??
[  288.165051][ T1822] usb 5-1: new high-speed USB device number 14 using dummy_hcd
[  288.184625][   T51] usb 6-1: string descriptor 0 read error: -22
[  288.187775][   T51] usb 6-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f
[  288.191643][   T51] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  288.197290][   T51] usb 6-1: config 0 descriptor??
[  288.201915][   T51] usbtest 6-1:0.0: FX2 device
[  288.203677][   T51] usbtest 6-1:0.0: low-speed {control intr-in intr-out} tests (+alt)
[  288.317775][ T1822] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  288.321435][ T1822] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  288.324910][ T1822] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  288.328227][   T24] kobil_sct 2-1:0.25: KOBIL USB smart card terminal converter detected
[  288.329333][ T1822] usb 5-1: New USB device found, idVendor=0b05, idProduct=1854, bcdDevice= 0.00
[  288.336031][   T24] usb 2-1: KOBIL USB smart card terminal converter now attached to ttyUSB0
[  288.336972][ T1822] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  288.341668][   T24] usb 2-1: USB disconnect, device number 30
[  288.349498][ T1822] usb 5-1: config 0 descriptor??
[  288.351944][   T24] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0
[  288.357806][   T24] kobil_sct 2-1:0.25: device disconnected
[  288.409357][ T5904] usb 6-1: USB disconnect, device number 4
[  288.763727][ T1822] asus 0003:0B05:1854.000F: report_id 393985501 is invalid
[  288.768152][ T1822] asus 0003:0B05:1854.000F: item 0 4 1 8 parsing failed
[  288.771992][ T1822] asus 0003:0B05:1854.000F: Asus hid parse failed: -22
[  288.775401][ T1822] asus 0003:0B05:1854.000F: probe with driver asus failed with error -22
[  289.050395][ T1822] usb 5-1: USB disconnect, device number 14
[  289.264298][T12216] overlayfs: overlapping lowerdir path
[  289.423789][T12220] netlink: 'syz.1.2330': attribute type 10 has an invalid length.
[  289.438425][T12220] bond0: (slave syz_tun): Enslaving as an active interface with an up link
[  289.480732][T12222] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  289.557987][T12226] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2333'.
[  289.891236][T12240] loop5: detected capacity change from 0 to 256
[  289.898031][T12240] MINIX-fs: mounting file system with errors, running fsck is recommended
[  290.079664][T12253] mmap: syz.5.2345 (12253) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[  290.294624][   T51] usb 5-1: new high-speed USB device number 15 using dummy_hcd
[  290.534593][   T51] usb 5-1: Using ep0 maxpacket: 32
[  290.540310][   T51] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[  290.544153][   T51] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  290.549137][   T51] usb 5-1: config 1 interface 2 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7
[  290.553705][   T51] usb 5-1: Duplicate descriptor for config 1 interface 2 altsetting 0, skipping
[  291.348432][   T51] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  291.351578][   T51] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  291.354201][   T51] usb 5-1: Product: syz
[  291.360300][   T51] usb 5-1: Manufacturer: syz
[  291.363306][   T51] usb 5-1: SerialNumber: syz
[  291.516126][T12281] loop1: detected capacity change from 0 to 128
[  291.519081][T12281] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (30846!=65535)
[  291.529327][T12281] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 ro without journal. Quota mode: none.
[  291.536684][T12281] EXT4-fs error (device loop1): __ext4_find_entry:1626: inode #2: comm syz.1.2357: checksumming directory block 0
[  291.569221][ T5849] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  291.619370][   T51] usb 5-1: USB disconnect, device number 15
[  291.620801][T12285] netlink: 'syz.5.2358': attribute type 1 has an invalid length.
[  291.831321][T12291] loop1: detected capacity change from 0 to 1024
[  291.857462][T12291] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  291.980945][ T5849] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  292.307341][T12298] loop4: detected capacity change from 0 to 4096
[  293.002244][T12322] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  293.081050][T12330] loop5: detected capacity change from 0 to 8
[  293.088102][T12330] SQUASHFS error: lzo decompression failed, data probably corrupt
[  293.091625][T12330] SQUASHFS error: Failed to read block 0x91: -5
[  293.095614][T12330] SQUASHFS error: Unable to read metadata cache entry [8f]
[  293.098737][T12330] SQUASHFS error: Unable to read inode 0x11f
[  293.128634][T12333] loop5: detected capacity change from 0 to 256
[  293.134054][T12333] exFAT-fs (loop5): failed to load upcase table (idx : 0x0001e4a3, chksum : 0x00949fb8, utbl_chksum : 0x7319d30d)
[  293.470696][T12341] loop5: detected capacity change from 0 to 32768
[  293.994129][ T1822] usb 6-1: new full-speed USB device number 5 using dummy_hcd
[  294.084853][T12361] loop4: detected capacity change from 0 to 32768
[  294.088936][T12361] BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.2391 (12361)
[  294.095291][T12361] BTRFS info (device loop4): first mount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2
[  294.098713][T12361] BTRFS info (device loop4): using xxhash64 (xxhash64-generic) checksum algorithm
[  294.102182][T12361] BTRFS info (device loop4): disk space caching is enabled
[  294.105867][T12361] BTRFS warning (device loop4): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2
[  294.142035][T12361] BTRFS info (device loop4): rebuilding free space tree
[  294.154917][T12361] BTRFS info (device loop4): disabling free space tree
[  294.157545][T12361] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  294.160861][T12361] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  294.168168][ T1822] usb 6-1: New USB device found, idVendor=13d8, idProduct=0011, bcdDevice=d0.62
[  294.174930][ T1822] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  294.177647][ T1822] usb 6-1: Product: syz
[  294.184273][ T1822] usb 6-1: Manufacturer: syz
[  294.186260][ T1822] usb 6-1: SerialNumber: syz
[  294.191832][ T1822] usb 6-1: config 0 descriptor??
[  294.194176][T12361] BTRFS warning (device loop4): can't clear the compat:1 feature bit while mounted
[  294.205668][ T1822] comedi comedi5: This driver needs USB 2.0 to operate. Aborting...
[  294.209847][ T1822] usbduxfast 6-1:0.0: driver 'usbduxfast' failed to auto-configure device.
[  294.227196][ T9822] BTRFS info (device loop4): last unmount of filesystem e417788f-7a09-42b2-9266-8ddc5d5d35d2
[  294.441342][ T1822] usb 6-1: USB disconnect, device number 5
[  294.512717][T12381] loop1: detected capacity change from 0 to 256
[  294.521570][T12381] exfat: Deprecated parameter 'namecase'
[  294.535167][T12381] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d)
[  295.233998][ T1822] usb 2-1: new high-speed USB device number 31 using dummy_hcd
[  295.275008][ T5904] usb 6-1: new full-speed USB device number 6 using dummy_hcd
[  295.384071][ T1822] usb 2-1: Using ep0 maxpacket: 32
[  295.390770][ T1822] usb 2-1: config 0 has an invalid interface number: 83 but max is 0
[  295.397394][ T1822] usb 2-1: config 0 has no interface number 0
[  295.399799][ T1822] usb 2-1: config 0 interface 83 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  295.403096][ T1822] usb 2-1: config 0 interface 83 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0
[  295.407441][ T1822] usb 2-1: config 0 interface 83 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  295.415483][ T1822] usb 2-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=d8.11
[  295.419070][ T1822] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  295.421697][ T1822] usb 2-1: Product: syz
[  295.423061][ T1822] usb 2-1: Manufacturer: syz
[  295.424927][ T1822] usb 2-1: SerialNumber: syz
[  295.431329][ T1822] usb 2-1: config 0 descriptor??
[  295.436251][ T1822] redrat3 2-1:0.83: Couldn't find all endpoints
[  295.446063][ T5904] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  295.450386][ T5904] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3
[  295.457592][ T5904] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  295.461630][ T5904] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  295.464851][ T5904] usb 6-1: Product: syz
[  295.466475][ T5904] usb 6-1: Manufacturer: syz
[  295.468050][ T5904] usb 6-1: SerialNumber: syz
[  295.640468][ T1822] usb 2-1: USB disconnect, device number 31
[  295.668007][T12410] loop4: detected capacity change from 0 to 8192
[  295.676718][ T5904] usb 6-1: 0:2 : does not exist
[  295.694649][ T5904] usb 6-1: 5:0: failed to get current value for ch 0 (-22)
[  295.707980][ T5904] usb 6-1: USB disconnect, device number 6
[  295.790751][T12414] loop4: detected capacity change from 0 to 512
[  295.797917][T12414] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (57259!=33349)
[  295.803601][T12414] EXT4-fs (loop4): orphan cleanup on readonly fs
[  295.807238][T12414] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:517: comm syz.4.2407: Block bitmap for bg 0 marked uninitialized
[  295.813249][T12414] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6657: Corrupt filesystem
[  295.818768][T12414] EXT4-fs (loop4): 1 orphan inode deleted
[  295.822179][T12414] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none.
[  296.347837][T12423] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2411'.
[  296.409265][T12429] loop1: detected capacity change from 0 to 512
[  296.427927][T12429] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback.
[  296.432644][T12429] ext4 filesystem being mounted at /774/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff)
[  296.479770][   T33] audit: type=1800 audit(2000003004.076:125): pid=12429 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2413" name="file1" dev="loop1" ino=20 res=0 errno=0
[  296.528097][ T5849] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000d40000.
[  296.649934][T12427] loop5: detected capacity change from 0 to 32768
[  296.670865][T12427] XFS: ikeep mount option is deprecated.
[  296.711328][ T9822] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  296.765791][T12427] XFS (loop5): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  296.810785][T12447] sit0: entered promiscuous mode
[  296.831252][T12447] netlink: 21 bytes leftover after parsing attributes in process `syz.4.2416'.
[  296.835515][T12427] XFS (loop5): Ending clean mount
[  296.843281][T12450] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2418'.
[  296.848361][T12427] XFS (loop5): Quotacheck needed: Please wait.
[  296.856860][T12450] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2418'.
[  296.906388][    C1] vkms_vblank_simulate: vblank timer overrun
[  296.912459][T12427] XFS (loop5): Quotacheck: Done.
[  296.980071][T11427] XFS (loop5): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  297.160388][T12466] loop5: detected capacity change from 0 to 256
[  297.183204][T12466] exfat: Deprecated parameter 'utf8'
[  297.233547][T12466] exFAT-fs (loop5): error, data size is invalid(34359738378)
[  297.373782][  T791] usb 2-1: new high-speed USB device number 32 using dummy_hcd
[  297.503761][ T5904] usb 6-1: new high-speed USB device number 7 using dummy_hcd
[  297.524277][  T791] usb 2-1: Using ep0 maxpacket: 16
[  297.528850][  T791] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  297.532642][  T791] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[  297.537697][  T791] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  297.540654][  T791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  297.543180][  T791] usb 2-1: Product: syz
[  297.546000][  T791] usb 2-1: Manufacturer: syz
[  297.547597][  T791] usb 2-1: SerialNumber: syz
[  297.654102][ T5904] usb 6-1: Using ep0 maxpacket: 8
[  297.658964][ T5904] usb 6-1: config 2 has an invalid interface number: 2 but max is 0
[  297.662394][ T5904] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config
[  297.668688][ T5904] usb 6-1: config 2 has no interface number 0
[  297.671509][ T5904] usb 6-1: config 2 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  297.673759][   T51] usb 5-1: new high-speed USB device number 16 using dummy_hcd
[  297.677495][ T5904] usb 6-1: New USB device found, idVendor=1bbb, idProduct=0203, bcdDevice=1c.35
[  297.683391][ T5904] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  297.853713][   T51] usb 5-1: Using ep0 maxpacket: 16
[  297.858306][   T51] usb 5-1: config 0 has an invalid interface number: 105 but max is 0
[  297.861204][   T51] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  297.864983][   T51] usb 5-1: config 0 has no interface number 0
[  297.871021][   T51] usb 5-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28
[  297.875498][   T51] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  297.878310][   T51] usb 5-1: Product: syz
[  297.879825][   T51] usb 5-1: Manufacturer: syz
[  297.881544][   T51] usb 5-1: SerialNumber: syz
[  297.887234][   T51] usb 5-1: config 0 descriptor??
[  297.901428][ T1822] usb 6-1: USB disconnect, device number 7
[  297.955098][  T791] usb 2-1: cannot find UAC_HEADER
[  297.970889][  T791] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22
[  298.093142][   T51] usb 5-1: Found UVC 0.00 device syz (046d:08f3)
[  298.095472][   T51] usb 5-1: No valid video chain found.
[  298.098714][   T51] usb 5-1: USB disconnect, device number 16
[  298.158036][  T791] usb 2-1: USB disconnect, device number 32
[  298.577074][T12482] loop5: detected capacity change from 0 to 40427
[  298.584568][T12482] F2FS-fs (loop5): invalid crc value
[  298.636907][T12482] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  298.645559][T12482] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5
[  298.679382][T12482] F2FS-fs (loop5): Can't enable fs-verity on inode 3: the verity feature is not enabled on this filesystem
[  299.136661][T12515] loop4: detected capacity change from 0 to 64
[  299.976990][T12519] loop1: detected capacity change from 0 to 4096
[  301.486199][ T1089] Bluetooth: hci3: Frame reassembly failed (-84)
[  302.283129][ T9215] Bluetooth: hci0: command 0x0405 tx timeout
[  303.026051][T12580] loop4: detected capacity change from 0 to 1024
[  303.038221][T12580] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  303.091358][T12580] EXT4-fs error (device loop4): __ext4_remount:6736: comm syz.4.2475: Abort forced by user
[  303.096426][T12580] EXT4-fs (loop4): Remounting filesystem read-only
[  303.098884][T12580] EXT4-fs (loop4): re-mounted 00000000-0000-0000-0000-000000000000.
[  303.128190][ T9822] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  303.355438][T12594] random: crng reseeded on system resumption
[  303.473187][ T5844] Bluetooth: hci3: Opcode 0x1003 failed: -110
[  304.365900][T12618] loop1: detected capacity change from 0 to 2048
[  304.378864][T12618] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  304.735442][T12641] vcan0: tx drop: invalid sa for name 0x0000000000000003
[  305.031698][T12643] loop5: detected capacity change from 0 to 256
[  305.041000][T12643] FAT-fs (loop5): Directory bread(block 64) failed
[  305.043881][T12643] FAT-fs (loop5): Directory bread(block 65) failed
[  305.046166][T12643] FAT-fs (loop5): Directory bread(block 66) failed
[  305.048363][T12643] FAT-fs (loop5): Directory bread(block 67) failed
[  305.050617][T12643] FAT-fs (loop5): Directory bread(block 68) failed
[  305.053005][T12643] FAT-fs (loop5): Directory bread(block 69) failed
[  305.055244][T12643] FAT-fs (loop5): Directory bread(block 70) failed
[  305.057520][T12643] FAT-fs (loop5): Directory bread(block 71) failed
[  305.059666][T12643] FAT-fs (loop5): Directory bread(block 72) failed
[  305.062116][T12643] FAT-fs (loop5): Directory bread(block 73) failed
[  305.305962][T12632] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[  305.539020][T12659] loop5: detected capacity change from 0 to 1024
[  305.541727][T12659] EXT4-fs: Ignoring removed nobh option
[  305.544626][T12659] EXT4-fs (loop5): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors
[  305.548566][T12659] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869)
[  305.558655][T12659] JBD2: no valid journal superblock found
[  305.560758][T12659] EXT4-fs (loop5): Could not load journal inode
[  305.574788][T12657] loop1: detected capacity change from 0 to 4096
[  305.580753][T12657] ntfs3(loop1): Mark volume as dirty due to NTFS errors
[  305.596169][T12657] ntfs3(loop1): ino=b, mi_enum_attr
[  305.598054][T12657] ntfs3(loop1): Failed to load $Extend (-22).
[  305.600407][T12657] ntfs3(loop1): Failed to initialize $Extend.
[  305.629194][T12664] loop5: detected capacity change from 0 to 4096
[  305.632231][T12664] ntfs3(loop5): Different NTFS sector size (1024) and media sector size (512).
[  305.646204][T12666] loop1: detected capacity change from 0 to 128
[  305.650530][T12664] ntfs3(loop5): ino=1a, mi_enum_attr
[  305.652475][T12664] ntfs3(loop5): Mark volume as dirty due to NTFS errors
[  305.661417][T12666] hpfs: Bad magic ... probably not HPFS
[  305.948685][T12678] loop4: detected capacity change from 0 to 32768
[  305.954132][T12678] XFS: noikeep mount option is deprecated.
[  305.954489][T12686] loop1: detected capacity change from 0 to 2364
[  305.963976][T12678] XFS (loop4): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  305.988381][T12696] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2523'.
[  306.009377][T12678] XFS (loop4): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51.
[  306.030173][T12678] XFS (loop4): Starting recovery (logdev: internal)
[  306.048425][T12678] XFS (loop4): Ending recovery (logdev: internal)
[  306.074186][ T9822] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  306.288140][T12704] loop1: detected capacity change from 0 to 32768
[  306.302461][T12704] JBD2: Ignoring recovery information on journal
[  306.334110][T12704] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  306.360320][   T33] audit: type=1800 audit(2000003013.957:126): pid=12704 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2526" name="file1" dev="loop1" ino=17058 res=0 errno=0
[  306.400573][ T5849] ocfs2: Unmounting device (7,1) on (node local)
[  306.505632][T12732] vlan0: entered promiscuous mode
[  306.532404][T12734] bridge1: entered allmulticast mode
[  306.583235][ T5904] usb 6-1: new full-speed USB device number 8 using dummy_hcd
[  306.911510][T12750] overlayfs: failed to resolve './file0': -2
[  307.144841][T12751] loop5: detected capacity change from 0 to 32768
[  307.185677][   T35] read_mapping_page failed!
[  307.187209][   T35] ERROR: (device loop5): txCommit: 
[  307.187209][   T35] 
[  307.190513][   T35] ERROR: (device loop5): remounting filesystem as read-only
[  307.196381][   T35] jfs_write_inode: jfs_commit_inode failed!
[  307.340030][T12770] PKCS7: Unknown OID: [4] 0.38.107.217331280.32(bad)
[  307.344906][T12770] PKCS7: Only support pkcs7_signedData type
[  307.398087][T12772] loop1: detected capacity change from 0 to 16
[  307.401158][T12772] erofs (device loop1): mounted with root inode @ nid 36.
[  307.650498][T12789] loop4: detected capacity change from 0 to 256
[  307.664125][T12789] exFAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  307.668499][T12789] exFAT-fs (loop4): Medium has reported failures. Some data may be lost.
[  307.691085][T12789] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  307.870646][T12784] loop5: detected capacity change from 0 to 32768
[  307.875029][T12784] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.2561 (12784)
[  307.883194][T12784] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  307.887505][T12784] BTRFS info (device loop5): using crc32c (crc32c-lib) checksum algorithm
[  307.891477][T12784] BTRFS info (device loop5): using free-space-tree
[  308.143730][T12784] BTRFS info (device loop5): rebuilding free space tree
[  308.213254][T12812] loop1: detected capacity change from 0 to 1024
[  308.223271][T12812] EXT4-fs: Ignoring removed orlov option
[  308.243466][T11427] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  308.251832][T12812] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  308.276147][   T33] audit: type=1800 audit(2000003015.877:127): pid=12812 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2566" name="file1" dev="loop1" ino=15 res=0 errno=0
[  308.311714][ T5849] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  308.805563][   T51] usb 6-1: new high-speed USB device number 9 using dummy_hcd
[  308.963342][   T51] usb 6-1: Using ep0 maxpacket: 8
[  308.969609][   T51] usb 6-1: unable to get BOS descriptor or descriptor too short
[  308.974291][   T51] usb 6-1: config 8 has an invalid interface number: 141 but max is 0
[  308.977927][   T51] usb 6-1: config 8 has no interface number 0
[  308.980829][   T51] usb 6-1: config 8 interface 141 altsetting 11 endpoint 0x5 has invalid maxpacket 1023, setting to 64
[  308.988322][   T51] usb 6-1: config 8 interface 141 has no altsetting 0
[  308.994135][   T51] usb 6-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=c1.47
[  308.997594][   T51] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  309.000273][   T51] usb 6-1: Product: syz
[  309.001742][   T51] usb 6-1: Manufacturer: syz
[  309.004028][   T51] usb 6-1: SerialNumber: syz
[  309.214702][   T51] ir_toy 6-1:8.141: required endpoints not found
[  309.218697][   T51] usb 6-1: USB disconnect, device number 9
[  310.194089][ T5904] usb 6-1: new high-speed USB device number 10 using dummy_hcd
[  310.353847][ T5904] usb 6-1: Using ep0 maxpacket: 8
[  310.377567][ T5904] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  310.381161][ T5904] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22
[  310.386189][ T5904] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  310.395867][ T5904] usb 6-1: config 0 descriptor??
[  310.401195][ T5904] iowarrior 6-1:0.0: no interrupt-in endpoint found
[  310.539072][T12862] netlink: 'syz.1.2586': attribute type 2 has an invalid length.
[  310.541757][T12862] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2586'.
[  310.602034][   T10] usb 6-1: USB disconnect, device number 10
[  311.236805][T12870] loop1: detected capacity change from 0 to 1024
[  311.240760][T12870] EXT4-fs: Ignoring removed nobh option
[  311.244071][T12870] EXT4-fs: Ignoring removed bh option
[  311.269572][T12870] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  311.726795][T12879] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4183: comm syz.1.2588: Allocating blocks 497-513 which overlap fs metadata
[  311.743335][T12879] EXT4-fs (loop1): pa ffff888111e94910: logic 256, phys. 385, len 8
[  311.746841][T12879] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:5434: group 0, free 0, pa_free 1
[  312.125207][ T5849] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  312.201222][T12900] loop5: detected capacity change from 0 to 40427
[  312.207119][T12900] F2FS-fs (loop5): build fault injection rate: 14
[  312.209252][T12900] F2FS-fs (loop5): build fault injection type: 0x3bfe8c
[  312.212729][T12900] F2FS-fs (loop5): invalid crc value
[  312.215694][    C1] F2FS-fs (loop5): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  312.222255][    C1] F2FS-fs (loop5): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  312.248158][T12900] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  312.251114][T12900] F2FS-fs (loop5): inject page alloc in f2fs_grab_cache_folio of __get_meta_folio+0x157/0x4f0
[  312.256330][T12900] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5
[  312.274930][T12900] F2FS-fs (loop5): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x1d9/0xa40
[  312.279489][T12900] F2FS-fs (loop5): inject inconsistent footer in sanity_check_node_footer of f2fs_get_dnode_of_data+0xab1/0x1cf0
[  312.284715][T12900] F2FS-fs (loop5): inconsistent node block, node_type:0, nid:11, node_footer[nid:11,ino:3,ofs:2041,cpver:0,blkaddr:0]
[  312.308442][T11427] syz-executor: attempt to access beyond end of device
[  312.308442][T11427] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  312.322111][T11427] CPU: 1 UID: 0 PID: 11427 Comm: syz-executor Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  312.322127][T11427] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  312.322141][T11427] Call Trace:
[  312.322145][T11427]  <TASK>
[  312.322149][T11427]  dump_stack_lvl+0x189/0x250
[  312.322165][T11427]  ? __pfx_dump_stack_lvl+0x10/0x10
[  312.322175][T11427]  ? __pfx_queue_work_on+0x10/0x10
[  312.322184][T11427]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  312.322194][T11427]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  312.322208][T11427]  f2fs_handle_critical_error+0x37c/0x540
[  312.322222][T11427]  f2fs_write_end_io+0x886/0xb60
[  312.322241][T11427]  __submit_merged_bio+0x27a/0x6a0
[  312.322254][T11427]  __submit_merged_write_cond+0x255/0x530
[  312.322266][T11427]  f2fs_write_data_pages+0x261d/0x3000
[  312.322275][T11427]  ? is_bpf_text_address+0x26/0x2b0
[  312.322301][T11427]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  312.322331][T11427]  ? __mod_zone_page_state+0xd7/0x140
[  312.322346][T11427]  ? folios_put_refs+0x560/0x640
[  312.322360][T11427]  ? __lock_acquire+0xab9/0xd20
[  312.322376][T11427]  ? do_raw_spin_lock+0x121/0x290
[  312.322390][T11427]  ? do_raw_spin_unlock+0x4d/0x240
[  312.322399][T11427]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  312.322409][T11427]  do_writepages+0x32e/0x550
[  312.322425][T11427]  ? do_raw_spin_unlock+0x4d/0x240
[  312.322436][T11427]  filemap_fdatawrite+0x199/0x240
[  312.322446][T11427]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  312.322477][T11427]  ? do_raw_spin_unlock+0x4d/0x240
[  312.322488][T11427]  f2fs_sync_dirty_inodes+0x31f/0x830
[  312.322506][T11427]  f2fs_write_checkpoint+0x95a/0x1df0
[  312.322527][T11427]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  312.322559][T11427]  ? kill_f2fs_super+0x298/0x6c0
[  312.322571][T11427]  kill_f2fs_super+0x2c3/0x6c0
[  312.322584][T11427]  ? __pfx_kill_f2fs_super+0x10/0x10
[  312.322593][T11427]  ? radix_tree_delete_item+0x2b6/0x400
[  312.322606][T11427]  ? shrinker_free+0x2ce/0x3e0
[  312.322615][T11427]  deactivate_locked_super+0xbc/0x130
[  312.322626][T11427]  cleanup_mnt+0x425/0x4c0
[  312.322634][T11427]  ? lockdep_hardirqs_on+0x9c/0x150
[  312.322644][T11427]  task_work_run+0x1d4/0x260
[  312.322655][T11427]  ? __pfx_task_work_run+0x10/0x10
[  312.322664][T11427]  ? __x64_sys_umount+0x122/0x160
[  312.322676][T11427]  ? exit_to_user_mode_loop+0x40/0x110
[  312.322689][T11427]  exit_to_user_mode_loop+0xec/0x110
[  312.322699][T11427]  do_syscall_64+0x2bd/0x3b0
[  312.322708][T11427]  ? lockdep_hardirqs_on+0x9c/0x150
[  312.322716][T11427]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  312.322723][T11427]  ? exc_page_fault+0x9f/0xf0
[  312.322733][T11427]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  312.322757][T11427] RIP: 0033:0x7f5d8178ff17
[  312.322766][T11427] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
[  312.322773][T11427] RSP: 002b:00007ffd66835648 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  312.322782][T11427] RAX: 0000000000000000 RBX: 00007f5d81811c05 RCX: 00007f5d8178ff17
[  312.322787][T11427] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd66835700
[  312.322791][T11427] RBP: 00007ffd66835700 R08: 0000000000000000 R09: 0000000000000000
[  312.322796][T11427] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd66836790
[  312.322801][T11427] R13: 00007f5d81811c05 R14: 000000000004c37f R15: 00007ffd668367d0
[  312.322814][T11427]  </TASK>
[  312.325414][T11427] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  312.559916][T12910] loop1: detected capacity change from 0 to 40427
[  312.563248][T12910] F2FS-fs (loop1): Insane cp_payload (553648128 >= 504)
[  312.565732][T12910] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock
[  312.568780][T12910] F2FS-fs (loop1): build fault injection rate: 3
[  312.571004][T12910] F2FS-fs (loop1): build fault injection type: 0x1f8
[  312.575421][T12910] F2FS-fs (loop1): invalid crc value
[  312.607739][T12910] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  312.611648][T12910] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0
[  312.615314][T12910] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5
[  312.629517][T12910] F2FS-fs (loop1): inject alloc nid in f2fs_alloc_nid of f2fs_get_dnode_of_data+0x7d7/0x1cf0
[  312.719227][T12921] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  312.877108][T12938] sch_tbf: burst 0 is lower than device lo mtu (81) !
[  312.915191][T12943] loop4: detected capacity change from 0 to 8
[  312.917803][T12943] squashfs: Unknown parameter '?Z9ۺ'
[  313.048596][T12939] loop5: detected capacity change from 0 to 40427
[  313.052809][T12939] F2FS-fs (loop5): Invalid log_blocksize (268), supports only 12
[  313.055922][T12939] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock
[  313.060695][T12939] F2FS-fs (loop5): invalid crc value
[  313.092499][T12939] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  313.097591][T12939] F2FS-fs (loop5): Try to recover 1th superblock, ret: 0
[  313.100190][T12939] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5
[  313.109777][T12939] syz.5.2616: attempt to access beyond end of device
[  313.109777][T12939] loop5: rw=2049, sector=77824, nr_sectors = 520 limit=40427
[  313.163282][ T1822] usb 5-1: new high-speed USB device number 17 using dummy_hcd
[  313.306064][T12959] loop1: detected capacity change from 0 to 32768
[  313.318535][T12959] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  313.327940][   T33] audit: type=1800 audit(2000003020.928:128): pid=12959 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2624" name="bus" dev="loop1" ino=17058 res=0 errno=0
[  313.333367][ T1822] usb 5-1: config index 0 descriptor too short (expected 65069, got 45)
[  313.350847][ T1822] usb 5-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0
[  313.361113][ T1822] usb 5-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 106
[  313.362718][T12963] loop5: detected capacity change from 0 to 764
[  313.368632][T12963] rock: directory entry would overflow storage
[  313.371168][ T1822] usb 5-1: config 0 has an invalid descriptor of length 100, skipping remainder of the config
[  313.371333][T12963] rock: sig=0x4654, size=5, remaining=4
[  313.384814][ T1822] usb 5-1: config 0 has no interfaces?
[  313.386618][ T1822] usb 5-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00
[  313.386637][ T1822] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  313.387998][ T1822] usb 5-1: config 0 descriptor??
[  313.404816][T12959] (syz.1.2624,12959,0):ocfs2_dio_end_io:2401 ERROR: Direct IO failed, bytes = -14
[  313.443668][ T5849] ocfs2: Unmounting device (7,1) on (node local)
[  313.591132][T12973] loop1: detected capacity change from 0 to 1024
[  313.605844][T12973] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  313.608566][   T51] usb 5-1: USB disconnect, device number 17
[  313.610984][T12973] ext4 filesystem being mounted at /852/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  313.636115][T12973] EXT4-fs error (device loop1): ext4_map_blocks:814: inode #15: block 1: comm syz.1.2628: lblock 1 mapped to illegal pblock 1 (length 3)
[  313.646564][T12973] EXT4-fs (loop1): Remounting filesystem read-only
[  313.678768][ T5849] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  313.722143][T12978] loop1: detected capacity change from 0 to 16
[  313.725539][T12978] MTD: Attempt to mount non-MTD device "/dev/loop1"
[  313.736666][T12978] cramfs: Error -3 while decompressing!
[  313.743315][T12978] cramfs: ffffffff99be75d8(42)->ffff888029429000(4096)
[  313.855729][ T9175] bond0: (slave syz_tun): Releasing backup interface
[  314.019232][ T5903] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  314.026913][ T5903] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  314.116862][ T5903] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  314.125017][ T5903] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  314.215942][ T9215] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  314.225545][ T9215] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  314.228988][ T9215] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  314.233385][ T9215] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  314.238085][ T9215] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  314.258174][ T5903] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  314.267223][ T5903] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  314.385600][ T5903] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  314.390946][ T5903] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  314.909516][ T5903] bridge_slave_1: left allmulticast mode
[  314.911612][ T5903] bridge_slave_1: left promiscuous mode
[  314.913795][ T5903] bridge0: port 2(bridge_slave_1) entered disabled state
[  314.918250][ T5903] bridge_slave_0: left allmulticast mode
[  314.920219][ T5903] bridge_slave_0: left promiscuous mode
[  314.924481][ T5903] bridge0: port 1(bridge_slave_0) entered disabled state
[  315.188081][T12997] loop4: detected capacity change from 0 to 1024
[  315.216322][T12997] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none.
[  315.221386][T12997] ext4 filesystem being mounted at /388/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  315.267588][ T5903] team0: Port device geneve1 removed
[  315.272484][ T9822] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000.
[  315.708402][ T5903] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  315.717603][ T5903] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  315.730995][ T5903] bond0 (unregistering): Released all slaves
[  315.984833][ T5903] bond1 (unregistering): (slave veth0_to_bond): Releasing active interface
[  315.995754][ T5903] bond1 (unregistering): Released all slaves
[  316.049430][T13008] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2640'.
[  316.063113][T12982] chnl_net:caif_netlink_parms(): no params data found
[  316.286497][ T5844] Bluetooth: hci2: command tx timeout
[  316.438259][T12982] bridge0: port 1(bridge_slave_0) entered blocking state
[  316.442437][T12982] bridge0: port 1(bridge_slave_0) entered disabled state
[  316.444997][T12982] bridge_slave_0: entered allmulticast mode
[  316.448176][T12982] bridge_slave_0: entered promiscuous mode
[  316.452138][T12982] bridge0: port 2(bridge_slave_1) entered blocking state
[  316.454726][T12982] bridge0: port 2(bridge_slave_1) entered disabled state
[  316.457330][T12982] bridge_slave_1: entered allmulticast mode
[  316.465560][T12982] bridge_slave_1: entered promiscuous mode
[  316.684741][ T1363] ieee802154 phy0 wpan0: encryption failed: -22
[  316.742775][T12982] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  316.768033][ T5903] hsr_slave_0: left promiscuous mode
[  316.774405][ T5903] hsr_slave_1: left promiscuous mode
[  316.778079][ T5903] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  316.783000][ T5903] batman_adv: batadv0: Removing interface: batadv_slave_0
[  316.789881][ T5903] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  316.793987][ T5903] batman_adv: batadv0: Removing interface: batadv_slave_1
[  316.836665][ T5903] veth1_macvtap: left promiscuous mode
[  316.838780][ T5903] veth0_macvtap: left promiscuous mode
[  316.841896][ T5903] veth1_vlan: left promiscuous mode
[  317.708557][ T5903] team0 (unregistering): Port device team_slave_1 removed
[  317.760120][ T5903] team0 (unregistering): Port device team_slave_0 removed
[  318.235092][T13025] loop5: detected capacity change from 0 to 256
[  318.259638][T13025] FAT-fs (loop5): Directory bread(block 64) failed
[  318.265574][T13025] FAT-fs (loop5): Directory bread(block 65) failed
[  318.268616][T13025] FAT-fs (loop5): Directory bread(block 66) failed
[  318.278161][T13025] FAT-fs (loop5): Directory bread(block 67) failed
[  318.289181][T13025] FAT-fs (loop5): Directory bread(block 68) failed
[  318.306646][T13025] FAT-fs (loop5): Directory bread(block 69) failed
[  318.309669][T13025] FAT-fs (loop5): Directory bread(block 70) failed
[  318.314727][T12982] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  318.320573][T13025] FAT-fs (loop5): Directory bread(block 71) failed
[  318.324082][T13025] FAT-fs (loop5): Directory bread(block 72) failed
[  318.326977][T13025] FAT-fs (loop5): Directory bread(block 73) failed
[  318.346864][T13025] syz.5.2646: attempt to access beyond end of device
[  318.346864][T13025] loop5: rw=524288, sector=1192, nr_sectors = 4 limit=256
[  318.355888][ T5844] Bluetooth: hci2: command tx timeout
[  318.360995][T13025] syz.5.2646: attempt to access beyond end of device
[  318.360995][T13025] loop5: rw=0, sector=1192, nr_sectors = 4 limit=256
[  318.383636][T12982] team0: Port device team_slave_0 added
[  318.394286][T12982] team0: Port device team_slave_1 added
[  318.496796][T12982] batman_adv: batadv0: Adding interface: batadv_slave_0
[  318.500417][T12982] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  318.511633][T12982] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  318.537941][T12982] batman_adv: batadv0: Adding interface: batadv_slave_1
[  318.540968][T12982] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  318.559615][T12982] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  318.756679][T12982] hsr_slave_0: entered promiscuous mode
[  318.760297][T12982] hsr_slave_1: entered promiscuous mode
[  318.766261][T12982] debugfs: 'hsr0' already exists in 'hsr'
[  318.768319][T12982] Cannot create hsr debugfs directory
[  318.786105][ T5903] IPVS: stop unused estimator thread 0...
[  318.789196][T13036] loop5: detected capacity change from 0 to 512
[  318.793726][T13036] EXT4-fs: Ignoring removed bh option
[  318.797799][T13036] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended
[  318.823630][T13036] EXT4-fs (loop5): orphan cleanup on readonly fs
[  318.827212][T13036] EXT4-fs error (device loop5): ext4_ext_check_inode:523: inode #3: comm syz.5.2651: pblk 0 bad header/extent: invalid eh_max - magic f30a, entries 7, max 0(0), depth 0(0)
[  318.834637][T13036] EXT4-fs error (device loop5): ext4_quota_enable:7127: comm syz.5.2651: Bad quota inode: 3, type: 0
[  318.838785][T13036] EXT4-fs warning (device loop5): ext4_enable_quotas:7168: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix.
[  318.845050][T13036] EXT4-fs (loop5): Cannot turn on quotas: error -117
[  318.865132][T13036] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[  319.028193][T11427] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  319.229559][T13043] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2654'.
[  319.312217][T12982] netdevsim netdevsim6 netdevsim0: renamed from eth0
[  319.323036][T12982] netdevsim netdevsim6 netdevsim1: renamed from eth1
[  319.337714][T12982] netdevsim netdevsim6 netdevsim2: renamed from eth2
[  319.348595][T12982] netdevsim netdevsim6 netdevsim3: renamed from eth3
[  319.510412][T13057] loop5: detected capacity change from 0 to 256
[  319.566748][T12982] 8021q: adding VLAN 0 to HW filter on device bond0
[  319.600743][T12982] 8021q: adding VLAN 0 to HW filter on device team0
[  319.613122][ T1207] bridge0: port 1(bridge_slave_0) entered blocking state
[  319.616516][ T1207] bridge0: port 1(bridge_slave_0) entered forwarding state
[  319.633293][ T1207] bridge0: port 2(bridge_slave_1) entered blocking state
[  319.636150][ T1207] bridge0: port 2(bridge_slave_1) entered forwarding state
[  319.931917][T12982] 8021q: adding VLAN 0 to HW filter on device batadv0
[  320.243316][T12982] veth0_vlan: entered promiscuous mode
[  320.257886][T12982] veth1_vlan: entered promiscuous mode
[  320.313079][T12982] veth0_macvtap: entered promiscuous mode
[  320.322663][T12982] veth1_macvtap: entered promiscuous mode
[  320.336347][T12982] batman_adv: batadv0: Interface activated: batadv_slave_0
[  320.344321][T12982] batman_adv: batadv0: Interface activated: batadv_slave_1
[  320.350585][   T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  320.357319][   T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  320.366191][   T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  320.378344][   T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  320.435552][ T6803] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  320.440043][ T6803] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  320.442890][ T5844] Bluetooth: hci2: command tx timeout
[  320.464441][ T1207] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  320.468583][ T1207] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  320.525117][T13081] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  320.565945][T13083] syzkaller1: entered promiscuous mode
[  320.568024][T13083] syzkaller1: entered allmulticast mode
[  320.680984][ T1822] usb 5-1: new full-speed USB device number 18 using dummy_hcd
[  320.837652][ T1822] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  320.842468][ T1822] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2
[  320.847266][ T1822] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8
[  320.850254][ T1822] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  320.856257][ T1822] usb 5-1: config 0 descriptor??
[  320.859753][ T1822] dvb-usb: found a 'Artec T1 USB2.0' in warm state.
[  320.862480][ T1822] dvb-usb: bulk message failed: -22 (3/0)
[  320.866079][ T1822] dvb-usb: will use the device's hardware PID filter (table count: 16).
[  320.869832][ T1822] dvbdev: DVB: registering new adapter (Artec T1 USB2.0)
[  320.873717][ T1822] usb 5-1: media controller created
[  320.876494][ T1822] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  320.884468][ T1822] dvb-usb: bulk message failed: -22 (6/0)
[  320.886488][ T1822] dvb-usb: no frontend was attached by 'Artec T1 USB2.0'
[  320.893707][ T1822] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input20
[  320.898239][ T1822] dvb-usb: schedule remote query interval to 150 msecs.
[  320.900526][ T1822] dvb-usb: Artec T1 USB2.0 successfully initialized and connected.
[  320.957213][T13088] loop5: detected capacity change from 0 to 256
[  320.967096][T13088] FAT-fs (loop5): Directory bread(block 64) failed
[  320.969777][T13088] FAT-fs (loop5): Directory bread(block 65) failed
[  320.973160][T13088] FAT-fs (loop5): Directory bread(block 66) failed
[  320.975543][T13088] FAT-fs (loop5): Directory bread(block 67) failed
[  320.977751][T13088] FAT-fs (loop5): Directory bread(block 68) failed
[  320.980301][T13088] FAT-fs (loop5): Directory bread(block 69) failed
[  320.983824][T13088] FAT-fs (loop5): Directory bread(block 70) failed
[  320.986436][T13088] FAT-fs (loop5): Directory bread(block 71) failed
[  320.988599][T13088] FAT-fs (loop5): Directory bread(block 72) failed
[  320.990938][T13088] FAT-fs (loop5): Directory bread(block 73) failed
[  321.075182][ T1822] dvb-usb: bulk message failed: -22 (1/0)
[  321.077610][ T1822] dvb-usb: error while querying for an remote control event.
[  321.236307][ T1822] dvb-usb: bulk message failed: -22 (1/0)
[  321.246884][ T1822] dvb-usb: error while querying for an remote control event.
[  321.423642][ T1822] dvb-usb: bulk message failed: -22 (1/0)
[  321.429440][ T1822] dvb-usb: error while querying for an remote control event.
[  321.489364][   T24] usb 5-1: USB disconnect, device number 18
[  321.501347][   T24] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected.
[  321.885437][T13095] loop5: detected capacity change from 0 to 8
[  321.901091][T13095] SQUASHFS error: Failed to read block 0x260685: -5
[  321.905567][T13095] SQUASHFS error: Unable to read metadata cache entry [260685]
[  321.908731][T13095] SQUASHFS error: Unable to read directory block [260685:0]
[  321.965873][T13097] loop5: detected capacity change from 0 to 1024
[  321.990358][T13097] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  321.996355][T13097] ext4 filesystem being mounted at /219/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  322.033480][T11427] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  322.571009][ T5844] Bluetooth: hci2: command tx timeout
[  322.915737][T13131] tipc: Started in network mode
[  322.917485][T13131] tipc: Node identity aaaaaaaaaa3a, cluster identity 4711
[  322.920162][T13131] tipc: Enabled bearer <eth:macvtap0>, priority 10
[  323.000656][  T791] usb 7-1: new full-speed USB device number 2 using dummy_hcd
[  323.164684][  T791] usb 7-1: config 0 has an invalid interface number: 133 but max is 0
[  323.167721][  T791] usb 7-1: config 0 has no interface number 0
[  323.170257][  T791] usb 7-1: config 0 interface 133 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  323.177658][  T791] usb 7-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d
[  323.182121][  T791] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  323.185577][  T791] usb 7-1: Product: syz
[  323.187437][  T791] usb 7-1: Manufacturer: syz
[  323.189506][  T791] usb 7-1: SerialNumber: syz
[  323.201401][  T791] usb 7-1: config 0 descriptor??
[  323.268199][T13136] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2685'.
[  323.415650][  T791] keyspan 7-1:0.133: Keyspan 1 port adapter converter detected
[  323.422900][  T791] keyspan 7-1:0.133: found no endpoint descriptor for endpoint 81
[  323.427416][  T791] keyspan 7-1:0.133: found no endpoint descriptor for endpoint 1
[  323.431542][  T791] keyspan 7-1:0.133: found no endpoint descriptor for endpoint 2
[  323.436197][  T791] usb 7-1: Keyspan 1 port adapter converter now attached to ttyUSB0
[  323.444319][  T791] usb 7-1: USB disconnect, device number 2
[  323.449887][  T791] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0
[  323.455276][  T791] keyspan 7-1:0.133: device disconnected
[  323.566668][T13148] loop5: detected capacity change from 0 to 256
[  323.592285][T13148] FAT-fs (loop5): Directory bread(block 64) failed
[  323.595469][T13148] FAT-fs (loop5): Directory bread(block 65) failed
[  323.598385][T13148] FAT-fs (loop5): Directory bread(block 66) failed
[  323.602536][T13148] FAT-fs (loop5): Directory bread(block 67) failed
[  323.605645][T13148] FAT-fs (loop5): Directory bread(block 68) failed
[  323.609118][T13148] FAT-fs (loop5): Directory bread(block 69) failed
[  323.613195][T13148] FAT-fs (loop5): Directory bread(block 70) failed
[  323.615916][T13148] FAT-fs (loop5): Directory bread(block 71) failed
[  323.618781][T13148] FAT-fs (loop5): Directory bread(block 72) failed
[  323.621905][T13148] FAT-fs (loop5): Directory bread(block 73) failed
[  323.729156][T13152] loop5: detected capacity change from 0 to 24
[  323.733775][T13152] MTD: Attempt to mount non-MTD device "/dev/loop5"
[  323.742527][T13152] romfs: Mounting image 'rom 637cf1fa' through the block layer
[  324.334084][   T10] tipc: Node number set to 9480874
[  324.449136][T13171] loop6: detected capacity change from 0 to 1024
[  324.467431][T13171] hfsplus: bad catalog entry type
[  324.478636][   T27] hfsplus: b-tree write err: -5, ino 4
[  324.554608][T13162] loop4: detected capacity change from 0 to 40427
[  324.562677][T13162] F2FS-fs (loop4): Fix alignment : done, start(4096) end(16896) block(12288)
[  324.567357][T13162] F2FS-fs (loop4): build fault injection rate: 771
[  324.573076][T13162] F2FS-fs (loop4): invalid crc value
[  324.625653][T13162] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  324.630698][T13162] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5
[  324.673185][T13184] loop6: detected capacity change from 0 to 16
[  324.677006][T13184] erofs (device loop6): dirblkbits 6 isn't supported
[  324.795541][T13190] loop6: detected capacity change from 0 to 128
[  324.799472][T13190] EXT4-fs: Ignoring removed nobh option
[  324.824655][T13190] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  324.830233][T13190] ext4 filesystem being mounted at /15/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  324.894867][T12982] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  325.128942][T13195] loop5: detected capacity change from 0 to 32768
[  325.147251][T13195] ocfs2: Mounting device (7,5) on (node local, slot 0) with writeback data mode.
[  325.173176][T13209] loop4: detected capacity change from 0 to 16
[  325.176652][T13195] (syz.5.2712,13195,0):ocfs2_remove_inode_range:1794 ERROR: status = -22
[  325.182007][T13195] (syz.5.2712,13195,1):__ocfs2_change_file_space:2045 ERROR: status = -22
[  325.182659][T13209] erofs (device loop4): mounted with root inode @ nid 36.
[  325.213630][T11427] ocfs2: Unmounting device (7,5) on (node local)
[  325.322493][T13215] loop5: detected capacity change from 0 to 1024
[  325.355039][ T1207] hfsplus: b-tree write err: -5, ino 4
[  325.367934][T13211] loop6: detected capacity change from 0 to 32768
[  325.371888][T13211] (syz.6.2718,13211,1):ocfs2_verify_volume:2290 ERROR: found superblock with incorrect block size bits: found 265, should be 9, 10, 11, or 12
[  325.378111][T13217] loop5: detected capacity change from 0 to 128
[  325.380907][T13211] (syz.6.2718,13211,1):ocfs2_verify_volume:2331 ERROR: status = -22
[  325.383607][T13211] (syz.6.2718,13211,1):ocfs2_fill_super:989 ERROR: superblock probe failed!
[  325.386495][T13211] (syz.6.2718,13211,1):ocfs2_fill_super:1177 ERROR: status = -22
[  325.530127][T13225] loop5: detected capacity change from 0 to 8
[  325.532487][T13077] usb 5-1: new high-speed USB device number 19 using dummy_hcd
[  325.700333][T13077] usb 5-1: Using ep0 maxpacket: 8
[  325.707817][T13077] usb 5-1: config 2 interface 0 has no altsetting 0
[  325.719900][T13077] usb 5-1: New USB device found, idVendor=04e2, idProduct=1412, bcdDevice=ca.10
[  325.723908][T13077] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  325.726600][T13077] usb 5-1: Product: syz
[  325.728020][T13077] usb 5-1: Manufacturer: syz
[  325.754711][T13077] usb 5-1: SerialNumber: syz
[  325.986260][T13077] usb 5-1: USB disconnect, device number 19
[  326.595911][T13243] loop4: detected capacity change from 0 to 4096
[  326.599483][   T33] audit: type=1326 audit(2000003034.200:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13244 comm="syz.6.2733" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f035838ebe9 code=0x7ffc0000
[  326.613778][   T33] audit: type=1326 audit(2000003034.210:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13244 comm="syz.6.2733" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f035838ebe9 code=0x7ffc0000
[  326.625111][   T33] audit: type=1326 audit(2000003034.220:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13244 comm="syz.6.2733" exe="/syz-executor" sig=0 arch=c000003e syscall=125 compat=0 ip=0x7f035838ebe9 code=0x7ffc0000
[  326.641041][   T33] audit: type=1326 audit(2000003034.220:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13244 comm="syz.6.2733" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f035838ebe9 code=0x7ffc0000
[  326.649647][T13243] ntfs3(loop4): Mark volume as dirty due to NTFS errors
[  326.652628][   T33] audit: type=1326 audit(2000003034.220:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13244 comm="syz.6.2733" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f035838ebe9 code=0x7ffc0000
[  326.665826][T13243] ntfs3(loop4): ino=9, ntfs_sync_fs failed, -22.
[  326.694777][ T9822] ntfs3(loop4): ino=9, ntfs_sync_fs failed, -22.
[  326.754890][T13255] loop4: detected capacity change from 0 to 1764
[  326.763508][T13255] iso9660: Corrupted directory entry in block 2 of inode 1920
[  326.942497][  T791] usb 7-1: new high-speed USB device number 3 using dummy_hcd
[  327.090280][  T791] usb 7-1: Using ep0 maxpacket: 16
[  327.096050][  T791] usb 7-1: config 4 has an invalid interface number: 51 but max is 0
[  327.099630][  T791] usb 7-1: config 4 has no interface number 0
[  327.102451][  T791] usb 7-1: config 4 interface 51 altsetting 2 bulk endpoint 0x1 has invalid maxpacket 16
[  327.106567][  T791] usb 7-1: config 4 interface 51 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64
[  327.110994][  T791] usb 7-1: config 4 interface 51 has no altsetting 0
[  327.116673][  T791] usb 7-1: New USB device found, idVendor=954f, idProduct=4199, bcdDevice= f.76
[  327.121016][  T791] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  327.124401][  T791] usb 7-1: Product: syz
[  327.126366][  T791] usb 7-1: Manufacturer: syz
[  327.128426][  T791] usb 7-1: SerialNumber: syz
[  327.133821][T13249] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22
[  327.136730][T13249] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22
[  327.343433][  T791] cdc_eem 7-1:4.51: probe with driver cdc_eem failed with error -71
[  327.362007][  T791] usb 7-1: USB disconnect, device number 3
[  327.631412][T13267] loop5: detected capacity change from 0 to 256
[  327.683336][T13269] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2743'.
[  328.223587][T13277] loop5: detected capacity change from 0 to 40427
[  328.231374][T13277] F2FS-fs (loop5): Insane cp_payload (553648128 >= 504)
[  328.234840][T13277] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock
[  328.235275][   T33] audit: type=1326 audit(2000003035.840:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13290 comm="syz.6.2752" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f035838ebe9 code=0x7ffc0000
[  328.239343][T13277] F2FS-fs (loop5): build fault injection rate: 8
[  328.253379][   T33] audit: type=1326 audit(2000003035.860:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13290 comm="syz.6.2752" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f035838ebe9 code=0x7ffc0000
[  328.262202][   T33] audit: type=1326 audit(2000003035.860:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13290 comm="syz.6.2752" exe="/syz-executor" sig=0 arch=c000003e syscall=118 compat=0 ip=0x7f035838ebe9 code=0x7ffc0000
[  328.262240][T13277] F2FS-fs (loop5): build fault injection type: 0x3bfe8d
[  328.271001][   T33] audit: type=1326 audit(2000003035.860:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13290 comm="syz.6.2752" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f035838ebe9 code=0x7ffc0000
[  328.303579][    C1] F2FS-fs (loop5): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  328.308475][T13277] F2FS-fs (loop5): invalid crc value
[  328.314692][T13277] F2FS-fs (loop5): Failed to get valid F2FS checkpoint
[  328.326058][T13293] Bluetooth: MGMT ver 1.23
[  328.760217][T13301] loop5: detected capacity change from 0 to 32768
[  328.767235][T13303] loop4: detected capacity change from 0 to 16
[  328.772587][T13303] erofs (device loop4): mounted with root inode @ nid 36.
[  328.778771][   T33] audit: type=1800 audit(2000003036.380:138): pid=13303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2758" name="file1" dev="loop4" ino=86 res=0 errno=0
[  328.779376][T13299] loop6: detected capacity change from 0 to 32768
[  328.793603][T13299] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.2756 (13299)
[  328.802385][T13301] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode.
[  328.808669][T13299] BTRFS info (device loop6): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  328.816274][T13299] BTRFS info (device loop6): using sha256 (sha256-lib) checksum algorithm
[  328.829413][T13299] BTRFS info (device loop6): using free-space-tree
[  328.964095][T13299] BTRFS info (device loop6): rebuilding free space tree
[  329.089190][T12982] BTRFS info (device loop6): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  329.537049][T11427] ocfs2: Unmounting device (7,5) on (node local)
[  329.952774][ T5904] usb 7-1: new high-speed USB device number 4 using dummy_hcd
[  330.101648][ T5904] usb 7-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  330.105645][ T5904] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  330.117188][ T5904] usb 7-1: config 0 descriptor??
[  330.128359][ T5904] cp210x 7-1:0.0: cp210x converter detected
[  330.741919][ T5904] cp210x 7-1:0.0: failed to get vendor val 0x0010 size 3: -32
[  330.760041][ T5904] usb 7-1: cp210x converter now attached to ttyUSB0
[  331.128560][ T5904] usb 7-1: USB disconnect, device number 4
[  331.185177][ T5904] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  331.252794][ T5904] cp210x 7-1:0.0: device disconnected
[  331.642579][T13360] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant.
[  331.642579][T13360] The task syz.5.2772 (13360) triggered the difference, watch for misbehavior.
[  332.492123][T13380] loop5: detected capacity change from 0 to 4096
[  332.577213][T13386] loop4: detected capacity change from 0 to 128
[  332.584826][T13386] EXT4-fs (loop4): Test dummy encryption mode enabled
[  332.607201][T13386] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  332.614282][T13386] ext4 filesystem being mounted at /432/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  333.178605][T13392] loop6: detected capacity change from 0 to 512
[  333.185861][ T9822] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  333.187277][T13392] EXT4-fs: Ignoring removed bh option
[  333.201175][T13392] EXT4-fs: Ignoring removed mblk_io_submit option
[  333.247150][T13392] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  333.258808][T13392] ext4 filesystem being mounted at /38/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  333.323520][T12982] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  333.429170][T13403] loop5: detected capacity change from 0 to 512
[  333.434861][T13403] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode
[  333.443442][T13403] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a00ee018, mo2=0002]
[  333.446985][T13403] System zones: 1-12
[  333.451767][T13403] EXT4-fs (loop5): 1 truncate cleaned up
[  333.455475][T13403] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  333.474807][T13403] EXT4-fs warning (device loop5): ext4_group_extend:1862: can't shrink FS - resize aborted
[  333.508161][T11427] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  333.599439][   T24] usb 5-1: new high-speed USB device number 20 using dummy_hcd
[  333.754009][   T24] usb 5-1: config 1 interface 0 altsetting 165 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  333.767452][   T24] usb 5-1: config 1 interface 0 has no altsetting 0
[  333.774586][   T24] usb 5-1: New USB device found, idVendor=18d1, idProduct=503c, bcdDevice= 0.40
[  333.778126][   T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  333.789471][   T24] usb 5-1: Product: syz
[  333.791328][   T24] usb 5-1: Manufacturer: syz
[  333.793531][   T24] usb 5-1: SerialNumber: syz
[  334.217405][T13416] loop5: detected capacity change from 0 to 32768
[  334.233660][T13416] ocfs2: Mounting device (7,5) on (node local, slot 0) with writeback data mode.
[  334.248446][   T33] kauditd_printk_skb: 1 callbacks suppressed
[  334.248456][   T33] audit: type=1800 audit(2000003041.851:140): pid=13416 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2794" name="file1" dev="loop5" ino=17058 res=0 errno=0
[  334.315208][   T24] usbhid 5-1:1.0: can't add hid device: -71
[  334.323784][   T24] usbhid 5-1:1.0: probe with driver usbhid failed with error -71
[  334.333025][   T24] usb 5-1: USB disconnect, device number 20
[  334.475393][T13416] (syz.5.2794,13416,0):ocfs2_dio_end_io:2401 ERROR: Direct IO failed, bytes = -28
[  334.507667][T13425] loop6: detected capacity change from 0 to 512
[  334.516981][T13425] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[  334.538126][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.542041][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.551748][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.554701][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.557948][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.584260][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.588198][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.588267][T11427] ocfs2: Unmounting device (7,5) on (node local)
[  334.593080][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.598070][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.603325][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.607146][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.610222][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.613349][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.616616][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.623227][T13425] FAT-fs (loop6): error, fat_get_cluster: invalid cluster chain (i_pos 548)
[  334.626702][T13425] FAT-fs (loop6): error, fat_free: invalid cluster chain (i_pos 548)
[  334.962894][T13439] loop6: detected capacity change from 0 to 4096
[  334.965812][T13439] ntfs3(loop6): Different NTFS sector size (4096) and media sector size (512).
[  334.975179][T13439] ntfs3(loop6): Failed to load $UpCase (-22).
[  335.111762][T13446] loop4: detected capacity change from 0 to 512
[  335.115880][T13446] EXT4-fs (loop4): Test dummy encryption mode enabled
[  335.118687][T13446] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  335.125722][T13446] EXT4-fs error (device loop4): ext4_orphan_get:1418: comm syz.4.2804: bad orphan inode 131083
[  335.131803][T13446] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  335.196453][   T33] audit: type=1800 audit(2000003042.801:141): pid=13449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2804" name="file1" dev="loop4" ino=19 res=0 errno=0
[  335.483980][   T10] usb 7-1: new high-speed USB device number 5 using dummy_hcd
[  335.943844][T13458] loop5: detected capacity change from 0 to 32768
[  335.961929][T13458] XFS (loop5): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  336.003353][T13458] XFS (loop5): Ending clean mount
[  336.015215][T13458] XFS (loop5): Quotacheck needed: Please wait.
[  336.078238][T13458] XFS (loop5): Quotacheck: Done.
[  336.120562][ T9822] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  336.225054][   T10] usb 7-1: Using ep0 maxpacket: 8
[  336.236278][   T10] usb 7-1: New USB device found, idVendor=0458, idProduct=7003, bcdDevice=7a.1a
[  336.245412][   T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  336.248636][   T10] usb 7-1: Product: syz
[  336.256223][T11427] XFS (loop5): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  336.256573][   T10] usb 7-1: Manufacturer: syz
[  336.262249][   T10] usb 7-1: SerialNumber: syz
[  336.276457][   T10] usb 7-1: config 0 descriptor??
[  336.284982][   T10] gspca_main: sn9c2028-2.14.0 probing 0458:7003
[  336.892742][   T10] gspca_sn9c2028: read1 error -71
[  337.187295][   T10] gspca_sn9c2028: read1 error -71
[  337.189286][   T10] sn9c2028 7-1:0.0: probe with driver sn9c2028 failed with error -71
[  337.193006][   T10] usb 7-1: USB disconnect, device number 5
[  337.283966][T13492] loop6: detected capacity change from 0 to 64
[  337.367306][   T24] kernel write not supported for file /register (pid: 24 comm: kworker/1:0)
[  337.598819][   T51] usb 5-1: new high-speed USB device number 21 using dummy_hcd
[  337.755174][T13511] loop5: detected capacity change from 0 to 64
[  337.766740][   T51] usb 5-1: Using ep0 maxpacket: 16
[  337.771829][   T51] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  337.776341][   T51] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  337.800835][   T51] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  337.804302][   T51] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  337.806969][   T51] usb 5-1: Product: syz
[  337.808551][   T51] usb 5-1: Manufacturer: syz
[  337.842787][   T51] usb 5-1: SerialNumber: syz
[  337.847556][   T51] usb 5-1: config 0 descriptor??
[  337.853354][   T51] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  337.856763][   T51] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class)
[  337.921592][T13515] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2830'.
[  338.120832][T13522] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2833'.
[  338.150764][T13522] veth3: entered promiscuous mode
[  338.153049][T13522] bridge1: port 1(veth3) entered blocking state
[  338.155219][T13522] bridge1: port 1(veth3) entered disabled state
[  338.157566][T13522] veth3: entered allmulticast mode
[  338.274192][T13526] loop5: detected capacity change from 0 to 4096
[  338.277580][T13526] ntfs3(loop5): Different NTFS sector size (1024) and media sector size (512).
[  338.294650][T13526] ntfs3(loop5): Mark volume as dirty due to NTFS errors
[  338.461076][T13530] loop6: detected capacity change from 0 to 32768
[  338.464460][T13530] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.2838 (13530)
[  338.473370][T13530] BTRFS info (device loop6): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  338.475627][   T51] em28xx 5-1:0.0: chip ID is em28174
[  338.477327][T13530] BTRFS info (device loop6): using crc32c (crc32c-lib) checksum algorithm
[  338.482768][T13530] BTRFS info (device loop6): using free-space-tree
[  338.534865][T12982] BTRFS info (device loop6): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  338.655761][T13557] netlink: 168 bytes leftover after parsing attributes in process `syz.5.2843'.
[  338.687398][   T51] usb 5-1: USB disconnect, device number 21
[  338.692938][   T51] em28xx 5-1:0.0: Disconnecting em28xx
[  338.720488][   T51] em28xx 5-1:0.0: Freeing device
[  339.314227][T13575] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2848'.
[  339.414261][T13583] loop4: detected capacity change from 0 to 256
[  339.418011][T13583] exFAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  339.424187][T13583] exFAT-fs (loop4): Medium has reported failures. Some data may be lost.
[  339.437421][T13583] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x2d0d25cc, utbl_chksum : 0xe619d30d)
[  340.043324][T13601] bridge0: port 1(bridge_slave_0) entered disabled state
[  340.052582][T13601] bridge0: port 2(bridge_slave_1) entered disabled state
[  340.056146][T13604] netlink: 'syz.6.2859': attribute type 16 has an invalid length.
[  340.078666][T13604] netlink: 'syz.6.2859': attribute type 17 has an invalid length.
[  340.172547][T13604] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  340.496946][T13608] loop5: detected capacity change from 0 to 4096
[  340.610832][T13607] loop6: detected capacity change from 0 to 32768
[  340.626639][T13607] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.2862 (13607)
[  340.635697][T13607] BTRFS info (device loop6): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  340.641355][T13607] BTRFS info (device loop6): using crc32c (crc32c-lib) checksum algorithm
[  340.644709][T13607] BTRFS info (device loop6): disk space caching is enabled
[  340.647170][T13607] BTRFS warning (device loop6): space cache v1 is being deprecated and will be removed in a future release, please use -o space_cache=v2
[  340.706674][T13607] BTRFS info (device loop6): rebuilding free space tree
[  340.730281][T13607] BTRFS info (device loop6): disabling free space tree
[  340.732615][T13607] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  340.736030][T13607] BTRFS info (device loop6): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  340.863372][T12982] BTRFS info (device loop6): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  341.395285][T13636] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096
[  341.768456][   T24] usb 7-1: new low-speed USB device number 6 using dummy_hcd
[  341.930216][   T24] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  341.938261][   T24] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3
[  341.950026][   T24] usb 7-1: string descriptor 0 read error: -22
[  341.952694][   T24] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  341.956481][   T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  341.976621][   T24] usb 7-1: Quirk or no altset; falling back to MIDI 1.0
[  341.981892][   T24] usb 7-1: MIDIStreaming interface descriptor not found
[  342.241752][T13077] usb 7-1: USB disconnect, device number 6
[  342.649318][T13667] loop5: detected capacity change from 0 to 512
[  342.662494][T13667] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.2882: bg 0: block 393: padding at end of block bitmap is not set
[  342.671815][T13667] EXT4-fs error (device loop5) in ext4_mb_clear_bb:6657: Corrupt filesystem
[  342.675432][T13667] EXT4-fs (loop5): 2 truncates cleaned up
[  342.680457][T13667] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  342.705088][T13667] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled
[  342.711977][T13667] EXT4-fs (loop5): can't disable delalloc during remount
[  342.732451][T11427] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  342.826917][T13679] loop5: detected capacity change from 0 to 64
[  342.885606][T13685] loop4: detected capacity change from 0 to 1024
[  342.895180][T13685] EXT4-fs: Ignoring removed nobh option
[  342.899851][T13685] EXT4-fs: Ignoring removed bh option
[  342.924302][T13685] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  342.959008][ T9822] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  343.436038][T13705] erspan0: entered promiscuous mode
[  343.442808][T13705] erspan0: left promiscuous mode
[  343.590629][T13711] loop5: detected capacity change from 0 to 136
[  343.613732][T11427] iso9660: Corrupted directory entry in block 2 of inode 1472
[  343.621019][T11427] iso9660: Corrupted directory entry in block 2 of inode 1472
[  343.653402][T13707] loop4: detected capacity change from 0 to 32768
[  343.670210][T13707] ERROR: (device loop4): dbAlloc: the hint is outside the map
[  343.670210][T13707] 
[  343.684265][T13707] read_mapping_page failed!
[  343.686292][T13707] ERROR: (device loop4): txCommit: 
[  343.686292][T13707] 
[  344.052986][T13717] overlayfs: failed to resolve './file0': -2
[  344.156778][T13718] loop5: detected capacity change from 0 to 2048
[  344.170598][T13718] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  344.184557][T13714] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters
[  344.191694][T13714] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 3 with error 28
[  344.195686][T13714] EXT4-fs (loop5): This should not happen!! Data will be lost
[  344.195686][T13714] 
[  344.198956][T13714] EXT4-fs (loop5): Total free blocks count 0
[  344.200946][T13714] EXT4-fs (loop5): Free/Dirty block details
[  344.202907][T13714] EXT4-fs (loop5): free_blocks=2415919504
[  344.204839][T13714] EXT4-fs (loop5): dirty_blocks=16
[  344.206541][T13714] EXT4-fs (loop5): Block reservation details
[  344.208619][T13714] EXT4-fs (loop5): i_reserved_data_blocks=1
[  344.289134][   T10] usb 5-1: new high-speed USB device number 22 using dummy_hcd
[  344.376460][T13732] loop6: detected capacity change from 0 to 512
[  344.382090][T13732] EXT4-fs: Ignoring removed mblk_io_submit option
[  344.388617][T13732] EXT4-fs (loop6): failed to initialize system zone (-117)
[  344.391959][T13732] EXT4-fs (loop6): mount failed
[  344.439152][   T10] usb 5-1: Using ep0 maxpacket: 8
[  344.442603][   T10] usb 5-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01
[  344.445615][   T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  344.449915][   T10] usb 5-1: config 0 descriptor??
[  344.453437][   T10] gspca_main: xirlink-cit-2.14.0 probing 0545:8080
[  344.456777][   T10] input: xirlink-cit as /devices/platform/dummy_hcd.4/usb5/5-1/input/input21
[  344.537140][T11427] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  344.586625][T13737] gretap0: entered promiscuous mode
[  344.589248][T13737] vlan2: entered promiscuous mode
[  344.633828][T13735] loop6: detected capacity change from 0 to 32768
[  344.643966][T13735] XFS (loop6): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  344.655681][T13077] usb 5-1: USB disconnect, device number 22
[  344.685661][T13735] XFS (loop6): Ending clean mount
[  344.692758][T13735] XFS (loop6): Quotacheck needed: Please wait.
[  344.732249][T13735] XFS (loop6): Quotacheck: Done.
[  345.330237][T12982] XFS (loop6): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  345.584508][T13764] netlink: 'syz.6.2918': attribute type 27 has an invalid length.
[  345.874950][T13764] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  345.883972][T13764] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  345.981559][ T5870] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  345.989819][ T5870] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  345.995183][ T5870] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  346.000321][ T5870] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  346.319381][T13077] usb 7-1: new low-speed USB device number 7 using dummy_hcd
[  346.394023][T13789] loop4: detected capacity change from 0 to 256
[  346.403265][T13789] FAT-fs (loop4): Directory bread(block 64) failed
[  346.408139][T13789] FAT-fs (loop4): Directory bread(block 65) failed
[  346.411131][T13789] FAT-fs (loop4): Directory bread(block 66) failed
[  346.413951][T13789] FAT-fs (loop4): Directory bread(block 67) failed
[  346.418557][T13789] FAT-fs (loop4): Directory bread(block 68) failed
[  346.431943][T13789] FAT-fs (loop4): Directory bread(block 69) failed
[  346.434705][T13789] FAT-fs (loop4): Directory bread(block 70) failed
[  346.438771][T13789] FAT-fs (loop4): Directory bread(block 71) failed
[  346.442435][T13789] FAT-fs (loop4): Directory bread(block 72) failed
[  346.445174][T13789] FAT-fs (loop4): Directory bread(block 73) failed
[  346.491500][T13077] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  346.495690][T13077] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  346.503684][T13077] usb 7-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb
[  346.513808][T13077] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  346.515009][T13796] syz_tun: entered allmulticast mode
[  346.520368][T13077] usb 7-1: config 0 descriptor??
[  346.527329][T13794] syz_tun: left allmulticast mode
[  346.565816][T13799] loop5: detected capacity change from 0 to 256
[  346.695461][T13804] loop5: detected capacity change from 0 to 4096
[  346.698809][T13804] ntfs3(loop5): ino=0, mi_enum_attr
[  346.700593][T13804] ntfs3(loop5): Mark volume as dirty due to NTFS errors
[  346.703052][T13804] ntfs3(loop5): mft corrupted
[  346.704669][T13804] ntfs3(loop5): Failed to load $MFT.
[  346.730943][   T10] usb 7-1: USB disconnect, device number 7
[  346.740187][T13806] loop5: detected capacity change from 0 to 256
[  346.751818][T13806] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x25fbf2c1, utbl_chksum : 0xe619d30d)
[  346.862378][T13812] syzkaller0: tun_chr_ioctl cmd 2147767520
[  346.988080][ T9215] Bluetooth: hci2: command 0x0405 tx timeout
[  347.159140][   T10] usb 6-1: new high-speed USB device number 11 using dummy_hcd
[  347.295718][T13818] loop6: detected capacity change from 0 to 512
[  347.314686][T13818] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  347.321086][T13818] ext4 filesystem being mounted at /88/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  347.326589][   T10] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  347.335364][   T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  347.340362][   T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  347.345448][   T33] audit: type=1800 audit(2000003054.952:142): pid=13818 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2943" name="file2" dev="loop6" ino=16 res=0 errno=0
[  347.354094][   T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  347.354142][   T10] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  347.354158][   T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  347.356224][   T10] usb 6-1: config 0 descriptor??
[  347.404583][T12982] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  347.539400][T13829] netlink: 'syz.6.2947': attribute type 3 has an invalid length.
[  347.601657][T13835] binder_alloc: 13833: pid 13833 spamming oneway? 1 buffers allocated for a total size of 5304
[  348.412359][   T10] plantronics 0003:047F:FFFF.0010: ignoring exceeding usage max
[  348.430151][   T10] plantronics 0003:047F:FFFF.0010: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0
[  348.438318][   T10] usb 6-1: USB disconnect, device number 11
[  348.719569][T13859] loop4: detected capacity change from 0 to 64
[  348.842303][T13853] loop6: detected capacity change from 0 to 32768
[  348.846288][T13853] BTRFS: device fsid 3d39d0ba-bdae-447e-827b-b091e1a68885 devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.2956 (13853)
[  348.860308][T13853] BTRFS error: invalid seeding and uuid-changed device detected
[  349.471964][ T9215] Bluetooth: hci1: command 0x0406 tx timeout
[  349.589228][ T1822] IPVS: starting estimator thread 0...
[  349.607105][T13869] loop5: detected capacity change from 0 to 32768
[  349.615443][T13869] ERROR: (device loop5): dtSearch: DT_GETPAGE: dtree page corrupt
[  349.615443][T13869] 
[  349.625328][T13869] ERROR: (device loop5): remounting filesystem as read-only
[  349.628221][T13869] jfs_lookup: dtSearch returned -5
[  349.630346][T13869] ERROR: (device loop5): dtReadFirst: DT_GETPAGE: dtree page corrupt
[  349.630346][T13869] 
[  349.633699][T13869] jfs_readdir: unexpected rc = -5 from dtReadNext
[  349.688441][T13881] IPVS: using max 78 ests per chain, 187200 per kthread
[  350.163943][T13891] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2971'.
[  350.177437][T13891] netlink: 34 bytes leftover after parsing attributes in process `syz.4.2971'.
[  350.899726][T13903] loop6: detected capacity change from 0 to 256
[  350.922243][T13903] exFAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  350.934661][T13903] exFAT-fs (loop6): Medium has reported failures. Some data may be lost.
[  350.951892][T13903] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d)
[  351.108253][T13913] loop5: detected capacity change from 0 to 256
[  351.113207][T13913] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  351.328680][T13932] netlink: 'syz.5.2987': attribute type 4 has an invalid length.
[  351.344851][T13932] netlink: 'syz.5.2987': attribute type 4 has an invalid length.
[  351.386748][T13936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2991'.
[  351.466701][T13938] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2992'.
[  351.470663][T13938] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2992'.
[  351.476871][T13938] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2992'.
[  351.483721][T13938] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2992'.
[  351.497429][   T24] usb 7-1: new high-speed USB device number 8 using dummy_hcd
[  351.667382][   T24] usb 7-1: Using ep0 maxpacket: 32
[  351.671428][   T24] usb 7-1: config 0 interface 0 has no altsetting 0
[  351.676533][   T24] usb 7-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e
[  351.680757][   T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  351.683433][   T24] usb 7-1: Product: syz
[  351.684905][   T24] usb 7-1: Manufacturer: syz
[  351.686619][   T24] usb 7-1: SerialNumber: syz
[  351.689807][   T24] usb 7-1: config 0 descriptor??
[  352.100452][   T24] gs_usb 7-1:0.0: Configuring for 2 interfaces
[  352.526339][   T24] gs_usb 7-1:0.0: Couldn't get bit timing const for channel 0 (-EPROTO)
[  352.529648][   T24] gs_usb 7-1:0.0: probe with driver gs_usb failed with error -71
[  352.536688][   T24] usb 7-1: USB disconnect, device number 8
[  352.895428][T13970] loop6: detected capacity change from 0 to 1024
[  353.272233][   T10] usb 6-1: new high-speed USB device number 12 using dummy_hcd
[  353.421974][T13979] loop4: detected capacity change from 0 to 1024
[  353.428701][   T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  353.432514][   T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  353.436674][   T10] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  353.518424][   T10] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  353.522296][   T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  353.526580][   T10] usb 6-1: config 0 descriptor??
[  353.853732][ T1234] hfsplus: b-tree write err: -5, ino 4
[  353.891282][T13985] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3008'.
[  353.894568][T13985] bond0: option coupled_control: mode dependency failed, not supported in mode balance-rr(0)
[  353.942086][T13987] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3009'.
[  353.995550][T13989] loop6: detected capacity change from 0 to 1024
[  354.005424][T13989] hfsplus: bad catalog entry type
[  354.022322][   T35] hfsplus: b-tree write err: -5, ino 4
[  354.025615][   T10] plantronics 0003:047F:FFFF.0011: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0
[  354.455852][ T1822] usb 6-1: USB disconnect, device number 12
[  354.488639][T13998] loop4: detected capacity change from 0 to 1024
[  354.492199][T13998] hfsplus: unable to find HFS+ superblock
[  354.604634][T13998] loop4: detected capacity change from 0 to 8192
[  354.607787][T13998] msdos: Unknown parameter 'nodo]'
[  355.656519][T14016] netlink: 'syz.5.3021': attribute type 1 has an invalid length.
[  355.669157][T14016] netlink: 168864 bytes leftover after parsing attributes in process `syz.5.3021'.
[  355.818202][T14019] loop4: detected capacity change from 0 to 128
[  355.832209][T14019] FAT-fs (loop4): bogus number of reserved sectors
[  355.837008][T14019] FAT-fs (loop4): This doesn't look like a DOS 1.x volume; DOS 2.x BPB is non-zero
[  355.841234][T14019] FAT-fs (loop4): Can't find a valid FAT filesystem
[  356.102993][   T33] audit: type=1326 audit(2000003063.713:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14024 comm="syz.5.3025" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5d8178ebe9 code=0x0
[  356.346392][T14031] loop4: detected capacity change from 0 to 512
[  356.377710][T14031] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2
[  356.384543][T14035] 
[  356.385211][T14031] EXT4-fs (loop4): 1 truncate cleaned up
[  356.385607][T14035] =====================================================
[  356.390828][T14035] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
[  356.393879][T14035] 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 Not tainted
[  356.397029][T14035] -----------------------------------------------------
[  356.400089][T14035] syz.5.3029/14035 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
[  356.402586][T14035] ffff888107eff168 (&new->fa_lock){....}-{3:3}, at: kill_fasync+0x199/0x4d0
[  356.405639][T14035] 
[  356.405639][T14035] and this task is already holding:
[  356.408685][T14035] ffff88811fc1e028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0
[  356.412753][T14035] which would create a new lock dependency:
[  356.415381][T14035]  (&client->buffer_lock){..-.}-{3:3} -> (&new->fa_lock){....}-{3:3}
[  356.418503][T14035] 
[  356.418503][T14035] but this new dependency connects a SOFTIRQ-irq-safe lock:
[  356.421697][T14035]  (&client->buffer_lock){..-.}-{3:3}
[  356.421712][T14035] 
[  356.421712][T14035] ... which became SOFTIRQ-irq-safe at:
[  356.426120][T14035]   lock_acquire+0x120/0x360
[  356.427708][T14035]   _raw_spin_lock+0x2e/0x40
[  356.429303][T14035]   evdev_pass_values+0xb9/0xbd0
[  356.431007][T14035]   evdev_events+0x1e6/0x340
[  356.432816][T14035]   input_pass_values+0x288/0x890
[  356.434821][T14035]   input_event_dispose+0x3e5/0x6b0
[  356.436656][T14035]   input_event+0x89/0xe0
[  356.438308][T14035]   hidinput_hid_event+0x132c/0x1c90
[  356.440513][T14035]   hid_process_event+0x4be/0x620
[  356.442635][T14035]   hid_report_raw_event+0xe91/0x16d0
[  356.444867][T14035]   hid_input_report+0x43e/0x520
[  356.446622][T14035]   hid_irq_in+0x47e/0x6d0
[  356.448409][T14035]   __usb_hcd_giveback_urb+0x41a/0x690
[  356.450715][T14035]   dummy_timer+0x862/0x4550
[  356.452238][T14035]   __hrtimer_run_queues+0x52c/0xc60
[  356.454006][T14035]   hrtimer_run_softirq+0x187/0x2b0
[  356.455753][T14035]   handle_softirqs+0x286/0x870
[  356.457615][T14035]   __irq_exit_rcu+0xca/0x1f0
[  356.459488][T14035]   irq_exit_rcu+0x9/0x30
[  356.461059][T14035]   sysvec_call_function_single+0xa3/0xc0
[  356.463253][T14035]   asm_sysvec_call_function_single+0x1a/0x20
[  356.465572][T14035]   rcu_is_watching+0x44/0xb0
[  356.467349][T14035]   lock_acquire+0x5f/0x360
[  356.468893][T14035]   unwind_next_frame+0xc2/0x2390
[  356.470579][T14035]   arch_stack_walk+0x11c/0x150
[  356.472347][T14035]   stack_trace_save+0x9c/0xe0
[  356.473872][T14035]   kasan_save_stack+0x3e/0x60
[  356.475395][T14035]   kasan_record_aux_stack+0xbd/0xd0
[  356.477076][T14035]   call_rcu+0x157/0x9c0
[  356.478447][T14035]   kmem_cache_free+0x309/0x400
[  356.480015][T14035]   vms_complete_munmap_vmas+0x626/0x8a0
[  356.481865][T14035]   mmap_region+0x11db/0x20c0
[  356.483403][T14035]   do_mmap+0xc45/0x10d0
[  356.484823][T14035]   vm_mmap_pgoff+0x2a6/0x4d0
[  356.486358][T14035]   do_syscall_64+0xfa/0x3b0
[  356.487849][T14035]   entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  356.489846][T14035] 
[  356.489846][T14035] to a SOFTIRQ-irq-unsafe lock:
[  356.492156][T14035]  (tasklist_lock){.+.+}-{3:3}
[  356.492170][T14035] 
[  356.492170][T14035] ... which became SOFTIRQ-irq-unsafe at:
[  356.496314][T14035] ...
[  356.496319][T14035]   lock_acquire+0x120/0x360
[  356.498806][T14035]   _raw_read_lock+0x36/0x50
[  356.500345][T14035]   __do_wait+0xde/0x740
[  356.501716][T14035]   do_wait+0x1f8/0x520
[  356.503123][T14035]   kernel_wait+0xab/0x170
[  356.504613][T14035]   call_usermodehelper_exec_work+0xbe/0x230
[  356.506583][T14035]   process_scheduled_works+0xae1/0x17b0
[  356.508434][T14035]   worker_thread+0x8a0/0xda0
[  356.509988][T14035]   kthread+0x711/0x8a0
[  356.511363][T14035]   ret_from_fork+0x3fc/0x770
[  356.512926][T14035]   ret_from_fork_asm+0x1a/0x30
[  356.514454][T14035] 
[  356.514454][T14035] other info that might help us debug this:
[  356.514454][T14035] 
[  356.517780][T14035] Chain exists of:
[  356.517780][T14035]   &client->buffer_lock --> &new->fa_lock --> tasklist_lock
[  356.517780][T14035] 
[  356.522067][T14035]  Possible interrupt unsafe locking scenario:
[  356.522067][T14035] 
[  356.524805][T14035]        CPU0                    CPU1
[  356.526564][T14035]        ----                    ----
[  356.528361][T14035]   lock(tasklist_lock);
[  356.529776][T14035]                                local_irq_disable();
[  356.532030][T14035]                                lock(&client->buffer_lock);
[  356.534451][T14035]                                lock(&new->fa_lock);
[  356.536644][T14035]   <Interrupt>
[  356.537858][T14035]     lock(&client->buffer_lock);
[  356.539444][T14035] 
[  356.539444][T14035]  *** DEADLOCK ***
[  356.539444][T14035] 
[  356.542115][T14035] 7 locks held by syz.5.3029/14035:
[  356.543875][T14035]  #0: ffff8881364ae918 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x1a1/0x480
[  356.546879][T14035]  #1: ffff88801f565230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0xa5/0x340
[  356.550154][T14035]  #2: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xb6/0x340
[  356.553415][T14035]  #3: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x8d/0x890
[  356.556571][T14035]  #4: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x79/0x340
[  356.559604][T14035]  #5: ffff88811fc1e028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0
[  356.562929][T14035]  #6: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0
[  356.565860][T14035] 
[  356.565860][T14035] the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
[  356.569408][T14035] -> (&client->buffer_lock){..-.}-{3:3} {
[  356.571205][T14035]    IN-SOFTIRQ-W at:
[  356.572723][T14035]                     lock_acquire+0x120/0x360
[  356.575189][T14035]                     _raw_spin_lock+0x2e/0x40
[  356.577320][T14035]                     evdev_pass_values+0xb9/0xbd0
[  356.579555][T14035]                     evdev_events+0x1e6/0x340
[  356.581687][T14035]                     input_pass_values+0x288/0x890
[  356.583992][T14035]                     input_event_dispose+0x3e5/0x6b0
[  356.586344][T14035]                     input_event+0x89/0xe0
[  356.588340][T14035]                     hidinput_hid_event+0x132c/0x1c90
[  356.590589][T14035]                     hid_process_event+0x4be/0x620
[  356.592759][T14035]                     hid_report_raw_event+0xe91/0x16d0
[  356.595158][T14035]                     hid_input_report+0x43e/0x520
[  356.597301][T14035]                     hid_irq_in+0x47e/0x6d0
[  356.599234][T14035]                     __usb_hcd_giveback_urb+0x41a/0x690
[  356.601474][T14035]                     dummy_timer+0x862/0x4550
[  356.603508][T14035]                     __hrtimer_run_queues+0x52c/0xc60
[  356.605710][T14035]                     hrtimer_run_softirq+0x187/0x2b0
[  356.607848][T14035]                     handle_softirqs+0x286/0x870
[  356.609902][T14035]                     __irq_exit_rcu+0xca/0x1f0
[  356.611955][T14035]                     irq_exit_rcu+0x9/0x30
[  356.613926][T14035]                     sysvec_call_function_single+0xa3/0xc0
[  356.616354][T14035]                     asm_sysvec_call_function_single+0x1a/0x20
[  356.618953][T14035]                     rcu_is_watching+0x44/0xb0
[  356.621057][T14035]                     lock_acquire+0x5f/0x360
[  356.623103][T14035]                     unwind_next_frame+0xc2/0x2390
[  356.625286][T14035]                     arch_stack_walk+0x11c/0x150
[  356.627410][T14035]                     stack_trace_save+0x9c/0xe0
[  356.629489][T14035]                     kasan_save_stack+0x3e/0x60
[  356.631581][T14035]                     kasan_record_aux_stack+0xbd/0xd0
[  356.633848][T14035]                     call_rcu+0x157/0x9c0
[  356.635810][T14035]                     kmem_cache_free+0x309/0x400
[  356.637954][T14035]                     vms_complete_munmap_vmas+0x626/0x8a0
[  356.640371][T14035]                     mmap_region+0x11db/0x20c0
[  356.642463][T14035]                     do_mmap+0xc45/0x10d0
[  356.644315][T14035]                     vm_mmap_pgoff+0x2a6/0x4d0
[  356.646393][T14035]                     do_syscall_64+0xfa/0x3b0
[  356.648366][T14035]                     entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  356.650730][T14035]    INITIAL USE at:
[  356.652069][T14035]                    lock_acquire+0x120/0x360
[  356.654389][T14035]                    _raw_spin_lock+0x2e/0x40
[  356.656815][T14035]                    evdev_pass_values+0xb9/0xbd0
[  356.659131][T14035]                    evdev_events+0x1e6/0x340
[  356.661595][T14035]                    input_pass_values+0x288/0x890
[  356.664407][T14035]                    input_event_dispose+0x3e5/0x6b0
[  356.667064][T14035]                    input_event+0x89/0xe0
[  356.669477][T14035]                    hidinput_hid_event+0x132c/0x1c90
[  356.672295][T14035]                    hid_process_event+0x4be/0x620
[  356.674740][T14035]                    hid_report_raw_event+0xe91/0x16d0
[  356.677365][T14035]                    hid_input_report+0x43e/0x520
[  356.679829][T14035]                    hid_irq_in+0x47e/0x6d0
[  356.681771][T14035]                    __usb_hcd_giveback_urb+0x41a/0x690
[  356.684277][T14035]                    dummy_timer+0x862/0x4550
[  356.686201][T14035]                    __hrtimer_run_queues+0x52c/0xc60
[  356.688384][T14035]                    hrtimer_run_softirq+0x187/0x2b0
[  356.690532][T14035]                    handle_softirqs+0x286/0x870
[  356.692707][T14035]                    __irq_exit_rcu+0xca/0x1f0
[  356.694902][T14035]                    irq_exit_rcu+0x9/0x30
[  356.696733][T14035]                    sysvec_call_function_single+0xa3/0xc0
[  356.699142][T14035]                    asm_sysvec_call_function_single+0x1a/0x20
[  356.701619][T14035]                    rcu_is_watching+0x44/0xb0
[  356.703592][T14035]                    lock_acquire+0x5f/0x360
[  356.705583][T14035]                    unwind_next_frame+0xc2/0x2390
[  356.707739][T14035]                    arch_stack_walk+0x11c/0x150
[  356.709853][T14035]                    stack_trace_save+0x9c/0xe0
[  356.711917][T14035]                    kasan_save_stack+0x3e/0x60
[  356.714276][T14035]                    kasan_record_aux_stack+0xbd/0xd0
[  356.716582][T14035]                    call_rcu+0x157/0x9c0
[  356.718653][T14035]                    kmem_cache_free+0x309/0x400
[  356.721274][T14035]                    vms_complete_munmap_vmas+0x626/0x8a0
[  356.724222][T14035]                    mmap_region+0x11db/0x20c0
[  356.726521][T14035]                    do_mmap+0xc45/0x10d0
[  356.728412][T14035]                    vm_mmap_pgoff+0x2a6/0x4d0
[  356.730445][T14035]                    do_syscall_64+0xfa/0x3b0
[  356.732577][T14035]                    entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  356.734995][T14035]  }
[  356.735844][T14035]  ... key      at: [<ffffffff99e22300>] evdev_open.__key.25+0x0/0x20
[  356.738720][T14035] 
[  356.738720][T14035] the dependencies between the lock to be acquired
[  356.738727][T14035]  and SOFTIRQ-irq-unsafe lock:
[  356.743505][T14035]   -> (tasklist_lock){.+.+}-{3:3} {
[  356.745204][T14035]      HARDIRQ-ON-R at:
[  356.746611][T14035]                         lock_acquire+0x120/0x360
[  356.748688][T14035]                         _raw_read_lock+0x36/0x50
[  356.750721][T14035]                         __do_wait+0xde/0x740
[  356.752757][T14035]                         do_wait+0x1f8/0x520
[  356.754918][T14035]                         kernel_wait+0xab/0x170
[  356.756998][T14035]                         call_usermodehelper_exec_work+0xbe/0x230
[  356.759499][T14035]                         process_scheduled_works+0xae1/0x17b0
[  356.761896][T14035]                         worker_thread+0x8a0/0xda0
[  356.763984][T14035]                         kthread+0x711/0x8a0
[  356.766304][T14035]                         ret_from_fork+0x3fc/0x770
[  356.768669][T14035]                         ret_from_fork_asm+0x1a/0x30
[  356.771056][T14035]      SOFTIRQ-ON-R at:
[  356.772753][T14035]                         lock_acquire+0x120/0x360
[  356.774922][T14035]                         _raw_read_lock+0x36/0x50
[  356.777154][T14035]                         __do_wait+0xde/0x740
[  356.779315][T14035]                         do_wait+0x1f8/0x520
[  356.781337][T14035]                         kernel_wait+0xab/0x170
[  356.783602][T14035]                         call_usermodehelper_exec_work+0xbe/0x230
[  356.786622][T14035]                         process_scheduled_works+0xae1/0x17b0
[  356.789520][T14035]                         worker_thread+0x8a0/0xda0
[  356.791651][T14035]                         kthread+0x711/0x8a0
[  356.793777][T14035]                         ret_from_fork+0x3fc/0x770
[  356.795997][T14035]                         ret_from_fork_asm+0x1a/0x30
[  356.798200][T14035]      INITIAL USE at:
[  356.799570][T14035]                        lock_acquire+0x120/0x360
[  356.802079][T14035]                        _raw_write_lock_irq+0xa2/0xf0
[  356.804508][T14035]                        copy_process+0x224f/0x3c00
[  356.806768][T14035]                        kernel_clone+0x21e/0x840
[  356.808954][T14035]                        user_mode_thread+0xdd/0x140
[  356.811260][T14035]                        rest_init+0x23/0x300
[  356.813360][T14035]                        start_kernel+0x3a9/0x410
[  356.815806][T14035]                        x86_64_start_reservations+0x24/0x30
[  356.818627][T14035]                        x86_64_start_kernel+0x143/0x1c0
[  356.821078][T14035]                        common_startup_64+0x13e/0x147
[  356.823660][T14035]      INITIAL READ USE at:
[  356.825484][T14035]                             lock_acquire+0x120/0x360
[  356.828071][T14035]                             _raw_read_lock+0x36/0x50
[  356.830446][T14035]                             __do_wait+0xde/0x740
[  356.832619][T14035]                             do_wait+0x1f8/0x520
[  356.834750][T14035]                             kernel_wait+0xab/0x170
[  356.836974][T14035]                             call_usermodehelper_exec_work+0xbe/0x230
[  356.839567][T14035]                             process_scheduled_works+0xae1/0x17b0
[  356.842072][T14035]                             worker_thread+0x8a0/0xda0
[  356.844265][T14035]                             kthread+0x711/0x8a0
[  356.846280][T14035]                             ret_from_fork+0x3fc/0x770
[  356.848531][T14035]                             ret_from_fork_asm+0x1a/0x30
[  356.850806][T14035]    }
[  356.851702][T14035]    ... key      at: [<ffffffff8de0c058>] tasklist_lock+0x18/0x40
[  356.854190][T14035]    ... acquired at:
[  356.855543][T14035]    lock_acquire+0x120/0x360
[  356.857101][T14035]    _raw_read_lock+0x36/0x50
[  356.858706][T14035]    send_sigurg+0x12b/0x420
[  356.860254][T14035]    sk_send_sigurg+0x6c/0x2e0
[  356.861915][T14035]    tcp_check_urg+0x200/0x760
[  356.863564][T14035]    tcp_urg+0x164/0x3f0
[  356.864966][T14035]    tcp_rcv_established+0xf93/0x1eb0
[  356.866743][T14035]    tcp_v4_do_rcv+0xa23/0xce0
[  356.868449][T14035]    __release_sock+0x21c/0x350
[  356.870105][T14035]    release_sock+0x5f/0x1f0
[  356.871773][T14035]    tcp_sendmsg+0x39/0x50
[  356.873722][T14035]    __sock_sendmsg+0x19c/0x270
[  356.875698][T14035]    __sys_sendto+0x3bd/0x520
[  356.877686][T14035]    __x64_sys_sendto+0xde/0x100
[  356.879755][T14035]    do_syscall_64+0xfa/0x3b0
[  356.881747][T14035]    entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  356.884443][T14035] 
[  356.885321][T14035]  -> (&f_owner->lock){....}-{3:3} {
[  356.887411][T14035]     INITIAL USE at:
[  356.889065][T14035]                      lock_acquire+0x120/0x360
[  356.891113][T14035]                      _raw_write_lock_irq+0xa2/0xf0
[  356.893717][T14035]                      __f_setown+0x67/0x370
[  356.895808][T14035]                      generic_setlease+0xd60/0x1240
[  356.897930][T14035]                      fcntl_setlease+0x3a2/0x4c0
[  356.899968][T14035]                      do_fcntl+0x6a9/0x1910
[  356.901918][T14035]                      __se_sys_fcntl+0xc8/0x150
[  356.903920][T14035]                      do_syscall_64+0xfa/0x3b0
[  356.906069][T14035]                      entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  356.908648][T14035]     INITIAL READ USE at:
[  356.910200][T14035]                           lock_acquire+0x120/0x360
[  356.912509][T14035]                           _raw_read_lock_irqsave+0xaf/0x100
[  356.915092][T14035]                           send_sigurg+0x55/0x420
[  356.917183][T14035]                           sk_send_sigurg+0x6c/0x2e0
[  356.919293][T14035]                           tcp_check_urg+0x200/0x760
[  356.921501][T14035]                           tcp_urg+0x164/0x3f0
[  356.924084][T14035]                           tcp_rcv_established+0xf93/0x1eb0
[  356.926553][T14035]                           tcp_v4_do_rcv+0xa23/0xce0
[  356.928917][T14035]                           __release_sock+0x21c/0x350
[  356.931589][T14035]                           release_sock+0x5f/0x1f0
[  356.934040][T14035]                           tcp_sendmsg+0x39/0x50
[  356.936182][T14035]                           __sock_sendmsg+0x19c/0x270
[  356.938434][T14035]                           __sys_sendto+0x3bd/0x520
[  356.940550][T14035]                           __x64_sys_sendto+0xde/0x100
[  356.942838][T14035]                           do_syscall_64+0xfa/0x3b0
[  356.945112][T14035]                           entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  356.947987][T14035]   }
[  356.948882][T14035]   ... key      at: [<ffffffff99b22f60>] file_f_owner_allocate.__key+0x0/0x20
[  356.951658][T14035]   ... acquired at:
[  356.953090][T14035]    lock_acquire+0x120/0x360
[  356.954806][T14035]    _raw_read_lock_irqsave+0xaf/0x100
[  356.956733][T14035]    send_sigio+0x38/0x370
[  356.958274][T14035]    kill_fasync+0x24d/0x4d0
[  356.959824][T14035]    sock_wake_async+0x137/0x160
[  356.961450][T14035]    sk_wake_async+0x184/0x280
[  356.963159][T14035]    unix_release_sock+0x768/0xd30
[  356.964897][T14035]    unix_release+0x92/0xd0
[  356.966366][T14035]    sock_close+0xc3/0x240
[  356.967835][T14035]    __fput+0x44c/0xa70
[  356.969151][T14035]    task_work_run+0x1d4/0x260
[  356.970677][T14035]    get_signal+0x11ed/0x1340
[  356.972352][T14035]    arch_do_signal_or_restart+0x9a/0x750
[  356.974498][T14035]    exit_to_user_mode_loop+0x75/0x110
[  356.976358][T14035]    do_syscall_64+0x2bd/0x3b0
[  356.977996][T14035]    entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  356.979967][T14035] 
[  356.980761][T14035] -> (&new->fa_lock){....}-{3:3} {
[  356.982472][T14035]    INITIAL USE at:
[  356.983711][T14035]                    lock_acquire+0x120/0x360
[  356.985652][T14035]                    _raw_write_lock_irq+0xa2/0xf0
[  356.987684][T14035]                    fasync_remove_entry+0xf1/0x1c0
[  356.989841][T14035]                    lease_modify+0x1ca/0x3c0
[  356.991862][T14035]                    locks_remove_file+0x4bf/0xea0
[  356.994021][T14035]                    __fput+0x3ab/0xa70
[  356.995861][T14035]                    task_work_run+0x1d4/0x260
[  356.997871][T14035]                    exit_to_user_mode_loop+0xec/0x110
[  357.000080][T14035]                    do_syscall_64+0x2bd/0x3b0
[  357.002041][T14035]                    entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  357.004583][T14035]    INITIAL READ USE at:
[  357.006206][T14035]                         lock_acquire+0x120/0x360
[  357.008322][T14035]                         _raw_read_lock_irqsave+0xaf/0x100
[  357.010755][T14035]                         kill_fasync+0x199/0x4d0
[  357.012879][T14035]                         sock_wake_async+0x137/0x160
[  357.015147][T14035]                         sk_wake_async+0x184/0x280
[  357.017310][T14035]                         mptcp_destroy_common+0x152/0x320
[  357.019677][T14035]                         mptcp_disconnect+0x23d/0x700
[  357.021934][T14035]                         __inet_stream_connect+0x6be/0xe80
[  357.024479][T14035]                         inet_stream_connect+0x66/0xa0
[  357.026771][T14035]                         __sys_connect+0x316/0x440
[  357.029468][T14035]                         __x64_sys_connect+0x7a/0x90
[  357.031629][T14035]                         do_syscall_64+0xfa/0x3b0
[  357.033744][T14035]                         entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  357.036519][T14035]  }
[  357.037441][T14035]  ... key      at: [<ffffffff99b22f80>] fasync_insert_entry.__key+0x0/0x20
[  357.040563][T14035]  ... acquired at:
[  357.041896][T14035]    lock_acquire+0x120/0x360
[  357.043412][T14035]    _raw_read_lock_irqsave+0xaf/0x100
[  357.045332][T14035]    kill_fasync+0x199/0x4d0
[  357.046897][T14035]    evdev_pass_values+0x627/0xbd0
[  357.048698][T14035]    evdev_events+0x1e6/0x340
[  357.050452][T14035]    input_pass_values+0x288/0x890
[  357.052453][T14035]    input_event_dispose+0x330/0x6b0
[  357.054225][T14035]    input_inject_event+0x1dd/0x340
[  357.055950][T14035]    evdev_write+0x2fc/0x480
[  357.057570][T14035]    vfs_write+0x27e/0xa90
[  357.059103][T14035]    ksys_write+0x145/0x250
[  357.060607][T14035]    do_syscall_64+0xfa/0x3b0
[  357.062197][T14035]    entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  357.064174][T14035] 
[  357.065025][T14035] 
[  357.065025][T14035] stack backtrace:
[  357.066951][T14035] CPU: 1 UID: 0 PID: 14035 Comm: syz.5.3029 Not tainted 6.16.0-syzkaller-11895-gcca7a0aae895-dirty #0 PREEMPT(full) 
[  357.066961][T14035] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  357.066967][T14035] Call Trace:
[  357.066972][T14035]  <TASK>
[  357.066976][T14035]  dump_stack_lvl+0x189/0x250
[  357.066988][T14035]  ? __pfx_dump_stack_lvl+0x10/0x10
[  357.066997][T14035]  ? __pfx__printk+0x10/0x10
[  357.067008][T14035]  validate_chain+0x1f05/0x2140
[  357.067019][T14035]  __lock_acquire+0xab9/0xd20
[  357.067031][T14035]  ? kill_fasync+0x199/0x4d0
[  357.067038][T14035]  lock_acquire+0x120/0x360
[  357.067048][T14035]  ? kill_fasync+0x199/0x4d0
[  357.067057][T14035]  _raw_read_lock_irqsave+0xaf/0x100
[  357.067066][T14035]  ? kill_fasync+0x199/0x4d0
[  357.067073][T14035]  ? __pfx__raw_read_lock_irqsave+0x10/0x10
[  357.067080][T14035]  ? do_raw_spin_lock+0x121/0x290
[  357.067090][T14035]  kill_fasync+0x199/0x4d0
[  357.067097][T14035]  ? kill_fasync+0x53/0x4d0
[  357.067105][T14035]  evdev_pass_values+0x627/0xbd0
[  357.067115][T14035]  ? evdev_pass_values+0x661/0xbd0
[  357.067124][T14035]  evdev_events+0x1e6/0x340
[  357.067132][T14035]  ? evdev_events+0x79/0x340
[  357.067140][T14035]  ? input_pass_values+0x8d/0x890
[  357.067148][T14035]  input_pass_values+0x288/0x890
[  357.067157][T14035]  ? input_handle_event+0x70c/0xf30
[  357.067163][T14035]  input_event_dispose+0x330/0x6b0
[  357.067171][T14035]  input_inject_event+0x1dd/0x340
[  357.067177][T14035]  ? input_inject_event+0xb6/0x340
[  357.067184][T14035]  evdev_write+0x2fc/0x480
[  357.067193][T14035]  ? __pfx_evdev_write+0x10/0x10
[  357.067202][T14035]  ? bpf_lsm_file_permission+0x9/0x20
[  357.067212][T14035]  ? security_file_permission+0x75/0x290
[  357.067220][T14035]  ? rw_verify_area+0x255/0x4d0
[  357.067229][T14035]  ? __lock_acquire+0xab9/0xd20
[  357.067239][T14035]  ? __pfx_evdev_write+0x10/0x10
[  357.067247][T14035]  vfs_write+0x27e/0xa90
[  357.067257][T14035]  ? __pfx_vfs_write+0x10/0x10
[  357.067266][T14035]  ? __fget_files+0x2a/0x420
[  357.067277][T14035]  ? __fget_files+0x2a/0x420
[  357.067286][T14035]  ? __fget_files+0x3a0/0x420
[  357.067296][T14035]  ? __fget_files+0x2a/0x420
[  357.067307][T14035]  ksys_write+0x145/0x250
[  357.067316][T14035]  ? __pfx_ksys_write+0x10/0x10
[  357.067324][T14035]  ? rcu_is_watching+0x15/0xb0
[  357.067331][T14035]  ? do_syscall_64+0xbe/0x3b0
[  357.067341][T14035]  do_syscall_64+0xfa/0x3b0
[  357.067349][T14035]  ? lockdep_hardirqs_on+0x9c/0x150
[  357.067357][T14035]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  357.067364][T14035]  ? exc_page_fault+0x9f/0xf0
[  357.067372][T14035]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  357.067379][T14035] RIP: 0033:0x7f5d8178ebe9
[  357.067388][T14035] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  357.067394][T14035] RSP: 002b:00007f5d826a3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  357.067403][T14035] RAX: ffffffffffffffda RBX: 00007f5d819b5fa0 RCX: 00007f5d8178ebe9
[  357.067409][T14035] RDX: 0000000000001068 RSI: 0000200000000040 RDI: 0000000000000004
[  357.067413][T14035] RBP: 00007f5d81811e19 R08: 0000000000000000 R09: 0000000000000000
[  357.067418][T14035] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  357.067422][T14035] R13: 00007f5d819b6038 R14: 00007f5d819b5fa0 R15: 00007ffd668363b8
[  357.067429][T14035]  </TASK>
[  357.074769][T14031] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  357.200222][ T9822] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.

VM DIAGNOSIS:
21:53:32  Registers:
info registers vcpu 0

CPU#0
RAX=ffffffff81b44d6b RBX=1ffff11026cc7f61 RCX=ffff88801ea21cc0 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc9000178f7e0 RSP=ffffc9000178f660
R8 =ffffffff8fa34237 R9 =1ffffffff1f46846 R10=dffffc0000000000 R11=fffffbfff1f46847
R12=ffff88813663fb08 R13=dffffc0000000000 R14=ffff88804b03b1c0 R15=0000000000000001
RIP=ffffffff81b44d53 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b8624000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f0b0b3733e0 CR3=000000000df36000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=2525252525252525 2525252525252525
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 00000000000000ff XMM05=7712c53e93b9f1e8 728370bf3cb3486e
XMM06=63e772d7f3a22482 dabb339f3c035440 XMM07=bd0dad416e16bee6 46815929601aad29
XMM08=0000000000000000 00007f0358412ee7 XMM09=0000000000000000 00007f0358412fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000030 RBX=0000000000000030 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000016d81 RDI=0000000000016d82 RBP=00000000000003f8 RSP=ffffc90004067010
R8 =ffff8880219d0237 R9 =1ffff1100433a046 R10=dffffc0000000000 R11=ffffffff854e6de0
R12=dffffc0000000000 R13=ffffffff99af18cb R14=ffffffff99de64e0 R15=0000000000000000
RIP=ffffffff854e6e5c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f5d826a36c0 ffffffff 00c00000
GS =0000 ffff8881a3c24000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c39ebff CR3=000000010fc0e000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=ffffffffffffffff ffffffffffffffff XMM01=2323232323232323 2323232323232323
XMM02=0000000000000000 0000000000000023 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=ffffffffffffffff ffffffffffffffff XMM05=00007f5d81987478 00007f5d819874c0
XMM06=00007f5d819874b8 00007f5d819874b0 XMM07=00007f5d819874a8 00007f5d819874a0
XMM08=35ca37e6a79f83ce 3c7ffd42c7de4993 XMM09=0000000000000000 00007f5d81812fc5
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
