syzkaller login: [ 264.054408][ T1860] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 264.122922][ T1860] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 264.144398][ T1860] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 291.150592][ T1860] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. Warning: Permanently added '[localhost]:5727' (ECDSA) to the list of known hosts. 1970/01/01 00:05:46 fuzzer started 1970/01/01 00:05:58 dialing manager at localhost:40615 [ 365.088397][ T2039] cgroup: Unknown subsys name 'net' [ 366.332897][ T2039] cgroup: Unknown subsys name 'rlimit' 1970/01/01 00:06:06 syscalls: 2918 1970/01/01 00:06:06 code coverage: enabled 1970/01/01 00:06:06 comparison tracing: enabled 1970/01/01 00:06:06 extra coverage: enabled 1970/01/01 00:06:06 delay kcov mmap: mmap returned an invalid pointer 1970/01/01 00:06:06 setuid sandbox: enabled 1970/01/01 00:06:06 namespace sandbox: enabled 1970/01/01 00:06:06 Android sandbox: /sys/fs/selinux/policy does not exist 1970/01/01 00:06:06 fault injection: enabled 1970/01/01 00:06:06 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 1970/01/01 00:06:06 net packet injection: enabled 1970/01/01 00:06:06 net device setup: enabled 1970/01/01 00:06:06 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 1970/01/01 00:06:06 devlink PCI setup: PCI device 0000:00:10.0 is not available 1970/01/01 00:06:06 NIC VF setup: PCI device 0000:00:11.0 is not available 1970/01/01 00:06:06 USB emulation: enabled 1970/01/01 00:06:06 hci packet injection: /dev/vhci does not exist 1970/01/01 00:06:06 wifi device emulation: /sys/class/mac80211_hwsim/ does not exist 1970/01/01 00:06:06 802.15.4 emulation: /sys/bus/platform/devices/mac802154_hwsim does not exist 1970/01/01 00:06:06 fetching corpus: 0, signal 0/2000 (executing program) 1970/01/01 00:06:10 fetching corpus: 50, signal 26603/29840 (executing program) 1970/01/01 00:06:14 fetching corpus: 99, signal 44407/48517 (executing program) 1970/01/01 00:06:18 fetching corpus: 149, signal 51118/56269 (executing program) 1970/01/01 00:06:21 fetching corpus: 198, signal 58268/64215 (executing program) 1970/01/01 00:06:24 fetching corpus: 248, signal 64581/71200 (executing program) 1970/01/01 00:06:27 fetching corpus: 298, signal 71019/78086 (executing program) 1970/01/01 00:06:30 fetching corpus: 348, signal 76617/84064 (executing program) 1970/01/01 00:06:32 fetching corpus: 398, signal 80144/88090 (executing program) 1970/01/01 00:06:35 fetching corpus: 448, signal 84391/92657 (executing program) 1970/01/01 00:06:39 fetching corpus: 497, signal 87381/95976 (executing program) 1970/01/01 00:06:43 fetching corpus: 547, signal 92051/100661 (executing program) 1970/01/01 00:06:45 fetching corpus: 597, signal 94160/103106 (executing program) 1970/01/01 00:06:48 fetching corpus: 647, signal 97293/106287 (executing program) 1970/01/01 00:06:52 fetching corpus: 697, signal 99548/108742 (executing program) 1970/01/01 00:06:55 fetching corpus: 747, signal 105630/114097 (executing program) 1970/01/01 00:06:59 fetching corpus: 796, signal 107326/115882 (executing program) 1970/01/01 00:07:03 fetching corpus: 846, signal 109308/117811 (executing program) 1970/01/01 00:07:06 fetching corpus: 896, signal 112183/120473 (executing program) 1970/01/01 00:07:09 fetching corpus: 946, signal 113697/121977 (executing program) 1970/01/01 00:07:12 fetching corpus: 996, signal 116003/124028 (executing program) 1970/01/01 00:07:15 fetching corpus: 1044, signal 117745/125632 (executing program) 1970/01/01 00:07:17 fetching corpus: 1093, signal 119649/127295 (executing program) 1970/01/01 00:07:20 fetching corpus: 1143, signal 121542/128836 (executing program) 1970/01/01 00:07:22 fetching corpus: 1193, signal 124020/130784 (executing program) 1970/01/01 00:07:25 fetching corpus: 1243, signal 126076/132377 (executing program) 1970/01/01 00:07:27 fetching corpus: 1292, signal 128075/133854 (executing program) 1970/01/01 00:07:30 fetching corpus: 1341, signal 129661/135012 (executing program) 1970/01/01 00:07:33 fetching corpus: 1391, signal 131150/136044 (executing program) 1970/01/01 00:07:35 fetching corpus: 1441, signal 132511/137038 (executing program) 1970/01/01 00:07:38 fetching corpus: 1491, signal 134059/138021 (executing program) 1970/01/01 00:07:41 fetching corpus: 1541, signal 135344/138819 (executing program) 1970/01/01 00:07:44 fetching corpus: 1591, signal 136988/139835 (executing program) 1970/01/01 00:07:47 fetching corpus: 1632, signal 138780/140850 (executing program) 1970/01/01 00:07:48 fetching corpus: 1634, signal 138797/140925 (executing program) 1970/01/01 00:07:48 fetching corpus: 1634, signal 138797/140986 (executing program) 1970/01/01 00:07:48 fetching corpus: 1634, signal 138797/141041 (executing program) 1970/01/01 00:07:48 fetching corpus: 1634, signal 138797/141109 (executing program) 1970/01/01 00:07:48 fetching corpus: 1634, signal 138797/141176 (executing program) 1970/01/01 00:07:49 fetching corpus: 1634, signal 138797/141216 (executing program) 1970/01/01 00:07:49 fetching corpus: 1634, signal 138797/141273 (executing program) 1970/01/01 00:07:49 fetching corpus: 1634, signal 138797/141335 (executing program) 1970/01/01 00:07:49 fetching corpus: 1634, signal 138797/141391 (executing program) 1970/01/01 00:07:50 fetching corpus: 1634, signal 138797/141450 (executing program) 1970/01/01 00:07:50 fetching corpus: 1634, signal 138797/141516 (executing program) 1970/01/01 00:07:50 fetching corpus: 1634, signal 138797/141577 (executing program) 1970/01/01 00:07:50 fetching corpus: 1634, signal 138797/141640 (executing program) 1970/01/01 00:07:50 fetching corpus: 1634, signal 138797/141695 (executing program) 1970/01/01 00:07:50 fetching corpus: 1634, signal 138797/141751 (executing program) 1970/01/01 00:07:51 fetching corpus: 1634, signal 138801/141824 (executing program) 1970/01/01 00:07:51 fetching corpus: 1634, signal 138801/141892 (executing program) 1970/01/01 00:07:51 fetching corpus: 1634, signal 138801/141947 (executing program) 1970/01/01 00:07:51 fetching corpus: 1634, signal 138801/142024 (executing program) 1970/01/01 00:07:51 fetching corpus: 1634, signal 138801/142090 (executing program) 1970/01/01 00:07:51 fetching corpus: 1634, signal 138801/142143 (executing program) 1970/01/01 00:07:52 fetching corpus: 1634, signal 138801/142190 (executing program) 1970/01/01 00:07:52 fetching corpus: 1634, signal 138801/142253 (executing program) 1970/01/01 00:07:52 fetching corpus: 1634, signal 138801/142315 (executing program) 1970/01/01 00:07:52 fetching corpus: 1634, signal 138801/142373 (executing program) 1970/01/01 00:07:52 fetching corpus: 1634, signal 138801/142428 (executing program) 1970/01/01 00:07:52 fetching corpus: 1634, signal 138801/142475 (executing program) 1970/01/01 00:07:52 fetching corpus: 1634, signal 138801/142537 (executing program) 1970/01/01 00:07:53 fetching corpus: 1634, signal 138801/142587 (executing program) 1970/01/01 00:07:53 fetching corpus: 1634, signal 138801/142648 (executing program) 1970/01/01 00:07:53 fetching corpus: 1634, signal 138809/142703 (executing program) 1970/01/01 00:07:53 fetching corpus: 1634, signal 138809/142761 (executing program) 1970/01/01 00:07:53 fetching corpus: 1634, signal 138809/142822 (executing program) 1970/01/01 00:07:53 fetching corpus: 1634, signal 138809/142880 (executing program) 1970/01/01 00:07:54 fetching corpus: 1634, signal 138809/142948 (executing program) 1970/01/01 00:07:54 fetching corpus: 1634, signal 138809/143005 (executing program) 1970/01/01 00:07:54 fetching corpus: 1634, signal 138809/143068 (executing program) 1970/01/01 00:07:54 fetching corpus: 1634, signal 138809/143096 (executing program) 1970/01/01 00:07:54 fetching corpus: 1634, signal 138809/143096 (executing program) 1970/01/01 00:09:57 starting 2 fuzzer processes 00:09:57 executing program 0: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x0, @loopback}], 0x10) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={r2}, 0x8) 00:09:57 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$BLKZEROOUT(r0, 0x127e, &(0x7f0000000100)) [ 625.700550][ C0] ================================================================== [ 625.704080][ C0] BUG: KASAN: slab-out-of-bounds in walk_stackframe+0x11c/0x260 [ 625.705605][ C0] Read of size 8 at addr ffffaf800c74bf70 by task syz-executor.1/2051 [ 625.708741][ C0] [ 625.710435][ C0] CPU: 0 PID: 2051 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 625.712193][ C0] Hardware name: riscv-virtio,qemu (DT) [ 625.713448][ C0] Call Trace: [ 625.714446][ C0] [] dump_backtrace+0x2e/0x3c [ 625.715825][ C0] [] show_stack+0x34/0x40 [ 625.717050][ C0] [] dump_stack_lvl+0xe4/0x150 [ 625.718349][ C0] [] print_address_description.constprop.0+0x2a/0x330 [ 625.720642][ C0] [] kasan_report+0x184/0x1e0 [ 625.722035][ C0] [] __asan_load8+0x6e/0x96 [ 625.723304][ C0] [] walk_stackframe+0x11c/0x260 [ 625.724686][ C0] [] arch_stack_walk+0x2c/0x3c [ 625.725951][ C0] [] stack_trace_save+0xa6/0xd8 [ 625.727438][ C0] [ 625.728310][ C0] Allocated by task 208977472: [ 625.729344][ C0] (stack is not available) [ 625.730518][ C0] [ 625.731719][ C0] Last potentially related work creation: [ 625.732983][ C0] ------------[ cut here ]------------ [ 625.733872][ C0] slab index 1358848 out of bounds (285) for stack id 0c74bc00 [ 625.738370][ C0] WARNING: CPU: 0 PID: 2051 at lib/stackdepot.c:304 stack_depot_print+0x66/0x70 [ 625.740687][ C0] Modules linked in: [ 625.742125][ C0] CPU: 0 PID: 2051 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 625.743566][ C0] Hardware name: riscv-virtio,qemu (DT) [ 625.744562][ C0] epc : stack_depot_print+0x66/0x70 [ 625.745735][ C0] ra : stack_depot_print+0x66/0x70 [ 625.746969][ C0] epc : ffffffff80c00b8a ra : ffffffff80c00b8a sp : ffffaf800c74be30 [ 625.748203][ C0] gp : ffffffff85863ac0 tp : ffffaf800de33080 t0 : ffffffff86bcb657 [ 625.749459][ C0] t1 : fffff5ef0b53910c t2 : 0000000000000000 s0 : ffffaf800c74be40 [ 625.751238][ C0] s1 : ffffaf807a9c9c40 a0 : 000000000000003c a1 : 00000000000f0000 [ 625.752431][ C0] a2 : 0000000000000504 a3 : ffffffff8012252a a4 : 6a86b1dd255fad00 [ 625.753662][ C0] a5 : 6a86b1dd255fad00 a6 : 0000000000f00000 a7 : ffffaf805a9c8863 [ 625.754844][ C0] s2 : ffffaf800c74bf70 s3 : ffffaf8007201c80 s4 : ffffaf800c74bc00 [ 625.756029][ C0] s5 : ffffaf800c74be00 s6 : 0000000000003fff s7 : ffffaf800c74bf10 [ 625.757181][ C0] s8 : 0000000000400000 s9 : ffffffffffffc000 s10: ffffaf800c74bfe0 [ 625.758407][ C0] s11: 0000000000000008 t3 : fffffffff3f3f300 t4 : fffff5ef0b53910c [ 625.759906][ C0] t5 : fffff5ef0b53910d t6 : ffffaf800c74b938 [ 625.761247][ C0] status: 0000000000000100 badaddr: 0000000000000000 cause: 0000000000000003 [ 625.762549][ C0] [] print_address_description.constprop.0+0x2fc/0x330 [ 625.764102][ C0] [] kasan_report+0x184/0x1e0 [ 625.765372][ C0] [] __asan_load8+0x6e/0x96 [ 625.766531][ C0] [] walk_stackframe+0x11c/0x260 [ 625.767802][ C0] [] arch_stack_walk+0x2c/0x3c [ 625.769028][ C0] [] stack_trace_save+0xa6/0xd8 [ 625.770787][ C0] irq event stamp: 33091 [ 625.771604][ C0] hardirqs last enabled at (33090): [] _raw_spin_unlock_irqrestore+0x68/0x98 [ 625.773187][ C0] hardirqs last disabled at (33091): [] _raw_spin_lock_irqsave+0x60/0x62 [ 625.774692][ C0] softirqs last enabled at (32990): [] __do_softirq+0x618/0x8fc [ 625.776180][ C0] softirqs last disabled at (32997): [] __irq_exit_rcu+0x142/0x1f8 [ 625.777671][ C0] ---[ end trace 0000000000000000 ]--- [ 625.779023][ C0] [ 625.779865][ C0] The buggy address belongs to the object at ffffaf800c74bc00 [ 625.779865][ C0] which belongs to the cache kmalloc-512 of size 512 [ 625.781596][ C0] The buggy address is located 368 bytes to the right of [ 625.781596][ C0] 512-byte region [ffffaf800c74bc00, ffffaf800c74be00) [ 625.783242][ C0] The buggy address belongs to the page: [ 625.784644][ C0] page:ffffaf807a9c9c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8c948 [ 625.786260][ C0] head:ffffaf807a9c9c40 order:2 compound_mapcount:0 compound_pincount:0 [ 625.787626][ C0] flags: 0x8800010200(slab|head|section=17|node=0|zone=0) [ 625.790864][ C0] raw: 0000008800010200 0000000000000000 0000000000000001 ffffaf8007201c80 [ 625.792202][ C0] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 625.793411][ C0] raw: 00000000000007ff [ 625.794284][ C0] page dumped because: kasan: bad access detected [ 625.795488][ C0] page_owner tracks the page as allocated [ 625.796454][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 501, ts 38395887300, free_ts 38394521100 [ 625.798698][ C0] __set_page_owner+0x48/0x136 [ 625.800154][ C0] post_alloc_hook+0xd0/0x10a [ 625.801627][ C0] get_page_from_freelist+0x8da/0x12d8 [ 625.802777][ C0] __alloc_pages+0x150/0x3b6 [ 625.803850][ C0] alloc_pages+0x132/0x2a6 [ 625.804968][ C0] alloc_slab_page.constprop.0+0xc2/0xfa [ 625.806144][ C0] new_slab+0x25a/0x2cc [ 625.807197][ C0] ___slab_alloc+0x56e/0x918 [ 625.808313][ C0] __slab_alloc.constprop.0+0x50/0x8c [ 625.809604][ C0] kmem_cache_alloc_trace+0x2a2/0x2e0 [ 625.811320][ C0] alloc_bprm+0x48/0x4b6 [ 625.812672][ C0] kernel_execve+0x54/0x288 [ 625.813768][ C0] call_usermodehelper_exec_async+0x1c0/0x2dc [ 625.814957][ C0] ret_from_exception+0x0/0x10 [ 625.816117][ C0] page last free stack trace: [ 625.816902][ C0] __reset_page_owner+0x4a/0xea [ 625.817936][ C0] free_pcp_prepare+0x29c/0x45e [ 625.818958][ C0] free_unref_page+0x6a/0x31e [ 625.820321][ C0] __free_pages+0xe2/0x112 [ 625.821305][ C0] put_task_stack+0x1d0/0x2b0 [ 625.822331][ C0] finish_task_switch.isra.0+0x3ce/0x420 [ 625.823427][ C0] schedule_tail+0xe/0xc8 [ 625.824474][ C0] ret_from_kernel_thread+0x4/0x10 [ 625.825721][ C0] [ 625.826557][ C0] Memory state around the buggy address: [ 625.827868][ C0] ffffaf800c74be00: fc fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00 [ 625.828999][ C0] ffffaf800c74be80: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc [ 625.830744][ C0] >ffffaf800c74bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 625.831870][ C0] ^ [ 625.832963][ C0] ffffaf800c74bf80: fc fc fc fc fc fc fc fc f1 f1 f1 f1 00 00 00 f3 [ 625.834049][ C0] ffffaf800c74c000: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 625.835166][ C0] ================================================================== [ 625.836167][ C0] Disabling lock debugging due to kernel taint [ 625.845969][ T2051] Kernel panic - not syncing: corrupted stack end detected inside scheduler [ 625.847909][ T2051] CPU: 0 PID: 2051 Comm: syz-executor.1 Tainted: G B W 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 625.849904][ T2051] Hardware name: riscv-virtio,qemu (DT) [ 625.851031][ T2051] Call Trace: [ 625.851580][ T2051] [] dump_backtrace+0x2e/0x3c [ 625.852769][ T2051] [] show_stack+0x34/0x40 [ 625.853770][ T2051] [] dump_stack_lvl+0xe4/0x150 [ 625.854806][ T2051] [] dump_stack+0x1c/0x24 [ 625.855793][ T2051] [] panic+0x24a/0x634 [ 625.856665][ T2051] [] schedule+0x0/0x14c [ 625.857639][ T2051] [] preempt_schedule_irq+0x4a/0x13e [ 625.858695][ T2051] [] resume_kernel+0x16/0x18 [ 625.860390][ T2051] SMP: stopping secondary CPUs [ 625.862419][ T2051] Rebooting in 86400 seconds.. VM DIAGNOSIS: 03:27:38 Registers: info registers vcpu 0 pc ffffffff8010b22c mhartid 0000000000000000 mstatus 00000000000000a0 mip 00000000000000a0 mie 000000000000022a mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff80475786 sepc ffffffff80be7ade mcause 8000000000000007 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff831a18d8 x2/sp ffffaf800c74b930 x3/gp ffffffff85863ac0 x4/tp ffffaf800de33080 x5/t0 ffffffff86bcb657 x6/t1 fffff5ef018e972c x7/t2 0000000000000000 x8/s0 ffffaf800c74b940 x9/s1 0000000000001000 x10/a0 0000000000000020 x11/a1 ffffffffffffffff x12/a2 1ffff5f001bc6611 x13/a3 ffffffff80146d84 x14/a4 0000000000000506 x15/a5 0000000000000000 x16/a6 0000000000f00000 x17/a7 ffffaf800c74b967 x18/s2 ffffaf800c74ba60 x19/s3 ffffffff84b73ec0 x20/s4 0000000000000000 x21/s5 ffffffff8343c840 x22/s6 ffffffffffffffff x23/s7 ffffffff8588c3e0 x24/s8 ffffffff86c1a620 x25/s9 1ffff5f0018e973c x26/s10 ffffffff84a88600 x27/s11 ffffffff8012183e x28/t3 fffffffff3f3f300 x29/t4 fffff5ef018e972c x30/t5 fffff5ef018e972d x31/t6 ffffaf800c74b978 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 pc ffffffff80475986 mhartid 0000000000000001 mstatus 00000000000000a2 mip 0000000000000000 mie 00000000000002aa mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff8000f97e sepc 00007fffb109e264 mcause 0000000000000009 scause 0000000000000008 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff80119b52 x2/sp ffffaf80091eb7e0 x3/gp ffffffff85863ac0 x4/tp ffffaf8009d2e100 x5/t0 00000000000001f8 x6/t1 6a86b1dd255fad00 x7/t2 ffffffffffffffff x8/s0 ffffaf80091eb7e0 x9/s1 ffffaf800c510c98 x10/a0 ffffaf800c510c98 x11/a1 0000000000000003 x12/a2 1ffff5f0018a2193 x13/a3 ffffffff80119b52 x14/a4 0000000000000000 x15/a5 0000000000000001 x16/a6 0000000000f00000 x17/a7 ffffffff826e6226 x18/s2 0000000000000001 x19/s3 ffffaf8009d2e100 x20/s4 ffffaf800c510ca8 x21/s5 ffffaf800c510ca0 x22/s6 ffffaf80091eb960 x23/s7 ffffaf80091ebb00 x24/s8 0000000000000000 x25/s9 0000000000004000 x26/s10 0000000000000040 x27/s11 0000000000000001 x28/t3 fffffffff3f3f300 x29/t4 ffffffff80112282 x30/t5 1ffff5f00123d6b4 x31/t6 000000000211f12e f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000