program: r0 = syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x8c0, &(0x7f0000000080)=ANY=[@ANYBLOB='acl,heartbeat=none,dir_resv_level=00003,coherency=full,coherency=full,localflocks,coherency=full,noacl,\x00'/119], 0x1, 0x4421, &(0x7f0000004500)="$eJzs3c9PHGUfAPBnBt63UNsKtYeamLiJTTRqCPSk0kRKaSm0WFNtY7xsF9i26MI2sBgPPeCtiScTD8ZDo4k3Tg0Hr/VP8OKxnpvowYuJSSNmd2eBGXbDSliwzeeTlNl5fu9+d5595jB94kTl9txSbm4pV1jIlWduLp3OfVYuLc8XQ7xPDrp/2tOJOIn9wbly7sIH10+H8NPsL4/X19fXQ1V3aGpoy+s//7g7s/XYEGfqVNtt3tpe+TiEcGLbuKq6Qggf/RhCFEI4m6SNJsfeEMKxUM+7fvfLG7k9Gs2DR8Uz+SdT99aGT02u3l9r/d6jEL4tvfjmrfnfXuka/vX1PeoeAAAAAAAAAAAAAAAAAICn3PjVK9feHxwKD6PQvRptf153PDm2ej52fc+83Pk3CwAAAAAAAAAAAAAAAAAAAP9Rm8//56LjTZ7/H0uOIy3qr7/b+THSORPvXRk7PziU7P8ebct/K0n6/WxX6G+y73t2//ezmfrN93/f3s9uNcbX6LcvRPFA6jyOBwZC+D7Z+P1kdDgulZcqb9wsLy/M7tkwnlrp+Nd3709FJ9nQv934j2ba7/z+/y9s+zZVz2/s3VfsmZaOf1fLcj98EbUV/3OZevsRf3YvHf/uWlrv1gIj9QmgGv+vuneO/1im/U7F/1gIIRdVx5pLzQDVNUw1vdV6hbR0/P9XS0tNnckH2er6/ysT//OZ9g9q/l/J/hDRVDr+/6+l9aRKbF7//fHO1/+FTPsHEf/q+Ff8/rclHf9D9cTuVJHaJ9nu/D+eab9T8b8WJ+M8FqW+AatRPb3V/1dHWjr+PdvyN+//4rbWfxcz9ffr/q/Rb+P+rzH9vxbV7/9oLh3/3pbl2r3+JzL1Oj3/j9TWf+xWOv6Ha2nptXNf7W+78Z/MtN+p+NdWJT2N+G/OJ38fqqd/Z/3XlnT8n6snxltLrNT+1tZ/0c7r/0uZ9g9i/Vcd/0rc2V6fFen4H2lZrhr/n9v4/b+cqdf5+IcwaK2/a+n4H21Zrnb99+wc/6lMvU7H/9VONg4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwFBhNjn0higdS53E8MBDCueT8ZDgcTRdm89Ol8synSyGMJem5cDy6VSpPF0r5uYXybDFfKJXKMyGcT/JPhJ5oqVSu5OcLdy5stNUb3S4WFivTxUIlhDCepL8Ujjbamp6rzBfuhBAubuQ9H5cX79wuLORn5xbfGRwcHAwTG2Poj4qfV4oLlXrv9dwQJjfq9kVbBlfLvrQxliPRJ+XlxYVCqZZ+eUudUnmmUNpSZyrJ+zr0R5XF5YWZQqWYL5VvNfo7SCPJcWzi6odXLw9ty78R1Y+j+zssAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP6lh8NvfxNC6K6fxSGEXJS8iJJ/KQ8eFc/kn0zdWxs+Nbl6f+1xszIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/7ADBwIAAAAAQP6vjVBVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWFXfpHaSCI4gD8Ziy09BhWy25nu6KIFq4InkCP4WH0KF7CO1ikSJsiBJJZCPsHtkmq72sezI+Z92AeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyz2+de+vdROR4mp7GfH7+fd/nD+X+n03ff/iDDNyOk8v3f1D3ZR/T6P8thyt2rxPN+uvj5iovZ/Bngz36WDcZ2hu3+bm6/teR8pVRLQlv0k5V9WytwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAHTtwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgWMBAAAAAGH+1lH0bQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPArAAD//z8QH1I=") r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="e80100002e000100000000000000000004001980d201098014"], 0x1e8}], 0x1, 0x0, 0x0, 0x84}, 0x300) syz_80211_inject_frame(0x0, 0x0, 0x0) syz_usb_connect(0x0, 0xfffffe88, 0x0, 0x0) truncate(&(0x7f0000000040)='./file1\x00', 0x1001bfc) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r1, 0x4000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) syz_mount_image$squashfs(&(0x7f0000000100), &(0x7f0000000240)='./file0\x00', 0x821070, &(0x7f0000000640)=ANY=[@ANYBLOB="c2f502770b7400"], 0x81, 0x1cf, &(0x7f00000002c0)="$eJzKKC4sZmdgYPj7sSaZQYABDBgZeBguMDAysDAwMKgzQsQYmCDUeij/BZSeCZW2gfKbofRCKF1xS3vdmlN+Z0566motk2VmaPXUlkcWk0vtMXKTXMwjwcwQmnpkUXFlVXZiTk5qUfFChopbyUkVp08wsFy3v6bSLMHp8EeewyFJ00GH6YiPR9aMxhLOSVKaYmxsmQpnz3yQX8emcYTh0QrmjXWeeY11halT89LykqqyqrLmTZy4cWZjZ2Pjyol1UWl+qxhbUlw2NXUyMjlsURPYzGyoPslGe8K79lUPkxxYezz8mk8ZK71OZb5kvLBI6tSKqpkTvijNZjT8znCHp2yFhIaGk8QVCYsGE4YjdbYNriAnpjQwpCmEMSapsYm1bTkzJ4SZn81tgUJL8gmm0KMcS2dKWBwQqjr501LzrUOi24xtTx3YzvAcPs6zpqBP0Oi4BIPTQsH/MiBjEhoayjTWMi21XfClSOOvhNdqY6cMBnd7pmWwAGVpAJEroTxZsJ6E5BUeOpqaRinJCQ2bJBKS3AoMlRm27uFcLdDAgBRtKgwMDNsZYXELAddgjFEwCkbBKBgFo2AUjIJRMApGwSgYBSMCAAIAAP//QJCYyw==") r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_aout(r5, &(0x7f00000002c0)=ANY=[], 0xc1) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000005, 0x12, r5, 0x0) write$bt_hci(r4, &(0x7f00000000c0)={0x1, @write_sc_support={{0xc7a, 0x1}}}, 0x6) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0xe) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@deltfilter={0x105c, 0x2d, 0x400, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x16, 0xd}, {0xe, 0x8}, {0x9, 0x2}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x81}}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_route={{0xa}, {0x101c, 0x2, [@TCA_ROUTE4_POLICE={0x408, 0x5, [@TCA_POLICE_RATE={0x404, 0x2, [0x2, 0x9, 0x8001, 0x1, 0x6, 0x40, 0x10001, 0x2, 0x9, 0x0, 0x101, 0x8, 0x659f, 0x7fffffff, 0x9, 0x8, 0x7, 0x3, 0x7, 0x5, 0xf5, 0x1, 0x7, 0x9786, 0x1, 0x2, 0x5, 0xc, 0x1ff, 0x8001, 0x401, 0x5, 0x0, 0x9, 0xa2dd, 0x4, 0x7fff, 0x1, 0x8, 0x2, 0x100, 0xbf4, 0x71, 0x7fff, 0x2, 0x3ff, 0x954c, 0x3ff, 0x1000, 0x5, 0x5, 0x7, 0x1, 0x7fff, 0xc, 0xfffffffa, 0x1000, 0x3, 0xffffff9c, 0x50, 0xfffff001, 0x9, 0x3, 0x57bb, 0x1, 0xff, 0x7fff, 0x7, 0xffff, 0x10, 0x4, 0x200, 0xc, 0x3, 0x3123ee32, 0x2, 0x2, 0x81, 0x3, 0x9, 0xc70, 0xbb9, 0x4, 0xdb8, 0x80000000, 0x7ff, 0xd, 0x8d, 0x1, 0xfffffffa, 0x7, 0x4d63b205, 0xfffffffa, 0x101, 0xfffffffb, 0x5, 0xffffffff, 0x200, 0x401, 0xd250, 0x8, 0x4, 0x3d, 0x6, 0x8, 0x0, 0x7fffffff, 0x7, 0x6, 0xfffffffb, 0x7, 0x240d, 0x3, 0x4, 0xfffffffe, 0x9, 0x4, 0xff, 0x2, 0xe, 0x1, 0xffff, 0x4, 0xe6a00000, 0x8, 0xffffffc0, 0xffffffff, 0x5, 0x81, 0x1, 0x4, 0xfffffff7, 0x5, 0x3, 0x28f8, 0xfffffffc, 0x10001, 0x5, 0x7, 0x6, 0x4, 0xffffffff, 0x0, 0xd, 0x0, 0xe, 0xfffffffe, 0x6, 0x3, 0x0, 0xfc7, 0x5, 0x3, 0xf, 0x2, 0x5, 0x1, 0x10001, 0x0, 0x3, 0x5, 0xc941, 0x3, 0x10000, 0x0, 0x7, 0x9, 0xf8, 0x81, 0x40, 0x0, 0x101, 0x0, 0x0, 0x44da, 0xf881, 0x5, 0x8, 0x5, 0x3, 0x0, 0x8, 0x5, 0x3, 0x5, 0x8, 0x9, 0x9, 0x0, 0x3, 0x0, 0x3, 0x401, 0xfefb0e2, 0x1b, 0x6, 0x5, 0x9, 0x39, 0x52f, 0x2d3d, 0xdefc, 0x5, 0xfffffffa, 0xffffffff, 0x2, 0x2, 0x4, 0x401, 0x1a, 0x10000, 0x8, 0x3, 0x2, 0x1000, 0x0, 0x4000, 0x200, 0x0, 0x8, 0x1, 0xfe, 0x1, 0x56, 0xc, 0x7, 0x8, 0x2, 0x81, 0x25a, 0x4, 0x200, 0xddb8, 0x800, 0x9, 0x5, 0x7, 0x8, 0xa9, 0x5, 0x0, 0x489a, 0x33b8da97, 0xb, 0x3, 0x4, 0xb, 0xcf, 0x81, 0x0, 0x9336, 0x8, 0x81, 0x9, 0x9, 0x2]}]}, @TCA_ROUTE4_POLICE={0xc10, 0x5, [@TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x56, 0x8, 0x1, 0x6, 0x0, 0x2, 0x6, 0x8, 0x2, 0x7, 0x800, 0x0, 0x4de06431, 0x6, 0x8, 0x8, 0x800, 0x5, 0x2, 0x6, 0x100, 0xb548, 0x0, 0x0, 0xfffffc01, 0x7, 0x4d4a, 0x3, 0x2, 0xf, 0x4e, 0x7, 0x0, 0x2, 0x7, 0x5, 0xf96, 0x1, 0x1, 0x3, 0x9, 0xa3272ad, 0xa000, 0x0, 0x2, 0xbe5, 0x3, 0x8, 0x0, 0x6, 0x3, 0x1, 0x5, 0x1, 0x1c25d23e, 0x10001, 0x10000, 0x5, 0x2, 0x3, 0x7fffffff, 0x2, 0x4, 0x8, 0x8, 0xe50, 0x40, 0x6, 0x200, 0x7, 0xfffeffff, 0x40, 0x2a, 0x2, 0x0, 0x3, 0x9, 0x6, 0x2, 0x3, 0x0, 0xffff7b13, 0x80000001, 0x4, 0x4, 0x0, 0x10001, 0x7, 0xc48, 0x0, 0x7, 0x8, 0x3, 0x9, 0x8, 0xb8d0, 0x7, 0x401, 0x5, 0x4, 0x2000000, 0x2, 0x3, 0x9, 0x8, 0xffffffff, 0x4, 0x486, 0x80, 0x5, 0xad, 0x6, 0x4, 0x80000000, 0x2, 0x556, 0x3, 0x3ff, 0x1, 0x0, 0x0, 0x7, 0x5, 0x8c7, 0x0, 0x3, 0x7, 0x1, 0xfffffff7, 0xfffffff7, 0x512, 0xb, 0x40, 0x9, 0x5, 0x5, 0x6, 0x7, 0x80, 0xc4c1, 0x61, 0x10000, 0xffffffff, 0x5, 0x3, 0x2, 0x2, 0x3, 0xfffffffa, 0x7, 0x7ff, 0x4, 0x9, 0x8, 0x7, 0x3, 0xfffffff7, 0x6, 0xa, 0xfffffff9, 0x1, 0xb94, 0xa, 0x4, 0x8, 0x40, 0x9, 0x8, 0x9, 0x4, 0xfffffff7, 0x120f154a, 0x6a, 0x3, 0xcfb, 0x1, 0x4, 0x7f, 0x7, 0xb, 0x9, 0x9, 0x0, 0x8, 0x4, 0x314ad56a, 0x0, 0x9, 0xee800000, 0xfffffffe, 0x4, 0x6, 0xaa56, 0x5, 0x4, 0x6, 0x8, 0x3, 0x200, 0x400, 0x40, 0x0, 0x8001, 0x1, 0x6, 0x3, 0x4, 0x9, 0x2, 0x7f, 0x5, 0x3, 0xe, 0x3, 0x1, 0x7ff, 0x9, 0xc, 0x4, 0x4887, 0x8e85, 0x80000001, 0x8, 0x6, 0x7ff, 0x1, 0x8, 0x4, 0x95, 0x6, 0x8, 0xf, 0x620, 0x80000000, 0xffffffff, 0xa, 0x800, 0x7fffffff, 0xfffffffb, 0x0, 0xa5d4, 0x0, 0x3, 0x8, 0x4, 0x4, 0x1, 0x80000001, 0x8001, 0x7, 0x80, 0x4, 0x6, 0x6, 0x300]}, @TCA_POLICE_RATE={0x404, 0x2, [0x7, 0x1e, 0x4a, 0x7, 0x0, 0x7fff, 0x7, 0x800, 0x9, 0x1, 0xfffffffa, 0x7fff, 0x83d, 0x4, 0x2, 0x9, 0x4, 0x2, 0x0, 0x401, 0x4d4, 0x26e, 0xd615, 0x3, 0x18, 0x2, 0x7, 0x2, 0x9, 0x3, 0xffffffff, 0xf, 0x8, 0xffffff00, 0x1, 0x3, 0x2, 0x1, 0x4, 0x5, 0x2, 0x200, 0xe, 0x1, 0x2a8, 0x7, 0x101, 0x8, 0x3, 0x2, 0x842, 0xfffffff8, 0x2, 0x380000, 0x7, 0x7ff, 0x1, 0x7fffffff, 0x40, 0x8, 0x800, 0x9b7, 0x100, 0x7, 0x1, 0x8, 0x9, 0xc, 0x7, 0xd5, 0x5, 0x10001, 0x5, 0x9662, 0xfffffc00, 0x0, 0x4, 0x9, 0x8, 0x1, 0x0, 0x80, 0xffffffff, 0x3, 0x3, 0x8, 0x100, 0x7, 0xfffffffa, 0xfffffe01, 0x80000000, 0x1, 0x1, 0x4, 0x3, 0xe4e8, 0x9, 0x7f, 0x2, 0x1, 0x9, 0x4, 0x4, 0x1, 0x6c9a, 0x7, 0x1, 0x80, 0xfffffff8, 0x457, 0x2, 0xfffffff8, 0x40, 0x8a, 0x9, 0xa, 0x1, 0x4, 0x2, 0x9, 0x1, 0x3ff, 0x80000001, 0x3, 0xffff, 0x6, 0x28, 0x6, 0xbb, 0x200, 0x101, 0x7, 0x7, 0x7f, 0x0, 0x2, 0x80, 0x7fffffff, 0x4, 0x2, 0xffffff80, 0x1, 0x3, 0x7240, 0x5, 0x6, 0x6, 0x3, 0x800, 0xf00, 0xf, 0x2, 0x3e76, 0xfffffff7, 0x855d, 0x0, 0x472c, 0x439d, 0x6, 0x7, 0x9, 0x7ff, 0x4, 0x0, 0x8, 0x9, 0x2, 0x0, 0x4, 0x2, 0xb35, 0xd, 0x200, 0x1, 0x7fffffff, 0x5, 0x1724, 0xfff, 0x7, 0x3, 0x7, 0x9, 0x0, 0xffffffff, 0xfffffffb, 0x8, 0xc1a, 0xf413, 0x4, 0x20000, 0x0, 0x3, 0x80, 0x81, 0x401, 0x88dd, 0x6, 0x0, 0x8, 0x6, 0x76, 0x8, 0x7ff, 0xc, 0x9, 0xfffffffb, 0xfffffffd, 0x28, 0x1, 0x3ff, 0xc000000, 0x4, 0x8, 0xe22, 0x94c4d0e, 0x21, 0x2, 0xa7, 0x8689, 0x80000001, 0xff, 0x4, 0x8, 0x0, 0xe09, 0x7ff, 0x3, 0x7, 0xc, 0x8000, 0x800, 0x1000, 0x3, 0xd342, 0x1000, 0xffffffff, 0x5, 0x4, 0x8, 0xa000000, 0x5af0, 0x64b8d2bf, 0x1, 0x9, 0x8, 0x38000, 0x5, 0xe28, 0x101, 0xfff, 0x7, 0xfff, 0x6, 0x80000000, 0xfa, 0x3]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x80, 0xffffff45, 0x5, 0x0, 0x8, 0x9, 0x7, 0x5, 0x2902, 0x108, 0x41, 0x1, 0x71b, 0x7fffffff, 0x5, 0x5009, 0x1ff, 0xcc8, 0x7, 0x16, 0x83a0, 0x0, 0xfffffffc, 0x7, 0x80000001, 0x3, 0x2, 0x7, 0x3, 0x7, 0x4000000, 0x9, 0x401, 0x1, 0x1, 0x3, 0xfff, 0xb, 0x5c17, 0x406, 0x2, 0x9, 0xb0ab, 0x9, 0x3, 0x7, 0x3, 0x7, 0x4, 0x400, 0x8001, 0x8, 0x47, 0x5, 0x1, 0x4e, 0x4000000, 0xffffffff, 0x3, 0x5, 0x0, 0x4, 0x1, 0x1, 0x2, 0x3, 0x0, 0x4, 0x9a2, 0x3, 0x6, 0x2, 0x556a, 0xfffffff9, 0x4, 0x8000, 0xffff, 0xc, 0xd, 0xfffffff6, 0xd0, 0xff4, 0x504c, 0x9, 0x3, 0x1, 0x7fffffff, 0x3, 0x8, 0x3, 0x1, 0x4, 0x6000, 0x5, 0x3, 0x2, 0xa, 0x7, 0xffff8001, 0x3, 0x2, 0x0, 0xb7c5, 0x9, 0x6, 0x6, 0x5, 0x40, 0x9, 0x6, 0x7fffffff, 0x800, 0x1, 0x8b6, 0x8, 0x496, 0x3, 0x2, 0x9, 0x9, 0x1000, 0x1, 0x3, 0x7, 0x1, 0x4, 0x7f, 0x6, 0x8, 0x5, 0xd33f, 0x2f, 0x7, 0x1ff, 0x3, 0x8000, 0xff, 0x762, 0x4, 0xfff, 0x0, 0x0, 0x9, 0x7, 0x5, 0xd, 0x0, 0x80000000, 0x2, 0x25, 0xffffffff, 0x5, 0x6, 0x5, 0xfe, 0x3, 0x7, 0x8001, 0x6, 0x4, 0x4f, 0x8, 0x8, 0xb, 0x52, 0x2841, 0xc6, 0x38000, 0x6, 0x2, 0x6, 0x2fb0, 0x40, 0xfffffff7, 0x6, 0x6, 0x0, 0x3a3, 0x6, 0x9, 0x10001, 0x10000, 0x23257493, 0x7fff, 0x7, 0x55, 0x0, 0x80000001, 0x3, 0x7, 0x1, 0x0, 0x80000000, 0xffffffff, 0x800, 0x8, 0x401, 0x1, 0x3, 0x6, 0x3, 0x8, 0x3, 0x5, 0x1ff, 0xd83, 0x4, 0x1, 0x6, 0x7, 0x7, 0x4, 0x40, 0x4, 0x7, 0xfffffffe, 0x9, 0x7f, 0x1, 0x5, 0x1000, 0x4, 0x9, 0x7, 0x4, 0x3d, 0x7, 0x4, 0x1, 0x9, 0x780, 0x40, 0x9, 0xb, 0x2, 0x0, 0x5, 0x5, 0x5, 0x8, 0x8, 0xb, 0x9, 0x3, 0x7, 0x6, 0x7fffffff, 0x4, 0x5, 0x474, 0xad53, 0x8001, 0x6, 0x3, 0x7]}]}]}}]}, 0x105c}, 0x1, 0x0, 0x0, 0x4004014}, 0xc000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r8 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x79b}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[], 0x20}}, 0x0) io_uring_enter(r8, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000001800)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x2, 0x6}}, 0x20) r9 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000004c0), 0x614002, 0x0) r10 = syz_genetlink_get_family_id$smc(&(0x7f0000000540), r3) sendmsg$SMC_PNETID_GET(r9, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x28, r10, 0x502, 0x70bd2b, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'vxcan1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x80) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f00000001c0)={{0x4, 0xd}, 'port1\x00', 0x14, 0x10063, 0xfc, 0xfffffff8, 0x3, 0x1000, 0x9e, 0x0, 0x0, 0x27}) [ 87.742024][ T5298] Bluetooth: hci0: command tx timeout [ 88.175578][ T5322] loop0: detected capacity change from 0 to 32768 [ 88.187298][ T5322] ======================================================= [ 88.187298][ T5322] WARNING: The mand mount option has been deprecated and [ 88.187298][ T5322] and is ignored by this kernel. Remove the mand [ 88.187298][ T5322] option from the mount to silence this warning. [ 88.187298][ T5322] ======================================================= [ 88.308748][ T5322] JBD2: Ignoring recovery information on journal [ 88.375204][ T5322] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 88.420577][ T5322] netlink: 'syz.0.0': attribute type 9 has an invalid length. [ 88.726746][ T5323] Bluetooth: MGMT ver 1.23 [ 88.769802][ T5322] ================================================================== [ 88.773642][ T5322] BUG: KASAN: slab-use-after-free in ocfs2_fault+0xdb/0x440 [ 88.777503][ T5322] Read of size 8 at addr ffff88803492a418 by task syz.0.0/5322 [ 88.781560][ T5322] [ 88.783062][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 88.783087][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.783096][ T5322] Call Trace: [ 88.783105][ T5322] [ 88.783114][ T5322] dump_stack_lvl+0xe8/0x150 [ 88.783140][ T5322] print_report+0xba/0x230 [ 88.783155][ T5322] ? ocfs2_fault+0xdb/0x440 [ 88.783174][ T5322] kasan_report+0x117/0x150 [ 88.783189][ T5322] ? ocfs2_fault+0xdb/0x440 [ 88.783207][ T5322] ocfs2_fault+0xdb/0x440 [ 88.783225][ T5322] ? __pfx_ocfs2_fault+0x10/0x10 [ 88.783242][ T5322] ? css_rstat_updated+0x23a/0x530 [ 88.783262][ T5322] __do_fault+0x138/0x390 [ 88.783288][ T5322] do_pte_missing+0x228f/0x3750 [ 88.783314][ T5322] ? handle_mm_fault+0xee/0x3310 [ 88.783331][ T5322] handle_mm_fault+0x1bec/0x3310 [ 88.783351][ T5322] ? handle_mm_fault+0xee/0x3310 [ 88.783366][ T5322] ? __pfx_handle_mm_fault+0x10/0x10 [ 88.783382][ T5322] ? follow_page_pte+0x841/0x1450 [ 88.783400][ T5322] ? __pfx_follow_page_pte+0x10/0x10 [ 88.783417][ T5322] __get_user_pages+0x165b/0x29d0 [ 88.783438][ T5322] populate_vma_page_range+0x2be/0x3c0 [ 88.783453][ T5322] ? __pfx_populate_vma_page_range+0x10/0x10 [ 88.783468][ T5322] ? down_read+0x272/0x2e0 [ 88.783528][ T5322] ? __mm_populate+0x173/0x390 [ 88.783544][ T5322] __mm_populate+0x25f/0x390 [ 88.783563][ T5322] ? __pfx___mm_populate+0x10/0x10 [ 88.783580][ T5322] vm_mmap_pgoff+0x3aa/0x4f0 [ 88.783598][ T5322] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 88.783612][ T5322] ? __fget_files+0x2a/0x420 [ 88.783627][ T5322] ? __fget_files+0x3a0/0x420 [ 88.783641][ T5322] ? __fget_files+0x2a/0x420 [ 88.783657][ T5322] ksys_mmap_pgoff+0x51e/0x760 [ 88.783673][ T5322] do_syscall_64+0x14d/0xf80 [ 88.783691][ T5322] ? trace_irq_disable+0x3b/0x150 [ 88.783708][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.783721][ T5322] ? clear_bhb_loop+0x40/0x90 [ 88.783735][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.783746][ T5322] RIP: 0033:0x7ffbb659c799 [ 88.783760][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.783772][ T5322] RSP: 002b:00007ffbb745d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 88.783787][ T5322] RAX: ffffffffffffffda RBX: 00007ffbb6815fa0 RCX: 00007ffbb659c799 [ 88.783795][ T5322] RDX: 00000000027ffff7 RSI: 0000000000600000 RDI: 0000200000000000 [ 88.783805][ T5322] RBP: 00007ffbb6632bd9 R08: 0000000000000004 R09: 0000000000004000 [ 88.783815][ T5322] R10: 0000000004012011 R11: 0000000000000246 R12: 0000000000000000 [ 88.783823][ T5322] R13: 00007ffbb6816038 R14: 00007ffbb6815fa0 R15: 00007ffc4ca9a008 [ 88.783836][ T5322] [ 88.783840][ T5322] [ 88.923519][ T5322] Allocated by task 5322: [ 88.925612][ T5322] kasan_save_track+0x3e/0x80 [ 88.928421][ T5322] __kasan_slab_alloc+0x6c/0x80 [ 88.932169][ T5322] kmem_cache_alloc_noprof+0x2bc/0x650 [ 88.935116][ T5322] vm_area_alloc+0x24/0x140 [ 88.937523][ T5322] mmap_region+0x10eb/0x2240 [ 88.939925][ T5322] do_mmap+0xc39/0x10c0 [ 88.942170][ T5322] vm_mmap_pgoff+0x2c9/0x4f0 [ 88.944299][ T5322] ksys_mmap_pgoff+0x51e/0x760 [ 88.946737][ T5322] do_syscall_64+0x14d/0xf80 [ 88.949734][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.953049][ T5322] [ 88.954284][ T5322] Freed by task 5328: [ 88.956227][ T5322] kasan_save_track+0x3e/0x80 [ 88.958266][ T5322] kasan_save_free_info+0x46/0x50 [ 88.960448][ T5322] __kasan_slab_free+0x5c/0x80 [ 88.962639][ T5322] slab_free_after_rcu_debug+0x126/0x220 [ 88.965035][ T5322] rcu_core+0x7cd/0x1070 [ 88.966735][ T5322] handle_softirqs+0x22a/0x870 [ 88.968883][ T5322] __irq_exit_rcu+0x5f/0x150 [ 88.971044][ T5322] irq_exit_rcu+0x9/0x30 [ 88.973038][ T5322] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 88.975964][ T5322] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 88.978872][ T5322] [ 88.979998][ T5322] Last potentially related work creation: [ 88.982759][ T5322] kasan_save_stack+0x3e/0x60 [ 88.985610][ T5322] kasan_record_aux_stack+0xbd/0xd0 [ 88.988556][ T5322] kmem_cache_free+0x426/0x630 [ 88.990750][ T5322] vms_complete_munmap_vmas+0x929/0xc60 [ 88.993453][ T5322] __mmap_complete+0x7b/0x5e0 [ 88.995787][ T5322] mmap_region+0x15a2/0x2240 [ 88.997999][ T5322] do_mmap+0xc39/0x10c0 [ 88.999964][ T5322] vm_mmap_pgoff+0x2c9/0x4f0 [ 89.002153][ T5322] ksys_mmap_pgoff+0x51e/0x760 [ 89.004368][ T5322] do_syscall_64+0x14d/0xf80 [ 89.006537][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.009372][ T5322] [ 89.010484][ T5322] The buggy address belongs to the object at ffff88803492a3c0 [ 89.010484][ T5322] which belongs to the cache vm_area_struct of size 256 [ 89.016812][ T5322] The buggy address is located 88 bytes inside of [ 89.016812][ T5322] freed 256-byte region [ffff88803492a3c0, ffff88803492a4c0) [ 89.023051][ T5322] [ 89.024517][ T5322] The buggy address belongs to the physical page: [ 89.027621][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803492ac80 pfn:0x3492a [ 89.032319][ T5322] memcg:ffff888041d07481 [ 89.034372][ T5322] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff) [ 89.038870][ T5322] page_type: f5(slab) [ 89.041970][ T5322] raw: 04fff00000000200 ffff88801c29e3c0 ffffea0001072790 ffffea000111f5d0 [ 89.046362][ T5322] raw: ffff88803492ac80 00000008000c000b 00000000f5000000 ffff888041d07481 [ 89.050332][ T5322] page dumped because: kasan: bad access detected [ 89.053547][ T5322] page_owner tracks the page as allocated [ 89.056342][ T5322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5001, tgid 5001 (run-parts), ts 50274244883, free_ts 48128614435 [ 89.066110][ T5322] post_alloc_hook+0x231/0x280 [ 89.068597][ T5322] get_page_from_freelist+0x24dc/0x2580 [ 89.072028][ T5322] __alloc_frozen_pages_noprof+0x18d/0x380 [ 89.074917][ T5322] allocate_slab+0x77/0x660 [ 89.077034][ T5322] refill_objects+0x331/0x3c0 [ 89.079359][ T5322] __pcs_replace_empty_main+0x2b9/0x620 [ 89.082065][ T5322] kmem_cache_alloc_noprof+0x37d/0x650 [ 89.085116][ T5322] vm_area_alloc+0x24/0x140 [ 89.087532][ T5322] mmap_region+0x10eb/0x2240 [ 89.090022][ T5322] do_mmap+0xc39/0x10c0 [ 89.092125][ T5322] vm_mmap_pgoff+0x2c9/0x4f0 [ 89.094320][ T5322] ksys_mmap_pgoff+0x51e/0x760 [ 89.096717][ T5322] do_syscall_64+0x14d/0xf80 [ 89.098896][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.102049][ T5322] page last free pid 4720 tgid 4720 stack trace: [ 89.105503][ T5322] __free_frozen_pages+0xc2b/0xdb0 [ 89.107806][ T5322] __slab_free+0x263/0x2b0 [ 89.109770][ T5322] qlist_free_all+0x97/0x100 [ 89.111779][ T5322] kasan_quarantine_reduce+0x148/0x160 [ 89.114179][ T5322] __kasan_slab_alloc+0x22/0x80 [ 89.116536][ T5322] kmem_cache_alloc_noprof+0x2bc/0x650 [ 89.119250][ T5322] do_getname+0x2e/0x250 [ 89.122646][ T5322] do_readlinkat+0xc8/0x510 [ 89.125427][ T5322] __x64_sys_readlink+0x7f/0x90 [ 89.127570][ T5322] do_syscall_64+0x14d/0xf80 [ 89.129725][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.132348][ T5322] [ 89.133526][ T5322] Memory state around the buggy address: [ 89.136341][ T5322] ffff88803492a300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 89.140839][ T5322] ffff88803492a380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 89.144690][ T5322] >ffff88803492a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 89.148549][ T5322] ^ [ 89.150635][ T5322] ffff88803492a480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 89.154052][ T5322] ffff88803492a500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 89.157719][ T5322] ================================================================== [ 89.324184][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 89.327541][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 89.331439][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 89.336029][ T5322] Call Trace: [ 89.337772][ T5322] [ 89.339773][ T5322] vpanic+0x56c/0xa60 [ 89.342628][ T5322] ? __pfx_vpanic+0x10/0x10 [ 89.345086][ T5322] panic+0xc5/0xd0 [ 89.346812][ T5322] ? __pfx_panic+0x10/0x10 [ 89.348815][ T5322] ? preempt_schedule_thunk+0x16/0x30 [ 89.351315][ T5322] ? ocfs2_fault+0xdb/0x440 [ 89.353352][ T5322] ? preempt_schedule_thunk+0x16/0x30 [ 89.356073][ T5322] ? ocfs2_fault+0xdb/0x440 [ 89.358679][ T5322] check_panic_on_warn+0x89/0xb0 [ 89.361477][ T5322] ? ocfs2_fault+0xdb/0x440 [ 89.363701][ T5322] end_report+0x73/0x180 [ 89.365573][ T5322] ? ocfs2_fault+0xdb/0x440 [ 89.367657][ T5322] kasan_report+0x128/0x150 [ 89.369742][ T5322] ? ocfs2_fault+0xdb/0x440 [ 89.371891][ T5322] ocfs2_fault+0xdb/0x440 [ 89.373943][ T5322] ? __pfx_ocfs2_fault+0x10/0x10 [ 89.376962][ T5322] ? css_rstat_updated+0x23a/0x530 [ 89.380495][ T5322] __do_fault+0x138/0x390 [ 89.382443][ T5322] do_pte_missing+0x228f/0x3750 [ 89.384900][ T5322] ? handle_mm_fault+0xee/0x3310 [ 89.387180][ T5322] handle_mm_fault+0x1bec/0x3310 [ 89.389429][ T5322] ? handle_mm_fault+0xee/0x3310 [ 89.391593][ T5322] ? __pfx_handle_mm_fault+0x10/0x10 [ 89.393981][ T5322] ? follow_page_pte+0x841/0x1450 [ 89.396542][ T5322] ? __pfx_follow_page_pte+0x10/0x10 [ 89.399317][ T5322] __get_user_pages+0x165b/0x29d0 [ 89.401921][ T5322] populate_vma_page_range+0x2be/0x3c0 [ 89.404494][ T5322] ? __pfx_populate_vma_page_range+0x10/0x10 [ 89.407333][ T5322] ? down_read+0x272/0x2e0 [ 89.409454][ T5322] ? __mm_populate+0x173/0x390 [ 89.411764][ T5322] __mm_populate+0x25f/0x390 [ 89.413917][ T5322] ? __pfx___mm_populate+0x10/0x10 [ 89.416355][ T5322] vm_mmap_pgoff+0x3aa/0x4f0 [ 89.419184][ T5322] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 89.422471][ T5322] ? __fget_files+0x2a/0x420 [ 89.424998][ T5322] ? __fget_files+0x3a0/0x420 [ 89.427196][ T5322] ? __fget_files+0x2a/0x420 [ 89.429439][ T5322] ksys_mmap_pgoff+0x51e/0x760 [ 89.431598][ T5322] do_syscall_64+0x14d/0xf80 [ 89.433726][ T5322] ? trace_irq_disable+0x3b/0x150 [ 89.436059][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.438846][ T5322] ? clear_bhb_loop+0x40/0x90 [ 89.442232][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.446451][ T5322] RIP: 0033:0x7ffbb659c799 [ 89.448471][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.457525][ T5322] RSP: 002b:00007ffbb745d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 89.461765][ T5322] RAX: ffffffffffffffda RBX: 00007ffbb6815fa0 RCX: 00007ffbb659c799 [ 89.465826][ T5322] RDX: 00000000027ffff7 RSI: 0000000000600000 RDI: 0000200000000000 [ 89.469582][ T5322] RBP: 00007ffbb6632bd9 R08: 0000000000000004 R09: 0000000000004000 [ 89.473564][ T5322] R10: 0000000004012011 R11: 0000000000000246 R12: 0000000000000000 [ 89.477459][ T5322] R13: 00007ffbb6816038 R14: 00007ffbb6815fa0 R15: 00007ffc4ca9a008 [ 89.481808][ T5322] [ 89.483981][ T5322] Kernel Offset: disabled [ 89.486205][ T5322] Rebooting in 86400 seconds..