program: r0 = syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000087d1e323200000000000109022d000100002000090400fc02030002000921ffff040122050009058103"], 0x0) syz_mount_image$jfs(&(0x7f0000000400), &(0x7f00000000c0)='./file1\x00', 0x10080, &(0x7f0000000000)=ANY=[], 0xfd, 0x6028, &(0x7f000000c6c0)="$eJzs3cuOHFcZB/CvL9NzCYmtCEXGYuE4EBJCfLch3OKwYAFIICGvsTWZRAYHkG0QiSw8kReIBZdHgE02LPIiYcca8QBYsllFglCops+xq9s902M809U95/eTxlVfn6rpU/5PTXdNVfUJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACC+8+0fnu5ExOVfpgcOR3wqehHdiNW6Phb1zMW8fD8ijsRWczwXEb3liHr9rX8ORZyLiI+eibh3/9Z6/fCZXfbj/Kmb1z/57rf+/ps/3Dny4zd/9MF4+w8+ffbD396OOPz91z785PbebDsAAACUoqqqqpMO84+m4/tu250CAGYiv/5XSX5crVar1Xta/747X/1RF1o3VZPdbhYRsdlcp37P4HQ8ACyYzfi47S7QIvkXrR8RT7XdCWCuddruAPvi3v1b652Ub6f5enBs2J7/TjmS/2bnwf0d202nGb/GZFY/X3eiF89u05/VGfVhnuT8u+P5Xx62D9Jy+53/rGyX/2B461Nxcv698fzHjOT/x4hY2Py7E/MvVc6//zj5b/YWeP+XPwAAAAAAB1/++//hls//Lj/5puzKTud/j82oDwAAAAAAAACw1550/L8HjP8HAAAAc6s+Vq/96ZmHj3Ui/nZowrL1If6lTsTTY8sDhUk3y6y13Q8AAAAAAAAAAAAAKEl/eA3vpU7EUkQ8vbZWVVX91TReP64nXX/Rlb79ULK2f8kDAMDQR8+ke/nvrgwf6ETUc5fSZ/0tra2tVdXK6lq1Vq0u5/ezg+WVarVxXJun9WPLg128Ie4PqvqbrTTWa5p2vDytffz71c81qHq76NhstJ06AKUbvhrd84p0wFTVoWj7XQ6Lwf5/8Nj/2Y22f04BAACA/VdVVdVJH+d9NJ3z77bdKQBgFlby6//4eQG1Wq1Wq9UHr26qJrvdLCJis7lO/Z7BcPwAsGA24+O2u0CL5F+0fkQcabsTwFzrtN0B9sW9+7fWOynfTvP1II3vnq8FGcl/s7O1Xl5/0nSa8WtMZvXzdSd68ew2/XluRn2YJzn/7nj+l4ftg7Tcfuc/K9vlX2/n4Rb607acf288/zEHJ//uxPxLlfPvP1b+PfkDAAAAAMAcy3//P+z8b95kAAAAAAAAAFg49+7fWs/3vebz/5+dsFynOef+zwMj59/Zdf7u/z1Icv7d8fzHLsjpNebvvvEw/3/dv7X+wc1/fiZP5z7/pd6gfu6lTrfXT9f8VEtvxdW4Fhtx6pHl+yPtpx9pXxppPzOl/ewj7YO6fTW3n4j1+FlcizcftC9PuTBqZUp7NaU959+z/xcp599vfNX5r6X2zti0dvf97iP7fXM66Xku/uU/Lz66d+21wdQl7kTvwbY11dt3fF/6tLOt/5OnBvGLGxvXT/zqys2b109Hmow8eibSZI/l/JfSV87/pReG7fn3fnN/vfv+4LHznxd3or9t/i805uvtfXnGfWtDzn+QvnL++RVo8v6/yPlvv/+/0kJ/AAAAAAAAAAAAAAAAYCdVVW3dInoxIi6k+3/aujcTAJip330vzVRJqNVqtVqt3qu6P2f9GVFN9nqziJXRdS5ExK8nfTMAYJ79NyL+0XYnaI38C5Y/76+efq7tzgAzdePd935y5dq1jes32u4JAAAAAAAAAPD/yuN/HmuM/7x1HdDYuNEj47++EccWdvzP7qC3NdZ52qDnY+fxv4/HzuN/96c839KU9mkjFi9PaV+Z0j7xRo+GnP/zKeOc/9G0YSWN//pSC/1pW87/eBrrOef/hbHlmvlXf17k/Lsj+Z+8+c7PT954971Xr75z5e2Ntzd+evrUhXNnz587e/78ybeuXts4Nfy3xR7vr5x/HvvadaBlyfnnzOVflpz/51Mt/7Lk/F9MtfzLkvPP7/fkX5acfz72kX9Zcv4vp1r+Zcn5fzHV8i9Lzv+VVMu/LDn/L6Va/mXJ+b+aavmXJed/ItXyL0vO/2Sq5V+WnH8+wyX/suT885UN8i9Lzv9MquVflpz/2VTLvyw5/3Opln9Zcv7nUy3/suT8L6Ra/mXJ+X851fIvS87/K6mWf1ly/q+lWv5lyfl/NdXyL0vO/2upln9Zcv5fT7X8y5Lz/0aq5V+WnP83Uy3/suT8X0+1/Mvy8PP/zcx45t9/jZiDbuzHTFVV1Rx0w8wTzLT9mwkAAAAAAAAAAAAAGDeLy4nb3kYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/sQMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7N1djFxnfQbws1/22gnEJSGEYMjacYIhG++uvxITDOYjNA0tTQOhpQ11jL12DP6q14YkippNk7ZBRGqk9iK9KAVEEVJbJUJIpVKKIhWpvWuuQLlBrZQLS00qE0ElKpKtzpz3fXdmdnZm1961z5zz+0Xx3ztzZuadM2dm91nrmQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGi26WPTfz6QZVn+f+OPDVl2Zf73ddm+/MvZ3Zd7hQAAAMDFeqPx5z9clU7Yt4QLNW3zb+/5j+/Pzc3NZV94/dybfzk3l84Yy7KhtVnWOC/691/+Yq55m+CJbHRgsOnrwR43P9Tj/OEe54/0OH9Nj/PX9jh/tMf5C3bAAuuK38c0rmxL468bil2aXZONNM7b0uFSTwysHRyMv8tpGGhcZm7kcHY0O5ZNZ5MLLjPQ+C/LXtiU39ZdWbytwabb2phl2fmfPXowrmEg7OMtWcuNNTQ/dq99JBt7/WePHvzOmVff2Wn23A0LVpplWzfn63wyy+Z/XZUNZGvTPonrHGxa58YO6xxqWedA43L539vXeX6J64z3ezSs86Uu69wYTnvoxizLZrNFt2n3RDaYrW+71bS/R4sjIr+O/KF8Wza8rONk0xKOk/wyr9zYepy0H5Nx/28K+2R4kTU0PxyvPb5mwX6/0OMkv9dlOFbz674nv9HR0eZfrbYcq/k2j960+DHQ8bHrcAykY7npGNjc6xgYXDPUOAYG59e8ueUYmFpwmcFsoHFb527qfgxMnDl+amLm4UduPXr8wJHpI9MnpiZ379yxa+eOXbsmDh89Nj1Z/Lm8XdpH1meD6RjcHF5r4jH43rZtmw/JuW+u3PNgtCTPg/y+f+bmfEFXDmaLHOP5Nk9uvfjnQfq+3/Q8GG56HnR8Te3wPBhewvMg3+b81qV9zxxu+r/TGlbrtXBD0zFwOb8f5rd5//sWfy3cGNb11PuX+/1waMExEO/WQHju5aekn/dGbw/7ZeFxcX1+xhVrsrMz06e3PXTgzJnTU1kYl8TVTY9V+/Gyvuk+ZQuOl8FlHy/7/v5XN1/f4fQNYV+N3tL9scq32Tne/bFqvLq37s81WbE/W07dnoWxwi71/uz03SzfnylLdNmf+TZP3nrxPwumXNL0+jfS6/VvaGS4eP0bSntjpOX1b+FDM9RYWZadv3Vpr38j4f9L/fp3TUle//J9df+27sdAvs1TE8s9Boa7vv7dGOZAWM/7QmIYbcr9bzbOny0O06bHsudxMzw8Eo6b4XiLrcfNjgWXya8tv+2tkxd23Gy9sfWxavm5pYLHTb6v/mqy+3GTb/Pi1MW/dqyLf2167VjT6xgYGVqTr3ckHQTF693cungMbMsOZiezY9mhdJn8Uc5va3z70o6BNeH/S/3acV1JjoF8Xz27vfsxkG/zox0r+7PT1nBK2qbpZ6f23y8slvmvH56/vvbdttKZP1/nx3/8qXRapwyRb/PqzuXmjO776ZZwyhUd9lP782exY/pQdmn203Vhncd2df/dVL7NNbuXeDzty7Ls5amXG7/vCr/f/d7ZH3+/5fe+nX6n/PLUy3dP3PuT5awfAIAL92bjz9k1xc+aTf9ivZR//wcAAAD6Qsz9g2Em8j8AAABURsz9Q2Em8j8AAABURsz9w2EmNcn/D96+57k3HsvSuwHOBfH8uBvu+VCxXex4z4avx+bm5ad/9Nsjz331saXd9mCWZb+6+10dt3/wQ3FdhVNxnR9oPX2B625Y0u0/cN/8ds3vn3B+T3H98f4s9TCIXeUXJrY3rnfs4anGfPHurDHvnX3qieL6i6/j9ud2FNv/TXjTkn2HB1ouvzWsZ0uYY+E9Ze7ZN78f8hkv99zG9/zr1Z+dv714uYHNb23czWf/uLje+B5Rz1xdbB/v92Lr/5evffe5fPuHbuq8/scGO6//XLjeV8L85d5i++Z9/tWm9f9pWH+8vXi5bd/6Ycf1P/+OYvvnw3HxjTDb1/+Rv3j3G50er3g7++4oLhdvf/J/dzYuF68vXn/7+kcfm2rZH+3X/+LrxfXs/fLPh5q3j6fH24keuKP1+B4Ij29LjzzLsu/+Wdayn7MPFpf757b1x+s7dUfn9d/Sts5TAzc0Lj9/fza03K+v/932jvc3rmffP25ouT/P3Bn23+sTP8qv99y94XgM5//fS8X1tb+X6fN3tr7exO2/saF43sbrm2hb/zNt65+9Id93vdd/1+vF+p//8NqW9e/7RDie7ipmr/Uf+durWi7/ze8Uj8fpr4yfODlz9uihpr3a/DxeO7pu/RVXvuWtV4XX0vav95888+D06bHJscksG+vDtwxc7fV/K8z/Kcbsyt9C4Sc/L467pz9ZfN967y+Kr58Jpz8QHs/4/fHrfz3Scry2P+6zHy7mxa7//WEdS/WOr/3XDUva8NznXzj7T3/yavvPBfH+nHr7aOP+Pbvp2sZ5Ay8W57e/XvXyn29vfV7/dHiyMX8Q9utceGfmzdcWt9d+/fG9SZ7+dPH8jT/Jxctnbe8nsmGo9X5c7Pp/Gn6O+eF1ra9/8fj4wWNt7+a8IRvIlzAbXh+y2eL8uFXc30+fv7bj7cX34clm37mcZS5q5uGZiWNHT5x9aOLM9MyZiZmHH9l//OTZE2f2N967dP8Xe11+/vm9vvH8PjS9e2fWeLafLMYqu9zrP3XfwUO3Td58aPrwgbOHz9x3avr0kYMzMwenD83cfODw4emv9Lr80UN7p7bv2XHb9vEjRw/tvX3Pnh17xo+eOJkvo1hUD7snvzR+4vT+xkVm9u7cM7Vr187J8eMnD03vvW1ycvxsr8s3vjeN55f+8vjp6WMHzhw9Pj0+c/SR6b1Te3bv3t7z3R+Pnzo8MzZx+uyJibMz06cnivsydqZxcv69r9flqYeZk+H1rs1A+On8c7fsTu+Pm/v244teVbFJ64+n2WvhvaDi97deX8fcPxJmUpP8DwAAAHUQc3944//5M+R/AAAAqIyY+9eGmcj/AAAAUBkx9xfJfzR9/Htd8v9K9f8f1/9v0P/X/8/0/xP9f/3/TP9f/78H/X/9/35ev/6//j+9la3/H3J/ti7L/Ps/AAAAVFTM/evDTOR/AAAAqIyY+68IM5H/AQAAoDJi7r8yzKQm+d/n/+v/6/936//HbfX/M/3/MvT/t/y3/v8C+v/6/5n+/wW73P35fl9/Cfv/6/T/KZuy9f9j7n9LmElN8j8AAADUQcz9bw0zkf8BAACgMmLuvyrMRP4HAACAyoi5f0OYSU3yv/5/cxf9cf1//X+f/6//n5Sw/+/z/zvQ/9f/z/T/L9jl7s/3+/pL2P/3+f+UTtn6/zH3/1qYSU3yPwAAANRBzP1vCzOR/wEAAKAyYu6/OsxE/gcAAIDKiLn/mjCTmuT/evb/X8myzOf/Z/r/+v9t69T/1/9fDfr/+v/d6P/r//fz+vX/9f/prWz9/5j73x5mUpP8DwAAAHUQc/+1YSbyPwAAAFRGzP3vCDOR/wEAAKAyYu6/LsykJvm/nv3/xT7/X/9f/1//X/9//nT9/5Wh/6//343+v/5/P69f/1//n97K1v+Puf+dYSY1yf8AAABQBzH3Xx9mIv8DAABAZcTc/64wE/kfAAAAKiPm/o1hJjXJ//r/+v/6//r/+v/6/6upv/r/g4ueo/9f0P9vtXL9/9n5Bej/98369f/1/+mtbP3/mPvfHWZSk/wPAAAAdRBz/3vCTOR/AAAAqIyY+28IM5H/AQAAoDJi7h8LM6lJ/tf/1//X/9f/1//X/19N/dX/X5z+f0H/v5XP/9f/1//X/6e7svX/Y+7fFGZSk/wPAAAAdRBz/+YwE/kfAAAAKiPm/hvDTOR/AAAAqIyY+7eEmdQk/+v/6//r/+v/6//r/68m/X/9/270//X/+3n9+v/6//RWtv5/zP03hZnUJP8DAABAHcTcf3OYifwPAAAAlRFz/3vDTOR/AAAAqIyY+7eGmdQk/+v/6//r//dx/39I/z/T/y89/X/9/270/8vV/x/W/9f/1/9nhZWt/x9z//vCTGqS/wEAAKAOYu5/f5iJ/A8AAACVEXP/LWEm8j8AAABURsz942EmNcn/+v/6//r/fdz/9/n/Letfgf7/SPPp+v8rQ/9f/78b/f9y9f99/r/+v/4/K61s/f+Y+28NM6lJ/gcAAIA6iLl/W5iJ/A8AAACVEXP/RJiJ/A8AAACVEXP/ZJhJTfK//v+l7P839rH+v/6//n84v4T9f5//vwr0//X/u9H/1//v5/Xr/+v/01vZ+v8x90+FmdQk/wMAAEAdxNy/PcxE/gcAAIDKiLl/R5iJ/A8AAACVEXP/zjCTmuT/Pun/b0sFqL7u//v8f/1//X/9f/3/lab/r/+f6f9fsMvdn+/39ev/6//TarDDaWXr/8fcvyvMpCb5HwAAAOog5v7dYSbyPwAAAFRGzP23hZnI/wAAAFAZMfffHmZSk/zfJ/3/inz+v/6//r/+v/6//v9K0//X/8/0/y/Y5e7P9/v69f/1/+mtbP3/mPv3hJnUJP8DAABAHcTc/4EwE/kfAAAAKiPm/jvCTOR/AAAA6CudPocwirn/g2EmNcn/+v9V7//PrdX/1//X/+++fv3/1aX/r//fjf6//n8/r1//X/+f3srW/4+5f2+YSU3yPwAAANRBzP0fCjOR/wEAAKAyYu7/cJiJ/A8AAACVEXP/vjCTmuR//f+q9/9r8/n/jfP1//X/9f/LR/9f/78b/f/+7P+HH1v0/0vU/8+PIf1/yqhs/f+Y+z8SZlKT/A8AAAB1EHP/R8NM5H8AAACojJj7PxZmIv8DAABAZcTc//Ewk5rkf/1//f+K9P9X7PP/B5rWpf+v/6//f/H0/1et/994KdT/Lyza/1+n/9/NfH/+Kp//3+f9f5//T1mVrf8fc/+dYSY1yf8AAABQBzH3fyLMRP4HAACAyoi5/9fDTOR/AAAAqIyY++8KM6lJ/tf/1//X//f5//r/+v+rSf/f5/934/P/y9L/vzz9+X5fv/6//j+9la3/H3P/b4SZ1CT/AwAAQB3E3H93mIn8DwAAAJURc/8nw0zkfwAAAOgzaxY9J+b+3wwzqUn+77/+/1hf9v8H0/Xr/+v/6//r/+v/ryT9f/3/TP//gl3u/ny/r1//X/+f3srW/4+5/7fCTGqS/wEAAKAOYu7/VJiJ/A8AAACVEXP/b4eZyP8AAABQGTH33xNmUpP8v9L9//bLd+Pz//X/M/1//X/9f/3/i9RP/f8R/f8F9P/1//t5/fr/+v/0Vrb+f8z9vxNmUpP8DwAAAHUQc/+9YSbyPwAAAJTUg8u+RMz9nw4zkf8BAACgMmLu/0yYSU3yf/99/n//9f/z69f/1//P9P/1/5v2qv7/yumn/r/P/19I/1//v5/Xr/+v/09vZev/x9x/X5hJTfI/AAAA1EHM/Z8NM5H/AQAAoDJi7v/dMBP5HwAAACoj5v7fCzOpSf7X/y/X5/+v1//X/9f/1//X/1+Wfuz/569h+v8F/X/9/35ev/6//j+9la3/H3P/58JMapL/AQAAoA5i7v/9MBP5HwAAACoj5v4/CDOR/wEAAKAyYu6/P8ykJvlf/79c/X+f/6//r/+v/6//vzz92P/3+f/z9P/1//t5/fr/+v/0Vrb+f8z9nw8zqUn+BwAAgDqIuf8Pw0zkfwAAAKiMmPv3h5nI/wAAAFAZMfc/EGZSk/yv/6//r/+v/6//r/+/mvT/9f+70f/X/+/n9ev/6//TW9n6/zH3Hwgz2dd6MwAAAED/irn/C2EmNfn3fwAAAKiDmPsPhpnI/wAAAFAZMfcfCjOpSf7X/9f/1//X/9f/1/9fTfr/+v/d6P/r//fz+vX/9f/prWz9/5j7p8NMapL/AQAAoA5i7j8cZiL/AwAAQGXE3H8kzET+BwAAgMqIuf/BMJOa5H/9f/1//f/a9v9f+l7bOvX/9f9Xg/6//n83+v/6//28fv1//X96K1v/P+b+o2EmNcn/AAAAUAcx938xzET+BwAAgMqIuf9LYSbyPwAAAFRGzP3Hwkxqkv/1//X/9f9r2/9f2uf/r5u/Xf1//f8Lof+v/9+N/r/+fz+vX/9f/5/eytb/j7n/eJhJTfI/AAAA1EHM/SfCTOR/AAAAqIyY+0+Gmcj/AAAAUBkx958KM6lJ/tf/X17/f2CRbqD+f+f16/9XoP/fRP9f//9C6P/r/3dzCfr/bzZfRP+/1eXuz/f7+vX/9f/prRT9/5H5r2Pu/6Mwk5rkfwAAAKiDmPtPh5nI/wAAAFAZMffPhJnI/wAAAFAZ/8/efS9ZVld9HD5vAy9DWd4Dt+AVeAleg1VegjmCGcxizglzwqyYc85ZxJxFMYtapTU9a62Bnum9u6fPmd77t57nj17S0MOmaNFvzXzYufsfGLc02f/6f+//1//r//X/+v9d0v/r/6d4/7/+f83Pr//X/zNvEf3/3X47d/+D4pYm+x8AAAA6yN3/4LjF/gcAAIBh5O5/SNxi/wMAAMAwcvc/NG5psv/1//p//b/+X/+v/98l/b/+/zD5zyL9v/5/rc+v/9f/M29p/X/u/ofFLU32PwAAAHSQu//hcYv9DwAAAMPI3f+IuMX+BwAAgGHk7n9k3NJk/+v/9f/6f/2//l//v0v6f/3/FO//1/+v+fn1//p/5i2t/8/d/6i4pcn+BwAAgA5y9z86brH/AQAAYBi5+x8Tt9j/AAAAMIzc/dfFLS32/5X6f/2//n+N/f+V+n/9/3ro//X/U/T/+v81P7/+/5L7/539s5rlWVr/n7v/+rilxf4HAACAHnL3PzZusf8BAABgBfaO9Efl7n9c3GL/AwAAwDBy9z8+bmmy//X/+v9V9f+bc//Sjvb9v/f/6/9X5CLPf7zAeob+X/+/0f9fstPu59f+/Pp/7/9n3jH6/ytnfqit9P+5+58QtzTZ/wAAANBB7v4nxi32PwAAAAwjd/+T4hb7HwAAAIaRu//JcUuT/a//1/+vqv/3/v99+n/9/5p4/7/+f4r+X/+/5ufX/+v/mbfz9//f74b9e9T+P3f/DXFLk/0PAAAAHeTuvzFusf8BAABgGLn7nxK32P8AAAAwjNz9T41bmux//b/+/3z//9//0//r//X/5z+v/98O/b/+f4r+X/+/5ufX/+v/mbfz/n+m9z/427n7nxa3NNn/AAAA0EHu/qfHLfY/AAAADCN3/zPiFvsfAAAAhpG7/5lxS5P9r//X/3v/v/5f/6//3yX9/2L7/4P/1bsn/f+R6P/1/4f1//c9wvPr/+lgaf1/7v5nxS1N9j8AAAB0kLv/2XGL/Q8AAADDyN1/U9xi/wMAAMAwcvc/J25psv/1//p//b/+/579/17L/v/s5/T/u6H/X2z/P03/fyT6f/3/Vt//n/+7q/9nIEvr/3P3PzduabL/AQAAoIPc/c+LW+x/AAAAGEbu/ufHLfY/AAAADCN3/wvilib7X/+v/z9R/3+1/n+8/v+Y7/+/Yoz+3/v/d0f/r/+fov/X/6/5+bfe/3v/PwNaWv+fu/+FcUuT/Q8AAADD29vU7n9R3GL/AwAAwDBy9784brH/AQAAYBi5+18StzTZ//p//b/3/+v/T9T/D/L+f/3/7uj/9f9Tjtr/b/T/9dei/1/O8+v/9f/MW1r/n7v/pXFLk/0PAAAAHeTuf1ncYv8DAADAMHL3vzxusf8BAABgGLn7XxG3NNn/+n/9v/5f/6//1//vkv5f/z/F+//1/2t+fv2//p95S+v/c/e/Mm5psv8BAACgg9z9r4pb7H8AAAAYRu7+V8ct9j8AAAAMI3f/a+KWg/t/73I+1eWj/9f/6//1//p//f8u6f/1/1P0/xfv/88c8ufT/y/r+fX/+n/mLa3/z91/c9zi5/8BAABgGLn7Xxu32P8AAAAwjNz9r4tb7H8AAAAYRu7+18ctTfb/Yf3/nfc69/v1/0ej/7/48+v/9f9H7f/vuv381+n/9f/Hof/X/28G7P+9/38dz6//1/8zb2n9f+7+N8QtTfY/AAAAdJC7/41xi/0PAAAAw8jd/6a4xf4HAACAYeTuf3Pc0mT/b//9/9fq//X/+v+4+n/v/9f/6//1/9P0//r/NT+//l//z7zt9P9XbLbV/+fuf0vc0mT/AwAAQAe5+98at9j/AAAAMIzc/W+LW+x/AAAAGEbu/rfHLU32//b7f+//1/8fs//f0/8n/X/8fdX/6/+PQf+v/9/o/y/Zaffza39+/b/+n3lLe/9/7v5b9qdev/0PAAAAHdyy//HM5h1xi/0PAAAAw8jd/864xf4HAACAYeTuf1fc0mT/6//1/6fe/3v/f9H/x99X/b/+/xj0//r/jf7/kp12P7/259f/6/+Zt7T+P3f/u+OWJvsfAAAAOsjd/564xf4HAACAYcTuP/eL3+1/AAAAGNJ79z+e2bwvbmmy/xv3/9eetP+/5m7/Wf9/8efX/2+l/7/l4Pee/l//vyb6f/3/FP2//n/Nz7+c/j8+cZ3+n+VZWv+fu//9cUuT/Q8AAAAd5O7/QNxi/wMAAMAwcvffGrfY/wAAADCM3P0fjFua7P/G/f8g7/+//x3xBPr/cft/7/+Pu6r+/079f9L/6/+n6P/1/2t+/uX0/97/z3Itrf/P3f+huKXJ/gcAAIAOcvd/OG6x/wEAAGAYufs/ErfY/wAAADCM3P0fjVua7H/9/9r7f+//1//r/xfZ/3v/f9H/6/+n6P/39v+fiP5/nc+v/9f/M29p/X/u/o/FLU32PwAAAHSQu//jcYv9DwAAAMPI3f+JuMX+BwAAgGHk7v9k3NJk/+v/9f+76v/P/kn0/036/+v1/xv9/6H0//r/Kfp/7/9f8/Pr//X/zFta/5+7/1NxS5P9DwAAAB3k7v903GL/AwAAwDBy938mbrH/AQAAYBi5+z8bN9zn3qf3SNt11SGfj95c/6//9/5//b/3/+v/d0n/r/+fov/X/6/5+fX/+n/mLa3/z93/ubjFz/8DAADAMHL3fz5usf8BAABgGLn7vxC32P8AAAAwjNz9X4xbmux//b/+X/+/2v7/Gv3/PZ9f/79M+n/9/xT9v/5/zc+v/9f/M29p/X/u/i/FLU32PwAAAHSQu//LcYv9DwAAAMPI3f+VuMX+BwAAgGHk7v9q3NJk/+v/9f/6/9X2/97/f+D59f/LpP/X/0/R/+v/1/z8+n/9P/NO3v/feFt+yf7HE/b/ufu/Frc02f8AAADQQe7+r8ct9j8AAAAMI3f/N+IW+x8AAACGkbv/m3FLk/2v/9f/6//1//p//f8u6f/1/1P0//r/LTx/fpvo//X/LNDJ+//zX7L/8YT9f+7+b8UtTfY/AAAAdJC7/9txi/0PAAAAS3fwl3ceKnf/d+IW+x8AAACGkbv/u3FLk/0/cv8/9Yfp/8/R/+v/N/p//f+O6f/1/1P0//r/NT+//l//z7yl9f+5+78XtzTZ/wAAANBB7v7vxy32PwAAAAwjd/8P4hb7HwAAAIaRu/+2uKXJ/h+5/5+i/z9H/6//3+j/9f87pv/X/0/R/+v/1/z8+n/9P/NOqf+/anNI/5+7/4dxS5P9DwAAAB3k7r89brH/AQAAYBi5+38Ut9j/AAAAMIzc/T+OW8bZ/w+4deJ36v+33v/vfxPp//X/G/2//l//v0//r/+fov/X/6/5+fX/+n/mLe39/7n7fxK3jLP/AQAAoL3c/T+NW+x/AAAAGEbu/p/FLfY/AAAADCN3/8/jlib7X/+/jPf/5zPo//X/O+7/r9jo//X/l5n+X/8/Rf+v/1/z8+v/9f/MW1r/n7v/F3FLk/0PAAAAHeTu/2XcYv8DAADAMHL3/ypusf8BAABgGLn7fx23NNn/+v9l9P8ne///+Xpa/3+a/f/eBT/+Avt/7//X/192+n/9/xT9v/5/zc+f/X9+3+n/9f9caGn9f+7+38QtTfY/AAAAdJC7/7dxi/0PAAAAw8jd/7u4xf4HAACAYeTu/33c0mT/6/9H6P+9/38Z/f+FP77+f3f9/9nP6f/XQf+v/5+i/9f/r/n5vf9f/8+8pfX/ufvviFua7H8AAADoIHf/H+IW+x8AAACGkbv/j3GL/Q8AAADDyN1/Z9zSZP/r//X/Q/b/V+v/R+//vf9/PfT/+v8p+n/9/5qfX/+v/2fe0vr/3P1/ilua7H8AAADoIHf/n+MW+x8AAACGkbv/L3GL/Q8AAADDyN3/17ilyf7X/+v/j9//X1V/3Yvt/73/X/+v/1+Mcfv//9f/6/9P3P/fdPO5T+v/1/n8+n/9P/OW1v/n7v9b3NJk/wMAAEAHufv/HrfY/wAAADCM3P3/iFvsfwAAABhG7v5/xi1N9r/+X/8/5Pv/9f/6f/3/Yozb/3v/v/7f+//1//p//T9zFtX/54jYnNncFbc02f8AAADQQe7+f8Ut9j8AAAAMI3f/v+MW+x8AAACGkbv/P3FLk/2v/9f/6//1//p//f8u6f/1/1P0//r/NT+//l//z7xF9f9n9+f+V53Z/C8AAP//ZkQqeg==") rename(&(0x7f0000000000)='./file1\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') setxattr$trusted_overlay_opaque(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x0, 0x0, 0x0) r1 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000180)=""/105, 0x69) r2 = syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file0\x00', 0x0, &(0x7f0000000000)={[{@nouid32}, {@mblk_io_submit}, {@i_version}]}, 0x1, 0x746, &(0x7f0000000f40)="$eJzs3c9rHGUfAPDvbJOmb9vXpODBimCgBwulG5vWUkGkogcpVop689Bud7ehZLdbspvShIpWFMGTSPHsj5M3/wFRBL15FDx7kkKRUi+CsDLb2bjt7jabNJtV9/OBCc8zM5tnvjszz/Mkz8NMAGNrNv2Ri9gfER8lEdPZ+iQiJlupiYiTd/e7c/taMV2SaDZf/y1p7ZPmo+MzqT1Z5rGI+O79iEO57nLrK6uLhUqlvJTl5xrVy3P1ldXDF6uFhfJC+dL88WePzp+Yf+bE/JbF+sd7r54/9dVLX9x498dfXnvr1JNJnIy92bbOOLbKbMxm38lk+hXe48WtLmzEklEfAJuS3po77t7lsT+mY0crBQD8l70dEU0AYMwk2n8AGDPt/wO0x/aGMQ72T3brhYjY1Sv+iWzMbldrHHT3neSekZEkIma2oPzZiLj65gdfp0sMaRwSoJd3rkfEuZnZ7vov6ZqzsFFPD7DP7H159R9sn2/T/s+JXv2f3Fr/J3r0f6Z63Lubsf79n7u5BcX0lfb/nuvZ/12btDazI8v9v9Xnm0wuXKyU07rtkYg4GJNTaf7IA8o49vHzP/Tb1tn/S5e0/HZfMDuOmxNT936mVGgUHibmTreuRzw+0Sv+ZO38J336v2cGLKPx/ROf99u2fvzD1fws4qme5//vGW1Jx/zEqeianzjXuh7m2ldFt/yH0/v6lT/q+NPzv/vB8c8knfM16xsv46dP/ny537bNXv87kzda6Z3ZuquFRmPpSMTO5JXu9R1TSNv59v5p/AcPPLj+63X9p38Tnhsw/sVPvzy/+fiHK42/tKHzv/HEgZ+/6R1PM5ttvO75P9ZKHczWDFL/DXqAD/PdAQAAAAAAAAAAAAAAAAAAAAAAAMCgchGxN5Jcfi2dy+Xzd9/h/WjszlVq9cahC7XlS6VovSt7JiZz7SddTnc8D/VI9jz8dn7+vvzRiNgXETem/tfK54u1SmnUwQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAZk+f9/+nfp0a9dEBAEOza9QHAABsO+0/AIwf7T8AjB/tPwCMH+0/AIwf7T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABDdub06XRp/n77WjHNl66sLC/WrhwuleuL+epyMV+sLV3OL9RqC5Vyvlirrvf7KrXa5fnjsXx1rlGuN+bqK6tnq7XlS42zF6uFhfLZ8uS2RAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG1NfWV0sVCrlJQkJCYm1xKhrJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB/h78CAAD//6LRHug=") r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x11}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000540)="4b967612492abcf9e956273ce2de", 0xe, 0x805, 0x0, 0x46) close_range(r2, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000440)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="200305f4ffff042226f860"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000000)='./file1\x00', 0x1000801, &(0x7f0000000140)=ANY=[], 0x1, 0x212, &(0x7f00000001c0)="$eJzsmb9rFEEUx78zu7d7RhEstLA5i4ARzN7unkoai9iKICSilodZQ3STk7stkoBgsLHxD/AfUUhlYWcjFlYWKggWXmmj4MjMztzN3Xrr/fCw8H2K4TtvZ96893bzBnIgCOK/5dPHbx+eXllZPw/gGBbha/sXp7+GW+vfP3MqWr7aOf7wcNgfAyBEf+7+4XwPR/Fy1QEe5W6F+C7s54va5zq40pIb4Din9U0wBCZWIcllAobb2nzP0q0jWqQJu9NKN+5upUkoh0gOsRwagBiIv3vAsAGgqo9gVnydvf37zRRo5yJNjKgIc07h0QRCRtspq5+Kb5XjslUC+b5uPXl8IOeBtodW/SJwRFo3wLCm9Qp8BEFQ09MksvI/7Rr/Phz52gbyHzel6niL/RmrZsSJ5dI1Jom/claJ+Cnm4tmb6hXMR8g4Jt/Fa8Vd3mR+vCliZsMW+Qfds5zqHr4u7vr8T8s7m1CNC0Dh0duFNL1mW95c1eLkgJ8zdn0sYb7AkZ9E3j+YC5y1+pNr3Qr1bPtBvbO3v7y13dxMNpOdOG5cCi+E4cW4rnpzPpb0v6rqTwuW/8qItR7zsNvMsna0C2TtqDeP87GfANaet76qPVz1P46lH0KY60Wl7f/+DHX/+fk+pmZLzsjgCYIgCIIgCIIgCIIgCIIgSqi9K1jwAvp/lcz8JlbEja+r1b8CAAD//0veXtA=") r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fadvise64(r5, 0x9, 0x0, 0x3) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x3e, &(0x7f00000000c0)=0x7, 0x4) bind$llc(r7, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x54}, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000340)={'wpan0\x00'}) [ 77.770007][ T48] Bluetooth: hci0: command tx timeout [ 78.085790][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 78.235806][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 78.241725][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 78.246650][ T10] usb 5-1: config 0 interface 0 altsetting 252 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 78.251907][ T10] usb 5-1: config 0 interface 0 altsetting 252 endpoint 0x81 has invalid wMaxPacketSize 0 [ 78.256763][ T10] usb 5-1: config 0 interface 0 altsetting 252 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 78.262380][ T10] usb 5-1: config 0 interface 0 has no altsetting 0 [ 78.265188][ T10] usb 5-1: New USB device found, idVendor=1e7d, idProduct=3232, bcdDevice= 0.00 [ 78.270427][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 78.283332][ T10] usb 5-1: config 0 descriptor?? [ 79.286826][ T5319] loop0: detected capacity change from 0 to 32768 [ 79.401051][ T5319] ERROR: (device loop0): dtReadFirst: DT_GETPAGE: dtree page corrupt [ 79.401051][ T5319] [ 79.414761][ T5319] ERROR: (device loop0): remounting filesystem as read-only [ 79.426948][ T5319] jfs_readdir: unexpected rc = -5 from dtReadNext [ 79.524034][ T104] blkno = 8ed2c, nblocks = 1 [ 79.526847][ T104] ERROR: (device loop0): dbUpdatePMap: blocks are outside the map [ 79.526847][ T104] [ 79.550025][ T104] JFS: metapage_get_blocks failed [ 79.552533][ T104] ERROR: (device loop0): release_metapage: metapage_write_one() failed [ 79.552533][ T104] [ 79.576806][ T104] ================================================================== [ 79.580461][ T104] BUG: KASAN: slab-use-after-free in release_metapage+0x760/0xac0 [ 79.583530][ T104] Read of size 8 at addr ffff8880426dabc8 by task jfsCommit/104 [ 79.586684][ T104] [ 79.587782][ T104] CPU: 0 UID: 0 PID: 104 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) [ 79.587796][ T104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 79.587803][ T104] Call Trace: [ 79.587810][ T104] [ 79.587816][ T104] dump_stack_lvl+0x189/0x250 [ 79.587836][ T104] ? __virt_addr_valid+0x1c8/0x5c0 [ 79.587852][ T104] ? rcu_is_watching+0x15/0xb0 [ 79.587865][ T104] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.587879][ T104] ? rcu_is_watching+0x15/0xb0 [ 79.587891][ T104] ? lock_release+0x4b/0x3e0 [ 79.587901][ T104] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 79.587967][ T104] ? __virt_addr_valid+0x1c8/0x5c0 [ 79.587981][ T104] ? __virt_addr_valid+0x4a5/0x5c0 [ 79.587994][ T104] print_report+0xca/0x240 [ 79.588008][ T104] ? release_metapage+0x760/0xac0 [ 79.588022][ T104] kasan_report+0x118/0x150 [ 79.588036][ T104] ? rcu_is_watching+0x15/0xb0 [ 79.588048][ T104] ? release_metapage+0x760/0xac0 [ 79.588062][ T104] release_metapage+0x760/0xac0 [ 79.588075][ T104] ? folio_unlock+0x101/0x160 [ 79.588089][ T104] ? put_metapage+0x188/0x200 [ 79.588103][ T104] txUnlock+0x524/0xdf0 [ 79.588122][ T104] jfs_lazycommit+0x584/0xa90 [ 79.588133][ T104] ? __pfx_jfs_lazycommit+0x10/0x10 [ 79.588142][ T104] ? __pfx_default_wake_function+0x10/0x10 [ 79.588151][ T104] ? __kthread_parkme+0x7b/0x200 [ 79.588159][ T104] ? __kthread_parkme+0x1a1/0x200 [ 79.588167][ T104] kthread+0x711/0x8a0 [ 79.588176][ T104] ? __pfx_jfs_lazycommit+0x10/0x10 [ 79.588182][ T104] ? __pfx_kthread+0x10/0x10 [ 79.588191][ T104] ? _raw_spin_unlock_irq+0x23/0x50 [ 79.588199][ T104] ? lockdep_hardirqs_on+0x9c/0x150 [ 79.588207][ T104] ? __pfx_kthread+0x10/0x10 [ 79.588215][ T104] ret_from_fork+0x4bc/0x870 [ 79.588223][ T104] ? __pfx_ret_from_fork+0x10/0x10 [ 79.588235][ T104] ? __pfx_kthread+0x10/0x10 [ 79.588248][ T104] ret_from_fork_asm+0x1a/0x30 [ 79.588269][ T104] [ 79.588273][ T104] [ 79.673486][ T104] Allocated by task 5319: [ 79.675331][ T104] kasan_save_track+0x3e/0x80 [ 79.677271][ T104] __kasan_slab_alloc+0x6c/0x80 [ 79.679354][ T104] kmem_cache_alloc_noprof+0x367/0x6e0 [ 79.681648][ T104] mempool_alloc_noprof+0x1a7/0x510 [ 79.683794][ T104] __get_metapage+0x509/0xde0 [ 79.685882][ T104] dtSplitRoot+0x202/0x16c0 [ 79.688035][ T104] dtInsert+0xef8/0x5f40 [ 79.689914][ T104] jfs_rename+0x7bc/0x1610 [ 79.691791][ T104] vfs_rename+0xb34/0xe80 [ 79.693636][ T104] do_renameat2+0x6a2/0xa50 [ 79.695594][ T104] __x64_sys_rename+0x82/0x90 [ 79.697589][ T104] do_syscall_64+0xfa/0xfa0 [ 79.699577][ T104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.702081][ T104] [ 79.703168][ T104] Freed by task 73: [ 79.704970][ T104] kasan_save_track+0x3e/0x80 [ 79.707432][ T104] __kasan_save_free_info+0x46/0x50 [ 79.709784][ T104] __kasan_slab_free+0x5c/0x80 [ 79.711883][ T104] kmem_cache_free+0x19b/0x690 [ 79.714017][ T104] metapage_release_folio+0x40e/0x540 [ 79.716336][ T104] shrink_folio_list+0x20ac/0x4c70 [ 79.718746][ T104] evict_folios+0x471e/0x57c0 [ 79.720811][ T104] try_to_shrink_lruvec+0x8a3/0xb50 [ 79.722956][ T104] shrink_one+0x21b/0x7c0 [ 79.724843][ T104] shrink_node+0x315d/0x3780 [ 79.726882][ T104] kswapd+0x147c/0x2800 [ 79.728691][ T104] kthread+0x711/0x8a0 [ 79.730414][ T104] ret_from_fork+0x4bc/0x870 [ 79.732431][ T104] ret_from_fork_asm+0x1a/0x30 [ 79.734446][ T104] [ 79.735483][ T104] The buggy address belongs to the object at ffff8880426daba0 [ 79.735483][ T104] which belongs to the cache jfs_mp of size 184 [ 79.741595][ T104] The buggy address is located 40 bytes inside of [ 79.741595][ T104] freed 184-byte region [ffff8880426daba0, ffff8880426dac58) [ 79.747861][ T104] [ 79.749057][ T104] The buggy address belongs to the physical page: [ 79.751855][ T104] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x426da [ 79.755371][ T104] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 79.758327][ T104] page_type: f5(slab) [ 79.760133][ T104] raw: 04fff00000000000 ffff88803255db40 dead000000000122 0000000000000000 [ 79.763961][ T104] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 79.767791][ T104] page dumped because: kasan: bad access detected [ 79.770533][ T104] page_owner tracks the page as allocated [ 79.773002][ T104] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5319, tgid 5318 (syz.0.0), ts 79323343260, free_ts 79286078445 [ 79.781126][ T104] post_alloc_hook+0x240/0x2a0 [ 79.783750][ T104] get_page_from_freelist+0x2365/0x2440 [ 79.786500][ T104] __alloc_frozen_pages_noprof+0x181/0x370 [ 79.789438][ T104] alloc_pages_mpol+0x232/0x4a0 [ 79.791596][ T104] allocate_slab+0x96/0x350 [ 79.793517][ T104] ___slab_alloc+0xe94/0x18a0 [ 79.795376][ T104] __slab_alloc+0x65/0x100 [ 79.797279][ T104] kmem_cache_alloc_noprof+0x3f9/0x6e0 [ 79.799590][ T104] mempool_alloc_noprof+0x1a7/0x510 [ 79.801944][ T104] __get_metapage+0x509/0xde0 [ 79.804075][ T104] diReadSpecial+0x25b/0x710 [ 79.806527][ T104] jfs_mount+0x73/0x870 [ 79.808676][ T104] jfs_fill_super+0x6bc/0xd80 [ 79.810966][ T104] get_tree_bdev_flags+0x40e/0x4d0 [ 79.813115][ T104] vfs_get_tree+0x92/0x2b0 [ 79.815071][ T104] do_new_mount+0x302/0xa10 [ 79.817091][ T104] page last free pid 5319 tgid 5318 stack trace: [ 79.819755][ T104] __free_frozen_pages+0xbc4/0xd30 [ 79.821849][ T104] tlb_remove_table_rcu+0x85/0x100 [ 79.823911][ T104] rcu_core+0xcab/0x1770 [ 79.825672][ T104] handle_softirqs+0x286/0x870 [ 79.827704][ T104] __irq_exit_rcu+0xca/0x1f0 [ 79.829600][ T104] irq_exit_rcu+0x9/0x30 [ 79.831288][ T104] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 79.833664][ T104] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 79.836032][ T104] [ 79.836999][ T104] Memory state around the buggy address: [ 79.839352][ T104] ffff8880426daa80: fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb [ 79.842924][ T104] ffff8880426dab00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 79.846125][ T104] >ffff8880426dab80: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb [ 79.849938][ T104] ^ [ 79.852954][ T104] ffff8880426dac00: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc [ 79.856302][ T104] ffff8880426dac80: fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 79.859648][ T104] ================================================================== [ 79.884517][ T48] Bluetooth: hci0: command tx timeout [ 79.969718][ T104] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 79.972910][ T104] CPU: 0 UID: 0 PID: 104 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) [ 79.976446][ T104] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 79.981290][ T104] Call Trace: [ 79.982811][ T104] [ 79.984187][ T104] dump_stack_lvl+0x99/0x250 [ 79.986374][ T104] ? __asan_memcpy+0x40/0x70 [ 79.988328][ T104] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.990421][ T104] ? __pfx__printk+0x10/0x10 [ 79.992337][ T104] vpanic+0x237/0x6d0 [ 79.993951][ T104] ? __pfx_vpanic+0x10/0x10 [ 79.995919][ T104] ? preempt_schedule+0xae/0xc0 [ 79.998125][ T104] ? __pfx_preempt_schedule+0x10/0x10 [ 80.000383][ T104] panic+0xb9/0xc0 [ 80.002082][ T104] ? __pfx_panic+0x10/0x10 [ 80.004059][ T104] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 80.006606][ T104] ? is_module_address+0x17/0xf0 [ 80.008706][ T104] ? release_metapage+0x760/0xac0 [ 80.010735][ T104] check_panic_on_warn+0x89/0xb0 [ 80.012858][ T104] ? release_metapage+0x760/0xac0 [ 80.014976][ T104] end_report+0x78/0x160 [ 80.016825][ T104] kasan_report+0x129/0x150 [ 80.019694][ T104] ? rcu_is_watching+0x15/0xb0 [ 80.022637][ T104] ? release_metapage+0x760/0xac0 [ 80.025545][ T104] release_metapage+0x760/0xac0 [ 80.027821][ T104] ? folio_unlock+0x101/0x160 [ 80.029666][ T104] ? put_metapage+0x188/0x200 [ 80.031785][ T104] txUnlock+0x524/0xdf0 [ 80.033741][ T104] jfs_lazycommit+0x584/0xa90 [ 80.035854][ T104] ? __pfx_jfs_lazycommit+0x10/0x10 [ 80.038138][ T104] ? __pfx_default_wake_function+0x10/0x10 [ 80.040825][ T104] ? __kthread_parkme+0x7b/0x200 [ 80.043187][ T104] ? __kthread_parkme+0x1a1/0x200 [ 80.045502][ T104] kthread+0x711/0x8a0 [ 80.047159][ T104] ? __pfx_jfs_lazycommit+0x10/0x10 [ 80.049482][ T104] ? __pfx_kthread+0x10/0x10 [ 80.051680][ T104] ? _raw_spin_unlock_irq+0x23/0x50 [ 80.053982][ T104] ? lockdep_hardirqs_on+0x9c/0x150 [ 80.056250][ T104] ? __pfx_kthread+0x10/0x10 [ 80.058548][ T104] ret_from_fork+0x4bc/0x870 [ 80.060624][ T104] ? __pfx_ret_from_fork+0x10/0x10 [ 80.062946][ T104] ? __pfx_kthread+0x10/0x10 [ 80.064970][ T104] ret_from_fork_asm+0x1a/0x30 [ 80.067011][ T104] [ 80.068858][ T104] Kernel Offset: disabled [ 80.070793][ T104] Rebooting in 86400 seconds..