program: r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000002fc0)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0x8}, @TCA_CAKE_WASH={0x8, 0xd, 0x1}]}}]}, 0x44}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) r3 = accept4$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, &(0x7f0000000200)=0x10, 0x80400) sendto$inet(r3, &(0x7f0000000240)="a2bdd7d0e605ea9338d3bcdafedfffa1d6fe9698730476cb6af0e905ac941740f5fff09022b7576d91df00345be11fd033df5f6793c956", 0x37, 0x40044, &(0x7f0000000280)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) syz_mount_image$bcachefs(&(0x7f00000000c0), &(0x7f0000000000)='./file1\x00', 0x1810404, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00'], 0x1, 0x598e, &(0x7f0000005c00)="$eJzs3X+QXFW9IPBzu3synZn8mAR4RJDJEMh7PHiaCb8K9ZXmvX1PXwFSsbCUsFEYyASjk5BKgkBACQouFGChpaWof6CF1KLRogoUIiXyYxNWUYrVpbaQXd1F/3ALWVICWcpyna2ZvqfTc6fv3J6envzi86lkbt/Tt7/n3HNP3+7v6TvTAQAAgDeFPTdv3XfBcf/6s88Mv37Dv/1o442htzxeXo0b9KXLaw5WCzmQuitLxpfZcfF3133n9wOX//NP7+/59hu71524/tf/ctTlj3z83F13ff3x1+Y/+NcXi+LG8XTq/vXk5SSE6o/3fvlzu58+dqwsCSGUk74dISxKFj++KMmEGPxzCGFdurIkc+cDr5+xfmx5423dE8oXZrYz3t/cquk4277v6tPCb/5pzU2/WPr973XtfGnH/k2SasN4CmHBpY2P7wohzE3/j4mjLY7HOGhXhxB6Gh53TkG7Tmqx/Sty1o9Pl3PSZW9BnHj/ssx6KbNddj3qyix7Cuqbqbx2tLtdkXmZ9ezJqOGeSjvx89oZyxely4fS5anTjF+O/5NQSkKl3vyRZP8YCQ3HLQnJ+LGs1tdL9WMb0v3PrCeZ9VJmvdyV2a/xetOBVk6SieVxu0x5PB1X0vITG8/VTVyYU/6WdFlNn6hvxPWQvVHTO+lGfb/GxXbtnaItB0Kp4RzUrLx+4NOD0ZuW9SaLJz1mtNFD/318Ee/bveb25eW1T+zpy2lHcn+Sxk9ai5+K923/+aJ5H/3urVdlX9fr8S8tpfFLbcX/7XnPvHLxrd/6Wm78O2P8clvxT3+05+Xznrx5WW7/7I39U2kr/tCLT92x9OjLdua2/+4Yv9pW/FW7numev+/Rx3LbPxj7Z25b8V9413t/d99zD7+UGz/E+D1txV+7a/Pnu/v3ndIY/7ON8R+L/dPb3vh5defZz/f3/2Egr/3Pxvjz24p/74673nnPwtvOzT2+q2P/9LUV//yTH7lp3r6HT5h4mtt/5kju7tQrJ8Cb01Hpe6xb0vV288z6Rm22oyFf+OpApRZnXvp/fpsxm8q8+RyrZ0En4wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABACOGY0/7z+/7Xh/perqTr3emNF0q1ZSyfE0IyN4SwddvQlm0bNl0x8PErr9qyaWhkYGjbwPCmbVuuHTjzHwa2DG8eGbp27N7Bt51Re9zikNSWyQmT6u4eHR0t9U0si/X9u5N3/mb5Of/7jyEMHvOr/kpu+1fctfGeo5v8zEhWjb5n41UX/Oqsb6b71Ze2q69Ju0ZHR0dDTrv+z0V/ueeLe39/SgiDfzNVu5564d0/mdCg8YL9cVKl7lBrUHfS07Qd9Van7Yn9VVm/YWR4cOr+HXt8OWc//v11L/15/TVf+Eutf6u5+9Fi/85dNTpS+sqa8//fV66vFRS162Ad96L+jnsR2xf7r5r294J0vxbk7FclZ79u/sVjz/34uFtf2xEGK68unVx30X51pQOgK3lLS/XGGnqSRRPKq+n28YjHx63YtnHziq3Xbn/bho1DVwxfMbzpHSvPXHn24Flnn7VifM9XdHj/Y/1/2+L+H5jxtPCTOx6KP1sbT0XtKuqPsXYV90dji/Kefz0Xfu5L77jryQtqBUXjPG5dP5+ky56x47wyNIy3yX3VbL+K+iGEMNCsH1557dxw7H/bcFPReajxyDT+zEhWjT697E/fPOcbS/6xVnBAzvONDWrzPF9v9f72jPdXNT0eo4do/3aHcrpfvU3btfLpJ7tu3/PHT9XbN2dOuGZo27YtK2s/56UtnZcc37Rd2dK4X0vHf5ZD2i2hPkybjNcxXaHWvuz5M26e7dXe9L7eZHHT/cqK9+1ec/vy8ton9uT1dHJ/rca5YX5tmbx1bKWJkcwDy/UGN6v/UH3+FY2P/vd948EPPfjDMyeNj9NrP4v2K8nZr+8/d++Xvv2F//DDzu3X+979TN+f/sfHltcO9eFyXomtju1JGs8rp4dQ9PxbGprvR+7zr9R8f4qef9l69m/fPN5AZr03lNt6vp7+aM/L5z1587JqeHRHs3qSvU2er01dP2GtXPB8PVTGT/b5lVQmtmP2nl8TBkqyavSntxy14/EbVh9XKyga1/Wtm43rM1rIP3L26ycXP99/5cBn/2vnzhvf+YcHLvn10KpP1wraP+6xLZ057tW0f6s5/Vtvdcw7G/v37ZdfObKuVn7ovv9NlwX5TzyVbL12+yeGRkaGt2xtbb9afT2N9WR7ud3X03h2W1ywX6VJ+zV7Nyb016Temt7zLbZ/Xdv9NfH51huStl4Xtv980byPfvfWq/qa7M94RZeW0viltuL/9rxnXrn41m99LTf+nTF+pa34Qy8+dcfSoy/bmRv/7iSNX20r/qpdz3TP3/foY7nxB2P757YV/4V3vfd39z338Eu58UOM39te/7+68+zn+/v/kBv/2SStZ+w9UggPvH7G+tp6ErrS51tsR9eEdoXsepJZL2XWy43rpdpca72CcpJMLI/bpeUnNrSlmQ/nlMd3YdUlteUbcT1kb0xdfqgpNZz7m5UXvU8FADjSxc//43vQ+Pn/cPpGKX+mAfabaR62JCduzMP2z+fMmXD/kjR+fHycB+x/exgcW944UHujP93PEeLzITvPGes55aSJMdqd5yyaf1+WWY/tqs2XVxry0NTkvKYSWph/n1zP1PPvmd0vnh8fuGVSswYa5q2yx68rnTFrdr1Dpr2VsQh54yM7Lxav5+hfEFaP19fi+MheRxOPQ/Y6mljPcZkTZ7vX0cx0fMRmTzE+xptc/PnG5OMXpujf/cevebTs8ZvG8a6ObT/bn892YN6w6SntwM0bzvTzsJz4e2P/mJdsGj99gh3q84axPO5HpcX5xA/llHdqPjGeLmK79k7RlgPBfCJwpMie22P+H18jxvL/sTfg/zezXdH70Oy7xhgv9zqhcvP2FeUdk6/T62nrdXztrs2f7+7fd0ru+5zHWr3uZ/OEtZ6C636K+nF5Zr2wH3MmaIryvWw9Rf2evS6jN8xvq9/v3XHXO+9ZeNu5uf2+uvZCWtzvX5qwNr+g3w+DfKF5fPnCwckXbkzjHybXMRTNnx20fCS98Gm28pEP5pRPNx/pmXSjvl/jDrt8pOvAtgsAOHzE/L/++Vma///PuEH6PqIobz01sx7j5eatOe9P8vLW96fLazLb96a/UTHd983nn/zITfP2PXxCbt5yd6t56H+csNZXmIfOLG/OzSNWd+Z68dw8op5nzSxPzG1/PU+cWZ6eG7+ep88sj87tn3oePbN5gNz49XmAw/tzscL5ukxlcbXV+bojNo9Of312tvLoC3PKp5tH9066Ud+vcYdGHn3D+E95NADwZhTz//g2Lub/T2a2m+nn7Ll5QYfet2f/Hkg9/rMHKq8szPuarEwn75vtvHW28/rZnpc43PPi2Z4Xmt15ssM0L046lhenlbaTF1cPmbzY58sAAEe6mP/HP0Gbn//PLD9plr91TchPDnp+3jS+/Fx+Ho6I+S/5v8/Fi8n/AQCObDH/j7/2GP/+339K17N/t744T6+EZnmEPF2eHg5enl4pin/o5Omdn2cLk68D6ArmAcYdkHmAhu/3Mg8AAMDB0DWeKU3+PfuPpMvs79nn/V7+xTnbt6qSvj2+bNuW4eFLrtq8bmjb8CWbrlw3vPWSq7ds2LZteFNtu5nmjbl5S5o3doVK2h/Nt8vmbQvTv4ewMOfvIWS3j2GPH78x+e8hZKudW/B3BPYfv9bam3f8SlNs32x85B3vvPgfztk+qh//yz92+iXrt16yYdOGbRuGRjZsH5643VjW2jON782M3TKt70vN/JhoZLyzpvv9nZ1pR+aPC5fGE/jc4z/WjiTTjkVpSxblff9BTrt/9l+++MmTR/9yXwiDx5TfOpP+C8mq0R9cNPz+bXt+tXms/aUp2/+DsSfs2JZpu4q+r7QeOX4fbPxe+5Ert247bf2VV23KfqNke+J8Rqm+3vH5jNr3EKdP/3KL8xNrc8qne51CedKNQ1PL8xMAAEwQP/+P72fj54dfSN9AxfLW8/SZfX6cm6cPtpanZ7+XrChPz24f97fVPL06wzw9W39Rnt5s+2Z5el7enRf/gznbT1fr42Rm13nkjpNLWxsn2e8zKBon2e2nO06SGY6TbP1F46TZ9s3GSd5xz4v/gZzt8+SOh7E7J4yHmV2Xkzse7mxtPPx9Zr1oPGS3n+54KM1wPGTrLxoPzbZvNh7yjm9e/Atytm/VxPExNjDGzxPDl1x95ZZPNGw3299/MfP2ze73f7Sr9fbP7nVfs9/+2b2ubPbbP7PrynLb/+zMZsJab//sfr9Luw7AfG3tOrP0YrOi68+K5nHX5JRPdx53zqQbhybzuHDwxPw/ftwT8//b0mWnPwY6/L8nrYOvc+9uiH/EXH8/u+9jvJ5PUdkhwOs5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQGu6K0vGl3tu3rrvguP+9WefGX79hn/70cYb/+667/x+4PJ//un9Pd9+Y/e6E9f/+l+OuvyRj5+7666vP/7a/Af/+mJh4L7xn5VT09VqCMnLSQjVH+/98ud2P33sWFkSQignfTtCWJQsfnxRkokw+OcQwrp6Oyfe+cDrZ6wfW954W/eE8oWZINn9Cr3l2J7GdoZwTeEecRiqpuNs+76rTwu/+ac1N/1i6fe/17XzpR37N0mqDeMphAWXNj6+K4QwN/0/Jo62JfHB6XJ1CKGn4XHnFLTrpBbbvyJn/fh0OSdd9hbEifcvy6yXMttl16OuzLKnoL6ZymtHu9sVmZdZz56MZiqvnbF8Ubp8KF2eOs345fg/CaUkVOrNH0n2j5HQcNySkIwfy2p9vVQ/tiHd/8x6klkvZdbLXZn9Gq83HWjlJJlYHrfLlMfTcSUtP7HxXN3EhTnlb0mX1fSJ+kZcD9kbNb2TbtT3a1xs194p2nIglBrOQc3K6wc+PRi9aVlvsnjSY0abiPftXnP78vLaJ/b05bQjuT9J4ydtxd/+80XzPvrdW69akhf/0lIav9RW/N+e98wrF9/6ra/lxr8zxi+3Ff/0R3tePu/Jm5fl9s/e2D+VtuIPvfjUHUuPvmxnbvvvjvGrbcVfteuZ7vn7Hn0st/2DsX/mthX/hXe993f3PffwS7nxQ4zf01b8tbs2f767f98pufEfi/3T2974eXXn2c/39/9hIC/+szH+/Lbi37vjrnfes/C2c3OP7+rYP31txT//5Edumrfv4RPyzp3J3Z165QR4czoqfY91S7rebp45Uw35wlcHKrX3fPPS//M7WVHGWD0LZjE+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABHpl9ef+ZHLnrPB9aEUghJzjajo6XRrHhfec6qVQNt1Dv04lN3LD36sp2NZUvaiAMAAAAUi3l4qV5SDUvC1cnccHzT7eMcwfFxLZlYnp1DiHGycwTtxil1KE65Q3EqHYrT1aE4czoUp7tDcaoFcaqhtThzp4hTaZi8KorTM2V7Wo/T26E48zoUZ35rcZLs/dk4CzrUnoUditM3ZZzWx+GiDsVZ3KE4R3UoztEdinNMh+L8TYfiHNuhONk55emOw/nplsflxRm/US6MU0nK9TsmTaaPjo4em9Zzwgzr6S2oZ37R63GL9cxtsZ6TMo8rTbOeaov1/O0M60larOfvZ1hPqaCeOG6vybYv1hPXWhz/13YozvYOxbmuQ3Gu71CcT3Uozqc7FOeGGcYBaFXM//fne32hu/KPoSc942RnAWK+u3T85+TXu7wTUoz31kz5nKJ42UQ9E2/pdNuXnUDIxFuWKe+aEK9Sz0emiFdtjLc8c2fh/mYnFDLtOzVT3l0ULzuxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACz6JfXn/mRi97zgTUhCWP/mhptIt5XnrNq1UAb9e5ec/vy8ton9jSWdVfaCAQAAAAUinl4V72kGrorK0N3MmfCdtV0HqCarpf7asv+BWH12DIZKI2v9ySLpnxcJX3cim0bN6/Yeu32t23YOHTF8BXDm96x8syVZw+edfZZK9ZvGBkerP0MobsgXghhfPph67XbPzE0MjK8ZWutMNv+JenjlqTrSfq4/reHwbHljcfEO6aurzSpvtm7UXTsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/7NrdyFynfUfwJ8zMzsz3Tb/zJ++TUOzGfJSohZN4lZSLZ0DgoU2CVkKMlNdS7AJFjdNaJMS69gGbGuCIrQEQiQXRmKxtXjTF1vEvhCI1GjAjUHaor3QC6XVSlpyISkj2Z0zOzM7s7MOtdvGz+dizszz/J7nd565WPieHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgA/aZG10vFIeqw5HIUQ9aupdJHPpbByXBuj75ed3fj83cnZ161guM8BGAAAAQF9JDh9qjuRDLpMO6XDV1KfloWUizOR+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgf89kbXS8Uh6rXhyFEPWoqXeRzKWzcVyau0XXbd9458nPvDoy8tfWseJAJwAAAAD6SXJ4qjmSD8WwIgxFV7XVJSF+Scf6zrpkn6XzrOt8dtCrbsU8666ZZ93H+tRtalz3BAAAAPjoS/J/pjlSCLnMop75v1+uT+qWddSlG9c+vxUAAAAA/guS/J9rjhRDLlNs5vX55v3lHXXJ+n7/t0/Wr+qxvt//8zc2rv5PDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfHZO10fFKeayajkKIetTUu0jm0tk4Lg3Qd90Lw3+/5dhDy1vHcpkBNgIAAAD6SnL4TPTOh1xmOAyFi6dy/8hNh5/+4tPPjoYQpmN+Nhv2bNm16+51069J3doTx4a+d/ytb82qWzv9umAHBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3jeTtdHxSnmselEUQtSjpt5FMpfOxnFpgL6vf+4Lf3789HNvto4VB9gHAAAA6C/J4TPZPx+KIRuy4YqpT61Z/7xUx/pezwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAC8c937jv61smJrbe7Y033njTfLPQf5kAAID327IQhfp/6MrNC33XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAh8FkbXS8Uh6r5qMQoh419S6SuXQ2jksD9I2fP5lbdPaFl1rHigPsAwAAAPSX5PCZ7J8PxTAUhsLlU5+6PROYyv+FD/AmAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgA+VydroeKU8Vl0UhRD1qKl3kcyls3Fc6rYoNXffx/Ye+uzRxd+9uXUslxnoCAAAAEAfSQ7PNkfyIZf5eMiFqxufJ9oXROnGtftzgZl1O9uWDc97Xa1tXXre6/Z1nCzTOM30unyyX2H62lxXmr2u1LKuGJrtS23rwoG2VYv63GcAAACABZTk/1xzpBBymVxLzv1JW31BzgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAepisjY5XymPVKAoh6lFT7yKZS2fjuDRA3/t+8/+XfOWn+3e3jhUH2AcAAADoL8nhM9k/H4phafi/sHQq94dCe31S94/KuaOP/vMvq0NYc8WpkUzntj9M3vzq9Rtf7HwJIdVenQphcaNf1KPfr3/36L0r6+ceD2HN5emrZ/ULc/dr3zKuP1PZunHX8VM7+3w5AAAAcIFI8v9Qc6QQcpm7eub/JHn3yf9NUwF88b17f35Z47WRyDtWpAqNfqke/T6/8sk/rVr/t7fO5/+5+n3q0Pajl7U1nB7pEMX18vbdm05ddySVnHq6f7qjf/K9fOmbb/5r255Hzk33z4d8Y3xJplv/2a8dLorrE6mD1Q3vHay198/0OP9Dv33p9C+X7H/3fP93lg03+18zx/nn7j9868MHrj90bFN7/xBCqVv/t9+9OVz5hzsf7Dz/cMfGrd9862uHKK6fWH7myPrDxRva+0cd/ZPv/2enHzvw40e+82zSP/mtyOoV8+2f6uj/yr5L9778wOYl7f1TPc7/4m2vjuwoffv3nee/o23XTM+7mH3+J6596vbXtsT3d04BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABcWCZro+OV8lg1FYUQ9aipd5HMpbNxXBqg7xu3nHz7tv0/+kHrWHGAfQAAAID+khw+k/3zoRiyIRuGp3L/M5WtG3cdP7UzFKZno8Y1M7Hjnl2f2LZj9113LNCdAwAAAPOV5P9Mc6QQcpmVYaiR/8vbd286dd2RVJL/U0n+33bnxNY1oVn3yr5L9778wOYlzecEIUz9LCB/vu7TM3U33XiycOaPX1vVtW7dTN2J5WeOrD9cvCGpC611a0Pz+cQT1z51+2tb4vub99da98mv7phoPJ5I9h2+9eED1x86tql5jsZ1uLFvUjeROljd8N7BWlKXblzzjXMDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALNN1kbHK+WxakiHEPWoqXeRzKWzcVwaoO+Glb948JKzzy1tHctlBtgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4N/swIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYb9+QuOo4jiAv7ebbba7SZu0glExTaui1INFQUQvKirSihQ8VYpUW3sQBUFEqQdTacVSFS+C1UsRFdQoBQUbi6VVUvFf8eJBBYXqQSjFgHYpHlSyO7PZTHa67aQe1M8Hwpv35s13fjPzdjYLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwL9Kf99Isz2y85HGnRfe+vlT95988vYPH9p++RNv/Ty2+ebP9tVePzW1ZeXW725ZvvnAA2sn97xy+PfB9/881jP48VazOulWQ4gnYgjVj6ZffHrqi/NnxmIIoRyHxkMYjssOD8dMwpo/Qghb2nXO3fneyWu2zrTbd/fPGV+aCcleV6iX03pahubWy39LNVln2xqPXRl+uGnDjq9WvPtOZeL4+OyUWO1YTyEs2dR5fCWEsDj5m5GutpH04KRdH0KodRx3XY+6LjnD+q/K6V+UtIuStt4jJ92/KtMvZeZl+6lKpq31ON9C5dVRdF4vA5l+9mW0UHl1puPDSftB0q4+m/DK7GY5hlIMfe3yH4yzayR0PLcYYvOwartf6oxpXn+mHzP9UqZfrmSuq3neelpXnDuezsuMp6/jvmR8Zee7uou7csYvSNpq8kE9lfZDdqOlPm+jfV1NaV3Tp6mlU/kM552tUsc7qNt4+8EnD6OejNXjsnnH/NVFum9qw7OXlTd+fGQop464Lyb5sVD+ti+HB+55e9ejI3n5m0pJfqlQ/o/rjv56965XX87NfyHNLxfKv/pg7cS6T3auyr0/0+n96WvlL5o/53T59x779LkV59030e1ZN/P3pvnVQvXfOHm0f7Bx8FBu/WvS+7O4UP73N9z205vf7D+emx/S/Fqh/I2TDz/fP9q4Ijf/UOujUG+u0ALr57eJa78dHf1lLC//6/T+D3bJjz3z3xjfc/1rS3evzV2f69P7M1So/jsuPbBjoLH/4rx3Z9x7rr45Af6flif/Yz2T9Iv+zlyojt8LL431tb6BBpK/wXN5ooyZ8yz5B/MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAv9mBAxIAAAAAQf9ftyNQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4KgAA//9JjSB3") syz_open_procfs(0x0, &(0x7f0000000040)='net/snmp6\x00') ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) [ 112.824958][ T5313] Bluetooth: hci0: command tx timeout [ 113.011861][ T5332] loop0: detected capacity change from 0 to 32768 [ 113.144086][ T5332] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 113.150075][ T5332] bcachefs (loop0): recovering from clean shutdown, journal seq 10 [ 113.153697][ T5332] bcachefs (loop0): Version upgrade required: [ 113.153697][ T5332] Version upgrade from 0.24: unwritten_extents to 1.7: mi_btree_bitmap incomplete [ 113.153697][ T5332] Doing incompatible version upgrade from 0.24: unwritten_extents to 1.25: extent_flags [ 113.153697][ T5332] running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,set_fs_needs_rebalance [ 113.190789][ T5332] bcachefs (loop0): error validating btree node on loop0 at btree extents level 0/0 [ 113.190810][ T5332] u64s 11 type btree_ptr_v2 18446744073707239423:U64_MAX:U32_MAX len 0 ver 0: seq c6c25c03258c59c5 written 16 min_key POS_MIN durability: 1 ptr: 0:27:0 gen 0 [ 113.190822][ T5332] node offset 0/16 bset u64s 0: incorrect max key SPOS_MAX [ 113.204094][ T5332] bcachefs (loop0): running explicit recovery pass check_topology (2), currently at recovery_pass_empty (0) [ 113.209028][ T5332] bcachefs (loop0): flagging btree extents lost data [ 113.211683][ T5332] bcachefs (loop0): running explicit recovery pass scan_for_btree_nodes (1), currently at recovery_pass_empty (0) [ 113.218335][ T5332] error reading btree root btree=extents level=0: btree_node_read_error, fixing [ 113.225738][ T5332] bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0 [ 113.225753][ T5332] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 113.225763][ T5332] node offset 0/24 bset u64s 0: incorrect btree id [ 113.237166][ T5332] bcachefs (loop0): flagging btree alloc lost data [ 113.240206][ T5332] error reading btree root btree=alloc level=0: btree_node_read_error, fixing [ 113.246909][ T5332] bcachefs (loop0): error validating btree node on loop0 at btree lru level 0/0 [ 113.246924][ T5332] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 28f61e078e70b95c written 16 min_key 0:562640715776:0 durability: 1 ptr: 0:28:0 gen 0 [ 113.246933][ T5332] node offset 0/16: incorrect min_key: got POS_MIN should be 0:562640715776:0 [ 113.259517][ T5332] bcachefs (loop0): flagging btree lru lost data [ 113.263190][ T5332] error reading btree root btree=lru level=0: btree_node_read_error, fixing [ 113.267919][ T5332] invalid bkey in btree_node btree=freespace level=0: u64s 5 type deleted 0:32:0 len 16777216 ver 0 [ 113.267938][ T5332] size != 0: delete?, fixing [ 113.275574][ T5332] bcachefs (loop0): flagging btree freespace lost data [ 113.279278][ T5332] error reading btree root btree=freespace level=0: btree_node_read_error, fixing [ 113.283804][ T5332] bcachefs (loop0): error validating btree node on loop0 at btree backpointers level 0/0 [ 113.283816][ T5332] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 4a8b0fa43a9980a6 written 24 min_key POS_MIN durability: 1 ptr: 0:37:0 gen 0 [ 113.283825][ T5332] node offset 0/24 bset u64s 0: invalid bkey format: field 2 too large: 4294967295 + 512 > 4294967295 [ 113.283833][ T5332] u64s 3 fields 64:0, 64:0, 32:512, 0:0, 0:0, 0:0 [ 113.299526][ T5332] bcachefs (loop0): flagging btree backpointers lost data [ 113.304684][ T5332] error reading btree root btree=backpointers level=0: btree_node_read_error, fixing [ 113.309219][ T5332] bcachefs (loop0): error validating btree node on loop0 at btree deleted_inodes level 0/0 [ 113.309233][ T5332] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1db8f60c84bb244c written 8 min_key 0:1970324836974592:0 durability: 1 ptr: 0:42:0 gen 0 [ 113.309243][ T5332] node offset 0/8: incorrect min_key: got POS_MIN should be 0:1970324836974592:0 [ 113.321342][ T5332] bcachefs (loop0): flagging btree deleted_inodes lost data [ 113.324389][ T5332] error reading btree root btree=deleted_inodes level=0: btree_node_read_error, fixing [ 113.329053][ T5332] bcachefs (loop0): scan_for_btree_nodes... [ 113.341240][ T5332] bcachefs (loop0): btree node scan found 8 nodes after overwrites [ 113.346636][ T5332] done [ 113.349733][ T5332] bcachefs (loop0): check_topology... [ 113.350583][ T5332] bcachefs (loop0): btree root extents unreadable, must recover from scan [ 113.356209][ T5332] bcachefs (loop0): bch2_get_scanned_nodes(): recovery btree=extents level=0 POS_MIN - SPOS_MAX [ 113.360522][ T5332] bcachefs (loop0): bch2_get_scanned_nodes(): recovering u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c6c25c03258c59c5 written 16 min_key POS_MIN durability: 1 ptr: 0:27:0 gen 0 [ 113.370775][ T5327] bcachefs (loop0): error validating btree node at btree extents level 0/0 [ 113.370795][ T5327] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c6c25c03258c59c5 written 16 min_key POS_MIN durability: 1 ptr: 0:27:0 gen 0 [ 113.370804][ T5327] node offset 8/16 bset u64s 49 bset byte offset 288: bad k->u64s 0 (min 5 max 255), shutting down [ 113.385280][ T5327] bcachefs (loop0): inconsistency detected - emergency read only at journal seq 10 [ 113.393087][ T5332] Topology repair: unreadable btree node at [ 113.393106][ T5332] btree=extents level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c6c25c03258c59c5 written 16 min_key POS_MIN durability: 1 ptr: 0:27:0 gen 0, fixing [ 113.402376][ T5332] empty interior btree node at btree=extents level=1 [ 113.402389][ T5332] u64s 5 type btree_ptr SPOS_MAX len 0 ver 0, fixing [ 113.407451][ T5332] bcachefs (loop0): empty btree root extents [ 113.410737][ T5332] bcachefs (loop0): btree root deleted_inodes unreadable, must recover from scan [ 113.414741][ T5332] bcachefs (loop0): bch2_get_scanned_nodes(): recovery btree=deleted_inodes level=0 POS_MIN - SPOS_MAX [ 113.419094][ T5332] bcachefs (loop0): bch2_get_scanned_nodes(): recovering u64s 11 type btree_ptr_v2 U64_MAX:U64_MAX:4278386687 len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 113.426545][ T5332] bcachefs (loop0): bch2_get_scanned_nodes(): recovering u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1db8f60c84bb244c written 8 min_key R U64_MAX:U64_MAX:4278386688 durability: 1 ptr: 0:42:0 gen 0 [ 113.435854][ T5327] bcachefs (loop0): error validating btree node at btree deleted_inodes level 0/0 [ 113.435868][ T5327] u64s 11 type btree_ptr_v2 U64_MAX:U64_MAX:4278386687 len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 113.435877][ T5327] node offset 8/24 bset u64s 375 bset byte offset 184: keys out of order: u64s 11 type alloc_v4 0:32:0 len 0 ver 0 > u64s 11 type alloc_v4 0:2:0 len 0 ver 0, fixing [ 113.451892][ T5327] bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error [ 113.451892][ T5327] btree=deleted_inodes level=0 u64s 11 type btree_ptr_v2 U64_MAX:U64_MAX:4278386687 len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 113.464582][ T5332] done [ 113.465647][ T5332] bcachefs (loop0): accounting_read... done [ 113.468475][ T5332] bcachefs (loop0): alloc_read... done [ 113.470576][ T5332] bcachefs (loop0): snapshots_read... done [ 113.473098][ T5332] bcachefs (loop0): check_allocations... [ 113.477102][ T5332] bucket 0:38 data type btree ptr gen 0 missing in alloc btree [ 113.477117][ T5332] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing [ 113.489057][ T5332] bucket 0:41 data type btree ptr gen 0 missing in alloc btree [ 113.489070][ T5332] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0, fixing [ 113.497169][ T5332] bucket 0:31 data type btree ptr gen 0 missing in alloc btree [ 113.497181][ T5332] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2285c34bed0abe32 written 16 min_key POS_MIN durability: 1 ptr: 0:31:0 gen 0, fixing [ 113.507194][ T5332] bucket 0:35 data type btree ptr gen 0 missing in alloc btree [ 113.507208][ T5332] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0, fixing [ 113.517376][ T5332] bucket 0:32 data type btree ptr gen 0 missing in alloc btree [ 113.517392][ T5332] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0, fixing [ 113.527834][ T5332] bucket 0:26 data type btree ptr gen 0 missing in alloc btree [ 113.527848][ T5332] while marking u64s 11 type btree_ptr_v2 U64_MAX:U64_MAX:4278386687 len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing [ 113.540310][ T5332] done [ 113.541785][ T5332] bcachefs (loop0): going read-write [ 113.546349][ T5332] bcachefs (loop0): journal_replay... [ 113.546416][ T5332] bcachefs (loop0): bch2_journal_replay(): error journal_shutdown [ 113.551705][ T5332] bcachefs (loop0): bch2_fs_recovery(): error journal_shutdown [ 113.554624][ T5332] bcachefs (loop0): bch2_fs_start(): error starting filesystem journal_shutdown [ 113.558597][ T5332] bcachefs (loop0): shutting down [ 113.560733][ T5332] bcachefs (loop0): going read-only [ 113.563269][ T5332] bcachefs (loop0): flushing journal and stopping allocators, journal seq 10 [ 113.566467][ T5332] bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 10 [ 113.570686][ T5332] bcachefs (loop0): unclean shutdown complete, journal seq 10 [ 113.574403][ T47] bcachefs (loop0): btree_path_down(): fatal error node not found at pos U64_MAX:U64_MAX:4278386687 within parent node u64s 5 type btree_ptr SPOS_MAX len 0 ver 0 [ 113.583610][ T47] bcachefs (loop0): async_btree_node_rewrite_work(): error btree_need_topology_repair [ 113.587712][ T5332] bcachefs (loop0): finished waiting for writes to stop [ 113.590449][ T5332] bcachefs (loop0): done going read-only, filesystem not clean [ 113.607478][ T5332] bcachefs (loop0): shutdown complete [ 113.612019][ T1036] ================================================================== [ 113.615848][ T1036] BUG: KASAN: slab-use-after-free in percpu_ref_put+0xda/0x250 [ 113.619460][ T1036] Read of size 8 at addr ffff88803e7000b0 by task kworker/u4:7/1036 [ 113.623148][ T1036] [ 113.624347][ T1036] CPU: 0 UID: 0 PID: 1036 Comm: kworker/u4:7 Not tainted 6.14.0-syzkaller-07422-gacb4f33713b9 #0 PREEMPT(full) [ 113.624364][ T1036] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 113.624372][ T1036] Workqueue: loop0 loop_workfn [ 113.624393][ T1036] Call Trace: [ 113.624401][ T1036] [ 113.624407][ T1036] dump_stack_lvl+0x241/0x360 [ 113.624425][ T1036] ? __pfx_dump_stack_lvl+0x10/0x10 [ 113.624439][ T1036] ? __virt_addr_valid+0x183/0x530 [ 113.624453][ T1036] ? rcu_is_watching+0x15/0xb0 [ 113.624465][ T1036] ? __virt_addr_valid+0x183/0x530 [ 113.624478][ T1036] ? lock_release+0x4e/0x3e0 [ 113.624495][ T1036] ? __virt_addr_valid+0x183/0x530 [ 113.624508][ T1036] ? __virt_addr_valid+0x183/0x530 [ 113.624521][ T1036] print_report+0x16e/0x5b0 [ 113.624535][ T1036] ? __virt_addr_valid+0x183/0x530 [ 113.624577][ T1036] ? __virt_addr_valid+0x183/0x530 [ 113.624589][ T1036] ? __virt_addr_valid+0x45f/0x530 [ 113.624601][ T1036] ? __phys_addr+0xba/0x170 [ 113.624614][ T1036] ? percpu_ref_put+0xda/0x250 [ 113.624624][ T1036] kasan_report+0x143/0x180 [ 113.624639][ T1036] ? percpu_ref_put+0xda/0x250 [ 113.624651][ T1036] ? percpu_ref_put+0x1f/0x250 [ 113.624660][ T1036] percpu_ref_put+0xda/0x250 [ 113.624671][ T1036] blk_update_request+0x5e5/0x1160 [ 113.624690][ T1036] blk_mq_end_request+0x3e/0x70 [ 113.624704][ T1036] loop_process_work+0x1bdf/0x21d0 [ 113.624718][ T1036] ? enqueue_timer+0x221/0x570 [ 113.624739][ T1036] ? __pfx_loop_process_work+0x10/0x10 [ 113.624753][ T1036] ? xfd_validate_state+0x6e/0x150 [ 113.624767][ T1036] ? do_raw_spin_lock+0x151/0x370 [ 113.624782][ T1036] ? do_raw_spin_unlock+0x58/0x8b0 [ 113.624795][ T1036] ? look_up_lock_class+0x7b/0x170 [ 113.624868][ T1036] ? register_lock_class+0x54/0x330 [ 113.624885][ T1036] ? __lock_acquire+0xad5/0xd80 [ 113.624900][ T1036] ? lockdep_hardirqs_on+0x9d/0x150 [ 113.624926][ T1036] ? process_scheduled_works+0x9cb/0x18e0 [ 113.624937][ T1036] process_scheduled_works+0xac3/0x18e0 [ 113.624952][ T1036] ? __pfx_process_scheduled_works+0x10/0x10 [ 113.624964][ T1036] ? assign_work+0x367/0x3d0 [ 113.624975][ T1036] worker_thread+0x870/0xd50 [ 113.624989][ T1036] ? __kthread_parkme+0x1a8/0x200 [ 113.625002][ T1036] ? __pfx_worker_thread+0x10/0x10 [ 113.625013][ T1036] kthread+0x7b7/0x940 [ 113.625027][ T1036] ? __pfx_worker_thread+0x10/0x10 [ 113.625037][ T1036] ? __pfx_kthread+0x10/0x10 [ 113.625050][ T1036] ? __pfx_kthread+0x10/0x10 [ 113.625062][ T1036] ? __pfx_kthread+0x10/0x10 [ 113.625074][ T1036] ? __pfx_kthread+0x10/0x10 [ 113.625086][ T1036] ? _raw_spin_unlock_irq+0x23/0x50 [ 113.625099][ T1036] ? lockdep_hardirqs_on+0x9d/0x150 [ 113.625113][ T1036] ? __pfx_kthread+0x10/0x10 [ 113.625125][ T1036] ret_from_fork+0x4b/0x80 [ 113.625137][ T1036] ? __pfx_kthread+0x10/0x10 [ 113.625150][ T1036] ret_from_fork_asm+0x1a/0x30 [ 113.625168][ T1036] [ 113.625172][ T1036] [ 113.736822][ T1036] Allocated by task 5332: [ 113.738399][ T1036] kasan_save_track+0x3f/0x80 [ 113.740187][ T1036] __kasan_kmalloc+0x9d/0xb0 [ 113.742022][ T1036] __kmalloc_cache_noprof+0x236/0x370 [ 113.744235][ T1036] __bch2_dev_alloc+0x57/0xa60 [ 113.745935][ T1036] bch2_dev_alloc+0xd6/0x180 [ 113.747446][ T1036] bch2_fs_open+0x315f/0x32a0 [ 113.748928][ T1036] bch2_fs_get_tree+0x77b/0x18d0 [ 113.750556][ T1036] vfs_get_tree+0x90/0x2b0 [ 113.752058][ T1036] do_new_mount+0x2cf/0xb70 [ 113.753711][ T1036] __se_sys_mount+0x38c/0x400 [ 113.755529][ T1036] do_syscall_64+0xf3/0x230 [ 113.757313][ T1036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.759692][ T1036] [ 113.760631][ T1036] Freed by task 5332: [ 113.762099][ T1036] kasan_save_track+0x3f/0x80 [ 113.763977][ T1036] kasan_save_free_info+0x40/0x50 [ 113.765915][ T1036] __kasan_slab_free+0x59/0x70 [ 113.767717][ T1036] kfree+0x198/0x430 [ 113.769257][ T1036] kobject_put+0x22f/0x480 [ 113.770802][ T1036] bch2_fs_free+0x27b/0x3c0 [ 113.772282][ T1036] deactivate_locked_super+0xc4/0x130 [ 113.774071][ T1036] bch2_fs_get_tree+0xd41/0x18d0 [ 113.775745][ T1036] vfs_get_tree+0x90/0x2b0 [ 113.777370][ T1036] do_new_mount+0x2cf/0xb70 [ 113.779030][ T1036] __se_sys_mount+0x38c/0x400 [ 113.780720][ T1036] do_syscall_64+0xf3/0x230 [ 113.782268][ T1036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.784349][ T1036] [ 113.785550][ T1036] Last potentially related work creation: [ 113.787631][ T1036] kasan_save_stack+0x3f/0x60 [ 113.789437][ T1036] kasan_record_aux_stack+0xbf/0xd0 [ 113.791439][ T1036] insert_work+0x3e/0x330 [ 113.793149][ T1036] __queue_work+0xda3/0x10a0 [ 113.794962][ T1036] queue_work_on+0x1c4/0x380 [ 113.796795][ T1036] bch2_dev_do_invalidates+0x17a/0x1f0 [ 113.798987][ T1036] bch2_do_invalidates+0x29/0x60 [ 113.800951][ T1036] __bch2_fs_read_write+0x386/0x3b0 [ 113.802986][ T1036] bch2_run_recovery_pass+0xf0/0x1e0 [ 113.805129][ T1036] bch2_run_recovery_passes+0x2ad/0xa90 [ 113.807321][ T1036] bch2_fs_recovery+0x292a/0x3e20 [ 113.809313][ T1036] bch2_fs_start+0x37c/0x620 [ 113.811184][ T1036] bch2_fs_get_tree+0x1270/0x18d0 [ 113.813205][ T1036] vfs_get_tree+0x90/0x2b0 [ 113.814942][ T1036] do_new_mount+0x2cf/0xb70 [ 113.816801][ T1036] __se_sys_mount+0x38c/0x400 [ 113.818614][ T1036] do_syscall_64+0xf3/0x230 [ 113.820398][ T1036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.822840][ T1036] [ 113.823714][ T1036] Second to last potentially related work creation: [ 113.826184][ T1036] kasan_save_stack+0x3f/0x60 [ 113.827994][ T1036] kasan_record_aux_stack+0xbf/0xd0 [ 113.829894][ T1036] insert_work+0x3e/0x330 [ 113.831428][ T1036] __queue_work+0xda3/0x10a0 [ 113.833225][ T1036] queue_work_on+0x1c4/0x380 [ 113.835042][ T1036] bch2_dev_do_discards+0x17a/0x1f0 [ 113.837096][ T1036] bch2_do_discards+0x29/0x60 [ 113.838961][ T1036] __bch2_fs_read_write+0x37e/0x3b0 [ 113.840862][ T1036] bch2_run_recovery_pass+0xf0/0x1e0 [ 113.842881][ T1036] bch2_run_recovery_passes+0x2ad/0xa90 [ 113.844952][ T1036] bch2_fs_recovery+0x292a/0x3e20 [ 113.846820][ T1036] bch2_fs_start+0x37c/0x620 [ 113.848655][ T1036] bch2_fs_get_tree+0x1270/0x18d0 [ 113.850558][ T1036] vfs_get_tree+0x90/0x2b0 [ 113.852215][ T1036] do_new_mount+0x2cf/0xb70 [ 113.853955][ T1036] __se_sys_mount+0x38c/0x400 [ 113.855782][ T1036] do_syscall_64+0xf3/0x230 [ 113.857520][ T1036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.859513][ T1036] [ 113.860444][ T1036] The buggy address belongs to the object at ffff88803e700000 [ 113.860444][ T1036] which belongs to the cache kmalloc-4k of size 4096 [ 113.865780][ T1036] The buggy address is located 176 bytes inside of [ 113.865780][ T1036] freed 4096-byte region [ffff88803e700000, ffff88803e701000) [ 113.870950][ T1036] [ 113.871889][ T1036] The buggy address belongs to the physical page: [ 113.874452][ T1036] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3e700 [ 113.877697][ T1036] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 113.880975][ T1036] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 113.883973][ T1036] page_type: f5(slab) [ 113.885632][ T1036] raw: 04fff00000000040 ffff88801b042140 ffffea0000d9fa00 dead000000000002 [ 113.888830][ T1036] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 113.892026][ T1036] head: 04fff00000000040 ffff88801b042140 ffffea0000d9fa00 dead000000000002 [ 113.895086][ T1036] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 113.898356][ T1036] head: 04fff00000000003 ffffea0000f9c001 ffffffffffffffff 0000000000000000 [ 113.901528][ T1036] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 113.904912][ T1036] page dumped because: kasan: bad access detected [ 113.907346][ T1036] page_owner tracks the page as allocated [ 113.909519][ T1036] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4796, tgid 4796 (v4l_id), ts 55342099737, free_ts 55317362452 [ 113.917059][ T1036] post_alloc_hook+0x1f4/0x240 [ 113.918937][ T1036] get_page_from_freelist+0x3695/0x37e0 [ 113.921078][ T1036] __alloc_frozen_pages_noprof+0x2c5/0x7b0 [ 113.923351][ T1036] alloc_pages_mpol+0x339/0x690 [ 113.925304][ T1036] allocate_slab+0x8f/0x3a0 [ 113.927108][ T1036] ___slab_alloc+0xc3b/0x1500 [ 113.928882][ T1036] __slab_alloc+0x58/0xa0 [ 113.930511][ T1036] __kmalloc_noprof+0x2ea/0x4d0 [ 113.932391][ T1036] tomoyo_realpath_from_path+0xcf/0x5e0 [ 113.934548][ T1036] tomoyo_path_number_perm+0x245/0x790 [ 113.936733][ T1036] security_file_ioctl+0xc6/0x2a0 [ 113.938548][ T1036] __se_sys_ioctl+0x46/0x160 [ 113.940257][ T1036] do_syscall_64+0xf3/0x230 [ 113.941969][ T1036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.944127][ T1036] page last free pid 4799 tgid 4799 stack trace: [ 113.946501][ T1036] free_frozen_pages+0xe16/0x10f0 [ 113.948400][ T1036] __put_partials+0x160/0x1c0 [ 113.950158][ T1036] put_cpu_partial+0x17e/0x250 [ 113.952045][ T1036] __slab_free+0x294/0x390 [ 113.953897][ T1036] qlist_free_all+0x9a/0x140 [ 113.955647][ T1036] kasan_quarantine_reduce+0x14f/0x170 [ 113.957683][ T1036] __kasan_slab_alloc+0x23/0x80 [ 113.959505][ T1036] kmem_cache_alloc_noprof+0x1e1/0x390 [ 113.961564][ T1036] vm_area_alloc+0x24/0x1d0 [ 113.963270][ T1036] mmap_region+0x1b10/0x2fc0 [ 113.965152][ T1036] do_mmap+0xd42/0x1420 [ 113.966765][ T1036] vm_mmap_pgoff+0x2a2/0x530 [ 113.968418][ T1036] ksys_mmap_pgoff+0x4ee/0x720 [ 113.970245][ T1036] do_syscall_64+0xf3/0x230 [ 113.971993][ T1036] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.974239][ T1036] [ 113.975212][ T1036] Memory state around the buggy address: [ 113.977424][ T1036] ffff88803e6fff80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 113.980267][ T1036] ffff88803e700000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.983290][ T1036] >ffff88803e700080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.986225][ T1036] ^ [ 113.988325][ T1036] ffff88803e700100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.991409][ T1036] ffff88803e700180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 113.994510][ T1036] ================================================================== [ 114.024288][ T1036] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 114.027119][ T1036] CPU: 0 UID: 0 PID: 1036 Comm: kworker/u4:7 Not tainted 6.14.0-syzkaller-07422-gacb4f33713b9 #0 PREEMPT(full) [ 114.031440][ T1036] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 114.035656][ T1036] Workqueue: loop0 loop_workfn [ 114.037601][ T1036] Call Trace: [ 114.038932][ T1036] [ 114.040061][ T1036] dump_stack_lvl+0x241/0x360 [ 114.041929][ T1036] ? __pfx_dump_stack_lvl+0x10/0x10 [ 114.043944][ T1036] ? __pfx__printk+0x10/0x10 [ 114.045723][ T1036] ? vscnprintf+0x5d/0x90 [ 114.047476][ T1036] panic+0x349/0x880 [ 114.049053][ T1036] ? check_panic_on_warn+0x21/0xb0 [ 114.050970][ T1036] ? __pfx_panic+0x10/0x10 [ 114.052700][ T1036] ? _raw_spin_unlock_irqrestore+0x134/0x140 [ 114.055023][ T1036] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 114.057554][ T1036] ? print_report+0x519/0x5b0 [ 114.059295][ T1036] check_panic_on_warn+0x86/0xb0 [ 114.061092][ T1036] ? percpu_ref_put+0xda/0x250 [ 114.062800][ T1036] end_report+0x77/0x160 [ 114.064381][ T1036] kasan_report+0x154/0x180 [ 114.065837][ T1036] ? percpu_ref_put+0xda/0x250 [ 114.067600][ T1036] ? percpu_ref_put+0x1f/0x250 [ 114.069368][ T1036] percpu_ref_put+0xda/0x250 [ 114.071076][ T1036] blk_update_request+0x5e5/0x1160 [ 114.073197][ T1036] blk_mq_end_request+0x3e/0x70 [ 114.075151][ T1036] loop_process_work+0x1bdf/0x21d0 [ 114.077634][ T1036] ? enqueue_timer+0x221/0x570 [ 114.079839][ T1036] ? __pfx_loop_process_work+0x10/0x10 [ 114.081913][ T1036] ? xfd_validate_state+0x6e/0x150 [ 114.084007][ T1036] ? do_raw_spin_lock+0x151/0x370 [ 114.085992][ T1036] ? do_raw_spin_unlock+0x58/0x8b0 [ 114.087966][ T1036] ? look_up_lock_class+0x7b/0x170 [ 114.089914][ T1036] ? register_lock_class+0x54/0x330 [ 114.091943][ T1036] ? __lock_acquire+0xad5/0xd80 [ 114.093911][ T1036] ? lockdep_hardirqs_on+0x9d/0x150 [ 114.095910][ T1036] ? process_scheduled_works+0x9cb/0x18e0 [ 114.098063][ T1036] process_scheduled_works+0xac3/0x18e0 [ 114.100110][ T1036] ? __pfx_process_scheduled_works+0x10/0x10 [ 114.102388][ T1036] ? assign_work+0x367/0x3d0 [ 114.104235][ T1036] worker_thread+0x870/0xd50 [ 114.106122][ T1036] ? __kthread_parkme+0x1a8/0x200 [ 114.108031][ T1036] ? __pfx_worker_thread+0x10/0x10 [ 114.110038][ T1036] kthread+0x7b7/0x940 [ 114.111574][ T1036] ? __pfx_worker_thread+0x10/0x10 [ 114.113537][ T1036] ? __pfx_kthread+0x10/0x10 [ 114.115342][ T1036] ? __pfx_kthread+0x10/0x10 [ 114.117120][ T1036] ? __pfx_kthread+0x10/0x10 [ 114.118835][ T1036] ? __pfx_kthread+0x10/0x10 [ 114.120624][ T1036] ? _raw_spin_unlock_irq+0x23/0x50 [ 114.122533][ T1036] ? lockdep_hardirqs_on+0x9d/0x150 [ 114.124695][ T1036] ? __pfx_kthread+0x10/0x10 [ 114.126742][ T1036] ret_from_fork+0x4b/0x80 [ 114.128521][ T1036] ? __pfx_kthread+0x10/0x10 [ 114.130329][ T1036] ret_from_fork_asm+0x1a/0x30 [ 114.132172][ T1036] [ 114.133657][ T1036] Kernel Offset: disabled [ 114.135383][ T1036] Rebooting in 86400 seconds..