last executing test programs: 23.597270308s ago: executing program 3 (id=2392): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280100000000000001000000"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x2, 0xffffffff}}], 0x1, 0x0, 0x0) 22.624819372s ago: executing program 3 (id=2394): r0 = socket$rds(0x15, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r4, &(0x7f0000000200), 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000200)='./config/file0\x00', 0x1ff) sendmsg$rds(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40080}, 0x20000090) set_mempolicy(0x5, &(0x7f0000000000)=0x4000000ff9, 0xf) openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) 21.591594758s ago: executing program 3 (id=2395): syz_mount_image$udf(&(0x7f0000000080), &(0x7f0000000740)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xa00004, &(0x7f0000000540)={[{@iocharset={'iocharset', 0x3d, 'cp852'}}, {@iocharset={'iocharset', 0x3d, 'cp1250'}}, {@anchor={'anchor', 0x3d, 0x7}}, {@noadinicb}, {@noadinicb}, {@iocharset={'iocharset', 0x3d, 'cp855'}}, {@uid_ignore}, {@mode={'mode', 0x3d, 0x8009}}, {@longad}, {@mode={'mode', 0x3d, 0xbf31}}, {@undelete}, {@uid_forget}, {@umask={'umask', 0x3d, 0x6}}]}, 0x1, 0xc6d, &(0x7f0000001980)="$eJzs3U9sHNd9B/DfG5LiSm4rJk4VJ42DTVuksmK5+hdTtgp3VdNsA8iyEIq5BeBKpNSFKZIgqUY23JbppYceAhRFDzkRaIUCKRoYTRH0yLQukFx8KHLqiWhhIyh6YIsAAVq4G8zsW3FFkZYsiiIlfz429d2deW/mvZnVDEXwzQsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIOJ3Xjl77HjaZEXfLjQGAHgozo999diJze7/AMBj6+JW//4HAAAAAAAAAAAAAAD2ihRFPBkp5s6vpYnqfUftXGvg+o3xkdHNq+1PVc2+qnz5VTt+4uSpLz8/fLqb51ozH1L/QftsvDZ28Wz95dlrc/NTCwtTk/Xxmdbl2cmpe97CdutvdKQ6APVrr1+fvHJloX7iuZO3rb4x9P7gE4eGzgw/c/TpbtnxkdHRsfUitd7y/ffdkI6tRnjsiyKORopnv/uT1IyIIrZ/LGoP99xvtL/qxJGqE+Mjo1VHplvNmcVy5YXugSgi6j2VGt1jtPm5iP6Bh9qHrTUilsrmlw0+UnZvbK4537w0PVW/0JxfbC22ZmcupE5ry/7Uo4jTKWI5IlYH79zcQBTRHym+fXAtXcpP/aiOw5eqgcFbt6PYwT7eg7Kd9YGI5eIROGd72GAU8Wqk+Ok7h+Nyvs5U15ovRrxa5vcjbpb5UkQqPxinIt7b5HPEo6k/iviz8vyfWUuT1fWge10597X6V2auzPaU7V5XPuL94Y4rxS7dH/ZvyIdjj1+balFEs7rir6X7/2YHAAAAAAAAAAAAAAAAgAdtfxTxmUjxyr/+QTWuOKpx6QfPDP/u0C/2jhl/6i7bKcs+FxFLxb2Nyd2XBwZeSBdS2uWxxB9ntSjiD/P4v2/udmMAAAAAAAAAAAAAAAAAAAA+1or4caR48d3DaTl65xRvzVytX2xemu7MCtud+7c7Z3q73W7XUycbOSdyLuVczrmSczVnFLl+zkbOiZxLOZdzruRczRl9uX7ORs6JnEs5l3Ou5FzNGf25fs5GzomcSzmXc67kXM0Ze2TuXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAx0kRRXwQKb71jbUUKSIaERPRyZXB3W4dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAaTEV8L1LUf69xa1l/RKTq/47D5R+norGvzE9GY7jMl6JxNmezyv7GN3eh/WzPQCriR5FisPb2rROez/9A592tj0HcfGv93Wf7O9nXXTn0/uAThw6eGR79/FNbvU6bNeDIudbM9Rv18ZHR0bGexf1575/sWTaU91s8mK4TEQtvvPl6c3p6av7+X5Qfgfus3j2T29j7w3yR+ne5qf+/Bw7Cx+lF9O/e3nf778Xt14naLlyb2Hnl/f+9SPGb7/5b94bfuf/X4hc6727d4eNnf7R+/39x44bu8f7fv7Fevv+Xd4LN7v9P9ix7MX83MtAfUVu8NjdwKKK28MabR1vXmlenrk7NnDp27IXh4RdOHhvYF1G70pqe6nn1QA4XAAAAAAAAAAAAAAAAwMOTivjtSNH80VqqR8SNarzW0JnhZ44+3Rd91Xir28ZtvzZ28Wz95dlrc/NTCwtTk/Xxmdbl2cmpe91drRruNT4yuiOduav9O9z+/bWXZ+femG9d/f3FTdcfqJ29tLA437y8+erYH0VEo3fJkarB4yOjVaOnW82ZquqFTQfTf3QDqYh/jxSXT9XTF/KyPP5/4wj/uPnWC7c+C0sbN/QAx/9//sD6+L9P9BQt95lSET+LFL/x50/FF6p2Hog7jlku99eR4sjpz+Vysa8s121D57kCnZGBZdn/jhR//8HtZbvjIZ9cL3v8Ix3cR0B5/g9Giu/96XfiV/Oy25//0Hv+14/fgY0b2qHnP3yqZ9mB255XsO2uk8//0Ujx0pNvx69VS/73Q5//0X1iw+FO4fXnc+zQ+f/lnmVDeb+//qA6DwAAAAAAAAAA8AgbSEX8TaT4wWh/ej4vu5ff/5vcuKEd+v2vT/csm3ww8xXd9cW2DyoAAAAA7BEDqYgfR4qri2/fGkN9+/jvnvGfv7U+/nMkbVhb/Zzvl6rnBjzIn//1Gsr7ndh+twEAAAAAAAAAAAAAAAAAAGBPSamI5/N86hPVeP7JLedTX4kUr/zns7lcOlSW684DP1T9WTs/O3P07PT0bC0Wm5emp+pjc83LU2XdT0WKtb/6XK5bVPOrd+eb78zxvj4X+3ykGP3bbtnOXOzduck784HX2u2I42XZT0SK//i728vmqanz3NHVdk+UZf8yUnz9Hzcve2i97Mmy7HcixQ+/Xu+WPVCW7T4f9dPrZZ+7PFvswFkBAAAAAAAAAAAAAAAAAADg42YgFfEnkeK/ri3fGsuf5/8f6HlbuflWz3z/G9yo5vkfqub/3+r1/cz/Xz1XYGmrvQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOMpRRFvRoq582tpZbB831E715q5fmN8ZHTzavtTVbOvKl9+1Y6fOHnqy88Pn+7mh9d/0D4Tr41dPFt/efba3PzUwsLUZH18pnV5dnLqnrew3fobHakOQP3a69cnr1xZqJ947uRtq28MvT/4xKGhM8PPHH26W3Z8ZHR0rKdM/8B97/0OaYvl+6KIv4gUz373J+kHgxFFbP9Y3OWzs9P2V504UnVifGS06sh0qzmzWK680D0QRUS9p1Kje4zuei7+r91uP6yubKIRsVQ2v2zwkbJ7Y3PN+eal6an6heb8YmuxNTtzIXVaW/anHkWcThHLEbE6eOfmBqKI1yPFtw+upX8ajOjrHocvnR/76rETW7ej2ME+3oOynfWBiOXiXs4ZWxmMIv4hUvz0ncPxz4MR/dH5ii9GvFrm9yNuRud8p/KDcSrivU0+Rzya+qOI/ynP/5m19M5geT3oXlfOfa3+lZkrsz1lu9eVbd4f2u32H5e5e/eHh2mPX5tqUcQPqyv+WvoXf68BAAAAAAAAAAAAAAAA9pAifiVSvPju4VSND741prg1c7V+sXlpujOsrzv2rztmut1ut+upk42cEzmXci7nXMm5mjOKXD9no8xauz2R3y/lXM65knM1Z/Tl+n3VcMV2I7+fyLmUcznnSs7VnNGf6+ds5JzIuZRzOedKztWcsUfG7gEAAAAAAAAAAAAAAAAAAI+Xovovxbe+sZbag535pSeikyvmA33s/TwAAP//9xz3UA==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x6200, 0x0) sendfile(r0, r1, 0x0, 0x20fffe82) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) 20.938777264s ago: executing program 3 (id=2398): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r5, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000900)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xa0}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) 19.753269343s ago: executing program 3 (id=2401): syz_mount_image$reiserfs(&(0x7f0000010000), &(0x7f0000010040)='./file0\x00', 0x0, &(0x7f0000010080), 0x1, 0xffde, &(0x7f00000100c0)="$eJzs1jFKA0EYBeC3yQGUP/0a0AuE9QBaKKSx8AYiqUyVrRSPKF5B7LXwBMqquUFwwXxfN4+Zf5jmMQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDBWfJ2lMzmSW2zeZImadvn5WuSdpsfPk0naXK9WvYXm+6y/9mWIZukGU59r2txXNVVV4s6nZ2fVH//cHezXq82v2OatHn5eLzN1ftOnzLcPd3pRAAAAPgfPoE9djB2BQEjGbt9AIC/N/b/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgC924EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7MCBAAAAAACQ/2sjVFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWEHDgQAAAAAgPxfG6GqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoKO3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdizY9OGgSgMwP8p6gUZQKRMEYRWSJkd0mWNjJN5Urk3HsCFwQMY2ZawjRpjsJrvA/GefrjjrnwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs63Vs3pKUpG3/vzZJ2mWPBQAAADyopMp3M5cn1VXykVVTpnyo+zL0ff5m1gMAAAD3KRfz+HvqaS4vx6f6Ol13+j+XbD+TlyT9zT7r3e/P+JVnXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAztwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7MCBAAAAAACQ/2sjVFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWEHjgUAAAAAhPlb94SxAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwAgAA///CDxkc") 15.461335559s ago: executing program 3 (id=2407): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b26, 0x0) 7.464935636s ago: executing program 2 (id=2424): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, 0x0, 0x0) writev(r2, 0x0, 0x0) r3 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) 6.750307944s ago: executing program 1 (id=2426): inotify_init1(0x800) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r0, 0x5410, 0x0) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{}, &(0x7f0000000840), &(0x7f0000000880)}, 0x20) close(0x3) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xd, 0x6, 0x4, 0x1, 0x81, r4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r5}, &(0x7f0000000840), &(0x7f0000000880)=r4}, 0x20) close(r4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r5, &(0x7f0000000900)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{}, &(0x7f0000000180), &(0x7f00000002c0)}, 0x20) write(0xffffffffffffffff, 0x0, 0x0) 5.593456822s ago: executing program 1 (id=2427): socket$l2tp(0x2, 0x2, 0x73) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20040014) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000001ec0)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00', @ANYRES16, @ANYBLOB="0100000000000000000001000000080001000700000008000200020000002c0004"], 0x50}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9b90000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x20004000) 5.398146157s ago: executing program 1 (id=2430): r0 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) ioctl$MEMREADOOB64(r0, 0x125f, 0x0) 5.211815202s ago: executing program 1 (id=2432): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x3, 0x87) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getpgid(0x0) mount(0x0, 0x0, &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) gettid() r2 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000540)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000000)='dns_resolver\x00', 0x0, &(0x7f0000000240)="48b12300", 0x4, r2) 4.86673021s ago: executing program 0 (id=2434): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x453, 0x4, 0x70bd26, 0x25dfdbfb, "c9c0c3cf51ab", ["", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x245a4f21c8508287}, 0x14000841) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000900)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xa0}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) 4.556600858s ago: executing program 2 (id=2435): inotify_init1(0x800) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSPGRP(r0, 0x5410, 0x0) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{}, &(0x7f0000000840), &(0x7f0000000880)}, 0x20) close(0x3) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xd, 0x6, 0x4, 0x1, 0x81, r4}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r5}, &(0x7f0000000840), &(0x7f0000000880)=r4}, 0x20) close(r4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r5, &(0x7f0000000900)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{}, &(0x7f0000000180), &(0x7f00000002c0)}, 0x20) write(0xffffffffffffffff, 0x0, 0x0) 3.799285047s ago: executing program 0 (id=2436): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xe) ioctl$TIOCSLCKTRMIOS(r0, 0x80047437, &(0x7f00000000c0)) 3.443797075s ago: executing program 0 (id=2437): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) ioprio_get$uid(0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) sendfile(r4, r3, 0x0, 0x20fffe82) 2.789033572s ago: executing program 2 (id=2438): socket$l2tp(0x2, 0x2, 0x73) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20040014) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000001ec0)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000000000)=ANY=[@ANYBLOB='P\x00', @ANYRES16, @ANYBLOB="0100000000000000000001000000080001000700000008000200020000002c0004"], 0x50}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9b90000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x20004000) 2.113888408s ago: executing program 2 (id=2439): ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 1.967793582s ago: executing program 0 (id=2440): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x4e21, 0x0, @mcast2, 0x1}], 0x1c) 1.696316179s ago: executing program 0 (id=2441): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r1, &(0x7f0000000580)='1:', 0x2) 1.575688401s ago: executing program 0 (id=2442): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, 0x0, 0x0) writev(r2, 0x0, 0x0) r3 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000001c0)='source', &(0x7f0000000100)='%\xff:2\x82|\x9a\xe0\xadA\xde\xd5\x03\x00\x00\x00\xb7\xe5\xee:\xb5\x0e\xec\xe5\xdc\xe5\x8d?\x16BE\x8b\xe8)\xa9H\x99\x10\x02q\xf7\xd3\xc5*\x15\xdf_\xb2_`\x92|\x7f\xff9\xf7o$e&1\xfd\xea\xb0\xb0', 0x0) 1.183348541s ago: executing program 1 (id=2443): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x453, 0x4, 0x70bd26, 0x25dfdbfb, "c9c0c3cf51ab", ["", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x245a4f21c8508287}, 0x14000841) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000900)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xa0}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) 1.071186484s ago: executing program 2 (id=2444): openat$cuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) lsetxattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000000)=@known='trusted.overlay.impure\x00', &(0x7f0000000140)='\xef\xab\xcc\xde35\x014\"Y\x85\xb4\v\xc3v\xf9\x14?\x8c`\xc1 [ 134.024909][ T6374] dump_stack_lvl+0x18c/0x250 [ 134.029646][ T6374] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 134.035318][ T6374] ? show_regs_print_info+0x20/0x20 [ 134.040546][ T6374] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 134.046223][ T6374] should_fail_ex+0x394/0x4c0 [ 134.050970][ T6374] should_failslab+0x9/0x20 [ 134.055501][ T6374] slab_pre_alloc_hook+0x59/0x300 [ 134.060561][ T6374] ? fuse_get_tree+0xb5/0x4e0 [ 134.065258][ T6374] __kmem_cache_alloc_node+0x53/0x250 [ 134.070666][ T6374] ? fuse_get_tree+0xb5/0x4e0 [ 134.075372][ T6374] kmalloc_trace+0x2a/0xe0 [ 134.079835][ T6374] fuse_get_tree+0xb5/0x4e0 [ 134.084365][ T6374] ? security_capable+0x89/0xb0 [ 134.089333][ T6374] vfs_get_tree+0x8c/0x280 [ 134.093784][ T6374] do_new_mount+0x24a/0xa40 [ 134.098322][ T6374] __se_sys_mount+0x2e7/0x3d0 [ 134.103026][ T6374] ? __x64_sys_mount+0xc0/0xc0 [ 134.107826][ T6374] ? lockdep_hardirqs_on+0x98/0x150 [ 134.113136][ T6374] ? __x64_sys_mount+0x20/0xc0 [ 134.117925][ T6374] do_syscall_64+0x55/0xb0 [ 134.122366][ T6374] ? clear_bhb_loop+0x40/0x90 [ 134.127057][ T6374] ? clear_bhb_loop+0x40/0x90 [ 134.131754][ T6374] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 134.137686][ T6374] RIP: 0033:0x7f65db59e159 [ 134.142120][ T6374] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 134.161748][ T6374] RSP: 002b:00007f65dc4ff028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 134.170202][ T6374] RAX: ffffffffffffffda RBX: 00007f65db825fa0 RCX: 00007f65db59e159 [ 134.178200][ T6374] RDX: 0000200000002100 RSI: 00002000000001c0 RDI: 0000000000000000 [ 134.186193][ T6374] RBP: 00007f65db63506b R08: 00002000000002c0 R09: 0000000000000000 [ 134.194186][ T6374] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000000 [ 134.202178][ T6374] R13: 00007f65db826038 R14: 00007f65db825fa0 R15: 00007ffd92722aa8 [ 134.210193][ T6374] [ 136.170610][ T6396] random: crng reseeded on system resumption [ 138.300414][ T5784] Bluetooth: Wrong link type (-71) [ 138.997944][ T28] audit: type=1800 audit(1791077886.953:2): pid=6416 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.172" name="ep1in-bulk" dev="gadgetfs" ino=8728 res=0 errno=0 [ 139.027342][ T6415] gadgetfs: bound to dummy_udc driver [ 139.387505][ T23] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 139.489166][ C1] gadgetfs: connected [ 139.501419][ T23] gadgetfs: disconnected [ 140.685734][ T6435] random: crng reseeded on system resumption [ 143.372941][ T5784] Bluetooth: Wrong link type (-71) [ 147.260815][ T6480] gadgetfs: bound to dummy_udc driver [ 147.303309][ T28] audit: type=1800 audit(1791077895.273:3): pid=6480 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.190" name="ep1in-bulk" dev="gadgetfs" ino=8873 res=0 errno=0 [ 147.484752][ T6487] Zero length message leads to an empty skb [ 147.737094][ T6054] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 148.177479][ T6054] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 148.272007][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 148.363101][ T6054] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.558060][ T6054] usb 4-1: config 0 descriptor?? [ 149.306509][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 150.466499][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 150.616509][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 150.919607][ T6054] [drm:udl_init] *ERROR* Selecting channel failed [ 150.990459][ T6054] [drm] Initialized udl 0.0.1 20120220 for 4-1:0.0 on minor 2 [ 150.998070][ T6054] [drm] Initialized udl on minor 2 [ 151.011087][ T23] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 151.027518][ T6054] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 151.051532][ T6054] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 151.074919][ T6056] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 151.092067][ T6054] usb 4-1: USB disconnect, device number 2 [ 151.101610][ T6056] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 151.745008][ T23] usb 2-1: Using ep0 maxpacket: 8 [ 151.757145][ T23] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 151.780110][ T23] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 151.808945][ T23] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 152.071400][ T23] usb 2-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 152.083303][ T23] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 152.097045][ T23] usb 2-1: config 168 interface 0 has no altsetting 0 [ 152.105596][ T23] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 152.114268][ T23] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 152.135941][ T23] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 152.186915][ T23] usb 2-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 152.241016][ T23] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 152.276529][ T23] usb 2-1: config 168 interface 0 has no altsetting 0 [ 152.294545][ T23] usb 2-1: unable to read config index 2 descriptor/start: -71 [ 152.319955][ T23] usb 2-1: can't read configurations, error -71 [ 153.296150][ T6524] gadgetfs: bound to dummy_udc driver [ 153.325643][ T28] audit: type=1800 audit(1791077901.293:4): pid=6524 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.199" name="ep1in-bulk" dev="gadgetfs" ino=9418 res=0 errno=0 [ 153.612399][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 155.266643][ T6054] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 155.276642][ T6056] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 155.476844][ T6054] usb 3-1: Using ep0 maxpacket: 16 [ 155.482134][ T6056] usb 2-1: Using ep0 maxpacket: 16 [ 155.499632][ T6054] usb 3-1: config index 0 descriptor too short (expected 51443, got 18) [ 155.515719][ T6056] usb 2-1: unable to get BOS descriptor or descriptor too short [ 155.528036][ T6054] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 155.549788][ T6056] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 155.571788][ T6054] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.594833][ T6056] usb 2-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 155.604417][ T6054] usb 3-1: Product: syz [ 155.617120][ T6054] usb 3-1: Manufacturer: syz [ 155.622979][ T6056] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.632382][ T6054] usb 3-1: SerialNumber: syz [ 155.646771][ T6056] usb 2-1: Product: syz [ 155.841314][ T6054] r8152-cfgselector 3-1: config 0 descriptor?? [ 155.847652][ T6056] usb 2-1: Manufacturer: syz [ 155.852276][ T6056] usb 2-1: SerialNumber: syz [ 156.090374][ T6538] syz.2.207 uses obsolete (PF_INET,SOCK_PACKET) [ 156.093160][ T6056] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 156.120272][ T6056] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 156.279253][ T6056] usb 2-1: 2:1 : can't get High Capability descriptor [ 156.346345][ T6054] r8152-cfgselector 3-1: Unknown version 0x0000 [ 156.386376][ T6054] r8152-cfgselector 3-1: USB disconnect, device number 2 [ 157.166449][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 158.445872][ T6054] usb 2-1: USB disconnect, device number 5 [ 159.749699][ T6611] FAULT_INJECTION: forcing a failure. [ 159.749699][ T6611] name failslab, interval 1, probability 0, space 0, times 0 [ 159.793340][ T6611] CPU: 1 PID: 6611 Comm: syz.0.220 Not tainted syzkaller #0 [ 159.800700][ T6611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 159.810785][ T6611] Call Trace: [ 159.814092][ T6611] [ 159.817041][ T6611] dump_stack_lvl+0x18c/0x250 [ 159.821755][ T6611] ? show_regs_print_info+0x20/0x20 [ 159.826991][ T6611] ? load_image+0x420/0x420 [ 159.831531][ T6611] ? __might_sleep+0xe0/0xe0 [ 159.836149][ T6611] ? __lock_acquire+0x7eb0/0x7eb0 [ 159.841200][ T6611] ? is_bpf_text_address+0x26/0x2a0 [ 159.846432][ T6611] should_fail_ex+0x394/0x4c0 [ 159.851153][ T6611] should_failslab+0x9/0x20 [ 159.855693][ T6611] slab_pre_alloc_hook+0x59/0x300 [ 159.860759][ T6611] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 159.867038][ T6611] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 159.873322][ T6611] __kmem_cache_alloc_node+0x53/0x250 [ 159.878738][ T6611] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 159.885016][ T6611] __kmalloc+0xa7/0x240 [ 159.889208][ T6611] genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 159.895317][ T6611] genl_family_rcv_msg_doit+0xcf/0x310 [ 159.900815][ T6611] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 159.906743][ T6611] ? apparmor_capable+0x137/0x1a0 [ 159.911793][ T6611] ? bpf_lsm_capable+0x9/0x10 [ 159.916492][ T6611] ? security_capable+0x89/0xb0 [ 159.921381][ T6611] genl_rcv_msg+0x611/0x7a0 [ 159.925921][ T6611] ? genl_bind+0x360/0x360 [ 159.930376][ T6611] ? vdpa_nl_cmd_mgmtdev_get_dumpit+0x270/0x270 [ 159.936662][ T6611] netlink_rcv_skb+0x235/0x4c0 [ 159.941457][ T6611] ? genl_bind+0x360/0x360 [ 159.945907][ T6611] ? netlink_ack+0x1160/0x1160 [ 159.950722][ T6611] ? __lock_acquire+0x7eb0/0x7eb0 [ 159.955776][ T6611] ? net_generic+0x1e/0x240 [ 159.960319][ T6611] ? down_read+0x1ac/0x2e0 [ 159.964767][ T6611] genl_rcv+0x28/0x40 [ 159.968780][ T6611] netlink_unicast+0x7b1/0x930 [ 159.973589][ T6611] netlink_sendmsg+0x8d0/0xbf0 [ 159.978392][ T6611] ? netlink_getsockopt+0x590/0x590 [ 159.983619][ T6611] ? apparmor_socket_sendmsg+0x8e/0x330 [ 159.989194][ T6611] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 159.994512][ T6611] ? security_socket_sendmsg+0x80/0xa0 [ 159.999997][ T6611] ? netlink_getsockopt+0x590/0x590 [ 160.005239][ T6611] ____sys_sendmsg+0x61b/0x980 [ 160.010054][ T6611] ? __asan_memset+0x22/0x40 [ 160.014682][ T6611] ? __sys_sendmsg_sock+0x30/0x30 [ 160.019735][ T6611] ? __import_iovec+0x5f2/0x850 [ 160.024626][ T6611] ? import_iovec+0x73/0xa0 [ 160.029162][ T6611] ___sys_sendmsg+0x2a6/0x360 [ 160.033885][ T6611] ? __sys_sendmsg+0x2b0/0x2b0 [ 160.038745][ T6611] __se_sys_sendmsg+0x1d0/0x2c0 [ 160.043633][ T6611] ? __x64_sys_sendmsg+0x80/0x80 [ 160.048622][ T6611] ? lockdep_hardirqs_on+0x98/0x150 [ 160.053864][ T6611] do_syscall_64+0x55/0xb0 [ 160.058324][ T6611] ? clear_bhb_loop+0x40/0x90 [ 160.063031][ T6611] ? clear_bhb_loop+0x40/0x90 [ 160.067739][ T6611] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 160.073676][ T6611] RIP: 0033:0x7f3bfc39e159 [ 160.078125][ T6611] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 160.097756][ T6611] RSP: 002b:00007f3bfd2c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 160.106194][ T6611] RAX: ffffffffffffffda RBX: 00007f3bfc625fa0 RCX: 00007f3bfc39e159 [ 160.114183][ T6611] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000006 [ 160.122171][ T6611] RBP: 00007f3bfc43506b R08: 0000000000000000 R09: 0000000000000000 [ 160.130162][ T6611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 160.138150][ T6611] R13: 00007f3bfc626038 R14: 00007f3bfc625fa0 R15: 00007ffea64b2168 [ 160.146155][ T6611] [ 160.806731][ T27] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 160.988767][ T27] usb 1-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 161.016275][ T27] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 161.029757][ T27] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 161.045598][ T27] usb 1-1: Manufacturer: syz [ 161.077038][ T27] usb 1-1: SerialNumber: syz [ 161.205506][ T6640] netlink: 4 bytes leftover after parsing attributes in process `syz.3.225'. [ 161.345537][ T27] usbhid 1-1:36.0: couldn't find an input interrupt endpoint [ 161.385018][ T27] usb 1-1: USB disconnect, device number 3 [ 164.519596][ T6693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.234'. [ 165.817667][ T27] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 166.028496][ T27] usb 1-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 166.078457][ T27] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 166.100681][ T27] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 166.121389][ T27] usb 1-1: Manufacturer: syz [ 166.126038][ T27] usb 1-1: SerialNumber: syz [ 167.644657][ T27] usbhid 1-1:36.0: couldn't find an input interrupt endpoint [ 167.669443][ T27] usb 1-1: USB disconnect, device number 4 [ 168.116592][ T23] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 168.504088][ T23] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 168.523733][ T23] usb 2-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 168.546547][ T23] usb 2-1: config 1 interface 0 has no altsetting 0 [ 168.556717][ T23] usb 2-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 168.565793][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.586925][ T23] usb 2-1: Product: syz [ 168.591130][ T23] usb 2-1: Manufacturer: syz [ 168.595738][ T23] usb 2-1: SerialNumber: syz [ 168.610051][ T23] usb-storage 2-1:1.0: USB Mass Storage device detected [ 168.627723][ T23] usb-storage 2-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 168.936797][ T6056] usb 2-1: USB disconnect, device number 6 [ 169.897386][ T6057] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 170.228859][ T6057] usb 4-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 170.378612][ T6057] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 170.395921][ T6057] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 170.404713][ T6057] usb 4-1: Manufacturer: syz [ 170.415347][ T6057] usb 4-1: SerialNumber: syz [ 170.638550][ T6057] usbhid 4-1:36.0: couldn't find an input interrupt endpoint [ 170.666990][ T6057] usb 4-1: USB disconnect, device number 3 [ 172.536703][ T23] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 172.743507][ T23] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 172.842751][ T23] usb 1-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 172.993429][ T23] usb 1-1: config 1 interface 0 has no altsetting 0 [ 173.084646][ T23] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 173.174472][ T23] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.223718][ T23] usb 1-1: Product: syz [ 173.232290][ T23] usb 1-1: Manufacturer: syz [ 173.243505][ T23] usb 1-1: SerialNumber: syz [ 173.259638][ T23] usb-storage 1-1:1.0: USB Mass Storage device detected [ 173.286093][ T23] usb-storage 1-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 173.464466][ T5829] usb 1-1: USB disconnect, device number 5 [ 173.616647][ T6057] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 173.819877][ T6057] usb 3-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 173.839096][ T6057] usb 3-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 173.852954][ T6057] usb 3-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 173.864616][ T6057] usb 3-1: Manufacturer: syz [ 173.869471][ T6057] usb 3-1: SerialNumber: syz [ 174.119047][ T6057] usbhid 3-1:36.0: couldn't find an input interrupt endpoint [ 174.153141][ T6057] usb 3-1: USB disconnect, device number 3 [ 174.876691][ T5829] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 175.425552][ T5829] usb 2-1: unable to get BOS descriptor or descriptor too short [ 175.522678][ T5829] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 175.572394][ T5829] usb 2-1: can't read configurations, error -71 [ 178.289733][ T27] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 178.362230][ T5829] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 178.491999][ T27] usb 4-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 178.514373][ T27] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 178.530944][ T27] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 178.547925][ T27] usb 4-1: Manufacturer: syz [ 178.558821][ T5829] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 178.570148][ T27] usb 4-1: SerialNumber: syz [ 178.584250][ T5829] usb 2-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 178.626066][ T5829] usb 2-1: config 1 interface 0 has no altsetting 0 [ 178.681476][ T5829] usb 2-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 178.704507][ T5829] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.735239][ T5829] usb 2-1: Product: syz [ 178.750817][ T5829] usb 2-1: Manufacturer: syz [ 178.764758][ T5829] usb 2-1: SerialNumber: syz [ 178.798996][ T5829] usb-storage 2-1:1.0: USB Mass Storage device detected [ 178.841622][ T27] usbhid 4-1:36.0: couldn't find an input interrupt endpoint [ 178.860158][ T27] usb 4-1: USB disconnect, device number 4 [ 178.889990][ T5829] usb-storage 2-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 179.035365][ T6056] usb 2-1: USB disconnect, device number 8 [ 180.995121][ T6889] random: crng reseeded on system resumption [ 182.906575][ T5829] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 183.068057][ T6056] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 183.158337][ T5829] usb 4-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 183.179344][ T5829] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 183.193580][ T5829] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 183.202236][ T5829] usb 4-1: Manufacturer: syz [ 183.209212][ T5829] usb 4-1: SerialNumber: syz [ 183.366702][ T6056] usb 2-1: Using ep0 maxpacket: 16 [ 183.401180][ T6056] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 183.423732][ T6056] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 183.441012][ T6056] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.475396][ T6056] usb 2-1: Product: syz [ 183.537592][ T6056] usb 2-1: Manufacturer: syz [ 183.615435][ T6056] usb 2-1: SerialNumber: syz [ 184.053935][ T5829] usbhid 4-1:36.0: couldn't find an input interrupt endpoint [ 184.066934][ T5829] usb 4-1: USB disconnect, device number 5 [ 184.078315][ T6056] usb 2-1: config 0 descriptor?? [ 185.403107][ T5829] usb 2-1: USB disconnect, device number 9 [ 185.423423][ T6937] random: crng reseeded on system resumption [ 186.192132][ T5777] Bluetooth: hci0: command 0x0406 tx timeout [ 187.010962][ T6950] gadgetfs: bound to dummy_udc driver [ 187.052802][ T28] audit: type=1800 audit(1791077935.023:5): pid=6950 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.314" name="ep1in-bulk" dev="gadgetfs" ino=10655 res=0 errno=0 [ 187.286685][ T5829] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 187.526800][ T6959] random: crng reseeded on system resumption [ 187.770428][ T5829] usb 4-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 188.162309][ T5829] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 188.238104][ T5829] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 188.286731][ T5829] usb 4-1: Manufacturer: syz [ 188.312809][ T5829] usb 4-1: SerialNumber: syz [ 188.653429][ T5829] usbhid 4-1:36.0: couldn't find an input interrupt endpoint [ 188.821256][ T5829] usb 4-1: USB disconnect, device number 6 [ 190.048654][ T6977] random: crng reseeded on system resumption [ 191.175360][ T6985] gadgetfs: bound to dummy_udc driver [ 191.207484][ T28] audit: type=1800 audit(1791077939.173:6): pid=6985 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.324" name="ep1in-bulk" dev="gadgetfs" ino=10755 res=0 errno=0 [ 191.719398][ T6996] random: crng reseeded on system resumption [ 192.956689][ T972] usb 3-1: new full-speed USB device number 4 using dummy_hcd [ 193.164606][ T972] usb 3-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 193.212866][ T972] usb 3-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 193.247390][ T972] usb 3-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 193.313193][ T972] usb 3-1: Manufacturer: syz [ 193.346405][ T972] usb 3-1: SerialNumber: syz [ 193.653325][ T972] usbhid 3-1:36.0: couldn't find an input interrupt endpoint [ 193.694004][ T972] usb 3-1: USB disconnect, device number 4 [ 194.244689][ T7017] random: crng reseeded on system resumption [ 194.376312][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.388113][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 198.406708][ T6055] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 198.436599][ T6057] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 198.558500][ T7054] ======================================================= [ 198.558500][ T7054] WARNING: The mand mount option has been deprecated and [ 198.558500][ T7054] and is ignored by this kernel. Remove the mand [ 198.558500][ T7054] option from the mount to silence this warning. [ 198.558500][ T7054] ======================================================= [ 198.628662][ T6055] usb 4-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 198.648384][ T6055] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 198.657856][ T6055] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 198.670958][ T6057] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 198.682175][ T6055] usb 4-1: Manufacturer: syz [ 198.686897][ T6055] usb 4-1: SerialNumber: syz [ 198.691671][ T6057] usb 1-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 198.707661][ T6057] usb 1-1: config 1 interface 0 has no altsetting 0 [ 198.718894][ T6057] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 198.744290][ T6057] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.754565][ T6057] usb 1-1: Product: syz [ 198.759364][ T6057] usb 1-1: Manufacturer: syz [ 198.764504][ T6057] usb 1-1: SerialNumber: syz [ 198.782073][ T6057] usb-storage 1-1:1.0: USB Mass Storage device detected [ 198.801688][ T6057] usb-storage 1-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 198.928116][ T6055] usbhid 4-1:36.0: couldn't find an input interrupt endpoint [ 198.951650][ T6055] usb 4-1: USB disconnect, device number 7 [ 199.011170][ T7066] random: crng reseeded on system resumption [ 199.991638][ T6055] usb 1-1: USB disconnect, device number 6 [ 200.383267][ T7072] netlink: 8 bytes leftover after parsing attributes in process `syz.1.354'. [ 200.392626][ T7072] netlink: 8 bytes leftover after parsing attributes in process `syz.1.354'. [ 200.850146][ T7078] random: crng reseeded on system resumption [ 202.206662][ T6055] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 202.389839][ T6055] usb 2-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 202.410018][ T6055] usb 2-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 202.419159][ T6055] usb 2-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 202.427858][ T6055] usb 2-1: Manufacturer: syz [ 202.432474][ T6055] usb 2-1: SerialNumber: syz [ 202.819568][ T6055] usbhid 2-1:36.0: couldn't find an input interrupt endpoint [ 202.906097][ T6055] usb 2-1: USB disconnect, device number 10 [ 204.054797][ T7110] random: crng reseeded on system resumption [ 206.866601][ T6057] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 207.150396][ T7143] random: crng reseeded on system resumption [ 207.377004][ T6057] usb 1-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 207.953751][ T6057] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 207.963304][ T6057] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 207.973701][ T6057] usb 1-1: Manufacturer: syz [ 207.982590][ T6057] usb 1-1: SerialNumber: syz [ 208.516256][ T6057] usbhid 1-1:36.0: couldn't find an input interrupt endpoint [ 208.977021][ T6057] usb 1-1: USB disconnect, device number 7 [ 210.667811][ T7183] random: crng reseeded on system resumption [ 211.838102][ T7193] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 212.048129][ T7195] fuse: root generation should be zero [ 212.364152][ T7200] program syz.2.398 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 212.917107][ T7200] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.924768][ T7200] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.986843][ T6057] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 213.966465][ T6057] usb 1-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 213.987841][ T6057] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 213.997514][ T6057] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 214.007512][ T6057] usb 1-1: Manufacturer: syz [ 214.012142][ T6057] usb 1-1: SerialNumber: syz [ 214.115733][ T7221] random: crng reseeded on system resumption [ 214.373921][ T6057] usbhid 1-1:36.0: couldn't find an input interrupt endpoint [ 214.649828][ T7200] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 214.862703][ T6057] usb 1-1: USB disconnect, device number 8 [ 214.876950][ T7200] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 215.469776][ T7200] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.479189][ T7200] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.488149][ T7200] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.497243][ T7200] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.711864][ T7252] random: crng reseeded on system resumption [ 218.062202][ T6056] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 218.530491][ T6056] usb 4-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 218.546127][ T6056] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 218.568377][ T6056] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 218.620116][ T6056] usb 4-1: Manufacturer: syz [ 218.666293][ T7256] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 218.668391][ T6056] usb 4-1: SerialNumber: syz [ 218.965097][ T6056] usbhid 4-1:36.0: couldn't find an input interrupt endpoint [ 219.006112][ T6056] usb 4-1: USB disconnect, device number 8 [ 219.682404][ T6056] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 220.536640][ T6056] usb 1-1: Using ep0 maxpacket: 32 [ 220.558864][ T6056] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 220.569529][ T6056] usb 1-1: config 0 has no interface number 0 [ 220.575667][ T6056] usb 1-1: config 0 interface 184 has no altsetting 0 [ 220.601409][ T6056] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 220.613689][ T6056] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.764617][ T6056] usb 1-1: Product: syz [ 220.772354][ T6056] usb 1-1: Manufacturer: syz [ 220.779317][ T6056] usb 1-1: SerialNumber: syz [ 220.800051][ T6056] usb 1-1: config 0 descriptor?? [ 220.822279][ T6056] smsc75xx v1.0.0 [ 220.856556][ T7282] random: crng reseeded on system resumption [ 221.036582][ T27] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 221.716550][ T27] usb 2-1: Using ep0 maxpacket: 16 [ 221.729869][ T27] usb 2-1: unable to get BOS descriptor or descriptor too short [ 221.738958][ T27] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 221.752641][ T27] usb 2-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 221.761878][ T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.769968][ T27] usb 2-1: Product: syz [ 221.774145][ T27] usb 2-1: Manufacturer: syz [ 221.779426][ T27] usb 2-1: SerialNumber: syz [ 222.101929][ T6056] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000044: -71 [ 222.113082][ T6056] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_DATA [ 222.135168][ T6056] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 222.154051][ T6056] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 222.168696][ T6056] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 222.186703][ T6056] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 222.201734][ T6056] smsc75xx: probe of 1-1:0.184 failed with error -71 [ 222.260169][ T6056] usb 1-1: USB disconnect, device number 9 [ 222.318988][ T27] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 222.327793][ T27] snd-usb-audio: probe of 2-1:1.0 failed with error -22 [ 222.591521][ T27] usb 2-1: USB disconnect, device number 11 [ 222.777471][ T7295] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 223.875836][ T7306] netlink: 4300 bytes leftover after parsing attributes in process `syz.0.432'. [ 224.324665][ T6056] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 224.332618][ T7312] random: crng reseeded on system resumption [ 224.624761][ T6056] usb 3-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 224.743338][ T6056] usb 3-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 224.766631][ T6056] usb 3-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 224.825490][ T6056] usb 3-1: Manufacturer: syz [ 224.864858][ T6056] usb 3-1: SerialNumber: syz [ 225.577207][ T6056] usbhid 3-1:36.0: couldn't find an input interrupt endpoint [ 225.929952][ T6056] usb 3-1: USB disconnect, device number 5 [ 226.386771][ T6054] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 226.566667][ T6054] usb 1-1: Using ep0 maxpacket: 16 [ 226.582920][ T6054] usb 1-1: unable to get BOS descriptor or descriptor too short [ 226.607503][ T6054] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 226.628367][ T6054] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 226.642168][ T6054] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.650886][ T6054] usb 1-1: Product: syz [ 226.655926][ T6054] usb 1-1: Manufacturer: syz [ 226.661555][ T6054] usb 1-1: SerialNumber: syz [ 226.795555][ T7345] random: crng reseeded on system resumption [ 227.589246][ T6054] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 227.606698][ T6054] snd-usb-audio: probe of 1-1:1.0 failed with error -22 [ 227.833355][ T6054] usb 1-1: USB disconnect, device number 10 [ 228.063695][ T5811] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 228.246596][ T5811] usb 3-1: Using ep0 maxpacket: 16 [ 228.253584][ T5811] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 228.265823][ T5811] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 228.280300][ T5811] usb 3-1: New USB device found, idVendor=05ac, idProduct=027c, bcdDevice= 0.00 [ 228.294274][ T5811] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.306668][ T5811] usb 3-1: config 0 descriptor?? [ 228.676588][ T6055] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 228.720295][ T5811] apple 0003:05AC:027C.0002: ignoring exceeding usage max [ 228.755606][ T5811] apple 0003:05AC:027C.0002: hidraw0: USB HID v0.81 Device [HID 05ac:027c] on usb-dummy_hcd.2-1/input0 [ 228.925026][ T5811] usb 3-1: USB disconnect, device number 6 [ 229.032629][ T6055] usb 2-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 229.045106][ T6055] usb 2-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 229.122693][ T6055] usb 2-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 229.131775][ T6055] usb 2-1: Manufacturer: syz [ 229.137485][ T6055] usb 2-1: SerialNumber: syz [ 229.235180][ T7373] random: crng reseeded on system resumption [ 229.872565][ T6055] usbhid 2-1:36.0: couldn't find an input interrupt endpoint [ 230.030028][ T6055] usb 2-1: USB disconnect, device number 12 [ 230.741437][ T7393] gadgetfs: bound to dummy_udc driver [ 230.761175][ T28] audit: type=1800 audit(1791077978.733:7): pid=7393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.463" name="ep1in-bulk" dev="gadgetfs" ino=11709 res=0 errno=0 [ 231.906108][ T7406] program syz.2.469 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 232.086666][ T6079] usb 1-1: new full-speed USB device number 11 using dummy_hcd [ 232.288941][ T6079] usb 1-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 232.333170][ T6079] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 232.370946][ T6079] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 232.404661][ T6079] usb 1-1: Manufacturer: syz [ 232.483677][ T6079] usb 1-1: SerialNumber: syz [ 232.541704][ T7413] random: crng reseeded on system resumption [ 233.486171][ T6079] usbhid 1-1:36.0: couldn't find an input interrupt endpoint [ 233.514715][ T6079] usb 1-1: USB disconnect, device number 11 [ 233.548136][ T7415] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 235.657733][ T7442] program syz.1.478 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 236.446113][ T7442] bridge0: port 2(bridge_slave_1) entered disabled state [ 236.454049][ T7442] bridge0: port 1(bridge_slave_0) entered disabled state [ 236.717063][ T7452] random: crng reseeded on system resumption [ 237.991707][ T7442] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 238.028967][ T7442] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 238.136656][ T6057] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 238.301467][ T7442] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.310831][ T7442] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.319969][ T7442] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.329941][ T7442] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.347248][ T6057] usb 4-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 238.364969][ T6057] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 238.378899][ T6057] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 238.390066][ T6057] usb 4-1: Manufacturer: syz [ 238.394714][ T6057] usb 4-1: SerialNumber: syz [ 238.624207][ T6057] usbhid 4-1:36.0: couldn't find an input interrupt endpoint [ 238.660892][ T6057] usb 4-1: USB disconnect, device number 9 [ 239.905137][ T7483] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 241.058097][ T7494] random: crng reseeded on system resumption [ 241.075069][ T7493] program syz.2.492 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 242.116389][ T7502] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 245.346482][ C0] sched: RT throttling activated [ 245.618292][ T7535] program syz.2.501 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 247.500233][ T7547] FAULT_INJECTION: forcing a failure. [ 247.500233][ T7547] name failslab, interval 1, probability 0, space 0, times 0 [ 247.513015][ T7547] CPU: 0 PID: 7547 Comm: syz.0.505 Not tainted syzkaller #0 [ 247.520332][ T7547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 247.530419][ T7547] Call Trace: [ 247.533703][ T7547] [ 247.536633][ T7547] dump_stack_lvl+0x18c/0x250 [ 247.541317][ T7547] ? is_bpf_text_address+0x28f/0x2a0 [ 247.546606][ T7547] ? show_regs_print_info+0x20/0x20 [ 247.551809][ T7547] ? load_image+0x420/0x420 [ 247.556317][ T7547] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 247.562299][ T7547] should_fail_ex+0x394/0x4c0 [ 247.566984][ T7547] should_failslab+0x9/0x20 [ 247.571491][ T7547] slab_pre_alloc_hook+0x59/0x300 [ 247.576519][ T7547] ? __local_bh_enable_ip+0x13a/0x1c0 [ 247.581892][ T7547] kmem_cache_alloc+0x5a/0x2c0 [ 247.586685][ T7547] ? dst_alloc+0x105/0x170 [ 247.591106][ T7547] dst_alloc+0x105/0x170 [ 247.595360][ T7547] ip_route_output_key_hash_rcu+0x14a2/0x2350 [ 247.601435][ T7547] ? ip_route_output_key_hash+0x13d/0x330 [ 247.607156][ T7547] ip_route_output_key_hash+0x1f3/0x330 [ 247.612697][ T7547] ? ip_route_input_rcu+0x3120/0x3120 [ 247.618074][ T7547] ? __lock_acquire+0x7eb0/0x7eb0 [ 247.623105][ T7547] ip_route_output_flow+0x2a/0x150 [ 247.628220][ T7547] ? security_sk_classify_flow+0x7b/0x90 [ 247.633861][ T7547] udp_sendmsg+0x160e/0x23d0 [ 247.638458][ T7547] ? ip_skb_dst_mtu+0x870/0x870 [ 247.643311][ T7547] ? udp_cmsg_send+0x350/0x350 [ 247.648073][ T7547] ? mark_lock+0x94/0x320 [ 247.652401][ T7547] ? __lock_acquire+0x135d/0x7eb0 [ 247.657447][ T7547] ? aa_label_sk_perm+0x500/0x6a0 [ 247.662482][ T7547] udpv6_sendmsg+0x7a4/0x2390 [ 247.667166][ T7547] ? __might_sleep+0xe0/0xe0 [ 247.671758][ T7547] ? udp_v6_early_demux+0xf90/0xf90 [ 247.676973][ T7547] ? aa_af_perm+0x330/0x330 [ 247.681485][ T7547] ? sock_rps_record_flow+0x19/0x3f0 [ 247.686769][ T7547] ? inet_send_prepare+0x5b/0x250 [ 247.691789][ T7547] ? inet6_sendmsg+0x5f/0xd0 [ 247.696375][ T7547] sock_write_iter+0x2dc/0x420 [ 247.701152][ T7547] ? sock_read_iter+0x3f0/0x3f0 [ 247.706009][ T7547] ? common_file_perm+0x198/0x1f0 [ 247.711040][ T7547] vfs_write+0x474/0x9a0 [ 247.715287][ T7547] ? file_end_write+0x250/0x250 [ 247.720148][ T7547] ? __fget_files+0x3fc/0x460 [ 247.724832][ T7547] ? __fdget_pos+0x1d8/0x330 [ 247.729424][ T7547] ? ksys_write+0x74/0x260 [ 247.733847][ T7547] ksys_write+0x151/0x260 [ 247.738189][ T7547] ? __ia32_sys_read+0x90/0x90 [ 247.742964][ T7547] ? lockdep_hardirqs_on+0x98/0x150 [ 247.748163][ T7547] do_syscall_64+0x55/0xb0 [ 247.752580][ T7547] ? clear_bhb_loop+0x40/0x90 [ 247.757250][ T7547] ? clear_bhb_loop+0x40/0x90 [ 247.761924][ T7547] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 247.767817][ T7547] RIP: 0033:0x7f3bfc39e159 [ 247.772230][ T7547] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 247.791836][ T7547] RSP: 002b:00007f3bfd2c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 247.800252][ T7547] RAX: ffffffffffffffda RBX: 00007f3bfc625fa0 RCX: 00007f3bfc39e159 [ 247.808224][ T7547] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 247.816192][ T7547] RBP: 00007f3bfc43506b R08: 0000000000000000 R09: 0000000000000000 [ 247.824162][ T7547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 247.832137][ T7547] R13: 00007f3bfc626038 R14: 00007f3bfc625fa0 R15: 00007ffea64b2168 [ 247.840133][ T7547] [ 249.343716][ T7574] program syz.3.512 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 251.058310][ T7590] random: crng reseeded on system resumption [ 252.570795][ T7593] syz.0.519: vmalloc error: size 4096, failed to allocate pages, mode:0xcc2(GFP_KERNEL|__GFP_HIGHMEM), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 252.603163][ T7593] CPU: 1 PID: 7593 Comm: syz.0.519 Not tainted syzkaller #0 [ 252.610514][ T7593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 252.620588][ T7593] Call Trace: [ 252.623898][ T7593] [ 252.626867][ T7593] dump_stack_lvl+0x18c/0x250 [ 252.631591][ T7593] ? show_regs_print_info+0x20/0x20 [ 252.636827][ T7593] ? load_image+0x420/0x420 [ 252.641362][ T7593] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 252.647788][ T7593] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 252.654293][ T7593] warn_alloc+0x246/0x340 [ 252.658631][ T7593] ? zone_watermark_ok_safe+0x230/0x230 [ 252.664188][ T7593] __vmalloc_node_range+0x1055/0x1320 [ 252.669582][ T7593] ? free_vm_area+0x50/0x50 [ 252.674094][ T7593] ? netlink_sendmsg+0x602/0xbf0 [ 252.679031][ T7593] vmalloc+0x79/0x90 [ 252.682927][ T7593] ? netlink_sendmsg+0x602/0xbf0 [ 252.687874][ T7593] netlink_sendmsg+0x602/0xbf0 [ 252.692645][ T7593] ? netlink_getsockopt+0x590/0x590 [ 252.697843][ T7593] ? apparmor_socket_sendmsg+0x8e/0x330 [ 252.703391][ T7593] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 252.708678][ T7593] ? security_socket_sendmsg+0x80/0xa0 [ 252.714135][ T7593] ? netlink_getsockopt+0x590/0x590 [ 252.719335][ T7593] ____sys_sendmsg+0x61b/0x980 [ 252.724109][ T7593] ? __asan_memset+0x22/0x40 [ 252.728699][ T7593] ? __sys_sendmsg_sock+0x30/0x30 [ 252.733722][ T7593] ? __import_iovec+0x5f2/0x850 [ 252.738597][ T7593] ? import_iovec+0x73/0xa0 [ 252.743124][ T7593] ___sys_sendmsg+0x2a6/0x360 [ 252.747821][ T7593] ? __sys_sendmsg+0x2b0/0x2b0 [ 252.752627][ T7593] __se_sys_sendmsg+0x1d0/0x2c0 [ 252.757494][ T7593] ? __x64_sys_sendmsg+0x80/0x80 [ 252.762448][ T7593] ? lockdep_hardirqs_on+0x98/0x150 [ 252.767652][ T7593] do_syscall_64+0x55/0xb0 [ 252.772092][ T7593] ? clear_bhb_loop+0x40/0x90 [ 252.776783][ T7593] ? clear_bhb_loop+0x40/0x90 [ 252.781461][ T7593] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 252.787361][ T7593] RIP: 0033:0x7f3bfc39e159 [ 252.791782][ T7593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.811392][ T7593] RSP: 002b:00007f3bfd2c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 252.819815][ T7593] RAX: ffffffffffffffda RBX: 00007f3bfc625fa0 RCX: 00007f3bfc39e159 [ 252.827783][ T7593] RDX: 000000000000c860 RSI: 0000200000007dc0 RDI: 0000000000000005 [ 252.835748][ T7593] RBP: 00007f3bfc43506b R08: 0000000000000000 R09: 0000000000000000 [ 252.843714][ T7593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 252.851682][ T7593] R13: 00007f3bfc626038 R14: 00007f3bfc625fa0 R15: 00007ffea64b2168 [ 252.859663][ T7593] [ 252.956721][ T7593] Mem-Info: [ 252.966875][ T7593] active_anon:10455 inactive_anon:0 isolated_anon:9 [ 252.966875][ T7593] active_file:17561 inactive_file:40055 isolated_file:0 [ 252.966875][ T7593] unevictable:768 dirty:59 writeback:0 [ 252.966875][ T7593] slab_reclaimable:10707 slab_unreclaimable:89896 [ 252.966875][ T7593] mapped:24197 shmem:6238 pagetables:488 [ 252.966875][ T7593] sec_pagetables:0 bounce:0 [ 252.966875][ T7593] kernel_misc_reclaimable:0 [ 252.966875][ T7593] free:1339295 free_pcp:15510 free_cma:0 [ 253.050179][ T7593] Node 0 active_anon:27120kB inactive_anon:0kB active_file:70244kB inactive_file:160020kB unevictable:1536kB isolated(anon):36kB isolated(file):0kB mapped:96788kB dirty:232kB writeback:0kB shmem:10616kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10784kB pagetables:1952kB sec_pagetables:0kB all_unreclaimable? no [ 253.321375][ T7593] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 253.357043][ T7593] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 253.566988][ T7593] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 253.621324][ T7593] Node 0 DMA32 free:1466708kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:44584kB inactive_anon:0kB active_file:70244kB inactive_file:159184kB unevictable:1536kB writepending:232kB present:3129332kB managed:2586780kB mlocked:0kB bounce:0kB free_pcp:19124kB local_pcp:8912kB free_cma:0kB [ 253.894949][ T7593] lowmem_reserve[]: 0 0 0 0 0 [ 253.942152][ T7593] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:836kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 254.078653][ T7593] lowmem_reserve[]: 0 0 0 0 0 [ 254.083455][ T7593] Node 1 Normal free:3894344kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:20544kB local_pcp:12064kB free_cma:0kB [ 254.118892][ T7593] lowmem_reserve[]: 0 0 0 0 0 [ 254.123722][ T7593] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 254.144217][ T7593] Node 0 DMA32: 530*4kB (UME) 848*8kB (UME) 1115*16kB (UM) 762*32kB (UME) 350*64kB (UME) 67*128kB (UME) 36*256kB (UME) 23*512kB (UM) 7*1024kB (UM) 6*2048kB (M) 333*4096kB (M) = 1486520kB [ 254.184703][ T7593] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 254.197786][ T7605] program syz.1.522 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 254.201924][ T7593] Node 1 Normal: 250*4kB (UME) 64*8kB (UME) 42*16kB (UME) 98*32kB (UME) 26*64kB (UME) 8*128kB (UM) 1*256kB (M) 2*512kB (UE) 2*1024kB (UE) 2*2048kB (UE) 947*4096kB (M) = 3894344kB [ 254.233133][ T7593] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 254.243033][ T7593] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 254.258941][ T7593] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 254.274681][ T7593] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 254.307232][ T7593] 60964 total pagecache pages [ 254.410407][ T7593] 6 pages in swap cache [ 254.446407][ T7593] Free swap = 124776kB [ 254.528836][ T7593] Total swap = 124996kB [ 254.579778][ T7593] 2097051 pages RAM [ 254.629015][ T7593] 0 pages HighMem/MovableOnly [ 254.685501][ T7593] 416970 pages reserved [ 254.739722][ T7593] 0 pages cma reserved [ 255.993709][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.000105][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.842013][ T7624] random: crng reseeded on system resumption [ 260.291503][ T7647] random: crng reseeded on system resumption [ 261.076664][ T7649] program syz.1.532 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 263.667315][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 265.142547][ T7671] random: crng reseeded on system resumption [ 268.765571][ T7687] program syz.0.543 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 272.470735][ T5784] Bluetooth: Wrong link type (-71) [ 272.478349][ T5784] Bluetooth: hci3: link tx timeout [ 272.483507][ T5784] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 272.624972][ T7706] netlink: 8 bytes leftover after parsing attributes in process `syz.2.550'. [ 273.223582][ T7709] netlink: 144 bytes leftover after parsing attributes in process `syz.2.550'. [ 275.680025][ T5784] Bluetooth: hci3: command 0x0406 tx timeout [ 276.164227][ T7726] random: crng reseeded on system resumption [ 279.731734][ T7738] jffs2: notice: (7738) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 279.851652][ T5777] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 281.546603][ T6079] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 281.726611][ T6079] usb 2-1: Using ep0 maxpacket: 8 [ 281.736222][ T6079] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 281.742774][ T7749] program syz.3.559 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 281.747736][ T6079] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 281.775358][ T6079] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 281.787716][ T6079] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 281.807792][ T6079] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 281.824220][ T6079] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.892582][ T7754] gadgetfs: bound to dummy_udc driver [ 281.906924][ T28] audit: type=1800 audit(1791078029.883:8): pid=7754 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.563" name="ep1in-bulk" dev="gadgetfs" ino=12200 res=0 errno=0 [ 282.058384][ T6079] usb 2-1: GET_CAPABILITIES returned 0 [ 282.068452][ T6079] usbtmc 2-1:16.0: can't read capabilities [ 282.396327][ T6079] usb 2-1: USB disconnect, device number 13 [ 284.387488][ T7773] jffs2: notice: (7773) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 284.586397][ T5777] Bluetooth: Wrong link type (-71) [ 284.592449][ T5777] Bluetooth: hci2: link tx timeout [ 284.597865][ T5777] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 287.167429][ T5777] Bluetooth: hci2: command 0x0406 tx timeout [ 288.060907][ T6079] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 288.806015][ T7795] program syz.1.575 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 288.830529][ T7794] gadgetfs: bound to dummy_udc driver [ 288.845993][ T28] audit: type=1800 audit(1791078036.813:9): pid=7794 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.572" name="ep1in-bulk" dev="gadgetfs" ino=13200 res=0 errno=0 [ 288.916573][ T6079] usb 3-1: Using ep0 maxpacket: 16 [ 288.929929][ T6079] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 288.954116][ T6079] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 289.715177][ T6079] usb 3-1: New USB device found, idVendor=05ac, idProduct=027c, bcdDevice= 0.00 [ 289.724729][ T6079] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 290.172913][ T6079] usb 3-1: config 0 descriptor?? [ 290.596509][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 290.646524][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 290.666517][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 292.037336][ T6079] usbhid 3-1:0.0: can't add hid device: -71 [ 292.039853][ T7811] jffs2: notice: (7811) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 292.043446][ T6079] usbhid: probe of 3-1:0.0 failed with error -71 [ 292.117351][ T6079] usb 3-1: USB disconnect, device number 7 [ 292.308366][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 294.631901][ T7825] gadgetfs: bound to dummy_udc driver [ 294.672461][ T28] audit: type=1800 audit(1791078042.643:10): pid=7825 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.585" name="ep1in-bulk" dev="gadgetfs" ino=13338 res=0 errno=0 [ 299.009399][ T7857] jffs2: notice: (7857) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 299.226441][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 308.131456][ T7907] jffs2: notice: (7907) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 308.309190][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 308.393411][ T7913] autofs4:pid:7913:autofs_fill_super: called with bogus options [ 308.720102][ T7919] syz.0.605[7919]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 309.660511][ T7926] mmap: syz.0.609 (7926): VmData 49479680 exceed data ulimit 14. Update limits or use boot option ignore_rlimit_data. [ 310.597869][ T7931] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 311.297217][ T5829] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 311.616678][ T5829] usb 4-1: Using ep0 maxpacket: 16 [ 311.635292][ T5829] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 311.740293][ T5829] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 313.046990][ T5829] usb 4-1: New USB device found, idVendor=05ac, idProduct=027c, bcdDevice= 0.00 [ 313.104542][ T5829] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.115021][ T5829] usb 4-1: config 0 descriptor?? [ 313.408400][ T7956] CIFS mount error: No usable UNC path provided in device string! [ 313.408400][ T7956] [ 313.418847][ T7956] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 313.548310][ T5829] usbhid 4-1:0.0: can't add hid device: -71 [ 313.609416][ T5829] usbhid: probe of 4-1:0.0 failed with error -71 [ 313.729473][ T5829] usb 4-1: USB disconnect, device number 10 [ 316.740832][ T7978] jffs2: notice: (7978) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 316.941856][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 317.239049][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.245495][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 320.316561][ T6056] usb 4-1: new full-speed USB device number 11 using dummy_hcd [ 320.838266][ T6056] usb 4-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 320.858120][ T6056] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 320.876877][ T6056] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 320.885177][ T6056] usb 4-1: Manufacturer: syz [ 320.892772][ T6056] usb 4-1: SerialNumber: syz [ 321.738753][ T6056] usbhid 4-1:36.0: couldn't find an input interrupt endpoint [ 321.802880][ T6056] usb 4-1: USB disconnect, device number 11 [ 323.806313][ T8025] jffs2: notice: (8025) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 323.902591][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 324.106618][ T5829] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 324.286569][ T5829] usb 3-1: Using ep0 maxpacket: 8 [ 324.301723][ T5829] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 324.311613][ T5829] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 324.604502][ T5829] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 324.626547][ T5829] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 324.639656][ T5829] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 324.650868][ T5829] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 325.610485][ T5829] usb 3-1: GET_CAPABILITIES returned 0 [ 325.617812][ T5829] usbtmc 3-1:16.0: can't read capabilities [ 325.969529][ T6056] usb 3-1: USB disconnect, device number 8 [ 326.366600][ T6054] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 327.258916][ T6054] usb 1-1: config 36 interface 0 altsetting 0 has an invalid endpoint with address 0x7C, skipping [ 327.316625][ T6054] usb 1-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 327.326334][ T6054] usb 1-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 327.346950][ T6054] usb 1-1: Manufacturer: syz [ 327.351591][ T6054] usb 1-1: SerialNumber: syz [ 327.592142][ T6054] usbhid 1-1:36.0: couldn't find an input interrupt endpoint [ 327.642564][ T6054] usb 1-1: USB disconnect, device number 12 [ 327.939111][ T8062] jffs2: notice: (8062) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 328.034961][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 330.226674][ T23] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 330.344465][ T8084] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 330.416773][ T23] usb 1-1: Using ep0 maxpacket: 8 [ 330.429050][ T23] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 330.463567][ T23] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 330.516752][ T23] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 330.526936][ T23] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 330.542843][ T23] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 330.552244][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.811867][ T23] usb 1-1: GET_CAPABILITIES returned 0 [ 330.945420][ T23] usbtmc 1-1:16.0: can't read capabilities [ 331.651990][ T23] usb 1-1: USB disconnect, device number 13 [ 332.129487][ T8100] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 0 (only 8 groups) [ 334.598699][ T8111] jffs2: notice: (8111) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 334.735541][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 338.279454][ T8135] netlink: 28 bytes leftover after parsing attributes in process `syz.3.674'. [ 340.684173][ T8140] jffs2: notice: (8140) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 341.014967][ T5784] Bluetooth: Wrong link type (-71) [ 343.221579][ T8163] netlink: 8 bytes leftover after parsing attributes in process `syz.0.682'. [ 343.620374][ T8168] FAULT_INJECTION: forcing a failure. [ 343.620374][ T8168] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 343.681520][ T8168] CPU: 1 PID: 8168 Comm: syz.0.684 Not tainted syzkaller #0 [ 343.688868][ T8168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 343.698937][ T8168] Call Trace: [ 343.702230][ T8168] [ 343.705148][ T8168] dump_stack_lvl+0x18c/0x250 [ 343.709822][ T8168] ? show_regs_print_info+0x20/0x20 [ 343.715018][ T8168] ? load_image+0x420/0x420 [ 343.719536][ T8168] ? __might_fault+0xaa/0x120 [ 343.724205][ T8168] ? __lock_acquire+0x7eb0/0x7eb0 [ 343.729216][ T8168] ? udp_sendmsg+0x1ae1/0x23d0 [ 343.733964][ T8168] ? __virt_addr_valid+0x10c/0x380 [ 343.739067][ T8168] should_fail_ex+0x394/0x4c0 [ 343.743743][ T8168] _copy_from_user+0x2f/0xe0 [ 343.748326][ T8168] csum_and_copy_from_iter+0x1f3/0x1480 [ 343.753873][ T8168] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 343.759507][ T8168] ? __kmem_cache_alloc_node+0x194/0x250 [ 343.765140][ T8168] ? __alloc_skb+0x138/0x2c0 [ 343.769721][ T8168] ? rcu_is_watching+0x15/0xb0 [ 343.774497][ T8168] ip_generic_getfrag+0x163/0x2f0 [ 343.779515][ T8168] ? ip_skb_dst_mtu+0x870/0x870 [ 343.784355][ T8168] ? __build_skb_around+0x245/0x3c0 [ 343.789547][ T8168] ? __alloc_skb+0x1b2/0x2c0 [ 343.794127][ T8168] ? skb_put+0x112/0x210 [ 343.798396][ T8168] __ip_append_data+0x2f3b/0x3bf0 [ 343.803436][ T8168] ? ip_skb_dst_mtu+0x870/0x870 [ 343.808291][ T8168] ? ip_setup_cork+0x840/0x840 [ 343.813054][ T8168] ? ip_setup_cork+0x527/0x840 [ 343.817812][ T8168] ip_make_skb+0x22b/0x440 [ 343.822223][ T8168] ? ip_skb_dst_mtu+0x870/0x870 [ 343.827276][ T8168] ? ip_flush_pending_frames+0x250/0x250 [ 343.832936][ T8168] ? verify_lock_unused+0x140/0x140 [ 343.838135][ T8168] udp_sendmsg+0x1ae1/0x23d0 [ 343.842727][ T8168] ? ip_skb_dst_mtu+0x870/0x870 [ 343.847586][ T8168] ? udp_cmsg_send+0x350/0x350 [ 343.852357][ T8168] ? mark_lock+0x94/0x320 [ 343.856691][ T8168] ? __lock_acquire+0x135d/0x7eb0 [ 343.861738][ T8168] ? __schedule+0x15b6/0x4660 [ 343.866447][ T8168] udpv6_sendmsg+0x7a4/0x2390 [ 343.871126][ T8168] ? __might_sleep+0xe0/0xe0 [ 343.875706][ T8168] ? udp_v6_early_demux+0xf90/0xf90 [ 343.880905][ T8168] ? aa_af_perm+0x330/0x330 [ 343.885405][ T8168] ? sock_rps_record_flow+0x19/0x3f0 [ 343.890700][ T8168] ? inet_send_prepare+0x5b/0x250 [ 343.895717][ T8168] ? inet6_sendmsg+0x5f/0xd0 [ 343.900303][ T8168] sock_write_iter+0x2dc/0x420 [ 343.905082][ T8168] ? sock_read_iter+0x3f0/0x3f0 [ 343.909930][ T8168] ? common_file_perm+0x198/0x1f0 [ 343.914948][ T8168] vfs_write+0x474/0x9a0 [ 343.919186][ T8168] ? file_end_write+0x250/0x250 [ 343.924041][ T8168] ? __fget_files+0x3fc/0x460 [ 343.928742][ T8168] ? __fdget_pos+0x1d8/0x330 [ 343.933321][ T8168] ? ksys_write+0x74/0x260 [ 343.937735][ T8168] ksys_write+0x151/0x260 [ 343.942060][ T8168] ? __ia32_sys_read+0x90/0x90 [ 343.946823][ T8168] ? lockdep_hardirqs_on+0x98/0x150 [ 343.952105][ T8168] do_syscall_64+0x55/0xb0 [ 343.956523][ T8168] ? clear_bhb_loop+0x40/0x90 [ 343.961226][ T8168] ? clear_bhb_loop+0x40/0x90 [ 343.965893][ T8168] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 343.971780][ T8168] RIP: 0033:0x7f3bfc39e159 [ 343.976193][ T8168] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.995790][ T8168] RSP: 002b:00007f3bfd2c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 344.004191][ T8168] RAX: ffffffffffffffda RBX: 00007f3bfc625fa0 RCX: 00007f3bfc39e159 [ 344.012151][ T8168] RDX: 0000000000003f80 RSI: 0000200000000300 RDI: 0000000000000003 [ 344.020123][ T8168] RBP: 00007f3bfc43506b R08: 0000000000000000 R09: 0000000000000000 [ 344.028082][ T8168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 344.036048][ T8168] R13: 00007f3bfc626038 R14: 00007f3bfc625fa0 R15: 00007ffea64b2168 [ 344.044018][ T8168] [ 349.477443][ T8196] jffs2: notice: (8196) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 349.599016][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 352.533000][ T8208] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 354.362016][ T8235] jffs2: notice: (8235) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 354.476526][ T5784] Bluetooth: Wrong link type (-71) [ 357.316583][ T23] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 357.496595][ T23] usb 3-1: Using ep0 maxpacket: 16 [ 357.507425][ T23] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 357.526745][ T23] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 357.538722][ T23] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 357.556582][ T23] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.564595][ T23] usb 3-1: Product: syz [ 357.576806][ T23] usb 3-1: Manufacturer: syz [ 357.584763][ T23] usb 3-1: SerialNumber: syz [ 357.835975][ T23] usb 3-1: 0:2 : does not exist [ 357.941162][ T23] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 358.507361][ T23] usb 3-1: USB disconnect, device number 9 [ 358.584831][ T8263] udevd[8263]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 358.624527][ T28] audit: type=1326 audit(1791078106.593:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8265 comm="syz.1.715" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 358.681150][ T8268] jffs2: notice: (8268) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 358.699949][ T28] audit: type=1326 audit(1791078106.623:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8265 comm="syz.1.715" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 358.729898][ T28] audit: type=1326 audit(1791078106.633:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8265 comm="syz.1.715" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=270 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 358.761270][ T28] audit: type=1326 audit(1791078106.673:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8265 comm="syz.1.715" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 358.785445][ T28] audit: type=1326 audit(1791078106.673:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8265 comm="syz.1.715" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 360.161323][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 361.139049][ T6054] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 361.346681][ T6054] usb 3-1: Using ep0 maxpacket: 16 [ 361.373067][ T6054] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 361.399724][ T6054] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 361.436613][ T6054] usb 3-1: New USB device found, idVendor=05ac, idProduct=027c, bcdDevice= 0.00 [ 361.462513][ T6054] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 361.487397][ T6054] usb 3-1: config 0 descriptor?? [ 362.790331][ T6054] usbhid 3-1:0.0: can't add hid device: -71 [ 362.796627][ T6054] usbhid: probe of 3-1:0.0 failed with error -71 [ 362.824323][ T6054] usb 3-1: USB disconnect, device number 10 [ 362.868026][ T8308] jffs2: notice: (8308) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 362.994716][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 365.656838][ T5829] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 365.849467][ T5829] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 365.863958][ T5829] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 367.147083][ T5829] usb 3-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 367.173616][ T5829] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 367.222912][ T8353] jffs2: notice: (8353) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 367.314478][ T5784] Bluetooth: Wrong link type (-71) [ 368.114592][ T5829] rtsx_usb: probe of 3-1:1.0 failed with error -71 [ 368.276333][ T5829] usb 3-1: USB disconnect, device number 11 [ 369.878982][ T8379] jffs2: notice: (8379) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 369.946461][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 370.034254][ T8391] netlink: 76 bytes leftover after parsing attributes in process `syz.0.760'. [ 370.288984][ T8397] random: crng reseeded on system resumption [ 372.202162][ T8416] netlink: 76 bytes leftover after parsing attributes in process `syz.2.769'. [ 372.318187][ T8420] jffs2: notice: (8420) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 372.375562][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 373.438651][ T8434] gadgetfs: bound to dummy_udc driver [ 373.464680][ T28] audit: type=1800 audit(1791078121.433:16): pid=8434 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.776" name="ep1in-bulk" dev="gadgetfs" ino=14144 res=0 errno=0 [ 373.678971][ T8447] netlink: 76 bytes leftover after parsing attributes in process `syz.1.779'. [ 374.942537][ T8470] jffs2: notice: (8470) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 375.011987][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 377.894489][ T28] audit: type=1326 audit(1791078125.813:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8504 comm="syz.2.802" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8ea379e159 code=0x0 [ 378.687615][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.694672][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.242342][ T8519] gadgetfs: bound to dummy_udc driver [ 379.275352][ T28] audit: type=1800 audit(1791078127.243:18): pid=8519 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.806" name="ep1in-bulk" dev="gadgetfs" ino=14274 res=0 errno=0 [ 379.352800][ T8525] jffs2: notice: (8525) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 379.451664][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 379.600282][ T8532] random: crng reseeded on system resumption [ 381.926615][ T8551] netlink: 'syz.2.814': attribute type 3 has an invalid length. [ 382.107878][ T8559] jffs2: notice: (8559) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 382.208261][ T5784] Bluetooth: Wrong link type (-71) [ 384.588177][ T8582] netlink: 20 bytes leftover after parsing attributes in process `syz.1.826'. [ 384.640278][ T8584] gadgetfs: bound to dummy_udc driver [ 384.667385][ T28] audit: type=1800 audit(1791078132.643:19): pid=8584 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.827" name="ep1in-bulk" dev="gadgetfs" ino=16434 res=0 errno=0 [ 384.930834][ T8593] jffs2: notice: (8593) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 385.166742][ T6057] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 385.715716][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 385.776804][ T6057] usb 4-1: Using ep0 maxpacket: 16 [ 385.791133][ T6057] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 385.802577][ T6057] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 385.971040][ T6057] usb 4-1: New USB device found, idVendor=05ac, idProduct=027c, bcdDevice= 0.00 [ 386.292254][ T6057] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 386.366877][ T6057] usb 4-1: config 0 descriptor?? [ 387.901344][ T6057] usbhid 4-1:0.0: can't add hid device: -71 [ 387.916842][ T6057] usbhid: probe of 4-1:0.0 failed with error -71 [ 387.952236][ T6057] usb 4-1: USB disconnect, device number 12 [ 388.052194][ T8617] mmap: syz.0.838 (8617) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 389.289140][ T8634] jffs2: notice: (8634) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 389.705525][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 389.897180][ T8647] fuse: Bad value for 'fd' [ 396.282228][ T8709] netlink: 120 bytes leftover after parsing attributes in process `syz.1.869'. [ 396.316820][ T8709] netlink: 12 bytes leftover after parsing attributes in process `syz.1.869'. [ 396.341508][ T8709] netlink: 16 bytes leftover after parsing attributes in process `syz.1.869'. [ 398.758418][ T8748] netlink: 28 bytes leftover after parsing attributes in process `syz.3.881'. [ 400.563758][ T8758] netlink: 12 bytes leftover after parsing attributes in process `syz.3.885'. [ 402.643716][ T8788] netlink: 12 bytes leftover after parsing attributes in process `syz.3.896'. [ 404.538191][ T8820] netlink: 12 bytes leftover after parsing attributes in process `syz.3.907'. [ 406.293113][ T8846] netlink: 36 bytes leftover after parsing attributes in process `syz.0.916'. [ 408.399862][ T8871] netlink: 36 bytes leftover after parsing attributes in process `syz.0.927'. [ 409.642510][ T8879] netlink: 4 bytes leftover after parsing attributes in process `syz.0.931'. [ 411.601211][ T8894] netlink: 36 bytes leftover after parsing attributes in process `syz.3.936'. [ 413.968877][ T8922] netlink: 76 bytes leftover after parsing attributes in process `syz.1.945'. [ 416.989106][ T8952] netlink: 76 bytes leftover after parsing attributes in process `syz.0.955'. [ 420.036618][ T8993] jffs2: notice: (8993) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 420.167710][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 420.446601][ T9005] netlink: 28 bytes leftover after parsing attributes in process `syz.1.973'. [ 421.218726][ T28] audit: type=1326 audit(1791078169.193:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 421.268678][ T28] audit: type=1326 audit(1791078169.193:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 421.359824][ T28] audit: type=1326 audit(1791078169.203:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 421.423763][ T28] audit: type=1326 audit(1791078169.203:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 421.570780][ T28] audit: type=1326 audit(1791078169.203:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 421.595453][ T28] audit: type=1326 audit(1791078169.203:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 421.676763][ T28] audit: type=1326 audit(1791078169.203:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 421.839018][ T28] audit: type=1326 audit(1791078169.203:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 422.675654][ T28] audit: type=1326 audit(1791078169.203:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 422.754319][ T28] audit: type=1326 audit(1791078169.203:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9011 comm="syz.1.975" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 422.991199][ T9034] netlink: 12 bytes leftover after parsing attributes in process `syz.1.981'. [ 425.002097][ T9049] jffs2: notice: (9049) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 425.203540][ T5784] Bluetooth: Wrong link type (-71) [ 425.209351][ T5784] Bluetooth: hci0: link tx timeout [ 425.214932][ T5784] Bluetooth: hci0: killing stalled connection 11:aa:aa:aa:aa:aa [ 425.803753][ T9061] netlink: 28 bytes leftover after parsing attributes in process `syz.0.985'. [ 427.309907][ T9053] Bluetooth: hci0: command 0x0406 tx timeout [ 428.530604][ T9081] netlink: 28 bytes leftover after parsing attributes in process `syz.0.994'. [ 430.930509][ T9097] jffs2: notice: (9097) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 431.019240][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 436.325333][ T9147] jffs2: notice: (9147) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 437.099091][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 440.101889][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.108316][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 442.013459][ T9194] jffs2: notice: (9194) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 442.864122][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 447.121214][ T9237] jffs2: notice: (9237) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 447.288663][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 449.763352][ T9255] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1041'. [ 452.378674][ T9273] jffs2: notice: (9273) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 452.533561][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 458.707469][ T9316] jffs2: notice: (9316) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 458.848424][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 462.067537][ T9349] jffs2: notice: (9349) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 462.374603][ T9353] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1080'. [ 462.997624][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 465.946065][ T9370] overlayfs: failed to clone upperpath [ 467.292596][ T9381] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1091'. [ 478.143208][ T9481] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1124'. [ 483.643288][ T9540] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1139'. [ 488.106319][ T9584] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1158'. [ 488.753807][ T9593] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1162'. [ 489.976735][ T9612] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1167'. [ 489.985842][ T9612] vlan0: entered promiscuous mode [ 490.232543][ T9616] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1169'. [ 497.426964][ T9702] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1200'. [ 499.048010][ T9711] CIFS mount error: No usable UNC path provided in device string! [ 499.048010][ T9711] [ 499.058356][ T9711] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 501.541680][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.548074][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.611939][ T9747] capability: warning: `syz.0.1215' uses 32-bit capabilities (legacy support in use) [ 509.449503][ T9841] netlink: 'syz.3.1250': attribute type 1 has an invalid length. [ 509.471083][ T9841] netlink: 'syz.3.1250': attribute type 2 has an invalid length. [ 509.533680][ T5784] Bluetooth: hci1: unexpected event for opcode 0x1003 [ 510.275573][ T9841] ceph: No mds server is up or the cluster is laggy [ 511.406171][ T9875] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1260'. [ 518.917564][ T9947] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1284'. [ 523.798999][ T9996] jffs2: notice: (9996) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 523.954499][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 529.165869][T10052] jffs2: notice: (10052) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 529.244064][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 532.064511][T10091] jffs2: notice: (10091) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 532.139474][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 536.439028][T10137] jffs2: notice: (10137) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 536.617290][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 541.127694][T10179] jffs2: notice: (10179) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 541.259107][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 544.602111][ T5784] Bluetooth: hci0: unexpected event for opcode 0x1003 [ 546.647777][T10216] jffs2: notice: (10216) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 548.211118][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 550.920612][ T5784] Bluetooth: hci1: unexpected event for opcode 0x1003 [ 553.348884][T10268] jffs2: notice: (10268) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 553.546807][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 559.554171][T10315] jffs2: notice: (10315) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 560.432145][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 561.666336][T10330] syz.2.1393 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 562.982379][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.991679][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 566.175976][T10368] jffs2: notice: (10368) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 566.294094][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 566.652041][ T5784] Bluetooth: hci1: unexpected event for opcode 0x1003 [ 569.027316][T10395] jffs2: notice: (10395) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 569.988784][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 571.288096][ T5784] Bluetooth: hci2: unexpected event for opcode 0x1003 [ 573.569130][T10437] jffs2: notice: (10437) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 573.687926][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 574.365331][ T5784] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 577.164775][T10481] jffs2: notice: (10481) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 577.338513][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 578.161694][ T5784] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 582.020961][T10518] jffs2: notice: (10518) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 582.101939][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 582.598167][ T5784] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 584.727181][T10547] 9pnet_fd: Insufficient options for proto=fd [ 585.098704][ T23] IPVS: starting estimator thread 0... [ 585.192440][T10563] IPVS: using max 20 ests per chain, 48000 per kthread [ 586.700771][T10573] jffs2: notice: (10573) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 586.734245][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 587.977869][ T5784] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 588.178323][T10593] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 588.256229][T10597] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1485'. [ 588.268855][T10597] hsr_slave_0: left promiscuous mode [ 588.274924][T10597] hsr_slave_1: left promiscuous mode [ 591.114396][T10630] jffs2: notice: (10630) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 591.244294][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 591.328294][ T5784] Bluetooth: hci3: unexpected event for opcode 0x1003 [ 594.107825][T10658] jffs2: notice: (10658) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 595.141793][ T5784] Bluetooth: hci2: unexpected event for opcode 0x1003 [ 595.170270][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 596.730443][ T5784] Bluetooth: hci1: unexpected event for opcode 0x1003 [ 596.853151][T10697] jffs2: notice: (10697) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 596.920619][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 597.847459][ T5784] Bluetooth: hci2: unexpected event for opcode 0x1003 [ 598.045609][T10724] jffs2: notice: (10724) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 598.073237][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 599.080671][ T5784] Bluetooth: hci2: unexpected event for opcode 0x1003 [ 599.862912][T10764] jffs2: notice: (10764) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 599.901797][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 600.196031][ T5784] Bluetooth: hci1: unexpected event for opcode 0x1003 [ 602.364456][T10807] jffs2: notice: (10807) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 602.436165][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 607.565355][T10857] jffs2: notice: (10857) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 607.679956][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 608.844729][ T28] kauditd_printk_skb: 8 callbacks suppressed [ 608.844747][ T28] audit: type=1326 audit(1791078356.581:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10871 comm="syz.1.1585" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faced19e159 code=0x0 [ 610.079520][T10893] jffs2: notice: (10893) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 610.858806][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 611.611624][T10912] atomic_op ffff8880278f8998 conn xmit_atomic 0000000000000000 [ 612.708594][T10921] netlink: 'syz.3.1602': attribute type 29 has an invalid length. [ 612.730609][T10921] netlink: 'syz.3.1602': attribute type 29 has an invalid length. [ 612.767881][T10922] netlink: 'syz.3.1602': attribute type 29 has an invalid length. [ 612.786618][T10921] netlink: 'syz.3.1602': attribute type 29 has an invalid length. [ 612.807174][T10921] netlink: 'syz.3.1602': attribute type 29 has an invalid length. [ 612.937611][T10925] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1604'. [ 614.258867][T10939] jffs2: notice: (10939) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 614.691883][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 615.707826][T10953] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1614'. [ 620.428433][T10990] jffs2: notice: (10990) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 620.518925][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 621.418214][T11004] netlink: 'syz.1.1627': attribute type 1 has an invalid length. [ 621.653617][T11004] 8021q: adding VLAN 0 to HW filter on device bond1 [ 621.862701][T11010] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1632'. [ 623.478116][T11029] atomic_op ffff888027168998 conn xmit_atomic 0000000000000000 [ 625.077984][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.085044][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 627.218765][T11049] jffs2: notice: (11049) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 627.305186][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 627.818251][T11068] atomic_op ffff88807cc3c198 conn xmit_atomic 0000000000000000 [ 629.325390][T11084] overlayfs: failed to clone upperpath [ 630.032521][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 630.152352][T11099] atomic_op ffff88805e631198 conn xmit_atomic 0000000000000000 [ 631.683767][T11107] jffs2: notice: (11107) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 632.392770][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 636.862851][T11149] atomic_op ffff88805e6e0998 conn xmit_atomic 0000000000000000 [ 637.081634][T11157] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1679'. [ 637.199915][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 639.798716][T11181] netlink: 276 bytes leftover after parsing attributes in process `syz.3.1689'. [ 640.761161][T11189] overlayfs: failed to clone upperpath [ 640.788467][T11189] overlayfs: failed to clone upperpath [ 643.748618][T11208] jffs2: notice: (11208) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 643.815907][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 644.376723][T11226] fuse: Bad value for 'fd' [ 644.518634][T11229] ip_tables: iptables: counters copy to user failed while replacing table [ 646.362282][T11246] jffs2: notice: (11246) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 646.419346][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 650.188536][T11280] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1716'. [ 652.584266][T11292] jffs2: notice: (11292) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 652.697022][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 655.853654][T11319] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 655.890836][T11319] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 656.333429][T11329] jffs2: notice: (11329) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 656.423512][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 659.693848][T11362] jffs2: notice: (11362) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 659.779975][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 662.747658][T11385] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1750'. [ 663.288361][T11393] jffs2: notice: (11393) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 663.399941][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 667.417569][T11444] jffs2: notice: (11444) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 667.766355][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 670.074158][T11466] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1773'. [ 674.001088][T11509] jffs2: notice: (11509) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 674.221952][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 675.535449][T11522] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1795'. [ 679.145108][T11542] jffs2: notice: (11542) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 679.219506][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 679.750408][T11568] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1810'. [ 680.963992][T11576] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1819'. [ 682.323839][T11595] jffs2: notice: (11595) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 682.782734][T11604] netlink: 27 bytes leftover after parsing attributes in process `syz.1.1829'. [ 683.949397][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 685.449972][T11632] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1835'. [ 685.694603][T11636] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1830'. [ 685.860860][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.868774][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.786136][T11653] jffs2: notice: (11653) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 688.211371][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 689.023331][T11669] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1846'. [ 690.895450][T11681] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1851'. [ 691.068053][T11688] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1854'. [ 692.942259][T11703] jffs2: notice: (11703) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 693.129312][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 693.140185][T11710] fuse: Bad value for 'fd' [ 693.253030][T11713] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1857'. [ 696.861062][T11751] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1872'. [ 698.658252][T11765] jffs2: notice: (11765) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 698.782381][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 700.078935][T11785] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1883'. [ 701.654492][T11793] fuse: Bad value for 'fd' [ 702.478169][T11813] atomic_op ffff88805d910198 conn xmit_atomic 0000000000000000 [ 704.304969][T11830] jffs2: notice: (11830) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 704.349591][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 706.223468][T11845] fuse: Bad value for 'fd' [ 707.496377][T11860] Invalid option length (0) for dns_resolver key [ 710.777713][T11884] jffs2: notice: (11884) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 710.939234][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 718.022478][T11955] jffs2: notice: (11955) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 718.208393][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 722.157456][T12009] jffs2: notice: (12009) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 722.196458][T12009] overlayfs: failed to clone upperpath [ 722.206676][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 722.987731][T12018] jffs2: notice: (12018) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 723.063820][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 728.432389][T12081] jffs2: notice: (12081) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 728.500696][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 729.472448][T12097] 8021q: adding VLAN 0 to HW filter on device bond0 [ 729.495152][T12097] 8021q: adding VLAN 0 to HW filter on device team0 [ 729.904091][T12097] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 729.922818][T12098] netlink: 'syz.1.1982': attribute type 4 has an invalid length. [ 732.112658][T12097] syz.1.1982 (12097) used greatest stack depth: 19192 bytes left [ 732.670317][T12156] jffs2: notice: (12156) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 732.713167][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 733.128917][T12168] Invalid option length (0) for dns_resolver key [ 734.380057][T12189] process 'syz.2.1998' launched './file0' with NULL argv: empty string added [ 736.199216][T12216] jffs2: notice: (12216) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 736.316835][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 736.858289][T12233] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2008'. [ 739.480417][T12278] jffs2: notice: (12278) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 739.710266][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 744.337204][T12328] jffs2: notice: (12328) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 744.389130][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 747.300350][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.312856][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 750.381626][T12382] jffs2: notice: (12382) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 751.511555][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 756.847650][T12439] jffs2: notice: (12439) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 756.928095][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 759.768317][ T5784] Bluetooth: hci3: unexpected event for opcode 0x2040 [ 760.123851][T12481] jffs2: notice: (12481) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 760.273300][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 764.681241][T12521] jffs2: notice: (12521) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 767.052724][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 769.388615][T12558] ip_tables: iptables: counters copy to user failed while replacing table [ 771.509648][T12569] jffs2: notice: (12569) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 772.287194][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 773.933404][T12599] ip_tables: iptables: counters copy to user failed while replacing table [ 775.303169][T12611] tipc: Started in network mode [ 775.322846][T12611] tipc: Node identity 7f000001, cluster identity 4711 [ 775.349720][T12611] tipc: Enabled bearer , priority 10 [ 776.538992][T11996] tipc: Node number set to 2130706433 [ 776.734989][T12628] jffs2: notice: (12628) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 776.801656][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 782.066413][T12685] jffs2: notice: (12685) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 782.310716][ T5784] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 782.982673][T12700] ip_tables: iptables: counters copy to user failed while replacing table [ 785.277056][T12738] ip_tables: iptables: counters copy to user failed while replacing table [ 786.284698][T12747] jffs2: notice: (12747) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 786.440477][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 788.247240][T12776] ip_tables: iptables: counters copy to user failed while replacing table [ 789.630398][ T28] audit: type=1326 audit(1791078543.605:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12784 comm="syz.2.2166" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8ea379e159 code=0x0 [ 791.412230][T12805] jffs2: notice: (12805) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 791.482944][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 791.592313][T12812] ip_tables: iptables: counters copy to user failed while replacing table [ 793.951390][T12832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 793.966306][T12832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 794.018297][T12832] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 794.122396][T12832] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 794.352060][T12839] ip_tables: iptables: counters copy to user failed while replacing table [ 794.706231][T12841] Invalid option length (0) for dns_resolver key [ 796.482663][T12862] jffs2: notice: (12862) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 796.679127][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 796.775772][T12872] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5770] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[12872] [ 797.744119][T12878] ip_tables: iptables: counters copy to user failed while replacing table [ 799.377712][T12890] Invalid option length (0) for dns_resolver key [ 801.414615][T12920] ip_tables: iptables: counters copy to user failed while replacing table [ 802.565441][T12928] Invalid option length (0) for dns_resolver key [ 805.021825][T12953] ip_tables: iptables: counters copy to user failed while replacing table [ 808.221963][T12992] Invalid option length (0) for dns_resolver key [ 808.813683][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.820142][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.484873][T13001] ip_tables: iptables: counters copy to user failed while replacing table [ 809.970327][T13003] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2233'. [ 810.223215][T13003] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 811.915135][T13030] Invalid option length (0) for dns_resolver key [ 813.020647][T13039] ip_tables: iptables: counters copy to user failed while replacing table [ 814.658387][T13045] atomic_op ffff88807cbf3998 conn xmit_atomic 0000000000000000 [ 816.466840][T13060] Invalid option length (0) for dns_resolver key [ 816.747599][T13069] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2250'. [ 817.383636][T13078] fuse: Bad value for 'fd' [ 817.469568][T13077] atomic_op ffff88801af4c198 conn xmit_atomic 0000000000000000 [ 818.765104][T13100] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.2260'. [ 819.534800][T13109] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2263'. [ 820.221610][T13113] atomic_op ffff88807ef87998 conn xmit_atomic 0000000000000000 [ 822.440076][T13145] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2275'. [ 823.769411][T13151] atomic_op ffff88805e52f198 conn xmit_atomic 0000000000000000 [ 826.206438][T13179] atomic_op ffff88807bdbb198 conn xmit_atomic 0000000000000000 [ 826.516427][T13183] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2285'. [ 830.415424][T13213] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2296'. [ 830.424766][T13218] atomic_op ffff88807736c998 conn xmit_atomic 0000000000000000 [ 832.709785][ T28] audit: type=1326 audit(1791078586.685:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 832.774539][ T28] audit: type=1326 audit(1791078586.685:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 832.844383][ T28] audit: type=1326 audit(1791078586.685:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 832.911765][ T28] audit: type=1326 audit(1791078586.685:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 832.966184][ T28] audit: type=1326 audit(1791078586.715:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 832.991682][ T28] audit: type=1326 audit(1791078586.715:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 833.063202][T13255] atomic_op ffff88807736c198 conn xmit_atomic 0000000000000000 [ 833.300220][ T28] audit: type=1326 audit(1791078586.715:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 833.641643][ T28] audit: type=1326 audit(1791078586.725:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 833.737044][ T28] audit: type=1326 audit(1791078586.725:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 833.761166][ T28] audit: type=1326 audit(1791078586.725:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13249 comm="syz.1.2307" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7faced19e159 code=0x7ffc0000 [ 834.365002][T13268] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2309'. [ 834.887649][T13272] fuse: Bad value for 'fd' [ 834.947049][T13274] jffs2: notice: (13274) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 835.004237][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 836.530464][T13288] atomic_op ffff888077368998 conn xmit_atomic 0000000000000000 [ 837.971924][T13300] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2321'. [ 839.862194][T13315] jffs2: notice: (13315) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 839.939194][ T5784] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 842.337745][T13337] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2330'. [ 842.817075][T13348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2334'. [ 843.088006][T13356] jffs2: notice: (13356) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 843.102962][T13358] atomic_op ffff88807eefe998 conn xmit_atomic 0000000000000000 [ 843.198496][ T5784] Bluetooth: hci2: ACL packet for unknown connection handle 201 [ 845.503710][T13384] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2341'. [ 848.107173][T13419] atomic_op ffff888078a9d198 conn xmit_atomic 0000000000000000 [ 850.767579][T13450] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5770] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[13450] [ 850.827539][ T5784] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 853.259023][T13474] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 853.273063][T13474] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 853.281825][T13474] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 853.400095][T13474] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 853.411899][T13474] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 853.420365][T13474] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 856.256983][ T5784] Bluetooth: hci3: command tx timeout [ 856.293929][T13471] chnl_net:caif_netlink_parms(): no params data found [ 856.576420][T13471] bridge0: port 1(bridge_slave_0) entered blocking state [ 856.596124][T13471] bridge0: port 1(bridge_slave_0) entered disabled state [ 856.619618][T13471] bridge_slave_0: entered allmulticast mode [ 856.643976][T13471] bridge_slave_0: entered promiscuous mode [ 856.721207][T13471] bridge0: port 2(bridge_slave_1) entered blocking state [ 856.738842][T13471] bridge0: port 2(bridge_slave_1) entered disabled state [ 856.769918][T13471] bridge_slave_1: entered allmulticast mode [ 856.817360][T13471] bridge_slave_1: entered promiscuous mode [ 857.017028][T13471] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 857.053781][T13471] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 857.213462][T13527] futex_wake_op: syz.2.2378 tries to shift op by 144; fix this program [ 857.982642][T13471] team0: Port device team_slave_0 added [ 858.009026][T13471] team0: Port device team_slave_1 added [ 858.068531][T13471] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 858.081152][T13471] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 858.109690][T13471] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 858.161943][T13471] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 858.181244][T13471] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 858.272514][T13471] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 858.347362][ T5784] Bluetooth: hci3: command tx timeout [ 859.150506][ T12] hsr_slave_0: left promiscuous mode [ 859.157363][ T12] hsr_slave_1: left promiscuous mode [ 859.163646][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 859.173253][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 859.182032][ T12] bridge_slave_1: left allmulticast mode [ 859.187840][ T12] bridge_slave_1: left promiscuous mode [ 859.195215][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 859.205377][ T12] bridge_slave_0: left allmulticast mode [ 859.211208][ T12] bridge_slave_0: left promiscuous mode [ 859.220247][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 859.432503][T13541] xt_policy: too many policy elements [ 859.687014][ T12] bond1 (unregistering): Released all slaves [ 860.416777][ T5784] Bluetooth: hci3: command tx timeout [ 860.600199][ T28] kauditd_printk_skb: 53 callbacks suppressed [ 860.600213][ T28] audit: type=1326 audit(1791078614.575:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13551 comm="syz.3.2385" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f65db59e159 code=0x0 [ 861.510712][ T12] team0 (unregistering): Port device team_slave_1 removed [ 861.567312][ T12] team0 (unregistering): Port device team_slave_0 removed [ 861.665622][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 861.748607][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 862.499783][ T5784] Bluetooth: hci3: command tx timeout [ 862.996993][ T12] bond0 (unregistering): Released all slaves [ 863.677646][T13471] hsr_slave_0: entered promiscuous mode [ 863.696419][T13471] hsr_slave_1: entered promiscuous mode [ 866.575820][T13471] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 866.664781][T13471] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 866.719899][T13471] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 866.791897][T13471] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 867.591682][T13471] 8021q: adding VLAN 0 to HW filter on device bond0 [ 867.710230][T13471] 8021q: adding VLAN 0 to HW filter on device team0 [ 867.768289][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 867.775465][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 868.019891][T13471] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 868.030420][T13471] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 868.061222][ T70] bridge0: port 2(bridge_slave_1) entered blocking state [ 868.068418][ T70] bridge0: port 2(bridge_slave_1) entered forwarding state [ 870.110068][T13471] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 870.190906][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.198669][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.300775][T13471] veth0_vlan: entered promiscuous mode [ 870.323042][T13471] veth1_vlan: entered promiscuous mode [ 870.352836][T13471] veth0_macvtap: entered promiscuous mode [ 870.407420][T13471] veth1_macvtap: entered promiscuous mode [ 870.443772][T13471] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 870.504204][T13471] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 870.542571][T13471] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 870.588871][T13471] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 870.631498][T13471] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 870.670520][T13471] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 870.856104][T13471] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 870.896116][T13471] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 870.905895][T13471] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 870.915826][T13471] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 871.858314][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 871.870306][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 871.973782][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 872.011274][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 874.635608][T13703] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2413'. [ 875.074351][T13474] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 875.092434][T13474] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 875.111443][T13474] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 875.131520][T13474] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 875.163006][T13474] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 875.170407][T13474] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 875.808344][T13474] Bluetooth: hci2: unexpected event for opcode 0x2003 [ 877.036218][T13702] chnl_net:caif_netlink_parms(): no params data found [ 877.296808][T13474] Bluetooth: hci4: command tx timeout [ 877.407190][T13742] binder_alloc: 13741: pid 13741 spamming oneway? 1 buffers allocated for a total size of 4096 [ 877.480322][T13702] bridge0: port 1(bridge_slave_0) entered blocking state [ 877.500781][T13702] bridge0: port 1(bridge_slave_0) entered disabled state [ 877.517172][T13702] bridge_slave_0: entered allmulticast mode [ 877.528564][T13702] bridge_slave_0: entered promiscuous mode [ 877.565503][T13702] bridge0: port 2(bridge_slave_1) entered blocking state [ 877.573697][T13702] bridge0: port 2(bridge_slave_1) entered disabled state [ 877.593777][T13702] bridge_slave_1: entered allmulticast mode [ 877.606679][T13702] bridge_slave_1: entered promiscuous mode [ 878.048720][T13702] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 878.081349][T13702] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 878.340315][T13702] team0: Port device team_slave_0 added [ 878.350380][T13702] team0: Port device team_slave_1 added [ 878.467817][T13777] Invalid option length (0) for dns_resolver key [ 878.594021][T13702] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 878.633221][T13702] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 878.711153][T13702] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 878.753607][T13702] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 878.777910][T13702] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 878.864662][T13702] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 879.082849][T13702] hsr_slave_0: entered promiscuous mode [ 879.095221][T13702] hsr_slave_1: entered promiscuous mode [ 879.125236][T13702] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 879.132953][T13702] Cannot create hsr debugfs directory [ 879.378235][T13474] Bluetooth: hci4: command tx timeout [ 879.446939][ T12] hsr_slave_0: left promiscuous mode [ 879.480408][ T12] hsr_slave_1: left promiscuous mode [ 879.514719][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 879.559318][ T12] bridge_slave_1: left allmulticast mode [ 879.566561][ T12] bridge_slave_1: left promiscuous mode [ 879.583638][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 879.637682][ T12] bridge_slave_0: left allmulticast mode [ 879.643363][ T12] bridge_slave_0: left promiscuous mode [ 879.659699][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 881.456826][T13474] Bluetooth: hci4: command tx timeout [ 882.088545][ T12] team0 (unregistering): Port device team_slave_1 removed [ 882.288546][ T12] team0 (unregistering): Port device team_slave_0 removed [ 882.576303][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 882.787431][T13831] Invalid option length (0) for dns_resolver key [ 882.828601][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 883.636584][T13474] Bluetooth: hci4: command tx timeout [ 885.466662][ T12] bond0 (unregistering): Released all slaves [ 886.480229][ T12] IPVS: stop unused estimator thread 0... [ 887.120906][T13702] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 887.460445][T13702] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 887.529554][T13702] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 887.577231][T13702] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 887.800357][T13702] 8021q: adding VLAN 0 to HW filter on device bond0 [ 887.852116][T13702] 8021q: adding VLAN 0 to HW filter on device team0 [ 887.898926][ T1331] bridge0: port 1(bridge_slave_0) entered blocking state [ 887.906124][ T1331] bridge0: port 1(bridge_slave_0) entered forwarding state [ 887.935993][ T1331] bridge0: port 2(bridge_slave_1) entered blocking state [ 887.943252][ T1331] bridge0: port 2(bridge_slave_1) entered forwarding state [ 888.465019][T13474] [ 888.467402][T13474] ====================================================== [ 888.474428][T13474] WARNING: possible circular locking dependency detected [ 888.481466][T13474] syzkaller #0 Not tainted [ 888.485891][T13474] ------------------------------------------------------ [ 888.492954][T13474] kworker/u5:1/13474 is trying to acquire lock: [ 888.499204][T13474] ffff8880242980b8 (&hdev->lock){+.+.}-{3:3}, at: hci_le_conn_update+0xd0/0x320 [ 888.508301][T13474] [ 888.508301][T13474] but task is already holding lock: [ 888.515671][T13474] ffff88807b868b38 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_recv_acldata+0xe2/0x11a0 [ 888.525029][T13474] [ 888.525029][T13474] which lock already depends on the new lock. [ 888.525029][T13474] [ 888.535441][T13474] [ 888.535441][T13474] the existing dependency chain (in reverse order) is: [ 888.544455][T13474] [ 888.544455][T13474] -> #2 (&conn->lock#2){+.+.}-{3:3}: [ 888.551926][T13474] __mutex_lock+0x135/0xc80 [ 888.556947][T13474] l2cap_connect_cfm+0x663/0x1160 [ 888.562484][T13474] hci_remote_features_evt+0x59b/0x900 [ 888.568456][T13474] hci_event_packet+0x807/0x1280 [ 888.573908][T13474] hci_rx_work+0x43a/0xd60 [ 888.578927][T13474] process_scheduled_works+0xa60/0x1600 [ 888.584985][T13474] worker_thread+0xa5e/0xfe0 [ 888.590091][T13474] kthread+0x2fa/0x390 [ 888.594681][T13474] ret_from_fork+0x48/0x80 [ 888.599608][T13474] ret_from_fork_asm+0x11/0x20 [ 888.604908][T13474] [ 888.604908][T13474] -> #1 (hci_cb_list_lock){+.+.}-{3:3}: [ 888.612634][T13474] __mutex_lock+0x135/0xc80 [ 888.617659][T13474] hci_remote_features_evt+0x535/0x900 [ 888.623656][T13474] hci_event_packet+0x807/0x1280 [ 888.629106][T13474] hci_rx_work+0x43a/0xd60 [ 888.634041][T13474] process_scheduled_works+0xa60/0x1600 [ 888.640100][T13474] worker_thread+0xa5e/0xfe0 [ 888.645219][T13474] kthread+0x2fa/0x390 [ 888.649819][T13474] ret_from_fork+0x48/0x80 [ 888.654751][T13474] ret_from_fork_asm+0x11/0x20 [ 888.660031][T13474] [ 888.660031][T13474] -> #0 (&hdev->lock){+.+.}-{3:3}: [ 888.667323][T13474] __lock_acquire+0x3a07/0x7eb0 [ 888.672690][T13474] lock_acquire+0x19e/0x420 [ 888.677704][T13474] __mutex_lock+0x135/0xc80 [ 888.682723][T13474] hci_le_conn_update+0xd0/0x320 [ 888.688180][T13474] l2cap_recv_frame+0xcc96/0xfd60 [ 888.693716][T13474] l2cap_recv_acldata+0x50b/0x11a0 [ 888.699339][T13474] hci_rx_work+0x545/0xd60 [ 888.704268][T13474] process_scheduled_works+0xa60/0x1600 [ 888.710330][T13474] worker_thread+0xa5e/0xfe0 [ 888.715436][T13474] kthread+0x2fa/0x390 [ 888.720015][T13474] ret_from_fork+0x48/0x80 [ 888.724947][T13474] ret_from_fork_asm+0x11/0x20 [ 888.730230][T13474] [ 888.730230][T13474] other info that might help us debug this: [ 888.730230][T13474] [ 888.740444][T13474] Chain exists of: [ 888.740444][T13474] &hdev->lock --> hci_cb_list_lock --> &conn->lock#2 [ 888.740444][T13474] [ 888.753044][T13474] Possible unsafe locking scenario: [ 888.753044][T13474] [ 888.760481][T13474] CPU0 CPU1 [ 888.765834][T13474] ---- ---- [ 888.771187][T13474] lock(&conn->lock#2); [ 888.775438][T13474] lock(hci_cb_list_lock); [ 888.782449][T13474] lock(&conn->lock#2); [ 888.789204][T13474] lock(&hdev->lock); [ 888.793271][T13474] [ 888.793271][T13474] *** DEADLOCK *** [ 888.793271][T13474] [ 888.801398][T13474] 3 locks held by kworker/u5:1/13474: [ 888.806758][T13474] #0: ffff888030bb0d38 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 888.817735][T13474] #1: ffffc90004677d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 888.829739][T13474] #2: ffff88807b868b38 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_recv_acldata+0xe2/0x11a0 [ 888.839490][T13474] [ 888.839490][T13474] stack backtrace: [ 888.845365][T13474] CPU: 1 PID: 13474 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 888.852993][T13474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 888.863042][T13474] Workqueue: hci1 hci_rx_work [ 888.867722][T13474] Call Trace: [ 888.870992][T13474] [ 888.873919][T13474] dump_stack_lvl+0x18c/0x250 [ 888.878601][T13474] ? load_image+0x420/0x420 [ 888.883100][T13474] ? show_regs_print_info+0x20/0x20 [ 888.888298][T13474] ? print_circular_bug+0x12b/0x1a0 [ 888.893488][T13474] check_noncircular+0x2fc/0x400 [ 888.898422][T13474] ? deref_stack_reg+0x1ab/0x230 [ 888.903348][T13474] ? print_deadlock_bug+0x5d0/0x5d0 [ 888.908536][T13474] ? lockdep_lock+0xf5/0x230 [ 888.913121][T13474] ? __lock_acquire+0x1431/0x7eb0 [ 888.918143][T13474] ? _find_first_zero_bit+0xd6/0x100 [ 888.923424][T13474] __lock_acquire+0x3a07/0x7eb0 [ 888.928274][T13474] ? verify_lock_unused+0x140/0x140 [ 888.933466][T13474] ? debug_objects_fill_pool+0x8b/0x790 [ 888.939006][T13474] ? __lock_acquire+0x7eb0/0x7eb0 [ 888.944028][T13474] lock_acquire+0x19e/0x420 [ 888.948525][T13474] ? hci_le_conn_update+0xd0/0x320 [ 888.953634][T13474] ? __might_sleep+0xe0/0xe0 [ 888.958220][T13474] ? read_lock_is_recursive+0x20/0x20 [ 888.963588][T13474] __mutex_lock+0x135/0xc80 [ 888.968083][T13474] ? hci_le_conn_update+0xd0/0x320 [ 888.973190][T13474] ? mark_lock+0x94/0x320 [ 888.977514][T13474] ? hci_le_conn_update+0xd0/0x320 [ 888.982620][T13474] ? mutex_lock_nested+0x20/0x20 [ 888.987551][T13474] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 888.993521][T13474] ? __lock_acquire+0x7eb0/0x7eb0 [ 888.998536][T13474] ? lock_chain_count+0x20/0x20 [ 889.003563][T13474] hci_le_conn_update+0xd0/0x320 [ 889.008502][T13474] ? wq_worker_last_func+0x40/0x40 [ 889.013607][T13474] ? hci_enhanced_setup_sync_destroy+0x50/0x50 [ 889.019762][T13474] l2cap_recv_frame+0xcc96/0xfd60 [ 889.024796][T13474] ? mark_lock+0x94/0x320 [ 889.029121][T13474] ? __lock_acquire+0x135d/0x7eb0 [ 889.034138][T13474] ? mark_lock+0x94/0x320 [ 889.038459][T13474] ? l2cap_recv_frag+0x500/0x500 [ 889.043391][T13474] ? mark_lock+0x94/0x320 [ 889.047714][T13474] ? __lock_acquire+0x1431/0x7eb0 [ 889.052739][T13474] ? verify_lock_unused+0x140/0x140 [ 889.057930][T13474] ? mark_lock+0x94/0x320 [ 889.062250][T13474] ? __lock_acquire+0x135d/0x7eb0 [ 889.067268][T13474] ? verify_lock_unused+0x140/0x140 [ 889.072474][T13474] ? __mutex_trylock_common+0x160/0x270 [ 889.078015][T13474] ? trace_raw_output_contention_end+0xd0/0xd0 [ 889.084158][T13474] ? l2cap_recv_acldata+0xbe/0x11a0 [ 889.089351][T13474] ? rcu_is_watching+0x15/0xb0 [ 889.094112][T13474] ? trace_contention_end+0x39/0xe0 [ 889.099301][T13474] ? __mutex_lock+0x30d/0xc80 [ 889.103973][T13474] ? __lock_acquire+0x7eb0/0x7eb0 [ 889.108997][T13474] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 889.114632][T13474] ? l2cap_recv_acldata+0xe2/0x11a0 [ 889.119829][T13474] ? mutex_lock_nested+0x20/0x20 [ 889.124761][T13474] ? l2cap_conn_hold_unless_zero+0x173/0x270 [ 889.130732][T13474] ? l2cap_disconn_ind+0xb0/0xb0 [ 889.135661][T13474] ? mutex_unlock+0x10/0x10 [ 889.140157][T13474] ? hci_conn_enter_active_mode+0x1c6/0x330 [ 889.146060][T13474] ? hci_conn_link+0x350/0x350 [ 889.150821][T13474] l2cap_recv_acldata+0x50b/0x11a0 [ 889.155926][T13474] hci_rx_work+0x545/0xd60 [ 889.160341][T13474] ? process_scheduled_works+0x975/0x1600 [ 889.166055][T13474] process_scheduled_works+0xa60/0x1600 [ 889.171605][T13474] ? worker_attach_to_pool+0x370/0x370 [ 889.177062][T13474] ? assign_work+0x3cc/0x5d0 [ 889.181645][T13474] worker_thread+0xa5e/0xfe0 [ 889.186234][T13474] ? _raw_spin_unlock+0x40/0x40 [ 889.191078][T13474] ? __kthread_parkme+0x71/0x1c0 [ 889.196012][T13474] kthread+0x2fa/0x390 [ 889.200071][T13474] ? pr_cont_work+0x550/0x550 [ 889.204743][T13474] ? kthread_blkcg+0xd0/0xd0 [ 889.209322][T13474] ret_from_fork+0x48/0x80 [ 889.213730][T13474] ? kthread_blkcg+0xd0/0xd0 [ 889.218316][T13474] ret_from_fork_asm+0x11/0x20 [ 889.223082][T13474] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 889.280762][T13884] loop1: detected capacity change from 0 to 32768 [ 889.371981][T13702] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 889.426461][T13884] workqueue: Failed to create a rescuer kthread for wq "xfs-inodegc/loop1": -EINTR [ 890.090755][ T6450] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 890.162848][ T6450] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 890.252274][ T6450] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 890.365667][ T6450] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 891.160683][ T6450] hsr_slave_0: left promiscuous mode [ 891.167133][ T6450] hsr_slave_1: left promiscuous mode [ 891.173047][ T6450] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 891.188553][ T6450] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 891.200347][ T6450] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 891.207804][ T6450] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 891.215478][ T6450] bridge_slave_1: left allmulticast mode [ 891.222918][ T6450] bridge_slave_1: left promiscuous mode [ 891.229062][ T6450] bridge0: port 2(bridge_slave_1) entered disabled state [ 891.240628][ T6450] bridge_slave_0: left allmulticast mode [ 891.246281][ T6450] bridge_slave_0: left promiscuous mode [ 891.252814][ T6450] bridge0: port 1(bridge_slave_0) entered disabled state [ 891.266689][ T6450] veth1_macvtap: left promiscuous mode [ 891.272217][ T6450] veth0_macvtap: left promiscuous mode [ 891.279566][ T6450] veth1_vlan: left promiscuous mode [ 891.284887][ T6450] veth0_vlan: left promiscuous mode [ 891.483305][ T6450] team0 (unregistering): Port device team_slave_1 removed [ 891.512678][ T6450] team0 (unregistering): Port device team_slave_0 removed [ 891.525097][ T6450] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 891.537830][ T6450] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 891.548824][ T6079] infiniband syz1: ib_query_port failed (-19) [ 891.598134][ T6450] bond0 (unregistering): Released all slaves [ 891.616000][ T7205] infiniband syz1: ib_query_port failed (-19) [ 892.036289][ T6450] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.081482][ T6450] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.143579][ T6450] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.182461][ T6450] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.541851][ T6450] tipc: Disabling bearer [ 892.548360][ T6450] tipc: Left network mode [ 893.492757][ T6450] hsr_slave_0: left promiscuous mode [ 893.500362][ T6450] hsr_slave_1: left promiscuous mode [ 893.506217][ T6450] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 893.515444][ T6450] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 893.523283][ T6450] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 893.531780][ T6450] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 893.540453][ T6450] bridge_slave_1: left allmulticast mode [ 893.546100][ T6450] bridge_slave_1: left promiscuous mode [ 893.552051][ T6450] bridge0: port 2(bridge_slave_1) entered disabled state [ 893.560288][ T6450] bridge_slave_0: left allmulticast mode [ 893.565915][ T6450] bridge_slave_0: left promiscuous mode [ 893.571804][ T6450] bridge0: port 1(bridge_slave_0) entered disabled state [ 893.582258][ T6450] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 893.590077][ T6450] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 893.597602][ T6450] bridge_slave_1: left allmulticast mode [ 893.603227][ T6450] bridge_slave_1: left promiscuous mode [ 893.610075][ T6450] bridge0: port 2(bridge_slave_1) entered disabled state [ 893.618135][ T6450] bridge_slave_0: left allmulticast mode [ 893.623759][ T6450] bridge_slave_0: left promiscuous mode [ 893.629434][ T6450] bridge0: port 1(bridge_slave_0) entered disabled state [ 893.638880][ T6450] veth1_macvtap: left promiscuous mode [ 893.644355][ T6450] veth0_macvtap: left promiscuous mode [ 893.649952][ T6450] veth1_vlan: left promiscuous mode [ 893.655202][ T6450] veth0_vlan: left promiscuous mode [ 893.814812][ T6450] team0 (unregistering): Port device team_slave_1 removed [ 893.841862][ T6450] team0 (unregistering): Port device team_slave_0 removed [ 893.863711][ T6450] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 893.890035][ T6450] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 893.939052][ T6450] bond0 (unregistering): Released all slaves [ 894.251013][ T6450] team0 (unregistering): Port device team_slave_1 removed [ 894.281877][ T6450] team0 (unregistering): Port device team_slave_0 removed [ 894.312873][ T6450] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 894.348326][ T6450] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 894.566215][ T6450] bond0 (unregistering): Released all slaves [ 895.990715][ T6450] hsr_slave_0: left promiscuous mode [ 895.999371][ T6450] hsr_slave_1: left promiscuous mode [ 896.005322][ T6450] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 896.013159][ T6450] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 896.021043][ T6450] bridge_slave_1: left allmulticast mode [ 896.028498][ T6450] bridge_slave_1: left promiscuous mode [ 896.034189][ T6450] bridge0: port 2(bridge_slave_1) entered disabled state [ 896.045436][ T6450] bridge_slave_0: left allmulticast mode [ 896.051604][ T6450] bridge_slave_0: left promiscuous mode [ 896.057630][ T6450] bridge0: port 1(bridge_slave_0) entered disabled state [ 896.240898][ T6450] team0 (unregistering): Port device team_slave_1 removed [ 896.264898][ T6450] team0 (unregistering): Port device team_slave_0 removed [ 896.284657][ T6450] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 896.310717][ T6450] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 896.365054][ T6450] bond0 (unregistering): Released all slaves