last executing test programs: 10.980236797s ago: executing program 0 (id=1754): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc086, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000f7850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="00bd710000"], 0x0, 0x0, 0x0, 0x0}, 0x0) 7.482662891s ago: executing program 0 (id=1778): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0x1}], 0x1}, 0x0) sendmsg$tipc(r1, &(0x7f0000002700)={0x0, 0x0, 0x0}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000001400000000000000ff000000850000000e000000850000000700000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='kmem_cache_free\x00', r2}, 0x10) recvmsg(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000600)=""/203, 0xcb}], 0x1}, 0x0) 7.106091833s ago: executing program 0 (id=1780): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1801000001ffffeb00000000eb658e0d850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r1, 0x25, &(0x7f0000000000)={0x1}) fcntl$lock(r1, 0x25, &(0x7f0000000340)={0x0, 0x0, 0x80000f}) fcntl$lock(r1, 0x25, &(0x7f0000000180)) 7.047836398s ago: executing program 0 (id=1781): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000580)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b0009058b", @ANYRES32], 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000000)='kfree\x00', r2}, 0x10) syz_usb_disconnect(r0) 5.071127334s ago: executing program 4 (id=1792): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x4, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000001000)={@local, @dev, @void, {@ipv4={0x820, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0xb00, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) 5.031205287s ago: executing program 4 (id=1793): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffffff, 0x1, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000080b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000380)='mm_page_alloc\x00', r1}, 0x10) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) 4.982795511s ago: executing program 4 (id=1794): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000002c0000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x10) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2cf6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000400)={0x2c, &(0x7f00000007c0)={0x0, 0x21, 0x7, {0x7, 0x0, "3d951d1323"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 3.958766987s ago: executing program 0 (id=1795): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f00090581", @ANYRES32], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0xd01c4813, &(0x7f0000000a00)={0x2, 0x100}) 3.423268472s ago: executing program 1 (id=1802): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='ext4_writepages_result\x00', r1}, 0x10) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) 3.351128838s ago: executing program 1 (id=1804): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000940)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad1f50ad32d3fd25dfd73a015e0ca6a0f68a7d007f15451dfb265a0e3ccae669e173a64bc1cfd5587d452d64e7cc957d77578f4c25235138d5521f9453559c35da860e8efbc64e57cbb7aee976f2b54421eed73d5661ca3dbe74bd09de8793dbcceef76b2e5feecf9c66c54c3b3ffe1b4ce25d7c983c044c06cd0a48dfe3e26e7a23129d6606fd28a69989d552af6d9a9df2c3af36e0360050011bbecc2f4a3799af2551ce935b0f327cb3f011a7d06602e2fd5234712596b696418f163d1a13ed38ae82f87925bfacba83109753f541cd027edd68149ee99eebc6f7d6dd4aed4af7588c8e1b44ccb19e810879b70a7000000e7ffffff00000000d7900a820b63278f4e9a217b98ef7042ad2a92895614cd50cbe43a1ed25268816b00000000000009d27d753a30a147b24a48435bd8a568669596e9e0867958e1dd7a0defb6670c06054002238260000000000040587c1ed797aa21a38e1e389f640a0b8b0000000000a835ad0f61ba73c31b05c00fba8a4aee676d7c45bb29671a68ee2e60da7b01a2e5785a238afa4aba70c07fcd95bf8b0d71b6f72d6a8d87fb08533d97ad96d3943c4cc8306dac433a5cdf334178b04963d67dd5a5707e618a1ef9057fec00f9e930219fa8d30e716de8cde9c60f0000000c3b64d10f0939b42b788daa7075fa542242b00f6bf9b64ad460e386b6f388351fbdacb3ad074574ee9d450f9dcfaef1be95ff3c449e6482e4403174618c20e887d6f320616d31d78a0e5421d5742cc52509fd90cf2df6d1404f6b8f810d7b94d421971b77a3270153a0d57cccfe27872f3e8e44480f93c33421986a7737842627301fb2fee8cabab074adaa2024ff57e609ba2f4d83b3bbf52309484532416f48f43b31395c6f45fee8f1682a4e8d5e3b9ae634ed24fb0e8b5fadaf5cb7eea62b7bb4264e72950c9dc791d771acc24c08cdb6ef24c813d082a86d9b879bdf5aefdfd905a2bd4ea36b0b54915a68fe149db154a8340017e1855511e9c0fe62d0cf55"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000080)=0xf3e, 0x62) sendto$packet(r1, &(0x7f00000000c0)="3f033608260812002c001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 3.302010742s ago: executing program 1 (id=1805): syz_mount_image$exfat(&(0x7f0000001500), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000000)=ANY=[], 0x6, 0x14f8, &(0x7f0000001540)="$eJzs3AnYjtXWOPC19t63XpKeJFP22uvmSYZNkmRIkiFJkuRIpoSQJElIvGRKQpJ5SjKHZArJPE+Zk+RIkiQkJNn/S+nS+Trf1/f/zjmfc33v+l3XvuzlftZ+1v2u572n63qfb9oNqFi7UrmazAz/EPz1n1QASAGA3gBwLQBEAFAsc7HMF7en15j6j72J+Od6ZMqVrkBcSdL/tE36n7ZJ/9M26X/aJv1P26T/aZv0P22T/guRlm2ZmuM6GWl3yPP/tEzO/2nSoN8m0v+0Tfr/f1D63wdl9X/1Uul/2ib9T9uk/2mb9D9tk/6nbdJ/IdKy/8Ez4wqP/hs8t/5fHAoArnQN/7JxpT9/QgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCHShrPhMgMAv82vdF1CCCGEEEIIIYT45wlXXekKhBBCCCGEEEII8a+HoECDgQjSwVWQAukhA1wNGeEayATXQgKug8xwPWSBGyArZIPskANywo2QCywQOGCIITfkgSTcBHnhZsgH+aEAFAQPhaAw3AJF4FYoCrdBMbgdisMdUAJKQikoDXdCGbgLysLdUA7ugfJQASpCJbgXKsN9UAXuh6rwAFSDB6E6PAQ14GGoCY9ALfgL1IZHoQ48BnWhHtSHBtDwf5T/InSCl6AzdIFU6Ard4GXoDj2gJ/SC3vAK9IFXoS+8Bv2gPwyA12EgvAGD4E0YDENgKAyD4TACRsIoGA1jYCy8BePgbRgP78AEmAiTYDJMgakwDd6F6TADZsJ7MAveh9kwB+bCPJgPH8ACWAiL4ENYDB/BElgKy2A5rICVsApWwxpYC+tgPWyAjbAJNsMW+Bi2wjbYDjtgJ+yC3fAJ7IFPYS98Bvvg8//P/DP/Ib89AgIqVGjQYDpMhymYghkwA2bEjJgJM2ECE5gZM2MWzIJZMStmx+yYE3NiLsyFhISMjLkxNyYxiXkxL+bDfFgAC6BHj4WxMBbBW7EoFsViWAyLY3EsgSWxJJbG0lgGy2BZLIvlsByWx/JYESvivXgv3odVsApWxapYDathdayONbAG1sSaWAtrYW2sjXWwDtbFulgf62NDbIiNsBE2xsbYFJtiM2yGLbAFtsSW2ApbYXNsjW2wDbbFttgO22F77IAd8EV8EV/Cl7ALllddsRt2w+7YHXtiL+yFr2AffBVfxdewH/bHAfg6vo5v4CA8jYNxCA7FoVhGjcCROApZjcGxOBbH4Tgcj+NxAk7EiTgZp+BUnIbTcDrOwBn4Hs7C9/F9nINzcB7Ox/m4ABfiIlyEi/EMLsGluAyX4wpciStwNa7B1bgO1+M63IgbcTNuxo/xYxyG23AH7sBduAs/wU/wU/wU++E+3If7cT8ewAN4EA/iITyEh/EwHsEjeBSP4jE8hsfxBJ7EE3gKT+FpPINn8Syew3N4Hp/P+VWtXfnX9gN1kVFGpVPpVIpKURlUBpVRZVSZVCaVUAmVWWVWWVQWlVVlVdlVdpVT5VS5VC5FihSrWOVWuVVSJVVelXLpmFJAeeVVYVVYFVFFVFFVVBVTt6vi6g5VQpVUTXxpVVqVUU19WXW3KqfKqfKqgqqoKiFAqqqsqqgqqqqqqqqpaqq6ekjVUF2xJz6iLnamtuqPddQArKvqqfqqgXoDH1eN1CBsrJqopupJNQQHYwvVyLdUT6tWaiS2Vs+qUficaqvGYDv1gmqvOqiO6kXVSTX2nVUXNQG7qm5qMnZXPVRP1UtNxwrqYscqqtdUP9VfDVCvq3n4hhqk3lSD1RA1VA1Tw9UINVKNUqPVGDVWvaXGqbfVePWOmqAmqklqspqipqpp6l01Xc0oO1O9p2ap99VsNUfNVfPUfPWBWqAWqkXqQ7VYfaSWqKVqmVquVqiVapVardaotWqdWq82qI1qk9qstqiP1Va1TW1XO9ROtUvtVp+oPepTtVd9pvapz9V+9Vd1QH2hDqov1SH1lTqsvlZH1DfqqPpWHVPfqePqhDqpvlen1A/qtDqjzqof1Tn1kzqvflYXVFCgUSuttdGRTqev0ik6vc6gr9YZ9TU6k75WJ/R1OrO+XmfRN+isOpvOrnPonPpGDerXTrOOdW6dRyf1TTqvvlnn0/l1AV1Qe11IF9a36CL6Vl1U36aL6dt1cX2HLqFL6lK6tL5Tl9F36bL6bl1O36PL6wq6oq6k79WV9X26ir5fV9UP6Gr6QV1dP6Rr6Id1Tf2IrqUbJAEe1XX0Y7qurqfr6wa6oX5cN9JP6Ma6iW6qn9TNdHPdQj+lW+qndSv9jG6tn9Vt9HO6rX5et9Mv6Pa6g+6of9YXdNCddRedqrvqbvpl3V330D11L91bv6L76Fd1X/2a7qf76wH6dT1Qv6EH6Tf1YD1ED9XD9HA9Qo/Uo/RoPUaP1W/pcfptPV6/oyfoiXqSnqyn6Km656WVZv438t/+O/l9f3n3zXqL/lhv1dv0dr1D79S79G69W+/Re/RevVfv0/v0fr1fH9AH9EF9UB/Sh/RhfVgf0Uf0UX1UH9PH9HF9Qv+ov9en9A/6tD6jz+gf9Tl9Tp+/9DMAg0YZbYyJTDpzlUkx6U0Gc7XJaK4xmcy1JmGuM5nN9SaLucFkNdlMdpPD5DQ3mlzGGjLOsIlNbpPHJM1NJq+52eQz+U0BU9B4U8gUNrf8w/l/Vl9D09A0Mo1MY9PYNDVNTTPTzLQwLUxL09K0Mq1Ma9PatDFtTFvT1rQz7Ux70950NB1NJ9PJdDadTapJNd3My6a76WF6ml6mt3nF9DF9TF/T1/Qz/cwAM8AMNAPNIDPIDDaDzVAz1Aw3w81IM9KMNqPNWDPWjDPjzHgz3kwwE8wkM8lMMVPMNDPNTDfTzUwz08wys8xsM9vMNXPNfDPfLDALzCKzyCw2i80Ss9QsNcvNcrPSrDSrzWqz1qw16816s9FsNEvMFrPFbDVbzXaz3ew0O81us9vsMXvMXrPX7DP7zH6z3xwwB8xBc9Acunj4NYfNEXPEHDVHzTFzzBw3x81Jc9KcMqfMaXPanDVnzTlzzpw3580Fc+HiZV+kIhWZyETponRRSpQSZYgyRBmjjFGmKFOUiBJR5ihzlCW6IcoaZYuyRzminNGNUa7IRhS5iKM4yh3liZLRTVHe6OYoX5Q/KhAVjHxUKCoc3RIViW6Nika3RcWi26Pi0R1RiahkVCoqHd0ZlYnuispGd0flonui8lGFqGJUKbo3qhzdF1WJ7o+qRg9E1aIHo+rRQ1GN6OGoZvRIVCsyl84vj0V1o3pR/ahB1PCfun4Ip7M94TvbLjbVdrXd7Mu2u+1he9petrd9xfaxr9q+9jXbz/a3A+zrdqB9ww6yb9rBdogdaofZ4XaEHWlH2dF2jB1r37Lj7Nt2vH3HTrAT7SQ72U6xU+00+66dbmfYmfY9O8u+b2fbOXaunWfTAcACu9Aush/axfYju8QutcvscrvCrrSr7Gq7xq616+x6u8FutJvsZrvFfmy32m12u91hd9pddrf9xO6xn9q99jO7z35u99u/2gP2C3vQfmkP2a/sYfu1PWK/sUftt/aY/c4etyfsSfu9PWV/sKftGXvW/mjP2Z/sefuzvWDDxYv7i6d3MmQoHaWjFEqhDJSBMlJGykSZKEEJykyZKQtloayUlbJTdspJOSkX5aKLmJhyU25KUpLyUl7KR/moABUgT54KU2EqQkWoKBWlYlSMilNxKkElqBSVojvpTrqL7qK76W66h+6hClSBKlElqkyVqQpVoapUlapRNapO1akG1aCaVJNqUS2qTbWpDtWhulSX6lN9akgNqRE1osbUmJpSU2pGzagFtaCW1JJaUStqTa2pDbWhttSW2lE7ak/tqSN1pE7UiTpTZ0qlVOpG3ag7daee1JN6U2/qQ32oL/WlftSPBtAAGkgDaRANosE0hIbSMBpOI2gkjaLRNIbG0lgaR+NoPI2nCTSBJtEkmkJTaBpNo+k0nWbSTJpFs2g2zaa5NJfm03xaQAtoES2ixbSYltASWkbLaAWtoFW0itbQGlpH62gDbaBNtIm20BbaSltpO22nnbSTdtNu2kN7aC/tpX20j/bTfjpAB+ggHaRDdIgO02E6QkfoKB2lY3SMjtNxOkkn6RSdotN0ms7SWTpHP9F5+pkuUKAUl95lcFe7jO4al8ld6/5jnN3lcDndjS6Xsy6ry/Y3MTnn8rn8roAr6Lwr5Aq7W/4Ql3AlXSlX2t3pyri7XNk/xJXdfa6Ku99VdQ+4Su7ev4mruQdd9bKPuhruMVfT1XO1XANX2z3q6rjHXF1Xz9V3DVwz19y1cE+5lu5p18o984d4gVuI4Na6dW692+M+dWfdj+6I+8adcz+5zq6L6+1ecX3cq66ve831c/3/EA91w9xwN8KNdKPcaDfmD/EkN9lNcVPdNPeum+5m/CGe7z5ws9wiN9vNcXPdvF/iBW6hW+Q+dIvdR26JW+qWueVuhVvpVrnVbs2lWpe7jW6T2+x2u0/cVrfNbXc73E6365f44n7sdZ+5fe5zd9h97Q64L9xBd9Qdcl/9El/cv6PuW3fMfeeOuxPupPvenXI/uNPuzC/7f3Hfv3c/uwsuOGBkxZoNR5yOr+IUTs8Z+GrOyNdwJr6WE3wdZ+brOQvfwFk5G2fnHJyTb+RcbJnYMXPMuTkPJ/kmzss3cz7OzwW4IHsuxIX5Fi7Ct3JRvo2L8e1cnO/gElySS3FpvpPL8F1clu/mcnwPl+cKXJEr8b1cme/jKnw/V+UHuBo/yNX5Ia7BD3NNfoRr8V+4Nj/Kdfgxrsv1uD434Ib8ODfiJ7gxN+Gm/CQ34+bcgp/ilvw0t+JnuDU/y5D669mkHb/A7bkDd+QXuRO/xJ25C6dyKnfjl7k79+Ce3It78yvch1/lvvwa9+P+PIBf54H8Bg/iN3kwD+GhPIyH8wgeyaN4NI/hsfwWj+O3eTy/wxN4Ik/iyTyFp/I0fpen8wyeye/xLH6fZ/McnsvzeD5/wAt4IS/iD3kxf8RLeCkv4+W8glfyKl7Na3gtr+P1vIE38ibezFv4Y97K23g77+CdvIt38ye8hz/lvfwZ7+PPeT//lQ/wF3yQv+RD/BUf5q/5CH/DR/lbPsbf8XE+wSf5ez7FP/BpPsNn+Uc+xz/xef6ZL3BgiDFWsY5NHMXp4qvilDh9nGH/sjhjfE2cKb42TsTXxZnj6+Ms8Q1x1jhbnD3OEeeMb4xzxTam2MUcx3HuOE+cjG+K88Y3x/ni/HGBuGDs40Jx4fiWuEh8a1w0vi0uFt8eF4/viEvEJeNHHygd3xmXie+Ky8Z3x+Xie+LycYW4YlwpvjeuHN8XV4nvj6vGD8RF4wfj6vFDcY344bhm/EhcK/5LXDt+NK4TPxbXjevF9eMGccP48bhR/ETcOG4SN42fjJvFzeMW8VNxy/jpuFX8zJ9uT427xt3il+OX4xDu13OT85Lzkx8kFyQXJtNfugZZklyaXJZcnlyRXJlclVydXJNcm1yXXJ/ckNyY3JTcnAyh0lXg0SuvvfGRT+ev8ik+vc/gr/YZ/TU+k7/WJ/x1PrO/3mfxN/isPpvP7nP4nP5Gn8tbT9559rHP7fP4pL/J5/U3+3w+vy/gC3rvC/nCvoFv6Bv6Rv4J39g38U39k/5J39w390/5p/zTvpV/xrf2z/o2/jnf1j/vn/cv+Pa+g+/oX/Sd/Eu+s+/iU32q7+a7+e6+u+/pe/revrfv4/v4vr6v7+f7+QF+gB/oB/pBfpAf7Af7oX6oH+6H+5F+pB/tR/uxfqwf58f58X68n+An+El+kp/ip/hpfpqf7qf7mX6mn5Vvlp/tZ/u5fq6f7+f7BX6BX+QX+cV+sV/il/hlfplf4Vf4VX6VX+PX+HV+nd/gN/hNfpPf4rf4rX6r3+63+51+p9/td/s9fo/f6/f6fX6f3+/3+wP+gD/ov/SH/Ff+sP/aH/Hf+KP+W3/Mf+eP+xP+pP/en/I/+NP+jD/rf/Tn/E/+vP/ZX/DBj028lRiXeDsxPvFOYkJiYmJSYnJiSmJqYlri3cT0xIzEzMR7iVmJ9xOzE3MScxPzEvMTHyQWJBYmFiU+TCxOfJRYkliaWJZYnliRWJkI4catccgd8oRkuCnkDTeHfCF/KBAKBh8KhcLhllAk3BqKhttCsXB7KB7uCCVCyVAqPBbqhnqhfmgQGobHQ6PwRGgcmoSm4cnQLDQPLcJToWV4OrQKz4TW4dnQJjwX2obnQ7vwQmgfOoSO4cXQKbwUOocuITV0Dd3Cy6F76BF6hl6hd3gl9Amvhr7htdAv9A8DwuthYHgjDApvhsFhSBgahoXhYUQYGUaF0WFMGBveCuPC22F8eCdMCBPDpDA5TAlTw7TwbpgeZoSZ4b0wK7wfZoc5YW6YF+aHD8KCsDAsCh+GxeGjsCQsDcvC8rAirAyrwuqwJuCl35WNYVPYHLaEj8PWsC1sDzvCzrAr7A6fhD3h07A3fBb2hc/D/vDXcCB8EQ6GL8Oh8FU4HL4OR8I34Wj4NhwL34Xj4UQ4Gb4Pp8IP4XQ4E86GH8O58FM4H34OF+Rv1oQQQggh/lvG/cn2rn/n/9SlcVE3ALhmW45Dv9+uAWBD1l/nPVTOZgkAeLpLu0d+G+XLp6ZeuvWGJRqiPHMAIAHpfsv/5fsHEr/Ol0JTaA4toQkU+bv19VAdzvGfrJ+8HSDD73JS4HIcuvy2/q3/yfojZv3p+nMA8uW5nHPxDvG3+HL9Rf+T9bM1+pP1038xFqDx73IywuX48vqF4Ql4Blr+zSuFEEIIIYQQQohf9VCl2vzZ/e3F+/Oc5nLOVXA5Xgr4X96fCyGEEEIIIYQQ4sp7rkPHpx5v2bJJmzQ56frvUca//0Rf+rj8blOB4gBXvjCZ/KsmV/jAJIQQQgghhPinu3zRf6UrEUIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQggh0q7/ja8Tu9L7KIQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQlxp/y8AAP//cNMkHA==") mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) mknod(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) r0 = fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) rename(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 3.117512638s ago: executing program 1 (id=1806): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000080000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0xffff}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x2}, @IFLA_XFRM_LINK={0x8, 0x1, 0x3}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) 3.023866106s ago: executing program 4 (id=1807): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x41100, 0x62, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f00090581", @ANYRES32], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647190890"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r1, 0x501c4814, &(0x7f00000000c0)={0x2}) 2.980191509s ago: executing program 1 (id=1808): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="1201000000000040ec13060000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r2}, 0x10) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00228000000000000000fc"], 0x0}, 0x0) 1.195172799s ago: executing program 3 (id=1811): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) pread64(r2, &(0x7f0000000300)=""/150, 0x96, 0x0) 1.161170822s ago: executing program 2 (id=1812): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r0}, 0x10) io_setup(0x23, &(0x7f0000000340)=0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x0, 0x0) io_submit(r1, 0x1, &(0x7f0000000700)=[&(0x7f00000002c0)={0x0, 0x0, 0x0, 0x5, 0x0, r2, 0x0}]) ioctl$BINDER_WRITE_READ(r2, 0x40046208, 0x0) 926.658892ms ago: executing program 0 (id=1813): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) syz_mount_image$f2fs(&(0x7f0000010600), &(0x7f0000010640)='./file0\x00', 0x0, &(0x7f0000010680)=ANY=[@ANYBLOB='\x00'], 0x1, 0x105df, &(0x7f00000106c0)="$eJzs3L9vG+UfB/CPm29/fkuJUH8wgDgJISUStuIkrWBBAVoBUlNFFAYmcOyL5db2RbGTmC4sMCAxsfBPMMHfwAI7KyxsLCCxVYB8d0ENdADixqV5vaTL+7nHz338PJaXxxddAEfWbPLLz5U4F6cjYiYizkbk7Up55FaKeDIinomIY/cclbL/j44TEXEmIs6Nixc1K+VLT/169/svvrn+9MffffrtB5/9dHN6qwam7bmI6G0W7d1ekVm7yFtlf2Onk2dveafM4oXe7fI8K3I3Xc8r7Db2xjXyXGoX47PN7cE4N7qN5jjbnY28f7NfvOFgp71XJ7/gVmMrP2+l63l2Blme7TvFvEZl3hkMizqtst77efkYDvey6E9HabGezdt5NvvDsr+om7XS0Th3yizfLppZt5XPY/1ff8wPveud/vYo2Um3Bp2sn1yu1V+o1a9U61tZKx2my9VGr3VlOZlrd8fDqsO00VtpZ1m7m9aaWW8+mWs3m9V6PZm7mq53Gv2kXq8t1Raql+fL1vPJazfeTrqtZG6cr3T628NOd5BsZFtJccV8slhbenE+ebae3FxdS9bevHZtde2td6++c+Pl1TdeLQf9ZVrJ3OLC4mK1vlBdrM9b/0GMKge7niPO9wfgH7P/B6bB/t/+P+x/j/z67f85EN8fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAj64fjX76eN2aL8/+X/Y+VXU9ExKWIuBgRFyLit/uYiRP7ap6PiErZvt/443+aw1eVyCuMrzlZHmciYqU87j7+oD8FAAAAeHR9/vWHH0XMjJv5n5emPSEOU/mjzalJ1ct/8vnfpKqdz4uNJlTtwl7JibgYEcdnf5xQtUsRcezsexOq9rfM7ItT90SliGOHORsAAOBw7N8JTGz3BgAAwEPnk2lPgOnI79eW/4tf3gs+WUR5Q/D0vjMAAADgP6gy7QkAAAAAD1y+//f8PwAAAHi0Fc//AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA39m5m9vEgSgO4A9YL+yXFq34aIXTao8cKGJLyDEFJN3kRg2REHWQW0qIIMKeSHHEIZLHOEG/n2RmbMFfz9yexxoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgTQ/Fenm3vbltmrM/NJPnbgAAAIBTdsV6WU7G1fmPdP1XuvQnIuYRMYuIaUSc6t0H8bWWOYmIXpqf+n7xpob7iDLh+JthOr5HxL90PP1u+18AAACAy7XdLFYRg+O0/PjbdUGcU3poM8qVVz7y+ZIrbVKGXWdKm75EZjGLiGL8mCltHhH9n/8zpb3LoDaMXg29auifsxoAAOA86p1Atu4NAACAD+eq6wLoRrlem97FT2vBw2pIC4LfamcAAADAJ9TrugAAAACgdWX/b/8/AAAAuGzV/n8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0aVesl9vNYtU0Z39oJs/dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDM/ryjQAiEQRjsXd93Grz/saRBU1OTKhA+/sZgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBif+5OIASCIAz2nf85LeYfljRoDCJUwcLHDPOwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF/0u1/+T0yNM8ncaWPpeCRZu2psXTX2HjSOHoy3fwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXO3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdiBAwEAAAAAIP/XRqiqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrCDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwAwcCAAAAAED+r41QVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhR04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqirswIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCAAAAAAAOT/2ghVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV2J9724SBMI7Dry+JErfJCOmtBGagoUIwAh8SkiXPwAAsRENFa7EIrAASnGs6U/A8zf9XXHEvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8JouD1+8RUQRqcsUabz5Ob1HxEekbduOPm9Z7M7H5uues/1hkvM7pr9lRJRR9HEOAEDvqm5zrNb18i/vf95B3mHeat7Ui2d+GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4MrO/bxE8cZxAH92dff7tVuXDlFQFiRErT8QV/FSFFjQP+Bt0U2ktUQ9pARhF+kSdOnepUvdPHXqP+jUJaKg7hsURBCEsbsz9pga62VnpdcLnpmPwzDzPHMQ3vMZBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOpL4ezqd1LoRwvPd33fD2y72Zvfb1+8dG0/Ho5PPF+JqNSxRCCDfna9XBDq6lm50Nw839h88PB+Jn+Od5y6trtyq1WnVJoVAotosMfmkBAHBoFZLRyPUfC5tTjWO5yRC2nu7M/+eiOrSZ/7eeDLyO7xXn/6GOrbC7pfl/+vrGxN/yf2llYbG0vLp2YX6hMledq94eGhsfGxwpjw6PlZrvU0reqgAAALC/YjLi/J+f3N3/PxLVoc38/+rlten4Xj3y/y5p/r/c3/+svf5/BpMEAAD4Rxw99e1rbo/juWIx3K2srCwNtbbbPw+3thlM9cD+S0ac/3sms54VAAAA0An19dyO/v9sVIc2+//vv185EV+zJ4TQl/T/L87cqc12bjldK+3/T1yq3Mj67/8zWD4AAAAd0peMuP9faH7/nz+dnpMPIQycadXJvwFsK///fDD+Jr5X/P3/SOeW2JXy5dbzSPP/xrsX8/vl/+a55RB6yxlNFgAAgEPv/2Q08v+nwubU0o/HV4u+/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4xY4dozQTRHEAn2ST72sUA4JYWmhjISoIVgELQeIhLERB8AgB8QAKnsXCO4ikTkoPkMIbyEx2JGyjguxq+P1g8n+ETfbtTJMXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgE9Nj8JGrov40pvV7fK98dvwPOakkumzN2sHccW6VW/bf856mc+T06fx3B62DpvrCQAAgMVT5Pk+hPDafTyJ2e6n+X8rXxNn/uHyrM7zfHXuz5ln/7iWHoqzjxv1ZvfphhAur64vdmt7wt9tM+ynHLxs38/vYfW6lS98VyedT/qHpkjH1h7crk67addbd6PR8b9U/v/5pwAAvmsnZ1nk30cx95psDICF1SlXmJv/i36zPQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADU4T0AAP//XHWQwg==") r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.numa_stat\x00', 0x275a, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r2, 0x8004587d, &(0x7f0000000c40)={0x0, 0xffffffffffffffff, 0x6, 0x6}) 907.822044ms ago: executing program 1 (id=1814): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000002c0)={0x1, &(0x7f00000000c0)=[{0x4, 0x0, 0x40, 0x1aec}]}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000080)='./file0\x00', 0x101c08a, &(0x7f0000000a00)=ANY=[@ANYBLOB="73686f72746e616d653d6d697865642c696f636861727365743d69736f383835392d312c666d61736b3d30303030303030303030303030303030303030303036362c6e6f6e756d7461696c3d302c756e695f786c6174653d302c666d61736b3d30303030303030303030303030303030303030303030332c73686f72746e616d653d6c6f7765722c756e695f786c6174653d302c757466383d312c636865636b3d7374726963742c757466383d302c756e695f786c6174653d312c756e695f786c6174653d302c666c7573682c757466383d302c726f6469722c747a3d5554432c00e696e27e745267d0e7f7d60cf64c4d116172285e0a94b37c3f04b4e454913b1615b6c103a4be033c3f79c81a7a0dc9f3282eb2b984b8df829f11f7b15ceaa2ddb341548691e92d41d923144fa5f6aa8b37c7698e74a04d87cb16f3c338160646d1719f9aa1097cb78032fa4c9c60c14840662537510c0ac9f95a646f5231c0c9eb096b898803099b3050797137354ed2fb2a3dd97ad790f0758b4561eb7180b4b366c9ac840ca3d57727827ab961af0bb24ac6b14796d3bedfa4addb1c2f59217a563ca0a3729d45669905a6f0f3dbf3fd22ab36dfe7cf80913ecb4656ca"], 0x6, 0x2c8, &(0x7f0000002500)="$eJzs3b+LHHUUAPA3d7O74w/YLaxEcEALq5BLa7NBEhCvMmyhFnqYBOR2ERI48AeOqcTOxtK/QBD8H2xt7CwF/wA7IwRGZnbmdtZM9u7k9sTc59PkZb7vzffN7HA3V9y7D15aHN7O4+6Dz3+LLEtiZxrTeJjEJHai9WWsmX4TAMD/2cOyjD/KpZ7lX79+Ql0SEdmWewMAtuOE7/+NdBX+eCFtAQBbdOudd9+6vr9/4+08z+Lm4qujWfWTffXvcv363fgo5nEnrsY4HkXULwqDqN8WqvBmWZZFmlcm8eqiOJpVlYv3f27O/9PzTbAX45jU0fHbRl3/5v6NvXypU19UfTzb7D+t9r8W43jhuHit/lpPfcyG8dornf6vxDh++TA+jnncrptY1X+xl+dvlN/++dl7VXtVfVIczUZ13kq5225eXODnAwAAAAAAAAAAAAAAAAAAAADA0+lKMztnFPX8nupQM39n91H1n0Hkrcn6fJ5lfdKeqDsfqCzLoozv2vk6V/M8L5vEVX0aL6bdwYIAAAAAAAAAAAAAAAAAAABwed3/5NPDg/n8zr1zCdppAGlE/HUr4t+eZ9o58nJsTh41ex7M5ztNuJ6Tdo/EbpuTRGxso7qIc7otJwXPPNZzE3z/Q29VuvbBpdFZyk7edNC/13kG7dN1eJD038PRcc/Z8iGpB0GscoZxyr2GT1oq4yyP37B3aXzmax8+VwfFhpxINjX2+u/LO9ccSf55FcP6rvaWD5qgU76ek53qeY5sWf7414rEtA4AAAAAAAAAAAAAAAAAANiq1W//9iw+2Fi6U4621hYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXKjV3/8/Q1A0xadIHsa9+//xJQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAJ/B0AAP//eWdglQ==") r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) r3 = open(&(0x7f0000000040)='./bus\x00', 0x1451c2, 0x0) ftruncate(r3, 0x2007ffb) sendfile(r3, r3, 0x0, 0x800000009) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) futex(&(0x7f000000cffc)=0x100000000000004, 0x0, 0x4, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x1, 0x0, 0x0, 0x0, 0x0) mlockall(0x1) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000000040d80402c000000000000109022400010000000009040000ff030000000921000000012207000905810300000000"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) r5 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_LIST_RULES(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x10}, 0x10}}, 0x4048810) open(&(0x7f0000000000)='./file0\x00', 0x80, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, 0x0, &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) syz_usb_control_io$hid(r4, &(0x7f0000000680)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x7, {[@local=@item_4={0x3, 0x2, 0x0, "7325ba8c"}, @main=@item_012={0x0, 0x0, 0xa}, @global]}}, 0x0}, 0x0) r7 = userfaultfd(0x1) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x1, 0x91) 844.501839ms ago: executing program 4 (id=1815): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=@framed={{}, [@printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x71}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r0}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) listen(r1, 0x5) syz_emit_ethernet(0x36, &(0x7f0000000380)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x39}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 762.457096ms ago: executing program 4 (id=1816): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0xf, {[@global=@item_4={0x3, 0x1, 0x6, "9b4d3948"}, @main=@item_012={0x2, 0x0, 0x0, "9f74"}, @local=@item_4={0x3, 0x2, 0x0, "6d011fe4"}, @global=@item_012={0x1, 0x1, 0x3, "03"}]}}, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000d40), 0x0, 0x0) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x1c, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f0000001a80)={0x3, 0x100}) 635.397127ms ago: executing program 2 (id=1817): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='mm_page_alloc\x00', r1}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='environ\x00') preadv(r2, &(0x7f0000000380)=[{0x0}, {&(0x7f0000000040)=""/99, 0x63}], 0x2, 0x0, 0x0) 575.552312ms ago: executing program 2 (id=1818): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x2d) r2 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000000)={'ip6gre0\x00', &(0x7f00000009c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @loopback, @private1={0xfc, 0x1, '\x00', 0x1}}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000640)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}) 486.479669ms ago: executing program 2 (id=1819): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r1}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='environ\x00') preadv(r2, &(0x7f0000000380)=[{0x0}, {&(0x7f0000000040)=""/99, 0x63}], 0x2, 0x0, 0x0) 396.421856ms ago: executing program 2 (id=1820): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000208500000004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='workqueue_queue_work\x00', r0}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18000700000000000000000000000000611259f80fe0bd06958ee18a079cd369f2e1200000000000000000000000000027f068cebae487bc2a62c9d49d19d211b31b09e0b919acd1c398ae16b4d5eb40cd6efb1643f9c277678f1771748b141e5f97856c2e000000490b3a3b898abcd7d3d1c2414603e6fa40eaa63535de1f3a7e5c88d08f16b1e0a19aa47223c931e9795457a48bd8477140c6073c8523a7e982cd1df5e4b40ad33f6d85148fc8bd8fa9059f5569786eec27693a84227ee2ad4142e6a07ffd7dd977d9813ab6025b6bb340f35d9c22f00acb2d55ffec329d69271e31206a0800000073ac4b7feffc0795a828473a47b57573201ad1e6cc689aa952b3d949264d5ff7a9c9971ea922d956ffb3a24848a392aac35ee4a08fee8347eb23c2808a6b7a1cbab944458235f5066fff190b1098fdef249c73a3f490aeab559bd1ec5e087ea3d35e8b41ddb0334812fa2d1e5496e4b2e8289576a671749373545fd778d00cc4352aca042a64aa6b638ed63c4ce83aaf5df61fa188f144cf574508d0ff48e5c0e5276a3a86ccae1a241ab8889e3ff3ad422a3f6d28898854bc91b3b7f18b7fbdbc4d59376e03bc59464f799bf78e1d38614b5f5f0b399c145fe1e2a739f1d66095f0f43011225addfd26600da1d65a3d76b8881fc8c2aad7b94054c996d9de2debc38db516d5b4"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) 323.500113ms ago: executing program 2 (id=1821): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="05010000000000107d1e222e00000000000109022400010000000009040000020300020009210000000122020009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000080)={0x0, 0x0, 0x4, {0x4, 0x0, "78e4"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000440)=@framed={{}, [@printk={@lu}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, &(0x7f0000000600)=ANY=[@ANYBLOB="1e62b5"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 285.630206ms ago: executing program 3 (id=1822): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) chroot(&(0x7f0000000300)='./file1\x00') 186.738534ms ago: executing program 3 (id=1823): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r0, 0x0, 0x0}, 0x20) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0d00000004000000040000000900000000000000", @ANYRES32=r1], 0x48) bpf$MAP_DELETE_ELEM(0x2, &(0x7f00000003c0)={r2, &(0x7f0000000300), 0x20000000}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) 165.314216ms ago: executing program 3 (id=1824): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000000002000000000000000000018190000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1, 0x7, 0xfff, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x3f, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000000000020000000000000000018190000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000c00)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) utimes(&(0x7f0000000280)='./file0\x00', 0x0) 66.605354ms ago: executing program 3 (id=1825): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x40046207, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f00000003c0)=[@increfs], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x10, 0x0, &(0x7f00000002c0)=[@request_death={0x400c6313}], 0x0, 0x0, 0x0}) 0s ago: executing program 3 (id=1826): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) r1 = dup(r0) write(r1, &(0x7f0000ef4000)="2400000058001f0014f9f407002304000afff51108000100febfffff0800020001000000", 0x24) r2 = socket$inet(0x10, 0x2, 0x0) sendto$inet(r2, &(0x7f000000ffab)="32000000120025e7000007940d0914040200000000000000000100008328564112002e0000000000fc08080042eb4e05d79278c337d68456f2c4de5accf85cd2aac435f0da01f9ba3089a8c1b5fde995a101110dc2", 0x55, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): 035][ T1228] usb 2-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 401.387536][ T1228] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.404643][ T1228] usb 2-1: config 0 descriptor?? [ 401.416094][ T4581] loop0: detected capacity change from 0 to 256 [ 401.468187][ T60] usb 3-1: USB disconnect, device number 27 [ 401.559771][ T323] usb 5-1: Using ep0 maxpacket: 8 [ 401.689897][ T323] usb 5-1: config 135 has an invalid interface number: 230 but max is 0 [ 401.708814][ T323] usb 5-1: config 135 has an invalid descriptor of length 0, skipping remainder of the config [ 401.729787][ T323] usb 5-1: config 135 has no interface number 0 [ 401.740054][ T323] usb 5-1: config 135 interface 230 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 401.893877][ T1228] hid-multitouch 0003:1FD2:6007.0015: hidraw0: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.1-1/input0 [ 401.949914][ T323] usb 5-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=3f.3a [ 401.969181][ T323] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.979310][ T323] usb 5-1: Product: syz [ 401.989428][ T323] usb 5-1: Manufacturer: syz [ 401.999529][ T323] usb 5-1: SerialNumber: syz [ 402.061269][ T323] usb 5-1: Found UVC 0.00 device syz (18ec:3288) [ 402.070070][ T323] usb 5-1: No valid video chain found. [ 402.177348][ T60] usb 2-1: USB disconnect, device number 35 [ 402.288833][ T323] usb 5-1: USB disconnect, device number 20 [ 402.543170][ T4595] xt_hashlimit: size too large, truncated to 1048576 [ 402.769685][ T4593] loop2: detected capacity change from 0 to 40427 [ 402.814219][ T4593] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 402.839975][ T4593] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 402.881265][ T4593] F2FS-fs (loop2): invalid crc value [ 402.921904][ T4593] F2FS-fs (loop2): Found nat_bits in checkpoint [ 402.988786][ T4609] loop4: detected capacity change from 0 to 512 [ 403.042009][ T4609] EXT4-fs (loop4): Mount option "noacl" will be removed by 3.5 [ 403.042009][ T4609] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 403.042009][ T4609] [ 403.103487][ T4593] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 403.111304][ T4593] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 403.129685][ T4609] EXT4-fs (loop4): mounted filesystem without journal. Opts: noacl,resgid=0x0000000000000000,grpquota,abort,block_validity,,errors=continue. Quota mode: writeback. [ 403.150009][ T4609] ext4 filesystem being mounted at /42/file0 supports timestamps until 2038 (0x7fffffff) [ 403.605625][ T30] audit: type=1400 audit(1728636534.628:544): avc: denied { connect } for pid=4628 comm="syz.4.1372" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 403.678532][ T4600] loop1: detected capacity change from 0 to 40427 [ 403.743230][ T4600] F2FS-fs (loop1): invalid crc value [ 403.769566][ T4600] F2FS-fs (loop1): Found nat_bits in checkpoint [ 403.883449][ T4600] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e4 [ 403.937301][ T1564] attempt to access beyond end of device [ 403.937301][ T1564] loop1: rw=2049, want=45104, limit=40427 [ 403.940502][ T20] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 404.199829][ T20] usb 5-1: Using ep0 maxpacket: 16 [ 404.294293][ T4640] loop1: detected capacity change from 0 to 256 [ 404.305692][ T4642] loop2: detected capacity change from 0 to 256 [ 404.319936][ T20] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 404.330858][ T20] usb 5-1: config 0 interface 0 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 404.340535][ T20] usb 5-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 404.351828][ T4642] exfat: Deprecated parameter 'utf8' [ 404.358649][ T4642] exfat: Deprecated parameter 'utf8' [ 404.363549][ T20] usb 5-1: config 0 interface 0 has no altsetting 0 [ 404.371252][ T4640] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x1a9973fb, utbl_chksum : 0xe619d30d) [ 404.386549][ T20] usb 5-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 404.395651][ T20] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.407260][ T4642] exfat: Deprecated parameter 'utf8' [ 404.440233][ T20] usb 5-1: config 0 descriptor?? [ 404.455861][ T4642] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xabf88b1f, utbl_chksum : 0xe619d30d) [ 404.658881][ T4654] loop1: detected capacity change from 0 to 512 [ 404.684046][ T4654] EXT4-fs error (device loop1): ext4_orphan_get:1397: inode #17: comm syz.1.1382: iget: bogus i_mode (0) [ 404.720235][ T4654] EXT4-fs error (device loop1): ext4_orphan_get:1402: comm syz.1.1382: couldn't read orphan inode 17 (err -117) [ 404.733108][ T4654] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 404.789865][ T1540] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 404.927973][ T20] hid-generic 0003:045E:05DA.0016: ignoring exceeding usage max [ 404.945427][ T20] hid-generic 0003:045E:05DA.0016: hidraw0: USB HID v0.00 Device [HID 045e:05da] on usb-dummy_hcd.4-1/input0 [ 405.019817][ T1228] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 405.110109][ T60] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 405.136081][ T449] usb 5-1: USB disconnect, device number 21 [ 405.179937][ T1540] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 405.189673][ T1540] usb 4-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 405.199595][ T1540] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.209342][ T1540] usb 4-1: config 0 descriptor?? [ 405.349795][ T60] usb 2-1: Using ep0 maxpacket: 8 [ 405.379886][ T1228] usb 3-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 405.388879][ T1228] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.398301][ T1228] usb 3-1: config 0 descriptor?? [ 405.469934][ T60] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 405.482960][ T60] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 405.492729][ T60] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 405.501778][ T60] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.511549][ T60] usb 2-1: config 0 descriptor?? [ 405.659928][ T1228] asix 3-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 405.682384][ T1540] hid-generic 0003:04F3:0755.0017: unknown main item tag 0x3 [ 405.689910][ T1540] hid-generic 0003:04F3:0755.0017: item fetching failed at offset 3/5 [ 405.698324][ T1540] hid-generic: probe of 0003:04F3:0755.0017 failed with error -22 [ 405.879911][ T1228] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 405.885386][ T1540] usb 4-1: USB disconnect, device number 26 [ 405.890497][ T1228] asix 3-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 405.908522][ T1228] asix: probe of 3-1:0.0 failed with error -71 [ 405.916617][ T1228] usb 3-1: USB disconnect, device number 28 [ 405.949834][ T417] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 405.991978][ T60] kone 0003:1E7D:2CED.0018: unknown main item tag 0x0 [ 405.998744][ T60] kone 0003:1E7D:2CED.0018: unknown main item tag 0x0 [ 406.005518][ T60] kone 0003:1E7D:2CED.0018: unknown main item tag 0x0 [ 406.012227][ T60] kone 0003:1E7D:2CED.0018: unknown main item tag 0x0 [ 406.019090][ T60] kone 0003:1E7D:2CED.0018: unknown main item tag 0x0 [ 406.027718][ T60] kone 0003:1E7D:2CED.0018: hidraw0: USB HID v0.00 Device [HID 1e7d:2ced] on usb-dummy_hcd.1-1/input0 [ 406.193077][ T1228] usb 2-1: USB disconnect, device number 36 [ 406.309895][ T417] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 406.320883][ T417] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 406.330533][ T417] usb 5-1: New USB device found, idVendor=056a, idProduct=0027, bcdDevice= 0.00 [ 406.339792][ T417] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.349056][ T417] usb 5-1: config 0 descriptor?? [ 406.590166][ T4679] loop2: detected capacity change from 0 to 16 [ 406.631033][ T4679] erofs: (device loop2): mounted with root inode @ nid 36. [ 406.756286][ T30] audit: type=1400 audit(1728636537.778:545): avc: denied { accept } for pid=4687 comm="syz.2.1398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 406.854513][ T417] wacom 0003:056A:0027.0019: Unknown device_type for 'HID 056a:0027'. Assuming pen. [ 406.880093][ T417] wacom 0003:056A:0027.0019: hidraw0: USB HID v0.00 Device [HID 056a:0027] on usb-dummy_hcd.4-1/input0 [ 406.906275][ T417] input: Wacom Intuos5 touch M Pen as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:056A:0027.0019/input/input19 [ 407.056068][ T1228] usb 5-1: USB disconnect, device number 22 [ 407.163435][ T4702] loop2: detected capacity change from 0 to 256 [ 407.867925][ T417] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 408.118906][ T4711] loop4: detected capacity change from 0 to 256 [ 409.079943][ T417] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 409.099833][ T417] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 409.149777][ T417] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 409.159590][ T417] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 409.219791][ T417] usb 4-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 409.228729][ T417] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 409.242371][ T4726] loop2: detected capacity change from 0 to 1024 [ 409.261563][ T417] usb 4-1: config 0 descriptor?? [ 409.279139][ T4698] loop1: detected capacity change from 0 to 40427 [ 409.320807][ T4698] F2FS-fs (loop1): Mismatch start address, segment0(134218240) cp_blkaddr(0) [ 409.339659][ T4698] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 409.384937][ T4698] F2FS-fs (loop1): Found nat_bits in checkpoint [ 409.402088][ T4726] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 409.440686][ T4726] ext4 filesystem being mounted at /257/file1 supports timestamps until 2038 (0x7fffffff) [ 409.585955][ T4698] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 409.599878][ T4698] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 409.622158][ T30] audit: type=1400 audit(1728636540.648:546): avc: denied { mount } for pid=4735 comm="syz.2.1414" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 409.644937][ T4720] loop4: detected capacity change from 0 to 40427 [ 409.700881][ T30] audit: type=1400 audit(1728636540.658:547): avc: denied { remount } for pid=4735 comm="syz.2.1414" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 409.755207][ T4720] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 409.762372][ T417] hid-picolcd 0003:04D8:C002.001A: unbalanced collection at end of report description [ 409.769801][ T4720] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 409.777452][ T30] audit: type=1400 audit(1728636540.678:548): avc: denied { unmount } for pid=1303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 409.802057][ T4698] F2FS-fs (loop1): Can't flush 4 in 0 for segs_per_sec 1 != 1 [ 409.821476][ T417] hid-picolcd 0003:04D8:C002.001A: device report parse failed [ 409.822064][ T4720] F2FS-fs (loop4): Found nat_bits in checkpoint [ 409.828887][ T417] hid-picolcd: probe of 0003:04D8:C002.001A failed with error -22 [ 409.903545][ T1564] attempt to access beyond end of device [ 409.903545][ T1564] loop1: rw=2049, want=45104, limit=40427 [ 410.025288][ T4723] loop0: detected capacity change from 0 to 40427 [ 410.060450][ T4720] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 410.067465][ T4720] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 410.099168][ T1228] usb 4-1: USB disconnect, device number 27 [ 410.109302][ T4723] F2FS-fs (loop0): Found nat_bits in checkpoint [ 410.279399][ T4723] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 410.408171][ T2125] attempt to access beyond end of device [ 410.408171][ T2125] loop0: rw=2049, want=45104, limit=40427 [ 411.102007][ T4766] loop1: detected capacity change from 0 to 256 [ 411.799565][ T4779] loop1: detected capacity change from 0 to 256 [ 411.856158][ T4781] loop4: detected capacity change from 0 to 1024 [ 411.937435][ T4783] syz.0.1424 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 411.950042][ T4781] EXT4-fs (loop4): Ignoring removed orlov option [ 411.958425][ T4781] EXT4-fs (loop4): Mount option "noacl" will be removed by 3.5 [ 411.958425][ T4781] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 411.958425][ T4781] [ 411.999960][ T417] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 412.020090][ T4781] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 412.081200][ T4781] EXT4-fs (loop4): mounted filesystem without journal. Opts: orlov,noacl,barrier=0x0000000000000002,jqfmt=vfsv1,block_validity,dioread_nolock,noquota,min_batch_time=0x0000000000000008,delalloc,delalloc,quota,,errors=continue. Quota mode: writeback. [ 412.195017][ T4794] loop1: detected capacity change from 0 to 256 [ 413.049909][ T417] usb 3-1: Using ep0 maxpacket: 16 [ 413.191811][ T417] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 413.210495][ T417] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 413.242510][ T417] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 413.269785][ T417] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 413.297031][ T417] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.318611][ T417] usb 3-1: config 0 descriptor?? [ 413.341095][ T4810] loop0: detected capacity change from 0 to 512 [ 413.401786][ T4810] EXT4-fs (loop0): mounted filesystem without journal. Opts: errors=remount-ro,. Quota mode: writeback. [ 413.413106][ T4810] ext4 filesystem being mounted at /183/file0 supports timestamps until 2038 (0x7fffffff) [ 413.433993][ T4810] EXT4-fs error (device loop0): ext4_get_verity_descriptor_location:338: inode #15: comm syz.0.1440: verity file corrupted; can't find descriptor [ 413.449780][ T4810] EXT4-fs (loop0): Remounting filesystem read-only [ 413.456171][ T4810] fs-verity (loop0, inode 15): Error -117 getting verity descriptor size [ 413.669833][ T331] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 413.749806][ T1540] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 413.783905][ T417] microsoft 0003:045E:07DA.001B: No inputs registered, leaving [ 413.792596][ T417] microsoft 0003:045E:07DA.001B: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 413.803946][ T417] microsoft 0003:045E:07DA.001B: no inputs found [ 413.810302][ T417] microsoft 0003:045E:07DA.001B: could not initialize ff, continuing anyway [ 413.909819][ T331] usb 2-1: Using ep0 maxpacket: 16 [ 413.997427][ T417] usb 3-1: USB disconnect, device number 29 [ 414.029904][ T331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 414.040760][ T331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 414.050599][ T331] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 414.063830][ T331] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 414.073153][ T331] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.088448][ T331] usb 2-1: config 0 descriptor?? [ 414.742514][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.770040][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.777338][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.784951][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.792494][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.799899][ T1540] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 414.800192][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.817970][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.818001][ T1540] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 414.825378][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.854292][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.862016][ T1540] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 414.878939][ T1540] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 414.889804][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.896903][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.906017][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.906293][ T4834] loop2: detected capacity change from 0 to 256 [ 414.913465][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.926486][ T331] microsoft 0003:045E:07DA.001C: unknown main item tag 0x0 [ 414.934227][ T331] microsoft 0003:045E:07DA.001C: No inputs registered, leaving [ 414.935788][ T1540] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 414.946376][ T331] microsoft 0003:045E:07DA.001C: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 414.962765][ T331] microsoft 0003:045E:07DA.001C: no inputs found [ 414.968960][ T331] microsoft 0003:045E:07DA.001C: could not initialize ff, continuing anyway [ 414.983387][ T1540] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 254 [ 414.988657][ T331] usb 2-1: USB disconnect, device number 37 [ 414.997467][ T1540] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.00 [ 415.013507][ T1540] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.036984][ T4834] FAT-fs (loop2): Directory bread(block 64) failed [ 415.051243][ T1540] usb 5-1: config 0 descriptor?? [ 415.058978][ T4834] FAT-fs (loop2): Directory bread(block 65) failed [ 415.065542][ T4834] FAT-fs (loop2): Directory bread(block 66) failed [ 415.076199][ T4834] FAT-fs (loop2): Directory bread(block 67) failed [ 415.093099][ T4834] FAT-fs (loop2): Directory bread(block 68) failed [ 415.099627][ T4834] FAT-fs (loop2): Directory bread(block 69) failed [ 415.109913][ T4834] FAT-fs (loop2): Directory bread(block 70) failed [ 415.116326][ T4834] FAT-fs (loop2): Directory bread(block 71) failed [ 415.130038][ T4834] FAT-fs (loop2): Directory bread(block 72) failed [ 415.136498][ T4834] FAT-fs (loop2): Directory bread(block 73) failed [ 415.661475][ T1540] keytouch 0003:0926:3333.001D: fixing up Keytouch IEC report descriptor [ 415.830040][ T1540] input: HID 0926:3333 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0926:3333.001D/input/input23 [ 416.250565][ T1540] keytouch 0003:0926:3333.001D: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.4-1/input0 [ 416.331244][ T1540] usb 5-1: USB disconnect, device number 23 [ 416.399809][ T331] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 416.476662][ T4863] binder: 4861:4863 ioctl 4018620d 0 returned -22 [ 416.533728][ T4863] loop1: detected capacity change from 0 to 1024 [ 417.302293][ T331] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 417.372533][ T331] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 417.460262][ T331] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 417.471700][ T4863] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 417.496656][ T331] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 417.529933][ T331] usb 3-1: SerialNumber: syz [ 417.784593][ T4885] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1469'. [ 417.810717][ T4885] device veth2 entered promiscuous mode [ 417.844419][ T331] usb 3-1: 0:2 : does not exist [ 417.909333][ T331] usb 3-1: USB disconnect, device number 30 [ 418.139078][ T4896] loop0: detected capacity change from 0 to 512 [ 418.234362][ T4896] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm syz.0.1474: bg 0: block 205: padding at end of block bitmap is not set [ 418.249566][ T4896] EXT4-fs error (device loop0) in ext4_mb_clear_bb:6185: Corrupt filesystem [ 418.260217][ T4896] EXT4-fs (loop0): 1 orphan inode deleted [ 418.265801][ T4896] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 418.277281][ T4896] ext4 filesystem being mounted at /189/file1 supports timestamps until 2038 (0x7fffffff) [ 418.359782][ T1540] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 418.369618][ T30] audit: type=1400 audit(1728636549.388:549): avc: denied { read } for pid=4899 comm="syz.2.1476" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 418.392809][ T30] audit: type=1400 audit(1728636549.388:550): avc: denied { open } for pid=4899 comm="syz.2.1476" path="/dev/snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 418.480125][ T30] audit: type=1400 audit(1728636549.398:551): avc: denied { ioctl } for pid=4899 comm="syz.2.1476" path="/dev/snapshot" dev="devtmpfs" ino=90 ioctlcmd=0x3312 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 418.484304][ T4905] loop2: detected capacity change from 0 to 512 [ 418.569956][ T4905] EXT4-fs (loop2): Test dummy encryption mode enabled [ 418.588191][ T4905] EXT4-fs error (device loop2): __ext4_iget:4903: inode #11: block 1: comm syz.2.1477: invalid block [ 418.599831][ T4905] EXT4-fs error (device loop2): ext4_orphan_get:1402: comm syz.2.1477: couldn't read orphan inode 11 (err -117) [ 418.623854][ T4905] EXT4-fs (loop2): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 418.654923][ T30] audit: type=1400 audit(1728636549.678:552): avc: denied { read } for pid=4913 comm="syz.3.1481" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 418.902850][ T1540] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 418.914189][ T1540] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 418.925045][ T1540] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 418.934775][ T1540] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 418.947626][ T1540] usb 5-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 418.957037][ T1540] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.979783][ T1540] usb 5-1: config 0 descriptor?? [ 419.046697][ T4919] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.1477: Directory hole found for htree leaf block 0 [ 419.285256][ T4924] loop1: detected capacity change from 0 to 256 [ 420.094636][ T1540] wacom 0003:056A:0331.001E: hidraw0: USB HID v0.00 Device [HID 056a:0331] on usb-dummy_hcd.4-1/input0 [ 420.172196][ T1540] usb 5-1: USB disconnect, device number 24 [ 420.445200][ T4930] xt_hashlimit: size too large, truncated to 1048576 [ 420.969764][ T331] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 421.220020][ T331] usb 2-1: Using ep0 maxpacket: 8 [ 421.350162][ T331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 421.367745][ T331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 421.379768][ T1228] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 421.391778][ T331] usb 2-1: New USB device found, idVendor=04d9, idProduct=a067, bcdDevice= 0.00 [ 421.403988][ T4953] loop4: detected capacity change from 0 to 128 [ 421.416946][ T331] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.427396][ T331] usb 2-1: config 0 descriptor?? [ 421.478847][ T4953] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 421.513177][ T4953] ext4 filesystem being mounted at /70/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038 (0x7fffffff) [ 421.586672][ T4959] loop2: detected capacity change from 0 to 256 [ 421.800656][ T1228] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 421.847031][ T1228] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 421.958012][ T1228] usb 4-1: New USB device found, idVendor=056a, idProduct=0325, bcdDevice= 0.00 [ 421.993310][ T331] holtek_mouse 0003:04D9:A067.001F: item fetching failed at offset 5/7 [ 422.081238][ T331] holtek_mouse 0003:04D9:A067.001F: hid parse failed: -22 [ 422.122935][ T1228] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.212498][ T331] holtek_mouse: probe of 0003:04D9:A067.001F failed with error -22 [ 422.419558][ T331] usb 2-1: USB disconnect, device number 38 [ 422.492521][ T1228] usb 4-1: config 0 descriptor?? [ 422.605326][ T4972] loop4: detected capacity change from 0 to 512 [ 422.674471][ T4975] binder: 4969:4975 ioctl 4018620d 0 returned -22 [ 422.675552][ T4974] loop0: detected capacity change from 0 to 1024 [ 422.688478][ T4972] EXT4-fs (loop4): Test dummy encryption mode enabled [ 422.712887][ T4972] EXT4-fs error (device loop4): __ext4_iget:4903: inode #11: block 1: comm syz.4.1503: invalid block [ 422.722914][ T4975] loop2: detected capacity change from 0 to 1024 [ 422.730693][ T4972] EXT4-fs error (device loop4): ext4_orphan_get:1402: comm syz.4.1503: couldn't read orphan inode 11 (err -117) [ 422.742991][ T4972] EXT4-fs (loop4): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 422.777590][ T4974] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 422.794470][ T4974] EXT4-fs (loop0): Unrecognized mount option "subj_user=GPL" or missing value [ 422.997659][ T1228] wacom 0003:056A:0325.0020: unbalanced collection at end of report description [ 423.050159][ T4975] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 423.069022][ T1228] wacom 0003:056A:0325.0020: parse failed [ 423.095037][ T1228] wacom: probe of 0003:056A:0325.0020 failed with error -22 [ 423.215697][ T4992] EXT4-fs error (device loop4): ext4_add_entry:2484: inode #2: comm syz.4.1503: Directory hole found for htree leaf block 0 [ 423.215777][ T1540] usb 4-1: USB disconnect, device number 28 [ 423.757890][ T4996] loop0: detected capacity change from 0 to 512 [ 423.865158][ T4996] EXT4-fs (loop0): Test dummy encryption mode enabled [ 423.902514][ T4996] EXT4-fs error (device loop0): __ext4_iget:4903: inode #11: block 1: comm syz.0.1510: invalid block [ 424.302220][ T5002] loop1: detected capacity change from 0 to 256 [ 424.324789][ T4996] EXT4-fs error (device loop0): ext4_orphan_get:1402: comm syz.0.1510: couldn't read orphan inode 11 (err -117) [ 424.780016][ T4996] EXT4-fs (loop0): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 425.851718][ T5010] EXT4-fs error (device loop0): ext4_add_entry:2484: inode #2: comm syz.0.1510: Directory hole found for htree leaf block 0 [ 426.179806][ T1540] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 426.214076][ T5030] loop0: detected capacity change from 0 to 1024 [ 426.582557][ T5035] loop1: detected capacity change from 0 to 256 [ 426.650478][ T5030] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 426.789993][ T331] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 426.806963][ T5030] EXT4-fs (loop0): Unrecognized mount option "subj_user=GPL" or missing value [ 427.133242][ T5040] netlink: 'syz.1.1525': attribute type 11 has an invalid length. [ 427.143344][ T5040] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1525'. [ 427.205412][ T5043] loop1: detected capacity change from 0 to 512 [ 427.279791][ T1540] usb 4-1: Using ep0 maxpacket: 32 [ 427.280120][ T331] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 427.302445][ T331] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 427.312206][ T331] usb 3-1: New USB device found, idVendor=056e, idProduct=00fb, bcdDevice= 0.00 [ 427.313853][ T5043] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 427.321817][ T331] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.337669][ T5043] EXT4-fs (loop1): 1 truncate cleaned up [ 427.339064][ T331] usb 3-1: config 0 descriptor?? [ 427.348452][ T5043] EXT4-fs (loop1): mounted filesystem without journal. Opts: resuid=0x0000000000000000,noblock_validity,usrquota,resuid=0x0000000000000000,debug_want_extra_isize=0x0000000000000008,jqfmt=vfsold,usrjquota=min_batch_time=0x0000000000000a9b,nodiscard,,errors=continue. Quota mode: writeback. [ 427.400173][ T1540] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 219 [ 427.464275][ T5055] loop4: detected capacity change from 0 to 512 [ 427.551224][ T5055] EXT4-fs (loop4): Test dummy encryption mode enabled [ 428.336383][ T5066] loop1: detected capacity change from 0 to 256 [ 428.580309][ T1540] usb 4-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 428.589258][ T1540] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.597175][ T1540] usb 4-1: Product: syz [ 428.601383][ T1540] usb 4-1: Manufacturer: syz [ 428.605859][ T1540] usb 4-1: SerialNumber: syz [ 428.628301][ T5055] EXT4-fs error (device loop4): __ext4_iget:4903: inode #11: block 1: comm syz.4.1533: invalid block [ 428.650579][ T1540] usb 4-1: config 0 descriptor?? [ 428.655805][ T5055] EXT4-fs error (device loop4): ext4_orphan_get:1402: comm syz.4.1533: couldn't read orphan inode 11 (err -117) [ 428.668865][ T5055] EXT4-fs (loop4): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 428.679912][ T5014] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 428.844442][ T331] elecom 0003:056E:00FB.0021: hidraw0: USB HID v0.00 Device [HID 056e:00fb] on usb-dummy_hcd.2-1/input0 [ 428.912819][ T5055] EXT4-fs error (device loop4): ext4_add_entry:2484: inode #2: comm syz.4.1533: Directory hole found for htree leaf block 0 [ 429.035843][ T1540] usb 4-1: USB disconnect, device number 29 [ 429.102555][ T1841] udevd[1841]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 429.203024][ T2067] usb 3-1: USB disconnect, device number 31 [ 429.450230][ T331] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 429.457958][ T1228] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 429.689828][ T331] usb 2-1: Using ep0 maxpacket: 8 [ 429.809975][ T331] usb 2-1: New USB device found, idVendor=0403, idProduct=f0c8, bcdDevice= 2.56 [ 429.819045][ T331] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.841436][ T331] usb 2-1: config 0 descriptor?? [ 429.855018][ T30] audit: type=1400 audit(1728636560.878:553): avc: denied { audit_write } for pid=5099 comm="syz.2.1549" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 429.876178][ T30] audit: type=1107 audit(1728636560.878:554): pid=5099 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t msg='' [ 429.880160][ T1228] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 429.900574][ T331] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 429.940359][ T1228] usb 5-1: New USB device found, idVendor=056a, idProduct=003f, bcdDevice= 0.00 [ 429.949352][ T1228] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.972239][ T1228] usb 5-1: config 0 descriptor?? [ 430.035227][ T5104] xt_hashlimit: size too large, truncated to 1048576 [ 430.120027][ T331] usb 2-1: Detected FT232BM [ 430.257971][ T5109] loop2: detected capacity change from 0 to 16 [ 430.422738][ T5109] erofs: Unknown parameter 'ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ0x00000000000002b1]‰çõ®#[8û¨ÞÏ+K·þ¬Wù䶓Ú?¸Ò‡í98 7' [ 431.072952][ T331] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 431.099845][ T331] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 431.114827][ T1228] wacom 0003:056A:003F.0022: unknown main item tag 0x0 [ 431.122903][ T331] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 431.124632][ T5114] syz.2.1554[5114] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 431.139979][ T1228] wacom 0003:056A:003F.0022: unknown main item tag 0x0 [ 431.153424][ T5114] syz.2.1554[5114] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 431.159986][ T331] usb 2-1: USB disconnect, device number 39 [ 431.177050][ T1228] wacom 0003:056A:003F.0022: unknown main item tag 0x0 [ 431.183950][ T1228] wacom 0003:056A:003F.0022: unknown main item tag 0x0 [ 431.192348][ T331] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 431.201663][ T1228] wacom 0003:056A:003F.0022: unknown main item tag 0x0 [ 431.208432][ T1228] wacom 0003:056A:003F.0022: unknown main item tag 0x0 [ 431.215633][ T331] ftdi_sio 2-1:0.0: device disconnected [ 431.221998][ T1228] wacom 0003:056A:003F.0022: unknown main item tag 0x0 [ 431.242044][ T1228] wacom 0003:056A:003F.0022: hidraw0: USB HID v0.07 Device [HID 056a:003f] on usb-dummy_hcd.4-1/input0 [ 431.467345][ T322] usb 5-1: USB disconnect, device number 25 [ 431.479626][ T30] audit: type=1400 audit(1728636562.498:555): avc: denied { connect } for pid=5126 comm="syz.1.1560" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 431.666692][ T5135] sit: Dst spoofed 0.0.0.0/2002::bfd8:a5dd -> 224.0.0.1/2002:c021:42c4:3911:45ba:dd28:fd7f:ffc [ 431.673182][ T5139] loop1: detected capacity change from 0 to 512 [ 431.724931][ T5139] EXT4-fs (loop1): orphan cleanup on readonly fs [ 431.731351][ T5139] EXT4-fs error (device loop1): ext4_orphan_get:1423: comm syz.1.1566: bad orphan inode 1 [ 431.745566][ T5139] EXT4-fs (loop1): Remounting filesystem read-only [ 431.752462][ T5139] EXT4-fs (loop1): mounted filesystem without journal. Opts: bsdgroups,i_version,usrquota,min_batch_time=0x0000000000000005,nobarrier,errors=remount-ro,jqfmt=vfsold,. Quota mode: writeback. [ 431.796443][ T5139] EXT4-fs (loop1): Cannot specify journal on remount [ 431.835125][ T1564] EXT4-fs error (device loop1): ext4_readdir:260: inode #11: block 21: comm syz-executor: path /257/file0/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=64815104, rec_len=1024, size=1024 fake=0 [ 431.858593][ T1564] EXT4-fs error (device loop1): ext4_lookup:1856: inode #16: comm syz-executor: iget: bad extra_isize 2080 (inode size 256) [ 431.879964][ T1564] EXT4-fs error (device loop1): ext4_lookup:1856: inode #16: comm syz-executor: iget: bad extra_isize 2080 (inode size 256) [ 432.033476][ T331] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 432.042846][ T325] tipc: Left network mode [ 432.148869][ T5153] loop4: detected capacity change from 0 to 256 [ 432.215057][ T5153] exfat: Deprecated parameter 'utf8' [ 432.231822][ T5160] loop0: detected capacity change from 0 to 128 [ 432.241424][ T5160] EXT4-fs warning (device loop0): ext4_fill_super:3972: metadata_csum and uninit_bg are redundant flags; please run fsck. [ 432.271097][ T5153] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xe3865569, utbl_chksum : 0xe619d30d) [ 432.287335][ T5160] EXT4-fs (loop0): VFS: Found ext4 filesystem with invalid superblock checksum. Run e2fsck? [ 432.299819][ T331] usb 3-1: Using ep0 maxpacket: 16 [ 432.330417][ T5162] syz.3.1579[5162] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 432.330589][ T5162] syz.3.1579[5162] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 432.357095][ T30] audit: type=1326 audit(1728636563.378:556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5161 comm="syz.3.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83ab355ff9 code=0x7ffc0000 [ 432.422359][ T30] audit: type=1326 audit(1728636563.378:557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5161 comm="syz.3.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=210 compat=0 ip=0x7f83ab355ff9 code=0x7ffc0000 [ 432.446855][ T5164] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 432.496015][ T30] audit: type=1326 audit(1728636563.378:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5161 comm="syz.3.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83ab355ff9 code=0x7ffc0000 [ 432.532821][ T30] audit: type=1326 audit(1728636563.418:559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5161 comm="syz.3.1579" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83ab355ff9 code=0x7ffc0000 [ 432.640520][ T331] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 432.657908][ T5172] loop4: detected capacity change from 0 to 2048 [ 432.665155][ T331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.682449][ T331] usb 3-1: Product: syz [ 432.686733][ T331] usb 3-1: Manufacturer: syz [ 432.691832][ T331] usb 3-1: SerialNumber: syz [ 432.697941][ T331] r8152-cfgselector 3-1: config 0 descriptor?? [ 432.751545][ T5165] bridge0: port 1(bridge_slave_0) entered blocking state [ 432.758666][ T5165] bridge0: port 1(bridge_slave_0) entered disabled state [ 432.767511][ T5165] device bridge_slave_0 entered promiscuous mode [ 432.779042][ T5165] bridge0: port 2(bridge_slave_1) entered blocking state [ 432.786478][ T5165] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.794817][ T5165] device bridge_slave_1 entered promiscuous mode [ 432.795367][ T5172] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 433.032638][ T325] device bridge_slave_1 left promiscuous mode [ 433.040555][ T325] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.055475][ T325] device bridge_slave_0 left promiscuous mode [ 433.063033][ T325] bridge0: port 1(bridge_slave_0) entered disabled state [ 433.086001][ T325] device veth1_macvtap left promiscuous mode [ 433.096255][ T325] device veth0_vlan left promiscuous mode [ 433.499169][ T331] r8152-cfgselector 3-1: Unknown version 0x0000 [ 433.549856][ T331] r8152-cfgselector 3-1: Unknown version 0x0000 [ 433.559890][ T331] r8152-cfgselector 3-1: bad CDC descriptors [ 433.690028][ T5186] loop4: detected capacity change from 0 to 2048 [ 433.762472][ T5186] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 433.793822][ T5186] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 433.811754][ T331] usb 3-1: USB disconnect, device number 32 [ 433.840197][ T5186] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 15 with max blocks 1 with error 28 [ 433.863049][ T5186] EXT4-fs (loop4): This should not happen!! Data will be lost [ 433.863049][ T5186] [ 433.877779][ T5186] EXT4-fs (loop4): Total free blocks count 0 [ 433.900201][ T5186] EXT4-fs (loop4): Free/Dirty block details [ 433.911638][ T5186] EXT4-fs (loop4): free_blocks=2415919104 [ 433.922304][ T5186] EXT4-fs (loop4): dirty_blocks=16 [ 433.937597][ T5186] EXT4-fs (loop4): Block reservation details [ 433.949521][ T5186] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 434.065225][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 434.080519][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 434.122714][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 434.135164][ T5192] loop4: detected capacity change from 0 to 256 [ 434.141152][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 434.149571][ T423] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.156531][ T423] bridge0: port 1(bridge_slave_0) entered forwarding state [ 434.165801][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 434.175066][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 434.183479][ T423] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.190426][ T423] bridge0: port 2(bridge_slave_1) entered forwarding state [ 434.198744][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 434.222137][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 434.235699][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 434.244891][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 434.254975][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 434.286495][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 434.296024][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 434.317021][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 434.326203][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 434.335847][ T5165] device veth0_vlan entered promiscuous mode [ 434.342595][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 434.350723][ T1467] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 434.403881][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 434.432619][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 434.446318][ T5165] device veth1_macvtap entered promiscuous mode [ 434.480834][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 434.492313][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 434.505132][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 434.517388][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 434.530598][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 434.564832][ T5203] loop4: detected capacity change from 0 to 256 [ 435.325977][ T5208] loop1: detected capacity change from 0 to 128 [ 435.680526][ T5208] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 435.833291][ T5208] ext4 filesystem being mounted at /0/mnt supports timestamps until 2038 (0x7fffffff) [ 436.200755][ T5218] loop4: detected capacity change from 0 to 512 [ 436.255208][ T5223] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 436.278557][ T5218] EXT4-fs (loop4): Test dummy encryption mode enabled [ 436.298220][ T5218] EXT4-fs error (device loop4): __ext4_iget:4903: inode #11: block 1: comm syz.4.1594: invalid block [ 436.313667][ T5218] EXT4-fs error (device loop4): ext4_orphan_get:1402: comm syz.4.1594: couldn't read orphan inode 11 (err -117) [ 436.329768][ T5218] EXT4-fs (loop4): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 436.338351][ T5228] bridge0: port 3(syz_tun) entered blocking state [ 436.370893][ T5228] bridge0: port 3(syz_tun) entered disabled state [ 436.378363][ T5228] device syz_tun entered promiscuous mode [ 436.385010][ T5228] bridge0: port 3(syz_tun) entered blocking state [ 436.391334][ T5228] bridge0: port 3(syz_tun) entered forwarding state [ 436.496550][ T30] audit: type=1400 audit(1728636567.518:560): avc: denied { write } for pid=5232 comm="syz.1.1600" name="hwrng" dev="devtmpfs" ino=94 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:random_device_t tclass=chr_file permissive=1 [ 436.639884][ T417] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 436.719851][ T1540] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 436.767510][ T5236] EXT4-fs error (device loop4): ext4_add_entry:2484: inode #2: comm syz.4.1594: Directory hole found for htree leaf block 0 [ 437.069929][ T1540] usb 3-1: Using ep0 maxpacket: 32 [ 437.139913][ T417] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 437.158137][ T417] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 437.189994][ T1540] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 437.207689][ T1540] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 437.237724][ T1540] usb 3-1: New USB device found, idVendor=046d, idProduct=ca03, bcdDevice= 0.00 [ 437.257445][ T1540] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.265727][ T417] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 437.285135][ T417] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 437.295832][ T417] usb 4-1: SerialNumber: syz [ 437.301799][ T1540] usb 3-1: config 0 descriptor?? [ 437.372331][ T5239] xt_hashlimit: size too large, truncated to 1048576 [ 437.409485][ T5243] loop1: detected capacity change from 0 to 512 [ 437.493075][ T5243] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 437.513563][ T5243] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 437.527019][ T5243] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #13: comm syz.1.1603: invalid indirect mapped block 2683928664 (level 1) [ 437.542010][ T5243] EXT4-fs (loop1): Remounting filesystem read-only [ 437.548752][ T5243] EXT4-fs (loop1): 1 truncate cleaned up [ 437.554979][ T5243] EXT4-fs (loop1): mounted filesystem without journal. Opts: noblock_validity,dioread_nolock,errors=remount-ro,minixdf,jqfmt=vfsv0,usrjquota=.". Quota mode: writeback. [ 437.591931][ T30] audit: type=1400 audit(1728636568.618:561): avc: denied { mounton } for pid=5242 comm="syz.1.1603" path="/5/file0/file0" dev="loop1" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 437.616747][ T5243] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.1603: Invalid block bitmap block 3 in block_group 0 [ 437.630976][ T5243] EXT4-fs (loop1): Remounting filesystem read-only [ 437.631953][ T417] usb 4-1: 0:2 : does not exist [ 437.655256][ T5165] EXT4-fs error (device loop1): htree_dirblock_to_tree:1112: inode #2: block 13: comm syz-executor: bad entry in directory: rec_len % 4 != 0 - offset=108, inode=4294901777, rec_len=65535, size=1024 fake=0 [ 437.678739][ T5165] EXT4-fs error (device loop1): ext4_xattr_ibody_find:2219: inode #15: comm syz-executor: corrupted in-inode xattr [ 437.692534][ T5165] EXT4-fs error (device loop1): ext4_xattr_ibody_find:2219: inode #15: comm syz-executor: corrupted in-inode xattr [ 437.696918][ T417] usb 4-1: USB disconnect, device number 30 [ 437.728032][ T5165] bridge0: port 3(syz_tun) entered disabled state [ 437.737581][ T5165] device syz_tun left promiscuous mode [ 437.743125][ T5165] bridge0: port 3(syz_tun) entered disabled state [ 437.771805][ T1540] logitech 0003:046D:CA03.0023: unknown main item tag 0x0 [ 437.800300][ T1540] logitech 0003:046D:CA03.0023: hidraw0: USB HID v0.02 Device [HID 046d:ca03] on usb-dummy_hcd.2-1/input0 [ 437.819787][ T1540] logitech 0003:046D:CA03.0023: no inputs found [ 437.987029][ T60] usb 3-1: USB disconnect, device number 33 [ 438.245530][ T60] kernel write not supported for file bpf-prog (pid: 60 comm: kworker/0:2) [ 438.273953][ T423] device bridge_slave_1 left promiscuous mode [ 438.280385][ T423] bridge0: port 2(bridge_slave_1) entered disabled state [ 438.310685][ T423] device bridge_slave_0 left promiscuous mode [ 438.316755][ T423] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.335483][ T423] device veth1_macvtap left promiscuous mode [ 438.351602][ T423] device veth0_vlan left promiscuous mode [ 438.575222][ T5257] loop0: detected capacity change from 0 to 2048 [ 438.619906][ T1039] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 438.638845][ T5261] loop4: detected capacity change from 0 to 512 [ 438.648146][ T5257] EXT4-fs (loop0): mounted filesystem without journal. Opts: commit=0x0000000000000005,,errors=continue. Quota mode: none. [ 438.684947][ T5261] EXT4-fs (loop4): Test dummy encryption mode enabled [ 438.713489][ T5261] EXT4-fs error (device loop4): __ext4_iget:4903: inode #11: block 1: comm syz.4.1612: invalid block [ 438.724847][ T5261] EXT4-fs error (device loop4): ext4_orphan_get:1402: comm syz.4.1612: couldn't read orphan inode 11 (err -117) [ 438.737966][ T5261] EXT4-fs (loop4): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 438.813691][ T5248] bridge0: port 1(bridge_slave_0) entered blocking state [ 438.822826][ T5248] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.840814][ T5248] device bridge_slave_0 entered promiscuous mode [ 438.848716][ T5248] bridge0: port 2(bridge_slave_1) entered blocking state [ 438.856753][ T5248] bridge0: port 2(bridge_slave_1) entered disabled state [ 438.865549][ T5248] device bridge_slave_1 entered promiscuous mode [ 438.937353][ T417] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 439.117672][ T5270] EXT4-fs error (device loop4): ext4_add_entry:2484: inode #2: comm syz.4.1612: Directory hole found for htree leaf block 0 [ 439.270035][ T417] usb 3-1: Using ep0 maxpacket: 16 [ 439.390744][ T417] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 439.420167][ T417] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 439.605798][ T417] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 439.626062][ T417] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.663700][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 439.671707][ T417] usb 3-1: config 0 descriptor?? [ 439.677812][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 439.694923][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 439.704265][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 439.716361][ T953] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.723419][ T953] bridge0: port 1(bridge_slave_0) entered forwarding state [ 439.742722][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 439.751447][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 439.760584][ T953] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.767531][ T953] bridge0: port 2(bridge_slave_1) entered forwarding state [ 439.784238][ T953] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 439.786866][ T1039] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 439.803200][ T1039] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 439.814463][ T1039] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 439.823933][ T1039] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.836848][ T1039] usb 4-1: config 0 descriptor?? [ 439.843100][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 439.853484][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 439.870382][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 439.879298][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 439.904784][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 439.914123][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 439.933219][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 439.982572][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 439.994143][ T5248] device veth0_vlan entered promiscuous mode [ 440.001135][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 440.009422][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 440.050153][ T5248] device veth1_macvtap entered promiscuous mode [ 440.058248][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 440.067301][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 440.075839][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 440.092036][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 440.100739][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 440.134831][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 440.150419][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 440.177740][ T5277] loop0: detected capacity change from 0 to 16 [ 440.242726][ T5277] erofs: Unknown parameter 'ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ0x00000000000001eb]‰çõ®#[8û¨ÞÏ+K·þ¬Wù䶓Ú?¸Ò‡í98 7' [ 440.275463][ T417] microsoft 0003:045E:07DA.0024: unknown main item tag 0x4 [ 440.455212][ T417] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0024/input/input30 [ 440.813026][ T417] microsoft 0003:045E:07DA.0024: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 440.921068][ T417] usb 3-1: USB disconnect, device number 34 [ 442.617378][ T5288] input: syz1 as /devices/virtual/input/input31 [ 442.730081][ T1039] usbhid 4-1:0.0: can't add hid device: -71 [ 442.736011][ T1039] usbhid: probe of 4-1:0.0 failed with error -71 [ 442.753990][ T1039] usb 4-1: USB disconnect, device number 31 [ 442.796079][ T5298] loop2: detected capacity change from 0 to 512 [ 442.806570][ T5303] loop0: detected capacity change from 0 to 1024 [ 442.813200][ T60] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 442.823300][ T5298] EXT4-fs (loop2): Test dummy encryption mode enabled [ 442.847815][ T5298] EXT4-fs error (device loop2): __ext4_iget:4903: inode #11: block 1: comm syz.2.1621: invalid block [ 442.858943][ T5298] EXT4-fs error (device loop2): ext4_orphan_get:1402: comm syz.2.1621: couldn't read orphan inode 11 (err -117) [ 442.871559][ T5298] EXT4-fs (loop2): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 442.901577][ T5303] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 442.925311][ T5303] EXT4-fs (loop0): Ignoring removed nomblk_io_submit option [ 442.951243][ T5303] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 442.964939][ T5303] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e855c01c, mo2=0003] [ 442.974307][ T5303] System zones: 0-1, 3-36 [ 442.982394][ T5303] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpquota,delalloc,resuid=0x0000000000000000,debug,dioread_nolock,jqfmt=vfsold,nomblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: writeback. [ 443.102378][ T30] audit: type=1400 audit(1728636574.128:562): avc: denied { rmdir } for pid=2125 comm="syz-executor" name="lost+found" dev="loop0" ino=11 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 443.125588][ T30] audit: type=1400 audit(1728636574.128:563): avc: denied { unlink } for pid=2125 comm="syz-executor" name="file1" dev="loop0" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 443.139803][ T449] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 443.265252][ T5314] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.1621: Directory hole found for htree leaf block 0 [ 443.571304][ T449] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 443.746284][ T449] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 443.762577][ T449] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 443.811111][ T449] usb 2-1: New USB device found, idVendor=11c2, idProduct=2208, bcdDevice= 0.00 [ 443.827041][ T5317] netlink: 'syz.4.1627': attribute type 4 has an invalid length. [ 443.834866][ T449] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.856340][ T449] usb 2-1: config 0 descriptor?? [ 443.999779][ T1039] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 444.010957][ T5322] loop4: detected capacity change from 0 to 128 [ 444.050722][ T5322] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 444.069338][ T5322] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 444.170654][ T60] usb 5-1: device not accepting address 26, error -71 [ 444.245244][ T5329] loop2: detected capacity change from 0 to 256 [ 444.300676][ T1467] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 444.460858][ T1039] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 444.585359][ T1039] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 444.676973][ T953] device bridge_slave_1 left promiscuous mode [ 444.748263][ T1039] usb 4-1: New USB device found, idVendor=054c, idProduct=024b, bcdDevice= 0.00 [ 444.766550][ T953] bridge0: port 2(bridge_slave_1) entered disabled state [ 444.906357][ T1039] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.918632][ T449] betop 0003:11C2:2208.0025: item fetching failed at offset 4/5 [ 444.926697][ T449] betop 0003:11C2:2208.0025: parse failed [ 444.932491][ T449] betop: probe of 0003:11C2:2208.0025 failed with error -22 [ 444.966034][ T1039] usb 4-1: config 0 descriptor?? [ 444.970674][ T449] usb 2-1: USB disconnect, device number 40 [ 445.000240][ T953] device bridge_slave_0 left promiscuous mode [ 445.006470][ T953] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.043321][ T953] device veth1_macvtap left promiscuous mode [ 445.054989][ T953] device veth0_vlan left promiscuous mode [ 445.200071][ T5338] binder: 5336:5338 ioctl 4018620d 0 returned -22 [ 445.239920][ T60] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 445.276207][ T5339] loop1: detected capacity change from 0 to 1024 [ 445.355403][ T5339] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 445.486759][ T1039] sony 0003:054C:024B.0026: unexpected long global item [ 445.541979][ T1039] sony 0003:054C:024B.0026: parse failed [ 445.575767][ T1039] sony: probe of 0003:054C:024B.0026 failed with error -22 [ 445.649921][ T60] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 445.678210][ T60] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 445.692117][ T5345] tipc: MTU too low for tipc bearer [ 445.713004][ T449] usb 4-1: USB disconnect, device number 32 [ 445.756083][ T60] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 445.849794][ T60] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 445.860621][ T60] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.877492][ T60] usb 5-1: config 0 descriptor?? [ 445.930895][ T5333] bridge0: port 1(bridge_slave_0) entered blocking state [ 445.948095][ T5333] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.964488][ T5333] device bridge_slave_0 entered promiscuous mode [ 445.982386][ T5333] bridge0: port 2(bridge_slave_1) entered blocking state [ 445.989288][ T5333] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.011523][ T5333] device bridge_slave_1 entered promiscuous mode [ 446.293251][ T5333] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.300185][ T5333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 446.307386][ T5333] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.314326][ T5333] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.362586][ T60] plantronics 0003:047F:FFFF.0027: No inputs registered, leaving [ 446.400373][ T60] plantronics 0003:047F:FFFF.0027: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 446.413303][ T1228] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 446.414193][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 446.442735][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 446.468153][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 447.117398][ T322] usb 5-1: USB disconnect, device number 27 [ 447.284678][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 447.304987][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 447.313487][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 447.322596][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 447.331156][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 447.340178][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 447.357432][ T5333] device veth0_vlan entered promiscuous mode [ 447.365591][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 447.375409][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 447.384309][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 447.392364][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 447.412420][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 447.421027][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 447.432126][ T5333] device veth1_macvtap entered promiscuous mode [ 447.448091][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 447.456509][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 447.468968][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 447.477904][ T423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 447.542956][ T5372] syz.0.1632[5372] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 447.543112][ T5372] syz.0.1632[5372] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 447.560452][ T1228] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 447.582410][ T1039] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 447.603953][ T1228] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 447.614766][ T1228] usb 3-1: New USB device found, idVendor=0f30, idProduct=0111, bcdDevice= 0.00 [ 447.636153][ T1228] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.655158][ T1228] usb 3-1: config 0 descriptor?? [ 447.748426][ T5382] loop4: detected capacity change from 0 to 512 [ 447.868845][ T5382] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 447.900621][ T5382] ext4 filesystem being mounted at /98/file0 supports timestamps until 2038 (0x7fffffff) [ 447.959943][ T1039] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 447.971789][ T5382] EXT4-fs error (device loop4): ext4_add_entry:2484: inode #2: comm syz.4.1651: Directory hole found for htree leaf block 0 [ 447.989983][ T1039] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 448.029883][ T1039] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 448.048996][ T1039] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.075566][ T1039] usb 2-1: config 0 descriptor?? [ 448.189019][ T5399] loop0: detected capacity change from 0 to 256 [ 448.443098][ T1228] pantherlord 0003:0F30:0111.0028: item fetching failed at offset 6/7 [ 448.538024][ T1228] pantherlord 0003:0F30:0111.0028: parse failed [ 448.619593][ T1039] keytouch 0003:0926:3333.0029: fixing up Keytouch IEC report descriptor [ 448.683501][ T1228] pantherlord: probe of 0003:0F30:0111.0028 failed with error -22 [ 448.938983][ T1039] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0029/input/input32 [ 448.951307][ T1228] usb 3-1: USB disconnect, device number 35 [ 449.040292][ T1039] keytouch 0003:0926:3333.0029: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 449.100838][ T1039] usb 2-1: USB disconnect, device number 41 [ 449.243922][ T5407] loop0: detected capacity change from 0 to 512 [ 449.331222][ T5407] EXT4-fs (loop0): Test dummy encryption mode enabled [ 449.354836][ T5407] EXT4-fs error (device loop0): __ext4_iget:4903: inode #11: block 1: comm syz.0.1659: invalid block [ 449.370265][ T5407] EXT4-fs error (device loop0): ext4_orphan_get:1402: comm syz.0.1659: couldn't read orphan inode 11 (err -117) [ 449.398793][ T5407] EXT4-fs (loop0): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 449.559198][ T5421] loop1: detected capacity change from 0 to 128 [ 449.621312][ T5421] EXT4-fs warning (device loop1): ext4_fill_super:3972: metadata_csum and uninit_bg are redundant flags; please run fsck. [ 449.634217][ T5421] EXT4-fs (loop1): VFS: Found ext4 filesystem with invalid superblock checksum. Run e2fsck? [ 449.669766][ T417] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 449.774759][ T5423] EXT4-fs error (device loop0): ext4_add_entry:2484: inode #2: comm syz.0.1659: Directory hole found for htree leaf block 0 [ 450.640898][ T417] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 450.679873][ T417] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 450.690029][ T322] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 450.732812][ T5426] loop2: detected capacity change from 0 to 1024 [ 450.799935][ T417] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2db4, bcdDevice= 0.00 [ 450.809091][ T417] usb 5-1: New USB device strings: Mfr=0, Product=9, SerialNumber=0 [ 450.829857][ T417] usb 5-1: Product: syz [ 450.835349][ T417] usb 5-1: config 0 descriptor?? [ 450.845594][ T5426] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 450.880351][ T45] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 4278190105 free clusters [ 450.895464][ T45] EXT4-fs (loop2): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 64 with error 28 [ 450.908122][ T45] EXT4-fs (loop2): This should not happen!! Data will be lost [ 450.908122][ T45] [ 450.918198][ T45] EXT4-fs (loop2): Total free blocks count 0 [ 450.924073][ T45] EXT4-fs (loop2): Free/Dirty block details [ 450.929837][ T45] EXT4-fs (loop2): free_blocks=68451041280 [ 450.935405][ T45] EXT4-fs (loop2): dirty_blocks=64 [ 450.940385][ T45] EXT4-fs (loop2): Block reservation details [ 450.946174][ T45] EXT4-fs (loop2): i_reserved_data_blocks=4 [ 450.990219][ T1540] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 451.069936][ T322] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 451.084332][ T322] usb 4-1: New USB device found, idVendor=046d, idProduct=1017, bcdDevice= 0.00 [ 451.093503][ T322] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.103013][ T322] usb 4-1: config 0 descriptor?? [ 451.141394][ T322] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 451.289985][ T60] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 451.301789][ T417] konepure 0003:1E7D:2DB4.002A: item fetching failed at offset 10/11 [ 451.310328][ T417] konepure 0003:1E7D:2DB4.002A: parse failed [ 451.316193][ T417] konepure: probe of 0003:1E7D:2DB4.002A failed with error -22 [ 451.341244][ T417] usb 4-1: USB disconnect, device number 33 [ 451.359918][ T1540] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 451.370994][ T1540] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 451.380663][ T1540] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 451.390770][ T1540] usb 2-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 451.399820][ T1540] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.408891][ T1540] usb 2-1: config 0 descriptor?? [ 451.451511][ T1540] usb 2-1: MIDIStreaming interface descriptor not found [ 451.503311][ T1228] usb 5-1: USB disconnect, device number 28 [ 451.539782][ T60] usb 3-1: Using ep0 maxpacket: 16 [ 451.659886][ T60] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 451.670972][ T60] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 451.680638][ T60] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.40 [ 451.689580][ T60] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.699664][ T60] usb 3-1: config 0 descriptor?? [ 452.047789][ T5440] loop4: detected capacity change from 0 to 2048 [ 452.123165][ T5440] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 452.143310][ T5440] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 452.158644][ T5440] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 16383 with max blocks 1 with error 28 [ 452.161478][ T60] cp2112 0003:10C4:EA90.002B: unknown main item tag 0x0 [ 452.176533][ T5440] EXT4-fs (loop4): This should not happen!! Data will be lost [ 452.176533][ T5440] [ 452.177875][ T60] cp2112 0003:10C4:EA90.002B: unknown main item tag 0x0 [ 452.188578][ T5440] EXT4-fs (loop4): Total free blocks count 0 [ 452.194075][ T1039] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 452.200986][ T5440] EXT4-fs (loop4): Free/Dirty block details [ 452.207890][ T60] cp2112 0003:10C4:EA90.002B: unknown main item tag 0x0 [ 452.220358][ T5440] EXT4-fs (loop4): free_blocks=2415919104 [ 452.221241][ T60] cp2112 0003:10C4:EA90.002B: unknown main item tag 0x0 [ 452.226079][ T5440] EXT4-fs (loop4): dirty_blocks=16 [ 452.233400][ T60] cp2112 0003:10C4:EA90.002B: unknown main item tag 0x0 [ 452.237823][ T5440] EXT4-fs (loop4): Block reservation details [ 452.247508][ T60] cp2112 0003:10C4:EA90.002B: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 452.257777][ T5440] EXT4-fs (loop4): i_reserved_data_blocks=1 [ 452.364352][ T30] audit: type=1400 audit(1728636583.388:564): avc: denied { getopt } for pid=5446 comm="syz.4.1673" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 452.385499][ T60] cp2112 0003:10C4:EA90.002B: Part Number: 0x00 Device Version: 0x00 [ 452.468546][ T30] audit: type=1326 audit(1728636583.488:565): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5448 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014e53ff9 code=0x7ffc0000 [ 452.492937][ T30] audit: type=1326 audit(1728636583.488:566): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5448 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014e53ff9 code=0x7ffc0000 [ 452.516207][ T30] audit: type=1326 audit(1728636583.488:567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5448 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=c000003e syscall=23 compat=0 ip=0x7f0014e53ff9 code=0x7ffc0000 [ 452.539444][ T30] audit: type=1326 audit(1728636583.538:568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5448 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014e53ff9 code=0x7ffc0000 [ 452.563190][ T30] audit: type=1326 audit(1728636583.538:569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5448 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0014e53ff9 code=0x7ffc0000 [ 452.589892][ T60] cp2112 0003:10C4:EA90.002B: error requesting SMBus config [ 452.598500][ T60] cp2112: probe of 0003:10C4:EA90.002B failed with error -71 [ 452.614991][ T60] usb 3-1: USB disconnect, device number 36 [ 452.621189][ T1039] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 452.635649][ T1039] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 452.651756][ T1039] usb 4-1: New USB device found, idVendor=0f30, idProduct=0111, bcdDevice= 0.00 [ 452.661035][ T1039] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.670706][ T1039] usb 4-1: config 0 descriptor?? [ 452.681744][ T1228] usb 2-1: USB disconnect, device number 42 [ 452.760378][ T5456] loop1: detected capacity change from 0 to 512 [ 452.830750][ T5456] EXT4-fs (loop1): Mount option "nouser_xattr" will be removed by 3.5 [ 452.830750][ T5456] Contact linux-ext4@vger.kernel.org if you think we should keep it. [ 452.830750][ T5456] [ 452.851220][ T5456] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 452.864824][ T5456] EXT4-fs (loop1): 1 orphan inode deleted [ 452.870468][ T5456] EXT4-fs (loop1): 1 truncate cleaned up [ 452.876029][ T5456] EXT4-fs (loop1): mounted filesystem without journal. Opts: errors=remount-ro,nouser_xattr,debug_want_extra_isize=0x000000000000002e,inode_readahead_blks=0x0000000000010000,block_validity,quota,. Quota mode: writeback. [ 452.899791][ T1540] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 452.911190][ T5456] EXT4-fs (loop1): shut down requested (2) [ 452.917401][ T5456] EXT4-fs warning (device loop1): empty_inline_dir:1861: bad inline directory (dir #12) - inode 13, rec_len 784, name_len 5inline size 60 [ 453.137632][ T5462] loop1: detected capacity change from 0 to 256 [ 453.227904][ T1039] pantherlord 0003:0F30:0111.002C: item fetching failed at offset 6/7 [ 453.238558][ T1039] pantherlord 0003:0F30:0111.002C: parse failed [ 453.340307][ T1039] pantherlord: probe of 0003:0F30:0111.002C failed with error -22 [ 453.467362][ T1039] usb 4-1: USB disconnect, device number 34 [ 453.919888][ T1540] usb 5-1: device descriptor read/64, error -71 [ 454.149783][ T1039] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 454.309842][ T1540] usb 5-1: device descriptor read/64, error -71 [ 454.339226][ T5469] loop1: detected capacity change from 0 to 40427 [ 454.376650][ T5469] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 454.384719][ T5469] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 454.407123][ T5469] F2FS-fs (loop1): invalid crc value [ 454.415511][ T5469] F2FS-fs (loop1): Found nat_bits in checkpoint [ 454.494416][ T5469] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 454.501473][ T5469] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 454.529935][ T1039] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 454.532563][ T5469] attempt to access beyond end of device [ 454.532563][ T5469] loop1: rw=10241, want=45104, limit=40427 [ 454.540919][ T1039] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 454.562101][ T1039] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 454.575417][ T1039] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 454.579778][ T1540] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 454.584873][ T1039] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.601929][ T1039] usb 3-1: config 0 descriptor?? [ 454.608175][ T45] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 454.618157][ T45] F2FS-fs (loop1): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. [ 454.759811][ T1228] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 454.869841][ T1540] usb 5-1: device descriptor read/64, error -71 [ 454.938086][ T5483] tipc: Started in network mode [ 454.942913][ T5483] tipc: Node identity ac141441, cluster identity 4711 [ 454.950778][ T5483] tipc: Enabled bearer , priority 0 [ 454.957855][ T30] audit: type=1400 audit(1728636585.978:570): avc: denied { ioctl } for pid=5482 comm="syz.1.1685" path="socket:[34184]" dev="sockfs" ino=34184 ioctlcmd=0x89e1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 455.032455][ T5487] loop1: detected capacity change from 0 to 128 [ 455.090318][ T5487] EXT4-fs warning (device loop1): ext4_fill_super:3972: metadata_csum and uninit_bg are redundant flags; please run fsck. [ 455.102590][ T1039] plantronics 0003:047F:FFFF.002D: unknown main item tag 0x0 [ 455.103291][ T5487] EXT4-fs (loop1): VFS: Found ext4 filesystem with invalid superblock checksum. Run e2fsck? [ 455.115469][ T1039] plantronics 0003:047F:FFFF.002D: No inputs registered, leaving [ 455.135581][ T1039] plantronics 0003:047F:FFFF.002D: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 455.150104][ T1228] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 455.163163][ T1228] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 455.173045][ T1228] usb 4-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 455.181986][ T1228] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 455.191125][ T1228] usb 4-1: config 0 descriptor?? [ 455.269965][ T1540] usb 5-1: device descriptor read/64, error -71 [ 455.390654][ T1540] usb usb5-port1: attempt power cycle [ 455.391248][ T60] usb 3-1: USB disconnect, device number 37 [ 455.559813][ T1039] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 455.673051][ T1228] hid-steam 0003:28DE:1142.002E: item fetching failed at offset 2/5 [ 455.681850][ T1228] hid-steam 0003:28DE:1142.002E: steam_probe:parse of hid interface failed [ 455.690471][ T1228] hid-steam: probe of 0003:28DE:1142.002E failed with error -22 [ 455.809857][ T1540] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 455.872936][ T1228] usb 4-1: USB disconnect, device number 35 [ 455.949880][ T1039] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 455.960858][ T1039] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 455.971427][ T1039] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 455.979992][ T1540] usb 5-1: device descriptor read/8, error -71 [ 455.981445][ T1039] usb 2-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 455.996506][ T1039] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 456.012390][ T1039] usb 2-1: config 0 descriptor?? [ 456.061742][ T1039] usb 2-1: MIDIStreaming interface descriptor not found [ 456.079799][ T417] tipc: Node number set to 2886997057 [ 456.090657][ T5493] input: syz0 as /devices/virtual/input/input33 [ 456.249853][ T1540] usb 5-1: device descriptor read/8, error -71 [ 456.609848][ T1540] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 456.950302][ T1540] usb 5-1: device descriptor read/8, error -71 [ 458.042490][ T1228] usb 2-1: USB disconnect, device number 43 [ 458.080034][ T1540] usb 5-1: device descriptor read/8, error -71 [ 458.200343][ T1540] usb usb5-port1: unable to enumerate USB device [ 458.249996][ T2067] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 458.280014][ T1039] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 458.519790][ T2067] usb 4-1: Using ep0 maxpacket: 8 [ 458.524784][ T1039] usb 3-1: Using ep0 maxpacket: 16 [ 458.599863][ T1228] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 458.679940][ T2067] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 458.689958][ T1039] usb 3-1: config 0 has no interfaces? [ 458.883428][ T1039] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 458.892477][ T2067] usb 4-1: New USB device found, idVendor=8086, idProduct=0b03, bcdDevice=f4.28 [ 458.901810][ T1039] usb 3-1: New USB device strings: Mfr=1, Product=121, SerialNumber=1 [ 458.909911][ T2067] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.917797][ T1039] usb 3-1: Product: syz [ 458.921842][ T1039] usb 3-1: Manufacturer: syz [ 458.926288][ T1039] usb 3-1: SerialNumber: syz [ 458.930784][ T2067] usb 4-1: Product: syz [ 458.934710][ T2067] usb 4-1: Manufacturer: syz [ 458.939131][ T2067] usb 4-1: SerialNumber: syz [ 458.945705][ T2067] usb 4-1: config 0 descriptor?? [ 458.951008][ T1039] r8152-cfgselector 3-1: config 0 descriptor?? [ 458.979898][ T1228] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 458.992239][ T1228] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 459.002001][ T1228] usb 2-1: New USB device found, idVendor=05ac, idProduct=029c, bcdDevice= 0.00 [ 459.010986][ T1228] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 459.020273][ T1228] usb 2-1: config 0 descriptor?? [ 459.220030][ T2067] usb 4-1: Found UVC 0.00 device syz (8086:0b03) [ 459.226247][ T2067] usb 4-1: No valid video chain found. [ 459.234590][ T953] usb 3-1: config 0 descriptor?? [ 459.423320][ T322] usb 3-1: USB disconnect, device number 38 [ 459.439863][ T953] usb 3-1: can't set config #0, error -71 [ 459.450809][ T1540] usb 4-1: USB disconnect, device number 36 [ 459.501973][ T1228] apple 0003:05AC:029C.002F: unknown main item tag 0x0 [ 459.508759][ T1228] apple 0003:05AC:029C.002F: ignoring exceeding usage max [ 459.518865][ T1228] apple 0003:05AC:029C.002F: usage index exceeded [ 459.526140][ T1228] apple 0003:05AC:029C.002F: item 0 0 2 0 parsing failed [ 459.534133][ T1228] apple 0003:05AC:029C.002F: parse failed [ 459.539920][ T1228] apple: probe of 0003:05AC:029C.002F failed with error -22 [ 459.706717][ T1228] usb 2-1: USB disconnect, device number 44 [ 459.957616][ T30] audit: type=1326 audit(1728636590.978:571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98c6524ff9 code=0x7ffc0000 [ 459.990713][ T30] audit: type=1326 audit(1728636590.978:572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f98c6524ff9 code=0x7ffc0000 [ 460.026034][ T30] audit: type=1326 audit(1728636591.008:573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98c6524ff9 code=0x7ffc0000 [ 460.032182][ T5528] ip6_tunnel: ip6gretap0 xmit: Routing loop! Remote address found on this node! [ 460.050778][ T30] audit: type=1326 audit(1728636591.018:574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98c6524ff9 code=0x7ffc0000 [ 460.060787][ T1228] ip6_tunnel: ip6gretap0 xmit: Routing loop! Remote address found on this node! [ 460.085310][ T30] audit: type=1326 audit(1728636591.038:575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f98c6524ff9 code=0x7ffc0000 [ 460.098366][ T5525] loop2: detected capacity change from 0 to 1024 [ 460.117839][ T30] audit: type=1326 audit(1728636591.038:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98c6524ff9 code=0x7ffc0000 [ 460.147294][ T30] audit: type=1326 audit(1728636591.038:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f98c6524ff9 code=0x7ffc0000 [ 460.172377][ T30] audit: type=1326 audit(1728636591.038:578): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f98c6524ff9 code=0x7ffc0000 [ 460.196580][ T30] audit: type=1326 audit(1728636591.038:579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f98c6525033 code=0x7ffc0000 [ 460.230076][ T30] audit: type=1326 audit(1728636591.048:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5524 comm="syz.2.1701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f98c6523adf code=0x7ffc0000 [ 460.260027][ T5525] EXT4-fs (loop2): Ignoring removed oldalloc option [ 460.305020][ T5525] EXT4-fs (loop2): mounted filesystem without journal. Opts: stripe=0x0000000000000003,noauto_da_alloc,jqfmt=vfsold,data_err=ignore,noauto_da_alloc,delalloc,resuid=0x0000000000000000,oldalloc,jqfmt=vfsv1,,errors=continue. Quota mode: none. [ 460.967925][ T5550] loop2: detected capacity change from 0 to 128 [ 461.118239][ T5550] EXT4-fs warning (device loop2): ext4_fill_super:3972: metadata_csum and uninit_bg are redundant flags; please run fsck. [ 461.363382][ T5550] EXT4-fs (loop2): VFS: Found ext4 filesystem with invalid superblock checksum. Run e2fsck? [ 461.442564][ T2067] ip6_tunnel: ip6gretap0 xmit: Routing loop! Remote address found on this node! [ 461.465090][ T5560] bridge0: port 3(syz_tun) entered blocking state [ 461.473187][ T5560] bridge0: port 3(syz_tun) entered disabled state [ 461.480812][ T5560] device syz_tun entered promiscuous mode [ 461.486670][ T5560] bridge0: port 3(syz_tun) entered blocking state [ 461.493021][ T5560] bridge0: port 3(syz_tun) entered forwarding state [ 461.494067][ T5561] loop1: detected capacity change from 0 to 256 [ 461.535337][ T5563] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 461.839826][ T1540] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 461.869782][ T2067] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 461.959797][ T20] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 462.199935][ T1540] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 462.210842][ T1540] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 462.220410][ T1540] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 462.229920][ T1540] usb 3-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 462.238827][ T1540] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.248596][ T1540] usb 3-1: config 0 descriptor?? [ 462.252125][ T2067] usb 4-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 462.263657][ T2067] usb 4-1: config 17 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 462.276522][ T2067] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 462.286089][ T2067] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.295184][ T1540] usb 3-1: MIDIStreaming interface descriptor not found [ 462.359989][ T20] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 462.372710][ T20] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 462.384241][ T20] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 462.394578][ T20] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 462.407416][ T20] usb 2-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 462.416597][ T20] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.426166][ T20] usb 2-1: config 0 descriptor?? [ 462.569856][ T2067] usb 4-1: string descriptor 0 read error: -71 [ 462.577459][ T2067] aiptek 4-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 462.587904][ T2067] usb 4-1: USB disconnect, device number 37 [ 462.902318][ T20] hid-picolcd 0003:04D8:C002.0030: unbalanced collection at end of report description [ 462.920502][ T20] hid-picolcd 0003:04D8:C002.0030: device report parse failed [ 462.938404][ T20] hid-picolcd: probe of 0003:04D8:C002.0030 failed with error -22 [ 463.013562][ T423] tipc: Disabling bearer [ 463.018825][ T423] tipc: Left network mode [ 463.018939][ T5569] bridge0: port 1(bridge_slave_0) entered blocking state [ 463.029950][ T5569] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.038045][ T5569] device bridge_slave_0 entered promiscuous mode [ 463.045787][ T5569] bridge0: port 2(bridge_slave_1) entered blocking state [ 463.053250][ T5569] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.061597][ T5569] device bridge_slave_1 entered promiscuous mode [ 463.105169][ T2067] usb 2-1: USB disconnect, device number 45 [ 463.236273][ T5569] bridge0: port 2(bridge_slave_1) entered blocking state [ 463.243220][ T5569] bridge0: port 2(bridge_slave_1) entered forwarding state [ 463.250460][ T5569] bridge0: port 1(bridge_slave_0) entered blocking state [ 463.257366][ T5569] bridge0: port 1(bridge_slave_0) entered forwarding state [ 463.327275][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 463.335700][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.343601][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.363209][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 463.371672][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 463.378559][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 463.394756][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 463.403141][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 463.410446][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 463.433316][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 463.451294][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 463.478822][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 463.502099][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 463.511093][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 463.518761][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 463.531889][ T423] device bridge_slave_1 left promiscuous mode [ 463.538378][ T423] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.547129][ T423] device bridge_slave_0 left promiscuous mode [ 463.553775][ T423] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.563412][ T423] device veth1_macvtap left promiscuous mode [ 463.569293][ T423] device veth0_vlan left promiscuous mode [ 463.596548][ T1540] usb 3-1: USB disconnect, device number 39 [ 463.702138][ T5580] loop2: detected capacity change from 0 to 512 [ 463.763128][ T5580] EXT4-fs (loop2): Test dummy encryption mode enabled [ 463.788340][ T5569] device veth0_vlan entered promiscuous mode [ 463.806176][ T5580] EXT4-fs error (device loop2): __ext4_iget:4903: inode #11: block 1: comm syz.2.1720: invalid block [ 463.820637][ T5580] EXT4-fs error (device loop2): ext4_orphan_get:1402: comm syz.2.1720: couldn't read orphan inode 11 (err -117) [ 463.839888][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 463.850274][ T5580] EXT4-fs (loop2): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 463.864108][ T5569] device veth1_macvtap entered promiscuous mode [ 464.069813][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 464.083902][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 464.397943][ T5586] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.1720: Directory hole found for htree leaf block 0 [ 464.818532][ T5590] hub 8-0:1.0: USB hub found [ 464.919299][ T5590] hub 8-0:1.0: 1 port detected [ 466.149775][ T322] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 466.289765][ T2067] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 466.329752][ T1540] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 466.389802][ T322] usb 3-1: Using ep0 maxpacket: 16 [ 466.509856][ T322] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 466.569774][ T1540] usb 2-1: Using ep0 maxpacket: 16 [ 466.679955][ T322] usb 3-1: New USB device found, idVendor=045e, idProduct=0721, bcdDevice=90.c4 [ 466.689333][ T322] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.697685][ T1540] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 466.710078][ T322] usb 3-1: Product: syz [ 466.714117][ T322] usb 3-1: Manufacturer: syz [ 466.720486][ T1540] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 466.731006][ T322] usb 3-1: SerialNumber: syz [ 466.736535][ T1540] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 466.739878][ T2067] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 466.754925][ T322] usb 3-1: config 0 descriptor?? [ 466.768492][ T2067] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 466.780370][ T2067] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 466.790158][ T2067] usb 4-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 466.799494][ T2067] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.826784][ T2067] usb 4-1: config 0 descriptor?? [ 466.875125][ T2067] usb 4-1: MIDIStreaming interface descriptor not found [ 466.919903][ T1540] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 466.939080][ T1540] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.947428][ T1540] usb 2-1: Product: syz [ 466.951790][ T1540] usb 2-1: Manufacturer: syz [ 466.956332][ T1540] usb 2-1: SerialNumber: syz [ 467.238996][ T5622] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 467.250233][ T322] usb 3-1: Found UVC 0.00 device syz (045e:0721) [ 467.256524][ T322] usb 3-1: No valid video chain found. [ 467.294164][ T5624] loop4: detected capacity change from 0 to 512 [ 467.370575][ T5624] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 467.383748][ T5624] EXT4-fs (loop4): 1 truncate cleaned up [ 467.389258][ T5624] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 467.406687][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 467.406720][ T30] audit: type=1400 audit(1728636598.428:606): avc: denied { setattr } for pid=5623 comm="syz.4.1735" name="file1" dev="loop4" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 467.430150][ T1540] usb 2-1: 0:2 : does not exist [ 467.446460][ T30] audit: type=1400 audit(1728636598.438:607): avc: denied { setattr } for pid=5623 comm="syz.4.1735" name="work" dev="loop4" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 467.468892][ T30] audit: type=1400 audit(1728636598.438:608): avc: denied { remove_name } for pid=5623 comm="syz.4.1735" name="#3" dev="loop4" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 467.492243][ T30] audit: type=1400 audit(1728636598.438:609): avc: denied { rename } for pid=5623 comm="syz.4.1735" name="#3" dev="loop4" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 467.513849][ T30] audit: type=1400 audit(1728636598.438:610): avc: denied { unlink } for pid=5623 comm="syz.4.1735" name="#3" dev="loop4" ino=22 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=chr_file permissive=1 [ 467.536149][ T30] audit: type=1400 audit(1728636598.438:611): avc: denied { unlink } for pid=5623 comm="syz.4.1735" name="#4" dev="loop4" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 467.539632][ T322] usb 3-1: USB disconnect, device number 40 [ 467.558166][ T30] audit: type=1400 audit(1728636598.448:612): avc: denied { read write } for pid=5623 comm="syz.4.1735" name="file1" dev="overlay" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 467.586635][ T30] audit: type=1400 audit(1728636598.448:613): avc: denied { open } for pid=5623 comm="syz.4.1735" path="/7/bus/file0/file1" dev="overlay" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 467.610133][ T30] audit: type=1400 audit(1728636598.448:614): avc: denied { setattr } for pid=5623 comm="syz.4.1735" name="#21" dev="loop4" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 467.632376][ T30] audit: type=1400 audit(1728636598.448:615): avc: denied { link } for pid=5623 comm="syz.4.1735" name="#21" dev="loop4" ino=21 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 467.945870][ T5629] bridge0: port 1(bridge_slave_0) entered blocking state [ 467.953149][ T5629] bridge0: port 1(bridge_slave_0) entered disabled state [ 467.961575][ T5629] device bridge_slave_0 entered promiscuous mode [ 467.970072][ T5629] bridge0: port 2(bridge_slave_1) entered blocking state [ 467.976981][ T5629] bridge0: port 2(bridge_slave_1) entered disabled state [ 467.984913][ T5629] device bridge_slave_1 entered promiscuous mode [ 468.072654][ T5634] loop0: detected capacity change from 0 to 256 [ 468.182476][ T953] device bridge_slave_1 left promiscuous mode [ 468.188784][ T953] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.197155][ T5636] loop2: detected capacity change from 0 to 512 [ 468.197775][ T953] device bridge_slave_0 left promiscuous mode [ 468.209331][ T953] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.220503][ T953] device veth1_macvtap left promiscuous mode [ 468.226421][ T953] device veth0_vlan left promiscuous mode [ 468.232932][ T5636] EXT4-fs (loop2): Test dummy encryption mode enabled [ 468.280995][ T5636] EXT4-fs error (device loop2): __ext4_iget:4903: inode #11: block 1: comm syz.2.1740: invalid block [ 468.300236][ T5636] EXT4-fs error (device loop2): ext4_orphan_get:1402: comm syz.2.1740: couldn't read orphan inode 11 (err -117) [ 468.318950][ T5636] EXT4-fs (loop2): mounted filesystem without journal. Opts: noauto_da_alloc,user_xattr,max_dir_size_kb=0x0000000000000009,inode_readahead_blks=0x0000000000010000,jqfmt=vfsv0,delalloc,inode_readahead_blks=0x0000000000400000,noauto_da_alloc,test_dummy_encryption,,errors=continue. Quota mode: none. [ 468.759659][ T1540] usb 2-1: USB disconnect, device number 46 [ 468.779342][ T5642] EXT4-fs error (device loop2): ext4_add_entry:2484: inode #2: comm syz.2.1740: Directory hole found for htree leaf block 0 [ 469.243678][ T702] udevd[702]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card1/controlC1/../uevent} for writing: No such file or directory [ 469.292602][ T417] usb 4-1: USB disconnect, device number 38 [ 469.621989][ T5652] device veth0_vlan left promiscuous mode [ 469.633637][ T5652] device veth0_vlan entered promiscuous mode [ 469.699865][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 469.707990][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 469.761715][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 469.797879][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 469.824674][ T325] bridge0: port 1(bridge_slave_0) entered blocking state [ 469.831634][ T325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 469.849263][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 469.858311][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 469.867714][ T325] bridge0: port 2(bridge_slave_1) entered blocking state [ 469.874650][ T325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 469.903276][ T325] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 469.934076][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 469.942452][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 469.953219][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 469.961743][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 469.987006][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 469.995630][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 470.013704][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 470.022311][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 470.031324][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 470.039050][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 470.048240][ T5629] device veth0_vlan entered promiscuous mode [ 470.049973][ T417] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 470.068562][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 470.077193][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 470.088192][ T5629] device veth1_macvtap entered promiscuous mode [ 470.103411][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 470.111224][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 470.120366][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 470.132080][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 470.139796][ T302] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 470.140965][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 470.189744][ T1039] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 470.309802][ T417] usb 3-1: Using ep0 maxpacket: 16 [ 470.430228][ T417] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 470.438849][ T417] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 470.449151][ T417] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 470.520018][ T302] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 470.530898][ T302] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 470.540795][ T302] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 470.549928][ T1039] usb 4-1: config index 0 descriptor too short (expected 45, got 36) [ 470.553627][ T302] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 470.562320][ T20] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 470.570799][ T302] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.577996][ T1039] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 470.587942][ T302] usb 2-1: config 0 descriptor?? [ 470.597672][ T1039] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 470.612489][ T1039] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 470.625629][ T1039] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 470.634834][ T1039] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.644503][ T1039] usb 4-1: config 0 descriptor?? [ 470.650167][ T417] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 470.659295][ T417] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.660073][ T5661] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 470.669764][ T417] usb 3-1: Product: syz [ 470.678215][ T417] usb 3-1: Manufacturer: syz [ 470.682946][ T417] usb 3-1: SerialNumber: syz [ 470.949921][ T20] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 470.961298][ T20] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 470.971630][ T20] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 470.985062][ T20] usb 5-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.10 [ 470.994442][ T20] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.004291][ T20] usb 5-1: config 0 descriptor?? [ 471.092158][ T302] plantronics 0003:047F:FFFF.0031: unknown main item tag 0x0 [ 471.101652][ T302] plantronics 0003:047F:FFFF.0031: No inputs registered, leaving [ 471.119948][ T302] plantronics 0003:047F:FFFF.0031: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 471.124059][ T1039] plantronics 0003:047F:FFFF.0032: unknown main item tag 0xd [ 471.154255][ T1039] plantronics 0003:047F:FFFF.0032: No inputs registered, leaving [ 471.160026][ T417] usb 3-1: 0:2 : does not exist [ 471.174612][ T1039] plantronics 0003:047F:FFFF.0032: hiddev97,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 471.492909][ T20] prodikeys 0003:041E:2801.0033: unexpected long global item [ 471.500709][ T20] prodikeys 0003:041E:2801.0033: hid parse failed [ 471.507133][ T20] prodikeys: probe of 0003:041E:2801.0033 failed with error -22 [ 471.725265][ T302] usb 5-1: USB disconnect, device number 33 [ 472.254160][ T417] usb 3-1: USB disconnect, device number 41 [ 472.274506][ T702] udevd[702]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 472.491578][ T302] usb 4-1: USB disconnect, device number 39 [ 472.536741][ T5695] device sit0 entered promiscuous mode [ 472.545654][ T5695] netlink: 'syz.2.1761': attribute type 1 has an invalid length. [ 472.554800][ T5695] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1761'. [ 472.569969][ T1039] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 472.743040][ T5705] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1765'. [ 472.819860][ T1039] usb 5-1: Using ep0 maxpacket: 16 [ 473.049889][ T1228] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 473.099954][ T1039] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 473.123551][ T1039] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 473.134385][ T1039] usb 5-1: Product: syz [ 473.138415][ T1039] usb 5-1: Manufacturer: syz [ 473.143841][ T1039] usb 5-1: SerialNumber: syz [ 473.158275][ T1039] r8152-cfgselector 5-1: config 0 descriptor?? [ 474.203738][ T20] usb 2-1: USB disconnect, device number 47 [ 474.231992][ T1039] r8152-cfgselector 5-1: Unknown version 0x0000 [ 474.239245][ T1039] r8152-cfgselector 5-1: bad CDC descriptors [ 474.259945][ T1039] r8152-cfgselector 5-1: Unknown version 0x0000 [ 474.267748][ T1039] r8152-cfgselector 5-1: USB disconnect, device number 34 [ 474.309873][ T1228] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 474.329758][ T1228] usb 3-1: New USB device found, idVendor=04b4, idProduct=de61, bcdDevice= 0.00 [ 474.349763][ T1228] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.359106][ T1228] usb 3-1: config 0 descriptor?? [ 474.889747][ T1039] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 475.024200][ T1228] cypress 0003:04B4:DE61.0034: item fetching failed at offset 0/3 [ 475.103143][ T1228] cypress 0003:04B4:DE61.0034: parse failed [ 475.178694][ T1228] cypress: probe of 0003:04B4:DE61.0034 failed with error -22 [ 475.424910][ T1039] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 475.443174][ T1228] usb 3-1: USB disconnect, device number 42 [ 475.449140][ T1039] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 475.464437][ T1039] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 475.474483][ T1039] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 475.487791][ T1039] usb 5-1: New USB device found, idVendor=044f, idProduct=b653, bcdDevice= 0.00 [ 475.497877][ T1039] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.507484][ T1039] usb 5-1: config 0 descriptor?? [ 475.982307][ T1039] thrustmaster 0003:044F:B653.0035: unbalanced delimiter at end of report description [ 475.996126][ T1039] thrustmaster 0003:044F:B653.0035: parse failed [ 475.999759][ T322] usb 4-1: new full-speed USB device number 40 using dummy_hcd [ 476.003287][ T1039] thrustmaster: probe of 0003:044F:B653.0035 failed with error -22 [ 476.120445][ T5754] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1785'. [ 476.220840][ T30] audit: type=1400 audit(1728636607.248:616): avc: denied { compute_member } for pid=5757 comm="syz.2.1787" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 476.229313][ T302] usb 5-1: USB disconnect, device number 35 [ 476.356425][ T5762] loop2: detected capacity change from 0 to 256 [ 476.419863][ T322] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 476.435545][ T322] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 476.594115][ T5766] loop1: detected capacity change from 0 to 256 [ 477.060123][ T1039] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 477.333397][ T322] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 477.349775][ T322] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 477.357929][ T322] usb 4-1: SerialNumber: syz [ 477.418816][ T5749] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 477.519847][ T1039] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 477.530850][ T1039] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 477.542321][ T1039] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 477.552462][ T1039] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 477.566052][ T1039] usb 3-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 477.575312][ T1039] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 477.592237][ T1039] usb 3-1: config 0 descriptor?? [ 477.662658][ T5749] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 477.709831][ T1540] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 477.959787][ T1540] usb 2-1: Using ep0 maxpacket: 8 [ 477.999822][ T20] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 478.091894][ T1039] hid-picolcd 0003:04D8:C002.0036: unbalanced collection at end of report description [ 478.102105][ T1039] hid-picolcd 0003:04D8:C002.0036: device report parse failed [ 478.109665][ T1039] hid-picolcd: probe of 0003:04D8:C002.0036 failed with error -22 [ 478.110436][ T1540] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 478.125778][ T1540] usb 2-1: config 179 has no interface number 0 [ 478.135770][ T322] cdc_ether 4-1:1.0 wwan0: register 'cdc_ether' at usb-dummy_hcd.3-1, Mobile Broadband Network Device, 42:42:42:42:42:42 [ 478.148791][ T1540] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 478.163368][ T1540] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 478.174814][ T1540] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 478.187047][ T1540] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 478.198464][ T1540] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 478.211942][ T1540] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice= 0.00 [ 478.221007][ T1540] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.269821][ T5770] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 478.297396][ T417] usb 3-1: USB disconnect, device number 43 [ 478.354455][ T322] usb 4-1: USB disconnect, device number 40 [ 478.359908][ T20] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 478.365061][ T322] cdc_ether 4-1:1.0 wwan0: unregister 'cdc_ether' usb-dummy_hcd.3-1, Mobile Broadband Network Device [ 478.379743][ T20] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 478.391667][ T20] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 478.400896][ T20] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.411350][ T20] usb 5-1: config 0 descriptor?? [ 478.552766][ T417] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input36 [ 478.744465][ T1228] usb 2-1: USB disconnect, device number 48 [ 478.759823][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 478.768037][ T1228] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 478.892196][ T20] pyra 0003:1E7D:2CF6.0037: item fetching failed at offset 5/7 [ 478.900239][ T20] pyra 0003:1E7D:2CF6.0037: parse failed [ 478.905780][ T20] pyra: probe of 0003:1E7D:2CF6.0037 failed with error -22 [ 479.124921][ T322] usb 5-1: USB disconnect, device number 36 [ 479.400567][ T5827] loop1: detected capacity change from 0 to 256 [ 479.467213][ T5827] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x72685a33, utbl_chksum : 0xe619d30d) [ 479.479943][ T60] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 479.505356][ T30] audit: type=1400 audit(1728636610.528:617): avc: denied { remove_name } for pid=5826 comm="syz.1.1805" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop1" ino=1048765 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 479.550424][ T30] audit: type=1400 audit(1728636610.528:618): avc: denied { rename } for pid=5826 comm="syz.1.1805" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop1" ino=1048765 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 479.600811][ T30] audit: type=1400 audit(1728636610.528:619): avc: denied { unlink } for pid=5826 comm="syz.1.1805" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="loop1" ino=1048766 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 479.645236][ T302] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 479.879779][ T302] usb 3-1: Using ep0 maxpacket: 8 [ 479.950219][ T60] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 479.961501][ T1228] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 479.969359][ T60] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 479.979918][ T417] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 479.982748][ T60] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 479.998989][ T60] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.000751][ T302] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 480.010054][ T60] usb 4-1: config 0 descriptor?? [ 480.100037][ T302] usb 3-1: New USB device found, idVendor=05ac, idProduct=8501, bcdDevice=20.9d [ 480.109250][ T302] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=105 [ 480.117635][ T302] usb 3-1: SerialNumber: syz [ 480.123798][ T302] usb 3-1: config 0 descriptor?? [ 480.161169][ T302] usb 3-1: Found UVC 0.00 device (05ac:8501) [ 480.167950][ T302] usb 3-1: No valid video chain found. [ 480.339867][ T1228] usb 5-1: config index 0 descriptor too short (expected 45, got 36) [ 480.348047][ T1228] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 480.349892][ T417] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 480.360035][ T1228] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 480.381975][ T1228] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 480.384460][ T417] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 480.397033][ T1228] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 480.404831][ T417] usb 2-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 480.414240][ T1228] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.422939][ T417] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.440030][ T302] usb 3-1: USB disconnect, device number 44 [ 480.440060][ T1228] usb 5-1: config 0 descriptor?? [ 480.447876][ T417] usb 2-1: config 0 descriptor?? [ 480.480393][ T5829] raw-gadget.3 gadget: fail, usb_ep_enable returned -22 [ 480.502141][ T60] plantronics 0003:047F:FFFF.0038: unknown main item tag 0x0 [ 480.512381][ T60] plantronics 0003:047F:FFFF.0038: No inputs registered, leaving [ 480.523338][ T60] plantronics 0003:047F:FFFF.0038: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 480.810244][ T1540] usb 4-1: USB disconnect, device number 41 [ 480.942489][ T417] zydacron 0003:13EC:0006.0039: unknown main item tag 0x0 [ 480.942662][ T1228] plantronics 0003:047F:FFFF.003A: unknown main item tag 0xd [ 480.949598][ T417] zydacron 0003:13EC:0006.0039: unknown main item tag 0x0 [ 480.949662][ T417] zydacron 0003:13EC:0006.0039: unknown main item tag 0x0 [ 480.971150][ T417] zydacron 0003:13EC:0006.0039: unknown main item tag 0x0 [ 480.978351][ T417] zydacron 0003:13EC:0006.0039: item fetching failed at offset 4/5 [ 480.989832][ T1228] plantronics 0003:047F:FFFF.003A: No inputs registered, leaving [ 481.000848][ T417] zydacron 0003:13EC:0006.0039: parse failed [ 481.006976][ T417] zydacron: probe of 0003:13EC:0006.0039 failed with error -22 [ 481.020568][ T1228] plantronics 0003:047F:FFFF.003A: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 481.206780][ T5836] loop2: detected capacity change from 0 to 40427 [ 481.242546][ T417] usb 2-1: USB disconnect, device number 49 [ 481.280398][ T5836] F2FS-fs (loop2): Small segment_count (9 < 1 * 24) [ 481.286994][ T5836] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 481.300995][ T60] usb 5-1: USB disconnect, device number 37 [ 481.301118][ T5836] F2FS-fs (loop2): Found nat_bits in checkpoint [ 481.420676][ T5836] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 481.427698][ T5836] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 481.526724][ T1303] attempt to access beyond end of device [ 481.526724][ T1303] loop2: rw=2049, want=45112, limit=40427 [ 481.829532][ T5848] loop1: detected capacity change from 0 to 256 [ 482.229840][ T302] usb 5-1: new full-speed USB device number 38 using dummy_hcd [ 482.290105][ T417] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 482.557052][ T5872] syz.3.1824[5872] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 482.557215][ T5872] syz.3.1824[5872] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 482.590178][ T302] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 482.615508][ T302] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 255, setting to 64 [ 482.626702][ T302] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 482.649858][ T302] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 482.660096][ T417] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 482.678408][ T302] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.686874][ T1540] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 482.694501][ T417] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 482.707277][ T302] usb 5-1: config 0 descriptor?? [ 482.712326][ T417] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 482.723062][ T417] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 482.736796][ T417] usb 2-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 482.746313][ T5854] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 482.753835][ T417] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.765707][ T5876] netlink: 'syz.3.1826': attribute type 46 has an invalid length. [ 482.774730][ T417] usb 2-1: config 0 descriptor?? [ 482.780147][ T322] ================================================================== [ 482.788206][ T322] BUG: KASAN: use-after-free in __list_del_entry_valid+0x2f/0x120 [ 482.795942][ T322] Read of size 8 at addr ffff888128fbd888 by task kworker/1:3/322 [ 482.803714][ T322] [ 482.805883][ T322] CPU: 1 PID: 322 Comm: kworker/1:3 Not tainted 5.15.167-syzkaller-02003-g5e4635681cf1 #0 [ 482.815606][ T322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 482.825514][ T322] Workqueue: events binder_deferred_func [ 482.830965][ T322] Call Trace: [ 482.834196][ T322] [ 482.837046][ T322] dump_stack_lvl+0x151/0x1c0 [ 482.840105][ T5876] netlink: 'syz.3.1826': attribute type 46 has an invalid length. [ 482.842313][ T322] ? io_uring_drop_tctx_refs+0x190/0x190 [ 482.855603][ T322] ? panic+0x760/0x760 [ 482.859623][ T322] ? kasan_quarantine_put+0x34/0x1a0 [ 482.865000][ T322] print_address_description+0x87/0x3b0 [ 482.870381][ T322] kasan_report+0x179/0x1c0 [ 482.874722][ T322] ? _raw_spin_lock+0xa4/0x1b0 [ 482.879415][ T322] ? __list_del_entry_valid+0x2f/0x120 [ 482.884709][ T322] ? __list_del_entry_valid+0x2f/0x120 [ 482.890007][ T322] __asan_report_load8_noabort+0x14/0x20 [ 482.895470][ T322] __list_del_entry_valid+0x2f/0x120 [ 482.900692][ T322] binder_release_work+0xcd/0x680 [ 482.905646][ T322] binder_deferred_func+0x1847/0x1bc0 [ 482.910850][ T322] ? read_word_at_a_time+0x12/0x20 [ 482.916007][ T322] process_one_work+0x6bb/0xc10 [ 482.920709][ T322] worker_thread+0xad5/0x12a0 [ 482.925215][ T322] kthread+0x421/0x510 [ 482.929101][ T322] ? worker_clr_flags+0x180/0x180 [ 482.934049][ T322] ? kthread_blkcg+0xd0/0xd0 [ 482.938484][ T322] ret_from_fork+0x1f/0x30 [ 482.943307][ T322] [ 482.946209][ T322] [ 482.948378][ T322] Allocated by task 5874: [ 482.952657][ T322] ____kasan_kmalloc+0xdb/0x110 [ 482.957431][ T322] __kasan_kmalloc+0x9/0x10 [ 482.961903][ T322] kmem_cache_alloc_trace+0x115/0x210 [ 482.967195][ T322] binder_thread_write+0x9f5/0x6ec0 [ 482.972237][ T322] binder_ioctl_write_read+0x205/0x7300 [ 482.977763][ T322] binder_ioctl+0x371/0x2640 [ 482.982269][ T322] __se_sys_ioctl+0x114/0x190 [ 482.986798][ T322] __x64_sys_ioctl+0x7b/0x90 [ 482.991209][ T322] x64_sys_call+0x98/0x9a0 [ 482.995450][ T322] do_syscall_64+0x3b/0xb0 [ 482.999713][ T322] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 483.005494][ T322] [ 483.007635][ T322] Freed by task 322: [ 483.011335][ T322] kasan_set_track+0x4b/0x70 [ 483.015779][ T322] kasan_set_free_info+0x23/0x40 [ 483.020748][ T322] ____kasan_slab_free+0x126/0x160 [ 483.025771][ T322] __kasan_slab_free+0x11/0x20 [ 483.030450][ T322] slab_free_freelist_hook+0xbd/0x190 [ 483.035800][ T322] kfree+0xc8/0x220 [ 483.039448][ T322] binder_free_ref+0x128/0x260 [ 483.044297][ T322] binder_deferred_func+0x171c/0x1bc0 [ 483.050213][ T322] process_one_work+0x6bb/0xc10 [ 483.055553][ T322] worker_thread+0xad5/0x12a0 [ 483.060072][ T322] kthread+0x421/0x510 [ 483.064053][ T322] ret_from_fork+0x1f/0x30 [ 483.068326][ T322] [ 483.070493][ T322] Last potentially related work creation: [ 483.076031][ T322] kasan_save_stack+0x3b/0x60 [ 483.080639][ T322] __kasan_record_aux_stack+0xd3/0xf0 [ 483.085840][ T322] kasan_record_aux_stack_noalloc+0xb/0x10 [ 483.091481][ T322] insert_work+0x56/0x320 [ 483.095787][ T322] __queue_work+0x92a/0xcd0 [ 483.100121][ T322] queue_work_on+0x105/0x170 [ 483.104562][ T322] nfc_genl_rcv_nl_event+0x199/0x220 [ 483.109943][ T322] blocking_notifier_call_chain+0xbb/0x140 [ 483.115860][ T322] netlink_release+0xf74/0x16f0 [ 483.120596][ T322] sock_close+0xdf/0x270 [ 483.125032][ T322] __fput+0x228/0x8c0 [ 483.128834][ T322] ____fput+0x15/0x20 [ 483.132657][ T322] task_work_run+0x129/0x190 [ 483.137265][ T322] exit_to_user_mode_loop+0xc4/0xe0 [ 483.142300][ T322] exit_to_user_mode_prepare+0x5a/0xa0 [ 483.147603][ T322] syscall_exit_to_user_mode+0x26/0x160 [ 483.153116][ T322] do_syscall_64+0x47/0xb0 [ 483.157371][ T322] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 483.163157][ T322] [ 483.165321][ T322] The buggy address belongs to the object at ffff888128fbd880 [ 483.165321][ T322] which belongs to the cache kmalloc-64 of size 64 [ 483.179040][ T322] The buggy address is located 8 bytes inside of [ 483.179040][ T322] 64-byte region [ffff888128fbd880, ffff888128fbd8c0) [ 483.192098][ T322] The buggy address belongs to the page: [ 483.197550][ T322] page:ffffea0004a3ef40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x128fbd [ 483.207619][ T322] flags: 0x4000000000000200(slab|zone=1) [ 483.213091][ T322] raw: 4000000000000200 ffffea00048eccc0 0000000f0000000f ffff888100042780 [ 483.221510][ T322] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 [ 483.229905][ T322] page dumped because: kasan: bad access detected [ 483.236159][ T322] page_owner tracks the page as allocated [ 483.241732][ T322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 388, ts 41004637272, free_ts 0 [ 483.256878][ T322] post_alloc_hook+0x1a3/0x1b0 [ 483.261476][ T322] prep_new_page+0x1b/0x110 [ 483.265899][ T322] get_page_from_freelist+0x3550/0x35d0 [ 483.271284][ T322] __alloc_pages+0x27e/0x8f0 [ 483.275710][ T322] new_slab+0x9a/0x4e0 [ 483.279623][ T322] ___slab_alloc+0x39e/0x830 [ 483.284142][ T322] __slab_alloc+0x4a/0x90 [ 483.288375][ T322] __kmalloc+0x16d/0x270 [ 483.292473][ T322] kvmalloc_node+0x1f0/0x4d0 [ 483.296886][ T322] f2fs_build_node_manager+0xf2f/0x2180 [ 483.302268][ T322] f2fs_fill_super+0x6348/0x8170 [ 483.307040][ T322] mount_bdev+0x282/0x3b0 [ 483.311212][ T322] f2fs_mount+0x34/0x40 [ 483.315289][ T322] legacy_get_tree+0xf1/0x190 [ 483.319803][ T322] vfs_get_tree+0x88/0x290 [ 483.324057][ T322] do_new_mount+0x2ba/0xb30 [ 483.328526][ T322] page_owner free stack trace missing [ 483.333693][ T322] [ 483.335852][ T322] Memory state around the buggy address: [ 483.341334][ T322] ffff888128fbd780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 483.349233][ T322] ffff888128fbd800: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 483.357312][ T322] >ffff888128fbd880: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 483.365200][ T322] ^ [ 483.369371][ T322] ffff888128fbd900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 483.377274][ T322] ffff888128fbd980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 483.385333][ T322] ================================================================== [ 483.393331][ T322] Disabling lock debugging due to kernel taint [ 483.400419][ T322] general protection fault, probably for non-canonical address 0xf83bfc50e0000028: 0000 [#1] PREEMPT SMP KASAN [ 483.412025][ T322] KASAN: maybe wild-memory-access in range [0xc1e0028700000140-0xc1e0028700000147] [ 483.421290][ T322] CPU: 1 PID: 322 Comm: kworker/1:3 Tainted: G B 5.15.167-syzkaller-02003-g5e4635681cf1 #0 [ 483.432390][ T322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 483.442338][ T322] Workqueue: events binder_deferred_func [ 483.447876][ T322] RIP: 0010:__list_del_entry_valid+0x75/0x120 [ 483.453784][ T322] Code: 1e 48 85 db 74 68 4d 85 ff 74 74 48 ba 00 01 00 00 00 00 ad de 48 39 d3 74 76 48 83 c2 22 49 39 d7 74 7e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 cc 90 48 ff 49 8b 17 4c 39 f2 75 [ 483.473312][ T322] RSP: 0018:ffffc900055b7c00 EFLAGS: 00010a06 [ 483.479307][ T322] RAX: 183c0050e0000028 RBX: ffff888107788900 RCX: ffffffff826a1859 [ 483.487201][ T322] RDX: dead000000000122 RSI: 0000000000000282 RDI: ffff888128fbd880 [ 483.495398][ T322] RBP: ffffc900055b7c20 R08: ffffffff8141997b R09: 0000000000000003 [ 483.503202][ T322] R10: fffffbfff0e9a04c R11: dffffc0000000001 R12: dffffc0000000000 [ 483.511020][ T322] R13: ffff888128fbd880 R14: ffff888128fbd880 R15: c1e0028700000142 [ 483.518915][ T322] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 483.527693][ T322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 483.534190][ T322] CR2: 00007f83a9fcef98 CR3: 000000011e5fd000 CR4: 00000000003506a0 [ 483.542119][ T322] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 483.550206][ T322] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 483.558016][ T322] Call Trace: [ 483.561243][ T322] [ 483.564023][ T322] ? __die_body+0x62/0xb0 [ 483.568191][ T322] ? die_addr+0x9f/0xd0 [ 483.572181][ T322] ? exc_general_protection+0x311/0x4b0 [ 483.577576][ T322] ? check_panic_on_warn+0x65/0xb0 [ 483.582512][ T322] ? asm_exc_general_protection+0x27/0x30 [ 483.588069][ T322] ? check_panic_on_warn+0x5b/0xb0 [ 483.593136][ T322] ? __list_del_entry_valid+0x49/0x120 [ 483.598404][ T322] ? __list_del_entry_valid+0x75/0x120 [ 483.603900][ T322] binder_release_work+0xcd/0x680 [ 483.608753][ T322] binder_deferred_func+0x1847/0x1bc0 [ 483.613970][ T322] ? read_word_at_a_time+0x12/0x20 [ 483.619261][ T322] process_one_work+0x6bb/0xc10 [ 483.623963][ T322] worker_thread+0xad5/0x12a0 [ 483.628483][ T322] kthread+0x421/0x510 [ 483.632443][ T322] ? worker_clr_flags+0x180/0x180 [ 483.637406][ T322] ? kthread_blkcg+0xd0/0xd0 [ 483.641947][ T322] ret_from_fork+0x1f/0x30 [ 483.646393][ T322] [ 483.649272][ T322] Modules linked in: [ 483.654117][ T322] ---[ end trace 02e3afbc6319c609 ]--- [ 483.659440][ T322] RIP: 0010:__list_del_entry_valid+0x75/0x120 [ 483.665384][ T322] Code: 1e 48 85 db 74 68 4d 85 ff 74 74 48 ba 00 01 00 00 00 00 ad de 48 39 d3 74 76 48 83 c2 22 49 39 d7 74 7e 4c 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 ff e8 cc 90 48 ff 49 8b 17 4c 39 f2 75 [ 483.684985][ T322] RSP: 0018:ffffc900055b7c00 EFLAGS: 00010a06 [ 483.691157][ T322] RAX: 183c0050e0000028 RBX: ffff888107788900 RCX: ffffffff826a1859 [ 483.699197][ T322] RDX: dead000000000122 RSI: 0000000000000282 RDI: ffff888128fbd880 [ 483.707202][ T322] RBP: ffffc900055b7c20 R08: ffffffff8141997b R09: 0000000000000003 [ 483.715194][ T322] R10: fffffbfff0e9a04c R11: dffffc0000000001 R12: dffffc0000000000 [ 483.723283][ T322] R13: ffff888128fbd880 R14: ffff888128fbd880 R15: c1e0028700000142 [ 483.731169][ T322] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 483.740121][ T322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 483.746582][ T322] CR2: 00007f83a9fcef98 CR3: 000000011e5fd000 CR4: 00000000003506a0 [ 483.754454][ T322] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 483.762256][ T322] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 483.770101][ T322] Kernel panic - not syncing: Fatal exception [ 483.776224][ T322] Kernel Offset: disabled [ 483.780399][ T322] Rebooting in 86400 seconds..