last executing test programs: 266.194984ms ago: executing program 4 (id=5): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000001080)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x41, 0x0, @multicast2}, 0x20020003}}, 0x2e) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mlockall(0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="65f2ab660f38817e0efeced9ea360f5c220f01c3660f388025f00fba3300640f015f930fc7af0000", 0x28}], 0x1, 0x51, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r5, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x100000}}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$USBDEVFS_CLEAR_HALT(0xffffffffffffffff, 0x80045515, &(0x7f0000000100)={0x2}) sendmsg$nl_route_sched(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x70, 0x30, 0xb, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_skbedit={0x58, 0x3ffe, 0x0, 0x0, {{0xc}, {0x0, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_MARK={0x1, 0x3}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x7}, @TCA_SKBEDIT_PARMS={0x18}]}, {0x4}, {0xb, 0xa, {0xe4ffffff}}, {0xc, 0x9, {0xf5}}}}]}]}, 0x70}}, 0x0) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000480)="a992b6b092f0aa1f0bdb4df7dec72a8e9d4af1a690a5ffc061592fc04f1975ca0c688d8b1ab7cc250f73c182ef97d678f6ea8c597e414d9785a13975f33db5f861433ef35b11cb1468ca675ff513847daa4450d4de503e8dbe320d44cfd061a0b42592959b141cc0dd2cc5a019dc8476bb78f528b340acfa50812e2cec38564d7a8562e566fc9c65739df760dbd293818abea20265698d3918dcb03f9949f4995662b9fdbdda742ccb3fcae6242a509e2082ef6b0f74eea7e370f60b6d072e8abeb03d9eb4ec8745f7061b73efdf0b8683f92f60d9cdf79ba04dea3eb826331081ebddd0b0c6") r6 = signalfd(r0, &(0x7f00000000c0)={[0x9]}, 0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r6, 0x0, 0x0, 0xfd, &(0x7f0000000100), &(0x7f00000001c0)=""/253, 0xd, 0x0, 0xa3, 0x4c, &(0x7f00000002c0)="1af69a38d6752f920573f2732aba380d35069e6b0b1b0bea10b1553323912defbb09cf425d34175b1bcf013224f45c4ca3fbcec8084092a8e5c6d827654641a6c9d12bc67bad1c5c2a4966af88a80a44aee1e4b3e81e4c8a5d68cfb958fed66177870b64245af3c691de77bf711eb99ed02c3b16d5cccd0aedab67ae7700994306466b31735a80597e16ae553b49e42c0ab126876b571f9213823b8a2b719ee43414b9", &(0x7f0000000380)="d7f7e135bcfb4a39a46c3206b18230b8f79f44779eca1d472cf274a779f98cae6a56fc9efdf87e569e6d456fb1cb788e5ed64bb89fce3abef37fd0d3b401e1c76d67ff721f2743dfbdf8c160", 0x5, 0x0, 0x9}, 0x50) 259.381304ms ago: executing program 2 (id=3): r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)={[{0x2b, 'net_prio'}, {0x2d, 'devices'}, {0x2d, 'net_prio'}]}, 0x1d) sendfile(r0, r0, 0x0, 0x9) syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000040)='./bus\x00', 0x2000000, &(0x7f0000000080)=ANY=[@ANYRES32=r0, @ANYRES32=r0, @ANYRES8=r0], 0x3, 0x554d, &(0x7f000000ad80)="$eJzs3E1rY1UYB/CTdjrtvDgWceFuLgxCC5PQ9GXQXdUZfMEOZdSFK02TNGQmyS1NmtauXLgUF34TUXDl0s/gwrU7caG4E5TccypTHWWgaTttfz+4/d97cvLcc0MoPMklAbiwZrPffy2FG+FKCGEyhHA9hGK/lLbCaoyXQgg3QwgTj22lND57MPdyCOFqCOFGHJxMc0Zzv7w9vLXyyzu/fffD9KVrX3374+lcMfAseDmE0N2K+7vdmHkr5sM0Xhu2i+wuD1PGBzoz8fFuHsd3mxtFhd3awbxakUutOD/f2umPcrNTq4+y1d4sxrd68YT9YeugTvGEh7Xt4rjR3Ciy3c+LbO3H8+7tx/9t+/1BrNNI9T4pyofB4CDjeHOvGa9n61GR9d4gjce6eaO5N8phynS6UM87jWIdG0d4oZ9x77Z7O3vZsLndb+e9bKVSfaVSvVOubueN5qC5XK51G3eWs7lWZzStPGjWuqutPG91mpV63p3P5lr1erlazebuNjfatV5WrVaWKgvllfm0dzt78/4HWaeRzY3y9XZvZ9Du9LPNfDuLz5jPFitLr85nt6rZe2vr2fqDe/fW1t//6O6H919be/uNNOlfy8rmFhcWF8vVhfJidf4CXf9nadFjvH44ktJpLwDg7BlX///3gP4feApH6f+7j9LxE/v/7QchHH//H/T/Y3Gm+t+L3v8fw/XDkej/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAurJ+mvn6r2JmNx9fS+HNp6IV0XAohTIQQ/nyCyXD5UM3JVGfqP+ZP/WMN35dCUWF0jum0XQ0hrKbtj+eP+1UAAACA8+ubT29+Ebv1+Gf2f2eXTmhVHLeJGPFDm4nrH4+p7OgNMjX785iqFYt8cUzFivf3pbA3pmrFB1gzYyoWP3K7NK5qT2XyUMw8FqUYEye6HAAA4EQc7gROtgsBAADgJH1+2gvgdBRf6Kd78dMN/NMx0heCVw4dAQAAAGeQG/oBAADg/Cv6f7//BwAAAOdb/P0/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC/2LmXHKdhOA7A/yRjZniJCrHnKuxmjsERWLJEs2PDJeYALHoGLtAzlB0XQEItamz1pUILdVKEvk9KXSfur3bVLuyoBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGBIX9M0xYfXn442TL+/vFiep96IAAAAgH3zNL3rn0xy/Wk5/7ycelnqTUS0EXFo7t7Fo53MruSkTfvP2+33lxK+RPQJq/e4LseTiHhTjvRi6E8BAAAA/l+z+4fbPFvPD5NLd4gx5UWb9tnbSnlNRKTJt0pp7SrvVaWw/vt9Fe8rpfULWDeVwvKS21WttJP0P/f1qt3NVtHkoj34snUnq40dAAAYUbdTjDsLAQAAYEzv/qBtN2A/GFkTm7/1l1uB17kot/ce79QAAACAf9D3I9vqNeN1BQAAALiQfv4/0v5/y3P2//th/z8AAAD4a3n/PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIY0T9O72f3D7S8uf2xOzFksz1NxSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8JP9eUeBEAiDMNi7vjOZ+x9WGjQ0NqkC4eNvDAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABe/O4v/yemxplk7rWx9DySrJ0aW6fG3rlx9Ifx9WsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALvbnJQVCIAiiYM7430nf/7CSoGcQIQIaHlXUogEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgC/63S//J6bGmWTutLF0PJKsXTW2rhp7DxpHD8bbvwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnbu5zeKKg4A+JuZnaWgxlpNDzVGEw96kbIgyM140DQe/BNMmrJgZfEH9CCEGHvxZnrmYvRojImm3vgfOEPCBW8c9oCJ8bhmfnUHusElgZmBfj7Jm/edycy875ukTb/7pgsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAZfzBNE6yzWIRx+Wxm/eubmT9rQf6zPWd2ytZy+KoOLTQWOLd91p9J1puLxEAAAAOjqSq70MId9LdtayPF/P6P63OyWr+n14o4rKe31f3V31V+2ftzz/uvrI30GIxTnbTs5uj4bH9qfSe3Cw7Ip59+MX/vbCXP/n88iS/T/zx9svjNH+e0Q83bnzYz8NDjz1jAOAxOVr1ZVD9PZT1gzYTA+DA6NUK76r+TxbbzQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgCePt8FwVRyGEld40zty6d3VjVn995/ZK1U5du7YTvpveM7tFGkI4uzkaHmt0Nt126fKV8+uj0fBi88HrIYS2Rn+/nP75T+c4OYSHnNNrcRYPBv92I40nG1Q/1PNfFZdXdCD5pyaYjFr6hQQAwDMrLVtW199Jd9eyY9FSCJOf76//36rFYc76/+5np27Wx6rX/4PGZth9q1sXvlq9dPnKO5sX1s8Nzw2/ePf44L3BidMnT55ezT8rWfWJCQAAAI9sMplM9nb6ZavX//HS/vX/I7U4zFn/f/3j4Nv6wIn6f6bpol/bmQAAABxsL73xz9/RjONRfyF8s761dXFQbKN+v9g/XmxbSPWRHSpbvf5PltrOCgAAAGjCeDu6b/3/TC0Oc67/P//Lq7/V75mEEA6X6/9HN74cnWluOp3WxL8Ttz1HAAAA2nW4bPX1/zR//z/ee+UhDiG8/WYRl18D+ND6Py3r/+Sj73+tj1V///9Ec1PspHi5eB55vxxCb7ntjAAAAHiWLZQtK/b/SnfXPv/9yCd97/8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANO2/AAAA///BvkAn") 183.872886ms ago: executing program 1 (id=2): r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="64656275672c757466383d312c757466383d302c757466383d312c73686f72746e616d653d77696e39352c636865636b3d7374726963742c73686f72746e616d653d77696e6e742c73686f72746e616d653d6c6f7765722c002bc08d8cca74e8ecafb48437094fe1a4a2383bd9d85bff651d1101fd722e01b9b5d22f08b5fc0ac7cbf33fb553a90ae4d01d71ddeeb089f517aeaaa271899287d5b8949b22b23c2807b7d81714b89e9682f6c3faa6107733a77a4cf985560ed64ec24e255dee3654aa2ba55be4bf3ae257adba34bed8e32e4122bb46aa57a75dab0288098e42f886f09bdf63537db28a454b02a4204a7e7dac3c30a6d4b5c814916b02", @ANYBLOB="a3e0aabaf079339d7469b1335e823af6b9f1efda2a073788d7ffc707eeae28b82f29ef43f038551e413f148e8c3c421c32fbac0e685cd20d8743806b86950d1a776261c430fcdf5f0dcbc404161a1081e3cb32c5cee1563c6d4afd7938cd4a5d4e0c5c849ec6c55b0a68c9f922fd9713b0ab723fcd82704da0943adf54a94f7a5eaa"], 0x1, 0x25a, &(0x7f0000000240)="$eJzs2s9rI2UYB/Bn6sqmXbqp+ItdEF/0oF6Gbc8edpEKYkFRK6yC7KydauyYlE4oRMT2pFf/BM/i0Zsge/TSi3+BB2+99LgHcSRNWtOysIs/mqX7+RySh3nnm7zzvmF4ErL/6refb6zX+XrRj5ksi5nrsRt3s1iImTiyG6+8dPOX5969+cGbN1ZWWuOjSymly8///OGXP7xwp3/p/R8v/3Qx9hY+2j9Y+n3vmb0r+3++92mnTp06dXv9VKTbvV6/uF2Vaa1Tb+QpvV2VRV2mTrcut06Mr1e9zc1BKrpr83ObW2Vdp6I7SBvlIPV7qb81SMUnRaeb8jxP83PBv7H6/d2miYPm8VvRNM3sd3HpTsz/Fu3InkjZk9ezp29lz+5mVw6apn06OjudGfPf+sf7z7kwvqkvv5NSK6L6Znt1e3X0PBxtxY316EQVZVyL2fgjhh+TsVH9+hsry9fSoYX4utoZ53e2Vx87fP3j/GK0Y+He+cVRPh3lL0bE8HFuMr8U7Xjq3vmlU/nR+7fi5Rcn8nm049ePoxdVrMUwGzvjJVj+ajGl195aOZW/engeAMB5k6djw/5t2LSd6N/y/MT4RH80yk/0h+379Ien+qsLcfXCdK+diHrwxUZRVeXW8AveYXF85FEtZieX5UGKo59C/r+JzZzYs4dloRTnuYj4bCp3JM7S35t+31NbZzIhAAAAAAAAAAAAHshZ/J1w2tcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA83P4KAAD//8scwHs=") r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000400)) (async) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200), 0x4) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000016c0)={@map=0x1, 0xa, 0x0, 0x3, &(0x7f00000015c0)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000001600)=[0x0, 0x0], &(0x7f0000001640)=[0x0], &(0x7f0000001680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000016c0)={@map=0x1, 0xa, 0x0, 0x3, &(0x7f00000015c0)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000001600)=[0x0, 0x0], &(0x7f0000001640)=[0x0], &(0x7f0000001680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000017c0)={'erspan0\x00', &(0x7f0000001740)={'gretap0\x00', 0x0, 0xc8, 0x40, 0x8, 0xa, {{0x17, 0x4, 0x3, 0xd, 0x5c, 0x64, 0x0, 0xd, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x1b}, @rand_addr=0x64010100, {[@rr={0x7, 0x2b, 0xc7, [@empty, @loopback, @dev={0xac, 0x14, 0x14, 0x33}, @multicast1, @multicast1, @multicast1, @broadcast, @remote, @local, @loopback]}, @lsrr={0x83, 0x1b, 0x2f, [@broadcast, @multicast1, @dev={0xac, 0x14, 0x14, 0x28}, @loopback, @empty, @multicast1]}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000017c0)={'erspan0\x00', &(0x7f0000001740)={'gretap0\x00', 0x0, 0xc8, 0x40, 0x8, 0xa, {{0x17, 0x4, 0x3, 0xd, 0x5c, 0x64, 0x0, 0xd, 0x29, 0x0, @dev={0xac, 0x14, 0x14, 0x1b}, @rand_addr=0x64010100, {[@rr={0x7, 0x2b, 0xc7, [@empty, @loopback, @dev={0xac, 0x14, 0x14, 0x33}, @multicast1, @multicast1, @multicast1, @broadcast, @remote, @local, @loopback]}, @lsrr={0x83, 0x1b, 0x2f, [@broadcast, @multicast1, @dev={0xac, 0x14, 0x14, 0x28}, @loopback, @empty, @multicast1]}]}}}}}) pipe2(&(0x7f0000001800), 0x0) (async) pipe2(&(0x7f0000001800)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001700)={@ifindex=r4, r2, 0x2, 0x200c, 0x0, @value=r5, @void, @void, @void, r3}, 0x20) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@local}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000000500)=""/4092}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) fsmount(r0, 0x0, 0x1) (async) fsmount(r0, 0x0, 0x1) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) readlinkat(r6, &(0x7f00000000c0)='./file0\x00', &(0x7f00000005c0)=""/4096, 0x1000) (async) readlinkat(r6, &(0x7f00000000c0)='./file0\x00', &(0x7f00000005c0)=""/4096, 0x1000) r7 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$uac3(0x5, 0xa7, &(0x7f0000000d40)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x249c, 0x9002, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x95, 0x3, 0x1, 0x45, 0x10, 0xe4, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0x35}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xd, 0x31, 0x5}, [@input_terminal={0x14, 0x24, 0x2, 0x2, 0x404, 0x6, 0x4, 0xc9, 0x3, 0x80, 0x2, 0x7}, @output_terminal={0x13, 0x24, 0x3, 0x3, 0x405, 0x1, 0x5, 0x2, 0xffffffff, 0x1ff, 0x3ff, 0x7f}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0xe, 0x9, 0x9, {0xa, 0x25, 0x25, 0x8, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x2, 0xc, 0x0, {0xa, 0x25, 0x25, 0xc9c, 0xd, 0xd}}}}}}}}]}}, 0x0) (async) syz_usb_connect$uac3(0x5, 0xa7, &(0x7f0000000d40)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x249c, 0x9002, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x95, 0x3, 0x1, 0x45, 0x10, 0xe4, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0x35}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0xd, 0x31, 0x5}, [@input_terminal={0x14, 0x24, 0x2, 0x2, 0x404, 0x6, 0x4, 0xc9, 0x3, 0x80, 0x2, 0x7}, @output_terminal={0x13, 0x24, 0x3, 0x3, 0x405, 0x1, 0x5, 0x2, 0xffffffff, 0x1ff, 0x3ff, 0x7f}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0xe, 0x9, 0x9, {0xa, 0x25, 0x25, 0x8, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x2, 0xc, 0x0, {0xa, 0x25, 0x25, 0xc9c, 0xd, 0xd}}}}}}}}]}}, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) (async) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r7, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x68, 0x30, 0xffff, 0x70bd29, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffffb}, 0x3, r9}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) (async) sendmsg$nl_route_sched(r7, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newtaction={0x68, 0x30, 0xffff, 0x70bd29, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffffb}, 0x3, r9}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r10) r11 = socket$packet(0x11, 0x2, 0x300) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r10, @ANYBLOB=',wfdno=', @ANYRESHEX=r11, @ANYBLOB="46bd"]) 141.016507ms ago: executing program 3 (id=4): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x400000) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async, rerun: 32) write$bt_hci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01"], 0x17) (async, rerun: 32) ioctl$FIOCLEX(r0, 0x5451) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) munlock(&(0x7f0000fe9000/0x14000)=nil, 0x14000) (async, rerun: 32) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x14, 0x0, 0xf800) (rerun: 32) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, &(0x7f0000010000)=ANY=[@ANYBLOB="1800000001000000000000000000000063010400000000009500000000000000587cef8e11908f87e4a058"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1d}, 0x80) socket$can_raw(0x1d, 0x3, 0x1) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x75, 0x4) (async) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) r4 = fcntl$dupfd(r3, 0x0, r3) (async, rerun: 32) sendto$inet(r3, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (rerun: 32) r5 = syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f0000000300)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r5, 0x0, 0x0) (async) syz_usb_control_io$rtl8150(r5, 0x0, &(0x7f0000000340)={0x2c, &(0x7f0000000140)={0x0, 0xd, 0x2, "addd"}, 0x0, 0x0, 0x0, 0x0}) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) (async) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) (async) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) (async, rerun: 32) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io(r5, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000580)={0x40, 0x30, 0x83, "128a353bce8ab253d3a30a82a102d6cd12e89ff17699c4c00180fe3a0d349e6a34ac52924e602fc40df1104663b60777bd7af9a68fbe314de232e9665626cb69c928665b85191bb5a3b133a4c1180f6e376fad6b86c3921e77ed21b9316d80f9926b356b0ac3f6c72e13443cfe65d177bae6ca263e417b0ca48a3419a9273eb64973a6"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)={0x40, 0xb, 0x2, "c657"}, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a00)={0x40, 0x1a, 0x2, 0x2000}, &(0x7f0000000a40)={0x40, 0x1c, 0x1, 0x9}, &(0x7f0000000a80)={0x40, 0x1e, 0x1, 0x49}, 0x0}) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) sendmsg$IEEE802154_LLSEC_ADD_DEV(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x14, r7, 0x852dd6c070cd7e4d}, 0x14}, 0x4, 0x700000000000000}, 0x0) (async) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000040)=0x3, 0x4) 67.112989ms ago: executing program 3 (id=6): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000540)=ANY=[@ANYBLOB="200000006a00717625bd7000fe52ed92e79ee8c11000000008000a"], 0x20}, 0x1, 0x0, 0x0, 0x4011}, 0x4004000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x13, r1, 0x8cee000) (async, rerun: 32) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) (rerun: 32) 0s ago: executing program 0 (id=1): mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000140)=0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffd, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0xf}, {0x1, 0x9, 0xc, '\x00', 0xfb}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x3, 0x4, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0x8}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x7, '\x00', 0xdc}, {0x40, 0x1, 0x5, '\x00', 0x1}, {0xfe, 0x3, 0x26}, {0xcf, 0x3, 0x1, '\x00', 0x6}, {0xf, 0xee, 0xa, '\x00', 0x3}, {0x39, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0xc, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7}, {0x0, 0x80, 0x1, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x3, '\x00', 0x10}, {0x1, 0x23, 0xf3, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='oom_score_adj < 1&', 0x12) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.66' (ED25519) to the list of known hosts. [ 28.597181][ T30] audit: type=1400 audit(1786262622.975:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.601380][ T277] cgroup: Unknown subsys name 'net' [ 28.620038][ T30] audit: type=1400 audit(1786262622.975:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.647360][ T30] audit: type=1400 audit(1786262623.005:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.647963][ T277] cgroup: Unknown subsys name 'devices' [ 28.851457][ T277] cgroup: Unknown subsys name 'hugetlb' [ 28.857152][ T277] cgroup: Unknown subsys name 'rlimit' [ 29.060770][ T30] audit: type=1400 audit(1786262623.445:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 29.084004][ T30] audit: type=1400 audit(1786262623.445:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 29.109210][ T30] audit: type=1400 audit(1786262623.445:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 29.123536][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 29.141454][ T30] audit: type=1400 audit(1786262623.525:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.165423][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.167079][ T30] audit: type=1400 audit(1786262623.525:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.201587][ T30] audit: type=1400 audit(1786262623.545:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.227945][ T30] audit: type=1400 audit(1786262623.545:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 30.000263][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.007372][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.015063][ T285] device bridge_slave_0 entered promiscuous mode [ 30.025129][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.032305][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.039741][ T285] device bridge_slave_1 entered promiscuous mode [ 30.133723][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.140891][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.148880][ T286] device bridge_slave_0 entered promiscuous mode [ 30.155852][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.163049][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.170575][ T286] device bridge_slave_1 entered promiscuous mode [ 30.191978][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.199264][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.206748][ T288] device bridge_slave_0 entered promiscuous mode [ 30.221297][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.228374][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.235857][ T289] device bridge_slave_0 entered promiscuous mode [ 30.245697][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.252870][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.260297][ T289] device bridge_slave_1 entered promiscuous mode [ 30.266947][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.274124][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.281696][ T288] device bridge_slave_1 entered promiscuous mode [ 30.319313][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.326393][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.333873][ T287] device bridge_slave_0 entered promiscuous mode [ 30.340926][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.347985][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.355572][ T287] device bridge_slave_1 entered promiscuous mode [ 30.507705][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.514810][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.548029][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.556240][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.563586][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.570652][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.588564][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.595656][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.602961][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.610035][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.619571][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.626626][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.633949][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.641096][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.649895][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.656953][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.664262][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.671319][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.700152][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.709198][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.716385][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.724329][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.731836][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.739290][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.746506][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.753827][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.761153][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.768509][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.777073][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.784580][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.792001][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.800361][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.808479][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.815555][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.837409][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.853566][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.862351][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.869437][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.888952][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.898072][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.906468][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.913674][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.921541][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.929799][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.936997][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.944440][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.952592][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.959657][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.967032][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.975524][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.013313][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.021732][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.028912][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.037778][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.046036][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.053098][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.060632][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.068586][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.076731][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.084722][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.092816][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.101816][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.110776][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 31.118241][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 31.128993][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 31.137397][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 31.145785][ T8] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.152860][ T8] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.160587][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 31.169145][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 31.177302][ T8] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.184375][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.197309][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.205305][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.213495][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.221395][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.229482][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 31.237600][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.251412][ T289] device veth0_vlan entered promiscuous mode [ 31.257959][ T288] device veth0_vlan entered promiscuous mode [ 31.266530][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.275242][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.283693][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.292036][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.300369][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.307837][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.325548][ T285] device veth0_vlan entered promiscuous mode [ 31.333454][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.341913][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.350458][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.359247][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.368111][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.376285][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.384491][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.391994][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.405731][ T286] device veth0_vlan entered promiscuous mode [ 31.418543][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.427209][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.435793][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.443913][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.452055][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 31.460156][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 31.468071][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 31.476356][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 31.484556][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.492168][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.503671][ T288] device veth1_macvtap entered promiscuous mode [ 31.512442][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.520868][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.530844][ T289] device veth1_macvtap entered promiscuous mode [ 31.549101][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.557467][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 31.565821][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.575423][ T285] device veth1_macvtap entered promiscuous mode [ 31.583551][ T286] device veth1_macvtap entered promiscuous mode [ 31.594793][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 31.602593][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.611001][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.619594][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.627803][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.636444][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.644825][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.667312][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.675648][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.684879][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 31.693438][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 31.701975][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.710410][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.720507][ T287] device veth0_vlan entered promiscuous mode [ 31.734509][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 31.742756][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 31.743492][ T288] request_module fs-gadgetfs succeeded, but still no fs? [ 31.752874][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.766602][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.775801][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 31.783606][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 31.791244][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.799572][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.845402][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 31.858601][ T311] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 31.861038][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.884825][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.902299][ T287] device veth1_macvtap entered promiscuous mode [ 31.920073][ T317] loop1: detected capacity change from 0 to 128 [ 31.950032][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.978255][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.006258][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.022158][ T327] UDC core: couldn't find an available UDC or it's busy: -16 [ 32.039188][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.061001][ T327] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 32.095998][ T327] 9pnet: Insufficient options for proto=fd [ 32.111523][ T311] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 32.120212][ T311] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 32.159123][ T309] ================================================================== [ 32.167242][ T309] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 32.175777][ T309] Read of size 4 at addr ffff888129c98800 by task syz.4.5/309 [ 32.183462][ T309] [ 32.185829][ T309] CPU: 0 PID: 309 Comm: syz.4.5 Not tainted syzkaller #0 [ 32.193274][ T309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.203459][ T309] Call Trace: [ 32.206763][ T309] [ 32.209734][ T309] __dump_stack+0x21/0x30 [ 32.214505][ T309] dump_stack_lvl+0x110/0x170 [ 32.219219][ T309] ? show_regs_print_info+0x20/0x20 [ 32.224451][ T309] ? load_image+0x3f0/0x3f0 [ 32.228985][ T309] ? __local_bh_enable_ip+0x58/0x80 [ 32.234217][ T309] print_address_description+0x7f/0x2c0 [ 32.239798][ T309] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 32.245569][ T309] kasan_report+0x10f/0x150 [ 32.250463][ T309] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 32.256223][ T309] __asan_report_load4_noabort+0x14/0x20 [ 32.261894][ T309] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 32.267475][ T309] pppol2tp_release+0x150/0x2b0 [ 32.272369][ T309] sock_close+0xb8/0x200 [ 32.276729][ T309] ? sock_mmap+0xa0/0xa0 [ 32.281008][ T309] __fput+0x22b/0x900 [ 32.285022][ T309] ____fput+0x15/0x20 [ 32.289041][ T309] task_work_run+0x127/0x190 [ 32.294014][ T309] exit_to_user_mode_loop+0xd0/0xe0 [ 32.298912][ T39] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 32.299266][ T309] exit_to_user_mode_prepare+0x87/0xd0 [ 32.312203][ T309] syscall_exit_to_user_mode+0x1a/0x30 [ 32.317693][ T309] do_syscall_64+0x58/0xa0 [ 32.322232][ T309] ? clear_bhb_loop+0x50/0xa0 [ 32.326947][ T309] ? clear_bhb_loop+0x50/0xa0 [ 32.332199][ T309] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 32.338130][ T309] RIP: 0033:0x7f9886bd00d9 [ 32.342580][ T309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.362220][ T309] RSP: 002b:00007fff0967f7e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 32.371096][ T309] RAX: 0000000000000000 RBX: 00007f9886e59da0 RCX: 00007f9886bd00d9 [ 32.379361][ T309] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 32.383044][ T312] loop2: detected capacity change from 0 to 40427 [ 32.387356][ T309] RBP: 00007f9886e59da0 R08: 00007f9886e58038 R09: 0000000000000000 [ 32.387374][ T309] R10: 00000000003ffc64 R11: 0000000000000246 R12: 0000000000007f7a [ 32.409911][ T309] R13: 00007f9886e5809c R14: 0000000000007d72 R15: 00007f9886e58090 [ 32.417929][ T309] [ 32.420982][ T309] [ 32.423356][ T309] Allocated by task 311: [ 32.427708][ T309] __kasan_kmalloc+0xd4/0x100 [ 32.432803][ T309] __kmalloc+0x13d/0x2c0 [ 32.437184][ T309] l2tp_session_create+0x39/0xb60 [ 32.442247][ T309] pppol2tp_connect+0xbf5/0x1640 [ 32.447222][ T309] __sys_connect+0x3cb/0x450 [ 32.451844][ T309] __x64_sys_connect+0x7a/0x90 [ 32.456646][ T309] x64_sys_call+0x7c/0x9a0 [ 32.461100][ T309] do_syscall_64+0x4c/0xa0 [ 32.465557][ T309] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 32.471483][ T309] [ 32.473845][ T309] Freed by task 45: [ 32.477673][ T309] kasan_set_track+0x4a/0x70 [ 32.482294][ T309] kasan_set_free_info+0x23/0x40 [ 32.487269][ T309] ____kasan_slab_free+0x125/0x160 [ 32.492409][ T309] __kasan_slab_free+0x11/0x20 [ 32.497211][ T309] slab_free_freelist_hook+0xc2/0x190 [ 32.502613][ T309] kfree+0xc4/0x270 [ 32.506451][ T309] l2tp_session_put+0xaf/0x1a0 [ 32.511253][ T309] l2tp_session_delete+0x3a9/0x4a0 [ 32.516399][ T309] l2tp_tunnel_del_work+0x180/0x3d0 [ 32.521641][ T309] process_one_work+0x6c8/0xbb0 [ 32.526531][ T309] worker_thread+0xaa0/0x1250 [ 32.531241][ T309] kthread+0x3f5/0x4f0 [ 32.535333][ T309] ret_from_fork+0x1f/0x30 [ 32.538057][ T326] cgroup: fork rejected by pids controller in [ 32.539776][ T309] [ 32.539781][ T309] The buggy address belongs to the object at ffff888129c98800 [ 32.539781][ T309] which belongs to the cache kmalloc-512 of size 512 [ 32.539797][ T309] The buggy address is located 0 bytes inside of [ 32.539797][ T309] 512-byte region [ffff888129c98800, ffff888129c98a00) [ 32.539816][ T309] The buggy address belongs to the page: [ 32.539835][ T309] page:ffffea0004a72600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x129c98 [ 32.546685][ T326] /syz3 [ 32.548339][ T309] head:ffffea0004a72600 order:2 compound_mapcount:0 compound_pincount:0 [ 32.565291][ T326] [ 32.575501][ T309] flags: 0x4000000000010200(slab|head|zone=1) [ 32.575537][ T309] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 32.575559][ T309] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 32.575569][ T309] page dumped because: kasan: bad access detected [ 32.575578][ T309] page_owner tracks the page as allocated [ 32.640309][ T309] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 292, ts 31839636114, free_ts 0 [ 32.659272][ T309] post_alloc_hook+0x192/0x1b0 [ 32.664081][ T309] prep_new_page+0x1c/0x110 [ 32.668624][ T309] get_page_from_freelist+0x2c3a/0x2cd0 [ 32.674200][ T309] __alloc_pages+0x1a2/0x460 [ 32.678827][ T309] new_slab+0xa0/0x4d0 [ 32.682916][ T309] ___slab_alloc+0x3ac/0x840 [ 32.687541][ T309] __slab_alloc+0x49/0x90 [ 32.691898][ T309] __kmalloc_track_caller+0x169/0x2c0 [ 32.697295][ T309] __alloc_skb+0x210/0x730 [ 32.701736][ T309] __ipv6_ifa_notify+0x200/0xe70 [ 32.706707][ T309] addrconf_dad_completed+0x182/0xe20 [ 32.712102][ T309] addrconf_dad_work+0xc4c/0x1510 [ 32.717207][ T309] process_one_work+0x6c8/0xbb0 [ 32.722090][ T309] worker_thread+0xaa0/0x1250 [ 32.727160][ T309] kthread+0x3f5/0x4f0 [ 32.731263][ T309] ret_from_fork+0x1f/0x30 [ 32.735704][ T309] page_owner free stack trace missing [ 32.741089][ T309] [ 32.743439][ T309] Memory state around the buggy address: [ 32.749091][ T309] ffff888129c98700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.757183][ T309] ffff888129c98780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.765287][ T309] >ffff888129c98800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.773370][ T309] ^ [ 32.777466][ T309] ffff888129c98880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.785568][ T309] ffff888129c98900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 32.793652][ T309] ================================================================== [ 32.801746][ T309] Disabling lock debugging due to kernel taint [ 32.833538][ T309] ------------[ cut here ]------------ [ 32.842562][ T39] usb 2-1: New USB device found, idVendor=249c, idProduct=9002, bcdDevice= 0.40 [ 32.870883][ T312] F2FS-fs (loop2): Mismatch start address, segment0(16) cp_blkaddr(0) [ 32.888822][ T312] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 32.890268][ T39] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.901092][ T312] F2FS-fs (loop2): Unrecognized mount option "ÿÿÿÿÿÿÿÿÿ" or missing value [ 32.934899][ T309] WARNING: CPU: 0 PID: 309 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 32.939478][ T39] usb 2-1: Product: syz [ 32.945792][ T309] Modules linked in: [ 32.954326][ T309] CPU: 0 PID: 309 Comm: syz.4.5 Tainted: G B syzkaller #0 [ 32.963244][ T309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.964590][ T39] usb 2-1: Manufacturer: syz [ 32.973951][ T309] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 32.988032][ T39] usb 2-1: SerialNumber: syz [ 32.993399][ T309] Code: 5d c3 e8 2c 83 0b fd be 02 00 00 00 eb 0a e8 20 83 0b fd be 01 00 00 00 4c 89 f7 e8 33 02 f2 fd e9 0f ff ff ff e8 09 83 0b fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 f8 82 0b fd 4c 89 f7 be 03 [ 33.028679][ T309] RSP: 0018:ffffc90007807d10 EFLAGS: 00010293 [ 33.038866][ T309] RAX: ffffffff845e33d7 RBX: ffff88810ec03000 RCX: ffff8881284c13c0 [ 33.047168][ T309] RDX: 0000000000000000 RSI: 000000000f3853c0 RDI: 000000000c04eb7d [ 33.055447][ T309] RBP: ffffc90007807d30 R08: 0000000000000003 R09: 0000000000000004 [ 33.064612][ T309] R10: dffffc0000000000 R11: fffffbfff0e18e4c R12: dffffc0000000000 [ 33.072856][ T309] R13: dffffc0000000000 R14: 000000000f3853c0 R15: ffff888129c98800 [ 33.087580][ T309] FS: 0000555569a4e500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 33.100472][ T309] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.109038][ T309] CR2: 00007f86f31d12f8 CR3: 00000001294b2000 CR4: 00000000003506b0 [ 33.117190][ T309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 33.125670][ T309] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 33.133983][ T309] Call Trace: [ 33.137396][ T309] [ 33.143067][ T309] pppol2tp_release+0x150/0x2b0 [ 33.148061][ T309] sock_close+0xb8/0x200 [ 33.152862][ T309] ? sock_mmap+0xa0/0xa0 [ 33.157192][ T309] __fput+0x22b/0x900 [ 33.161467][ T309] ____fput+0x15/0x20 [ 33.165537][ T309] task_work_run+0x127/0x190 [ 33.170421][ T309] exit_to_user_mode_loop+0xd0/0xe0 [ 33.175731][ T309] exit_to_user_mode_prepare+0x87/0xd0 [ 33.181460][ T309] syscall_exit_to_user_mode+0x1a/0x30 [ 33.187100][ T309] do_syscall_64+0x58/0xa0 [ 33.192026][ T309] ? clear_bhb_loop+0x50/0xa0 [ 33.196819][ T309] ? clear_bhb_loop+0x50/0xa0 [ 33.201650][ T309] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 33.207745][ T309] RIP: 0033:0x7f9886bd00d9 [ 33.212347][ T309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 33.232295][ T309] RSP: 002b:00007fff0967f7e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 33.241009][ T309] RAX: 0000000000000000 RBX: 00007f9886e59da0 RCX: 00007f9886bd00d9 [ 33.249229][ T309] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 33.257226][ T309] RBP: 00007f9886e59da0 R08: 00007f9886e58038 R09: 0000000000000000 [ 33.265300][ T309] R10: 00000000003ffc64 R11: 0000000000000246 R12: 0000000000007f7a [ 33.273587][ T309] R13: 00007f9886e5809c R14: 0000000000007d72 R15: 00007f9886e58090 [ 33.281708][ T309] [ 33.284759][ T309] ---[ end trace 564d501b923ff49a ]--- [ 33.369025][ T39] usb 2-1: unit 5 not found! [ 33.426120][ T39] usb 2-1: USB disconnect, device number 2 [ 33.804974][ T30] kauditd_printk_skb: 53 callbacks suppressed [ 33.804989][ T30] audit: type=1400 audit(1786262628.185:127): avc: denied { unmount } for pid=286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 36.713848][ T30] audit: type=1400 audit(1786262631.095:128): avc: denied { read } for pid=366 comm="poweroff" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Stopping sshd: stopped /usr/sbin/sshd (pid 192) OK Stopping crond: stopped /usr/sbin/crond (pid 185) OK Stopping dhcpcd... stopped /sbin/dhcpcd (pid 139) [ 36.991611][ T30] audit: type=1400 audit(1786262631.375:129): avc: denied { search } for pid=378 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping network: [ 37.089043][ T30] audit: type=1400 audit(1786262631.475:130): avc: denied { write } for pid=140 comm="dhcpcd" name="dhcpcd" dev="tmpfs" ino=481 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 37.119075][ T30] audit: type=1400 audit(1786262631.475:131): avc: denied { remove_name } for pid=140 comm="dhcpcd" name="sock" dev="tmpfs" ino=483 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 OK [ 37.143198][ T30] audit: type=1400 audit(1786262631.475:132): avc: denied { unlink } for pid=140 comm="dhcpcd" name="sock" dev="tmpfs" ino=483 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file permissive=1 [ 37.165502][ T30] audit: type=1400 audit(1786262631.495:133): avc: denied { unlink } for pid=140 comm="dhcpcd" name="pid" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 Stopping iptables: [ 37.193699][ T30] audit: type=1400 audit(1786262631.575:134): avc: denied { search } for pid=392 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 OK [ 37.215751][ T30] audit: type=1400 audit(1786262631.575:135): avc: denied { write } for pid=392 comm="iptables" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 37.238407][ T30] audit: type=1400 audit(1786262631.575:136): avc: denied { add_name } for pid=392 comm="iptables" name="xtables.lock" scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Stopping system message bus: done Stopping klogd: OK Stopping acpid: OK Stopping syslogd: stopped /sbin/syslogd (pid 83) OK umount: can't remount debugfs read-only umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Connection to 10.128.0.66 closed by remote host. Sent SIGTERM to all processes [ 38.778210][ T288] syz-executor (288) used greatest stack depth: 22056 bytes left [ 38.821190][ T285] syz-executor (285) used greatest stack depth: 21096 bytes left [ 39.519505][ T8] device bridge_slave_1 left promiscuous mode [ 39.525644][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.533485][ T8] device bridge_slave_0 left promiscuous mode [ 39.539737][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.547683][ T8] device veth1_macvtap left promiscuous mode [ 39.553928][ T8] device veth0_vlan left promiscuous mode Sent SIGKILL to all processes Requesting system poweroff [ 40.559935][ T8] device bridge_slave_1 left promiscuous mode [ 40.566353][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.573930][ T8] device bridge_slave_0 left promiscuous mode [ 40.580178][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.588282][ T8] device bridge_slave_1 left promiscuous mode [ 40.594459][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.602054][ T8] device bridge_slave_0 left promiscuous mode [ 40.608178][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.616492][ T8] device bridge_slave_1 left promiscuous mode [ 40.622750][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.630352][ T8] device bridge_slave_0 left promiscuous mode [ 40.636764][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.645390][ T8] device veth1_macvtap left promiscuous mode [ 40.651433][ T8] device veth0_vlan left promiscuous mode [ 40.657440][ T8] device veth1_macvtap left promiscuous mode [ 40.663514][ T8] device veth0_vlan left promiscuous mode [ 40.669550][ T8] device veth1_macvtap left promiscuous mode [ 40.675548][ T8] device veth0_vlan left promiscuous mode [ 40.777232][ T413] kvm: exiting hardware virtualization [ 40.785059][ T413] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 40.792203][ T413] ACPI: PM: Preparing to enter system sleep state S5 [ 40.799288][ T413] reboot: Power down serialport: VM disconnected.