program: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000680)={0x0, {0x2, 0x100, @empty}, {0x2, 0x0, @loopback}, {0x2, 0x0, @broadcast}}) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={0x0, {0x2, 0x0, @private}, {0x2, 0x0, @empty}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0xfffd, &(0x7f0000000240)='batadv_slave_1\x00'}) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x0, @empty}, {0x2, 0x0, @remote}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xfc}}, 0x592243c4f6d942ef, 0x0, 0x0, 0x0, 0x1}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000240), r1) sendmsg$NET_DM_CMD_STOP(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r2, 0x89, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x800) syz_mount_image$bcachefs(&(0x7f00000000c0), &(0x7f0000000080)='./file1\x00', 0x818001, &(0x7f00000001c0)=ANY=[@ANYBLOB='sb=0008,shard_inode_numbers,errors=continue,inline_data,direct_io,nochanges,prjquota,compression=none,version_upgrade=incompatible,\x00', @ANYBLOB="235a619f9f9939ef30ceb6f01a8c09078073a8a720bd49fcf0840fb200573e678b600f7fff0d28c7cc9ef5606eab829418e4f3331f5b6d02d83373389034c6c48e86aa54cfb828bd9211046e9ccf34aedfcc03e09aad7c79aa702f5692b8586e3415942e001cec9e906c8defcc0a449a30022f622d57c48a1e43d23c3421c6611ef0a794616e2b03f8b2bf9e4ed13b4db125cc96976175fa2de191468d731d3a3e4b3cdc7db7", @ANYRESDEC, @ANYRES8=0x0, @ANYRESHEX, @ANYRES16], 0x1, 0x5987, &(0x7f0000000340)="$eJzs3X+MXMWdIPB63T2e9ox/jA0sDoTxYPAuC5t4zA+LhNXGu7ebrIBFjlhlMecEBjxmndjGss2CDbuYPciBgIisstolyR8kIuhInAgJLsFBIfw4m0tIEJccOhF0yR3JSTkRDiuAD0W5zGmmX/X0vOk3r6e7x9jw+cie11Vd/a169apfv6rumQ4AAAC8Kxy8befhS076i+//4+ibN//lt7feEvrLE/nVWGAg3d7wdrWQI6m3smximx0Xf3DjV38xdPWffe+hvq+8dWDjqZt+8ufHXf3YJy/cf+8Xnnxj4SO/e7kobhxPZ06mk1eTEKrfOfTPnz7w7InjeUkIoZwM7A1hSbL0ySVJJsTwb0IIG9NEuTL1zoffPGfT+PaWO3un5C/OBDHe392q6Tjbc/j6s8JP/3T9rT9c/o2v9+x7Ze9kkaTaMJ5CWHRl4+N70v/z03Qcbcvig9PtuhBCX8Pjzi9o12kttn9VTvrkdDsv3fYXxIn3r8ikS5ly2XTUk9n2FdTXqbx2tFuuyIJMOnsy6lReO2P+knT7rXR75izjl+P/JJSSUKk3f0syOUZCw3FLQjJxLKv1dKl+bEO6/5l0kkmXMulyT2a/JupNB1o5Sabmx3KZ/Hg6rqT5pzaeq5u4NCf/Pem2mj5R34rpkL1R0z/tRn2/JsR2HZqhLUdCqeEc1Cy/Ps7Sg9Gf5vUnS6c9ZqyJeN+B9XetLG946uBATjuSh5I0fjLRR7ONv+cHSxZ84mt3XJd3bJMrS2n8Ulvxf3bRc69dfseXP78sL/49MX65rfhnP9736kVP37Yir3/ifvWHSlvxR15+5u7lx1+1L7f998X+r7Z1fNfuf6534eHHn8g9vsOxf+a31f6XLvjwzx984dFXcuOHGL+vrfgb9m//TO/g4TNy4z8R+6e/vfHz+r41Lw4O/nIoL/7zMf7CtuI/sPfeD96/+M4Lc4/vutg/A23Fv/j0x25dcPjRU3KfX/d165UT4N3puPQa6/Y0PdM8s3eGeWanGuYL/zpUqV23Lkj/L+xmRZmLz/F6FnUzPgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEE446z9/5H9+bODVSpruTW+8VKptY/68EJL5IYSdu0Z27Nq87ZqhT1573Y5tI1uGRnYNjW7btWP30Ll/NLRjdPuWkd3j9w6/75za45aGpLZNTplWd+/Y2FhpYGperO/fnL7vpyvP/9+/CmH4hB8PVnLbv+rerfcf3+RnRrJ27ENbr7vkx+d9Kd2vgbRdA03aNTY2NhZy2vV/Lvvt/f906BdnhDD8ezO165mX/uS7Uxo0kTEZJ1XqDbUG9SZ9TdtRb3XanthflU2bt4wOz9y/448v5+zHv73xld9suuGzv631bzV3P1rs3/lrx7aU/mX9xf/vX26qZRS1q74fmXbN9XEv6u+4F7F9sf+qaX8vSvdrUc5+VXL6+7YfPvHCd0664429Ybjy+vLpdRftV086AHqS97RUb6yhL1kyJb+alo9HPD5u1a6t21ft3L3nfZu3jlwzes3otg+sPnf1muHz1py3amLPV3V5/2P9v9/i/rc6nrL1zm48Lf67vd+KP1sbT0XtKuqP8XYV90djizLtWjjxc/7asb5LP/25D9z79CW17KJxHkvXn4fptm/8OK8ODeNtel8126+ifgghDDXrh9feuDCc+N8231p0Hmo8Mo0/M5K1Y8+u+PWXzv/isj+uZRyR83xjg9o8z9dbPdmeif6qpsdj7Cjt395QTverv2m7Vj/7dM9dB3/19/X2zZsXbhjZtWvH6trPBWlLFyQnN21XNjfu1/KJn+WQdkuoD9Mm43VcT6i1L3v+jMWzvdqf3tefLG26X1nxvgPr71pZ3vDUwbyeTh6q1Tg/PnGT9+aU3JJ5YLne4Gb1H63Pv6LxMfiRLz7ysUe+ee608XF27WfRfiU5+/WNFx743Fc++++/2b39+sifPDfw6//+tytrGcfKeaXe6rQ9SeN55ewQip5/y0Pz/ch9/pWa70/R8y9bz2T55vGGMun+UC5+vlbDtOfr2Y/3vXrR07etyH2+Hmr1+XrTlFS54Pl6tIyf7PMrqUxtx9w9v6YMlGTt2PduP27vkzevO6mWUTSu66WbjetzWph/5OzXdy9/cfDaoX/3X7t33vjqHz18xU9G1v5DLaP94x7b0p3jXk37t5rTv/VWx3lnY/++/+prt2ys5b/t1781Ta5/023B/CeeSnbu3vOpkS1bRnfsbG2/Wn09jfVke7nd19N4dltasF+lafs1dzda6a9Wn2+x/Run9VdvW8+3/pC0dR235wdLFnzia3dcNzDtUWlFV5bS+KW24v/soudeu/yOL38+N/49MX6lrfgjLz9z9/Ljr9qXG/++JI1fbSv+2v3P9S48/PgTufGHY/vntxX/pQs+/PMHX3j0ldz4Icbvb6//X9+35sXBwV/mxn8+SesZv0YK4eE3z9lUSyehJ32+xXb0TGlXyKaTTLqUSZcb06XaWmu9gnKSTM2P5dL8Uxva0szf5OTHq7Dqstr2rZgO2Rsz5x9tSg3n/mb5RdepAADvdPH9/3gNGt//H00vlPJXGmBSp/OwZTlx4zxscj1n3pT7l6Xx4+PjOuDg+8Pw+PaWodqF/mzfR4jPh+w6Z6znjNOmxpjNOmcpTK5zFq2/r8ikY7tq6+WVhnloavq8phJaWH+fXs/M6++Z3S9eHx+6fVqzhhrWrbLHryddMWv2eYdMeyvjEfLGR3ZdLH6eY3BRWDdRX4vjI/s5mngcsp+jifWclDlxtvs5mk7HR2z2DONjosnF729MP35hhv6dPH7No2WP3yyOd3W8/Fy/P9uFdcOmp7Qjt27YwvthTeK3+n5YfV1y7fQyM8V/t6xLHu3rhjE/7kelxfXEj+Xkt7Ke2Lgul7eeGE8XsV2HZmjLkWA9EXinivP/+BoxPv8fvwD/v5lyRdeh2avGGC/3c0Ll5u0pmndM/5xeX1uv4xv2b/9M7+DhM3Kvc55o9XM/26ek+go+91PUjysz6cJ+zFmgKZrvZesp6vfs5zL6w8K2+v2Bvfd+8P7Fd16Y2+/rai+kxf3+uSmphQX9fgzMF5rHf6fNF3yOYWr8Ln2OoWj97G2bj6QffJqr+chf5+TP9vMNfdNu1PdrwjE3H+k5su0CAI4dcf5ff/8snf//j1ggvY4omreemUnHeLnz1pzrk7x561+l2xsy5fvT36iY7XXzxac/duuCw4+ekjtvua/Veeh/mJIaKJyHdjZvzp1HrOvO58Vz5xH1eVZn88Tc9tfniZ3N03Pj1+fpnc2jc/unPo/ubB0gN359HeBYn+cWrNdlKovJVtfr3rHz6PTXZzPz6Pov1XY6j740J3+28+j+aTfq+zXBPBoA4O0V5//xMi7O/5/OlOv0ffbceUGXrtuzfw+kHv/5IzWvnOt531zPW+d6Xj/X6xLH+rx4jtaF0uWouV4nO8rmxZPljtS8OK303Tcvnn/E2gYAQOfi/D9exeXP/zubnzSbv/VMed/a/LxpfPPzo2R+fqyvf5n/e1+8mPfFAQDe2eL8P/7aY/z7f/8pTWf/br15ek5883Tz9JnGz+v71jw40Mo8vfvrbGHKOpt1gCO+DtDwFrl1AAAA3g49EzOl6b9n//F0m/09+7zfy788p3yrKunl8VW7doyOXnHd9o0ju0av2HbtxtGdV1y/Y/OuXaPbauU6nTfmzlvSeWNPqKT90bxcdt62OP17CItz/h5CtnwMe/LEjel/DyFb7fyCvyMwefxaa2/e8SvNUL7Z+Mg73nnx/yanfFQ//lf/7dlXbNp5xeZtm3dtHtmyec/o1HLjs9a+WXxvZuyWWX1faubHNKXZf39nd9pRmtaOnrQ/8r6fPcm0Y0nakiV533+Q0+7v/5d/+rvTx377YAjDJ5Tf21H/JWvH/uNlo3+16+CPt4+3f/6M7a+XTNtV9H2l2fJxfypbrt2566xN1163LfuNku2J6xmlenqO1jPSp3+5xfWJDTn5s/2cQnnajaNTy+sTAABMEd//j9ez8f3Dz6YXUDG/9Xl6Z+8f587Th6fO0/N+6zT7vWRF8/Rs+bi/rc7Tqx3O07P1F83Tm5VvNk/Pm3fnxf/rnPKz1fo46exzHrnj5MrW1nOy32dQNE6y5Wc7TpIOx0m2/qJx0qx8s3GSd9zz4n80p3ye1sdDZ5/LyR0P97Q2Hv4wky4aD9nysx0PpQ7HQ7b+ovHQrHyz8ZB3fPPiX5JTvlVTx8f4wJgYF6NXXH/tjk81lJvr77/ovH1z+/0f7Wq9/XP7ua+5b//cfq5s7tvf2e9/5bb/+c5Wwlpv/9x+v0u7jth6bfphs6LPnxWt467PyZ/tOu68aTeOTtZx4e0T5//x7Z44/78z3Xb7baC36XvSkqL4rX9Pmu8xaxq/S99jVnQd4/V8hsqOAl7PAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFrTW1k2sT14287Dl5z0F9//x9E3b/7Lb2+95Q9u/Oovhq7+s+891PeVtw5sPHXTT/78uKsf++SF++/9wpNvLHzkdy8XBh6Y+Fk5M01WQ0heTUKofufQP3/6wLMnjuclIYRyMrA3hCXJ0ieXJJkIw78JIWyst3PqnQ+/ec6m8e0td/ZOyV+cCZLdr9Bfju1pbGcINxTuEcegajrO9hy+/qzw0z9df+sPl3/j6z37Xtk7WSSpNoynEBZd2fj4nhDC/PT/uDjalsUHp9t1IYS+hsedX9Cu01ps/6qc9Mnpdl667S+IE+9fkUmXMuWy6agns+0rqK9Tee1ot1yRBZl09mTUqbx2xvwl6fZb6fbMWcYvx/9JKCWhUm/+lmRyjISG45aEZOJYVuvpUv3YhnT/M+kkky5l0uWezH5N1JsOtHKSTM2P5TL58XRcSfNPbTxXN3FpTv570m01faK+FdMhe6Omf9qN+n5NiO06NENbjoRSwzmoWX79wKcHoz/N60+WTnvMWBPxvgPr71pZ3vDUwYGcdiQPJWn8pK34e36wZMEnvnbHdcvy4l9ZSuOX2or/s4uee+3yO778+dz498T45bbin/1436sXPX3bitz+ORT7p9JW/JGXn7l7+fFX7ctt/30xfrWt+Gv3P9e78PDjT+S2fzj2z/y24r90wYd//uALj76SGz/E+H1txd+wf/tnegcPn5Eb/4nYP/3tjZ/X9615cXDwl0N58Z+P8Re2Ff+Bvfd+8P7Fd16Ye3zXxf4ZaCv+xac/duuCw4+eknfuTO7r1isnwLvTcek11u1put15Zqca5gv/OlSpXfMtSP8v7GZFGeP1LJrD+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvDP96KZzP37Zhz66vpKEkOSUGWsi3leet3btUBv1jrz8zN3Lj79qX2PesjbiAAAAAMXiPLxUz6mGZeH6ZH44uWn5uEZwckwlU/OzawgxTnaNoN04pS7FKXcpTqVLcXq6FGdel+L0dilOtSBONbQWZ/4McSrjo6LF9vTN2J7W4/R3Kc6CLsVZ2KU4i7oUZ3GX4gzMGKf1cbikS3GWdinOcV2Kc3yX4pzQpTi/16U4J3YpTnZNebbjcGFa8qS8OBM3yoVxKkm5fkez9fQT03pO6bCe/oJ6Fha9HrdYz/wW6zkt87jSLOuptljP73dYT9JiPX/YYT2lgnriuL0h275YT0y1OP53dynOns7i/K94vXVjl9pzU5fi/H2X4vxDl+Lc3GGcbBogT5z/T873BkJv5Y9DX3rGya4CxPnu8omf01/v8k5AMd57M/nziuJlJ+qZeMtn277sAkIm3opMfs+UeJX6fGSGeNXGeCszdxbub3ZBIdO+MzP5vUXxsgsLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCHfnTTuR+/7EMfXR+SMP6vqbEm4n3leWvXDrVR74H1d60sb3jqYGNeb6WNQAAAAEChOA/vqedUQ29ldehN5k0pV03XAappujxQ2w4uCuvGt8lQaSLdlyyZ8XGV9HGrdm3dvmrn7j3v27x15JrRa0a3fWD1uavXDJ+35rxVmzZvGR2u/QyhtyBeCGFi+WHn7j2fGtmyZXTHzlpmtv3L0sctS9NJ+rjB94fh8e0tafuXFtRXmlbf7hcvqN01mdOlGwWHDgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/8+u3YXIedV/AD/PzOzMdNv8u3/6Ng3NdshLiVo0iVtJtXQfECy0SchSkJnqWoJNsLhpQpuUWMc2YFsTFKElECK5MBKLrcWbvtgi9oVApEYDbgzSFu2FXiitVtKSC0kZye6c2ZnJTGYdS9PGz+fieWbO+Z3zmzMXC99nBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgA/cdG1ssjI+UR1OQkh61NS7iHPZfJqWB+j75ee3fr8wenJ561ghN8BGAAAAQF8xhw81R4qhkMuGbLhy5t3i05d8YyLM5X4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB/z3RtbLIyPlG9MAkh6VFT7yLOZfNpWh6g7xvvPPmZV0dH/9o6VhpgHwAAAKC/mMMzzZFiKIUlYSi5sq0uPhtY2LG+sy7us2iedZ3PDnrVLZln3TXzrPtYn7p1jfuOAAAAAB99Mf/nmiMjoZBb0DP/98v1se7qjrps4z7IbwUAAACA/07M/4XmSCkUcqVmXp9v3l/cURfX9/u/fVy/rMf6fv/PX9u4+z89AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHx0TNfGJivjE9VsEkLSo6beRZzL5tO0PEDfVS8M//2WQw8tbh0r5AbYCAAAAOgr5vC56F0MhdxwGAoXzuT+0Zv2P/3Fp58dCyHMxvx8PuzYsG3b3atmr7Fu5ZFDQ987/Na3mtvEupWz13NyOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4H01XRubrIxPVC9IQkh61NS7iHPZfJqWB+j7+ue+8OfHjz/3ZutYaYB9AAAAgP5iDp/L/sVQCvmQD5fPvGvN+qdlOtb3emYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnD/u+cZ9X98wNbXxbi+88MKL5otz/ZcJAAB4v10dklD/D12x/lx/agAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4MNgujY2WRmfqBaTEJIeNfUu4lw2n6blAfqmzx8tLDj5wkutY6UB9gEAAAD6izl8LvsXQykMhaFw2cy7bs8EZvL/yAf4IQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAPlena2GRlfKK6IAkh6VFT7yLOZfNpWh6g72M793324MXfvbl1rJAbYCMAAACgr5jD882RYijkPh4K4arG+6n2BUm2ce/+XGBu3da2ZcPzXldrW5ed97pdHSfLNU4zu64Y9xuZvTfXlc9cV25ZVwrN9uW2dWFP26oFfT5nAAAAgHMo5v9Cc2QkFHKFlpz7k7b6ETkXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOhhujY2WRmfqCZJCEmPmnoXcS6bT9PyAH3v+83/X/SVn+7e3jpWGmAfAAAAoL+Yw+eyfzGUwqLwf2HRTO4PI+31se4flVMHH/3nX5aHsOLyY6O5zm1/GF/86vUbX+y8hJBpr86EcHGjX9Kj369/9+i9S+unHg9hxWXZq87oF87eb069Xk7S+jOVjWu3HT62tf/3AwAAAOeDmP+HmiMjoZC7q2f+j8m7T/5vmgngF9+78+eXNq6NRN6xIlNo/M4g06Pf55c++adlq//21un8f7Z+n9q3+eClbQ1nRzokaX188/Z1x647kImnnj1vtqN//F6+9M03/7VpxyOnZvsXQ7ExvjDXrf+Z1w4XpPWpzN7qmvf21tr753qc/6HfvnT8lwt3v3u6/ztXDzf7X3OW85+9//CtD++5ft+hde39Qwjlbv3ffvfmcMUf7nyw8/zDHRu3fvOt1w5JWj+y+MSB1ftLN7T3Tzr6x+//Z8cf2/PjR77zbOwffyuyfMl8+2c6+r+y65KdLz+wfmF7/0yP879426ujW8rf/n3n+e9o2zXX81Ocef4nrn3q9tc2pPd3TgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJxfpmtjk5XxiWomCSHpUVPvIs5l82laHqDvG7ccffu23T/6QetYaYB9AAAAgP5iDp/L/sVQCvmQD8Mzuf+Zysa12w4f2xpGZmeTxj03teWebZ/YtGX7XXeco08OAAAAzFfM/7nmyEgo5JaGoUb+H9+8fd2x6w5kYv7PxPy/6c6pjStCs+6VXZfsfPmB9QubzwlCmPlZQPF03afn6m668ejIiT9+bVnXulVzdUcWnziwen/phlgXWutWhubziSeufer21zak9zc/X2vdJ7+6ZarxeCLuO3zrw3uu33doXfMcjftwY99YN5XZW13z3t5arMs27sXGuQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAM03XxiYr4xPVkA0h6VFT7yLOZfNpWh6g75qlv3jwopPPLWodK+QG2AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODf7MCBAAAAAACQ/2sjVFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWG/bkLjqvo4AJ8zk7yZZJI2aV8wKqZpVZS6sCiI6EZFRVqRgqtKkWprF6IgiCh1YSqtWKriRrC6KaKCGqWgYGOxtEoqfhU3LlRQqC6EUgxoQ3Ghksk508lNrqOTKqjPA5eTc+69v/u/95y5kwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4B+lp2u40R7Zef/0Lefc8NGjd5185KZ37t1+0cOvfje6+boP9/W9dGpyy8qtX16/fPOBu9dO7Hn+8E8Db/1yrG3wQ7PN6tSthRBPxBBq704989jkx2fNjMUQQjUOjoUwFJcdHoqFhDU/hxC2NOucu/PNk5dvnWm37+6ZM760EFK8r1Cv5npmDc6tl3+XWlpn26YfvCR8fe2GHZ+ueOP17vHjY6cPibWW9RTCkk2t53eHEHrTNiOvtuF8cmrXhxD6Ws67sk1d5//B+i8t6Z+b2v+ltt4mJ+9fVehXCscV+1l3oe1rc73FKquj0+Pa6S/0iy+jxSqrM48Ppfbt1K7+k/nVvMVQiaGrWf498fQaCS3zFkNszGWt2a805zak+y/0Y6FfKfSr3YX7alw3LbRqjHPH83GF8fw67krjK1vf1Qu4tWT87NTW0gf1VO6H4h+z6vP+aN5XQ65r6ndq+TtUWt5BC403Jz5NRj2N1eOyeef8uoC8b3LDExdWN753ZLCkjrgvpvzYUf62T4b6b39t1wPDZfmbKim/0lH+N+uO/nDbrheeK81/OudXy/N7518k77vsYN+Jde/vXFX6fKby8+nqqP47jn3w5Ir/3zm+0Fw38vfm/FpH+ddMHO0ZmD54qLT+Nfn59HaU/9XVN377yuf7j5fmh5zf11H+xon7nuoZmb64NP/Q7Eeh3lihHayfH8ev+GJk5PvRsvzP8vMfWCA/ts1/eWzPVS8u3b22dH2uz89nsKP6b77gwI7+6f3nlb07494z9c0J8N+0PP2P9Xjqd/o7c7Fafi88O9o1+w3Un7aBM3mhgpnrLPkL8wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPiNHTggAQAAABD0/3U7AgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgqAAD//wkGIGs=") [ 84.814846][ T5340] Bluetooth: hci0: command tx timeout [ 85.282777][ T5364] loop0: detected capacity change from 0 to 32768 [ 85.521163][ T5364] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,prjquota,nochanges,nojournal_transaction_names,read_only,version_upgrade=incompatible [ 85.521182][ T5364] allowing incompatible features above 0.0: (unknown version) [ 85.521189][ T5364] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 85.663172][ T5364] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0 [ 85.667736][ T5364] bcachefs (loop0): invalid journal entry, version=1.7: mi_btree_bitmap type=clock in superblock: bad rw, fixing [ 85.672889][ T5364] bcachefs (loop0): invalid bkey in superblock btree=xattrs level=1: u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2285c34bed0abe32 written 16 min_key POS_MIN durability: 0 crc: c_size 1 size 1 offset 0 nonce 0 csum none 12010b:10004000b compress none [ 85.672908][ T5364] has non ptr field, deleting [ 85.709132][ T5364] bcachefs (loop0): recovering from clean shutdown, journal seq 10 [ 85.729042][ T5364] bcachefs (loop0): Version upgrade from 1.3: rebalance_work to 1.7: mi_btree_bitmap incomplete [ 85.729042][ T5364] Doing compatible version upgrade from 1.3: rebalance_work to 1.28: inode_has_case_insensitive [ 85.729042][ T5364] running recovery passes: check_allocations,check_extents_to_backpointers,check_subvols,check_inodes,check_dirents [ 85.768557][ T5364] bcachefs (loop0): Now allowing incompatible features up to 1.28: inode_has_case_insensitive, previously allowed up to 0.0: (unknown version) [ 85.768557][ T5364] [ 85.803209][ T5364] bcachefs (loop0): accounting_read... done [ 85.824958][ T5364] bcachefs (loop0): alloc_read... done [ 85.839091][ T5364] bcachefs (loop0): snapshots_read... done [ 85.850153][ T5364] bcachefs (loop0): check_allocations... [ 85.852595][ T5364] bcachefs (loop0): bucket 0:26 data type btree ptr gen 0 missing in alloc btree [ 85.852619][ T5364] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing [ 85.888389][ T5364] bcachefs (loop0): bucket 0:38 data type btree ptr gen 0 missing in alloc btree [ 85.888405][ T5364] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 8 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing [ 85.924408][ T5364] bcachefs (loop0): bucket 0:41 data type btree ptr gen 0 missing in alloc btree [ 85.924425][ T5364] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0, fixing [ 85.963014][ T5364] bcachefs (loop0): bucket 0:29 data type btree ptr gen 0 missing in alloc btree [ 85.963030][ T5364] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq e81e1ed936acf3df written 32 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0, fixing [ 86.024860][ T5364] bcachefs (loop0): bucket 0:1 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.070320][ T5364] bcachefs (loop0): bucket 0:1 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.082444][ T5364] bcachefs (loop0): bucket 0:2 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.133559][ T5364] bcachefs (loop0): bucket 0:2 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.140905][ T5364] bcachefs (loop0): bucket 0:3 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.162652][ T5364] bcachefs (loop0): bucket 0:3 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.172011][ T5364] bcachefs (loop0): bucket 0:4 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.197603][ T5364] bcachefs (loop0): bucket 0:4 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.202896][ T5364] bcachefs (loop0): bucket 0:5 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.220331][ T5364] bcachefs (loop0): bucket 0:5 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.225567][ T5364] bcachefs (loop0): bucket 0:6 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.246739][ T5364] bcachefs (loop0): bucket 0:6 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.273427][ T5364] bcachefs (loop0): bucket 0:7 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.296932][ T5364] bcachefs (loop0): bucket 0:7 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.313820][ T5364] bcachefs (loop0): bucket 0:8 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.337246][ T5364] bcachefs (loop0): bucket 0:8 gen 0 data type sb has wrong dirty_sectors: got 0, should be 8, fixing [ 86.342946][ T5364] bcachefs (loop0): bucket 0:16 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.347792][ T5364] bcachefs (loop0): bucket 0:16 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.352501][ T5364] bcachefs (loop0): bucket 0:17 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.368732][ T5364] bcachefs (loop0): bucket 0:17 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.388489][ T5364] bcachefs (loop0): bucket 0:18 gen 0 has wrong data_type: got free, should be sb, fixing [ 86.388504][ T5364] Ratelimiting new instances of previous error [ 86.410812][ T5364] bcachefs (loop0): bucket 0:18 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 86.410828][ T5364] Ratelimiting new instances of previous error [ 86.442626][ T5364] done [ 86.462301][ T5364] bcachefs (loop0): going read-write [ 86.525896][ T5364] bcachefs (loop0): journal_replay... done [ 86.604628][ T5364] bcachefs (loop0): check_extents_to_backpointers... [ 86.620588][ T5364] bcachefs (loop0): scanning for missing backpointers in 4/128 buckets [ 86.671853][ T5364] done [ 86.673699][ T5364] bcachefs (loop0): check_subvols... done [ 86.677286][ T5364] bcachefs (loop0): check_inodes... done [ 86.679927][ T5364] bcachefs (loop0): check_dirents... [ 86.681743][ T5364] bcachefs (loop0): key in missing inode, found keys: [ 86.681768][ T5364] u64s 7 type dirent 4096:189491840996961599:U32_MAX len 0 ver 0: file0 -> 4098 type dir [ 86.681777][ T5364] u64s 7 type dirent 4096:1896155912177158345:U32_MAX len 0 ver 0: file3 -> 536870913 type reg [ 86.681785][ T5364] u64s 7 type dirent 4096:2695648408715017799:U32_MAX len 0 ver 0: file2 -> 536870913 type reg [ 86.681793][ T5364] u64s 7 type dirent 4096:4330382808765833931:U32_MAX len 0 ver 0: file1 -> 536870912 type reg [ 86.681801][ T5364] u64s 8 type dirent 4096:8130059955150870709:U32_MAX len 0 ver 0: lost+found -> 4097 type dir [ 86.681809][ T5364] u64s 8 type dirent 4096:9097378837824744618:U32_MAX len 0 ver 0: file.cold -> 536870914 type reg [ 86.681816][ T5364] , fixing [ 86.822677][ T5364] bcachefs (loop0): hash table key at wrong offset: should be at 5108364972035839015 [ 86.822693][ T5364] u64s 7 type dirent 4096:189491840996961599:U32_MAX len 0 ver 0: file0 -> 4098 type dir, fixing [ 86.854322][ T5364] bcachefs (loop0): hash table key at wrong offset: should be at 391335652985464408 [ 86.854347][ T5364] u64s 7 type dirent 4096:1896155912177158345:U32_MAX len 0 ver 0: file3 -> 536870913 type reg, fixing [ 86.881536][ T4707] Bluetooth: hci0: command tx timeout [ 86.912246][ T5364] bcachefs (loop0): hash table key at wrong offset: should be at 6870829770456881937 [ 86.912261][ T5364] u64s 7 type dirent 4096:2695648408715017799:U32_MAX len 0 ver 0: file2 -> 536870913 type reg, fixing [ 86.922596][ T5364] bcachefs (loop0): hash table key at wrong offset: should be at 7454722759146076023 [ 86.922610][ T5364] u64s 7 type dirent 4096:4330382808765833931:U32_MAX len 0 ver 0: file1 -> 536870912 type reg, fixing [ 86.968103][ T5364] bcachefs (loop0): dirent points to missing inode: [ 86.968119][ T5364] u64s 7 type dirent 4096:5108364972035839015:U32_MAX len 0 ver 0: file0 -> 4098 type dir, fixing [ 86.993418][ T5364] bcachefs (loop0): dirent points to missing inode: [ 86.993432][ T5364] u64s 7 type dirent 4096:6870829770456881937:U32_MAX len 0 ver 0: file2 -> 536870913 type reg, fixing [ 87.006145][ T5364] bcachefs (loop0): dirent points to missing inode: [ 87.007459][ T5364] u64s 7 type dirent 4096:7454722759146076023:U32_MAX len 0 ver 0: file1 -> 536870912 type reg, fixing [ 87.022089][ T5364] bcachefs (loop0): hash table key at wrong offset: should be at 3384316734938100614 [ 87.022102][ T5364] u64s 8 type dirent 4096:8130059955150870709:U32_MAX len 0 ver 0: lost+found -> 4097 type dir, fixing [ 87.060135][ T5364] bcachefs (loop0): hash table key at wrong offset: should be at 334321547855866872 [ 87.060150][ T5364] u64s 8 type dirent 4096:9097378837824744618:U32_MAX len 0 ver 0: file.cold -> 536870914 type reg, fixing [ 87.078135][ T5364] bcachefs (loop0): key in missing inode, found keys: [ 87.078151][ T5364] u64s 7 type dirent 4098:5675548428000973578:U32_MAX len 0 ver 0: file1 -> 4100 type lnk [ 87.078159][ T5364] u64s 7 type dirent 4098:8977922886548783724:U32_MAX len 0 ver 0: file0 -> 4099 type reg [ 87.078166][ T5364] , fixing [ 87.100523][ T5364] bcachefs (loop0): key in missing inode, found keys: [ 87.100595][ T5364] u64s 7 type dirent 4098:8977922886548783724:U32_MAX len 0 ver 0: file0 -> 4099 type reg [ 87.100604][ T5364] , fixing [ 87.138322][ T5364] bcachefs (loop0): check_dirents requires second pass [ 87.142995][ T5364] bcachefs (loop0): dirent points to missing inode: [ 87.143011][ T5364] u64s 8 type dirent 4096:334321547855866872:U32_MAX len 0 ver 0: file.cold -> 536870914 type reg, fixing [ 87.163186][ T5364] bcachefs (loop0): dirent points to missing inode: [ 87.163200][ T5364] u64s 7 type dirent 4096:391335652985464408:U32_MAX len 0 ver 0: file3 -> 536870913 type reg, fixing [ 87.204505][ T5364] ================================================================== [ 87.208898][ T5364] BUG: KASAN: use-after-free in bch2_check_dirents+0x1fac/0x33f0 [ 87.213114][ T5364] Read of size 1 at addr ffff888055ac00c0 by task syz.0.0/5364 [ 87.220472][ T5364] [ 87.226029][ T5364] CPU: 0 UID: 0 PID: 5364 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.226049][ T5364] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 87.226057][ T5364] Call Trace: [ 87.226067][ T5364] [ 87.226074][ T5364] dump_stack_lvl+0x189/0x250 [ 87.226093][ T5364] ? __kasan_check_byte+0x12/0x40 [ 87.226112][ T5364] ? __pfx_dump_stack_lvl+0x10/0x10 [ 87.226126][ T5364] ? lock_release+0x4b/0x3e0 [ 87.226144][ T5364] ? __virt_addr_valid+0x4a5/0x5c0 [ 87.226159][ T5364] print_report+0xca/0x240 [ 87.226170][ T5364] ? bch2_check_dirents+0x1fac/0x33f0 [ 87.226181][ T5364] kasan_report+0x118/0x150 [ 87.226201][ T5364] ? bch2_check_dirents+0x1fac/0x33f0 [ 87.226213][ T5364] bch2_check_dirents+0x1fac/0x33f0 [ 87.226232][ T5364] ? bch2_check_dirents+0x2f1/0x33f0 [ 87.226246][ T5364] ? desc_read+0x1b8/0x3f0 [ 87.226262][ T5364] ? prb_first_seq+0xfd/0x1a0 [ 87.226279][ T5364] ? __pfx_bch2_check_dirents+0x10/0x10 [ 87.226290][ T5364] ? __pfx_prb_first_seq+0x10/0x10 [ 87.226305][ T5364] ? desc_read+0x1b8/0x3f0 [ 87.226320][ T5364] ? this_cpu_in_panic+0x4f/0x80 [ 87.226333][ T5364] ? _prb_read_valid+0xa07/0xa90 [ 87.226344][ T5364] ? console_flush_all+0x13a/0xc40 [ 87.226361][ T5364] ? up+0xde/0x150 [ 87.226442][ T5364] ? __console_unlock+0x14c/0x1a0 [ 87.226454][ T5364] ? __pfx___console_unlock+0x10/0x10 [ 87.226471][ T5364] ? prb_read_valid+0x3c/0x60 [ 87.226484][ T5364] ? console_unlock+0x21b/0x270 [ 87.226495][ T5364] ? __pfx_console_unlock+0x10/0x10 [ 87.226508][ T5364] ? vprintk_emit+0x63e/0x7a0 [ 87.226525][ T5364] ? __bch2_print+0x176/0x220 [ 87.226537][ T5364] ? bch2_check_dirents+0x2f1/0x33f0 [ 87.226548][ T5364] ? lockdep_hardirqs_on+0x9c/0x150 [ 87.226563][ T5364] __bch2_run_recovery_passes+0x3bd/0x1060 [ 87.226582][ T5364] bch2_run_recovery_passes+0x184/0x210 [ 87.226595][ T5364] bch2_fs_recovery+0x2690/0x3a50 [ 87.226609][ T5364] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 87.226621][ T5364] ? __lock_acquire+0xab9/0xd20 [ 87.226639][ T5364] ? __mutex_trylock_common+0x153/0x260 [ 87.226650][ T5364] ? __lock_acquire+0xab9/0xd20 [ 87.226667][ T5364] ? __lock_acquire+0xab9/0xd20 [ 87.226688][ T5364] ? bch2_fs_start+0xa0f/0xda0 [ 87.226700][ T5364] ? up_write+0x1c4/0x420 [ 87.226710][ T5364] ? bch2_fs_start+0x5e7/0xda0 [ 87.226721][ T5364] bch2_fs_start+0xaaf/0xda0 [ 87.226733][ T5364] ? bch2_fs_start+0x5e7/0xda0 [ 87.226747][ T5364] ? __pfx_bch2_fs_start+0x10/0x10 [ 87.226763][ T5364] ? sget+0x267/0x620 [ 87.226776][ T5364] bch2_fs_get_tree+0xb39/0x1520 [ 87.226793][ T5364] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 87.226809][ T5364] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 87.226830][ T5364] vfs_get_tree+0x92/0x2b0 [ 87.226844][ T5364] do_new_mount+0x2a2/0x9e0 [ 87.226859][ T5364] ? ns_capable+0x8a/0xf0 [ 87.226869][ T5364] ? __pfx_do_new_mount+0x10/0x10 [ 87.226881][ T5364] ? path_mount+0x61c/0xfe0 [ 87.226893][ T5364] ? user_path_at+0x44/0x60 [ 87.226905][ T5364] __se_sys_mount+0x317/0x410 [ 87.226922][ T5364] ? __pfx___se_sys_mount+0x10/0x10 [ 87.226938][ T5364] ? do_syscall_64+0xbe/0x3b0 [ 87.226954][ T5364] ? __x64_sys_mount+0x20/0xc0 [ 87.226969][ T5364] do_syscall_64+0xfa/0x3b0 [ 87.226985][ T5364] ? lockdep_hardirqs_on+0x9c/0x150 [ 87.227000][ T5364] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.227011][ T5364] ? clear_bhb_loop+0x60/0xb0 [ 87.227024][ T5364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.227036][ T5364] RIP: 0033:0x7f58e2d9038a [ 87.227049][ T5364] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 87.227060][ T5364] RSP: 002b:00007f58e3c1ce68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 87.227073][ T5364] RAX: ffffffffffffffda RBX: 00007f58e3c1cef0 RCX: 00007f58e2d9038a [ 87.227082][ T5364] RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00007f58e3c1ceb0 [ 87.227090][ T5364] RBP: 00002000000000c0 R08: 00007f58e3c1cef0 R09: 0000000000818001 [ 87.227097][ T5364] R10: 0000000000818001 R11: 0000000000000246 R12: 0000200000000080 [ 87.227103][ T5364] R13: 00007f58e3c1ceb0 R14: 0000000000005987 R15: 00002000000001c0 [ 87.227115][ T5364] [ 87.227119][ T5364] [ 87.604018][ T5364] The buggy address belongs to the physical page: [ 87.623487][ T5364] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x55ac0 [ 87.627517][ T5364] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 87.631239][ T5364] page_type: f0(buddy) [ 87.633173][ T5364] raw: 04fff00000000000 ffffea000156c808 ffff88805ffd6f08 0000000000000000 [ 87.637179][ T5364] raw: 0000000000000000 0000000000000005 00000000f0000000 0000000000000000 [ 87.640769][ T5364] page dumped because: kasan: bad access detected [ 87.643809][ T5364] page_owner tracks the page as freed [ 87.661879][ T5364] page last allocated via order 5, migratetype Unmovable, gfp_mask 0x42800(GFP_NOWAIT|__GFP_COMP), pid 5364, tgid 5363 (syz.0.0), ts 87077406462, free_ts 87204422443 [ 87.669025][ T5364] post_alloc_hook+0x240/0x2a0 [ 87.671005][ T5364] get_page_from_freelist+0x21e4/0x22c0 [ 87.673256][ T5364] __alloc_frozen_pages_noprof+0x181/0x370 [ 87.675851][ T5364] alloc_pages_mpol+0x232/0x4a0 [ 87.677924][ T5364] ___kmalloc_large_node+0x5f/0x1b0 [ 87.680039][ T5364] __kmalloc_large_node_noprof+0x18/0x90 [ 87.682460][ T5364] __kvmalloc_node_noprof+0x6d/0x5f0 [ 87.684618][ T5364] btree_node_sort+0x666/0x1760 [ 87.697003][ T5364] bch2_btree_post_write_cleanup+0x11f/0xad0 [ 87.699704][ T5364] bch2_btree_node_prep_for_write+0x337/0x650 [ 87.702458][ T5364] bch2_trans_lock_write+0x669/0xba0 [ 87.704810][ T5364] __bch2_trans_commit+0x2773/0x8870 [ 87.717348][ T5364] bch2_str_hash_repair_key+0x2a2d/0x3fa0 [ 87.719790][ T5364] __bch2_str_hash_check_key+0xa65/0xd40 [ 87.736853][ T5364] bch2_check_dirents+0x2166/0x33f0 [ 87.739153][ T5364] __bch2_run_recovery_passes+0x3bd/0x1060 [ 87.741809][ T5364] page last free pid 5364 tgid 5363 stack trace: [ 87.744621][ T5364] __free_pages_ok+0xa83/0xbe0 [ 87.757091][ T5364] free_large_kmalloc+0x13a/0x1f0 [ 87.759593][ T5364] btree_node_sort+0x117f/0x1760 [ 87.762472][ T5364] bch2_btree_post_write_cleanup+0x11f/0xad0 [ 87.766127][ T5364] bch2_btree_node_prep_for_write+0x337/0x650 [ 87.777037][ T5364] bch2_trans_lock_write+0x669/0xba0 [ 87.779905][ T5364] __bch2_trans_commit+0x2773/0x8870 [ 87.782423][ T5364] bch2_check_dirents+0x1c5c/0x33f0 [ 87.786332][ T5364] __bch2_run_recovery_passes+0x3bd/0x1060 [ 87.788953][ T5364] bch2_run_recovery_passes+0x184/0x210 [ 87.797857][ T5364] bch2_fs_recovery+0x2690/0x3a50 [ 87.799893][ T5364] bch2_fs_start+0xaaf/0xda0 [ 87.806329][ T5364] bch2_fs_get_tree+0xb39/0x1520 [ 87.808563][ T5364] vfs_get_tree+0x92/0x2b0 [ 87.810602][ T5364] do_new_mount+0x2a2/0x9e0 [ 87.817407][ T5364] __se_sys_mount+0x317/0x410 [ 87.826363][ T5364] [ 87.827741][ T5364] Memory state around the buggy address: [ 87.830839][ T5364] ffff888055abff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 87.845854][ T5364] ffff888055ac0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 87.849559][ T5364] >ffff888055ac0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 87.853239][ T5364] ^ [ 87.865114][ T5364] ffff888055ac0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 87.869962][ T5364] ffff888055ac0180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 87.895218][ T5364] ================================================================== [ 87.944583][ T5364] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.963442][ T5364] CPU: 0 UID: 0 PID: 5364 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 87.967192][ T5364] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 87.977979][ T5364] Call Trace: [ 87.979532][ T5364] [ 87.980820][ T5364] dump_stack_lvl+0x99/0x250 [ 87.986026][ T5364] ? __asan_memcpy+0x40/0x70 [ 87.988108][ T5364] ? __pfx_dump_stack_lvl+0x10/0x10 [ 87.990467][ T5364] ? __pfx__printk+0x10/0x10 [ 87.992569][ T5364] vpanic+0x281/0x750 [ 88.013963][ T5364] ? preempt_schedule+0xae/0xc0 [ 88.016188][ T5364] ? __pfx_vpanic+0x10/0x10 [ 88.018262][ T5364] ? preempt_schedule_common+0x83/0xd0 [ 88.020735][ T5364] ? preempt_schedule+0xae/0xc0 [ 88.022938][ T5364] ? __pfx_preempt_schedule+0x10/0x10 [ 88.025351][ T5364] panic+0xb9/0xc0 [ 88.037218][ T5364] ? __pfx_panic+0x10/0x10 [ 88.042002][ T5364] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 88.062029][ T5364] ? bch2_check_dirents+0x1fac/0x33f0 [ 88.068486][ T5364] check_panic_on_warn+0x89/0xb0 [ 88.076644][ T5364] ? bch2_check_dirents+0x1fac/0x33f0 [ 88.094126][ T5364] end_report+0x78/0x160 [ 88.099004][ T5364] kasan_report+0x129/0x150 [ 88.107740][ T5364] ? bch2_check_dirents+0x1fac/0x33f0 [ 88.119011][ T5364] bch2_check_dirents+0x1fac/0x33f0 [ 88.136834][ T5364] ? bch2_check_dirents+0x2f1/0x33f0 [ 88.141909][ T5364] ? desc_read+0x1b8/0x3f0 [ 88.145312][ T5364] ? prb_first_seq+0xfd/0x1a0 [ 88.148045][ T5364] ? __pfx_bch2_check_dirents+0x10/0x10 [ 88.156005][ T5364] ? __pfx_prb_first_seq+0x10/0x10 [ 88.162547][ T5364] ? desc_read+0x1b8/0x3f0 [ 88.169747][ T5364] ? this_cpu_in_panic+0x4f/0x80 [ 88.171711][ T5364] ? _prb_read_valid+0xa07/0xa90 [ 88.173650][ T5364] ? console_flush_all+0x13a/0xc40 [ 88.175616][ T5364] ? up+0xde/0x150 [ 88.185732][ T5364] ? __console_unlock+0x14c/0x1a0 [ 88.188632][ T5364] ? __pfx___console_unlock+0x10/0x10 [ 88.191244][ T5364] ? prb_read_valid+0x3c/0x60 [ 88.201029][ T5364] ? console_unlock+0x21b/0x270 [ 88.204820][ T5364] ? __pfx_console_unlock+0x10/0x10 [ 88.212194][ T5364] ? vprintk_emit+0x63e/0x7a0 [ 88.221137][ T5364] ? __bch2_print+0x176/0x220 [ 88.224144][ T5364] ? bch2_check_dirents+0x2f1/0x33f0 [ 88.230713][ T5364] ? lockdep_hardirqs_on+0x9c/0x150 [ 88.235925][ T5364] __bch2_run_recovery_passes+0x3bd/0x1060 [ 88.255198][ T5364] bch2_run_recovery_passes+0x184/0x210 [ 88.257583][ T5364] bch2_fs_recovery+0x2690/0x3a50 [ 88.262549][ T5364] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 88.265467][ T5364] ? __lock_acquire+0xab9/0xd20 [ 88.279410][ T5364] ? __mutex_trylock_common+0x153/0x260 [ 88.281719][ T5364] ? __lock_acquire+0xab9/0xd20 [ 88.283745][ T5364] ? __lock_acquire+0xab9/0xd20 [ 88.286126][ T5364] ? bch2_fs_start+0xa0f/0xda0 [ 88.289571][ T5364] ? up_write+0x1c4/0x420 [ 88.294514][ T5364] ? bch2_fs_start+0x5e7/0xda0 [ 88.313550][ T5364] bch2_fs_start+0xaaf/0xda0 [ 88.315437][ T5364] ? bch2_fs_start+0x5e7/0xda0 [ 88.318067][ T5364] ? __pfx_bch2_fs_start+0x10/0x10 [ 88.320258][ T5364] ? sget+0x267/0x620 [ 88.321906][ T5364] bch2_fs_get_tree+0xb39/0x1520 [ 88.323976][ T5364] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 88.326249][ T5364] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 88.328771][ T5364] vfs_get_tree+0x92/0x2b0 [ 88.336008][ T5364] do_new_mount+0x2a2/0x9e0 [ 88.337884][ T5364] ? ns_capable+0x8a/0xf0 [ 88.339624][ T5364] ? __pfx_do_new_mount+0x10/0x10 [ 88.346397][ T5364] ? path_mount+0x61c/0xfe0 [ 88.348351][ T5364] ? user_path_at+0x44/0x60 [ 88.350465][ T5364] __se_sys_mount+0x317/0x410 [ 88.370019][ T5364] ? __pfx___se_sys_mount+0x10/0x10 [ 88.372589][ T5364] ? do_syscall_64+0xbe/0x3b0 [ 88.375199][ T5364] ? __x64_sys_mount+0x20/0xc0 [ 88.377686][ T5364] do_syscall_64+0xfa/0x3b0 [ 88.379960][ T5364] ? lockdep_hardirqs_on+0x9c/0x150 [ 88.382344][ T5364] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.385866][ T5364] ? clear_bhb_loop+0x60/0xb0 [ 88.388554][ T5364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.392263][ T5364] RIP: 0033:0x7f58e2d9038a [ 88.394945][ T5364] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 88.407322][ T5364] RSP: 002b:00007f58e3c1ce68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 88.411978][ T5364] RAX: ffffffffffffffda RBX: 00007f58e3c1cef0 RCX: 00007f58e2d9038a [ 88.415591][ T5364] RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 00007f58e3c1ceb0 [ 88.424810][ T5364] RBP: 00002000000000c0 R08: 00007f58e3c1cef0 R09: 0000000000818001 [ 88.429946][ T5364] R10: 0000000000818001 R11: 0000000000000246 R12: 0000200000000080 [ 88.433628][ T5364] R13: 00007f58e3c1ceb0 R14: 0000000000005987 R15: 00002000000001c0 [ 88.438961][ T5364] [ 88.441635][ T5364] Kernel Offset: disabled [ 88.445860][ T5364] Rebooting in 86400 seconds..