Warning: Permanently added '10.128.0.165' (ED25519) to the list of known hosts. 2024/05/01 15:25:23 fuzzer started 2024/05/01 15:25:23 dialing manager at 10.128.0.169:30005 [ 53.423803][ T5091] cgroup: Unknown subsys name 'net' [ 53.558576][ T5091] cgroup: Unknown subsys name 'rlimit' 2024/05/01 15:25:25 code coverage: enabled 2024/05/01 15:25:25 comparison tracing: enabled 2024/05/01 15:25:25 extra coverage: enabled 2024/05/01 15:25:25 delay kcov mmap: enabled 2024/05/01 15:25:25 setuid sandbox: enabled 2024/05/01 15:25:25 namespace sandbox: enabled 2024/05/01 15:25:25 Android sandbox: /sys/fs/selinux/policy does not exist 2024/05/01 15:25:25 fault injection: enabled 2024/05/01 15:25:25 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2024/05/01 15:25:25 net packet injection: enabled 2024/05/01 15:25:25 net device setup: enabled 2024/05/01 15:25:25 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2024/05/01 15:25:25 devlink PCI setup: PCI device 0000:00:10.0 is not available 2024/05/01 15:25:25 NIC VF setup: PCI device 0000:00:11.0 is not available 2024/05/01 15:25:25 USB emulation: enabled 2024/05/01 15:25:25 hci packet injection: enabled 2024/05/01 15:25:25 wifi device emulation: enabled 2024/05/01 15:25:25 802.15.4 emulation: enabled 2024/05/01 15:25:25 swap file: enabled 2024/05/01 15:25:25 starting 5 executor processes [ 54.945576][ T5091] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 56.685376][ T5107] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 56.694254][ T5107] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 56.708988][ T5112] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 56.716707][ T5112] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 56.726840][ T5112] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 56.729068][ T5114] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 56.734800][ T5112] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 56.749451][ T5114] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 56.749966][ T5112] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 56.757905][ T5114] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 56.764604][ T5112] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 56.772648][ T5114] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 56.777789][ T5112] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 56.785194][ T5114] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 56.811351][ T5107] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 56.817254][ T5112] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 56.819640][ T5107] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 56.835207][ T5107] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 56.837773][ T5112] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 56.854856][ T5112] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 56.856144][ T5107] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 56.869402][ T5107] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 56.875831][ T4493] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 56.881131][ T5107] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 56.890765][ T5107] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 56.911953][ T5114] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 56.920670][ T5114] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 56.931473][ T5114] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 56.940366][ T5114] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 56.948589][ T5114] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 57.385612][ T5116] chnl_net:caif_netlink_parms(): no params data found [ 57.524545][ T5108] chnl_net:caif_netlink_parms(): no params data found [ 57.552657][ T5109] chnl_net:caif_netlink_parms(): no params data found [ 57.617979][ T5105] chnl_net:caif_netlink_parms(): no params data found [ 57.644080][ T5116] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.651929][ T5116] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.659185][ T5116] bridge_slave_0: entered allmulticast mode [ 57.666340][ T5116] bridge_slave_0: entered promiscuous mode [ 57.699029][ T5116] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.706376][ T5116] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.713662][ T5116] bridge_slave_1: entered allmulticast mode [ 57.720358][ T5116] bridge_slave_1: entered promiscuous mode [ 57.757478][ T5120] chnl_net:caif_netlink_parms(): no params data found [ 57.790645][ T5116] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 57.827817][ T5108] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.835373][ T5108] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.843177][ T5108] bridge_slave_0: entered allmulticast mode [ 57.849857][ T5108] bridge_slave_0: entered promiscuous mode [ 57.883264][ T5116] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 57.908110][ T5108] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.915517][ T5108] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.922979][ T5108] bridge_slave_1: entered allmulticast mode [ 57.929593][ T5108] bridge_slave_1: entered promiscuous mode [ 57.957562][ T5109] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.967610][ T5109] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.975202][ T5109] bridge_slave_0: entered allmulticast mode [ 57.984992][ T5109] bridge_slave_0: entered promiscuous mode [ 57.993136][ T5109] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.000197][ T5109] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.007906][ T5109] bridge_slave_1: entered allmulticast mode [ 58.015443][ T5109] bridge_slave_1: entered promiscuous mode [ 58.053979][ T5105] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.061244][ T5105] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.068426][ T5105] bridge_slave_0: entered allmulticast mode [ 58.076057][ T5105] bridge_slave_0: entered promiscuous mode [ 58.095661][ T5108] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 58.112301][ T5108] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.142080][ T5116] team0: Port device team_slave_0 added [ 58.150682][ T5116] team0: Port device team_slave_1 added [ 58.156936][ T5105] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.165011][ T5105] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.174517][ T5105] bridge_slave_1: entered allmulticast mode [ 58.182462][ T5105] bridge_slave_1: entered promiscuous mode [ 58.216914][ T5109] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 58.280670][ T5108] team0: Port device team_slave_0 added [ 58.292374][ T5108] team0: Port device team_slave_1 added [ 58.299978][ T5109] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.319231][ T5116] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 58.326329][ T5116] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 58.352827][ T5116] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 58.370390][ T5105] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 58.379900][ T5120] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.387381][ T5120] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.394627][ T5120] bridge_slave_0: entered allmulticast mode [ 58.401828][ T5120] bridge_slave_0: entered promiscuous mode [ 58.409514][ T5120] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.416700][ T5120] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.424256][ T5120] bridge_slave_1: entered allmulticast mode [ 58.432734][ T5120] bridge_slave_1: entered promiscuous mode [ 58.474813][ T5116] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 58.482226][ T5116] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 58.508469][ T5116] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 58.525488][ T5105] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.567008][ T5108] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 58.574115][ T5108] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 58.600068][ T5108] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 58.613849][ T5108] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 58.621405][ T5108] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 58.647680][ T5108] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 58.673767][ T5109] team0: Port device team_slave_0 added [ 58.693617][ T5105] team0: Port device team_slave_0 added [ 58.703991][ T5120] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 58.729198][ T5109] team0: Port device team_slave_1 added [ 58.755305][ T5105] team0: Port device team_slave_1 added [ 58.763282][ T5120] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.806879][ T5116] hsr_slave_0: entered promiscuous mode [ 58.813392][ T5116] hsr_slave_1: entered promiscuous mode [ 58.859736][ T5120] team0: Port device team_slave_0 added [ 58.869017][ T5120] team0: Port device team_slave_1 added [ 58.887261][ T5109] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 58.894317][ T5109] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 58.921241][ T5114] Bluetooth: hci3: command tx timeout [ 58.921292][ T4493] Bluetooth: hci1: command tx timeout [ 58.932729][ T5112] Bluetooth: hci0: command tx timeout [ 58.932730][ T5109] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 58.940544][ T5109] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 58.956493][ T5109] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 58.982585][ T5109] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 58.993221][ T5112] Bluetooth: hci2: command tx timeout [ 58.998559][ T5105] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.005878][ T5112] Bluetooth: hci4: command tx timeout [ 59.006022][ T5105] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 59.038068][ T5105] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.062219][ T5108] hsr_slave_0: entered promiscuous mode [ 59.069414][ T5108] hsr_slave_1: entered promiscuous mode [ 59.076414][ T5108] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 59.084203][ T5108] Cannot create hsr debugfs directory [ 59.107650][ T5105] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.114749][ T5105] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 59.142104][ T5105] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 59.185036][ T5120] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.192408][ T5120] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 59.218454][ T5120] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.267287][ T5120] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.274557][ T5120] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 59.301174][ T5120] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 59.332007][ T5105] hsr_slave_0: entered promiscuous mode [ 59.338318][ T5105] hsr_slave_1: entered promiscuous mode [ 59.344666][ T5105] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 59.352312][ T5105] Cannot create hsr debugfs directory [ 59.406054][ T5109] hsr_slave_0: entered promiscuous mode [ 59.412667][ T5109] hsr_slave_1: entered promiscuous mode [ 59.418733][ T5109] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 59.426977][ T5109] Cannot create hsr debugfs directory [ 59.498185][ T5120] hsr_slave_0: entered promiscuous mode [ 59.505087][ T5120] hsr_slave_1: entered promiscuous mode [ 59.511676][ T5120] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 59.519242][ T5120] Cannot create hsr debugfs directory [ 59.854314][ T5116] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 59.866615][ T5116] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 59.886375][ T5116] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 59.904166][ T5116] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 59.952725][ T5108] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 59.963453][ T5108] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 59.979356][ T5108] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 59.998735][ T5108] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 60.072533][ T5105] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 60.082475][ T5105] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 60.103817][ T5105] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 60.115521][ T5105] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 60.201630][ T5109] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 60.232823][ T5109] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 60.242043][ T5109] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 60.260478][ T5109] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 60.304321][ T5116] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.376497][ T5120] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 60.386999][ T5120] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 60.399622][ T5120] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 60.414877][ T5120] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 60.484523][ T5108] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.507205][ T5116] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.539945][ T5108] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.560047][ T5157] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.567307][ T5157] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.589830][ T785] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.596998][ T785] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.637157][ T5161] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.644329][ T5161] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.669758][ T5109] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.685483][ T5105] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.730633][ T5159] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.737785][ T5159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.811565][ T5109] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.840539][ T5161] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.847845][ T5161] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.883397][ T5105] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.897263][ T5159] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.904405][ T5159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.944717][ T5120] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.956204][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.963420][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.994132][ T4493] Bluetooth: hci1: command tx timeout [ 60.996499][ T5114] Bluetooth: hci3: command tx timeout [ 60.999597][ T5112] Bluetooth: hci0: command tx timeout [ 61.019597][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.026798][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.071989][ T5116] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.074766][ T5112] Bluetooth: hci4: command tx timeout [ 61.078789][ T5114] Bluetooth: hci2: command tx timeout [ 61.120295][ T5120] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.188782][ T5159] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.195995][ T5159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.206092][ T5159] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.213268][ T5159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.647777][ T5116] veth0_vlan: entered promiscuous mode [ 61.717815][ T5116] veth1_vlan: entered promiscuous mode [ 61.747651][ T5108] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.787304][ T5105] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.834942][ T5109] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.853676][ T5116] veth0_macvtap: entered promiscuous mode [ 61.864639][ T5116] veth1_macvtap: entered promiscuous mode [ 61.889221][ T5116] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 61.914485][ T5120] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.963282][ T5116] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 61.980382][ T5105] veth0_vlan: entered promiscuous mode [ 62.009050][ T5108] veth0_vlan: entered promiscuous mode [ 62.018664][ T5116] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.028605][ T5116] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.038275][ T5116] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.051723][ T5116] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.085104][ T5105] veth1_vlan: entered promiscuous mode [ 62.097984][ T5108] veth1_vlan: entered promiscuous mode [ 62.131299][ T5109] veth0_vlan: entered promiscuous mode [ 62.165472][ T5109] veth1_vlan: entered promiscuous mode [ 62.188518][ T5120] veth0_vlan: entered promiscuous mode [ 62.224361][ T5120] veth1_vlan: entered promiscuous mode [ 62.266507][ T5108] veth0_macvtap: entered promiscuous mode [ 62.282938][ T5105] veth0_macvtap: entered promiscuous mode [ 62.307842][ T5108] veth1_macvtap: entered promiscuous mode [ 62.317920][ T5105] veth1_macvtap: entered promiscuous mode [ 62.338615][ T5109] veth0_macvtap: entered promiscuous mode [ 62.354808][ T1114] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.370017][ T1114] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.389850][ T5105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.404027][ T5105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.416506][ T5105] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 62.433066][ T5109] veth1_macvtap: entered promiscuous mode [ 62.463522][ T5105] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 62.474500][ T5105] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.487177][ T5105] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 62.504369][ T1114] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.511313][ T5120] veth0_macvtap: entered promiscuous mode [ 62.515947][ T1114] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.538878][ T5105] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.550483][ T5105] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.561615][ T5105] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.570332][ T5105] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.588666][ T5108] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.599570][ T5108] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.611376][ T5108] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.623140][ T5108] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.635194][ T5108] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 62.645844][ T5120] veth1_macvtap: entered promiscuous mode [ 62.670147][ T5108] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 62.690304][ T5108] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.701427][ T5108] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 62.712574][ T5108] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.723870][ T5108] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 62.739935][ T5108] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.750520][ T5108] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.760752][ T5108] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.769736][ T5108] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 62.780651][ T5109] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.791747][ T5109] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.802271][ T5109] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.812753][ T5109] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.824235][ T5109] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.835351][ T5109] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.847121][ T5109] batman_adv: batadv0: Interface activated: batadv_slave_0 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f000000a400)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x3e0150f9}, @NFTA_LIMIT_FLAGS={0x8}, @NFTA_LIMIT_TYPE={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0xf}}, 0x94}}, 0x0) [ 62.879756][ T5120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.890693][ T5120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.901880][ T5120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.913485][ T5120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.932956][ T5120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 62.953761][ T5120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.964850][ T5120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 executing program 4: r0 = epoll_create(0x3a) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000002c0)) epoll_wait(r0, &(0x7f00000000c0)=[{}], 0x1, 0xa521) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000040)={0x20006007}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r2, 0x0) [ 62.976660][ T5120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 62.989241][ T5120] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.011542][ T5109] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.038104][ T5109] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.063503][ T5109] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.071044][ T5114] Bluetooth: hci3: command tx timeout [ 63.079483][ T5114] Bluetooth: hci0: command tx timeout [ 63.081321][ T5112] Bluetooth: hci1: command tx timeout [ 63.087091][ T5109] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.103658][ T5109] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.115176][ T5109] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.140647][ T5109] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.151695][ T5112] Bluetooth: hci2: command tx timeout [ 63.161616][ T5112] Bluetooth: hci4: command tx timeout [ 63.172491][ T5109] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.187449][ T5109] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.197711][ T5109] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.213078][ T5109] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.229508][ T5120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.241908][ T5120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.252533][ T5120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.264139][ T5120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.274383][ T5120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.285600][ T5120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.296214][ T5120] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.309006][ T5120] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.325069][ T5120] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.346318][ T5120] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.355507][ T5120] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.365775][ T5120] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.374796][ T5120] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 63.514096][ T142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.524154][ T142] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 executing program 4: r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x24, @short={0x2, 0xffff, 0xffff}}, 0x14, &(0x7f0000000080)={0x0}}, 0x0) setsockopt$WPAN_WANTLQI(r0, 0x0, 0x3, &(0x7f0000001780)=0x1, 0x4) recvmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=""/14, 0xe}}], 0x1, 0x62, 0x0) [ 63.562152][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.577102][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.675922][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.709003][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) sendmmsg$inet6(r0, &(0x7f0000001bc0)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000001c0)="c3116b9f0b", 0x5}], 0x1}}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_256={{0x303, 0x36}, "76f7bc3e4ae1c84c", "af193cff4810ba5ac120d096eb00b40752095b4285514ca312c52e3a08756735", "5d09da4d", "bc3a20b10f4ad11e"}, 0x38) [ 63.748984][ T5160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.781385][ T5160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.830433][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.846118][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000080)={0x2, 0x4, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_sa={0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}, 0x1, 0x7}, 0x0) [ 63.947785][ T5158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.957293][ T5158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.997735][ T142] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.034528][ T142] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 executing program 1: syz_emit_ethernet(0xa7, &(0x7f0000000000)={@local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00 \x00', 0x71, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x18, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, '\x00\x00\x00\x00\x00\x00'}, {0x0, 0x0, "005ff9297d"}]}}}}}}, 0x0) [ 64.047864][ T2890] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000080)=@v1={0x2, @aes128, 0x0, @desc2}) [ 64.090090][ T2890] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 executing program 1: r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000140)={0x0, 0xb, 0x0, "d032f7879377914ba2ad9e675b08c50d52cbdc9c35e2e89897a3e97073b17608"}) executing program 0: syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000000)='./file1\x00', 0x810, &(0x7f0000000040)={[{@discard}, {@nodatacow}, {@commit={'commit', 0x3d, 0x80000001}}, {@usebackuproot}, {@nodatasum}, {@autodefrag}, {@user_subvol_rm}, {@max_inline={'max_inline', 0x3d, [0x6d, 0x38, 0x67, 0x30, 0x65, 0x25]}}]}, 0x3, 0x510e, &(0x7f000000a240)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTtRq2fvz3mQI6xdW8rsJfhMPtyspzI8VCh2tpMe22CMvzI8XCh1zSY/NkyE8uLCyPyn8PxbaSeHK2rxwJCmcjoX8fOgWjiWFE/FM+3xtPt208H0s5BdYzMcrKNZ0L4lIelzt12OhcMMeZ7sHBwAAuKfE8Jxn2bHeZkij7Hxt0A6rB+0wMmiH+qAdRpMd0h37bQ+zvYW4vX1m49Ke/39kuPwf34pV2aLf9f8hXv+fP9ewe/3/bCw0ksJ8LLTSOwa04jGysPtxPEajlfe4sr5bAAAAgLta/F6gvsLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5h715j5KruA4CffY734d2FpAqhUbJJahw38Xptk4daqqwpVSPSNOuGBlVRGht7TRYv2LFNiVGIjE1EIwSlDVLyoQijKKr5ALUCEUkB4SLFESqPiKoogEChNURBpJQkIk2Q4mr23jN759ydhx9rvPT3k7xzZv7ncc+Zh+fce+dcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4/+HQV67622bxh397wdPPXTxx2d51F798zQVnPh7C5OzjHVm4o//6Wyd+fuf5d+29b81t9xy58P29ebk8HgaqfzrzO9fFWo8sDeHejhC608DKwSzQk98fjPW9YzCEM8JcoFZiqj8rkTYcvt8Xwv4wF6hV9b2+EAYLgYueeOjBG6uJW/pCWBZCqKRtPFvJ2uhLA+f0ZoH+NLCtOwv86mimFvhuZxaAExbfDLUX/cHJ+gwj85dr8PrrOWkb9sZKu9cVEyON8/1s3QJvVEFv+sDkCT1tpepYEKW3xyHvtkXwbiuN882etuIXqfwbytG5UCV0bp7asvHKmV3xkc4wNtbVqKYFep6fevVLm44lvWheh3EDRk7K6/Cmx5bd2bXiE4/es3LZiwc+sO+lE93MHxWGtJheaJWQv+YWzfMYTfg8WQRvv9K3pFFfukIIWz7/e59sFi/N/0eaz//jyznedtbljrW+PpTNzeMjgzHxylA2NwcAAIBFYzHsNd029sBHCsWHK0l9pfn/aHvH/+Mh/3wyn/X2UAgTs4l9wyGcNft4FrgjNnfJcAjvnk1N1gfWJYFDIbx9NrGiVlVSYkksMZoEfjKUByaSwOEYmEwC34qBm5PAdTFwMAlsioFDSeD8GAjT9f34/aG8H20H+mJgQzaIB+NZCL8Yiq0lY/VMrSoAAICTJJ8d9tTfLZzrcKIZ4vTyYF+rDPEM7IYZKkkN6Qy2Nq1qWEN3qxo6W9VQ6/ee5t0v1dzRqubSaRgd9Rlu/eXffCo0UZr/jzef/1fm2ZCO0vH/ENbP/o25O/PITC2+YbIuAwAAAHACBv73+W82i5fm/xPtnf8f94l0FTKHR+JuiK3DIYzXB7Jq/7AcyI56D+QBAAAAWAxqx+Nrx8Kn89vsFO10Pl3OP3mM+eOB/4l58/ceun9Ds+0tzf8n2zv/v7/+NtuIw3ErvjYcwpJC4AdxK6uBWaMx8OOP1gfy/h+OA3BDrCo/MaFW1Q2xxIYYGE8C+xuV+GGtxFn1gfzJqjW+r9aP6bxEIQAAAACnXNwdEI/Lx/P/3/ObNVc1K1ea/284tvP/Z+fBpdP7ZwZCWNUdQlf6w4BH+rOFAWNgsCNPPNCf1dWVVnVtfwjnVTuWVvV8vv5/d7rG4BN9WVUxcNZ7Drx6TjXxzb4QVhUDT37m9g9WE7uSQK3xv+wL4V3V3qaNf2dJ1nhP2vjXl4TwzkKgVtUlS0KoNtabVvVQJb+OQVrVP1dCeEshUKvqQ5UQdgcAFqn4X+nm4oM7d1+9dePMzNSOBUzEffh9Ycv0zNTYpm0zmysNtmlzss11yxhdW+5Tu1e+eSZfoujTd68fbCdd+53geLGtfD9+6cTB/H78LtQz2881PXV316Zdft97y02EwjepRl3uXOAu9xcrmXsSS/XH/L1hICy5cufUjrEvbty1a8fq7G+72ddkf+NhpmysVqdj1T/ftrXx8mi4WlbieMdqebGSVbsu375q5+6rV05fvvHSqUunrlj9oTXj546vHf/wuauqvRrP/rbo6vL5qk66evT2Nvt1Ert6dnehklPxqSEhIbHYEtsGljf9P7k0/9/efP4fP3XiJ3++PkOj4/8j8TB/9vjcYf4NMbC/3eP/I42O5tdODBhNAntiYI/D/AAAALw5xEl+3JsZ90r/dMV3XmxWrjT/39Pe7/9P0vr/taXrL2y0zP+KWGK80fr/6TL/tfX/9zRa/z9d5r+2/v/+N2D9/ytrgWRIfmH9fwAA4M3g1K3/33J5//QCAaUMLZf3Ty8QUMrQchn/di8QcMzr/z/7n3/136GJ0vz/5vbm/xbuBwAAgNPHl//sqt9pFi/N//e3N/8/9ev/hUbn/482Ckw2WhjQ+n8AAAAsUo3W/xu5vv9zzcqV5v8H25v/x9MuOutyx1pfH8rWtAvpmnavDNV+MgAAAACLQ2cYG+tpM2/dyqjrjr/Np/KlQJuli57/kyPHdv7/ofbm/3W/y7jpsWV3dq34xKOv37Ny2YsHPrDvpbnj/wAAAMDCaXe/BAAAAAAAAAAAAAAA8MZ7/j/2rm0WL/3+P6yffbzR7//jdf/i7wveWpc71tp6/b/8/kUfv2v37JKFjwyF8N5iYOverWeE/Nr8y4uBBz+74m3VxN60xP3Pnf9CNfG5NPCxlWe+Vk2clwQ2xEUS354G4lUVX1uaBOLyiv+eBuJ4HEwDvXngq0uzfnSkY/XTwWysOtKxenowhOFCoDZW9w5mbXSkHbwlCdQ6+IU0EDv453mgM92quwayrYqBwVj0toFsqwAAOG3Fb4E9Ycv0zNR4/Aofb8/urr+N6pYsu7ZcbUebzT+TL0326bvXD7aT7kq/i85da7wnVKpdWF36ulrM0jHby5NTS4uhe2uDLrda7a2zQbnUsQ5db+Me9WU9Gtu0bWZzT8uOr22dZU13yyyrS5OdYpbO2SFto5Y2tqWNHrU5Nm1scrzfGcbGupJcfxCDI6FOq1dEu7/XL67z1+hVUMxzxZF9v2pWX2n+P9Le/L9S7Ndr+cUA9sQr6/3dsGX+AQAAYGF9dd2vvxH/fer6h59slrc0/x9tb/4f92Dlh4KzvR2H4vX/9w2HMHtp/ZEscEds7pLhEN49m5qMJbIL6l8YS4xngTviDpMVscSGyfqqlsTAwSTwk6E8cCgJHI6BfC/FgZDvyvn7oRA+OJtaX19ieywxkgQ+GQOjSWAsBsaTwNIYmEgCLy/NA5NJ4N9iIEzXj9XdS/OxAgAAOBb5PKun/m5I53kHu1tl6GiVob9Vhs5WGSpNM/SEg416Ee9/O2bo6SiPQnyoJ222L6mllCFeDL/hhrcc3drh/x/W50wLlpqO5x/UzjfoqM9w30e6K6GJ0vx/vL35f3/9bdb64Tj/n7v+Xxb4Qdy8r8VTx0dj4McfrQ/kOwYOx8nuDbWqJvMS+aT9hlhiIgZGk8D2GJhIAhvW54H9b6sP5DPtWuP7ao1P5yUKAQAAADjl4g6CuJsmzv9v2/mVgWblSvP/ifbm/7G9gWJj18VajywN4d6Oua2pBVYOZoG4H2Mw/jz+HYMhnFHYwVErMdWflehNGg7f78t+od6bVvW9vuzHB/H+RU889OCN1cQtfSEsK+x9qbXxbCVroy8NnNObBfrTwLbuLBD3/NQC3+3MAnDCansF4wsqP9WlZmT+cg1ef2+Wa4Km3SvtA50n33y/uVoopR2u+T7VmmN72pruv+WkKb09Dnm3LcZ324h3W/GLVP4N5ehcqBI6N09t2XjlzK74SPGXrCUL9DwXf6XaTvokvA73HP/WtlZJN2A8+fgYn7/c/K/DjljdTY8tu7NrxScevWflshcPfGDfS21vRgPxh8IPXfOvgz8qDO9Cq4T8NbfoPk8mfZ4siv8Gknf3qKcthLD+5a/f0Cxemv9Ptjf/705uZ/06DubO4RDeVxjcR+Lw//Fw9jlYCGSfkm8pB7JD7v811PCTEwAAAE622u6O2v6C6fw2OyE8nSeX80+GcHT4GPLH/RUT8+Zvd7v7//qzy5rFS/P/Dc3n/0uSzXT83/F/Fojj//M63XdFL0kf2HNCu6JL1bEgHP+f1+n+bnP8f16O/zv+Px/H/1tw/H9ep/vTVvqWtN2XrhDCi3/0wNPN4qX5//b25v/W/5t/0b7a+n8bGq3/t73R+n97rP8HAAAsqAYLzaXzvNLqfaUM6ep9pQwtFwhsucRg8/X/mqyz96ZZ/680qK3W/3vh7Gd/E5oozf/3tDf/jy+HgWLri2X9v9H1Daq6OQa2WxgQAACA01GjfRMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8se77h//Z3Cz+8G8vePq5iycu27vu4pevueDMx0OYnn28Iwt39F9/68TP7zz/rr33rbntniMXvr+Sl+vJb3+3Lnes9fWhEPYXHhmMiVeGqnfmAhd9/K7d3dXEI0MhvLcY2Lp36xnVxLeGQlheDDz42RVvqyb2piXuf+78F6qJz6WBj60887Vq4rw80JFu7j8uzTa3I93cG5eGMFwI1Db3sqX1VdXa+NM80Jm28U+DWRsxMBiLfmMwayMGZmKJ6SUhrOoOoSut6uFKVlVXWtW/VLKqutKqvlwJ4bwQQnda1XO9WVXdac8f782qioGz3nPg1XOqif29IawqBp78zO0frCa+kARqjf9Fbwjvqr5k0sa/3ZM13pM2fktPCO8MIfSmJX7ZnZXoTUs83x3CWwqBWuOf7w5hd+BNIX741H2i7dx99daNMzNTOxYw0Zu31Re2TM9MjW3aNrO5kmxTIx2F9NFrj7/vz7z6pU3V20/fvX6wnXR3Xq5ndpPX9NTdXXu6b33crv5iJXPPR6n+mL83DIQlV+6c2jH2xY27du1Ynf1tN/ua7G9XHs3GavViGavlxUpW7bp8+6qdu69eOX35xkunLp26YvWH1oyfO752/MPnrqr2ajz7ezK6evup7+rZ3YVKTsUHgISExGJLdNZ9uo2f7h/kpS/6cxvaEyqzH9ClaUUxS8dsL09Gp9cdZ4+P53tKyx6tLk0cSlnWzJPl2vosa0uTibla+rIss9/rSpPDYmOds0Ma73eGsbGuRuMwUn+3OLw/O4HhfSofunbTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP+xAwcCAAAAAED+r41QVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhR04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqirswLEAAAAAgDB/6zB6NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAD//56HJTY=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f00000001c0)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, "70dd01", "aecaee4898c787dc10361569dee22abe1962ce5b40f39d8436d4e325e3fa674663019e72f4b3cb1c618697a8c12390af02d1fe6bc12e2e2601d4234b6a8b2bcce0fec5af9333672e87bbc9de6c34873353d2b51abf8f10f652c60154a22a4715d78f8ed9c29f9ec70092919b4544aafddeceef8affb815eb3f4d9312cdef1293d9dcd78d7b28767a4b17dd6bab49f68b2d74051aa642ffb87a96b6008ab7348ccecfbe32aef514061c1cf2fd360a84a82bd776d8827de3386ace89ea513a04bd07ba35863dec505b41f766fc3c8896f9054224f5a930a6c3603ac7ff6d9c8db4d5bc95270439e1b1d12f46a27ce9521789f6eb295f6ad68e5e12658fad787d74"}}, 0x110) write$cgroup_type(r1, &(0x7f00000000c0), 0x9) executing program 4: bpf$MAP_CREATE(0x0, &(0x7f00000088c0)=@base={0x1c, 0x4, 0x8, 0x0, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5}, 0x48) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) [ 64.264198][ T5207] fscrypt (sda1, inode 1940): Unsupported log2_data_unit_size in encryption policy: 227 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$packet(r1, &(0x7f0000000180)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) getsockname$packet(r1, &(0x7f00000015c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000700)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x300, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000055000100000000000000000007008209", @ANYRES32=r3, @ANYBLOB="20000100", @ANYRES32=r5, @ANYBLOB="00001000e000030000010001000000000000000008"], 0x38}}, 0x0) executing program 1: r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) setreuid(0xee00, 0x0) r1 = getuid() setreuid(0xee00, r1) ioctl$TIOCL_PASTESEL(r0, 0x4b65, 0x0) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x200000005c832, 0xffffffffffffffff, 0x62fe7000) munmap(&(0x7f0000400000/0xc00000)=nil, 0xc00002) executing program 3: r0 = epoll_create1(0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) r2 = syz_io_uring_setup(0x6908, &(0x7f0000000280)={0x0, 0x0, 0x10100}, &(0x7f0000000180), &(0x7f0000000100)=0x0) syz_io_uring_setup(0x1b3f, &(0x7f0000000300), &(0x7f0000000040)=0x0, &(0x7f0000000240)) syz_io_uring_submit(r4, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r2, 0x184c, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)={0xe0028008}) executing program 2: sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7b}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/39, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000280)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x63, &(0x7f0000000600)=""/99}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0xfffffffe) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4000003}, 0x90) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0xe, &(0x7f00000001c0)={&(0x7f0000000040)=@bridge_getvlan={0x20, 0x72, 0x101, 0x0, 0x0, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x43}]}, 0x20}}, 0x0) executing program 1: r0 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r0, &(0x7f0000000440)={&(0x7f0000000480)={0x2, 0x0, @local}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000007000000890704e068000000110000000000000000dbc790ad000000fc000000000000001400000000000000000000000200000004000000000000001c000000000000000000000008"], 0x68}, 0x0) executing program 4: ioperm(0x0, 0x6, 0x1f) modify_ldt$read(0x3, 0x0, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @mcast1}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @private0}}}}]}]}, 0x6c}}, 0x0) executing program 3: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5412, &(0x7f00000000c0)=0x3) [ 64.934214][ T5231] ================================================================== [ 64.942507][ T5231] BUG: KASAN: slab-use-after-free in __mutex_unlock_slowpath+0xef/0x750 [ 64.950869][ T5231] Read of size 8 at addr ffff88802ba56080 by task vhost-5229/5231 [ 64.958686][ T5231] [ 64.961108][ T5231] CPU: 0 PID: 5231 Comm: vhost-5229 Not tainted 6.9.0-rc6-next-20240501-syzkaller #0 [ 64.970576][ T5231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 64.980732][ T5231] Call Trace: [ 64.984027][ T5231] [ 64.986966][ T5231] dump_stack_lvl+0x241/0x360 [ 64.991669][ T5231] ? __pfx_dump_stack_lvl+0x10/0x10 [ 64.996890][ T5231] ? __pfx__printk+0x10/0x10 [ 65.001505][ T5231] ? _printk+0xd5/0x120 [ 65.005683][ T5231] ? __virt_addr_valid+0x183/0x520 [ 65.010825][ T5231] ? __virt_addr_valid+0x183/0x520 [ 65.015958][ T5231] print_report+0x169/0x550 [ 65.020486][ T5231] ? __virt_addr_valid+0x183/0x520 [ 65.025628][ T5231] ? __virt_addr_valid+0x183/0x520 [ 65.026693][ T5235] tipc: Enabling of bearer rejected, failed to enable media [ 65.031011][ T5231] ? __virt_addr_valid+0x44e/0x520 [ 65.031041][ T5231] ? __phys_addr+0xba/0x170 [ 65.031064][ T5231] ? __mutex_unlock_slowpath+0xef/0x750 [ 65.031083][ T5231] kasan_report+0x143/0x180 [ 65.031105][ T5231] ? __mutex_unlock_slowpath+0xef/0x750 [ 65.064589][ T5231] kasan_check_range+0x282/0x290 [ 65.069551][ T5231] ? vhost_task_fn+0x3bc/0x3f0 [ 65.074340][ T5231] __mutex_unlock_slowpath+0xef/0x750 [ 65.079736][ T5231] ? preempt_schedule_thunk+0x1a/0x30 [ 65.085132][ T5231] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 65.091137][ T5231] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 65.097138][ T5231] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 65.103485][ T5231] ? complete+0xb4/0x1c0 [ 65.107745][ T5231] vhost_task_fn+0x3bc/0x3f0 [ 65.112356][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.117488][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.122626][ T5231] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 65.128631][ T5231] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 65.135244][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.140381][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.145512][ T5231] ? _raw_spin_unlock_irq+0x23/0x50 [ 65.150734][ T5231] ? lockdep_hardirqs_on+0x99/0x150 [ 65.156089][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.161245][ T5231] ret_from_fork+0x4b/0x80 [ 65.165687][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.170818][ T5231] ret_from_fork_asm+0x1a/0x30 [ 65.176218][ T5231] [ 65.179249][ T5231] [ 65.181580][ T5231] Allocated by task 5229: [ 65.185919][ T5231] kasan_save_track+0x3f/0x80 [ 65.190609][ T5231] __kasan_kmalloc+0x98/0xb0 [ 65.193207][ T5112] Bluetooth: hci1: command tx timeout [ 65.195205][ T5231] kmalloc_trace_noprof+0x19c/0x2b0 [ 65.195234][ T5231] vhost_task_create+0x149/0x300 [ 65.210871][ T5231] vhost_worker_create+0x17b/0x3f0 [ 65.216017][ T5231] vhost_dev_set_owner+0x563/0x940 [ 65.221140][ T5231] vhost_dev_ioctl+0xda/0xda0 [ 65.225831][ T5231] vhost_vsock_dev_ioctl+0x2bb/0xfa0 [ 65.231134][ T5231] __se_sys_ioctl+0xfc/0x170 [ 65.235737][ T5231] do_syscall_64+0xf5/0x240 [ 65.240260][ T5231] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 65.241573][ T5112] Bluetooth: hci4: command tx timeout [ 65.246162][ T5231] [ 65.246169][ T5231] Freed by task 5226: [ 65.246179][ T5231] kasan_save_track+0x3f/0x80 [ 65.246199][ T5231] kasan_save_free_info+0x40/0x50 [ 65.246220][ T5231] poison_slab_object+0xe0/0x150 [ 65.251777][ T4493] Bluetooth: hci2: command tx timeout [ 65.253913][ T5231] __kasan_slab_free+0x37/0x60 [ 65.253937][ T5231] kfree+0x149/0x350 [ 65.253957][ T5231] vhost_dev_cleanup+0x9b0/0xba0 [ 65.291492][ T5231] vhost_vsock_dev_release+0x3aa/0x410 [ 65.296978][ T5231] __fput+0x406/0x8b0 [ 65.300981][ T5231] __x64_sys_close+0x7f/0x110 [ 65.305678][ T5231] do_syscall_64+0xf5/0x240 [ 65.310229][ T5231] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 65.316157][ T5231] [ 65.318484][ T5231] The buggy address belongs to the object at ffff88802ba56000 [ 65.318484][ T5231] which belongs to the cache kmalloc-512 of size 512 [ 65.332546][ T5231] The buggy address is located 128 bytes inside of [ 65.332546][ T5231] freed 512-byte region [ffff88802ba56000, ffff88802ba56200) [ 65.346363][ T5231] [ 65.348696][ T5231] The buggy address belongs to the physical page: [ 65.355109][ T5231] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ba54 [ 65.363883][ T5231] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 65.372390][ T5231] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 65.380296][ T5231] page_type: 0xffffefff(slab) [ 65.384988][ T5231] raw: 00fff00000000040 ffff888015041c80 ffffea0000925500 dead000000000003 [ 65.393590][ T5231] raw: 0000000000000000 0000000080100010 00000001ffffefff 0000000000000000 [ 65.402198][ T5231] head: 00fff00000000040 ffff888015041c80 ffffea0000925500 dead000000000003 [ 65.410889][ T5231] head: 0000000000000000 0000000080100010 00000001ffffefff 0000000000000000 [ 65.419670][ T5231] head: 00fff00000000002 ffffea0000ae9501 ffffffffffffffff 0000000000000000 [ 65.428361][ T5231] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 [ 65.437040][ T5231] page dumped because: kasan: bad access detected [ 65.443473][ T5231] page_owner tracks the page as allocated [ 65.449192][ T5231] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11913945339, free_ts 0 [ 65.468920][ T5231] post_alloc_hook+0x1f3/0x230 [ 65.473708][ T5231] get_page_from_freelist+0x2ce2/0x2d90 [ 65.473903][ T5212] loop0: detected capacity change from 0 to 32768 [ 65.479254][ T5231] __alloc_pages_noprof+0x256/0x6c0 [ 65.479277][ T5231] alloc_slab_page+0x5f/0x120 [ 65.479294][ T5231] allocate_slab+0x5a/0x2e0 [ 65.479309][ T5231] ___slab_alloc+0xcd1/0x14b0 [ 65.479324][ T5231] __slab_alloc+0x58/0xa0 [ 65.509151][ T5231] kmalloc_node_track_caller_noprof+0x286/0x440 [ 65.515414][ T5231] krealloc_noprof+0x7d/0x120 [ 65.519521][ T5212] btrfs: Deprecated parameter 'usebackuproot' [ 65.520089][ T5231] add_sysfs_param+0xca/0x7f0 [ 65.520111][ T5231] kernel_add_sysfs_param+0xb4/0x130 [ 65.520141][ T5231] param_sysfs_builtin+0x16e/0x1f0 [ 65.541419][ T5231] param_sysfs_builtin_init+0x31/0x40 [ 65.545444][ T5212] BTRFS warning: 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 65.546790][ T5231] do_one_initcall+0x248/0x880 [ 65.546817][ T5231] do_initcall_level+0x157/0x210 [ 65.546838][ T5231] do_initcalls+0x3f/0x80 [ 65.570167][ T5231] page_owner free stack trace missing [ 65.575541][ T5231] [ 65.577872][ T5231] Memory state around the buggy address: [ 65.583506][ T5231] ffff88802ba55f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 65.591580][ T5231] ffff88802ba56000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.599652][ T5231] >ffff88802ba56080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.606119][ T5212] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor.0 (5212) [ 65.607699][ T5231] ^ [ 65.607713][ T5231] ffff88802ba56100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.607725][ T5231] ffff88802ba56180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.607733][ T5231] ================================================================== [ 65.656032][ T5112] Bluetooth: hci0: command tx timeout [ 65.662011][ T4493] Bluetooth: hci3: command tx timeout [ 65.713836][ T5231] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 65.721087][ T5231] CPU: 1 PID: 5231 Comm: vhost-5229 Not tainted 6.9.0-rc6-next-20240501-syzkaller #0 [ 65.730563][ T5231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 [ 65.740639][ T5231] Call Trace: [ 65.743938][ T5231] [ 65.746888][ T5231] dump_stack_lvl+0x241/0x360 [ 65.751599][ T5231] ? __pfx_dump_stack_lvl+0x10/0x10 [ 65.756822][ T5231] ? __pfx__printk+0x10/0x10 [ 65.761445][ T5231] ? preempt_schedule+0xe1/0xf0 [ 65.766318][ T5231] ? vscnprintf+0x5d/0x90 [ 65.770666][ T5231] panic+0x349/0x860 [ 65.774585][ T5231] ? check_panic_on_warn+0x21/0xb0 [ 65.779724][ T5231] ? __pfx_panic+0x10/0x10 [ 65.784163][ T5231] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 65.790340][ T5231] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 65.796698][ T5231] ? print_report+0x502/0x550 [ 65.801396][ T5231] check_panic_on_warn+0x86/0xb0 [ 65.806363][ T5231] ? __mutex_unlock_slowpath+0xef/0x750 [ 65.811928][ T5231] end_report+0x77/0x160 [ 65.816195][ T5231] kasan_report+0x154/0x180 [ 65.820718][ T5231] ? __mutex_unlock_slowpath+0xef/0x750 [ 65.826290][ T5231] kasan_check_range+0x282/0x290 [ 65.831257][ T5231] ? vhost_task_fn+0x3bc/0x3f0 [ 65.836039][ T5231] __mutex_unlock_slowpath+0xef/0x750 [ 65.841436][ T5231] ? preempt_schedule_thunk+0x1a/0x30 [ 65.846832][ T5231] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 65.852844][ T5231] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 65.858849][ T5231] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 65.865218][ T5231] ? complete+0xb4/0x1c0 [ 65.869495][ T5231] vhost_task_fn+0x3bc/0x3f0 [ 65.874113][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.879245][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.884376][ T5231] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 65.890374][ T5231] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 65.896720][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.902035][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.907231][ T5231] ? _raw_spin_unlock_irq+0x23/0x50 [ 65.912491][ T5231] ? lockdep_hardirqs_on+0x99/0x150 [ 65.917711][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.922852][ T5231] ret_from_fork+0x4b/0x80 [ 65.927289][ T5231] ? __pfx_vhost_task_fn+0x10/0x10 [ 65.932418][ T5231] ret_from_fork_asm+0x1a/0x30 [ 65.937209][ T5231] [ 65.940329][ T5231] Kernel Offset: disabled [ 65.944643][ T5231] Rebooting in 86400 seconds..