last executing test programs: 5.822362232s ago: executing program 2 (id=969): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[], 0xfffffdef}}, 0x0) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x0, 0x0, 0x0) 4.913582022s ago: executing program 2 (id=985): syz_usb_connect(0x0, 0x35, &(0x7f0000000d40)={{0x12, 0x1, 0x0, 0x4a, 0xa2, 0xff, 0x0, 0x1b3d, 0x1a4, 0x7f41, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x23, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xb5, 0x0, 0x1, 0xef, 0x1, 0x1, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x8, 0xb, "133c5c7a379f"}]}}]}}]}}]}}, 0x0) 3.494734021s ago: executing program 0 (id=1000): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) recvmmsg(0xffffffffffffffff, &(0x7f0000006a00), 0x0, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x0, &(0x7f0000000300)=0x20, 0x4) write$binfmt_misc(r3, &(0x7f0000000300)=ANY=[], 0x6) recvmmsg(r3, &(0x7f0000000600), 0x204083acb88ff8b, 0x0, 0x0) 3.277582055s ago: executing program 4 (id=1002): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12}) 2.667684169s ago: executing program 4 (id=1003): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d00)={0x38, r1, 0x19, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_BITS={0x4}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_0\x00'}]}]}, 0x38}}, 0x0) 2.481913567s ago: executing program 0 (id=1004): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB='&\x00\x00\x00\a'], 0xd) write$binfmt_misc(r0, &(0x7f0000000200)=ANY=[@ANYBLOB='\''], 0xd) 2.418777667s ago: executing program 4 (id=1005): unshare(0x80) unshare(0x80) 2.418636577s ago: executing program 4 (id=1006): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'hsr0\x00', @random="b5b3b2651f42"}) 2.346688728s ago: executing program 0 (id=1008): r0 = open(&(0x7f0000000080)='./bus\x00', 0x143142, 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x2) fallocate(r1, 0x0, 0x0, 0x0) 2.342910848s ago: executing program 4 (id=1009): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000014c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd12000000000000850000006d000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4e020f698393aa0f3881f9c24aa564f5199fad0093c59d66b5ece9f36c70d0f13905ea23c2262be4ac30f526fb8616a1847152f0f69c64c9f87f9793f50bb546040677b0c504b0080fb982c1e9400e693146cea484a415b76960300b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c29184ff7f0000cef809606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d858588d72ec29c48b45ef4adf634be763289d01aa27ae8b09e00b99ab20b0b8ed8fb7a68af2ad0000000000000006fa03c6468972089b302d7bf5a23cdcedb5e0125ebbcebdde510cb2364149215108333719acd97fa9e8828ee18e509ef3627cc675fcfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89131f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb07324ed2d1813335706719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a7aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996360a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b477632f32030916f89c6dad7603f2ba2a7909abd6faec2fed44da4928b30142ba11de6c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9bf7af4c0eb97fca585ee6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbfc8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57200000009700cf0b4b8bc229413300000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b6c4a000000002b435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9ec747097c9c9ab600830689da6b53b263339863297771429d1200000041bf4a00fca0493cf29b33dcc9ff99acd160afd1ffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde4a594290c2a5ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d164c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3ace0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa292601101b4326b51b8c2b7a30bcd703822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ecbbc55bf404e4e1f74b7eed82571be54c72d978d8906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd062c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91300bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458a35450804042b3eac10000b136345cf67c70d3ae6d5b8bc0d2e0efa3fb5aac518a75f9e7d7101d5e186c489b3a06dbce2ad1a764370c9a6ff963fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3dfb77ffe0f7f3ee9afe7befb89d277739901004c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea600000000000000099f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c90506000000000000001981c4238ecaee6f75cd0a6881bdb1cd93bc4cfcc144171d2d250c19a39c1517a8250df9"], 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r0}, 0xe) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000180)=@name={0x1e, 0x2, 0x0, {{0x42}, 0x1}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) close(r1) 2.110282705s ago: executing program 0 (id=1011): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd600a843500140600fe80000000000000e5000000", @ANYRES32=0x41424344], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000327000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000001c0)="b9740b00000f32ea0000000021000f019e6f750000b906030000b800500000ba000000000f300f0e0f01c466660f38305c311366baa10066b8001066efb805000000b9800000000f01d9f2ac", 0x4c}], 0x1, 0x0, 0x0, 0x0) r3 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x10, 0x0) landlock_restrict_self(r3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@ipv6_getroute={0x1c}, 0x1c}}, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x10) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x10840, &(0x7f0000000f00)={[{@iocharset={'iocharset', 0x3d, 'utf8'}}, {@shortname_winnt}, {@utf8no}, {@uni_xlate}, {@fat=@showexec}, {@fat=@flush}, {@shortname_win95}, {@numtail}, {@rodir}, {@utf8no}, {@shortname_mixed}, {@numtail}]}, 0x1, 0x26c, &(0x7f0000000340)="$eJzs3U9rU1kYB+A3bTpJC0OyGCgzDMwdZjOr0HaYfcrQgWECipKFriw2RWlqoYWCLtruit9Bv4Iu3QouxK1fQASpghvrqgshEm//JDWJjZpG7PNs+nLu++Ock17upYueXPl1eWlhZW1xd3cn8vlMZMtRjr1MFGMkRiO1FQDA92Sv0Yg3jdSw1wIAnA7vfwA4e3q9/zNbh2PnT39lAMCgfNHf/yMDWRIAMGAXL13+f7ZSmbuQJPmI5e316no1/Zlen12M61GPWkxFId5FNA6l9b//VeamkqaXxcgvb46k+c316mh7fjoKUeycn05SUW3mDvJjMbGffzYRtZiJQvzUOT/TMf9D/PlHy/ylKMTTq7ES9ViIZjbN5yJiYzpJ/jlXOZbPfegDAAAAAAAAAAAAAAAAAAAAAIBBKCWHiu3n36Tn95RK3a6n+dbzgcZ7nQ/U2Dx2vk42fskOd+8AAAAAAAAAAAAAAAAAAADwrVi7eWtpvl6vrfYqbjy592gnlwY+2dy7yOzP219qu2fP+Ml2caz48fcXdzpdykWu38/n84qxiGgdSfanfPjbACf9WsXjnWs//7U2+Xe3nsi2jtxubrWtp8uNlB3UB/66ENG1J9/3Ddla3D8oym8/6jm4lWqr48P+xU3eLc8/2Hj+6qSpHg+NxuggHkUAAAAAAAAAAAAAAAAAAHDmHf3T77BXAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADDc/T9//0WuWgbyXdt3hr2HgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4H0AAAD//7qXlSU=") 2.092734057s ago: executing program 3 (id=1012): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000780)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000017000000080003"], 0x64}}, 0x0) 1.978450615s ago: executing program 4 (id=1013): syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000010280)='./mnt\x00', 0x40004c0, &(0x7f0000000100)=ANY=[@ANYBLOB="00000000ffffffff6c03bb00007367", @ANYRESHEX=0x0, @ANYRESHEX], 0x1, 0x10212, &(0x7f00000102c0)="$eJzs3L9uW1UYAPBzaxoVWkqEGNg4EiA5ErGu7aSCskRUVQdIFdEyMji2Y7lN7Ch2nNAJBv48BBtMvAMPwMbSoW+AxIbEUiGBfO4NQhVDVUzcOL+fdO93z3dvvnOO5eW7ihyAc2s5/v5bFq6GF0MIlRDClRDSdVYeyUYRXg8hvBFCuPCPIyvzfyeWQggvhRCuTosXNbPy1nc/fvXp9798+Pa3P/xUyb/5+tf57RqYt7dCCHv7xfXRXhGHvSLeK/OtST/FvbVJGYsbe/fL8bCIR93tVOGodfJcK8Vmr3h+uH84msad3VZ7Gnv9nZTfHxQTjia9kzrpD+61DtK4091OsT8apth7UKzruIwPRuOiTqes91kqH8bjk1jku8fdYj/791NsD8Zlvqg77HSPp3FSxnK60Nl+9s/3rPioPzg8jpPuwag/HMT1Wj2v5asH7WureV5/r7na67R22te6jbVOa2ctVrsbo+HuSqz22u1YvXXjxkqs57VGLX8n3rr9SdztxOo0ftAfHI77u6OV2Kg112v1lfhmPd7Z3IpbH9+8ubl1N24OB/H2cBKbeaw3r683rjffjVt37sZG3sjt/1R9ccrzsWCyeS8A4OzR/wPz8Ez9/6Uir/9fHOe9/z3v+9e+8Z/4AgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnFuXf37/MF0sF+MLZf7lMvVqOc7Ke3/+i+yJmpVp3RDCxad8/ssshKVyjpPjhRDCRnn88cr/+xkAAADAInv0uPowS916cVqe94I4TUvpnF35fEb10mudmX2H0ouo12ZVrZLWN6udXg7lG6qZuDg9XZpVtadSOdXZAACA54NOAAAAABbak/+GDwAAACwe/T8AAAAsvtT/+/0/AAAAWGyPHlcfznsNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPzF3r2cIAwEAQCd9XcJotiOF0uwGUuwEDvymjq8iUQRRxARFaKI4T0YkklCdue4e5gFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALqu2s5X9f58V1r9pzm286l6AAAAgCeml0sv03E+mmVe8t2jtfv9zkE/IqqIGL75/bpEjHKMawwiYpFxmHy7eAAAAOiuerNb/noOAAAAAAAAAAAAAAAAAAAAwI1/7P/XODgAAAAAXtH/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABO7M7LCQAwCAPQfhbo/tMWQTcQvLwHCTkGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOizM+vUuFFv+hcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDZnWMbgAAgCqDnLKCyjyHUtjWLxgxETiVqQt5LLpf833wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+bR0ilrYuj6CrPM9+3Obp7l81Tw3+qv7tAbCzX4c2AAAhEAT/QwP0Xy0GQQcIZpLzZxcAALggem+0+s/FQwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFLtzaAUADAJRrKX7sP94FTw8DpMYvkAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAyBt93BOdUQkAQMm+uTwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgM8OHAgAAAAAAPm/NkJVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVUVduBAAAAAAADI/7URqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrADBwIAAAAAQP6vjVBVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWFHTgQAAAAAADyf22EqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqKuzAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24IAEAAAAQND/1+0IFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYKAAA//8ypRiS") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) fallocate(r1, 0x0, 0x0, 0x20000) syz_genetlink_get_family_id$nl80211(&(0x7f0000005e40), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) fallocate(r0, 0x8, 0x0, 0x2000) 1.978143235s ago: executing program 3 (id=1015): sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000080), 0xc, 0x0}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x20}, 0x20}}, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x5c9}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 1.863622763s ago: executing program 2 (id=1016): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000c00)) 1.755068289s ago: executing program 3 (id=1017): syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB='iocharset=cp865,utf8=1,utf8=0,utf8=1,iocharset=utf8,sys_immutable,uni_xlate=0,uni_xlate=1,uni_xlate=1,gid=', @ANYRESHEX, @ANYBLOB='A\x00'], 0x1, 0x193, &(0x7f0000000b00)="$eJzs281qE10YB/B/+vataV0kC1fiYpauQtMrMEgFMSAoWSgIim1AOlKwENCF7c6FN+HluNUrcdmFMNJOYz9IQEGb2Px+m3ngzB+ec2A+zsA8v/V6Z2t3b/hs+DnNRiNLd1LksJF2ljJ2EADgKjmsqnyrqqq6dpDVT6mqatYdAQB/m+c/ACyex0+ePuj1+5uPiqKZlB9Gg9GgPtbjvWFepcx21tPK9xy9IJyo63v3+5vrxbF2Ppb7J/n90eC/8/luWmlPznfrfHE+/3/WzuY30sqNyfmNifmV3F45k++kla8vs5syWznKnubfd4vi7sP+hfz14/MAAADgKugUP03cv3c608brfK/xy98HLuyvl3NzebZzB4BFtff23c6Lstx+M6/Fl7W60XnpZ3oxXtJ56ef3i9XMRRt/sGgkmYM2/qGiOV6xGd6UgEtxevXPuhMAAAAAAAAAAAAAAGCay/ivaNZzBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGDx/AgAAP//fVyNVw==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0x105042, 0x0) pwritev2(r0, &(0x7f0000000080)=[{&(0x7f0000000040)='T', 0xfffffe12}], 0xf, 0x0, 0x0, 0x0) 1.410588923s ago: executing program 2 (id=1018): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 916.666619ms ago: executing program 2 (id=1020): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0) connect$unix(r0, &(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000000)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK/file0\x00'}, 0x6e) 818.663443ms ago: executing program 2 (id=1021): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[], 0xfffffdef}}, 0x0) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x0, 0x0, 0x0) 784.735829ms ago: executing program 1 (id=1022): shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0xd000) mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x3) 700.007052ms ago: executing program 1 (id=1023): poll(0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$bt_hci(r0, 0x84, 0x0, &(0x7f0000001f00)=""/4062, &(0x7f00000004c0)=0x744) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)={{0x1, 0x1, 0x18}, '\x00'}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x3) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCGFLAGS1(r2, 0x80047458, &(0x7f00000019c0)) 583.00549ms ago: executing program 1 (id=1024): bpf$MAP_CREATE(0x0, &(0x7f00000000c0), 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={0x0}, 0x10) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) splice(r1, 0x0, r0, 0x0, 0x1, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) close_range(r0, 0xffffffffffffffff, 0x0) 582.00649ms ago: executing program 0 (id=1025): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) 398.671688ms ago: executing program 0 (id=1026): syz_usb_connect(0x0, 0x35, &(0x7f0000000d40)={{0x12, 0x1, 0x0, 0x4a, 0xa2, 0xff, 0x0, 0x1b3d, 0x1a4, 0x7f41, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x23, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xb5, 0x0, 0x1, 0xef, 0x1, 0x1, 0x0, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [@generic={0x8, 0xb, "133c5c7a379f"}]}}]}}]}}]}}, 0x0) 398.512759ms ago: executing program 1 (id=1027): sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000080), 0xc, 0x0}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x20}, 0x20}}, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x5c9}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 394.492659ms ago: executing program 3 (id=1028): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000540)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00'}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021740000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000004800038044000080080003400000000238000b80340001800a0001006c696d69740000002400028008000440000000010c00024000000000000000000c0001400000000000000009"], 0xf8}}, 0x0) 359.949454ms ago: executing program 1 (id=1029): r0 = io_uring_setup(0x113d, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x10, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000280)=[0xffffffffffffffff, 0x5]}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002700)=""/4096, 0x1000}], 0x0, 0xa}, 0x20) 238.670913ms ago: executing program 3 (id=1030): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f00000002c0)='./file0\x00', 0x2000480, &(0x7f0000000140), 0x1, 0x79b, &(0x7f0000000f80)="$eJzs3c1rXFUbAPDnTpKmSfu+iSBoXQUEDZROTI2tgouKCxEsFHRtGybTUDPJlMykNCFgiwhuBBUXgm669qPu3Pqx1T9CcCEtVdNixUWJ3MlMOm1m0kk6M0nJ7wc3c879yDnPnHvPPXfuZSaAPWsk/ZOJOBQRHyURQ9X5SUT0VVK9ESfW1ru9spxLpyRWV9/8M6msc2tlORd126QOVDNPRsSP70cczmwst7S4NDNZKOTnq/mx8uz5sdLi0pFzs5PT+en83LHxiYmjx184fqx9sf79y9LB6x+/9uw3J/5974mrH/6UxIk4WF1WH0e7jMRI9T3pS9/Ce7za7sJ2WLLTFWBb0kOzZ+0oj0MxFD2V1Lo7q/W5ga5XDwDogHcjYhUA2GMS538A2GNqnwPcWlnO1aad/USiu268EhH71+Kv3d9cW9JbvWe3v3IfdPBWcs+dkSQihttQ/khEfPHd21+lU3ToPiRAI5cuR8SZ4ZGN/X+y4ZmFrXpus4Wr/ZWXkftm6/+ge75Pxz8vNhr/ZdbHP9Fg/NPf4Njdjgcf/5lrbSimqXT893Lds2236+KvGu6p5v5XGfP1JWfPFfJp3/b/iBiNvv40P15ZtfFTUKM379xsVn79+O+vT975Mi0/fb27RuZab/+920xNlicfNu6aG5cjnuptFH+y3v5Jk/HvqRbLeP2lDz5vtiyNP423Nm2Mv7NWr0Q807D977ZlsunziWOV3WGstlM08O1vnw02K7++/dMpLb92LdANafsPbh7/cFL/vGZp62X8fGXoh2bLHhx/4/1/X/JWJb2vOu/iZLk8Px6xL3lj4/yjd7et5Wvrp/GPPt34+N9s/0+vCc+0GH/v9T++3n78nZXGP7Wl9t964urtmZ5m5bfW/hOV1Gh1Tiv9X6sVfJj3DgAAAAAAAAAAAAAAAAAAAAAAAABalYmIg5FksuvpTCabXfsN78djMFMolsqHzxYX5qai8lvZw9GXqX3V5VDd96GOV78Pv5Y/el/++Yh4LCI+7R+o5LO5YmFqp4MHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKoDTX7/P/V7/07XDgDomP3b3bCnvfUAALpn2+d/AOCRtbXz/0DH6gEAdI/rfwDYe1o+/5/pbD0AgO5x/Q8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAECHnTp5Mp1W/1lZzqX5qQuLCzPFC0em8qWZ7OxCLpsrzp/PTheL04V8NlecbfqPLq29FIrF8xMxt3BxrJwvlcdKi0unZ4sLc+XT52Ynp/On831diwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWldaXJqZLBTy8w+buDDY5n+4uxIDu6MauybRG7uiGs0Sv+6OajzKifpeYmCHeicAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA3e+/AAAA//8xrSpm") r0 = socket(0x10, 0x3, 0x0) bind$l2tp(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0xc0b, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x8}}]}, 0x38}}, 0x0) 130.6669ms ago: executing program 1 (id=1031): socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/profiling', 0x88102, 0x10a) write$cgroup_int(r0, &(0x7f0000000040)=0x2, 0xfdef) 0s ago: executing program 3 (id=1032): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) readv(r0, &(0x7f0000000200)=[{&(0x7f00000010c0)=""/171, 0xab}], 0x100000000000016a) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010000000000000000000200000008000100", @ANYRES32=r1], 0x1c}}, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): T1068] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 103.519312][ T1068] usb 4-1: USB disconnect, device number 12 [ 103.538816][ T3925] usb 5-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 64 [ 103.549581][ T1068] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 103.583148][ T1068] ftdi_sio 4-1:0.0: device disconnected [ 103.724232][ T3925] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 103.741152][ T3925] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.758929][ T3925] usb 5-1: Product: syz [ 103.769115][ T3925] usb 5-1: Manufacturer: syz [ 103.783081][ T3925] usb 5-1: SerialNumber: syz [ 103.823481][ T4564] ptrace attach of "./syz-executor exec"[3503] was attempted by "./syz-executor exec"[4564] [ 103.911983][ T4569] netlink: 4 bytes leftover after parsing attributes in process `syz.0.178'. [ 103.992419][ T4576] ptrace attach of "./syz-executor exec"[3503] was attempted by "./syz-executor exec"[4576] [ 104.154083][ T3925] cdc_ncm 5-1:1.0: bind() failure [ 104.162727][ T3925] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 104.185641][ T3925] cdc_ncm 5-1:1.1: bind() failure [ 104.234735][ T3925] usb 5-1: USB disconnect, device number 7 [ 104.349681][ T4590] loop1: detected capacity change from 0 to 512 [ 104.414028][ T4590] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 104.447898][ T4590] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 104.490015][ T4590] EXT4-fs (loop1): 1 truncate cleaned up [ 104.506213][ T4590] EXT4-fs (loop1): mounted filesystem without journal. Opts: init_itable,resuid=0x0000000000000000,stripe=0x0000000000000000,,errors=continue. Quota mode: none. [ 104.553337][ T4590] tipc: Started in network mode [ 104.573520][ T4590] tipc: Node identity aaaaaaaaaa2a, cluster identity 4711 [ 104.590790][ T4590] tipc: Enabled bearer , priority 0 [ 104.766145][ T4599] syz.4.189 uses obsolete (PF_INET,SOCK_PACKET) [ 105.184195][ T4608] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.193'. [ 105.243907][ T4514] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 105.283053][ T4600] loop2: detected capacity change from 0 to 32768 [ 105.367342][ T4600] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop2 scanned by syz.2.191 (4600) [ 105.400735][ T4600] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 105.424067][ T4600] BTRFS info (device loop2): using free space tree [ 105.430590][ T4600] BTRFS info (device loop2): has skinny extents [ 105.494533][ T4514] usb 2-1: Using ep0 maxpacket: 16 [ 105.605179][ T3553] tipc: Node number set to 8432298 [ 105.624603][ T4600] BTRFS info (device loop2): enabling ssd optimizations [ 105.828359][ T4514] usb 2-1: New USB device found, idVendor=0c45, idProduct=628f, bcdDevice=8d.0b [ 105.842220][ T4618] loop4: detected capacity change from 0 to 40427 [ 105.847738][ T4514] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.874251][ T4514] usb 2-1: Product: syz [ 105.878493][ T4514] usb 2-1: Manufacturer: syz [ 105.883087][ T4514] usb 2-1: SerialNumber: syz [ 105.898178][ T4514] usb 2-1: config 0 descriptor?? [ 105.903150][ T4618] F2FS-fs (loop4): Unrecognized mount option "smackfsroot=f2fs" or missing value [ 105.957625][ T4514] gspca_main: gspca_sn9c20x-2.14.0 probing 0c45:628f [ 106.169170][ T4514] gspca_sn9c20x: Write register 1000 failed -71 [ 106.185744][ T4514] gspca_sn9c20x: Device initialization failed [ 106.342374][ T4514] gspca_sn9c20x: probe of 2-1:0.0 failed with error -71 [ 106.354425][ T4514] usb 2-1: USB disconnect, device number 5 [ 106.377529][ T4657] netlink: 20 bytes leftover after parsing attributes in process `syz.2.203'. [ 106.459817][ T4657] EXT4-fs warning (device sda1): ext4_group_extend:1831: need to use ext2online to resize further [ 107.208053][ T4681] capability: warning: `syz.2.212' uses 32-bit capabilities (legacy support in use) [ 108.321250][ T4696] netlink: 20 bytes leftover after parsing attributes in process `syz.4.215'. [ 108.373551][ T4700] EXT4-fs warning (device sda1): ext4_group_extend:1831: need to use ext2online to resize further [ 108.563122][ T4707] kcapi: manufacturer command 0 unknown. [ 108.893187][ T3551] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 109.088765][ T4715] netlink: 'syz.1.222': attribute type 10 has an invalid length. [ 109.110710][ T4715] device geneve1 entered promiscuous mode [ 109.117402][ T4715] team0: Port device geneve1 added [ 109.474200][ T3551] usb 5-1: config 0 has an invalid interface number: 231 but max is 0 [ 109.487025][ T3551] usb 5-1: config 0 has an invalid interface number: 14 but max is 0 [ 109.513910][ T3551] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 109.524414][ T3551] usb 5-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 109.533447][ T3551] usb 5-1: config 0 has no interface number 0 [ 109.539826][ T3551] usb 5-1: config 0 has no interface number 1 [ 109.546073][ T3551] usb 5-1: too many endpoints for config 0 interface 14 altsetting 116: 78, using maximum allowed: 30 [ 109.557773][ T3551] usb 5-1: config 0 interface 14 altsetting 116 has 0 endpoint descriptors, different from the interface descriptor's value: 78 [ 109.921774][ T3551] usb 5-1: config 0 interface 231 has no altsetting 0 [ 109.932492][ T3551] usb 5-1: config 0 interface 14 has no altsetting 0 [ 109.939314][ T3551] usb 5-1: New USB device found, idVendor=0bda, idProduct=8173, bcdDevice=77.d1 [ 109.948455][ T3551] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 110.105264][ T3551] usb 5-1: config 0 descriptor?? [ 110.444226][ T3551] usb 5-1: string descriptor 0 read error: -71 [ 110.578195][ T3551] r8712u: register rtl8712_netdev_ops to netdev_ops [ 110.701955][ T3551] usb 5-1: r8712u: USB_SPEED_HIGH with 0 endpoints [ 110.851789][ T4758] process 'syz.1.234' launched './file1' with NULL argv: empty string added [ 110.860855][ T3551] usb 5-1: r8712u: Boot from EFUSE: Autoload Failed [ 110.964184][ T1068] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 111.037008][ T3551] usb 5-1: r8712u: MAC Address from efuse = 00:e0:4c:87:00:00 [ 111.044789][ T3551] usb 5-1: r8712u: Loading firmware from "rtlwifi/rtl8712u.bin" [ 111.055316][ T3551] r8712u: register rtl8712_netdev_ops to netdev_ops [ 111.061928][ T3551] usb 5-1: r8712u: USB_SPEED_HIGH with 0 endpoints [ 111.069668][ T4760] netlink: 'syz.0.235': attribute type 10 has an invalid length. [ 111.122803][ T4760] team0: Port device geneve1 added [ 111.129203][ T3551] usb 5-1: r8712u: Boot from EFUSE: Autoload Failed [ 111.239704][ T3551] usb 5-1: r8712u: MAC Address from efuse = 00:e0:4c:87:00:00 [ 111.302396][ T3551] usb 5-1: r8712u: Loading firmware from "rtlwifi/rtl8712u.bin" [ 111.462609][ T4773] autofs4:pid:4773:autofs_fill_super: called with bogus options [ 112.087128][ T3551] usb 5-1: USB disconnect, device number 8 [ 112.264009][ T1068] usb 3-1: New USB device found, idVendor=1d50, idProduct=606f, bcdDevice=14.d4 [ 112.273138][ T1068] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.314858][ T1068] usb 3-1: config 0 descriptor?? [ 112.383938][ T26] kauditd_printk_skb: 23 callbacks suppressed [ 112.384357][ T26] audit: type=1800 audit(1719603649.118:15): pid=4797 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.241" name="/" dev="fuse" ino=1 res=0 errno=0 [ 113.170446][ T1068] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 114.592682][ T3925] usb 3-1: USB disconnect, device number 5 [ 115.137944][ T4854] device syzkaller0 entered promiscuous mode [ 115.201339][ T4863] autofs4:pid:4863:autofs_fill_super: called with bogus options [ 117.482421][ T4647] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 117.646515][ T4926] netlink: 8 bytes leftover after parsing attributes in process `syz.1.263'. [ 119.086288][ T4647] usb 4-1: Using ep0 maxpacket: 32 [ 119.214138][ T4647] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.257854][ T4944] autofs4:pid:4944:autofs_fill_super: called with bogus options [ 119.320780][ T4647] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 119.436855][ T4647] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 119.511218][ T4647] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.551139][ T4647] usb 4-1: config 0 descriptor?? [ 119.619969][ T4647] hub 4-1:0.0: USB hub found [ 119.796808][ T4954] device lo entered promiscuous mode [ 119.824599][ T4647] hub 4-1:0.0: 1 port detected [ 119.829505][ T3551] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 120.734060][ T26] audit: type=1804 audit(1719603658.493:16): pid=4968 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.276" name="/root/syzkaller.Qqv6Uo/83/bus" dev="sda1" ino=1996 res=1 errno=0 [ 120.883808][ T3551] usb 1-1: Using ep0 maxpacket: 8 [ 120.958596][ T4974] netlink: 132 bytes leftover after parsing attributes in process `syz.1.278'. [ 121.153869][ T3551] usb 1-1: config 0 has an invalid interface number: 4 but max is 0 [ 121.162357][ T3551] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 121.895646][ T3551] usb 1-1: config 0 has no interface number 0 [ 121.901778][ T3551] usb 1-1: config 0 interface 4 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 121.933462][ T1068] usb 4-1: USB disconnect, device number 13 [ 121.943990][ T4647] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 122.043989][ T3551] usb 1-1: string descriptor 0 read error: -71 [ 122.050232][ T3551] usb 1-1: New USB device found, idVendor=03f0, idProduct=421d, bcdDevice= e.68 [ 122.093309][ T3551] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.118115][ T3551] usb 1-1: config 0 descriptor?? [ 122.144034][ T3551] usb 1-1: can't set config #0, error -71 [ 122.154073][ T3551] usb 1-1: USB disconnect, device number 7 [ 122.660330][ T5004] netlink: 8 bytes leftover after parsing attributes in process `syz.1.286'. [ 122.695128][ T4986] chnl_net:caif_netlink_parms(): no params data found [ 122.907399][ T3732] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.224926][ T4647] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 123.265913][ T3732] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.350219][ T5007] netlink: 24 bytes leftover after parsing attributes in process `syz.1.287'. [ 123.374803][ T3732] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.483571][ T4986] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.513440][ T4986] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.533265][ T4986] device bridge_slave_0 entered promiscuous mode [ 123.565990][ T4986] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.578534][ T4986] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.590445][ T4986] device bridge_slave_1 entered promiscuous mode [ 123.597281][ T3551] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 124.070847][ T3732] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 124.242129][ T3555] Bluetooth: hci5: command 0x0409 tx timeout [ 124.260403][ T5014] netlink: 132 bytes leftover after parsing attributes in process `syz.2.289'. [ 124.295937][ T4986] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 124.316590][ T4986] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 124.981740][ T4986] team0: Port device team_slave_0 added [ 125.016907][ T4647] usb 4-1: config 164 has an invalid descriptor of length 0, skipping remainder of the config [ 125.048013][ T4986] team0: Port device team_slave_1 added [ 125.080420][ T3551] usb 1-1: Using ep0 maxpacket: 8 [ 125.089856][ T5028] Zero length message leads to an empty skb [ 125.189126][ T4986] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 125.200405][ T4986] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 125.248166][ T3551] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 125.263663][ T5042] tmpfs: Unknown parameter 'usrquota' [ 125.269990][ T3551] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 125.281709][ T4647] usb 4-1: New USB device found, idVendor=048d, idProduct=9005, bcdDevice=40.3d [ 125.299953][ T4647] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.308427][ T4986] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 125.474434][ T3551] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 125.484653][ T4647] usb 4-1: Product: syz [ 125.488874][ T4647] usb 4-1: Manufacturer: syz [ 125.493971][ T3551] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 125.507253][ T5046] Device name cannot be null; rc = [-22] [ 125.541895][ T4986] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 125.561143][ T4986] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 125.593998][ T3551] usb 1-1: New USB device found, idVendor=28bd, idProduct=1903, bcdDevice= 0.00 [ 125.603038][ T3551] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.613853][ T4647] usb 4-1: can't set config #164, error -71 [ 125.622024][ T4647] usb 4-1: USB disconnect, device number 14 [ 125.630955][ T3551] usb 1-1: config 0 descriptor?? [ 125.645494][ T4986] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 125.656898][ T3551] usb 1-1: can't set config #0, error -71 [ 125.666119][ T3551] usb 1-1: USB disconnect, device number 8 [ 125.684696][ T5061] (syz.2.301,5061,0):ocfs2_parse_options:1459 ERROR: Invalid heartbeat mount options [ 125.744566][ T5061] (syz.2.301,5061,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 125.770853][ T5064] netlink: 132 bytes leftover after parsing attributes in process `syz.0.300'. [ 125.951553][ T4986] device hsr_slave_0 entered promiscuous mode [ 126.666283][ T4649] Bluetooth: hci5: command 0x041b tx timeout [ 126.675402][ T4986] device hsr_slave_1 entered promiscuous mode [ 126.730198][ T4986] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 126.740318][ T4986] Cannot create hsr debugfs directory [ 128.500710][ T4986] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 128.517732][ T4986] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 128.648933][ T5117] loop0: detected capacity change from 0 to 512 [ 128.658222][ T3732] device hsr_slave_0 left promiscuous mode [ 128.674519][ T3732] device hsr_slave_1 left promiscuous mode [ 128.691216][ T3732] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.719525][ T3732] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.750596][ T3732] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.790317][ T3732] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.809720][ T3732] device bridge_slave_1 left promiscuous mode [ 128.836398][ T3732] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.873027][ T3732] device bridge_slave_0 left promiscuous mode [ 128.900855][ T3732] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.930135][ T3732] device veth1_macvtap left promiscuous mode [ 128.949610][ T3732] device veth0_macvtap left promiscuous mode [ 128.982580][ T3732] device veth1_vlan left promiscuous mode [ 128.985562][ T1068] Bluetooth: hci5: command 0x040f tx timeout [ 129.007101][ T3732] device veth0_vlan left promiscuous mode [ 129.016666][ T1068] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 129.024999][ T5117] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 129.025580][ T1068] Bluetooth: hci0: Injecting HCI hardware error event [ 129.045499][ T3512] Bluetooth: hci0: hardware error 0x00 [ 129.118005][ T5117] EXT4-fs error (device loop0): __ext4_iget:4861: inode #11: block 1: comm syz.0.312: invalid block [ 129.154335][ T5117] EXT4-fs (loop0): Remounting filesystem read-only [ 129.160907][ T5117] EXT4-fs error (device loop0): ext4_orphan_get:1402: comm syz.0.312: couldn't read orphan inode 11 (err -117) [ 129.200189][ T5117] EXT4-fs (loop0): mounted filesystem without journal. Opts: noauto_da_alloc,errors=continue,max_dir_size_kb=0x0000000000000009,data_err=abort,errors=remount-ro,noinit_itable,mblk_io_submit,i_version,acl,. Quota mode: none. [ 130.206694][ T3732] team0 (unregistering): Port device team_slave_1 removed [ 130.261182][ T3732] team0 (unregistering): Port device team_slave_0 removed [ 130.310617][ T3732] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 130.362196][ T3732] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 130.520653][ T3732] bond0 (unregistering): Released all slaves [ 130.614150][ T4986] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 130.634601][ T5115] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 130.644021][ T5115] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 130.652317][ T5115] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 130.676479][ T4986] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 131.031418][ T4145] Bluetooth: hci5: command 0x0419 tx timeout [ 131.054876][ T5131] netlink: 132 bytes leftover after parsing attributes in process `syz.3.314'. [ 131.877540][ T4986] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.916372][ T5128] chnl_net:caif_netlink_parms(): no params data found [ 131.954433][ T4986] 8021q: adding VLAN 0 to HW filter on device team0 [ 131.972185][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 131.981872][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 132.211914][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 132.306388][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 132.462783][ T3554] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.469931][ T3554] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.701312][ T1375] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.707663][ T1375] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.756117][ T1068] Bluetooth: hci4: command 0x0409 tx timeout [ 132.880168][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 132.921970][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 132.968585][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 133.032174][ T3925] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.039280][ T3925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.104406][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 133.122232][ T26] audit: type=1326 audit(1719603670.883:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5149 comm="syz.3.317" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb6c491db99 code=0x0 [ 133.171606][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 133.214625][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 133.269845][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 133.313175][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 133.350490][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 133.386952][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 133.411946][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 133.442638][ T5157] delete_channel: no stack [ 133.475445][ T4986] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 133.511394][ T4986] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 133.547322][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 133.564595][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 133.572908][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 133.672409][ T5128] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.712205][ T5128] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.750668][ T5128] device bridge_slave_0 entered promiscuous mode [ 133.867323][ T5128] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.902141][ T5128] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.929663][ T5128] device bridge_slave_1 entered promiscuous mode [ 133.955493][ T5128] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 133.983701][ T5128] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 134.777809][ T5128] team0: Port device team_slave_0 added [ 134.854291][ T3554] Bluetooth: hci4: command 0x041b tx timeout [ 134.966060][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 134.973528][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 135.056279][ T5128] team0: Port device team_slave_1 added [ 135.190645][ T4986] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 135.778358][ T5128] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 135.813081][ T5128] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 136.098803][ T5128] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 136.563028][ T5128] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 136.609402][ T5128] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 136.764674][ T5128] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 136.776694][ T5199] netlink: 132 bytes leftover after parsing attributes in process `syz.1.323'. [ 136.838302][ T5128] device hsr_slave_0 entered promiscuous mode [ 136.854615][ T5128] device hsr_slave_1 entered promiscuous mode [ 136.866746][ T5128] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 136.883843][ T5128] Cannot create hsr debugfs directory [ 136.969394][ T3555] Bluetooth: hci4: command 0x040f tx timeout [ 137.044897][ T5227] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 137.100394][ T26] audit: type=1326 audit(1719603674.863:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5226 comm="syz.2.328" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f98e2e0fb99 code=0x0 [ 137.184378][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 137.193150][ T3554] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 137.254380][ T5233] delete_channel: no stack [ 137.282691][ T5128] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.318093][ T4986] device veth0_vlan entered promiscuous mode [ 137.364589][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 137.373243][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 137.394814][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 137.417785][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 137.459629][ T4986] device veth1_vlan entered promiscuous mode [ 137.495303][ T5128] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 137.915218][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 137.980156][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 138.102744][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 138.159533][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 138.211588][ T4986] device veth0_macvtap entered promiscuous mode [ 138.239987][ T4986] device veth1_macvtap entered promiscuous mode [ 138.329080][ T5128] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.519183][ T5128] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.534601][ T4986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 138.552517][ T4986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 138.571190][ T4986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 138.583631][ T4986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 138.596070][ T4986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 138.739270][ T4986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 138.842843][ T4986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 138.944901][ T4986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 139.014810][ T4145] Bluetooth: hci4: command 0x0419 tx timeout [ 139.075099][ T4986] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 139.237080][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 139.279474][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 139.344209][ T26] audit: type=1107 audit(1719603677.103:19): pid=5249 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ë' [ 139.357979][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 139.373826][ T26] audit: type=1326 audit(1719603677.123:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5247 comm="syz.1.332" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3135cc0b99 code=0x7ffc0000 [ 139.454255][ T26] audit: type=1326 audit(1719603677.123:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5247 comm="syz.1.332" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3135cc0b99 code=0x7ffc0000 [ 139.488660][ T4986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 139.530598][ T4986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 139.553850][ T26] audit: type=1326 audit(1719603677.123:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5247 comm="syz.1.332" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3135cc0b99 code=0x7ffc0000 [ 139.553885][ T5255] syz.1.335 (pid 5255) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 139.592260][ T4986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 139.615202][ T26] audit: type=1326 audit(1719603677.123:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5247 comm="syz.1.332" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3135cc0b99 code=0x7ffc0000 [ 139.623866][ T4986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 139.671813][ T5255] overlayfs: failed to create directory ./file0/work (errno: 13); mounting read-only [ 139.681866][ T26] audit: type=1326 audit(1719603677.123:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5247 comm="syz.1.332" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3135cc0b99 code=0x7ffc0000 [ 139.719913][ T4986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 139.740964][ T26] audit: type=1326 audit(1719603677.123:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5247 comm="syz.1.332" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3135cc0b99 code=0x7ffc0000 [ 139.770042][ T4986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 139.779911][ T4986] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 139.786899][ T26] audit: type=1326 audit(1719603677.213:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5247 comm="syz.1.332" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3135cc0b99 code=0x7ffc0000 [ 139.823769][ T4986] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 139.854826][ T4986] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 139.897136][ T4986] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.923188][ T26] audit: type=1326 audit(1719603677.213:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5247 comm="syz.1.332" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3135cc0b99 code=0x7ffc0000 [ 139.931476][ T4986] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.993884][ T4986] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.003030][ T4986] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.049025][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 140.058609][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 140.127100][ T26] audit: type=1326 audit(1719603677.223:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5247 comm="syz.1.332" exe="/root/syz-executor" sig=0 arch=c000003e syscall=264 compat=0 ip=0x7f3135cc0b99 code=0x7ffc0000 [ 140.569263][ T5128] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 140.597350][ T5128] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 140.654197][ T5128] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 140.664103][ T4693] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 140.688171][ T4693] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 140.744292][ T5128] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 140.788255][ T5253] loop2: detected capacity change from 0 to 40427 [ 140.821948][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 140.847665][ T3643] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 140.885366][ T3643] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 140.893111][ T5253] F2FS-fs (loop2): invalid crc value [ 140.940351][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 141.148501][ T5253] F2FS-fs (loop2): Found nat_bits in checkpoint [ 141.177413][ T5128] 8021q: adding VLAN 0 to HW filter on device bond0 [ 141.726452][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 141.744208][ T5271] loop4: detected capacity change from 0 to 256 [ 141.752604][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 141.834950][ T5271] exfat: Deprecated parameter 'utf8' [ 141.840251][ T5271] exfat: Deprecated parameter 'utf8' [ 141.876166][ T5128] 8021q: adding VLAN 0 to HW filter on device team0 [ 141.910241][ T5253] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 141.945849][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 141.969288][ T5271] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x14f16447, utbl_chksum : 0xe619d30d) [ 141.988986][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 141.998661][ T3555] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.005782][ T3555] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.061336][ T5253] attempt to access beyond end of device [ 142.061336][ T5253] loop2: rw=2049, want=45104, limit=40427 [ 142.081080][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 142.099922][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 142.110070][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 142.130146][ T3925] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.137261][ T3925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.180696][ T3925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 142.183952][ T1289] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 142.214973][ T4046] attempt to access beyond end of device [ 142.214973][ T4046] loop2: rw=2049, want=45112, limit=40427 [ 142.232247][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 142.251234][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 142.285696][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 142.320516][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 142.332334][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 142.357960][ T5128] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 142.376622][ T5128] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 142.393178][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 142.408375][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 142.419137][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 142.432078][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 142.442903][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 142.481880][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 142.619757][ T1289] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 142.653840][ T1289] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 142.677982][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 142.683804][ T1289] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 142.688786][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 142.713777][ T1289] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 142.716378][ T5128] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 142.750382][ T1289] usb 2-1: New USB device found, idVendor=044f, idProduct=b653, bcdDevice= 0.00 [ 142.790599][ T1289] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.801977][ T3732] device hsr_slave_0 left promiscuous mode [ 142.815549][ T3732] device hsr_slave_1 left promiscuous mode [ 142.823294][ T3732] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 142.824526][ T1289] usb 2-1: config 0 descriptor?? [ 142.838136][ T3732] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 142.851962][ T3732] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 142.869899][ T3732] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 142.887247][ T3732] device bridge_slave_1 left promiscuous mode [ 142.897139][ T3732] bridge0: port 2(bridge_slave_1) entered disabled state [ 142.909725][ T3732] device bridge_slave_0 left promiscuous mode [ 142.945469][ T3732] bridge0: port 1(bridge_slave_0) entered disabled state [ 142.984823][ T3732] device veth1_macvtap left promiscuous mode [ 142.990972][ T3732] device veth0_macvtap left promiscuous mode [ 143.043875][ T3732] device veth1_vlan left promiscuous mode [ 143.049683][ T3732] device veth0_vlan left promiscuous mode [ 143.332378][ T5280] overlayfs: filesystem on './file1' not supported [ 143.624720][ T3732] team0 (unregistering): Port device geneve1 removed [ 143.807220][ T1289] thrustmaster 0003:044F:B653.0002: unbalanced delimiter at end of report description [ 143.817731][ T1289] thrustmaster 0003:044F:B653.0002: parse failed [ 143.824126][ T1289] thrustmaster: probe of 0003:044F:B653.0002 failed with error -22 [ 143.834202][ T1289] usb 2-1: USB disconnect, device number 6 [ 144.118546][ T3732] team0 (unregistering): Port device team_slave_1 removed [ 144.146846][ T3732] team0 (unregistering): Port device team_slave_0 removed [ 144.197649][ T3732] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 144.236179][ T5289] loop4: detected capacity change from 0 to 8192 [ 144.254313][ T3732] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 144.522419][ T3732] bond0 (unregistering): Released all slaves [ 144.604027][ T4145] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 144.658396][ T4647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 144.675043][ T4647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 144.728413][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 144.767518][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 144.783137][ T5128] device veth0_vlan entered promiscuous mode [ 144.830829][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 144.843834][ T4145] usb 2-1: Using ep0 maxpacket: 16 [ 144.851169][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 144.871275][ T5128] device veth1_vlan entered promiscuous mode [ 144.896608][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 144.905382][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 144.929093][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 144.938819][ T1289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 144.954094][ T5128] device veth0_macvtap entered promiscuous mode [ 144.968194][ T5128] device veth1_macvtap entered promiscuous mode [ 144.970219][ T4145] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 33032, setting to 1024 [ 145.000211][ T4145] usb 2-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 145.020391][ T4145] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.037643][ T5128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 145.042194][ T4145] usb 2-1: config 0 descriptor?? [ 145.066599][ T5128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 145.082571][ T5128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 145.098227][ T5128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 145.117462][ T5128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 145.134002][ T5128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 145.151271][ T5128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 145.164572][ T5128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 145.185392][ T5128] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 145.193236][ T4647] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 145.209291][ T4647] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 145.213915][ T3925] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 145.219776][ T4647] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 145.233599][ T4647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 145.251085][ T5128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 145.263454][ T5128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 145.273708][ T5128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 145.287592][ T5128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 145.291668][ T5306] kvm [5305]: vcpu0, guest rIP: 0x1b4 disabled perfctr wrmsr: 0xc2 data 0xfffffc18 [ 145.304285][ T5128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 145.325319][ T5128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 145.353934][ T5128] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 145.367745][ T5306] kvm [5305]: vcpu0, guest rIP: 0x1b4 disabled perfctr wrmsr: 0x186 data 0xfffffc18 [ 145.381902][ T5128] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 145.394587][ T5306] kvm [5305]: vcpu0, guest rIP: 0x1b4 ignored wrmsr: 0x11e data 0xfffffc18 [ 145.407501][ T5128] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 145.419995][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 145.428988][ T5306] kvm [5305]: vcpu0, guest rIP: 0x1b4 disabled perfctr wrmsr: 0x187 data 0xfffffc18 [ 145.429613][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 145.450336][ T5128] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.461171][ T5128] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.463865][ T3925] usb 5-1: Using ep0 maxpacket: 16 [ 145.470368][ T5128] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.484867][ T5128] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.598846][ T5292] udc-core: couldn't find an available UDC or it's busy [ 145.613351][ T4692] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 145.621840][ T5292] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 145.624714][ T3925] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 145.649454][ T4692] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 145.654920][ T4145] hid (null): invalid report_count 983040256 [ 145.662869][ T4145] hid (null): unknown global tag 0xc [ 145.678319][ T3925] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 145.692720][ T4145] hid-generic 0003:0158:0100.0003: unknown main item tag 0x0 [ 145.713820][ T3925] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 145.726914][ T4145] hid-generic 0003:0158:0100.0003: invalid report_count 983040256 [ 145.739615][ T4145] hid-generic 0003:0158:0100.0003: item 0 4 1 9 parsing failed [ 145.750303][ T3925] usb 5-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 145.763454][ T4145] hid-generic: probe of 0003:0158:0100.0003 failed with error -22 [ 145.771486][ T3925] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.785261][ T3925] usb 5-1: config 0 descriptor?? [ 145.816935][ T3553] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 145.854086][ T5024] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 145.866787][ T3553] usb 2-1: USB disconnect, device number 7 [ 145.868176][ T5024] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 145.899184][ T4146] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 145.985322][ T5313] (syz.0.313,5313,0):ocfs2_parse_options:1459 ERROR: Invalid heartbeat mount options [ 146.015999][ T5313] (syz.0.313,5313,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 146.090719][ T5317] loop0: detected capacity change from 0 to 256 [ 146.124794][ T5317] exfat: Deprecated parameter 'utf8' [ 146.134607][ T5317] exfat: Deprecated parameter 'utf8' [ 146.144012][ T4145] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 146.209625][ T5317] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x14f16447, utbl_chksum : 0xe619d30d) [ 146.266563][ T3925] magicmouse 0003:05AC:0265.0004: unknown main item tag 0x0 [ 146.292739][ T3925] magicmouse 0003:05AC:0265.0004: unknown main item tag 0x0 [ 146.323217][ T3925] magicmouse 0003:05AC:0265.0004: hidraw0: USB HID v0.00 Device [HID 05ac:0265] on usb-dummy_hcd.4-1/input0 [ 146.471184][ T3925] usb 5-1: USB disconnect, device number 9 [ 146.514038][ T4145] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 146.559859][ T4145] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 146.585585][ T4145] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 146.613461][ T4145] usb 3-1: New USB device found, idVendor=048d, idProduct=ce50, bcdDevice= 0.00 [ 146.630721][ T4145] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.651560][ T4145] usb 3-1: config 0 descriptor?? [ 146.773819][ T5321] kvm: emulating exchange as write [ 147.141645][ T4145] asus 0003:048D:CE50.0005: unknown main item tag 0x0 [ 147.172815][ T4145] asus 0003:048D:CE50.0005: hidraw0: USB HID v0.00 Device [HID 048d:ce50] on usb-dummy_hcd.2-1/input0 [ 147.224753][ T4145] asus 0003:048D:CE50.0005: Asus input not registered [ 147.260545][ T4145] asus: probe of 0003:048D:CE50.0005 failed with error -12 [ 147.334236][ T5327] loop4: detected capacity change from 0 to 8192 [ 147.337304][ T4514] usb 3-1: USB disconnect, device number 6 [ 147.504614][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 147.504627][ T26] audit: type=1800 audit(1719603685.273:32): pid=5327 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.355" name="bus" dev="loop4" ino=1048668 res=0 errno=0 [ 147.950198][ T5336] overlayfs: filesystem on './file1' not supported [ 149.062414][ T5351] (syz.2.362,5351,1):ocfs2_parse_options:1459 ERROR: Invalid heartbeat mount options [ 149.092529][ T5351] (syz.2.362,5351,1):ocfs2_fill_super:1177 ERROR: status = -22 [ 150.569041][ T5365] loop0: detected capacity change from 0 to 8192 [ 150.698657][ T26] audit: type=1800 audit(1719603688.463:33): pid=5365 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.367" name="bus" dev="loop0" ino=1048673 res=0 errno=0 [ 151.232877][ T5374] loop0: detected capacity change from 0 to 256 [ 151.334809][ T5374] exfat: Deprecated parameter 'utf8' [ 151.350463][ T5374] exfat: Deprecated parameter 'utf8' [ 151.401286][ T5374] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x14f16447, utbl_chksum : 0xe619d30d) [ 151.660526][ T5390] loop3: detected capacity change from 0 to 256 [ 151.723084][ T5390] exfat: Deprecated parameter 'utf8' [ 151.749956][ T5390] exfat: Deprecated parameter 'utf8' [ 151.802275][ T5390] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x14f16447, utbl_chksum : 0xe619d30d) [ 153.163680][ T5400] overlayfs: filesystem on './file1' not supported [ 154.950408][ T26] audit: type=1326 audit(1719603692.713:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6c491db99 code=0x7ffc0000 [ 155.011897][ T26] audit: type=1326 audit(1719603692.713:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6c491db99 code=0x7ffc0000 [ 155.070773][ T26] audit: type=1326 audit(1719603692.713:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=121 compat=0 ip=0x7fb6c491db99 code=0x7ffc0000 [ 155.120410][ T26] audit: type=1326 audit(1719603692.713:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6c491db99 code=0x7ffc0000 [ 155.172464][ T26] audit: type=1326 audit(1719603692.713:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6c491db99 code=0x7ffc0000 [ 155.203857][ T4647] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 155.232388][ T26] audit: type=1326 audit(1719603692.723:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=312 compat=0 ip=0x7fb6c491db99 code=0x7ffc0000 [ 155.263826][ T3925] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 155.311949][ T26] audit: type=1326 audit(1719603692.723:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6c491db99 code=0x7ffc0000 [ 155.361616][ T26] audit: type=1326 audit(1719603692.723:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb6c491db99 code=0x7ffc0000 [ 155.419922][ T26] audit: type=1326 audit(1719603692.723:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb6c491c5d0 code=0x7ffc0000 [ 155.482487][ T26] audit: type=1326 audit(1719603692.723:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5418 comm="syz.3.386" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fb6c491d79b code=0x7ffc0000 [ 155.624033][ T4647] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 155.641015][ T4647] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 155.669322][ T4647] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 155.674111][ T3925] usb 4-1: config index 0 descriptor too short (expected 58, got 29) [ 155.709060][ T4647] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 155.709081][ T3925] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 155.763434][ T3925] usb 4-1: config 0 descriptor has 1 excess byte, ignoring [ 155.773834][ T4647] usb 1-1: New USB device found, idVendor=044f, idProduct=b653, bcdDevice= 0.00 [ 155.783148][ T3925] usb 4-1: config 0 has no interface number 0 [ 155.791415][ T4647] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.829821][ T4647] usb 1-1: config 0 descriptor?? [ 155.959350][ T3925] usb 4-1: New USB device found, idVendor=1164, idProduct=2edc, bcdDevice=62.de [ 155.985026][ T3925] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.002858][ T3925] usb 4-1: Product: syz [ 156.018197][ T3925] usb 4-1: Manufacturer: syz [ 156.033812][ T3925] usb 4-1: SerialNumber: syz [ 156.063207][ T3925] usb 4-1: config 0 descriptor?? [ 156.332849][ T4647] thrustmaster 0003:044F:B653.0006: unbalanced delimiter at end of report description [ 156.344052][ T3925] dvb-usb: found a 'Yuan PD378S' in warm state. [ 156.362947][ T3925] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 156.379613][ T4647] thrustmaster 0003:044F:B653.0006: parse failed [ 156.397169][ T4647] thrustmaster: probe of 0003:044F:B653.0006 failed with error -22 [ 156.415363][ T3925] dvbdev: DVB: registering new adapter (Yuan PD378S) [ 156.433663][ T3925] usb 4-1: media controller created [ 156.477888][ T3925] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 156.507620][ T5436] loop1: detected capacity change from 0 to 8192 [ 156.553138][ T4647] usb 1-1: USB disconnect, device number 9 [ 156.564091][ T3925] DVB: Unable to find symbol dib7000p_attach() [ 156.570365][ T3925] dvb-usb: no frontend was attached by 'Yuan PD378S' [ 156.653863][ T3925] rc_core: IR keymap rc-dib0700-rc5 not found [ 156.659964][ T3925] Registered IR keymap rc-empty [ 156.685429][ T3925] dvb-usb: could not initialize remote control. [ 156.691684][ T3925] dvb-usb: Yuan PD378S successfully initialized and connected. [ 156.788977][ T1068] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 156.975301][ T3925] usb 4-1: USB disconnect, device number 15 [ 157.025158][ T3925] dvb-usb: Yuan PD378S successfully deinitialized and disconnected. [ 157.053835][ T1068] usb 5-1: Using ep0 maxpacket: 8 [ 157.174079][ T1068] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 157.288100][ T4647] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 157.344023][ T1068] usb 5-1: New USB device found, idVendor=05ac, idProduct=0252, bcdDevice= 0.40 [ 157.353158][ T1068] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.373821][ T1068] usb 5-1: Product: syz [ 157.378101][ T1068] usb 5-1: Manufacturer: syz [ 157.391882][ T1068] usb 5-1: SerialNumber: syz [ 157.439064][ T1068] usbhid 5-1:1.0: couldn't find an input interrupt endpoint [ 157.543910][ T3925] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 157.543924][ T4647] usb 2-1: Using ep0 maxpacket: 32 [ 157.683870][ T4647] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 157.692379][ T4647] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 157.723783][ T4647] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 157.732850][ T4647] usb 2-1: config 1 has no interface number 0 [ 157.739340][ T4647] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 157.760350][ T4647] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 17669, setting to 1024 [ 157.772653][ T4647] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 157.796962][ T3925] usb 1-1: Using ep0 maxpacket: 8 [ 157.803293][ T4647] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 157.812674][ T4647] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.854167][ T5446] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 157.876613][ T4647] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 157.915004][ T3925] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 157.937033][ T3925] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 157.954982][ T3925] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 157.969269][ T3925] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 157.982351][ T3925] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 157.998142][ T3925] usb 1-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 158.009111][ T3925] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 230, changing to 7 [ 158.043472][ T1289] usb 5-1: USB disconnect, device number 10 [ 158.076905][ T5446] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 158.094836][ T4647] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached [ 158.263994][ T3925] usb 1-1: string descriptor 0 read error: -22 [ 158.270333][ T3925] usb 1-1: New USB device found, idVendor=0fe9, idProduct=db58, bcdDevice=e9.9b [ 158.285137][ T3925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.306224][ T3925] usb 1-1: config 0 descriptor?? [ 158.311593][ T4146] usb 2-1: USB disconnect, device number 8 [ 158.331995][ T4146] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 158.347716][ T3925] dvb-usb: found a 'DViCO FusionHDTV DVB-T Dual Digital 2' in cold state, will try to load a firmware [ 158.374152][ T3925] usb 1-1: Direct firmware load for dvb-usb-bluebird-01.fw failed with error -2 [ 158.393613][ T3925] usb 1-1: Falling back to sysfs fallback for: dvb-usb-bluebird-01.fw [ 158.554170][ T5448] udc-core: couldn't find an available UDC or it's busy [ 158.577658][ T5448] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 158.703351][ T5484] serio: Serial port pts0 [ 159.202948][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 161.539076][ T5543] usb usb8: usbfs: process 5543 (syz.4.427) did not claim interface 0 before use [ 161.603824][ T3553] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 161.956945][ T5561] loop4: detected capacity change from 0 to 2048 [ 162.044046][ T3553] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 162.061367][ T3553] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.072714][ T5561] EXT4-fs (loop4): mounted filesystem without journal. Opts: quota,dioread_lock,,errors=continue. Quota mode: writeback. [ 162.106246][ T5561] ext4 filesystem being mounted at /root/syzkaller.SRVMZz/22/file1 supports timestamps until 2038 (0x7fffffff) [ 162.137788][ T3553] usb 3-1: config 0 descriptor?? [ 162.214701][ T3553] cp210x 3-1:0.0: cp210x converter detected [ 162.418045][ T3553] usb 3-1: cp210x converter now attached to ttyUSB0 [ 162.644958][ T5537] udc-core: couldn't find an available UDC or it's busy [ 162.681664][ T5537] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 162.718502][ T4145] usb 3-1: USB disconnect, device number 7 [ 162.762158][ T4145] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 162.795767][ T4145] cp210x 3-1:0.0: device disconnected [ 164.638727][ T26] kauditd_printk_skb: 35 callbacks suppressed [ 164.638740][ T26] audit: type=1800 audit(1719603702.403:79): pid=5650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.464" name="bus" dev="sda1" ino=2007 res=0 errno=0 [ 164.788685][ T5660] input: syz0 as /devices/virtual/input/input11 [ 165.113952][ T4145] usb 5-1: new low-speed USB device number 11 using dummy_hcd [ 165.325315][ T4692] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.470964][ T4692] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.481469][ T4145] usb 5-1: config index 0 descriptor too short (expected 1307, got 27) [ 165.490242][ T4145] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 165.503105][ T4145] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 165.513799][ T4145] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 165.606740][ T4692] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.660624][ T4692] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.697273][ T5678] chnl_net:caif_netlink_parms(): no params data found [ 165.770552][ T4145] usb 5-1: string descriptor 0 read error: -22 [ 165.792854][ T4145] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 165.819349][ T4145] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.890051][ T4145] usb 5-1: config 0 descriptor?? [ 165.930770][ T5678] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.934088][ T5664] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 165.949470][ T5678] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.973829][ T5678] device bridge_slave_0 entered promiscuous mode [ 165.982661][ T5678] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.991008][ T5678] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.994683][ T4145] hub 5-1:0.0: bad descriptor, ignoring hub [ 165.999164][ T5678] device bridge_slave_1 entered promiscuous mode [ 166.022996][ T4145] hub: probe of 5-1:0.0 failed with error -5 [ 166.050110][ T5678] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 166.061880][ T5678] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 166.078782][ T4145] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input12 [ 166.159743][ T5678] team0: Port device team_slave_0 added [ 166.190029][ T5678] team0: Port device team_slave_1 added [ 166.253147][ T5678] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 166.260626][ T5678] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 166.292498][ T5678] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 166.313139][ T5678] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 166.328591][ T5678] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 166.328905][ T4145] usb 5-1: USB disconnect, device number 11 [ 166.364680][ T5678] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 166.460836][ T5678] device hsr_slave_0 entered promiscuous mode [ 166.471454][ T5678] device hsr_slave_1 entered promiscuous mode [ 166.482699][ T5678] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 166.493977][ T5678] Cannot create hsr debugfs directory [ 166.642772][ T5741] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 166.772411][ T5746] device lo left promiscuous mode [ 166.801194][ T5746] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 166.812490][ T5746] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 166.831122][ T5746] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 167.099943][ T4692] device hsr_slave_0 left promiscuous mode [ 167.121029][ T4692] device hsr_slave_1 left promiscuous mode [ 167.131576][ T4692] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 167.162742][ T4692] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 167.188997][ T4692] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 167.197008][ T4692] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 167.213058][ T4692] device bridge_slave_1 left promiscuous mode [ 167.219731][ T4692] bridge0: port 2(bridge_slave_1) entered disabled state [ 167.235001][ T4692] device bridge_slave_0 left promiscuous mode [ 167.241679][ T4692] bridge0: port 1(bridge_slave_0) entered disabled state [ 167.253942][ T1068] Bluetooth: hci1: command 0x0409 tx timeout [ 167.260859][ T4692] device veth1_macvtap left promiscuous mode [ 167.269386][ T4692] device veth0_macvtap left promiscuous mode [ 167.280628][ T4692] device veth1_vlan left promiscuous mode [ 167.286986][ T4692] device veth0_vlan left promiscuous mode [ 167.560996][ T5768] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 167.745064][ T5774] ./file0: Can't open blockdev [ 167.771111][ T4692] team0 (unregistering): Port device team_slave_1 removed [ 167.801362][ T4692] team0 (unregistering): Port device team_slave_0 removed [ 167.840878][ T4692] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 167.875898][ T4692] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 168.082889][ C0] TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 168.098641][ T4692] bond0 (unregistering): Released all slaves [ 168.341199][ T5678] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 168.420553][ T5678] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 168.461473][ T5678] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 168.502092][ T5678] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 168.853064][ T5678] 8021q: adding VLAN 0 to HW filter on device bond0 [ 168.912446][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 168.932335][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 168.982986][ C0] TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 168.988831][ T5678] 8021q: adding VLAN 0 to HW filter on device team0 [ 169.069743][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 169.084579][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 169.127452][ T4145] bridge0: port 1(bridge_slave_0) entered blocking state [ 169.134579][ T4145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 169.225481][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 169.249637][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 169.298626][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 169.338025][ T4145] bridge0: port 2(bridge_slave_1) entered blocking state [ 169.345154][ T4145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 169.368420][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 169.392858][ T3555] Bluetooth: hci1: command 0x041b tx timeout [ 169.411251][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 169.429661][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 169.460342][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 169.502345][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 169.533609][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 169.603713][ T5678] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 169.673828][ T5678] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 169.730662][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 169.744765][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 169.789549][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 169.820129][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 169.862013][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 169.917662][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 170.302343][ T5678] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 170.484639][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 170.492087][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 170.513974][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 171.240383][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 171.249080][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 171.257284][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 171.270537][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 171.278397][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 171.292624][ T5678] device veth0_vlan entered promiscuous mode [ 171.354867][ T5678] device veth1_vlan entered promiscuous mode [ 171.413957][ T3555] Bluetooth: hci1: command 0x040f tx timeout [ 171.442024][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 171.466042][ T5896] tmpfs: Unknown parameter 'usrquota' [ 171.476468][ T3555] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 171.486161][ T5678] device veth0_macvtap entered promiscuous mode [ 171.534518][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 171.545826][ T5678] device veth1_macvtap entered promiscuous mode [ 171.617847][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.643773][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.673781][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.809027][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 171.837420][ T4646] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 171.859972][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 171.898064][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.012457][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 172.190522][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.244463][ T4646] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 172.318998][ T4646] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 172.415711][ T5678] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 172.562305][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 172.582191][ T4646] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 172.603919][ T4646] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 172.612014][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.623592][ T4646] usb 2-1: SerialNumber: syz [ 172.642481][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 172.679232][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.700278][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 172.719787][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.738587][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 172.758051][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 172.875942][ T5678] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 172.887830][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 172.919443][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 172.946650][ T4646] usb 2-1: 0:2 : does not exist [ 172.966875][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 172.982457][ T4646] usb 2-1: USB disconnect, device number 9 [ 172.999009][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 173.021293][ T5908] netlink: 'syz.4.537': attribute type 10 has an invalid length. [ 173.141406][ T5908] team0: Port device wlan1 added [ 173.163512][ T5678] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.192857][ T5678] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.202269][ T5908] syz.4.537 (5908) used greatest stack depth: 18784 bytes left [ 173.234870][ T5678] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.243575][ T5678] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 173.439391][ T3732] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 173.483840][ T3732] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 173.498251][ T23] Bluetooth: hci1: command 0x0419 tx timeout [ 173.676905][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 173.714846][ T4693] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 173.745649][ T4693] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 173.854647][ T1068] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 174.532434][ T5932] netlink: 28 bytes leftover after parsing attributes in process `syz.3.546'. [ 174.604367][ T5935] netlink: 8 bytes leftover after parsing attributes in process `syz.4.540'. [ 175.310807][ T4646] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 175.574285][ T4145] Bluetooth: hci2: command 0x0406 tx timeout [ 175.618907][ T4646] usb 5-1: Using ep0 maxpacket: 16 [ 175.661481][ T4649] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 175.784067][ T4646] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 33032, setting to 1024 [ 175.798349][ T4646] usb 5-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 175.822759][ T4646] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.845157][ T4646] usb 5-1: config 0 descriptor?? [ 175.934297][ T5953] misc userio: Begin command sent, but we're already running [ 176.049671][ T4649] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 176.075427][ T4649] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 176.110212][ T5941] udc-core: couldn't find an available UDC or it's busy [ 176.120805][ T5941] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 176.179201][ T4649] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 176.192354][ T4649] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 176.207453][ T4649] usb 4-1: SerialNumber: syz [ 176.227858][ T5956] device tunl0 entered promiscuous mode [ 176.235911][ T5956] netlink: 'syz.2.553': attribute type 2 has an invalid length. [ 176.360000][ T5941] udc-core: couldn't find an available UDC or it's busy [ 176.372669][ T5941] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 176.417459][ T4646] hid (null): invalid report_size 25705 [ 176.428926][ T4646] hid (null): unknown global tag 0xd [ 176.450849][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.484228][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.501770][ T4649] usb 4-1: 0:2 : does not exist [ 176.516777][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.533478][ T4649] usb 4-1: USB disconnect, device number 16 [ 176.570519][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x4 [ 176.619030][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.647511][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.671355][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.686535][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.700688][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.711215][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.722713][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.733269][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.744373][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.751859][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.772068][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.792240][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.808224][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.823826][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.856823][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.872841][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.893822][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.909725][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.924599][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.940692][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.956798][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 176.995660][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.011610][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.029479][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.047563][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.063769][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.081704][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.091816][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.122133][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.162850][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.185194][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.213774][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.240204][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.257545][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.269247][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.436602][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.444079][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.451470][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.459621][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.467084][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.474710][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.482466][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.489903][ T4646] hid-generic 0003:0158:0100.0007: unknown main item tag 0x0 [ 177.503773][ T4646] hid-generic 0003:0158:0100.0007: invalid report_size 25705 [ 178.216866][ T4646] hid-generic 0003:0158:0100.0007: item 0 2 1 7 parsing failed [ 178.224939][ T4646] hid-generic: probe of 0003:0158:0100.0007 failed with error -22 [ 178.234888][ T4646] usb 5-1: USB disconnect, device number 12 [ 179.296891][ T5993] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 179.441120][ T5998] netlink: 64 bytes leftover after parsing attributes in process `syz.3.562'. [ 179.463825][ T3555] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 179.667078][ T4145] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 179.727322][ T3555] usb 5-1: Using ep0 maxpacket: 16 [ 179.844140][ T3555] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 179.913882][ T4145] usb 2-1: Using ep0 maxpacket: 16 [ 180.023893][ T3555] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 180.033083][ T3555] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.042498][ T4145] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 33032, setting to 1024 [ 180.053769][ T3555] usb 5-1: Product: syz [ 180.057949][ T3555] usb 5-1: Manufacturer: syz [ 180.062537][ T3555] usb 5-1: SerialNumber: syz [ 180.067483][ T4145] usb 2-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 180.077308][ T4145] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 180.086359][ T3555] usb 5-1: config 0 descriptor?? [ 180.101984][ T4145] usb 2-1: config 0 descriptor?? [ 180.126180][ T3555] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 180.136807][ T3555] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 180.144997][ T3553] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 180.444122][ T4646] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 180.534365][ T3553] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 180.559747][ T3553] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 180.594740][ T5991] udc-core: couldn't find an available UDC or it's busy [ 180.610999][ T5991] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 180.677494][ T5997] udc-core: couldn't find an available UDC or it's busy [ 180.724937][ T3553] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 180.756222][ T5997] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 180.780047][ T3553] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 180.861374][ T3553] usb 4-1: SerialNumber: syz [ 181.054450][ T4646] usb 3-1: New USB device found, idVendor=07ca, idProduct=a801, bcdDevice=b7.a7 [ 181.117630][ T4646] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 181.132183][ T4145] hid-generic 0003:0158:0100.0008: unknown main item tag 0x1 [ 181.138905][ T4646] usb 3-1: Product: syz [ 181.139781][ T4145] hid-generic 0003:0158:0100.0008: unexpected long global item [ 181.156571][ T4646] usb 3-1: Manufacturer: syz [ 181.161339][ T4646] usb 3-1: SerialNumber: syz [ 181.168945][ T4145] hid-generic: probe of 0003:0158:0100.0008 failed with error -22 [ 181.179754][ T4145] usb 2-1: USB disconnect, device number 10 [ 181.287320][ T4646] usb 3-1: config 0 descriptor?? [ 181.309573][ T3553] usb 4-1: 0:2 : does not exist [ 181.335807][ T4646] dvb-usb: found a 'AVerMedia AverTV DVB-T USB 2.0 (A800)' in warm state. [ 181.355486][ T3553] usb 4-1: USB disconnect, device number 17 [ 181.369265][ T4646] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 181.385451][ T3555] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 181.404168][ T4646] dvbdev: DVB: registering new adapter (AVerMedia AverTV DVB-T USB 2.0 (A800)) [ 181.405728][ T3582] udevd[3582]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 181.415241][ T4646] usb 3-1: media controller created [ 181.472290][ T4646] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 181.490903][ T4646] dvb-usb: bulk message failed: -22 (6/0) [ 181.497346][ T4646] dvb-usb: bulk message failed: -22 (6/0) [ 181.507250][ T4646] dvb-usb: no frontend was attached by 'AVerMedia AverTV DVB-T USB 2.0 (A800)' [ 181.654023][ T4646] rc_core: IR keymap rc-avermedia-m135a not found [ 181.670731][ T4646] Registered IR keymap rc-empty [ 181.687693][ T4646] rc rc0: AVerMedia AverTV DVB-T USB 2.0 (A800) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 181.705758][ T4646] input: AVerMedia AverTV DVB-T USB 2.0 (A800) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input13 [ 181.734411][ T4646] dvb-usb: schedule remote query interval to 150 msecs. [ 181.750632][ T4646] dvb-usb: AVerMedia AverTV DVB-T USB 2.0 (A800) successfully initialized and connected. [ 181.843287][ T4646] usb 3-1: USB disconnect, device number 8 [ 182.448173][ T4646] dvb-usb: AVerMedia AverTV DVB-T USB 2.0 (A800) successfully deinitialized and disconnected. [ 182.604523][ T3555] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 182.613029][ T3555] em28xx 5-1:0.0: board has no eeprom [ 182.733861][ T3555] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 182.736901][ T4649] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 182.749820][ T3555] em28xx 5-1:0.0: dvb set to bulk mode. [ 182.771366][ T1068] em28xx 5-1:0.0: Binding DVB extension [ 182.804746][ T3555] usb 5-1: USB disconnect, device number 13 [ 182.835522][ T3555] em28xx 5-1:0.0: Disconnecting em28xx [ 182.868451][ T1068] em28xx 5-1:0.0: Registering input extension [ 182.878412][ T3555] em28xx 5-1:0.0: Closing input extension [ 182.987068][ T3555] em28xx 5-1:0.0: Freeing device [ 183.502171][ T4649] usb 2-1: Using ep0 maxpacket: 8 [ 183.614200][ T4647] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 183.662605][ T4649] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 183.675786][ T4649] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 183.693809][ T4649] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 183.719262][ T4649] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 183.748464][ T4649] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 183.778395][ T4649] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 183.792200][ T4649] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.901524][ T26] audit: type=1800 audit(1719603721.663:80): pid=6067 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.587" name="file1" dev="sda1" ino=2018 res=0 errno=0 [ 184.064654][ T4649] usb 2-1: usb_control_msg returned -32 [ 184.071965][ T4649] usbtmc 2-1:16.0: can't read capabilities [ 184.244453][ T4647] usb 3-1: New USB device found, idVendor=0644, idProduct=800f, bcdDevice=8f.45 [ 184.345127][ T4647] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 184.467662][ T4647] usb 3-1: Product: syz [ 184.484027][ T6068] usbtmc 2-1:16.0: usb_control_msg returned -32 [ 184.490649][ T4647] usb 3-1: Manufacturer: syz [ 184.511247][ T4647] usb 3-1: SerialNumber: syz [ 184.553268][ T4647] usb 3-1: config 0 descriptor?? [ 184.578416][ T4649] usb 2-1: USB disconnect, device number 11 [ 185.034555][ T4649] usb 3-1: USB disconnect, device number 9 [ 185.610987][ T6074] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 185.617623][ T6074] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 185.629611][ T6074] vhci_hcd vhci_hcd.0: Device attached [ 185.638119][ T6080] vhci_hcd: cannot find the pending unlink 2147483648 [ 185.718708][ T6080] vhci_hcd: connection closed [ 185.718964][ T3732] vhci_hcd: stop threads [ 185.730062][ T3732] vhci_hcd: release socket [ 185.764629][ T3732] vhci_hcd: disconnect device [ 185.934688][ T3555] vhci_hcd: vhci_device speed not set [ 187.143845][ T4647] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 187.713965][ T4647] usb 4-1: New USB device found, idVendor=0644, idProduct=800f, bcdDevice=8f.45 [ 187.723262][ T4647] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.753816][ T4647] usb 4-1: Product: syz [ 187.771818][ T4647] usb 4-1: Manufacturer: syz [ 187.781949][ T4647] usb 4-1: SerialNumber: syz [ 187.810774][ T4647] usb 4-1: config 0 descriptor?? [ 188.183821][ T4647] usb 4-1: USB disconnect, device number 18 [ 193.985592][ T1375] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.992236][ T1375] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.249859][ T4146] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 194.483877][ T4647] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 194.645241][ T4146] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 194.657393][ T4146] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.685368][ T4146] usb 2-1: config 0 descriptor?? [ 194.933965][ T4647] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 194.962825][ T6193] udc-core: couldn't find an available UDC or it's busy [ 194.970064][ T4647] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.990397][ T6193] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 195.012028][ T4647] usb 5-1: config 0 descriptor?? [ 195.192679][ T26] audit: type=1800 audit(1719603732.953:81): pid=6225 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.639" name="file1" dev="sda1" ino=1997 res=0 errno=0 [ 195.254182][ T4146] [drm] vendor descriptor length:b9 data:06 01 32 df da cd 00 00 00 00 00 [ 195.268878][ T4146] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 195.303932][ T4146] [drm:udl_init] *ERROR* Selecting channel failed [ 195.304622][ T6198] udc-core: couldn't find an available UDC or it's busy [ 195.322407][ T6198] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 195.343297][ T4146] [drm] Initialized udl 0.0.1 20120220 for 2-1:0.0 on minor 2 [ 195.362075][ T4146] [drm] Initialized udl on minor 2 [ 195.383965][ T4647] [drm] vendor descriptor length:c3 data:06 01 32 df da cd 00 00 00 00 00 [ 195.389821][ T4146] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 195.400161][ T4647] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 195.403674][ T4146] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 195.431696][ T4146] usb 2-1: USB disconnect, device number 12 [ 195.514059][ T1068] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 195.603831][ T4647] [drm:udl_init] *ERROR* Selecting channel failed [ 195.625231][ T4647] [drm] Initialized udl 0.0.1 20120220 for 5-1:0.0 on minor 3 [ 195.632724][ T4647] [drm] Initialized udl on minor 3 [ 195.673835][ T4647] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 195.686857][ T4647] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 195.720033][ T4647] usb 5-1: USB disconnect, device number 14 [ 195.883880][ T1068] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 195.903865][ T1068] usb 3-1: New USB device found, idVendor=054c, idProduct=0374, bcdDevice= 0.00 [ 195.960659][ T1068] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 195.987812][ T1068] usb 3-1: config 0 descriptor?? [ 196.223906][ T4646] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 196.283852][ T4649] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 196.471999][ T4646] usb 2-1: Using ep0 maxpacket: 16 [ 196.485612][ T1068] sony 0003:054C:0374.0009: unknown main item tag 0x0 [ 196.566766][ T1068] sony 0003:054C:0374.0009: hiddev0,hidraw0: USB HID v0.00 Device [HID 054c:0374] on usb-dummy_hcd.2-1/input0 [ 196.598880][ T1068] sony 0003:054C:0374.0009: failed to claim input [ 196.619346][ T4646] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 33032, setting to 1024 [ 196.641209][ T4646] usb 2-1: New USB device found, idVendor=0158, idProduct=0100, bcdDevice= 0.00 [ 196.664508][ T4646] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.699846][ T6252] netlink: 4 bytes leftover after parsing attributes in process `syz.0.649'. [ 196.700747][ T4646] usb 2-1: config 0 descriptor?? [ 196.714568][ T4649] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 196.738053][ T6252] device team0 entered promiscuous mode [ 196.745804][ T4649] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 196.755446][ T6252] device team_slave_0 entered promiscuous mode [ 196.762488][ T6252] device team_slave_1 entered promiscuous mode [ 196.766386][ T4649] usb 4-1: New USB device found, idVendor=056a, idProduct=030a, bcdDevice= 0.00 [ 196.798265][ T4649] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.821617][ T4649] usb 4-1: config 0 descriptor?? [ 196.829808][ T6252] team0: Port device team_slave_0 removed [ 196.841620][ T4647] usb 3-1: USB disconnect, device number 10 [ 196.849691][ T6251] device team0 left promiscuous mode [ 196.861513][ T6251] device team_slave_1 left promiscuous mode [ 197.073788][ T4146] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 197.340030][ T6234] udc-core: couldn't find an available UDC or it's busy [ 197.350449][ T6234] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 197.382098][ T4646] hid-generic 0003:0158:0100.000A: unknown main item tag 0x1 [ 197.393880][ T4649] usbhid 4-1:0.0: can't add hid device: -71 [ 197.399957][ T4649] usbhid: probe of 4-1:0.0 failed with error -71 [ 197.412235][ T4646] hid-generic 0003:0158:0100.000A: unexpected long global item [ 197.436177][ T4649] usb 4-1: USB disconnect, device number 19 [ 197.443986][ T4146] usb 5-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 197.459186][ T4646] hid-generic: probe of 0003:0158:0100.000A failed with error -22 [ 197.472475][ T4146] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.509343][ T4146] usb 5-1: config 0 descriptor?? [ 197.565936][ T4146] gspca_main: spca508-2.14.0 probing 8086:0110 [ 197.631797][ T4646] usb 2-1: USB disconnect, device number 13 [ 198.297780][ T4146] gspca_spca508: reg_read err -110 [ 198.324103][ T4146] gspca_spca508: reg_read err -32 [ 198.344689][ T4146] gspca_spca508: reg_read err -32 [ 198.373914][ T4146] gspca_spca508: reg_read err -32 [ 198.394360][ T4146] gspca_spca508: reg write: error -32 [ 198.406624][ T4146] spca508: probe of 5-1:0.0 failed with error -32 [ 198.777146][ T4646] usb 5-1: USB disconnect, device number 15 [ 199.699009][ T4647] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 200.136932][ T4647] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 200.158253][ T4647] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 200.193928][ T4647] usb 5-1: New USB device found, idVendor=056a, idProduct=030a, bcdDevice= 0.00 [ 200.211762][ T4647] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.231876][ T4647] usb 5-1: config 0 descriptor?? [ 200.809065][ T4647] usbhid 5-1:0.0: can't add hid device: -71 [ 200.819176][ T4647] usbhid: probe of 5-1:0.0 failed with error -71 [ 200.853983][ T4647] usb 5-1: USB disconnect, device number 16 [ 201.099433][ T6345] netlink: 48 bytes leftover after parsing attributes in process `syz.0.678'. [ 201.363300][ T26] audit: type=1326 audit(1719603739.123:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6346 comm="syz.0.679" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdae555db99 code=0x0 [ 202.303857][ T4647] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 202.630763][ T6399] netlink: 12 bytes leftover after parsing attributes in process `syz.2.702'. [ 202.734869][ T4647] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 202.751789][ T4647] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 202.766206][ T4647] usb 2-1: New USB device found, idVendor=056a, idProduct=030a, bcdDevice= 0.00 [ 202.776244][ T4647] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 202.801827][ T4647] usb 2-1: config 0 descriptor?? [ 202.943512][ T6412] Cannot find add_set index 0 as target [ 203.013890][ T4146] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 203.194473][ T6424] loop4: detected capacity change from 0 to 512 [ 203.251098][ T6424] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpquota,inode_readahead_blks=0x0000000000000800,minixdf,,errors=continue. Quota mode: writeback. [ 203.254661][ T4146] usb 3-1: Using ep0 maxpacket: 16 [ 203.272498][ T6424] ext4 filesystem being mounted at /root/syzkaller.SRVMZz/82/bus supports timestamps until 2038 (0x7fffffff) [ 203.383918][ T4647] usbhid 2-1:0.0: can't add hid device: -71 [ 203.391382][ T4647] usbhid: probe of 2-1:0.0 failed with error -71 [ 203.408003][ T4647] usb 2-1: USB disconnect, device number 14 [ 203.563929][ T4146] usb 3-1: New USB device found, idVendor=23a7, idProduct=fedc, bcdDevice=e0.0b [ 203.577787][ T4146] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.589655][ T6432] loop3: detected capacity change from 0 to 32768 [ 203.590803][ T4146] usb 3-1: Product: syz [ 203.600960][ T4146] usb 3-1: Manufacturer: syz [ 203.607234][ T4146] usb 3-1: SerialNumber: syz [ 203.618133][ T4146] usb 3-1: config 0 descriptor?? [ 203.627311][ T6432] Dev loop3 Sun disklabel: Csum bad, label corrupted [ 203.641253][ T2963] Dev loop3 Sun disklabel: Csum bad, label corrupted [ 203.802897][ T6437] netlink: 'syz.3.718': attribute type 10 has an invalid length. [ 203.837648][ T6437] bond0: (slave bond_slave_0): Releasing backup interface [ 203.841028][ T6439] TCP: request_sock_subflow_v6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 203.870510][ T6406] loop2: detected capacity change from 0 to 512 [ 203.972252][ T6443] netlink: 'syz.1.720': attribute type 5 has an invalid length. [ 204.012402][ T6406] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.706: bg 0: block 248: padding at end of block bitmap is not set [ 204.044710][ T6406] Quota error (device loop2): write_blk: dquota write failed [ 204.052413][ T6406] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 204.063385][ T6406] EXT4-fs error (device loop2): ext4_acquire_dquot:6196: comm syz.2.706: Failed to acquire dquot type 1 [ 204.081378][ T6406] EXT4-fs (loop2): 1 truncate cleaned up [ 204.132364][ T6406] EXT4-fs (loop2): mounted filesystem without journal. Opts: bsdgroups,nodiscard,noblock_validity,grpjquota=,grpjquota=,nojournal_checksum,abort,noload,noload,,errors=continue. Quota mode: writeback. [ 204.182279][ T6406] ext4 filesystem being mounted at /root/syzkaller.7WWmty/140/bus supports timestamps until 2038 (0x7fffffff) [ 204.239793][ T6406] EXT4-fs error (device loop2): ext4_remount:5854: comm syz.2.706: Abort forced by user [ 204.280261][ T6406] EXT4-fs (loop2): Remounting filesystem read-only [ 204.544003][ T4146] usb 3-1: MIDIStreaming interface descriptor not found [ 204.563870][ T3555] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 204.784621][ T4146] usb 3-1: USB disconnect, device number 11 [ 204.934380][ T3555] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 205.085193][ T3555] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 205.153178][ T6406] syz.2.706 (6406) used greatest stack depth: 18752 bytes left [ 205.173590][ T3606] udevd[3606]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 205.181675][ T3555] usb 5-1: New USB device found, idVendor=056a, idProduct=030a, bcdDevice= 0.00 [ 205.233331][ T3555] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.249531][ T3555] usb 5-1: config 0 descriptor?? [ 205.783963][ T4146] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 205.814826][ T3555] usbhid 5-1:0.0: can't add hid device: -71 [ 205.823273][ T3555] usbhid: probe of 5-1:0.0 failed with error -71 [ 205.832960][ T3555] usb 5-1: USB disconnect, device number 17 [ 206.023905][ T4146] usb 3-1: Using ep0 maxpacket: 16 [ 206.148903][ T4146] usb 3-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 206.158572][ T4146] usb 3-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 206.169866][ T4146] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 206.363866][ T4146] usb 3-1: New USB device found, idVendor=1b80, idProduct=c161, bcdDevice=ce.43 [ 206.373400][ T4146] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.385419][ T4146] usb 3-1: Product: syz [ 206.389657][ T4146] usb 3-1: Manufacturer: syz [ 206.394588][ T4146] usb 3-1: SerialNumber: syz [ 206.408419][ T4146] usb 3-1: config 0 descriptor?? [ 206.573120][ T26] audit: type=1400 audit(1719603744.333:83): apparmor="DENIED" operation="stack" info="label not found" error=-2 profile="unconfined" name=3A220AE10CCA7C2B08C9DFF78977F306B457CA93031D371D06D2E59E863E2FE54118A4EE43068DF6BA88E1B6DC3A552C91AE1C817D6B6014270B8BC51F73363852F4F12EE955F464599F0C485D pid=6509 comm="syz.1.745" [ 207.472495][ T6524] udc-core: couldn't find an available UDC or it's busy [ 207.649599][ T6527] netlink: 8 bytes leftover after parsing attributes in process `syz.4.749'. [ 208.073362][ T6524] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 208.176629][ T4146] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 208.202420][ T4146] dvb_usb_af9015: probe of 3-1:0.0 failed with error -22 [ 208.221778][ T4146] usb 3-1: USB disconnect, device number 12 [ 208.613833][ T23] Bluetooth: hci2: command 0x201b tx timeout [ 208.761494][ T6545] netlink: 28 bytes leftover after parsing attributes in process `syz.2.754'. [ 209.281605][ T6560] netlink: 'syz.4.759': attribute type 10 has an invalid length. [ 209.300278][ T6560] device hsr0 entered promiscuous mode [ 209.351477][ T6560] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 209.416180][ T6560] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 209.433992][ T6560] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 209.485309][ T6560] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 209.634712][ T26] audit: type=1804 audit(1719603747.393:84): pid=6565 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.758" name="/root/syzkaller.KIA4qZ/44/bus/cgroup.controllers" dev="overlay" ino=2023 res=1 errno=0 [ 209.696234][ T26] audit: type=1800 audit(1719603747.393:85): pid=6565 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.758" name="cgroup.controllers" dev="overlay" ino=2023 res=0 errno=0 [ 209.888353][ T6567] netlink: 8 bytes leftover after parsing attributes in process `syz.4.761'. [ 211.753792][ T3553] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 212.133796][ T3553] usb 2-1: Using ep0 maxpacket: 8 [ 212.393881][ T3553] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 212.417441][ T3553] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 212.575305][ T3553] usb 2-1: Product: syz [ 212.580042][ T3553] usb 2-1: SerialNumber: syz [ 212.589233][ T3553] usb 2-1: config 0 descriptor?? [ 212.638185][ T3553] gspca_main: spca501-2.14.0 probing 0000:0000 [ 212.648189][ T6608] sp0: Synchronizing with TNC [ 213.022434][ T6616] netlink: 'syz.3.777': attribute type 4 has an invalid length. [ 213.280501][ T6616] netlink: 17 bytes leftover after parsing attributes in process `syz.3.777'. [ 213.349833][ T3553] gspca_spca501: reg write: error -71 [ 213.368536][ T3553] spca501 2-1:0.0: Reg write failed for 0x02,0xa048,0x00 [ 213.407520][ T3553] spca501: probe of 2-1:0.0 failed with error -22 [ 213.454274][ T3553] usb 2-1: USB disconnect, device number 15 [ 214.103866][ T4647] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 214.136652][ T6657] netlink: 'syz.3.791': attribute type 4 has an invalid length. [ 214.145008][ T6657] netlink: 17 bytes leftover after parsing attributes in process `syz.3.791'. [ 214.515277][ T4647] usb 5-1: Using ep0 maxpacket: 8 [ 214.623922][ T3553] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 214.643273][ T3553] Bluetooth: hci2: Injecting HCI hardware error event [ 214.682091][ T3512] Bluetooth: hci2: hardware error 0x00 [ 214.691476][ T4647] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 214.726960][ T4647] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 214.788120][ T4647] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 214.843759][ T4647] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 214.921205][ T4647] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 214.988957][ T4647] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.334419][ T4647] usb 5-1: GET_CAPABILITIES returned 0 [ 215.340565][ T4647] usbtmc 5-1:16.0: can't read capabilities [ 215.729374][ T4647] usb 5-1: USB disconnect, device number 18 [ 215.942206][ T6680] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 215.992701][ T6680] cgroup: noprefix used incorrectly [ 216.071060][ T6680] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 216.345764][ T4146] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 216.378553][ T23] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 216.700856][ T6696] netlink: 8 bytes leftover after parsing attributes in process `syz.2.804'. [ 217.378211][ T4146] usb 2-1: Using ep0 maxpacket: 8 [ 217.404030][ T23] usb 4-1: Using ep0 maxpacket: 8 [ 217.644042][ T4146] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 218.102719][ T4146] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 218.174123][ T23] usb 4-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 218.187160][ T6719] sp0: Synchronizing with TNC [ 218.192249][ T23] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 218.214037][ T23] usb 4-1: Product: syz [ 218.218412][ T23] usb 4-1: SerialNumber: syz [ 218.252245][ T23] usb 4-1: config 0 descriptor?? [ 218.273983][ T4146] usb 2-1: New USB device found, idVendor=03f0, idProduct=421d, bcdDevice= e.68 [ 218.305628][ T23] gspca_main: spca501-2.14.0 probing 0000:0000 [ 218.326065][ T4146] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.351275][ T4146] usb 2-1: Product: syz [ 218.362025][ T4146] usb 2-1: Manufacturer: syz [ 218.377946][ T4146] usb 2-1: SerialNumber: syz [ 218.417204][ T4146] usb 2-1: config 0 descriptor?? [ 218.455575][ T4146] qmi_wwan: probe of 2-1:0.0 failed with error -22 [ 218.659166][ T4146] usb 2-1: USB disconnect, device number 16 [ 218.733829][ T23] gspca_spca501: reg write: error -71 [ 218.739338][ T23] spca501 4-1:0.0: Reg write failed for 0x02,0xa048,0x00 [ 218.753824][ T23] spca501: probe of 4-1:0.0 failed with error -22 [ 218.793921][ T23] usb 4-1: USB disconnect, device number 20 [ 219.089077][ T6739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.105132][ T6739] cgroup: noprefix used incorrectly [ 219.152173][ T6739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 219.217643][ T26] audit: type=1326 audit(1719603756.983:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6741 comm="syz.2.819" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f98e2e0fb99 code=0x0 [ 219.577153][ T3925] dvb-usb: did not find the firmware file 'dvb-usb-bluebird-01.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 219.600694][ T3925] dvb_usb_cxusb: probe of 1-1:0.0 failed with error -22 [ 220.386075][ T3925] usb 1-1: USB disconnect, device number 10 [ 222.033898][ T4649] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 222.313773][ T4649] usb 3-1: Using ep0 maxpacket: 8 [ 222.414912][ T4646] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 222.464336][ T4649] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 222.493775][ T4649] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 222.703820][ T4646] usb 5-1: Using ep0 maxpacket: 8 [ 222.709108][ T4649] usb 3-1: New USB device found, idVendor=03f0, idProduct=421d, bcdDevice= e.68 [ 222.724077][ T4649] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.752421][ T4649] usb 3-1: Product: syz [ 222.762555][ T4649] usb 3-1: Manufacturer: syz [ 222.782788][ T4649] usb 3-1: SerialNumber: syz [ 222.802422][ T4649] usb 3-1: config 0 descriptor?? [ 222.865135][ T4649] qmi_wwan: probe of 3-1:0.0 failed with error -22 [ 223.013982][ T4646] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 223.033658][ T4646] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 223.059571][ T4646] usb 5-1: Product: syz [ 223.093810][ T4646] usb 5-1: SerialNumber: syz [ 223.124594][ T4646] usb 5-1: config 0 descriptor?? [ 223.133111][ T4649] usb 3-1: USB disconnect, device number 13 [ 223.170777][ T4646] gspca_main: spca501-2.14.0 probing 0000:0000 [ 223.427227][ T6790] netlink: 'syz.1.836': attribute type 4 has an invalid length. [ 223.470299][ T6790] netlink: 17 bytes leftover after parsing attributes in process `syz.1.836'. [ 223.593899][ T4646] gspca_spca501: reg write: error -71 [ 223.599315][ T4646] spca501 5-1:0.0: Reg write failed for 0x02,0xa048,0x00 [ 223.623780][ T4646] spca501: probe of 5-1:0.0 failed with error -22 [ 223.655308][ T4646] usb 5-1: USB disconnect, device number 19 [ 225.053845][ T3925] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 225.293796][ T3925] usb 2-1: Using ep0 maxpacket: 8 [ 225.419036][ T3925] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 225.467569][ T3925] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 225.507601][ T3925] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 225.527971][ T3925] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 225.566233][ T3925] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 225.608929][ T3925] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.809941][ T6828] netlink: 'syz.4.851': attribute type 5 has an invalid length. [ 225.870718][ T6828] netlink: 40 bytes leftover after parsing attributes in process `syz.4.851'. [ 226.563810][ T3925] usb 2-1: GET_CAPABILITIES returned 0 [ 226.569322][ T3925] usbtmc 2-1:16.0: can't read capabilities [ 226.774053][ T1068] Bluetooth: hci3: command 0x0406 tx timeout [ 226.838053][ T6847] netlink: 12 bytes leftover after parsing attributes in process `syz.0.855'. [ 226.883510][ T3925] usb 2-1: USB disconnect, device number 17 [ 227.001797][ T6841] netlink: 4 bytes leftover after parsing attributes in process `syz.0.855'. [ 227.560455][ T6884] netlink: 'syz.3.865': attribute type 5 has an invalid length. [ 227.604048][ T6884] netlink: 40 bytes leftover after parsing attributes in process `syz.3.865'. [ 227.605526][ T6886] netlink: 8 bytes leftover after parsing attributes in process `syz.4.866'. [ 227.907766][ T6899] netlink: 4 bytes leftover after parsing attributes in process `syz.4.873'. [ 227.928643][ T6899] device team0 entered promiscuous mode [ 227.941914][ T6899] device team_slave_0 entered promiscuous mode [ 227.948510][ T6899] device team_slave_1 entered promiscuous mode [ 227.955522][ T6899] device wlan1 entered promiscuous mode [ 227.992160][ T6899] team0: Port device team_slave_0 removed [ 228.002043][ T6898] device team0 left promiscuous mode [ 228.007766][ T4646] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 228.015844][ T6898] device team_slave_1 left promiscuous mode [ 228.021853][ T6898] device wlan1 left promiscuous mode [ 228.213891][ T4647] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 228.280763][ T1068] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 228.416166][ T4646] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 228.433796][ T4647] usb 2-1: device descriptor read/64, error -71 [ 228.445940][ T4646] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 228.459737][ T4646] usb 4-1: New USB device found, idVendor=056a, idProduct=00f8, bcdDevice= 4.00 [ 228.470754][ T4646] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.499251][ T4646] usb 4-1: config 0 descriptor?? [ 228.633791][ T3555] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 228.703958][ T1068] usb 1-1: New USB device found, idVendor=1d50, idProduct=606f, bcdDevice=14.d4 [ 228.713493][ T1068] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.723875][ T4647] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 228.732535][ T1068] usb 1-1: config 0 descriptor?? [ 228.873809][ T3555] usb 3-1: Using ep0 maxpacket: 8 [ 228.934553][ T4647] usb 2-1: device descriptor read/64, error -71 [ 228.993998][ T3555] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 229.004484][ T4646] wacom 0003:056A:00F8.000B: hidraw0: USB HID v0.00 Device [HID 056a:00f8] on usb-dummy_hcd.3-1/input0 [ 229.023188][ T3555] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 229.042565][ T3555] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 229.052852][ T3555] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 229.066429][ T3555] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 229.074295][ T4647] usb usb2-port1: attempt power cycle [ 229.075583][ T3555] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 229.166996][ T6917] netlink: 'syz.4.880': attribute type 5 has an invalid length. [ 229.179371][ T6917] netlink: 40 bytes leftover after parsing attributes in process `syz.4.880'. [ 229.201282][ T4646] usb 4-1: USB disconnect, device number 21 [ 229.203920][ T1068] gs_usb 1-1:0.0: Configuring for 1 interfaces [ 229.251107][ T6919] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 229.353852][ T3555] usb 3-1: GET_CAPABILITIES returned 0 [ 229.359381][ T3555] usbtmc 3-1:16.0: can't read capabilities [ 229.537759][ T4647] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 229.545960][ T3553] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 229.614294][ T4646] usb 3-1: USB disconnect, device number 14 [ 229.651283][ T4649] usb 1-1: USB disconnect, device number 11 [ 229.657642][ T4647] usb 2-1: device descriptor read/8, error -71 [ 229.833811][ T3553] usb 5-1: Using ep0 maxpacket: 8 [ 229.843215][ T6946] netlink: 4 bytes leftover after parsing attributes in process `syz.3.884'. [ 229.860303][ T6946] device team0 entered promiscuous mode [ 229.867807][ T6946] device team_slave_0 entered promiscuous mode [ 229.876642][ T6946] device team_slave_1 entered promiscuous mode [ 229.932986][ T6946] team0: Port device team_slave_0 removed [ 229.948822][ T6945] device team0 left promiscuous mode [ 229.957340][ T6945] device team_slave_1 left promiscuous mode [ 229.959688][ T4647] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 229.998836][ T3553] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 230.029621][ T3553] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 230.050143][ T3553] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 230.061738][ T3553] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 230.073134][ T3553] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 230.082406][ T4647] usb 2-1: device descriptor read/8, error -71 [ 230.088719][ T3553] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.115348][ T26] audit: type=1326 audit(1719603767.883:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6955 comm="syz.3.886" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb6c491db99 code=0x0 [ 230.164881][ T3553] hub 5-1:1.0: bad descriptor, ignoring hub [ 230.170809][ T3553] hub: probe of 5-1:1.0 failed with error -5 [ 230.175539][ T6956] netlink: 10 bytes leftover after parsing attributes in process `syz.3.886'. [ 230.193354][ T3553] cdc_wdm 5-1:1.0: skipping garbage [ 230.198762][ T3553] cdc_wdm 5-1:1.0: skipping garbage [ 230.211642][ T3553] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 230.218582][ T4647] usb usb2-port1: unable to enumerate USB device [ 230.225213][ T3553] cdc_wdm 5-1:1.0: Unknown control protocol [ 230.513806][ T4647] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 230.746494][ T6956] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 230.776833][ T6921] usb 5-1: reset high-speed USB device number 20 using dummy_hcd [ 231.040480][ T6969] netlink: 'syz.3.891': attribute type 5 has an invalid length. [ 231.048338][ T6969] netlink: 40 bytes leftover after parsing attributes in process `syz.3.891'. [ 231.052077][ T6971] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 231.073961][ T4647] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 231.097709][ T4647] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 231.313981][ T4647] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=a1.c9 [ 231.325496][ T4647] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.359434][ T4647] usb 1-1: Product: syz [ 231.363616][ T4647] usb 1-1: Manufacturer: syz [ 231.368738][ T4647] usb 1-1: SerialNumber: syz [ 231.529775][ T6962] udc-core: couldn't find an available UDC or it's busy [ 231.559635][ T6962] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 231.584045][ T1068] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 231.651029][ T6962] udc-core: couldn't find an available UDC or it's busy [ 231.680527][ T6962] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 231.747346][ T4647] usb 1-1: config 0 descriptor?? [ 231.784037][ T1068] usb 2-1: device descriptor read/64, error -71 [ 232.067048][ T1068] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 232.158874][ T4647] usb 5-1: USB disconnect, device number 20 [ 232.213978][ T3555] Bluetooth: hci1: command 0x0409 tx timeout [ 232.263892][ T1068] usb 2-1: device descriptor read/64, error -71 [ 232.385170][ T1068] usb usb2-port1: attempt power cycle [ 232.727040][ T7003] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 232.803913][ T1068] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 232.827984][ T7006] netlink: 4 bytes leftover after parsing attributes in process `syz.2.905'. [ 232.862932][ T7006] device team0 entered promiscuous mode [ 232.873346][ T7006] device team_slave_0 entered promiscuous mode [ 232.881945][ T7006] device team_slave_1 entered promiscuous mode [ 232.904013][ T1068] usb 2-1: device descriptor read/8, error -71 [ 232.973487][ T7006] team0: Port device team_slave_0 removed [ 233.044532][ T7004] device team0 left promiscuous mode [ 233.073836][ T7004] device team_slave_1 left promiscuous mode [ 233.419179][ T1068] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 233.463517][ T3555] usb 1-1: USB disconnect, device number 12 [ 233.548211][ T1068] usb 2-1: device descriptor read/8, error -71 [ 233.675164][ T1068] usb usb2-port1: unable to enumerate USB device [ 234.497619][ C0] TCP: request_sock_TCP: Possible SYN flooding on port 2. Sending cookies. Check SNMP counters. [ 234.778819][ T7074] loop1: detected capacity change from 0 to 32768 [ 234.836786][ T7074] Dev loop1 SGI disklabel: csum bad, label corrupted [ 234.912506][ T2963] Dev loop1 SGI disklabel: csum bad, label corrupted [ 234.943815][ T3555] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 234.954328][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 235.203874][ T4647] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 235.213947][ T3555] usb 5-1: Using ep0 maxpacket: 8 [ 235.344307][ T3555] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 235.378773][ T3555] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 235.404003][ T3555] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 235.423808][ T4647] usb 4-1: device descriptor read/64, error -71 [ 235.432791][ T3555] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 235.459438][ T3555] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 235.469289][ T3555] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.693793][ T4647] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 235.706752][ T7109] device ip6gretap0 entered promiscuous mode [ 235.714278][ T7109] device bridge0 entered promiscuous mode [ 235.721517][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 235.767013][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 235.785367][ T7113] netlink: 12 bytes leftover after parsing attributes in process `syz.4.940'. [ 235.903973][ T4647] usb 4-1: device descriptor read/64, error -71 [ 235.923960][ T3555] usb 5-1: GET_CAPABILITIES returned 0 [ 235.929664][ T3555] usbtmc 5-1:16.0: can't read capabilities [ 236.048336][ T4647] usb usb4-port1: attempt power cycle [ 236.146156][ T3555] usb 5-1: USB disconnect, device number 21 [ 236.483772][ T4647] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 236.608915][ T4647] usb 4-1: device descriptor read/8, error -71 [ 236.883969][ T4647] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 237.003902][ T4647] usb 4-1: device descriptor read/8, error -71 [ 237.134817][ T4647] usb usb4-port1: unable to enumerate USB device [ 237.958102][ T26] audit: type=1804 audit(1719603775.723:88): pid=7196 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.983" name="/root/syzkaller.Qqv6Uo/248/bus" dev="sda1" ino=2014 res=1 errno=0 [ 237.993214][ T7198] netlink: 4 bytes leftover after parsing attributes in process `syz.0.982'. [ 238.156219][ T7208] loop1: detected capacity change from 0 to 512 [ 238.306507][ T4646] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 238.386299][ T7208] EXT4-fs error (device loop1): ext4_orphan_get:1397: inode #15: comm syz.1.987: casefold flag without casefold feature [ 238.489902][ T7214] input: syz0 as /devices/virtual/input/input19 [ 238.601800][ T7208] EXT4-fs error (device loop1): ext4_xattr_inode_iget:404: inode #12: comm syz.1.987: missing EA_INODE flag [ 238.731078][ T7208] EXT4-fs error (device loop1): ext4_xattr_inode_iget:409: comm syz.1.987: error while reading EA inode 12 err=-117 [ 238.805165][ T7208] EXT4-fs (loop1): 1 orphan inode deleted [ 238.813958][ T4646] usb 3-1: device descriptor read/64, error -71 [ 238.830966][ T7208] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 239.029397][ T26] audit: type=1800 audit(1719603776.793:89): pid=7208 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.987" name="file0" dev="loop1" ino=18 res=0 errno=0 [ 239.103780][ T4646] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 239.201563][ T7230] netlink: 4 bytes leftover after parsing attributes in process `syz.0.995'. [ 239.321551][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 239.334091][ T4646] usb 3-1: device descriptor read/64, error -71 [ 239.459790][ T4646] usb usb3-port1: attempt power cycle [ 240.482053][ T7257] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 240.553505][ T26] audit: type=1804 audit(1719603778.313:90): pid=7261 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1008" name="/root/syzkaller.KIA4qZ/94/bus" dev="sda1" ino=2020 res=1 errno=0 [ 240.703802][ T4646] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 240.785212][ T7263] tipc: Failed to remove unknown binding: 66,1,1/0:2491549873/2491549875 [ 240.814031][ T4646] usb 3-1: device descriptor read/8, error -71 [ 240.822615][ T7263] tipc: Failed to remove unknown binding: 66,1,1/0:2491549873/2491549875 [ 240.858934][ T7268] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1012'. [ 241.912328][ T7283] loop3: detected capacity change from 0 to 128 [ 242.004391][ T7288] device hsr0 entered promiscuous mode [ 242.015189][ T7283] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 242.077381][ T26] audit: type=1800 audit(1719603779.843:91): pid=7283 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1017" name="file2" dev="loop3" ino=1048688 res=0 errno=0 [ 242.098229][ C1] vkms_vblank_simulate: vblank timer overrun [ 242.115763][ T7283] FAT-fs (loop3): error, clusters badly computed (5 != 1) [ 242.123562][ T7283] FAT-fs (loop3): Filesystem has been set read-only [ 242.151001][ T7283] FAT-fs (loop3): error, clusters badly computed (6 != 2) [ 242.172968][ T7283] FAT-fs (loop3): error, clusters badly computed (7 != 3) [ 242.180418][ T7283] FAT-fs (loop3): error, clusters badly computed (8 != 4) [ 242.238863][ T7283] FAT-fs (loop3): error, clusters badly computed (9 != 5) [ 242.251151][ T7283] FAT-fs (loop3): error, clusters badly computed (10 != 6) [ 242.273262][ T7283] FAT-fs (loop3): error, clusters badly computed (11 != 7) [ 242.295974][ T7283] FAT-fs (loop3): error, clusters badly computed (12 != 8) [ 242.319712][ T7283] FAT-fs (loop3): error, clusters badly computed (13 != 9) [ 242.337033][ T7283] FAT-fs (loop3): error, clusters badly computed (14 != 10) [ 242.346837][ T7283] FAT-fs (loop3): error, clusters badly computed (15 != 11) [ 242.364284][ T7283] FAT-fs (loop3): error, clusters badly computed (16 != 12) [ 242.371734][ T7283] FAT-fs (loop3): error, clusters badly computed (17 != 13) [ 242.382442][ T7283] FAT-fs (loop3): error, clusters badly computed (18 != 14) [ 242.391052][ T7283] FAT-fs (loop3): error, clusters badly computed (19 != 15) [ 242.399905][ T7283] FAT-fs (loop3): error, clusters badly computed (20 != 16) [ 242.411131][ T7283] FAT-fs (loop3): error, clusters badly computed (21 != 17) [ 242.420107][ T7283] FAT-fs (loop3): error, clusters badly computed (22 != 18) [ 242.431548][ T7283] FAT-fs (loop3): error, clusters badly computed (23 != 19) [ 242.660430][ T7313] loop3: detected capacity change from 0 to 2048 [ 242.722945][ T7313] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 not in group (block 1095216660482)! [ 242.743783][ T4647] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 242.748541][ T7313] EXT4-fs (loop3): group descriptors corrupted! [ 242.785423][ T7316] kernel profiling enabled (shift: 2) [ 242.953763][ T4647] usb 1-1: device descriptor read/64, error -71 [ 242.973986][ C1] ================================================================== [ 242.982319][ C1] BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0 [ 242.989421][ C1] Read of size 8 at addr ffffc90002e67300 by task syz.3.1032/7318 [ 242.997207][ C1] [ 242.999520][ C1] CPU: 1 PID: 7318 Comm: syz.3.1032 Not tainted 5.15.161-syzkaller #0 [ 243.007651][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 243.017716][ C1] Call Trace: [ 243.021008][ C1] [ 243.023845][ C1] dump_stack_lvl+0x1e3/0x2d0 [ 243.028532][ C1] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 243.034149][ C1] ? _printk+0xd1/0x120 [ 243.038294][ C1] ? __wake_up_klogd+0xcc/0x100 [ 243.043129][ C1] ? panic+0x860/0x860 [ 243.047180][ C1] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 243.052630][ C1] print_address_description+0x63/0x3b0 [ 243.058178][ C1] ? profile_pc+0xa4/0xe0 [ 243.062492][ C1] kasan_report+0x16b/0x1c0 [ 243.066978][ C1] ? profile_pc+0xa4/0xe0 [ 243.071289][ C1] ? trigger_load_balance+0x1d5/0xd90 [ 243.076648][ C1] ? _raw_spin_unlock_irqrestore+0xd4/0x130 [ 243.082548][ C1] profile_pc+0xa4/0xe0 [ 243.086690][ C1] profile_tick+0xd4/0x130 [ 243.091117][ C1] tick_sched_timer+0x390/0x550 [ 243.095957][ C1] ? tick_setup_sched_timer+0x2d0/0x2d0 [ 243.101496][ C1] __hrtimer_run_queues+0x55b/0xcf0 [ 243.106694][ C1] ? hrtimer_interrupt+0x980/0x980 [ 243.111795][ C1] ? ktime_get_update_offsets_now+0x407/0x420 [ 243.117853][ C1] hrtimer_interrupt+0x392/0x980 [ 243.122788][ C1] __sysvec_apic_timer_interrupt+0x139/0x470 [ 243.128754][ C1] sysvec_apic_timer_interrupt+0x8c/0xb0 [ 243.134371][ C1] [ 243.137285][ C1] [ 243.140199][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 243.146179][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd4/0x130 [ 243.152692][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 62 6c a2 f7 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 57 ac 2f f7 65 8b 05 d8 b2 da 75 85 c0 74 3f 48 c7 04 24 0e 36 [ 243.172282][ C1] RSP: 0018:ffffc90002e67300 EFLAGS: 00000206 [ 243.178352][ C1] RAX: d9a8786fda33a800 RBX: 1ffff920005cce64 RCX: ffffffff81631688 [ 243.186310][ C1] RDX: dffffc0000000000 RSI: ffffffff8a8b2a00 RDI: 0000000000000001 [ 243.194272][ C1] RBP: ffffc90002e67388 R08: dffffc0000000000 R09: fffffbfff1f7f224 [ 243.202228][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 243.210181][ C1] R13: 1ffff920005cce60 R14: ffffc90002e67320 R15: 0000000000000246 [ 243.218145][ C1] ? mark_lock+0x98/0x340 [ 243.222462][ C1] ? _raw_spin_unlock+0x40/0x40 [ 243.227302][ C1] debug_check_no_obj_freed+0x455/0x4e0 [ 243.232835][ C1] ? __mutex_unlock_slowpath+0x218/0x750 [ 243.238471][ C1] ? slab_free_freelist_hook+0xdd/0x160 [ 243.244006][ C1] slab_free_freelist_hook+0x86/0x160 [ 243.249363][ C1] ? kobject_uevent_env+0x362/0x8d0 [ 243.254557][ C1] kfree+0xf1/0x270 [ 243.258352][ C1] kobject_uevent_env+0x362/0x8d0 [ 243.263365][ C1] device_add+0xa4f/0xfd0 [ 243.267683][ C1] nfc_register_device+0x4a/0x310 [ 243.273396][ C1] nci_register_device+0x7be/0x900 [ 243.278512][ C1] ? nci_free_device+0x90/0x90 [ 243.283349][ C1] ? nci_hci_allocate+0x1dd/0x2a0 [ 243.288358][ C1] ? nci_allocate_device+0x248/0x350 [ 243.293631][ C1] virtual_ncidev_open+0x55/0xc0 [ 243.298559][ C1] ? virtual_ncidev_ioctl+0x90/0x90 [ 243.303743][ C1] misc_open+0x304/0x380 [ 243.307972][ C1] chrdev_open+0x54a/0x630 [ 243.312373][ C1] ? cd_forget+0x160/0x160 [ 243.316776][ C1] ? do_raw_spin_unlock+0x137/0x8b0 [ 243.321977][ C1] ? fsnotify_perm+0x47a/0x5a0 [ 243.326749][ C1] ? cd_forget+0x160/0x160 [ 243.331149][ C1] do_dentry_open+0x807/0xfb0 [ 243.335824][ C1] path_openat+0x2705/0x2f20 [ 243.340426][ C1] ? do_filp_open+0x460/0x460 [ 243.345105][ C1] do_filp_open+0x21c/0x460 [ 243.349595][ C1] ? vfs_tmpfile+0x2e0/0x2e0 [ 243.354199][ C1] ? _raw_spin_unlock+0x24/0x40 [ 243.359035][ C1] ? alloc_fd+0x594/0x630 [ 243.363353][ C1] do_sys_openat2+0x13b/0x500 [ 243.368015][ C1] ? __context_tracking_enter+0x5f/0x90 [ 243.373547][ C1] ? do_sys_open+0x220/0x220 [ 243.378130][ C1] __x64_sys_openat+0x243/0x290 [ 243.382966][ C1] ? __ia32_sys_open+0x270/0x270 [ 243.387891][ C1] ? syscall_enter_from_user_mode+0x2e/0x240 [ 243.393859][ C1] ? lockdep_hardirqs_on+0x94/0x130 [ 243.399048][ C1] ? syscall_enter_from_user_mode+0x2e/0x240 [ 243.405014][ C1] do_syscall_64+0x3b/0xb0 [ 243.409415][ C1] ? clear_bhb_loop+0x15/0x70 [ 243.414077][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 243.419952][ C1] RIP: 0033:0x7fb6c491db99 [ 243.424354][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 243.443943][ C1] RSP: 002b:00007fb6c339e048 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 243.452355][ C1] RAX: ffffffffffffffda RBX: 00007fb6c4aabfa0 RCX: 00007fb6c491db99 [ 243.460323][ C1] RDX: 0000000000000002 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 243.468299][ C1] RBP: 00007fb6c499e77e R08: 0000000000000000 R09: 0000000000000000 [ 243.476266][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 243.484231][ C1] R13: 000000000000000b R14: 00007fb6c4aabfa0 R15: 00007ffd1e114c88 [ 243.492199][ C1] [ 243.495215][ C1] [ 243.497520][ C1] [ 243.499824][ C1] addr ffffc90002e67300 is located in stack of task syz.3.1032/7318 at offset 0 in frame: [ 243.509706][ C1] _raw_spin_unlock_irqrestore+0x0/0x130 [ 243.515327][ C1] [ 243.517643][ C1] this frame has 1 object: [ 243.522032][ C1] [32, 40) 'flags.i.i.i.i' [ 243.522042][ C1] [ 243.528829][ C1] Memory state around the buggy address: [ 243.534448][ C1] ffffc90002e67200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 243.542496][ C1] ffffc90002e67280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 243.550539][ C1] >ffffc90002e67300: f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00 [ 243.558580][ C1] ^ [ 243.562632][ C1] ffffc90002e67380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 243.570674][ C1] ffffc90002e67400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 243.578712][ C1] ================================================================== [ 243.586752][ C1] Disabling lock debugging due to kernel taint [ 243.592926][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 243.600100][ C1] CPU: 1 PID: 7318 Comm: syz.3.1032 Tainted: G B 5.15.161-syzkaller #0 [ 243.609630][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 243.619680][ C1] Call Trace: [ 243.622952][ C1] [ 243.625790][ C1] dump_stack_lvl+0x1e3/0x2d0 [ 243.630462][ C1] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 243.636083][ C1] ? panic+0x860/0x860 [ 243.640144][ C1] ? lock_release+0xb9/0x9a0 [ 243.644744][ C1] ? irq_work_queue+0xcd/0x150 [ 243.649495][ C1] panic+0x318/0x860 [ 243.653390][ C1] ? check_panic_on_warn+0x1d/0xa0 [ 243.658487][ C1] ? fb_is_primary_device+0xd0/0xd0 [ 243.663670][ C1] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 243.669548][ C1] ? _raw_spin_unlock+0x40/0x40 [ 243.674385][ C1] check_panic_on_warn+0x7e/0xa0 [ 243.679303][ C1] ? profile_pc+0xa4/0xe0 [ 243.683611][ C1] end_report+0x6d/0xf0 [ 243.687759][ C1] kasan_report+0x18e/0x1c0 [ 243.692244][ C1] ? profile_pc+0xa4/0xe0 [ 243.696555][ C1] ? trigger_load_balance+0x1d5/0xd90 [ 243.701931][ C1] ? _raw_spin_unlock_irqrestore+0xd4/0x130 [ 243.707809][ C1] profile_pc+0xa4/0xe0 [ 243.711946][ C1] profile_tick+0xd4/0x130 [ 243.716349][ C1] tick_sched_timer+0x390/0x550 [ 243.721191][ C1] ? tick_setup_sched_timer+0x2d0/0x2d0 [ 243.726724][ C1] __hrtimer_run_queues+0x55b/0xcf0 [ 243.731929][ C1] ? hrtimer_interrupt+0x980/0x980 [ 243.737050][ C1] ? ktime_get_update_offsets_now+0x407/0x420 [ 243.743100][ C1] hrtimer_interrupt+0x392/0x980 [ 243.748024][ C1] __sysvec_apic_timer_interrupt+0x139/0x470 [ 243.753987][ C1] sysvec_apic_timer_interrupt+0x8c/0xb0 [ 243.759603][ C1] [ 243.762515][ C1] [ 243.765425][ C1] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 243.771386][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xd4/0x130 [ 243.777873][ C1] Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 62 6c a2 f7 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 57 ac 2f f7 65 8b 05 d8 b2 da 75 85 c0 74 3f 48 c7 04 24 0e 36 [ 243.797459][ C1] RSP: 0018:ffffc90002e67300 EFLAGS: 00000206 [ 243.803506][ C1] RAX: d9a8786fda33a800 RBX: 1ffff920005cce64 RCX: ffffffff81631688 [ 243.811475][ C1] RDX: dffffc0000000000 RSI: ffffffff8a8b2a00 RDI: 0000000000000001 [ 243.819433][ C1] RBP: ffffc90002e67388 R08: dffffc0000000000 R09: fffffbfff1f7f224 [ 243.827387][ C1] R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 [ 243.835344][ C1] R13: 1ffff920005cce60 R14: ffffc90002e67320 R15: 0000000000000246 [ 243.843299][ C1] ? mark_lock+0x98/0x340 [ 243.847614][ C1] ? _raw_spin_unlock+0x40/0x40 [ 243.852453][ C1] debug_check_no_obj_freed+0x455/0x4e0 [ 243.857987][ C1] ? __mutex_unlock_slowpath+0x218/0x750 [ 243.863612][ C1] ? slab_free_freelist_hook+0xdd/0x160 [ 243.869162][ C1] slab_free_freelist_hook+0x86/0x160 [ 243.874519][ C1] ? kobject_uevent_env+0x362/0x8d0 [ 243.879702][ C1] kfree+0xf1/0x270 [ 243.883499][ C1] kobject_uevent_env+0x362/0x8d0 [ 243.888515][ C1] device_add+0xa4f/0xfd0 [ 243.892833][ C1] nfc_register_device+0x4a/0x310 [ 243.897868][ C1] nci_register_device+0x7be/0x900 [ 243.902968][ C1] ? nci_free_device+0x90/0x90 [ 243.907714][ C1] ? nci_hci_allocate+0x1dd/0x2a0 [ 243.912728][ C1] ? nci_allocate_device+0x248/0x350 [ 243.917999][ C1] virtual_ncidev_open+0x55/0xc0 [ 243.922928][ C1] ? virtual_ncidev_ioctl+0x90/0x90 [ 243.928108][ C1] misc_open+0x304/0x380 [ 243.932338][ C1] chrdev_open+0x54a/0x630 [ 243.936741][ C1] ? cd_forget+0x160/0x160 [ 243.941147][ C1] ? do_raw_spin_unlock+0x137/0x8b0 [ 243.946331][ C1] ? fsnotify_perm+0x47a/0x5a0 [ 243.951088][ C1] ? cd_forget+0x160/0x160 [ 243.955484][ C1] do_dentry_open+0x807/0xfb0 [ 243.960152][ C1] path_openat+0x2705/0x2f20 [ 243.964732][ C1] ? do_filp_open+0x460/0x460 [ 243.969398][ C1] do_filp_open+0x21c/0x460 [ 243.973885][ C1] ? vfs_tmpfile+0x2e0/0x2e0 [ 243.978465][ C1] ? _raw_spin_unlock+0x24/0x40 [ 243.983297][ C1] ? alloc_fd+0x594/0x630 [ 243.987632][ C1] do_sys_openat2+0x13b/0x500 [ 243.992293][ C1] ? __context_tracking_enter+0x5f/0x90 [ 243.997820][ C1] ? do_sys_open+0x220/0x220 [ 244.002400][ C1] __x64_sys_openat+0x243/0x290 [ 244.007252][ C1] ? __ia32_sys_open+0x270/0x270 [ 244.012433][ C1] ? syscall_enter_from_user_mode+0x2e/0x240 [ 244.018400][ C1] ? lockdep_hardirqs_on+0x94/0x130 [ 244.023579][ C1] ? syscall_enter_from_user_mode+0x2e/0x240 [ 244.029541][ C1] do_syscall_64+0x3b/0xb0 [ 244.033937][ C1] ? clear_bhb_loop+0x15/0x70 [ 244.038594][ C1] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 244.044466][ C1] RIP: 0033:0x7fb6c491db99 [ 244.048865][ C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 244.068452][ C1] RSP: 002b:00007fb6c339e048 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 244.076866][ C1] RAX: ffffffffffffffda RBX: 00007fb6c4aabfa0 RCX: 00007fb6c491db99 [ 244.084819][ C1] RDX: 0000000000000002 RSI: 0000000020000080 RDI: ffffffffffffff9c [ 244.092771][ C1] RBP: 00007fb6c499e77e R08: 0000000000000000 R09: 0000000000000000 [ 244.100720][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 244.108670][ C1] R13: 000000000000000b R14: 00007fb6c4aabfa0 R15: 00007ffd1e114c88 [ 244.116630][ C1] [ 244.119734][ C1] Kernel Offset: disabled [ 244.124046][ C1] Rebooting in 86400 seconds..