program: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x200, 0x2}, 0x8008, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x7, &(0x7f0000000640)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @map_fd, @exit]}, &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0)={0x3}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) ioprio_set$uid(0x3, 0x0, 0x0) r2 = userfaultfd(0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) io_setup(0x7, &(0x7f0000007f00)=0x0) io_submit(r3, 0x1, &(0x7f0000000000)=[&(0x7f0000007f80)={0x0, 0x0, 0x8, 0x0, 0x0, r2, 0x0}]) mmap$perf(&(0x7f0000ffc000/0x3000)=nil, 0x3015, 0x0, 0x13, r0, 0x0) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000100)='./file0\x00') syz_mount_image$bcachefs(&(0x7f00000058c0), &(0x7f0000000000)='./file0\x00', 0x10000, &(0x7f0000000140)=ANY=[@ANYBLOB="696e6f6465735f7573655f6b65795f63616368652c67727071756f74612c6469726563745f696f2c6261636b67726f756e645f636f6d7072657373696f6e3d6c7a342c71737271756f74612c6669785f6572726f72733d7965732c6e6f5f646174615f696f2c6673636b2c686173682c008699577e1f48b20bf65c23457a5076c1e30a123235295d84946fed3e12f2b46e5d39a6b931c31cf9468587a0c20959add6a69c321aa2089b8d2a84be99dea6d9df264389bb2c22301f539495e8a95d4b50b48d0fdaade470e03d79775b2172aa64a2e9cc2f008ddf2149"], 0x1, 0x58ff, &(0x7f0000005900)="$eJzs3X+QHFWdAPDXM7PZyW5+bAJIBNksgSiCmg2/Cn+URs9fBUjFwlLCRWEhG4wmIZUEgYASPPCgAAstLUX9Ay2kDo0WVaASKZEfl3CKUpwedYXU6R36h1fIkRLIUZbnXu1Ov8ls7/T27OxsSODzqWR7+s2b73vd/aanv29mdwIAAACvCLuv3bL3rCPe8/PPDr9w1ft/vOHq0FseK6/GCn3p8rKXqofsT92VRWPL7Lh43RXf+cPAhe/62Z09335x15qj1/7m3YdceO8nTt95y9cfeH7u3X97qihuHE/H71tPnklCqP5kz5c/t+uRw0fLkhBCOenbHsKCZOEDC5JMiMG/hBDWpCuLMnfe9cJJa0eXV9/QPa58fqae8f7KVk3H2ba9l54QfvvOVdf8cvH3v9e14+nt+6ok1YbxFMK88xsf3xVCmJ3+HxVHWxyPcdCuDCH0NDzutIJ+HdNi/5flrB+ZLmely96COPH+JZn1UqZedj3qyix7Ctqbrrx+tFuvyJzMevZkNF15/YzlC9Llj9Ll8VOMX47/k1BKQqXe/fXJvjESGo5bEpKxY1mtr5fqxzak259ZTzLrpcx6uSuzXWPtpgOtnCTjy2O9THk8HVfS8qMbz9VNnJ1T/up0WU2fqC/G9ZC9UdM74UZ9u8bEfu2ZpC/7Q6nhHNSsvH7g04PRm5b1JgsnPGakiXjfrlU3Li2vfnB3X04/kjuTNH7SVvxtv1gw52Pfvf6S7Ot66sVYvTeU2or/uzMeffbc67/1tZz4Ibm5lPa/3Fb8E+/reeaMh65dkrt/9sT9U2kr/tBTD9+0+NALduT2/9YYv5oX/wc9TZqJd67Y+Wj33L333Z/b/8G4f2a31f8n3/re39/x+D1P58YPMX5PW/FX79z0+e7+vcflxr8/7p/e9sbPcztOfaK//48DefEfi/HnthX/9u23vOW2+Tecnnt8V8b909dW/DOPvfeaOXvvOSrv3Jnc2qlXToBXpkPSa6zr0vV288zpasgXvjpQqV3zzUn/z+1kQxmj7cybwfgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvDIddsK/vO+/Ptz3TCVd705vPFmqLWP5rBCS2SGELVuHNm9dt/GigU9cfMnmjUPrB4a2Dgxv3Lr58oGT3zCweXjT+qHLR+8dfONJtcctDEltmRw1oe2RkZGRUt/4stje3x2747dLT/vvP4UweNiv+yu5/V92y4bbDm3yMyNZMfKODZec9etTvpluV1/ar76cfoWcfv3POX+97Yt7/nBcCIOvmqxfDz/59p+O69BYwb44qVJ3qHWoO+lp2o96r9P+xP1VWbtu/fBg8f4t52zH31/x9F/WXvaFv9b2bzV3O1rcv7NXjKwvfWXVmf/3lStrBQfqcS/a33ErYv/i/qum+3teul3zcrarkrNd1/7y/sd/csT1z28Pg5XnFk9su2i7utIB0JW8uqV2Yws9yYJx5dW0fjzi8XHLtm7YtGzL5dveuG7D0EXDFw1vfPPyk5efOnjKqacsG9vyZR3e/tj+a1vc/v0znuZ/avuP4s/WxlNRv4r2x2i/ivdHY4/ynn89Z3/uS2++5aGzagVF4zzWrp9P0mXP6HFeHhrG28R91Wy7ivZDCGGg2X549vnTw+H/vu6aovNQ45Fp/JmRrBh5ZMmfv3naNxa9rVawX87zjR1q8zxf7/W+/oztr2p6PA7U/dsdyul29Tbt1/JHHuq6cfefPl3v36xZ4bKhrVs3L6/9nJP2dE5yZNN+ZUvjdi0e+1kO6W4J9WHaZLyO6gq1/mXPn7F6dq/2pvf1JgubbldWvG/XqhuXllc/uDtvTyd31lqcHebWlslrcmquzzywXO9ws/YP1vHR/75v3P3hu3948oTxcWLtZ9F2JTnb9f3Hb//St7/wjz/s3Ha97+2P9v35Pz6+tFZwsJxX6r1O+5M0nldODKHo+bc4NN+O3Odfqfn2FD3/su3sq9883kBmvTeU23q+nnhfzzNnPHTtktzn655Wn69XjlsrFzxfD5Tx89I9v8YNlGTFyM+uO2T7A1etPKJWUDSu67WbjeuTWsg/crbrp+c+0X/xwD/8W+fOG995w13n/WZoxWdqBQfKca+m+7eas3/rvY55Z+P+fdOFF69fUys/cK9/02VB/hNPJVsu3/bJofXrhzdvaW27Wn09je1k93K7r6fx7LawYLtKE7Zr5m60sr9afb7F/q9pe3+Nf771hqSt14Vtv1gw52Pfvf6SvgmPShs6v5TGL7UV/3dnPPrsudd/62u58W+O8SttxR966uGbFh96wY7c+LcmafxqW/FX7Hy0e+7e++7PjT8Y+z+7rfhPvvW9v7/j8Xuezo0fYvze9vb/cztOfaK//4+58R9L0nZGr5FCuOuFk9bW1pPQlT7fYj+6xvUrZNeTzHops15uXC/V5lrrDZSTZHx5rJeWH93Ql2Y+klMer8Kqi2rLF+N6yN6YvPxAU2o49zcrL7pOBQB4uYvv/8dr0Pj+/3B6oZQ/0wD7tJmHzY552KKcuDEP2zefM2vc/YvS+PHxcR6w/01hcHR59UDtQn+q85zx+ZCd54ztHHfM+BjtznMWzb8vyazHftXmyysNeWhqYl5TCS3Mv09sZ/L598zmF8+PD1w3oVsDDfNW2ePXlc6YNfu8Q6a/ldEIeeMjOy8WP8/RPy+sHGuvxfGR/RxNPA7Zz9HEdo7InDjb/RzNdMdH7PYk42Osy8Xvb0w8fmGS/bvv+DWPlj1+Uzje1dH6M/3+7ME/bziz74eZl8yJnz7BDvR5w1get6PS4nzih3PKOzWfGE8XsV97JunL/mA+EXi5ivl/fI0Yzf9HL8D/N1Ov6Do0e9UY4+V+TqjcvD9FecfEz+n1tPU6vnrnps939+89Lvc65/5WP/ezadxaT8Hnfor249LMeuF+zJmgKcr3su0U7ffs5zJ6w9y29vvt2295y23zbzg9d7+vrL2QFu/3L41bm1uw3+ULOfHlCzOdLxwb9sPnGIrmz16yfCT94NNM5SMfyimfaj7SM+FGfbvGHHT5SNf+7RcAcPCI+X/9/bM0///PTL2ivPX4zHqMl5u35lyf5OWtH0iXl2Xq96a/UTHV6+Yzj733mjl77zkqN2+5tdU89J/GrfUV5qHTy5tz84iVnfm8eG4eUc+zppcn5va/nidOL0/PjV/P06eXR+fun3oePb15gNz49XmAAzbPbfHz+jM7X/eyzaPTX5+dqTz67JzyqebRvRNu1LdrjDwaAOClFfP/eBkX8/+HMvWme92emxd06Lo9+/dA6vEf21955UznfTOdt850Xj/T8xIHe1480/NCMztPJi9O10P2Ro28GACAA0HM/2en6/n5//Tyk9z8rZ6fyM+bxpefHyD5+cE+/yX/l/8Xk/8DALy8xfw//tpj/Pt//5yuZ/9u/UuZp8fL5GbxD4Q8vVuePs08PcmN/8rJ02d6ns08gHmAYtvNAwAAvKx0jWVKE3/P/qPpMvt79nm/l39uTv1WVcZ+xz6EC7ZuHh4+75JNa4a2Dp+38eI1w1vOu3Tzuq1bhzfW6k33/d3cvCXNG7tCJd0fzetl87b56d9DmJ/z9xCy9WPYI8duTPx7CNlmZxf8HYF9x6+1/uYdv9Ik9ZuNj7zjnRf/Izn1o/rxv/DjJ563dst56zau27puaP26bcPj641mrT1T+N7MuFum9L2ZmR8TlKb+/Z3j+pGENvtRmtCPrnR/5H0/e5Lpx4K0Jwvyvv8gp98//9cvfurYkb/eEcLgYeXXTGv/JStGfnDO8Ae27v71ptH+lybtf71m2q+i7yvN1o/bU1l/8ZatJ6y9+JKN2W+UbE+czyjV12doPiN9+pdbnJ9YnVM+1fmJ8oQbB6aWP6cAAMA48f3/eD0b3z/8QnoBFctbz9Nz3z+uTpanx/ePc/P0wdby9Oz3khXl6dn6cXtbzdOr08zTs+0X5enN6jfL0/Py7rz4H8qpP1Wtj5Pp/T5G7jg5v7Vxkv0+g6Jxkq0/1XGSTHOcZNsvGifN6jcbJ3nHPS/+B3Pq56nManU8TO9zObnj4ebWxsPrM+tF4yFbf6rjoTTN8ZBtv2g8NKvfbDzkHd+8+Gfl1G/V+PPF6MAYGxfD51168eZPNtSb6e+/mH7/Zvb7P9rVev9n9nNfM9//mf39r5nv//Q+V5bb/8emNxPWev9n9vtd2rXf5mvTD5sVff6saB53VU75VOdxZ024cWAyjwsvnZj/x7d7Yv5/Q7rs9NtAB//3pL1iv8esxc/fz+x1jNfzSRo7AHg9BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhNd2XR2HL3tVv2nnXEe37+2eEXrnr/jzdc/borvvOHgQvf9bM7e7794q41R6/9zbsPufDeT5y+85avP/D83Lv/9lRh4L7a4vh0tRpC8kwSQvUne778uV2PHD5aloQQyknf9hAWJAsfWJBkIgz+JYSwpt7P8Xfe9cJJa0eXV9/QPa58fiZIdrtCbzn2Z1w/w2WFW8RBqJqOs217Lz0h/Padq6755eLvf69rx9Pb91VJqg3jKYR55zc+viuEMDv9PyqOtkXxwelyZQihp+FxpxX065gW+78sZ/3IdDkrXfYWxIn3L8mslzL1sutRV2bZU9DedOX1o916ReZk1rMno+nK62csX5Auf5Quj59i/HL8n4RSEir17q9P9o2R0HDckpCMHctqfb1UP7Yh3f7MepJZL2XWy12Z7RprNx1o5SQZXx7rZcrj6biSlh/deK5u4uyc8leny2r6RH0xrofsjZreCTfq2zUm9mvPJH3ZH0oN56Bm5fUDnx6M3rSsN1k44TEjTcT7dq26cWl59YO7+3L6kdyZpPGTtuJv+8WCOR/77vWXLMqLf34pjV9qK/7vznj02XOv/9bXcuPfHOOX24p/4n09z5zx0LVLcvfPnrh/Km3FH3rq4ZsWH3rBjtz+3xrjV9uKv2Lno91z9953f27/B+P+md1W/Cff+t7f3/H4PU/nxg8xfk9b8Vfv3PT57v69x+XGvz/un972xs9zO059or//jwN58R+L8ee2Ff/27be85bb5N5yee3xXxv3T11b8M4+995o5e+85Ku/cmdzaqVdOgFemQ9JrrOvS9XbzzOlqyBe+OlCpXfPNSf/P7WRDGaPtzJvB+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvDz96sqTP3rOOz64qpKEkOTUGWki3leetWLFQBvtDj318E2LD71gR2PZojbiAAAAAMViHl6ql1TDonBpMjsc2bR+nCM4Mq4l48uzcwgxTnaOoN04pQ7FKXcoTqVDcbo6FGdWh+J0dyhOtSBONbQWZ/akcUot96enQ3F6J4kzUg4tx5nTof7M7VCceR2KM79DcfomjdP6OFzQoTgLOxTnkA7FObRDcQ7rUJxXdSjO4R2Kk51Tnuo4nJvWPCIvztiNcmGcSlKu39FsPj22c9Q02+ltsZ3c1+MW25ndYjvHZB5XmmI71Rbbee0020labOf102ynVNBOHLeXZfsX24lrLY7/yzsUZ1uH4lzRoThXdijOpzsU5zMdinPVNOMAtCrm//vyvb7QXXlb6EnPONlZgJjvLh77OfH1Lu+EFOO9JlM+KxsvGyabqGfiLZ5q/7ITCJl4SzLlXePiVer5yCTxqo3xlmbunLC92f5lJxQy/Ts+U95dFC87sQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM+hXV5780XPe8cFVIQmj/5oaaSLeV561YsVAG+3uWnXj0vLqB3c3lnVX2ggEAAAAFIp5eFe9pBq6K8tDdzJrXL1qOg9QTdfLfbVl/7ywcnSZDJTG1nuSBZM+rpI+btnWDZuWbbl82xvXbRi6aPii4Y1vXn7y8lMHTzn1lGVr160fHqz9DKG7IF4IYWz6Ycvl2z45tH798OYttcJs/xelj1uUrifp4/rfFAZHl1en/V9Y0F5pQnvFN0brt1x5c3ZLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP6ffbsLkess4wD+npnZmem2sSP9moZmM+SjRC2axK2kWjoHBAttErIUZLa6lmATLG6a0CYl1mkbsK0JitASCJHcRGKxtXjTD1vEfhCI1GjAjUHaor3QC6XVSlr2QlJGsjtnvjKT2YzFTdPf7+Kcmfd93veZdy4C/7MTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADh/TFVHJyrlsfHhKISoR02ti2QunY3j0gB9v/7ith/lRqZXtI7lMgNsBAAAAPSV5PChxkg+5DLpkA5Xz7xbElomQjP3AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHz9T1dGJSnls/OIohKhHTa2LZC6djePSAH3feu/pL7w+MvL31rHiAPsAAAAA/SU5PNUYyYdiWBqGoqvb6pJnAws71nfWJfssmmNd57ODXnVL51h37RzrPtWnbn39vjMAAADAR1+S/zONkULIZRb0zP/9cn1St7ijLl2/D/JbAQAAAOB/k+T/XGOkGHKZYiOvzzXvL+moS9b3+7v99PTs/yVY3mN9v7/nr6vf/Z0eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD46pqqjE5Xy2APpKISoR02ti2QunY3j0gB9V780/M9bDz+ypHUslxlgIwAAAKCvJIc3o3c+5DLDYShcPJP7R24+8OxXn31+NIQwG/Oz2bBz4/bt96yevSZ1q44eHvrhkXceOKNu1ex13g4IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8aKaqoxOV8tj4RVEIUY+aWhfJXDobx6UB+r75pa/89ckTL7zdOlYcYB8AAACgvySHN7N/PhRDNmTDlTPvWrP+aamO9b2eGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXjnu/c/+3N05ObrrHCy+8+Bi9yIcQzlYz3/8yAQAAH7bFIQq1c3TVhvn+1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPlgqjo6USmPjeejEKIeNbUukrl0No5LA/SNXzyWWzD90iutY8UB9gEAAAD6S3J4M/vnQzEMhaFwxcy7bs8EZvJ/4f/4IQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDzylR1dKJSHhtfEIUQ9aipdZHMpbNxXBqg7xO79n/x0KU/uKV1LJcZYCMAAACgrySHZxsj+ZDLfDrkwjX195PtC6J0/d79uUBz3ba2ZcNzXldtW5ee87rdHSfL1E8zuy6f7FeYvTfWlc5cV2pZVwyN9qW2dWFv26oFfT5nAAAAgHmU5P9cY6QQcplcS879WVt9Qc4FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHqYqo5OVMpj41EUQtSjptZFMpfOxnFpgL73/+6Tl3zj53t2tI4VB9gHAAAA6C/J4c3snw/FsCh8Iiyayf2h0F6f1P2rcurQ4//+24oQVl55fCTTc//fvHnTy52XEFLtRakQLq33i3r0++0fHr9vWe3UkyGsvCJ9zbn2a6rVpqfj2nOVTeu2Hzm+7ezfDQAAAFwokvw/1BgphFzm7p75P0ne55T/L71v1y8vr1/ribxjRapQ75fq0e/Ly57+y/I1/3jndP4/W7/P7d9y6PK2hrMjHaK4Vt6yY/3x6w+mklPP9k939E++l6999+3/bN752KnZ/vmQr48vzHTrf+a1w0VxbTK1b3ztB/uq7f0zPc7/yO9fOfHrhXveP93/vcXDjf7XnuX8Z+8/fNuje2/Yf3h9e/8QQqlb/3ffvyVc9ae7Hu48/3DHxq3ffOu1QxTXji45eXDNgeKN7f2jjv7J9/+LE0/s/elj338+6Z/8VmTF0rn2T3X0f233ZbtefWjDwvb+qR7nf/n210e2lr73x87z3znw+Z+67pk73tgYP9g5BQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcGGZqo5OVMpj46kohKhHTa2LZC6djePSAH3fuvXYu7fv+cmPW8eKA+wDAAAA9Jfk8Gb2z4diyIZsGJ7J/c9VNq3bfuT4tlCYnY3q98zk1nu3f2bz1h133zlPnxwAAACYqyT/ZxojhZDLLAtD9fxf3rJj/fHrD6aS/J9K8v/muyY3rQyNutd2X7br1Yc2LGw8Jwhh5mcB+dN1n2/W3XzTscLJP39rede61c26o0tOHlxzoHhjUhda61aFxvOJp6575o43NsYPNj5fa91nv7l1sv54Itl3+LZH996w//D6xjnq9+H6vkndZGrf+NoP9lWTunT9nq+fGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA401R1dKJSHhsP6RCiHjW1LpK5dDaOSwP0XbvsVw9fMv3CotaxXGaAjQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP7LDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFfbrL0SqKo4D+Lkzs+04s6uzGrQVrasFhT0kBRH1UlERGiH0ZEhYmg9REEQU9tBuaCRW9BJkvUhUUG0hFOQmiRZr9E966aGCAushEGmhHKSHipm5Z5y97m3yrgXl5wOXM+fce7/3d+85e3cGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/lMHKaLs9tP2h5u0X3PzpE/cef/zW9x+YvPSxN34c33TjJ3tqr56Y2bxiyzc3Ldu0774107teOvjr8Lu/H+kb/GinWZV2qyEkx5IQqh/MPv/kzGfntcaSEEI5aUyEMJIsPTiSZBJW/xZC2Nytc+7Od45ftaXVTu4cnDO+JBOSva9QL8d6Ohpz6+X/pZqus63NRy4P392wftsXy99+a2Dq6MTJQ5Jqz3oKYfHG3vMHQgiL0q0lrrbReHLargsh1HrOu6ZPXRf/zfqvyOlfmLbnpG29T07cvzLTL4Uw2XtcKef8gUxb63O9hcqro+hx/Qxl+tmX0ULl1RnHR9L2vbRddZr55bgloZSESrf8+5OTayT0zFsSkvZcVrv9UnduQ3r/mX6S6Zcy/fJA5r7a100XWjlJ5o7H4zLj8XVcScdX9L6r53FHzvj5aVtN/1BPxH7Ifuion/Khe19tsa7Zv6jl31DqeQfNN96d+PZkdKpujdWTpaec88c84r6Z9U+XwoYPDzUy8xUlezpXqrdX0unnb/18ZOiuN3c8PJpzn8nGUppfKpT//drDP9+54+UXc/Ofi/nlQvlX7q8dW/vR9pWNvPzZ+HwqhfLvPvLxM8vPvWcqt/7dMb9aKP/66cODw839B3LrXx2fz6JC+d9ed8sPr3+192hufoj5tUL5G6YffHZwrHlZbv6B+HzqxdbPL1NXfz029tN4Xv6XMX+4UP5rE7uufWXJzjW587suPp9GofzbLtm3bai596K8d2ey+0z95wQ4Oy1LvzI+lfaL/s5cqJ7fCy+MVzrf+YbSbfhMXiijdZ3F/2A+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/MkOHJAAAAAACPr/uh2BAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATwUAAP//K/Yw9Q==") umount2(&(0x7f00000002c0)='./file0\x00', 0x2) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) [ 59.152464][ T5321] syz.0.0 (5321) use[ 59.220105][ T5322] loop0: detected capacity change from 0 to 32768 [ 59.229474][ T5308] Bluetooth: hci0: command tx timeout [ 59.343502][ T5322] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,background_compression=lz4,grpquota,fsck,fix_errors=yes,nojournal_transaction_names,no_data_io [ 59.352341][ T5322] invalid bkey u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key 17870283321406128128:0:0 durability: 0 ptr: 255:17592186044415 gen 0 cached [ 59.352368][ T5322] has unwritten ptrs: delete?, fixing [ 59.361521][ T5322] invalid bkey u64s 11 type btree_ptr_v2 U64_MAX:18446744073692774400:10 len 3036676096 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0 [ 59.361539][ T5322] size != 0: delete?, fixing [ 59.369406][ T5322] bcachefs (loop0): recovering from clean shutdown, journal seq 10 [ 59.372600][ T5322] bcachefs (loop0): Version upgrade required: [ 59.372600][ T5322] Version upgrade from 0.24: unwritten_extents to 1.7: mi_btree_bitmap incomplete [ 59.372600][ T5322] Doing incompatible version upgrade from 0.24: unwritten_extents to 1.13: inode_has_child_snapshots [ 59.372600][ T5322] running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,set_fs_needs_rebalance [ 59.409124][ T5322] invalid btree root inodes, fixing [ 59.411358][ T5322] bcachefs (loop0): will run btree node scan [ 59.413463][ T5322] bcachefs (loop0): flagging btree inodes lost data [ 59.418391][ T5322] bcachefs (loop0): error validating btree node on loop0 at btree xattrs level 0/0 [ 59.418410][ T5322] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2285c34bed0abe32 written 16 min_key POS_MIN durability: 1 ptr: 0:31:0 gen 0 [ 59.418420][ T5322] node offset 0/16: bad magic: want 59513f585d347cd2, got 7d513f585d347cd2 [ 59.429566][ T5322] bcachefs (loop0): flagging btree xattrs lost data [ 59.435322][ T5322] error reading btree root xattrs l=0: btree_node_read_error, fixing [ 59.439516][ T5322] bcachefs (loop0): error validating btree node at btree alloc level 0/0 [ 59.439535][ T5322] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 59.439545][ T5322] node offset 8/24 bset u64s 375 bset byte offset 184: keys out of order: u64s 11 type alloc_v4 0:32:0 len 0 ver 0 > u64s 11 type alloc_v4 0:2:0 len 0 ver 0, fixing [ 59.453714][ T5322] invalid bkey u64s 12 type alloc_v4 0:28:0 len 0 ver 0: [ 59.453725][ T5322] gen 0 oldest_gen 0 data_type btree [ 59.453731][ T5322] journal_seq 6 [ 59.453737][ T5322] need_discard 1 [ 59.453742][ T5322] need_inc_gen 1 [ 59.453748][ T5322] dirty_sectors 0 [ 59.453753][ T5322] stripe_sectors 0 [ 59.453758][ T5322] cached_sectors 0 [ 59.453764][ T5322] stripe 0 [ 59.453770][ T5322] stripe_redundancy 0 [ 59.453776][ T5322] io_time[READ] 1 [ 59.453782][ T5322] io_time[WRITE] 768 [ 59.453788][ T5322] fragmentation 0 [ 59.453793][ T5322] bp_start 8 [ 59.453799][ T5322] [ 59.453804][ T5322] invalid data type (got 3 should be 9): delete?, fixing [ 59.480348][ T5322] bcachefs (loop0): btree_node_read_work: rewriting btree node at btree=alloc level=0 SPOS_MAX due to error [ 59.484696][ T5322] invalid btree root subvolumes, fixing [ 59.486783][ T5322] bcachefs (loop0): flagging btree subvolumes lost data [ 59.495632][ T5322] invalid bkey u64s 5 type set 0:37:0 len 4294964982 ver 0 [ 59.495647][ T5322] size greater than offset (4294964982 > 37): delete?, fixing [ 59.501054][ T5322] bcachefs (loop0): flagging btree freespace lost data [ 59.504713][ T5322] error reading btree root freespace l=0: btree_node_read_error, fixing [ 59.509221][ T5322] bcachefs (loop0): scan_for_btree_nodes... [ 59.517340][ T5333] invalid bkey u64s 17 type inode_v3 0:4097:U32_MAX len 0 ver 0: (unpack error) [ 59.517363][ T5333] invalid variable length fields: delete?, fixing [ 59.531689][ T5322] bch2_scan_for_btree_nodes: nodes found after overwrites: [ 59.531712][ T5322] extents l=0 seq=1 journal_seq=5 cookie=c6c25c03258c59c5 POS_MIN-SPOS_MAX ptr: 0:27:0 gen 0 [ 59.531720][ T5322] inodes l=0 seq=1 journal_seq=5 cookie=7589ab5e0c11cc7a POS_MIN-SPOS_MAX ptr: 0:38:0 gen 0 [ 59.531726][ T5322] dirents l=0 seq=1 journal_seq=4 cookie=9aa2895aefce4bdf POS_MIN-SPOS_MAX ptr: 0:41:0 gen 0 [ 59.531734][ T5322] subvolumes l=0 seq=1 journal_seq=1 cookie=c0bef60d07ceb940 POS_MIN-SPOS_MAX ptr: 0:35:0 gen 0 [ 59.531741][ T5322] snapshots l=0 seq=1 journal_seq=1 cookie=ebb8d5a9e3463bdb POS_MIN-SPOS_MAX ptr: 0:32:0 gen 0 [ 59.531748][ T5322] lru l=0 seq=1 journal_seq=5 cookie=28f61e078e70b95c POS_MIN-SPOS_MAX ptr: 0:28:0 gen 0 [ 59.531754][ T5322] deleted_inodes l=0 seq=1 journal_seq=0 cookie=1db8f60c84bb244c POS_MIN-SPOS_MAX ptr: 0:42:0 gen 0 [ 59.531761][ T5322] [ 59.560558][ T5322] done [ 59.561622][ T5322] bcachefs (loop0): check_topology... [ 59.561743][ T5322] bcachefs (loop0): btree root inodes unreadable, must recover from scan [ 59.566765][ T5322] bcachefs (loop0): bch2_get_scanned_nodes(): recovering inodes l=0 POS_MIN - SPOS_MAX [ 59.570526][ T5322] bcachefs (loop0): bch2_get_scanned_nodes(): recovering u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 59.582417][ T5322] bcachefs (loop0): btree root xattrs unreadable, must recover from scan [ 59.585559][ T5322] no nodes found for btree xattrs, continuing [ 59.587724][ T5322] bcachefs (loop0): btree root subvolumes unreadable, must recover from scan [ 59.590974][ T5322] bcachefs (loop0): bch2_get_scanned_nodes(): recovering subvolumes l=0 POS_MIN - SPOS_MAX [ 59.594426][ T5322] bcachefs (loop0): bch2_get_scanned_nodes(): recovering u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0 [ 59.602977][ T5322] done [ 59.603986][ T5322] bcachefs (loop0): accounting_read... done [ 59.607790][ T5322] bcachefs (loop0): alloc_read... done [ 59.609885][ T5322] bcachefs (loop0): stripes_read... done [ 59.612042][ T5322] bcachefs (loop0): snapshots_read... done [ 59.614386][ T5322] bcachefs (loop0): check_allocations... [ 59.618619][ T5322] bucket 0:26 data type btree ptr gen 0 missing in alloc btree [ 59.618642][ T5322] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing [ 59.634065][ T5322] bucket 0:38 data type btree ptr gen 0 missing in alloc btree [ 59.634078][ T5322] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing [ 59.643710][ T5322] bucket 0:41 data type btree ptr gen 0 missing in alloc btree [ 59.643724][ T5322] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0, fixing [ 59.654045][ T5322] bucket 0:35 data type btree ptr gen 0 missing in alloc btree [ 59.654057][ T5322] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0, fixing [ 59.664751][ T5322] bucket 0:28 data type btree ptr gen 0 missing in alloc btree [ 59.664765][ T5322] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 28f61e078e70b95c written 16 min_key POS_MIN durability: 1 ptr: 0:28:0 gen 0, fixing [ 59.673728][ T5322] bucket 0:1 gen 0 has wrong data_type: got free, should be sb, fixing [ 59.677227][ T5322] bucket 0:1 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 59.681884][ T5322] bucket 0:2 gen 0 has wrong data_type: got free, should be sb, fixing [ 59.684805][ T5322] bucket 0:2 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 59.688162][ T5322] bucket 0:3 gen 0 has wrong data_type: got free, should be sb, fixing [ 59.691198][ T5322] bucket 0:3 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 59.694702][ T5322] bucket 0:4 gen 0 has wrong data_type: got free, should be sb, fixing [ 59.697643][ T5322] bucket 0:4 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 59.701499][ T5322] bucket 0:5 gen 0 has wrong data_type: got free, should be sb, fixing [ 59.704338][ T5322] bucket 0:5 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 59.707788][ T5322] bucket 0:6 gen 0 has wrong data_type: got free, should be sb, fixing [ 59.710908][ T5322] bucket 0:6 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 59.714293][ T5322] bucket 0:7 gen 0 has wrong data_type: got free, should be sb, fixing [ 59.717240][ T5322] bucket 0:7 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 59.720949][ T5322] bucket 0:8 gen 0 has wrong data_type: got free, should be sb, fixing [ 59.723765][ T5322] bucket 0:8 gen 0 data type sb has wrong dirty_sectors: got 0, should be 8, fixing [ 59.727226][ T5322] bucket 0:9 gen 0 has wrong data_type: got free, should be journal, fixing [ 59.730513][ T5322] bucket 0:9 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing [ 59.734039][ T5322] bucket 0:10 gen 0 has wrong data_type: got free, should be journal, fixing [ 59.737092][ T5322] bucket 0:10 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing [ 59.740965][ T5322] bucket 0:11 gen 0 has wrong data_type: got free, should be journal, fixing [ 59.744094][ T5322] bcachefs (loop0): Ratelimiting new instances of previous error [ 59.746844][ T5322] bucket 0:11 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing [ 59.750547][ T5322] bcachefs (loop0): Ratelimiting new instances of previous error [ 59.758622][ T5322] done [ 59.762725][ T5322] bcachefs (loop0): going read-write [ 59.767066][ T5322] bcachefs (loop0): journal_replay... done [ 59.909011][ T5322] bcachefs (loop0): check_alloc_info... [ 59.910709][ T5322] hole in alloc btree missing in freespace btree [ 59.910728][ T5322] device 0 buckets 25-26, fixing [ 59.917449][ T5322] hole in alloc btree missing in freespace btree [ 59.917460][ T5322] device 0 buckets 29-30, fixing [ 59.922600][ T5322] incorrect key in need_discard btree (got deleted should be set) [ 59.922610][ T5322] u64s 13 type alloc_v4 0:31:0 len 0 ver 0: [ 59.922616][ T5322] gen 0 oldest_gen 0 data_type need_discard [ 59.922622][ T5322] journal_seq 4 [ 59.922627][ T5322] need_discard 1 [ 59.922632][ T5322] need_inc_gen 1 [ 59.922638][ T5322] dirty_sectors 0 [ 59.922644][ T5322] stripe_sectors 0 [ 59.922649][ T5322] cached_sectors 0 [ 59.922655][ T5322] stripe 0 [ 59.922660][ T5322] stripe_redundancy 0 [ 59.922666][ T5322] io_time[READ] 1 [ 59.922672][ T5322] io_time[WRITE] 512 [ 59.922678][ T5322] fragmentation 0 [ 59.922683][ T5322] bp_start 8 [ 59.922688][ T5322] , fixing [ 59.954791][ T5322] hole in alloc btree missing in freespace btree [ 59.954804][ T5322] device 0 buckets 33-34, fixing [ 59.959269][ T5322] hole in alloc btree missing in freespace btree [ 59.959283][ T5322] device 0 buckets 36-37, fixing [ 59.963730][ T5322] hole in alloc btree missing in freespace btree [ 59.963740][ T5322] device 0 buckets 44-45, fixing [ 59.968085][ T5322] hole in alloc btree missing in freespace btree [ 59.968094][ T5322] device 0 buckets 46-120, fixing [ 59.974050][ T5322] done [ 59.985241][ T5322] bcachefs (loop0): check_lrus... done [ 59.988177][ T5322] bcachefs (loop0): check_btree_backpointers... done [ 59.992101][ T5322] bcachefs (loop0): check_backpointers_to_extents... [ 59.992637][ T5322] backpointer for missing btree node [ 59.992647][ T5322] u64s 9 type backpointer 0:8126464:0 len 0 ver 0: bucket=0:31:0 btree=xattrs l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing [ 60.002203][ T5322] done [ 60.006470][ T5322] bcachefs (loop0): check_extents_to_backpointers... [ 60.024916][ T5322] missing backpointer for btree=inodes l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 60.024934][ T5322] got: u64s 5 type deleted 0:9961472:0 len 0 ver 0 [ 60.024941][ T5322] want: u64s 9 type backpointer 0:9961472:0 len 0 ver 0: bucket=0:38:0 btree=inodes l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing [ 60.041316][ T5322] missing backpointer for btree=dirents l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0 [ 60.041332][ T5322] got: u64s 5 type deleted 0:10747904:0 len 0 ver 0 [ 60.041338][ T5322] want: u64s 9 type backpointer 0:10747904:0 len 0 ver 0: bucket=0:41:0 btree=dirents l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing [ 60.054953][ T5322] missing backpointer for btree=subvolumes l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0 [ 60.054967][ T5322] got: u64s 5 type deleted 0:9175040:0 len 0 ver 0 [ 60.054974][ T5322] want: u64s 9 type backpointer 0:9175040:0 len 0 ver 0: bucket=0:35:0 btree=subvolumes l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing [ 60.069069][ T5322] missing backpointer for btree=snapshots l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0 [ 60.069084][ T5322] got: u64s 5 type deleted 0:8388608:0 len 0 ver 0 [ 60.069091][ T5322] want: u64s 9 type backpointer 0:8388608:0 len 0 ver 0: bucket=0:32:0 btree=snapshots l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing [ 60.089404][ T5322] done [ 60.093731][ T5322] bcachefs (loop0): check_alloc_to_lru_refs... done [ 60.097557][ T5322] bcachefs (loop0): bucket_gens_init... done [ 60.112870][ T5322] bcachefs (loop0): check_snapshot_trees... done [ 60.115857][ T5322] bcachefs (loop0): check_snapshots... [ 60.116265][ T5322] snapshot points to missing/incorrect tree: [ 60.116277][ T5322] u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent 0 children 0 0 subvol 1 tree 0, fixing [ 60.130072][ T5322] done [ 60.134240][ T5322] bcachefs (loop0): check_subvols... done [ 60.137492][ T5322] bcachefs (loop0): check_subvol_children... done [ 60.140700][ T5322] bcachefs (loop0): delete_dead_snapshots... done [ 60.143602][ T5322] bcachefs (loop0): check_inodes... done [ 60.146865][ T5322] bcachefs (loop0): check_extents... done [ 60.151817][ T5322] bcachefs (loop0): check_indirect_extents... done [ 60.155588][ T5322] bcachefs (loop0): check_dirents... [ 60.156257][ T5322] dirent points to missing inode: [ 60.156265][ T5322] u64s 8 type dirent 4096:8130059955150870709:U32_MAX len 0 ver 0: lost+found -> 4097 type dir, fixing [ 60.165033][ T5322] done [ 60.169347][ T5322] bcachefs (loop0): check_xattrs... done [ 60.172729][ T5322] bcachefs (loop0): check_root... done [ 60.175602][ T5322] bcachefs (loop0): check_unreachable_inodes... done [ 60.178916][ T5322] bcachefs (loop0): check_subvolume_structure... done [ 60.182164][ T5322] bcachefs (loop0): check_directory_structure... done [ 60.185838][ T5322] bcachefs (loop0): check_nlinks... done [ 60.188797][ T5322] bcachefs (loop0): resume_logged_ops... done [ 60.191469][ T5322] bcachefs (loop0): delete_dead_inodes... done [ 60.195538][ T5322] bcachefs (loop0): set_fs_needs_rebalance... done [ 60.295796][ T5322] bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean [ 60.299313][ T5322] bcachefs (loop0): check_alloc_info... [ 60.300404][ T5322] incorrect gen in bucket_gens btree (got 0 should be 1) [ 60.300417][ T5322] u64s 13 type alloc_v4 0:31:0 len 0 ver 0: [ 60.300424][ T5322] gen 1 oldest_gen 0 data_type free [ 60.300430][ T5322] journal_seq 4 [ 60.300436][ T5322] need_discard 0 [ 60.300442][ T5322] need_inc_gen 0 [ 60.300448][ T5322] dirty_sectors 0 [ 60.300454][ T5322] stripe_sectors 0 [ 60.300459][ T5322] cached_sectors 0 [ 60.300465][ T5322] stripe 0 [ 60.300470][ T5322] stripe_redundancy 0 [ 60.300476][ T5322] io_time[READ] 1 [ 60.300482][ T5322] io_time[WRITE] 512 [ 60.300487][ T5322] fragmentation 0 [ 60.300493][ T5322] bp_start 8 [ 60.300506][ T5322] , fixing [ 60.329840][ T5322] incorrect gen in bucket_gens btree (got 0 should be 1) [ 60.329864][ T5322] u64s 13 type alloc_v4 0:31:0 len 0 ver 0: [ 60.329871][ T5322] gen 1 oldest_gen 0 data_type free [ 60.329878][ T5322] journal_seq 4 [ 60.329884][ T5322] need_discard 0 [ 60.329891][ T5322] need_inc_gen 0 [ 60.329897][ T5322] dirty_sectors 0 [ 60.329903][ T5322] stripe_sectors 0 [ 60.329910][ T5322] cached_sectors 0 [ 60.329915][ T5322] stripe 0 [ 60.329921][ T5322] stripe_redundancy 0 [ 60.329926][ T5322] io_time[READ] 1 [ 60.329931][ T5322] io_time[WRITE] 512 [ 60.329937][ T5322] fragmentation 0 [ 60.329942][ T5322] bp_start 8 [ 60.329949][ T5322] , fixing [ 60.361458][ T5322] done [ 60.364625][ T5322] bcachefs (loop0): check_lrus... done [ 60.366848][ T5322] bcachefs (loop0): check_btree_backpointers... done [ 60.369755][ T5322] bcachefs (loop0): check_backpointers_to_extents... done [ 60.373116][ T5322] bcachefs (loop0): check_extents_to_backpointers... done [ 60.376345][ T5322] bcachefs (loop0): check_alloc_to_lru_refs... done [ 60.379424][ T5322] bcachefs (loop0): bucket_gens_init... done [ 60.383441][ T5322] bcachefs (loop0): check_snapshot_trees... done [ 60.386126][ T5322] bcachefs (loop0): check_snapshots... done [ 60.388503][ T5322] bcachefs (loop0): check_subvols... done [ 60.390884][ T5322] bcachefs (loop0): check_subvol_children... done [ 60.393387][ T5322] bcachefs (loop0): delete_dead_snapshots... done [ 60.395722][ T5322] bcachefs (loop0): check_inodes... done [ 60.398417][ T5322] bcachefs (loop0): check_extents... done [ 60.400790][ T5322] bcachefs (loop0): check_indirect_extents... done [ 60.403023][ T5322] bcachefs (loop0): check_dirents... [ 60.403468][ T5322] directory 4096:4294967295 with wrong i_nlink: got 2, should be 1, fixing [ 60.408830][ T5322] done [ 60.415660][ T5322] bcachefs (loop0): check_xattrs... done [ 60.418355][ T5322] bcachefs (loop0): check_root... done [ 60.420648][ T5322] bcachefs (loop0): check_unreachable_inodes... done [ 60.423244][ T5322] bcachefs (loop0): check_subvolume_structure... done [ 60.425884][ T5322] bcachefs (loop0): check_directory_structure... done [ 60.428598][ T5322] bcachefs (loop0): check_nlinks... done [ 60.431161][ T5322] bcachefs (loop0): resume_logged_ops... done [ 60.433455][ T5322] bcachefs (loop0): delete_dead_inodes... done [ 60.435729][ T5322] bcachefs (loop0): set_fs_needs_rebalance... done [ 60.439630][ T5322] bcachefs (loop0): Second fsck run was not clean [ 60.442188][ T5322] bcachefs (loop0): reading quotas [ 60.445290][ T5322] bcachefs (loop0): quotas done [ 60.449193][ T5322] bcachefs (loop0): done starting filesystem [ 60.465778][ T5322] bcachefs (loop0): shutting down [ 60.467813][ T5322] bcachefs (loop0): going read-only [ 60.481151][ T5322] bcachefs (loop0): finished waiting for writes to stop [ 60.490906][ T5322] bcachefs (loop0): flushing journal and stopping allocators, journal seq 481 [ 60.500966][ T5322] bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 484 [ 60.506834][ T5322] bcachefs (loop0): shutdown complete, journal seq 485 [ 60.510612][ T5322] bcachefs (loop0): marking filesystem clean [ 60.532044][ T5322] bcachefs (loop0): shutdown complete [ 60.538085][ T1084] ================================================================== [ 60.541540][ T1084] BUG: KASAN: slab-use-after-free in percpu_ref_put+0xda/0x250 [ 60.544644][ T1084] Read of size 8 at addr ffff88803812e0b0 by task kworker/u4:8/1084 [ 60.547584][ T1084] [ 60.548544][ T1084] CPU: 0 UID: 0 PID: 1084 Comm: kworker/u4:8 Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0 [ 60.552376][ T1084] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 60.556414][ T1084] Workqueue: loop0 loop_rootcg_workfn [ 60.558500][ T1084] Call Trace: [ 60.559746][ T1084] [ 60.560897][ T1084] dump_stack_lvl+0x241/0x360 [ 60.562749][ T1084] ? __pfx_dump_stack_lvl+0x10/0x10 [ 60.564737][ T1084] ? __pfx__printk+0x10/0x10 [ 60.566649][ T1084] ? _printk+0xd5/0x120 [ 60.568271][ T1084] ? __virt_addr_valid+0x183/0x530 [ 60.570238][ T1084] ? __virt_addr_valid+0x183/0x530 [ 60.572225][ T1084] print_report+0x169/0x550 [ 60.573995][ T1084] ? __virt_addr_valid+0x183/0x530 [ 60.576067][ T1084] ? __virt_addr_valid+0x183/0x530 [ 60.578322][ T1084] ? __virt_addr_valid+0x45f/0x530 [ 60.580258][ T1084] ? __phys_addr+0xba/0x170 [ 60.581901][ T1084] ? percpu_ref_put+0xda/0x250 [ 60.583747][ T1084] kasan_report+0x143/0x180 [ 60.585589][ T1084] ? percpu_ref_put+0xda/0x250 [ 60.587549][ T1084] ? percpu_ref_put+0x1f/0x250 [ 60.589374][ T1084] percpu_ref_put+0xda/0x250 [ 60.591058][ T1084] blk_update_request+0x5e5/0x1160 [ 60.593088][ T1084] blk_mq_end_request+0x3e/0x70 [ 60.594848][ T1084] loop_process_work+0x1bc8/0x21c0 [ 60.596820][ T1084] ? __pfx_loop_process_work+0x10/0x10 [ 60.598950][ T1084] ? register_lock_class+0x102/0x980 [ 60.601037][ T1084] ? try_to_wake_up+0x609/0x14b0 [ 60.603000][ T1084] ? do_raw_spin_lock+0x14f/0x370 [ 60.605014][ T1084] ? __pfx_register_lock_class+0x10/0x10 [ 60.607193][ T1084] ? mark_lock+0x9a/0x360 [ 60.608862][ T1084] ? __pfx_lock_acquire+0x10/0x10 [ 60.610826][ T1084] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 60.613203][ T1084] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 60.615678][ T1084] ? process_scheduled_works+0x976/0x1850 [ 60.618080][ T1084] process_scheduled_works+0xa63/0x1850 [ 60.620437][ T1084] ? __pfx_process_scheduled_works+0x10/0x10 [ 60.622797][ T1084] ? assign_work+0x364/0x3d0 [ 60.624615][ T1084] worker_thread+0x870/0xd30 [ 60.626344][ T1084] ? __kthread_parkme+0x169/0x1d0 [ 60.628349][ T1084] ? __pfx_worker_thread+0x10/0x10 [ 60.630275][ T1084] kthread+0x2f0/0x390 [ 60.631856][ T1084] ? __pfx_worker_thread+0x10/0x10 [ 60.633914][ T1084] ? __pfx_kthread+0x10/0x10 [ 60.635750][ T1084] ret_from_fork+0x4b/0x80 [ 60.637505][ T1084] ? __pfx_kthread+0x10/0x10 [ 60.639325][ T1084] ret_from_fork_asm+0x1a/0x30 [ 60.641071][ T1084] [ 60.642311][ T1084] [ 60.643344][ T1084] Allocated by task 5322: [ 60.645027][ T1084] kasan_save_track+0x3f/0x80 [ 60.646932][ T1084] __kasan_kmalloc+0x98/0xb0 [ 60.648768][ T1084] __kmalloc_cache_noprof+0x19c/0x2c0 [ 60.650818][ T1084] __bch2_dev_alloc+0x57/0xa60 [ 60.652719][ T1084] bch2_dev_alloc+0xd4/0x170 [ 60.654481][ T1084] bch2_fs_open+0x2e3f/0x2f80 [ 60.656304][ T1084] bch2_fs_get_tree+0x738/0x1710 [ 60.658246][ T1084] vfs_get_tree+0x90/0x2b0 [ 60.660127][ T1084] do_new_mount+0x2be/0xb40 [ 60.662066][ T1084] __se_sys_mount+0x2d6/0x3c0 [ 60.663952][ T1084] do_syscall_64+0xf3/0x230 [ 60.666197][ T1084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.668849][ T1084] [ 60.669747][ T1084] Freed by task 5322: [ 60.671274][ T1084] kasan_save_track+0x3f/0x80 [ 60.673046][ T1084] kasan_save_free_info+0x40/0x50 [ 60.674987][ T1084] __kasan_slab_free+0x59/0x70 [ 60.676924][ T1084] kfree+0x1a0/0x440 [ 60.678467][ T1084] kobject_put+0x22f/0x480 [ 60.680224][ T1084] bch2_fs_free+0x27b/0x3c0 [ 60.681992][ T1084] deactivate_locked_super+0xc4/0x130 [ 60.683946][ T1084] cleanup_mnt+0x41f/0x4b0 [ 60.685754][ T1084] task_work_run+0x24f/0x310 [ 60.687636][ T1084] syscall_exit_to_user_mode+0x168/0x370 [ 60.689800][ T1084] do_syscall_64+0x100/0x230 [ 60.691600][ T1084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.693856][ T1084] [ 60.694791][ T1084] Last potentially related work creation: [ 60.697009][ T1084] kasan_save_stack+0x3f/0x60 [ 60.698855][ T1084] __kasan_record_aux_stack+0xac/0xc0 [ 60.701033][ T1084] insert_work+0x3e/0x330 [ 60.702683][ T1084] __queue_work+0xc8b/0xf50 [ 60.704467][ T1084] queue_work_on+0x1c2/0x380 [ 60.706281][ T1084] bch2_dev_do_discards+0x17a/0x1f0 [ 60.708661][ T1084] bch2_do_discards+0x29/0x60 [ 60.710492][ T1084] journal_write_done+0x785/0xea0 [ 60.712384][ T1084] process_scheduled_works+0xa63/0x1850 [ 60.714521][ T1084] worker_thread+0x870/0xd30 [ 60.716317][ T1084] kthread+0x2f0/0x390 [ 60.717909][ T1084] ret_from_fork+0x4b/0x80 [ 60.719684][ T1084] ret_from_fork_asm+0x1a/0x30 [ 60.721530][ T1084] [ 60.722472][ T1084] Second to last potentially related work creation: [ 60.724962][ T1084] kasan_save_stack+0x3f/0x60 [ 60.726837][ T1084] __kasan_record_aux_stack+0xac/0xc0 [ 60.728918][ T1084] insert_work+0x3e/0x330 [ 60.730603][ T1084] __queue_work+0xc8b/0xf50 [ 60.732391][ T1084] queue_work_on+0x1c2/0x380 [ 60.734214][ T1084] bch2_dev_do_discards+0x17a/0x1f0 [ 60.736199][ T1084] bch2_do_discards+0x29/0x60 [ 60.737989][ T1084] journal_write_done+0x785/0xea0 [ 60.739949][ T1084] process_scheduled_works+0xa63/0x1850 [ 60.742030][ T1084] worker_thread+0x870/0xd30 [ 60.743733][ T1084] kthread+0x2f0/0x390 [ 60.745257][ T1084] ret_from_fork+0x4b/0x80 [ 60.746965][ T1084] ret_from_fork_asm+0x1a/0x30 [ 60.748876][ T1084] [ 60.749823][ T1084] The buggy address belongs to the object at ffff88803812e000 [ 60.749823][ T1084] which belongs to the cache kmalloc-4k of size 4096 [ 60.754979][ T1084] The buggy address is located 176 bytes inside of [ 60.754979][ T1084] freed 4096-byte region [ffff88803812e000, ffff88803812f000) [ 60.760234][ T1084] [ 60.761224][ T1084] The buggy address belongs to the physical page: [ 60.763668][ T1084] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38128 [ 60.767267][ T1084] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 60.770478][ T1084] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 60.773435][ T1084] page_type: f5(slab) [ 60.774927][ T1084] raw: 04fff00000000040 ffff88801ac42140 dead000000000122 0000000000000000 [ 60.778296][ T1084] raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 60.781592][ T1084] head: 04fff00000000040 ffff88801ac42140 dead000000000122 0000000000000000 [ 60.784889][ T1084] head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 60.788453][ T1084] head: 04fff00000000003 ffffea0000e04a01 ffffffffffffffff 0000000000000000 [ 60.791797][ T1084] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 60.794978][ T1084] page dumped because: kasan: bad access detected [ 60.797443][ T1084] page_owner tracks the page as allocated [ 60.799596][ T1084] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5301, tgid 5301 (udevd), ts 59253905428, free_ts 59018485432 [ 60.807067][ T1084] post_alloc_hook+0x1f3/0x230 [ 60.809030][ T1084] get_page_from_freelist+0x3649/0x3790 [ 60.811190][ T1084] __alloc_pages_noprof+0x292/0x710 [ 60.813166][ T1084] alloc_pages_mpol_noprof+0x3e8/0x680 [ 60.815278][ T1084] alloc_slab_page+0x6a/0x140 [ 60.817104][ T1084] allocate_slab+0x5a/0x2f0 [ 60.818855][ T1084] ___slab_alloc+0xcd1/0x14b0 [ 60.820737][ T1084] __slab_alloc+0x58/0xa0 [ 60.822351][ T1084] __kmalloc_noprof+0x25a/0x400 [ 60.824235][ T1084] tomoyo_realpath_from_path+0xcf/0x5e0 [ 60.826399][ T1084] tomoyo_path2_perm+0x3eb/0xbb0 [ 60.828294][ T1084] tomoyo_path_rename+0x198/0x1e0 [ 60.830261][ T1084] security_path_rename+0x266/0x4e0 [ 60.832252][ T1084] do_renameat2+0x94a/0x13f0 [ 60.834014][ T1084] __x64_sys_rename+0x82/0x90 [ 60.835829][ T1084] do_syscall_64+0xf3/0x230 [ 60.837586][ T1084] page last free pid 5324 tgid 5324 stack trace: [ 60.839952][ T1084] free_unref_page+0xdf9/0x1140 [ 60.841773][ T1084] __slab_free+0x31b/0x3d0 [ 60.843449][ T1084] qlist_free_all+0x9a/0x140 [ 60.845166][ T1084] kasan_quarantine_reduce+0x14f/0x170 [ 60.847440][ T1084] __kasan_slab_alloc+0x23/0x80 [ 60.849671][ T1084] __kmalloc_noprof+0x1a6/0x400 [ 60.851617][ T1084] load_elf_binary+0x2eb/0x2710 [ 60.853546][ T1084] bprm_execve+0xaf8/0x1770 [ 60.855273][ T1084] do_execveat_common+0x55f/0x6f0 [ 60.857247][ T1084] __x64_sys_execve+0x92/0xb0 [ 60.859084][ T1084] do_syscall_64+0xf3/0x230 [ 60.860986][ T1084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.863222][ T1084] [ 60.864170][ T1084] Memory state around the buggy address: [ 60.866243][ T1084] ffff88803812df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.869161][ T1084] ffff88803812e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.872131][ T1084] >ffff88803812e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.875147][ T1084] ^ [ 60.877440][ T1084] ffff88803812e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.880433][ T1084] ffff88803812e180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.883393][ T1084] ================================================================== [ 60.911558][ T1084] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 60.914146][ T1084] CPU: 0 UID: 0 PID: 1084 Comm: kworker/u4:8 Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0 [ 60.917617][ T1084] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 60.921076][ T1084] Workqueue: loop0 loop_rootcg_workfn [ 60.922763][ T1084] Call Trace: [ 60.924104][ T1084] [ 60.925171][ T1084] dump_stack_lvl+0x241/0x360 [ 60.926971][ T1084] ? __pfx_dump_stack_lvl+0x10/0x10 [ 60.929005][ T1084] ? __pfx__printk+0x10/0x10 [ 60.930853][ T1084] ? preempt_schedule+0xe1/0xf0 [ 60.932749][ T1084] ? vscnprintf+0x5d/0x90 [ 60.934491][ T1084] panic+0x349/0x880 [ 60.936068][ T1084] ? check_panic_on_warn+0x21/0xb0 [ 60.937999][ T1084] ? __pfx_panic+0x10/0x10 [ 60.939712][ T1084] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 60.942021][ T1084] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 60.944352][ T1084] ? print_report+0x502/0x550 [ 60.946188][ T1084] check_panic_on_warn+0x86/0xb0 [ 60.948098][ T1084] ? percpu_ref_put+0xda/0x250 [ 60.949870][ T1084] end_report+0x77/0x160 [ 60.951575][ T1084] kasan_report+0x154/0x180 [ 60.953358][ T1084] ? percpu_ref_put+0xda/0x250 [ 60.955149][ T1084] ? percpu_ref_put+0x1f/0x250 [ 60.957068][ T1084] percpu_ref_put+0xda/0x250 [ 60.958877][ T1084] blk_update_request+0x5e5/0x1160 [ 60.960804][ T1084] blk_mq_end_request+0x3e/0x70 [ 60.962690][ T1084] loop_process_work+0x1bc8/0x21c0 [ 60.964670][ T1084] ? __pfx_loop_process_work+0x10/0x10 [ 60.966748][ T1084] ? register_lock_class+0x102/0x980 [ 60.968747][ T1084] ? try_to_wake_up+0x609/0x14b0 [ 60.970621][ T1084] ? do_raw_spin_lock+0x14f/0x370 [ 60.972523][ T1084] ? __pfx_register_lock_class+0x10/0x10 [ 60.974677][ T1084] ? mark_lock+0x9a/0x360 [ 60.976331][ T1084] ? __pfx_lock_acquire+0x10/0x10 [ 60.978180][ T1084] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 60.980499][ T1084] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 60.982845][ T1084] ? process_scheduled_works+0x976/0x1850 [ 60.985135][ T1084] process_scheduled_works+0xa63/0x1850 [ 60.987307][ T1084] ? __pfx_process_scheduled_works+0x10/0x10 [ 60.989488][ T1084] ? assign_work+0x364/0x3d0 [ 60.991288][ T1084] worker_thread+0x870/0xd30 [ 60.993099][ T1084] ? __kthread_parkme+0x169/0x1d0 [ 60.994946][ T1084] ? __pfx_worker_thread+0x10/0x10 [ 60.996911][ T1084] kthread+0x2f0/0x390 [ 60.998462][ T1084] ? __pfx_worker_thread+0x10/0x10 [ 61.000392][ T1084] ? __pfx_kthread+0x10/0x10 [ 61.002158][ T1084] ret_from_fork+0x4b/0x80 [ 61.003937][ T1084] ? __pfx_kthread+0x10/0x10 [ 61.005689][ T1084] ret_from_fork_asm+0x1a/0x30 [ 61.007545][ T1084] [ 61.008987][ T1084] Kernel Offset: disabled [ 61.010636][ T1084] Rebooting in 86400 seconds..