Extracting prog: 1m55.163810569s Minimizing prog: 169.988µs Simplifying prog options: 0s Extracting C: 37.170748466s Simplifying C: 5m22.941064175s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bcachefs detailed listing: executing program 0: syz_mount_image$bcachefs(&(0x7f0000005b00), &(0x7f0000005b40)='./file2\x00', 0x0, &(0x7f00000003c0)={[{@metadata_checksum={'metadata_checksum', 0x3d, 'none'}}, {@data_checksum={'data_checksum', 0x3d, 'xxhash'}}, {@reconstruct_alloc}, {@str_hash={'str_hash', 0x3d, 'crc32c'}}, {@version_upgrade={'version_upgrade', 0x3d, 'none'}}], [{@subj_type={'subj_type', 0x3d, '/(/{'}}, {@obj_user={'obj_user', 0x3d, '\x00'}}, {@smackfshat={'smackfshat', 0x3d, 'crc32c'}}]}, 0x1, 0x5b2d, &(0x7f000000b6c0)="$eJzs3Q2MXWXdIPBz7p2ZznTaMkWBWj46QOkWVmBKcYEG48BGwNUighYVpK10Wgb7AZ3WQhVbSESDLNtkN8qaSAjRhA0huEvW9WNNMYuYlTU2cdni7vpiQPPK+wZrELQvJfbNzD3nzr1nznPPnXvvlBZ+v8Cce8597v95/s955sw5zz29NwIAAOAd4Zkvj/3l6oUf/Pk9I6/vuuqHm+6O+ssT23vTAgPJ8o63qoUcSbO6Fkwss+Niz3DPMx+4/yPPf+sz33nxpflLl3371isO3T5n5X33Df/qokO/+NtdRXHT8XT25Hr8ShxFp/5y6dfv/emzJ41vi6MoKscDu6Noflz6yfw4E2LojSiK1lXbWf/kk68vXz++3P21WXXbj8sEMd7f2XqTcfaVH2855Q/nXfH83l9f/vpQ7xtbd08WiXtrxlMUzVtT+/ruKIr6osmhmY62BemLk+U1URQN17zu4oJ2ndFk+88NrC9Mlj3Jsr8gTvr86Zn17ibb0ZVZ9jb5ulaVZjh+Kt1/c2a4/uzBLVvP/GT5vWR59jTjl9P/46gUR13V6jbGk2MkqtlvcRRP7PvJ9VLdWIgzYyOOojizXsqsl7szeU3Umwy0chzXb0/LZbYPJtu7ku2n5+ybWtcFtr8nzTf5RT2YyT87gPunPKjmNSFt128btOVIKNUcg/K2p+3tTXZGf7KtPz5+ymsO50ifW/XSA0+8uPOhxQOBdsTfjZP4cUvxn9t0yf4lO39zYEEo/ppSEr/UUvyx8159/OVrf3ZSMP6eNH65pfgvXLjkGz/ateNgsH/+lPZPV0vxyyvOObTsnqFVwfY/nMbvbSn+I5c/9s1573v68WD7h9L+6Wutf0a3v3nDoyccCMaP0vizW4p/2WsnnrViy2MbgvGfSvunv6X4z46Nrrz3lkU7BkPx96Xx57YU/4zf3XjD3v0jLwTbP5z2z0BL8d+/+LJrVh7YfH/o73S8+0j9hQV4e3pXco711WS91evMdtVcLzw4EFfO+eYk/8/tZEUZ4/XMSx53zWA9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALyzPDKwbuRvPzjtza5kfVby4LRyZZlu74miuC+KorFta7duG928YfDWLdu3bl67cXDttsGRzdu23jl44XsHt47ctnHtnePPDp27vPK646O4soxPnVL34cOHD5cG6rel9X3uon//5OBp+/9vFA2d8KvTuoLt/+hdC//1/JyfGfHw4Y3/7qybXp7zP7dXNgwk7RoItCsKtOvSR19Z8Ycf9v3bKBo6sVG7/n7plT+ta9DEhsk4idKsqDTxYFY8O7cd1VYn7Un7q2v96MaRoeL+LQfy+P3B//KJHWM37670b28wjyb7t2/48F83f/+pmy/deU1lw9G634v6O80ibV/af71Jf89L8poXyKsrkNe9Z53+d//nP256ZXc01PXnRVPrLsqrOxkA3fF7mqo3rWF2XN8nvUn5dI+nrzt/26bbzh+7c+e5o5vWbhjZMLJ5+fLlF1+4/IKLLvhX50+kXvnZsfzT+v9Fk/kfmfG05aLh0fRnc+OpqF1F/THeruL+qG1R6Pfv3R+/8v/d/V/3XFvZUDTO09LV40mynD2+m5dFNeNtal/l5VXUD92BfthwXf9/em1wyz8VHYdq90ztz4x4+PCfR//XB+bsPfOmyoYjcpyvbVCLx/lqq5P2dNced5Ydvf07KyonefXntuvMe1795P/+QTxYbV9PT3TH2m3bti6r/DxCeb37ui92Nq+Ll/zj7TvX3D1/Sl4XVH7OSVo6Jz45t13ZrWleiyZ+lqOkW9JF1FvKz687qrQv+3chfV22V/uT5/rj43PzykqfW/XSA0+8uPOhxaGejr9bqbEvmltZxqcESm7MvLBcbXBe/UXjI4qiNbXb0n586vv/YXDvz+dvKhwflZEx5Wc2veHDX7pkzu/Hrt+3srLhyBxXahrU4nGl2urJ9kz018Rx5YKjJ4+3bj/X/WLFw4f3nvLeDcv/+7bk176of6ul8/p3eRQVHQcWZdZn6jiQrWeyfH68wcx6f1Ru6bjxwoVLvvGjXTsOBo8bf2r2uPHFurVym8eNODCe9n/pP//1C/uf+1DnjhsfWlL+9P9ftDzp0KPl9603Gde9gXFdbXXSnrh2XJ9385aN6yrbj97z32RZcP2T/v0eu3Pn59Zu3Diyday5vJo9L0nryfZyq+cl6W/f8QV5pftrMq+Ze9BMfzX7+5a2f122v1r8fYM8/VHc0t+z5zZdsn/Jzt8cGAjEjdeUkvilluKPnffq4y9f+7OTgvH3pPG7WopfXnHOoWX3DK0Kxn84TuL3thT/kcsf++a89z39eDD+UNr+vtbOJ0a3v3nDoyeE+z9K4/e3FP/ZsdGV996yaEcw/r44qWf83C6Knnx9+frKehx1J8fhtB3dde2KsutxZr2UWS/Xrpcqc/DVCspxXL89LZdsP72mLXmuD2xPzx57F1SWB9P1KPug8fajTanmnCBve9H5NQC8naTv/6fnGun7/4uSP4g17/9XlnFP3esXJOdTCyY3TVzn3T1Y+UM63Xm9tB3Zeb00/tIz62O0Oq9XNC93RmY9bdeipFfS9jQ4b5gTNTEvN7WexvNymfSL580Gv5rZ0DUxtxfab93JTEXe+8yZ9s4Zj9DuefaC/FZXz7ND4y4735G+Tx83Oe6y90Wk+zd7X0Qaf2FmAq3V+yLaHXfptEaDcTeRWfF86tRxETXo18lxkR8tOy6mMY4GKuNoZt+XOvav92d2/t18QiB+8nfkaL/eT7enx4euJucBVgW2d2oeID1cpO36bYO2HAnmAQBg8vo/PacYv/4f/1s9mDnPL7puyV5lpPGC97GU89tTdP079X622S2d91322olnrdjy2IbgefFTzd6Xclvd2uyC+1KK+nFxZr2wHwO3ghTNOyzJlO+P5rbUj2f87sYb9u4feSHYj8OVE6niftxTtza3zX5cmlkv7Mfu/FYV9WO2nqLxe3ZmvT+5I2i6/f7+xZdds/LA5vuD/b672X5/uG5toKDfXacH4h/r1+nfiZL4x/Z1+kzPR75l8wDJvPVMzQNcF9g+3XmA/ikPqnlNOObmAQJ/FwDgWJZe/1fvl0+u//9Hply714fB87bhztzPGjxvq77/1N55ebD91fPy9q6LgvGr10XtXbcE+6d63dLedVcwfvW6q715mmD/PJX2T3vn/aF/LpCe9x/710UzO8/guihZj7IPKlwXAQBwNEiv/9PT1fT+/6eT9ey58cxf5870dehMX0fP9DzDTM+THOvXucf6PMNMz7O9VfMAPcnz5gHqH1TzmmAeAACATvpgsrypyfJdE/cQR9Fnb77lgtXrRj6/ev3WkZGx29bePLJ6dPPotmq57okrr6n3SYfqK7pPOq/87AblVwfj17fnikD5kHbzD9VXlH9e+Ub5rwnGr2/PlYHyIe3mH6qvKP+88o3yXxuMX9+eqwLlQ9rNP1RfUf555Rvl/9lg/Pr2fChQPqTd/EP1FeWfV75R/jcH49e3598Eyoe0m3+ovqL888o3yj/7eZmh/D8cKB/Sbv6h+oryzyvfKP+RYPz69nwkUD6k3fxD9RXln1e+Uf7rg/Hr27MyUD6k3fxD9RXln1e+Uf4bgvHr23N1oHxIu/mH6ivKP698o/xvCcavb89HA+VD2s0/VF9R/nnlG+U/Goxf355rAuVD2s0/VF9R/nnl6/Lvq3/+1mD8+vZ8LFA+pN38Q/UV5Z9XvtH+/1wwfn17rg2UD2k3/1B9RfnnlW+U/8Zg/Pr2XBcoH9Ju/qH6ivLPK98o/03B+PXt+XigfEi7+YfqK8o/r3yj/DcH49e35xOB8iHt5h+qryj/vPKN8t8SjF/fnlWB8iGZ/OPk9oim8w/VV5R/XvlG+d8WjF/fnusD5UPa3f+h+oryzyvfKP/bg/Hr2/PJQPmQvPzTtzybyT9UX1H+eeUb5b81GL++PZ8KlA9pd/+H6ivKP698o/zHgvHr2/PpQPmQdvMP1VeUf175RvlvC8avb88NgfIh7eYfqq8o/7zyjfLfHoxf354bA+VD2s0/VF9R/nnlG+X/+WD8+vZ8JlA+pN38Q/UV5Z9XvlH+O4Lx69tzU6B8SLv5h+oryj+vfKP87wjGr2/P6kD5kGr+27aOjKzeftu6tdtGVm/esm5kbPWOraPbto0kJ2rt3pcYvK8suS+xO+pqmP/CzPpxyecDHRf4fKBs+TTsyRMPpn4+ULbaroLPySnaX9n6iz5nKK983ngL7d+i40Gz4yGr7vejMkhGN4+NbJ16/O5r2B+1YyKauG2uMsHRG5/YVPnsx3UGqinUfD69DfPJbp6V3Ag4Kz6hqfJR4Pvgpqv5fOJgPnntmO732KVhp/U9dpkfU+R8RmtdvuvHJg7So2s3ju4cmdr+2UdB+9+afixNaUfR/o8z7ZiftGR+6PveAu3e8b1/eOSPf/xvH46ioRPKp7TVf/Hw4TUHT/zsLy+ddf54+0sN218tmX6vcsH3H2bLp/l0bdwytu1frt+yfXP+O2jp/c6l6voM3e+c5Flu8v7l0P0e071/OZ7y4OjU7P3LAAAA7xTpv/9Pr1cXJP8GdX5miqD5eeD2/n10cB54X3PzwNnZiKJ54Gz5NO1m54H725wHztYfmqctNSjf6H2XZueBPx0oP13Nj5P2PgcgOE6SnioaJ9l/h180TrLlpztO+tocJ9n6i8ZJXvlG7083O06uD5QPaX48tPe5E8HxMNTceMh+r2bReMiWn+546G1zPGTrLxoPeeUb3a/T7Hj4eKB8s5ofH+19LkxwfKxpbnxkvy+laHxky093fMRtjo9s/UXjI698o/sZmx0fHwuUTzW//9v73J7g/t/T3P7Pfm9L0f7Plp/u/i+1uf+z9Rft/7zyje7nbnb/Xx0on6rf/+M7fmK/j6zesWVr7T3QTe7/ntD+L/relpDm2zez31vTqubbP7Of+zTz7Z/Zz5Wa+fa3d90UbP++9t7par79M/v9wa06Yu/HJh82VfT5U0Xv034qsH2679P2THlwdPI+LQAAAMy89P3/9Ov408+H/1qyDHxNf8uO/e/3ntl5rmP/8/dndh7TfF6Dyo4C5vMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6Y1bXgonlM18e+8vVCz/483tGXt911Q833b1nuOeZD9z/kee/9ZnvvPjS/KXLvn3rFYdun7PyvvuGf3XRoV/87a7CwAOVxdnJam8Uxa/EUXTqL5d+/d6fPnvS+LY4iqJyPLA7iubHpZ/MjzMRht6IomhdtZ31Tz75+vL148vdX5tVt/24TJBsXlF/OW1PXTujOwoz4hjUm4yzr/x4yyl/OO+K5/f++vLXh3rf2Lp7skjcWzOeomjemtrXd0dR1Jf8Py4dbQvSFyfLa6Ioml3zuosL2nVGk+0/N7C+MFn2JMv+gjjp86dn1rubbEdXZtnb5OtaVZrh+Kl0/82Z4fqzB7dsPfOT5feS5dnTjF9O/4+jUhx1VavbGE+Okahmv8VRPLHvJ9dLdWMhzoyNOIrizHops17uzuQ1UW8y0MpxXL89LZfZPphs70q2n14w1q4LbH9Pmm/yi3owk382aP+UB9W8JqTt+m2DthwJpZpjUN72tL29yc7oT7b1x8dPec3hHOlzq1564IkXdz60eCDQjvi7cRI/bin+c5su2b9k528OLAjFX1NK4pdaij923quPv3ztz04Kxt+Txi+3FP+FC5d840e7dhwM9s+f0v7pail+ecU5h5bdM7Qq2P6H0/i9LcV/5PLHvjnvfU8/Hmz/UNo/fa31z+j2N2949IQDwfhRGn92S/Eve+3Es1ZseWxDMP5Taf/0txT/2bHRlffesmjHYCj+vjT+3Jbin/G7G2/Yu3/khWD7h9P+GWgp/vsXX3bNygOb7w8dO+PdR+ovLMDb07uSc6yvJuutXme2q+Z64cGBuHLONyf5f24nK8oYr2feDMYHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODtaeTKB3dduW/1VV1xFMWBModzpM+Ve4aHB1uot7zinEPL7hlaVbttQQtxAAAAgGLpdXipuqU3WhDtiPuik3PLp3MEJ6drcf327BxC32TJjsQpdShOuUNxujoUp7tDcXo6FGdWh+L0FsTpjZqL09cwTqnp9szuUJz+DsWZ06E4czsUZ15hnPoZwFCc4zrUnoGGcZofh/M7FOf4DsV5V4fivLtDcU7oUJwTOxTnpA7Fyc4pT3cczk1KLgzFmXhQLozTFZerT+TNp6f1nJp5XWma9fQ3WU92zn669fQ1Wc+ZbdbT22Q9S9qsJ26ynrPbrKdUUE86bu/Iti+tJ11rcvzf2aE4OzsU5wsdivPFDsW5q0NxvtShOLvajAPQrPT6f/K6cSCa1XVpNDs54mRnAdLr3UWVV085HvVmL9ATabxTMtt7iuJlL9Qz8RZ1uH1nZLZ318Xrqp43NYg3UBtvcebJwnyzEwqZ9i2dbrzsxAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzKCRKx/cdeW+1VdFcTT+X67DOdLnyj3Dw4Mt1LvqpQeeeHHnQ4trt83qaiEQAAAAUCi9Du+ubumNZnWdH/X8M7v2FyNXVQYA/Nyd2ZlhW3BqoA6k0JHSFSPS0kX5kxou+jBLDEoAowHT3VKGdcN2F9ltCiuy1gfigwYSTVx9MjxhCA9qUFSS5UFjUBI2UWwiKC8SRQMkQEJNTMbszr3zrzM764i24O/3cO6953znfPfMNk2+MxPl2uIKyTlAIXnOFOvXqDy0fh2Jtm0Yn03i9ywcvmvP/L2LH54+fHCqOlWdHRsbu/LysX1X7PvonjumZ6p7623I91lvOFlv/t7FOw/OzFTvnq8/d753KZlXanZNrjXHkvd+b588URLfzPPfu+n/1wIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgFOrWlleqqxOjI9EIUQ9YmpdpGOZXByXB8h77Zvbd1899+hUa18+O8BCAAAAQF9pHT7c6CmEfDYTMuHc9acLm6HFEJp1PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8P+nWlleqqxOjG+JQoh6xNS6SMcyuTguD5D3N/PT1z/whZ1HW/tKA6wDAAAA9JfW4UONnkIohV1hODq3LS49GzivY35nXLrO+ZuM6zw76BW3a5Nxo5uM+2CfuE8l13sCAAAAvPOl9X+20VMM+eyZPev/fnV9GrezIy6TXAf5rQAAAADwn0nr/1yjpxTy2VKjXt9svX9hR1w6v9/39un8ft/bp3EX98jT+X0+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHD6qlaWlyqrE+OZKISoR0yti3Qsk4vj8gB5X7x89Ns/Xzp6orUvnx1gIQAAAKCvtA5vlt6FkM+OhOGwZb3uv3L0719cnDy2bbiYDOdy4Z6DCwt376u3adyur77+ud/9NCqfFHdZvT0lmwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN5W1cryUmV1YvyMKISoR0yti3Qsk4vj8gB5X5w+8s9bHznntda+0gDrAAAAAP2ldXiz9i+EUsiFXNi+/tRa668Z6pjf68wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAePeYv3fxzoMzM9W73bhx46Zxc6r/ZwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE4X1cryUmV1YrwQhRD1iKl1kY5lcnFcHiDvwx9/9LtnfeQXj7X2lQZYBwAAAOgvrcObtX8hlMJwGA7nrD91OxNYr/+L/8OXBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATgvVyvJSZXVi/MwohKhHTK2LdCyTi+PyAHkv/PPnb105Xn2xtS+fHWAhAAAAoK+0Ds81egohn70s5MOO5HmmfUKUSa7dzwWa8+5qmzay6Xn3tc3LbHre1zp2lk12U59XSNcr1q+NeeWT55VDCKVkXqk5MNk2LzzUNuvMTb/n99rmFfvMCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAaqlaWlyqrE+NRFELUI6bWRTqWycVxeYC8zx2+6vjo4h9fa+0rDbAOAAAA0F9ahzdr/0IohfPDWeH89bo/FNvj07j9j7xy9V9/dsY3Qti7/bcXZHuu/5eLK7/sbEIYag8aCuE9Sb6oR76jP/7bw6+++pNPhrD3nMyOfzdf+5JxbfLE9tue3Z/fs8EHAwAAAO8iaf0/3Ogphnx2tmf9n1beG9f/zdOE9QJ87uyb7tuWtElF3jFjqJjkG+qR784rvvmj8gXH/7BW/2903vDpL5/3iW1h7op4Om3rPZ0vGNdmHtx94OWtTx9Jd13Pn+nIn34uL5344WeOzh/6Sj1/IRSS/vOy3fKf3HY4I669NfvEU4f2L97Qnj/bY/8P7H7/n37/ncOvrOV/Y+dII/8HNtj/xvnPvrny/LHHH7qxPf9wj/xTN235/pvluX907n+kY+Hkk6//wVv+Ch2iuPbG9DPXbF3ZdaA9fwhhsjUw/fyfeuJb5ZVfbzuc5k9/K3Lxro78Lf/UWtuOM6corq3suGRq7MmFLe35o4786f6P3/+Dt750/LnrOvd/e+f+e+bv3P91o5lbXtg5NsiPZwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3gGqleWlyurEeMiEEPWIqXWRjmVycVweIO/HLrr2hutfm/16a18+O8BCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNumWlleqqxOjA9FIUQ9YmpdpGOZXByXB8g7f+nrj71846/e19pXGmAdAAAAoL+0Dm/W/oVQCrmQCyPrdf/kie23Pbs/vycU66NRcs3OzM0vfOiOuSOzt5+iNwcAAAA2K63/s42eYshnLwrDSf2/suOSqbEnF7ak9X8IYXKtKdwxPVMdC41zgutGM7e8sHOs3DgnaI279NDcTHJMkK57/1VbX5r/7Or1Xdfd14x7Y/qZa7au7DqQxg0n1/W4y5pxMw/uPvDy1qePpHFD6TnFWtzeZtxbs088dWj/4g3peKZ1vZa4s2+uPH/s8YdubKyTXEeSvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAvduBAAAAAAADI/7URqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrBfRyFWFXEcgGfu3dWrd912i3KTIhUTDZKVikqIViHpoQ0p8MUCH7IyMqklDCHchCxMwqeKoIgoCEQKgh6KsKAMkiiI0B7C0B7qITaiDXGjYndndu8ePe12ahXk++Awzpx7fvM/c8az9wIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADn19y2nrH28NMDv9+56LbPd28Z3nX7+9ue2t835/Ct++449sq9b5442b1i9RsPrR95tKN/796+r28c+eLPJ6cNfmK8WZm6jRDizzGEK79c8cKeT48sHB2LIYR67BoMoTvWPu6OhYTe0yGE+ybqnHry3eHr7h9tB5+bO2X8okJI8b5Cs57rGdc1tV4uLI20z575cPsVP65af+zQt+uGexunHxuc/EhstOynEDo3t17fHkKYl45Rebf15ItTuyGEML/lupumqWvpDOu/tqS/KLVzUtucJiefX1Lot8+wjrZC25jhdVXVZjk/y8+vY5bnL77civN0p/a91K78l/n1fMRQi6FtYrqH4+QeCS3PLYY49uwn+7UpeyEW9kYMIRb6tUK/3l64r7F500arxzh1PH+uML44jbel8SXT7LW7S8Yvz/eb/qOeKtx/MbR5xj8m7mtMruv7f6jlXKi1vIPONp7rbaSH0UxjzXjxGdf8dRb53MaTz799Yuery7pK6ojvxJQfK+V/s+3mo8t3fjfUU5a/uZbya5XyB1b9evCnuz5bWJq/P+fXK+Ufv375ix/s2nGqdH1+yevTVim/vuaakdW7ezeW1v9azm9Uyn993YGXO2/45GBp/b15feZVW5+tj/+x6a1Lh0rzQ86fXyl/7W+XXb1m+4EHSvM/yuvTrJR/ZGBr/54Hr9qxuCz/q5y/oFL+0h/u2XTo6JbjpfX35fXpqpR/y7K1G/qHHtlX9u6Mg+fqLyzAhemS9B3r2dSv+jvzv2r5vfBSVxz/zteRjgX/50QFo/N0zmI+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPzNDhyQAAAAAAj6/7odgQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATwUAAP//r6RXYA==") program crashed: KASAN: slab-use-after-free Read in bch2_reconstruct_alloc single: successfully extracted reproducer found reproducer with 1 syscalls minimizing guilty program extracting C reproducer testing compiled C program (duration=1m5.219201491s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bcachefs program crashed: KASAN: slab-use-after-free Read in bch2_reconstruct_alloc simplifying C reproducer testing compiled C program (duration=1m5.219201491s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bcachefs program crashed: KASAN: slab-use-after-free Read in bch2_reconstruct_alloc testing compiled C program (duration=1m5.219201491s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bcachefs program crashed: KASAN: slab-use-after-free Read in bch2_reconstruct_alloc testing compiled C program (duration=1m5.219201491s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bcachefs program crashed: KASAN: slab-use-after-free Read in bch2_reconstruct_alloc testing compiled C program (duration=1m5.219201491s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bcachefs program crashed: KASAN: slab-use-after-free Read in bch2_reconstruct_alloc testing compiled C program (duration=1m5.219201491s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bcachefs program crashed: KASAN: slab-use-after-free Read in bch2_reconstruct_alloc testing compiled C program (duration=1m5.219201491s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bcachefs program crashed: KASAN: slab-use-after-free Read in bch2_reconstruct_alloc testing compiled C program (duration=1m5.219201491s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$bcachefs program crashed: KASAN: slab-use-after-free Read in bch2_reconstruct_alloc reproducing took 7m55.275820083s repro crashed as (corrupted=false): bcachefs (loop0): recovering from clean shutdown, journal seq 8 bcachefs (loop0): dropping and reconstructing all alloc info ================================================================== BUG: KASAN: slab-use-after-free in bch2_reconstruct_alloc+0x2af/0xac0 fs/bcachefs/recovery.c:100 Read of size 8 at addr ffff888012078f58 by task syz-executor263/5313 CPU: 0 UID: 0 PID: 5313 Comm: syz-executor263 Not tainted 6.12.0-rc4-syzkaller-00289-gea1fda89f5b2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 bch2_reconstruct_alloc+0x2af/0xac0 fs/bcachefs/recovery.c:100 bch2_fs_recovery+0x12dd/0x39c0 fs/bcachefs/recovery.c:812 bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1036 bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170 vfs_get_tree+0x90/0x2b0 fs/super.c:1800 do_new_mount+0x2be/0xb40 fs/namespace.c:3507 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc6e5b03f6a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe8b358568 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007ffe8b358580 RCX: 00007fc6e5b03f6a RDX: 0000000020005b00 RSI: 0000000020005b40 RDI: 00007ffe8b358580 RBP: 0000000000000004 R08: 00007ffe8b3585c0 R09: 0000000000005b27 R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000 R13: 00007ffe8b3585c0 R14: 0000000000000003 R15: 0000000001000000 Allocated by task 5313: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_track_caller_noprof+0x225/0x440 mm/slub.c:4283 __do_krealloc mm/slab_common.c:1220 [inline] krealloc_noprof+0x88/0x120 mm/slab_common.c:1269 bch2_sb_realloc+0x2d2/0x660 fs/bcachefs/super-io.c:189 __copy_super+0x5dc/0xe70 fs/bcachefs/super-io.c:586 bch2_sb_to_fs+0xab/0x150 fs/bcachefs/super-io.c:613 bch2_fs_alloc fs/bcachefs/super.c:827 [inline] bch2_fs_open+0x1693/0x2f80 fs/bcachefs/super.c:2064 bch2_fs_get_tree+0x738/0x1710 fs/bcachefs/fs.c:2157 vfs_get_tree+0x90/0x2b0 fs/super.c:1800 do_new_mount+0x2be/0xb40 fs/namespace.c:3507 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5313: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 krealloc_noprof+0xec/0x120 bch2_sb_realloc+0x2d2/0x660 fs/bcachefs/super-io.c:189 bch2_sb_field_resize_id+0x140/0x7c0 fs/bcachefs/super-io.c:221 bch2_sb_counters_from_cpu+0xac/0x300 fs/bcachefs/sb-counters.c:67 bch2_write_super+0xe80/0x3c50 fs/bcachefs/super-io.c:976 bch2_reconstruct_alloc+0x28c/0xac0 fs/bcachefs/recovery.c:97 bch2_fs_recovery+0x12dd/0x39c0 fs/bcachefs/recovery.c:812 bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1036 bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170 vfs_get_tree+0x90/0x2b0 fs/super.c:1800 do_new_mount+0x2be/0xb40 fs/namespace.c:3507 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888012078000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 3928 bytes inside of freed 4096-byte region [ffff888012078000, ffff888012079000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12078 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac42140 ffffea0000474e00 dead000000000002 raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac42140 ffffea0000474e00 dead000000000002 head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea0000481e01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4744, tgid 4744 (udevd), ts 25395379675, free_ts 25361004111 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x3045/0x3190 mm/page_alloc.c:3457 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x120 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] tomoyo_realpath_from_path+0xcf/0x5e0 security/tomoyo/realpath.c:251 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 do_filp_open+0x235/0x490 fs/namei.c:3960 page last free pid 4736 tgid 4736 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2638 discard_slab mm/slub.c:2677 [inline] __put_partials+0xeb/0x130 mm/slub.c:3145 put_cpu_partial+0x17c/0x250 mm/slub.c:3220 __slab_free+0x2ea/0x3d0 mm/slub.c:4449 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4141 getname_flags+0xb7/0x540 fs/namei.c:139 do_sys_openat2+0xd2/0x1d0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888012078e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888012078e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888012078f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888012078f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888012079000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): bcachefs (loop0): recovering from clean shutdown, journal seq 8 bcachefs (loop0): dropping and reconstructing all alloc info ================================================================== BUG: KASAN: slab-use-after-free in bch2_reconstruct_alloc+0x2af/0xac0 fs/bcachefs/recovery.c:100 Read of size 8 at addr ffff888012078f58 by task syz-executor263/5313 CPU: 0 UID: 0 PID: 5313 Comm: syz-executor263 Not tainted 6.12.0-rc4-syzkaller-00289-gea1fda89f5b2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 bch2_reconstruct_alloc+0x2af/0xac0 fs/bcachefs/recovery.c:100 bch2_fs_recovery+0x12dd/0x39c0 fs/bcachefs/recovery.c:812 bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1036 bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170 vfs_get_tree+0x90/0x2b0 fs/super.c:1800 do_new_mount+0x2be/0xb40 fs/namespace.c:3507 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc6e5b03f6a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe8b358568 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007ffe8b358580 RCX: 00007fc6e5b03f6a RDX: 0000000020005b00 RSI: 0000000020005b40 RDI: 00007ffe8b358580 RBP: 0000000000000004 R08: 00007ffe8b3585c0 R09: 0000000000005b27 R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000 R13: 00007ffe8b3585c0 R14: 0000000000000003 R15: 0000000001000000 Allocated by task 5313: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __do_kmalloc_node mm/slub.c:4264 [inline] __kmalloc_node_track_caller_noprof+0x225/0x440 mm/slub.c:4283 __do_krealloc mm/slab_common.c:1220 [inline] krealloc_noprof+0x88/0x120 mm/slab_common.c:1269 bch2_sb_realloc+0x2d2/0x660 fs/bcachefs/super-io.c:189 __copy_super+0x5dc/0xe70 fs/bcachefs/super-io.c:586 bch2_sb_to_fs+0xab/0x150 fs/bcachefs/super-io.c:613 bch2_fs_alloc fs/bcachefs/super.c:827 [inline] bch2_fs_open+0x1693/0x2f80 fs/bcachefs/super.c:2064 bch2_fs_get_tree+0x738/0x1710 fs/bcachefs/fs.c:2157 vfs_get_tree+0x90/0x2b0 fs/super.c:1800 do_new_mount+0x2be/0xb40 fs/namespace.c:3507 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5313: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 krealloc_noprof+0xec/0x120 bch2_sb_realloc+0x2d2/0x660 fs/bcachefs/super-io.c:189 bch2_sb_field_resize_id+0x140/0x7c0 fs/bcachefs/super-io.c:221 bch2_sb_counters_from_cpu+0xac/0x300 fs/bcachefs/sb-counters.c:67 bch2_write_super+0xe80/0x3c50 fs/bcachefs/super-io.c:976 bch2_reconstruct_alloc+0x28c/0xac0 fs/bcachefs/recovery.c:97 bch2_fs_recovery+0x12dd/0x39c0 fs/bcachefs/recovery.c:812 bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1036 bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170 vfs_get_tree+0x90/0x2b0 fs/super.c:1800 do_new_mount+0x2be/0xb40 fs/namespace.c:3507 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888012078000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 3928 bytes inside of freed 4096-byte region [ffff888012078000, ffff888012079000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12078 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac42140 ffffea0000474e00 dead000000000002 raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac42140 ffffea0000474e00 dead000000000002 head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea0000481e01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4744, tgid 4744 (udevd), ts 25395379675, free_ts 25361004111 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x3045/0x3190 mm/page_alloc.c:3457 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x120 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] tomoyo_realpath_from_path+0xcf/0x5e0 security/tomoyo/realpath.c:251 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 do_filp_open+0x235/0x490 fs/namei.c:3960 page last free pid 4736 tgid 4736 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2638 discard_slab mm/slub.c:2677 [inline] __put_partials+0xeb/0x130 mm/slub.c:3145 put_cpu_partial+0x17c/0x250 mm/slub.c:3220 __slab_free+0x2ea/0x3d0 mm/slub.c:4449 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4141 getname_flags+0xb7/0x540 fs/namei.c:139 do_sys_openat2+0xd2/0x1d0 fs/open.c:1409 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888012078e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888012078e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888012078f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888012078f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888012079000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================