program:
syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x8c0, &(0x7f0000000400)=ANY=[@ANYBLOB="61636c2c6865617274626561743d6e6f6e652c6e6f757365725f78617474722c636f686572656e63793d66756c6c2c646174613d77726974656261636b2c6c6f63616c616c6c6f633d30303030303030303030303030303030303030312c61636c2c6e6f61636c2c6c6f63616c616c6c6f633d30303030303030303030303030303030302c00a89f6b8d5800aa954e6c8735dcd52921ce08462fb4ce7c1600883251443ac332f4d17b77d29867e4321610916dbc5963e9fb59a032c92e32ebffc3b739951e866d52bff6bd63136a656222062a8eea0cf97480bc8ac6c0e8a2aa38ffa8fa758cd54b9ef39a7f536d7b85173a83c34d78e210ecf4d040817bbe989e9eb015acb84b99b2ed90f71810cd92eeca69f5275cb7b7027d4babf643bd69b0a68134c022fe5dcd03834f547325ac2d1a5d16f074d898946ff71afa90180b317e645dd58a922e5d907462cd50dc23801c48c0d49ab012961d84d2eb85a3730a3f3177da048c3bc991216b11dca020afefc24ae7583b59534a0ab1fca82bf473216141db8e9864f7861d0500a920e1a8d3352d0662f586e743386e87b6c0c5ed6e4d192ef2990b44cedbb708e7a18b20dcd5573b603c4d659992647ffa8210abf4e9d232b52a8ea1dd1c045afd8e472cd1fbb775e89cca49d136a6"], 0x1, 0x4446, &(0x7f00000088c0)="$eJzs3b9vHFkdAPDvjH3ENslhH1ccEhIrcRIIkGVfBfgkHMeJz76YoMCdEM1mbW8Sw9ob2WtEkcJ0kaiQKBBFBBKdq8gFbfgTaChDHQkKGiSkCKPdnXV2xrt4E3kdkvt8Co/n/ba/M2/fFLMvzTTubu6WNndLle1Sff327geln9dre1vVSM9Jz/7fOr/+GcwwrpNXfe19lt24cu2Hn34Q8eeNvz49Ojo6iqbR6Gm26/d//fP+evexIy3Uabbbu7Wz8pOIePfEuJpGIuLHf4pIIuJylraQHccj4lK08z69/6tbpTMazaMn1Q/Lz1YfHM69v3Lw8LD/355E/K72pW/d2fr7V0fm/vaNM+oeAAAAAAAAAAAAAAAAAIDX3NLNG5/8YGY2HicxepCcfF93KTv2fT/26Kx8JWJy6H8uAAAAAAAAAAAAAAAAAAAA/F96/v5/KXmnx/v/i9lxvk/9o+8Nf4wMz/L3byxenZnN9n9PTuR/O0v6x+WRmOqx73tx//fLhfq9938/2c/L6oyv0+9kJOl07jxNp6cj/pBt/P5eMpHW6ruNb96u721vnNkwXlv5+Ld3789FJ9vQf9D4LxTaH/7+/188cTU1z2+d3SX2RsvHf6RvuT/+Mhko/lcK9c4j/ry8fPxHW2nj3QXm2xNAM/6/Hj09/ouF9ocV/7cjopQ0x1rKzQDNNUwzvd96hbx8/N9qpeWmzuwf2e/+/3ch/lcL7b+q+X+/+EFET/n4f66VNpYr8fz+n0pPv/+vFdp/FfFvjn/f5/9A8vG/0E4czRVp/ScHnf+XCu0PK/6fpNk4305yV8BB0k7v+3115OTjP3Yi//nzXzrQ+u+jQv3zev7r9Nt5/utM/19P2s9/9JaP/3jfcoPe/8uFesOe/+ejFElc7Jya9V9QPv4TrbT82rn9pZzd8b/wP+K/Umh/WPFvrUrG2vHvnv//c6Gd/nvrv4Hk4//5dmLaXWK/9bO1/ktOX/9/XGi/Hf9h3pYn13/N8e+nQ+zyDZKP/8W+5Zrx/8sAn//XC/WGv/6PmDHrv7R8/C/1Lde6/8dOj/9qod6w4/+1YTYOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8BpYyI6TkaTTufM0nZ6OuJKdvxcTyVplo7xWq6//bDdiMUsvxTvJnVp9rVIrb27XN6rlSq1WX4+4muW/G2PJbq3eKG9V7l07bms8uVut7DTWqpVGRCxl6V+OS5221jYbW5V7EfHRcd4X0vrOvbuV7fLG5s53Z2ZmZmL5eAxTSfUXjep2o917Ozdi5bjuZNI1uFb2x8djuZj8tL63s12ptdKvd9Wp1dcrta46q1neb2Iqaezsba9XGtVyrX6n099pkv0XDM4LmG/+SCMWl2/+6Ob12Yli/q2kfVwY3hAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAOP577z24gYbZ+lETHf+SXpVf7Rk+qH5WerDw7n3l85eHj4tF85AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/sgMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYVdOkZpIIjCAPxmLNTOY1gtu53tiiJauCJ4Aj2Gh9GjeAnvkCJF2hQhkMxC2OzCNkn1fc2D+Zl5D+YBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADDP03v38VY3ESmuNpcRf1//i8P8pdSf+/H7F2eYkdN5fu0eHuum/Hs6yu/K0bLNu3S9+v6Mkdr7HezJcJ/2+j7Xk3NN7dvUfH3fm0i5ioi25Lcp56qa9xYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGzZgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCwAAAAAI87eOom8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB+BQAA///8NR6x")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0)
fallocate(r0, 0x0, 0x0, 0xffff)
r1 = open(&(0x7f0000000080)='./file1\x00', 0x64842, 0x22)
socket$nl_xfrm(0x10, 0x3, 0x6) (async)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000f70100000000000000000000000000000000000000080a00000000000000", @ANYRES32=0x0, @ANYRESOCT=r1, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) (async)
sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000f70100000000000000000000000000000000000000080a00000000000000", @ANYRES32=0x0, @ANYRESOCT=r1, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r3, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc)
keyctl$KEYCTL_WATCH_KEY(0x18, 0x0, 0xffffffffffffffff, 0x0)
socket$inet6(0xa, 0x3, 0x1) (async)
r4 = socket$inet6(0xa, 0x3, 0x1)
connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@remote, @in6=@private1, 0x0, 0x0, 0x400, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x7fffffffffffffff, 0xfffffffffffffffc, 0x800000000007, 0x7e}, {0xd5e}, 0x0, 0x0, 0x1}, {{@in=@loopback, 0xfffffffd, 0x6c}, 0x0, @in=@loopback, 0x800000, 0x2, 0x0, 0x8, 0x32}}, 0xe8) (async)
setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@remote, @in6=@private1, 0x0, 0x0, 0x400, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x7fffffffffffffff, 0xfffffffffffffffc, 0x800000000007, 0x7e}, {0xd5e}, 0x0, 0x0, 0x1}, {{@in=@loopback, 0xfffffffd, 0x6c}, 0x0, @in=@loopback, 0x800000, 0x2, 0x0, 0x8, 0x32}}, 0xe8)
sendmmsg(r4, &(0x7f0000000480), 0x21, 0x0)
ftruncate(r1, 0x6)
mkdir(&(0x7f00000006c0)='./file0\x00', 0x20)
mount(&(0x7f0000000e40)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000e80)='./file0\x00', &(0x7f0000000ec0)='omfs\x00', 0x1000000, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r0, 0x0) (async)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r0, 0x0)
[ 84.866281][ T5320] Bluetooth: hci0: command tx timeout
[ 85.258929][ T5344] loop0: detected capacity change from 0 to 32768
[ 85.268460][ T5344] =======================================================
[ 85.268460][ T5344] WARNING: The mand mount option has been deprecated and
[ 85.268460][ T5344] and is ignored by this kernel. Remove the mand
[ 85.268460][ T5344] option from the mount to silence this warning.
[ 85.268460][ T5344] =======================================================
[ 85.355752][ T5344] ocfs2: Mounting device (7,0) on (node local, slot 0) with writeback data mode.
[ 85.396325][ T5345] netlink: 68 bytes leftover after parsing attributes in process `syz.0.0'.
[ 85.411803][ T5344] netlink: 68 bytes leftover after parsing attributes in process `syz.0.0'.
[ 85.434982][ T5344] syz.0.0: attempt to access beyond end of device
[ 85.434982][ T5344] nbd0: rw=0, sector=0, nr_sectors = 1 limit=0
[ 85.452903][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 85.464854][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 85.471509][ T5344] OCFS2: File system is now read-only.
[ 85.473871][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 85.477276][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 85.482712][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 85.488247][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 85.497396][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 85.503348][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 85.507369][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 85.511398][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 85.516918][ T5345] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 85.533063][ T5345] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 85.537716][ T5345] (syz.0.0,5345,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 85.543762][ T5345] (syz.0.0,5345,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 85.547539][ T5345] (syz.0.0,5345,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 85.553865][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 85.563649][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 85.568159][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 85.572702][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 85.576579][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 85.582465][ T5345] ==================================================================
[ 85.586087][ T5345] BUG: KASAN: slab-use-after-free in ocfs2_fault+0xd3/0x3f0
[ 85.590563][ T5345] Read of size 8 at addr ffff888043542418 by task syz.0.0/5345
[ 85.593923][ T5345]
[ 85.595047][ T5345] CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted 6.16.0-rc6-syzkaller-00121-g6832a9317eee #0 PREEMPT(full)
[ 85.595059][ T5345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 85.595068][ T5345] Call Trace:
[ 85.595078][ T5345]
[ 85.595084][ T5345] dump_stack_lvl+0x189/0x250
[ 85.595101][ T5345] ? __kasan_check_byte+0x12/0x40
[ 85.595114][ T5345] ? __pfx_dump_stack_lvl+0x10/0x10
[ 85.595125][ T5345] ? lock_release+0x4b/0x3e0
[ 85.595136][ T5345] ? __virt_addr_valid+0x4a5/0x5c0
[ 85.595150][ T5345] print_report+0xca/0x230
[ 85.595182][ T5345] ? ocfs2_fault+0xd3/0x3f0
[ 85.595197][ T5345] kasan_report+0x118/0x150
[ 85.595209][ T5345] ? ocfs2_fault+0xd3/0x3f0
[ 85.595221][ T5345] ocfs2_fault+0xd3/0x3f0
[ 85.595234][ T5345] ? __pfx_ocfs2_fault+0x10/0x10
[ 85.595246][ T5345] ? __raw_spin_lock_init+0x45/0x100
[ 85.595262][ T5345] __do_fault+0x135/0x390
[ 85.595277][ T5345] __handle_mm_fault+0x37ed/0x5620
[ 85.595294][ T5345] ? __pfx___handle_mm_fault+0x10/0x10
[ 85.595311][ T5345] ? __pfx___might_resched+0x10/0x10
[ 85.595326][ T5345] handle_mm_fault+0x40a/0x8e0
[ 85.595341][ T5345] __get_user_pages+0x1af4/0x30b0
[ 85.595353][ T5345] ? mt_find+0x15c/0x5f0
[ 85.595417][ T5345] ? __pfx___get_user_pages+0x10/0x10
[ 85.595428][ T5345] populate_vma_page_range+0x26b/0x340
[ 85.595439][ T5345] ? __pfx_populate_vma_page_range+0x10/0x10
[ 85.595448][ T5345] ? userfaultfd_unmap_complete+0x278/0x2d0
[ 85.595461][ T5345] ? down_read+0x1ad/0x2e0
[ 85.595475][ T5345] __mm_populate+0x24c/0x380
[ 85.595485][ T5345] ? __pfx___mm_populate+0x10/0x10
[ 85.595496][ T5345] ? up_write+0x1c4/0x420
[ 85.595511][ T5345] vm_mmap_pgoff+0x3f0/0x4c0
[ 85.595523][ T5345] ? __pfx_vm_mmap_pgoff+0x10/0x10
[ 85.595540][ T5345] ? __fget_files+0x2a/0x420
[ 85.595556][ T5345] ? __fget_files+0x3a0/0x420
[ 85.595569][ T5345] ? __fget_files+0x2a/0x420
[ 85.595583][ T5345] ksys_mmap_pgoff+0x51f/0x760
[ 85.595598][ T5345] do_syscall_64+0xfa/0x3b0
[ 85.595610][ T5345] ? lockdep_hardirqs_on+0x9c/0x150
[ 85.595625][ T5345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.595636][ T5345] ? clear_bhb_loop+0x60/0xb0
[ 85.595648][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.595660][ T5345] RIP: 0033:0x7fe5f8d8e9a9
[ 85.595673][ T5345] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 85.595683][ T5345] RSP: 002b:00007fe5f9c22038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[ 85.595697][ T5345] RAX: ffffffffffffffda RBX: 00007fe5f8fb6080 RCX: 00007fe5f8d8e9a9
[ 85.595704][ T5345] RDX: 00000000027ffff7 RSI: 0000000000600000 RDI: 0000200000000000
[ 85.595712][ T5345] RBP: 00007fe5f8e10ca1 R08: 0000000000000004 R09: 0000000000000000
[ 85.595718][ T5345] R10: 0000000004012011 R11: 0000000000000246 R12: 0000000000000000
[ 85.595725][ T5345] R13: 0000000000000000 R14: 00007fe5f8fb6080 R15: 00007fff43e5b688
[ 85.595736][ T5345]
[ 85.595740][ T5345]
[ 85.725844][ T5345] Allocated by task 5345:
[ 85.728133][ T5345] kasan_save_track+0x3e/0x80
[ 85.730213][ T5345] __kasan_slab_alloc+0x6c/0x80
[ 85.732361][ T5345] kmem_cache_alloc_noprof+0x1c1/0x3c0
[ 85.734846][ T5345] vm_area_alloc+0x24/0x140
[ 85.737036][ T5345] mmap_region+0xcc7/0x1f30
[ 85.739270][ T5345] do_mmap+0xc45/0x10d0
[ 85.741126][ T5345] vm_mmap_pgoff+0x31b/0x4c0
[ 85.743324][ T5345] ksys_mmap_pgoff+0x51f/0x760
[ 85.745415][ T5345] do_syscall_64+0xfa/0x3b0
[ 85.747511][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.750097][ T5345]
[ 85.751278][ T5345] Freed by task 5344:
[ 85.753280][ T5345] kasan_save_track+0x3e/0x80
[ 85.755496][ T5345] kasan_save_free_info+0x46/0x50
[ 85.757864][ T5345] __kasan_slab_free+0x62/0x70
[ 85.759983][ T5345] slab_free_after_rcu_debug+0x129/0x2a0
[ 85.762651][ T5345] rcu_core+0xca8/0x1710
[ 85.764427][ T5345] handle_softirqs+0x286/0x870
[ 85.766481][ T5345] __irq_exit_rcu+0xca/0x1f0
[ 85.768503][ T5345] irq_exit_rcu+0x9/0x30
[ 85.770537][ T5345] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 85.773190][ T5345] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 85.775896][ T5345]
[ 85.776992][ T5345] Last potentially related work creation:
[ 85.779431][ T5345] kasan_save_stack+0x3e/0x60
[ 85.781499][ T5345] kasan_record_aux_stack+0xbd/0xd0
[ 85.783784][ T5345] kmem_cache_free+0x2f6/0x400
[ 85.785947][ T5345] vms_complete_munmap_vmas+0x626/0x8a0
[ 85.788835][ T5345] mmap_region+0x161d/0x1f30
[ 85.791148][ T5345] do_mmap+0xc45/0x10d0
[ 85.793251][ T5345] vm_mmap_pgoff+0x31b/0x4c0
[ 85.795328][ T5345] ksys_mmap_pgoff+0x51f/0x760
[ 85.797490][ T5345] do_syscall_64+0xfa/0x3b0
[ 85.799452][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.802030][ T5345]
[ 85.803145][ T5345] The buggy address belongs to the object at ffff8880435423c0
[ 85.803145][ T5345] which belongs to the cache vm_area_struct of size 256
[ 85.809615][ T5345] The buggy address is located 88 bytes inside of
[ 85.809615][ T5345] freed 256-byte region [ffff8880435423c0, ffff8880435424c0)
[ 85.816533][ T5345]
[ 85.817586][ T5345] The buggy address belongs to the physical page:
[ 85.820294][ T5345] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43542
[ 85.824059][ T5345] memcg:ffff88805241ff01
[ 85.825837][ T5345] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 85.828686][ T5345] page_type: f5(slab)
[ 85.830268][ T5345] raw: 04fff00000000000 ffff888030413b40 ffffea0000d69580 dead000000000004
[ 85.833675][ T5345] raw: 0000000000000000 00000000800c000c 00000000f5000000 ffff88805241ff01
[ 85.837714][ T5345] page dumped because: kasan: bad access detected
[ 85.840870][ T5345] page_owner tracks the page as allocated
[ 85.843559][ T5345] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5030, tgid 5030 (dhcpcd), ts 50717363435, free_ts 48539723771
[ 85.851222][ T5345] post_alloc_hook+0x240/0x2a0
[ 85.853246][ T5345] get_page_from_freelist+0x21e4/0x22c0
[ 85.855602][ T5345] __alloc_frozen_pages_noprof+0x181/0x370
[ 85.858206][ T5345] alloc_pages_mpol+0x232/0x4a0
[ 85.860372][ T5345] allocate_slab+0x8a/0x3b0
[ 85.862217][ T5345] ___slab_alloc+0xbfc/0x1480
[ 85.864041][ T5345] kmem_cache_alloc_noprof+0x283/0x3c0
[ 85.866039][ T5345] vm_area_dup+0x2b/0x680
[ 85.867722][ T5345] dup_mmap+0x90c/0x1ac0
[ 85.869392][ T5345] copy_mm+0x13c/0x4b0
[ 85.871302][ T5345] copy_process+0x16d3/0x3b80
[ 85.873428][ T5345] kernel_clone+0x21e/0x870
[ 85.875478][ T5345] __x64_sys_clone+0x18b/0x1e0
[ 85.877355][ T5345] do_syscall_64+0xfa/0x3b0
[ 85.879246][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 85.881781][ T5345] page last free pid 4744 tgid 4744 stack trace:
[ 85.884190][ T5345] __free_frozen_pages+0xc71/0xe70
[ 85.886148][ T5345] __tlb_remove_table+0x2d2/0x3b0
[ 85.888283][ T5345] tlb_remove_table_rcu+0x85/0x100
[ 85.890572][ T5345] rcu_core+0xca8/0x1710
[ 85.892526][ T5345] handle_softirqs+0x286/0x870
[ 85.894749][ T5345] __irq_exit_rcu+0xca/0x1f0
[ 85.896788][ T5345] irq_exit_rcu+0x9/0x30
[ 85.898600][ T5345] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 85.900974][ T5345] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 85.903493][ T5345]
[ 85.904528][ T5345] Memory state around the buggy address:
[ 85.906787][ T5345] ffff888043542300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 85.910341][ T5345] ffff888043542380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 85.913501][ T5345] >ffff888043542400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 85.916765][ T5345] ^
[ 85.919149][ T5345] ffff888043542480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 85.922674][ T5345] ffff888043542500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 85.925818][ T5345] ==================================================================
[ 85.950397][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 85.971608][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 85.975854][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 85.979032][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 85.989361][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 85.994389][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 86.004380][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 86.008366][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 86.011684][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 86.014962][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 86.020924][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 86.029079][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 86.034016][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 86.037399][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 86.041924][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 86.046841][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 86.056662][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 86.062322][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 86.066794][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 86.073766][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 86.078305][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 86.087559][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 86.092046][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 86.095057][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 86.098989][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 86.105973][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 86.116075][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 86.121577][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 86.124846][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 86.128437][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 86.133965][ T5344] OCFS2: ERROR (device loop0): int ocfs2_get_clusters_nocache(struct inode *, struct buffer_head *, u32, unsigned int *, struct ocfs2_extent_rec *, unsigned int *): Inode 17058 has bad extent record (0, 1, 0)
[ 86.144290][ T5344] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[ 86.148242][ T5344] (syz.0.0,5344,0):ocfs2_get_clusters:634 ERROR: status = -30
[ 86.153467][ T5344] (syz.0.0,5344,0):ocfs2_extent_map_get_blocks:681 ERROR: status = -30
[ 86.156922][ T5344] (syz.0.0,5344,0):ocfs2_get_block:153 ERROR: get_blocks() failed, inode: 0xffff888043b5c178, block: 0
[ 86.163485][ T5345] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 86.166479][ T5345] CPU: 0 UID: 0 PID: 5345 Comm: syz.0.0 Not tainted 6.16.0-rc6-syzkaller-00121-g6832a9317eee #0 PREEMPT(full)
[ 86.171377][ T5345] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 86.175853][ T5345] Call Trace:
[ 86.177251][ T5345]
[ 86.178475][ T5345] dump_stack_lvl+0x99/0x250
[ 86.180552][ T5345] ? __asan_memcpy+0x40/0x70
[ 86.182636][ T5345] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.184891][ T5345] ? __pfx__printk+0x10/0x10
[ 86.186794][ T5345] panic+0x2db/0x790
[ 86.188507][ T5345] ? __pfx_panic+0x10/0x10
[ 86.190454][ T5345] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 86.192756][ T5345] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 86.195418][ T5345] ? print_memory_metadata+0x314/0x400
[ 86.197826][ T5345] ? ocfs2_fault+0xd3/0x3f0
[ 86.199877][ T5345] check_panic_on_warn+0x89/0xb0
[ 86.202026][ T5345] ? ocfs2_fault+0xd3/0x3f0
[ 86.203965][ T5345] end_report+0x78/0x160
[ 86.205514][ T5345] kasan_report+0x129/0x150
[ 86.207427][ T5345] ? ocfs2_fault+0xd3/0x3f0
[ 86.209482][ T5345] ocfs2_fault+0xd3/0x3f0
[ 86.211286][ T5345] ? __pfx_ocfs2_fault+0x10/0x10
[ 86.213161][ T5345] ? __raw_spin_lock_init+0x45/0x100
[ 86.215314][ T5345] __do_fault+0x135/0x390
[ 86.217112][ T5345] __handle_mm_fault+0x37ed/0x5620
[ 86.218997][ T5345] ? __pfx___handle_mm_fault+0x10/0x10
[ 86.221112][ T5345] ? __pfx___might_resched+0x10/0x10
[ 86.223416][ T5345] handle_mm_fault+0x40a/0x8e0
[ 86.225487][ T5345] __get_user_pages+0x1af4/0x30b0
[ 86.227502][ T5345] ? mt_find+0x15c/0x5f0
[ 86.229360][ T5345] ? __pfx___get_user_pages+0x10/0x10
[ 86.231746][ T5345] populate_vma_page_range+0x26b/0x340
[ 86.234312][ T5345] ? __pfx_populate_vma_page_range+0x10/0x10
[ 86.237071][ T5345] ? userfaultfd_unmap_complete+0x278/0x2d0
[ 86.239738][ T5345] ? down_read+0x1ad/0x2e0
[ 86.241719][ T5345] __mm_populate+0x24c/0x380
[ 86.243722][ T5345] ? __pfx___mm_populate+0x10/0x10
[ 86.245888][ T5345] ? up_write+0x1c4/0x420
[ 86.247870][ T5345] vm_mmap_pgoff+0x3f0/0x4c0
[ 86.249946][ T5345] ? __pfx_vm_mmap_pgoff+0x10/0x10
[ 86.252081][ T5345] ? __fget_files+0x2a/0x420
[ 86.254136][ T5345] ? __fget_files+0x3a0/0x420
[ 86.256267][ T5345] ? __fget_files+0x2a/0x420
[ 86.258402][ T5345] ksys_mmap_pgoff+0x51f/0x760
[ 86.260599][ T5345] do_syscall_64+0xfa/0x3b0
[ 86.262675][ T5345] ? lockdep_hardirqs_on+0x9c/0x150
[ 86.264931][ T5345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.267473][ T5345] ? clear_bhb_loop+0x60/0xb0
[ 86.269249][ T5345] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.271945][ T5345] RIP: 0033:0x7fe5f8d8e9a9
[ 86.274160][ T5345] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 86.282706][ T5345] RSP: 002b:00007fe5f9c22038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[ 86.286490][ T5345] RAX: ffffffffffffffda RBX: 00007fe5f8fb6080 RCX: 00007fe5f8d8e9a9
[ 86.290069][ T5345] RDX: 00000000027ffff7 RSI: 0000000000600000 RDI: 0000200000000000
[ 86.293553][ T5345] RBP: 00007fe5f8e10ca1 R08: 0000000000000004 R09: 0000000000000000
[ 86.296998][ T5345] R10: 0000000004012011 R11: 0000000000000246 R12: 0000000000000000
[ 86.300470][ T5345] R13: 0000000000000000 R14: 00007fe5f8fb6080 R15: 00007fff43e5b688
[ 86.303813][ T5345]
[ 86.305458][ T5345] Kernel Offset: disabled
[ 86.307467][ T5345] Rebooting in 86400 seconds..