program: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x7, 0x1, 0x37946dc765e95746, 0x0, 0x0, {0x2, 0x0, 0x3}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x3edfec16767d76ff}, 0x4000004) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES8=r2, @ANYRES8=r1, @ANYBLOB='\x00'/20, @ANYRES8=r1, @ANYRES32=0x0, @ANYRESHEX=r1], 0x48) ioctl$XFS_IOC_EXCHANGE_RANGE(r0, 0x40285881, &(0x7f0000000200)={r0, 0x0, 0x2, 0x1, 0x5, 0x2}) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000240), &(0x7f0000000000)=""/10, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000010c0)={r3, &(0x7f0000000240), 0x0}, 0x20) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x200, 0x0) syz_mount_image$hfs(&(0x7f00000001c0), &(0x7f0000000180)='./file1\x00', 0x3004048, &(0x7f0000000100)=ANY=[], 0x11, 0x2c6, &(0x7f0000005bc0)="$eJzs3btuE08Ux/HfjJ3E/3+isCFBSJSBSNAgCA2iMUKueAIqBMRGirCCgCAuVUBUCEFPR8Er8BA0IF4AKioeIFSLZmbt9WXXNpbjjcP3I8XatWd2z3gvc46laAXgn3Wt9v3jpZ/uz0gllaTXVyQrqSKVJZ3Qycrjnd3t3WajPmhDJd/D/RmFnqavzdZOI6ur6+d7JCK3VtZS53vB4niDRK44jq/+KDoIFM5f/RmstKD5dL0yxZhG8WLMfnsTjmPWmH3t66mWi44DAFCsZP63IZPXUpK/WyttJNO+zw8O2/w/rv2iAzhw8cBPO+Z/X2XFxh3fY/6jtN7zJZz73LaqxFH2PNez7tNH25NgmmFVpY/F/nd3u9k4v3W/Wbd6qWqio9maf62HU7dlSLTrGbXpACOM3WRnlL5etXNuDJsh/ieSuuJfHXOPYzOfzVdz00R6r3o7/yvHxh0mf6SiniMV4r+Qv0U/ysi1UnLbqFartqvJit/JKXWWEsNGWcmuSNQ6o1bU/QNBNCxO3+t4T68wuotDeq1m9tpsreX0Wuvq5UbTPpvz93fQzFtzw6zrlz6p1pH/WxffhgZemelVYzbCVOC/8TCe+ezdlf02o76Zo/9yaX+LC3mh/+69p13/EA++zSHPG93RZS0/evb8XqnZbDx0C7czFh4std+ZeyVltil4QXvpOwuKvb7GrUlpmoGdm+gG3f1jaGN3lR2Kg3KkF2pfpnsiFbFQ8P0JU5Ee9KIjQUFc3mVC/ZfWK+WQ7LmXKDNPH/GHgGSLscux2xVc2jcOGbmk//+qglvMr+D6a66+mtHXXKfPSmdG32OUxHlEmJq+6Ra//wMAAAAAAAAAAAAAAAAAAMyaafw7QdFjBAAAAAAAAAAAAAAAAAAAAABg1rWf/6vW83812vN/e5+7Msnn/77bUfbzfwFM0p8AAAD//0gLf7E=") r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) creat(&(0x7f0000000600)='./bus\x00', 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) pwrite64(r5, &(0x7f0000000140)='2', 0x1, 0x8080c61) creat(&(0x7f0000000300)='./bus\x00', 0x4) unlinkat(0xffffffffffffff9c, &(0x7f0000000c40)='./file1\x00', 0x0) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0xcb) mount(&(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000400)='./file1\x00', &(0x7f0000000440)='binder\x00', 0x800, &(0x7f0000000480)='\xa0{\x00') r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000280)={0x0, r1}, 0x8) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x5, 0x1004, 0x4, 0x4, 0x0, 0xffffffffffffffff, 0x5, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x10000000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x5, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x6, 0x9, 0x0, 0x6, 0xe7030000}, {0x4, 0x0, 0x0, 0x6}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x4, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x14}}], {{0x5, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x2}}}, &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0xfffffd83, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000000f40)={0x0, 0x55, &(0x7f00000001c0)={&(0x7f0000000e00)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010d29bd7000fddbdf251b00000008009a0001000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4044800}, 0x4010) r8 = syz_create_resource$binfmt(&(0x7f0000000100)='./file1\x00') r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_MSRS_sys(r9, 0xc008ae88, &(0x7f00000000c0)={0x1, 0x0, [{0x482, 0x0, 0x2}]}) openat$binfmt(0xffffffffffffff9c, r8, 0x41, 0x1ff) syz_mount_image$btrfs(&(0x7f0000000000), &(0x7f0000000040)='./file1\x00', 0xa08811, &(0x7f0000000080)={[{@autodefrag}, {@datasum}, {@thread_pool={'thread_pool', 0x3d, 0x2}}, {@noenospc_debug}, {@space_cache_v2}, {@compress_force}]}, 0xfb, 0x5112, &(0x7f000000a240)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDnZXRG9dPXZs+c26mufPAlpnL+6bXnQ6h1tley+s7tj77ypvbdrw4ETvMvpwtG41+h8y6ns8aq3o2LvTr/Xk9hDCWDFDPl8+sKY1aXN1THrDS9Yu7j27a29x4/HC7fvXS2ZPll86CiZWewErJz6sLi+dSs/N7JNmj2y6cerWeUzTrn55w/8qLAACWZKrVWXQ/juYfcbvt/Wk9aTeTdjtpx08I7WJjObJxV/Wb54a0vkLzbGZRYbzvPJN6/v532620f9JOosYS5tm7ax5pJvrNcy6pr9Q8AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO4kj7w9+lBV/dS16TPnZpo7D2yZubxvet3pEBqd7bWsXFv9/uHmX99uPXbgx81fHb/w/GP1vF9cjhZ2Dr/FlScmQ3ijULkQh724NoRWb6HTDF+WC291Vp6LBQAAAO4m93d+j3TbWRwc62nXOmmy1vkXZWHx+sXdRzftbW48frhdv3rp7Mnlj9fqM17zhuN1243Fn1ohGMf4m463WI+77imNUy0dMc3zj5+f+ruqfyn/N6rzf3zn5H8AAABuhvyfjlNtUP7/7rU/PqnqX8r/G3oOWcr/ccYx/4+E5eV/AAAAuJPd7vzfLI1TbVD+H39p7Ouq/qX8PzVc/h8tTjtu/DVOeNdkCFODpg4AAAD0Ef/fffGrhZjXs28O0rz+1KMHz1WNV8r/zeHy/9gtfVUAAADAzTjyxfaHq+ql/N8aLv+P39ZZAwAAAEvxzocTH1TVS/l/drj8vzpf5lc+ZJ1+in+FcGgyhImFlbms8HNoP90tAAAAALdIzOl/frrzh6r9Svl/rvr+//FOB/H6/577/5Wu/y8Usrv+PenGAAAAANyLytfzx9vjZ08u6Pf8/WGv/3/gfwdfrTp+Kf/vHy7/14vLW/n8PwAAAFiG/9rz/7aXxqk26P7/93307i9V/Uv5vz1c/o/LNcWXd6JWy96f9yZDWL+wkt9N8Jt4uF1JYX6sUOhoJT22xR55YX68UOiYS3psngzhwYWV/Unh/7HQTgpX1uaFI0nhdCzk50O3cCwpnIhn2udr8+mmhe9jIb/AYj5eQbGme0lE0uNqvx4LhRv2ONs9OAAAwD0lhuc8y471NkMaZedrg3ZYPWiHkUE71AftMJrskO7Yb3uY7S3E7e0zG5f2/P8jw+X/+Fasyhb9rv8P8fr//LmG3ev/Z2OhkRTmY6GV3jGgFY+Rhd2P4zEarbzHlfXdAgAAANzV4vcC9RWeBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP+wd68xclX3AcDPPsf78O5CUoXQKNkkNY6beL22yUMtVdaUqhFpmnVDg6qIYmOvyeIFO7YpMQqRsYlohKC0QUo+FGEURTUfoFYgIikgXKQ4QuURURUFECi0hiiIlJJEpAlSqGbvPbN3zt15+LHGS38/yTtn5n+ed2au59x75wwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD/D4e+ctXfNos//Nvznn7uwonL9q678OVrzjv98RAmZx/vyMId/dffOvHzO8+9a+99a26758j5H+zNy+XxMFD905nfuS7WemRpCPd2hNCdBlYOZoGe/P5grO9dgyGcFuYCtRJT/VmJtOHw/b4Q9oe5QK2q7/WFMFgIXPDEQw/eWE3c0hfCshBCJW3j2UrWRl8aOKs3C/SngW3dWeBXb2Rqge92ZgE4bvHNUHvRH5yszzAyf7kGr7+eE9axN1c6vK6YGGmc72frFrhTBb3pA5PH9bSVqmNBlN4eh7zbFsG7rbSdb/a0FT9I5Z9Q3pgLVULn5qktG6+c2RUf6QxjY12Nalqg5/mpV7+06WjSi+Z1GDswckJehzc9tuzOrhWfevSelctePPChfS8dbzd/VNikxfRCq4T8Nbdonsdowv5kEbz9Sp+SRn3oCiFs+fzvfbpZvDT/H2k+/48v53jbWZc71vr6UDY3j48MxsQrQ9ncHAAAABaNxXDUdNvYAx8rFB+uJPWV5v+j7Z3/j6f888l8NtpDIUzMJvYNh3DG7ONZ4I7Y3CXDIbx3NjVZH1iXBA6F8M7ZxIpaVUmJJbHEaBL4yVAemEgCh2NgMgl8KwZuTgLXxcDBJLApBg4lgXNjIEzXj+P3h/JxtB3oi4EN2UY8GK9C+MVQbC3ZVs/UqgIAADhB8tlhT/3dwrUOx5shTi8P9rXKEK/AbpihktSQzmBr06qGNXS3qqGzVQ21ce9pPvxSzR2tai5dhtFRn+HWX/7NZ0ITpfn/ePP5f2WejnSUzv+HsH72b8zdmUdmavENk3UZAAAAgOMw8L/Pf7NZvDT/n2jv+v94TKSrkDk8Eg9DbB0OYbw+kFX7h+VAdtZ7IA8AAADAYlA7H187Fz6d32aXaKfz6XL+yaPMH0/8T8ybv/fQ/Rua9bc0/59s7/r//vrbrBOHYy++NhzCkkLgB7GX1cCs0Rj48cfrA/n4D8cNcEOsKr8woVbVDbHEhhgYTwL7G5X4Ya3EGfWB/MmqNb6vNo7pvEQhAAAAACddPBwQz8vH6//f95s1VzUrV5r/bzi66/9n58Gly/tnBkJY1R1CV/rFgEf6s4UBY2CwI0880J/V1ZVWdW1/COdUB5ZW9Xy+/n93usbgE31ZVTFwxvsOvHpWNfHNvhBWFQNPfu72D1cTu5JArfG/7AvhPdXRpo1/Z0nWeE/a+NeXhPDuQqBW1SVLQqg21ptW9VAl/x2DtKp/roTwtkKgVtVHKiHsDgAsUvG/0s3FB3fuvnrrxpmZqR0LmIjH8PvClumZqbFN22Y2Vxr0aXPS57pljK4tj6ndX755Jl+i6LN3rx9sJ137nuB4sa38OH7pwsH8fvws1DM7zjU9dXfXpkP+wPvLTYTCJ6lGQ+5c4CH3FyuZexJL9cf8vWEgLLly59SOsS9u3LVrx+rsb7vZ12R/42mmbFutTrdV/3x9a+Pl0XC1rMSxbqvlxUpW7bp8+6qdu69eOX35xkunLp26YvVH1oyfPb52/KNnr6qOajz722Koy+erOhnqG7e3Oa4TONQzuwuVnIy9hoSExGJLbBtY3vT/5NL8f3vz+X/c68Q9f74+Q6Pz/yPxNH/2+Nxp/g0xsL/d8/8jjc7m1y4MGE0Ce2Jgj9P8AAAAvDXESX48mhmPSv90xXdebFauNP/f0973/0/Q+v+1pevPb7TM/4pYYrzR+v/pMv+19f/3NFr/P13mv7b+//43Yf3/K2uBZJP8wvr/AADAW8HJW/+/5fL+6Q8ElDK0XN4//YGAUoaWy/i3+wMBR73+/7P/+Vf/HZoozf9vbm/+b+F+AAAAOHV8+c+u+p1m8dL8f3978/+Tv/5faHT9/2ijwGSjhQGt/wcAAMAi1Wj9v5Hr+y9uVq40/z/Y3vw/XnbRWZc71vr6ULamXUjXtHtlqPaVAQAAAFgcOsPYWE+beetWRl137G0+lS8F2ixd9PyfHDm66/8PtTf/r/texk2PLbuza8WnHn39npXLXjzwoX0vzZ3/BwAAABZOu8clAAAAAAAAAAAAAACAN9/z/7F3bbN46fv/Yf3s442+/x9/9y9+v+Dtdbljra3X/8vvX/DJu3bPLln4yFAI7y8Gtu7delrIf5t/eTHw4EUr3lFN7E1L3P/cuS9UExengU+sPP21auKcJLAhLpL4zjQQf1XxtaVJIC6v+O9pIG6Pg2mgNw98dWk2jo50W/10MNtWHem2enowhOFCoLat7h3M2uhIB3hLEqgN8AtpIA7wz/NAZ9qruwayXsXAYCx620DWKwAATlnxU2BP2DI9MzUeP8LH2zO762+juiXLri1X29Fm88/kS5N99u71g+2ku9LPonO/Nd4TKtUhrC59XC1m6Zgd5YmppcWme3uDIbda7a2zQbnU0W663sYj6stGNLZp28zmnpYDX9s6y5rulllWlyY7xSyds5u0jVra6EsbI2pz27TR5Xi/M4yNdSW5/iAGR0KdVq+Idr+vX1znr9GroJjniiP7ftWsvtL8f6S9+X+lOK7X8h8D2BN/We/vhi3zDwAAAAvrq+t+/Y347zPXP/xks7yl+f9oe/P/eAQrPxWcHe04FH//f99wCLM/rT+SBe6IzV0yHMJ7Z1OTsUT2g/rnxxLjWeCOeMBkRSyxYbK+qiUxcDAJ/GQoDxxKAodjID9KcSDkh3L+fiiED8+m1teX2B5LjCSBT8fAaBIYi4HxUH/UZ2kMTCQlXl6aByaTwL/FQJiu31Z3L823FQAAwNHIpyg99XdDOs872N0qQ0erDP2tMnS2ylBplaHRKOL9b8cMPcnFKx2FTD1prX1JLaUM8cfwj7pfpQzhh/U504KlpuP1B7XrDTrqM9z3se5KaKI0/x9vb/7fX3+btX44zv/nfv8vC/wgdu9r8dLx0Rj48cfrA/mBgcNxsntDrarJvEQ+ab8hlpiIgdEksD0GJpLAhvV5YP876gP5TLvW+L5a49N5iUIAAAAATrp4gCAeponz/9t2fmWgWbnS/H+ivfl/bG+g2Nh1sdYjS0O4t2OuN7XAysEsEI9jDMavx79rMITTCgc4aiWm+rMSvUnD4ft92TfUe9OqvteXffkg3r/giYcevLGauKUvhGWFoy+1Np6tZG30pYGzerNAfxrY1p0F4pGfWuC7nVkAjlvtqGB8QeWXutSMzF+uwevvrfKboOnwSsdA58k333euFkrpgGt+TLXm6J62psdvOWFKb49D3m2L8d024t1W/CCVf0J5Yy5UCZ2bp7ZsvHJmV3yk+E3WkgV6novfUm0nfQJeh3uOvbetVdIOjCe7j/H5y83/OuyI1d302LI7u1Z86tF7Vi578cCH9r3UdjcaiF8Ufuiafx38UWHzLrRKyF9zi25/Mml/sij+G0je3aOethDC+pe/fkOzeGn+P9ne/L87uZ3167gxdw6H8IHCxn0kbv4/Hs72g4VAtpd8Wx7onAtkp9z/a6jhnhMAAABOtNrhjtrxgun8NrsgPJ0nl/NPHmX+eLxiYt787fa7/68vWtYsXpr/b2g+/1+SdNP5f+f/WSDO/8/rVD8UvSR9YM9xHYouVdeaHdAxcP5/Xqf6u62t8//zvIfe4id+nP93/n8+zv+34Pz/vE71p620h99+sj90nZJe/KMHnm4WL83/t7c3/7f+3/yL9tXW/9uQBGrr/21vtP7fHuv/AQAAC6rBQnPpPK+0el8pQ7p6XylDywUCWy4xmJ58tv5fy/X/Xjjz2d+EJkrz/z3tzf/jy2Gg2PpiWf9vdH2Dqm6Oge0WBgQAAOBU1OgAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG+u+/7hfzY3iz/82/Oefu7Cicv2rrvw5WvOO/3xEKZnH+/Iwh3919868fM7z71r731rbrvnyPkfrOTlevLb363LHWt9fSiE/YVHBmPilaHqnbnABZ+8a3d3NfHIUAjvLwa27t16WjXxraEQlhcDD1604h3VxN60xP3PnftCNXFxGvjEytNfqybOyQMdaXf/cWnW3Y60uzcuDWG4EKh197Kl9VXV2vjTPNCZtvFPg1kbMTAYi35jMGsjBmZiieklIazqDqErrerhSlZVV1rVv1SyqrrSqr5cCeGcEEJ3WtVzvVlV3enIH+/NqoqBM9534NWzqon9vSGsKgae/NztH64mvpAEao3/RW8I76m+ZNLGv92TNd6TNn5LTwjvDiH0piV+2Z2V6E1LPN8dwtsKgVrjn+8OYXfgLSHufOr2aDt3X71148zM1I4FTPTmbfWFLdMzU2Obts1sriR9aqSjkH7j2mMf+zOvfmlT9fazd68fbCfdnZfrme3ymp66u2tP9d7HfvUXK5l7Pkr1x/y9YSAsuXLn1I6xL27ctWvH6uxvu9nXZH+78mi2rVYvlm21vFjJql2Xb1+1c/fVK6cv33jp1KVTV6z+yJrxs8fXjn/07FXVUY1nf0/EUG8/+UM9s7tQycnYAUhISCy2RGfd3m38VN+Rlz7oz3W0J1Rmd9ClaUUxS8fsKE/EoNcd44iP5XNKyxGtLk0cSlnWzJPl2vosa0uTibla+rIss5/rSpPDYmOds5s03u8MY2NdjbbDSP3d4ub92XFs3qfyTdduGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+jx04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqirswIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQeOBQAAAACE+VuH0bMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMClAAAA//98XiM2") [ 74.539280][ T5297] Bluetooth: hci0: command tx timeout [ 74.603033][ T5317] loop0: detected capacity change from 0 to 64 [ 74.627396][ T5317] ======================================================= [ 74.627396][ T5317] WARNING: The mand mount option has been deprecated and [ 74.627396][ T5317] and is ignored by this kernel. Remove the mand [ 74.627396][ T5317] option from the mount to silence this warning. [ 74.627396][ T5317] ======================================================= [ 75.466505][ T5317] hfs: request for non-existent node 8 in B*Tree [ 75.469618][ T5317] hfs: request for non-existent node 8 in B*Tree [ 75.511467][ T5317] [ 75.512578][ T5317] ====================================================== [ 75.515627][ T5317] WARNING: possible circular locking dependency detected [ 75.518666][ T5317] syzkaller #0 Not tainted [ 75.520606][ T5317] ------------------------------------------------------ [ 75.523738][ T5317] syz.0.0/5317 is trying to acquire lock: [ 75.526227][ T5317] ffff8880120440b0 (&tree->tree_lock/1){+.+.}-{4:4}, at: hfs_find_init+0x18e/0x300 [ 75.530442][ T5317] [ 75.530442][ T5317] but task is already holding lock: [ 75.533727][ T5317] ffff888011e0c1f8 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf2/0x15e0 [ 75.538357][ T5317] [ 75.538357][ T5317] which lock already depends on the new lock. [ 75.538357][ T5317] [ 75.542821][ T5317] [ 75.542821][ T5317] the existing dependency chain (in reverse order) is: [ 75.546659][ T5317] [ 75.546659][ T5317] -> #1 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}: [ 75.550579][ T5317] __mutex_lock+0x19f/0x1300 [ 75.552914][ T5317] hfs_extend_file+0xf2/0x15e0 [ 75.555274][ T5317] hfs_bmap_reserve+0x107/0x430 [ 75.557631][ T5317] __hfs_ext_write_extent+0x1fa/0x470 [ 75.560250][ T5317] __hfs_ext_cache_extent+0x6b/0x9b0 [ 75.563565][ T5317] hfs_extend_file+0x39b/0x15e0 [ 75.565953][ T5317] hfs_get_block+0x412/0xc50 [ 75.568125][ T5317] __block_write_begin_int+0x6c6/0x1910 [ 75.570781][ T5317] cont_write_begin+0x737/0xae0 [ 75.573093][ T5317] hfs_write_begin+0x66/0xb0 [ 75.575242][ T5317] cont_write_begin+0x2e7/0xae0 [ 75.577510][ T5317] hfs_write_begin+0x66/0xb0 [ 75.579552][ T5317] generic_perform_write+0x2e2/0x8f0 [ 75.581965][ T5317] generic_file_write_iter+0x14a/0x680 [ 75.584568][ T5317] vfs_write+0x61d/0xb90 [ 75.586643][ T5317] __x64_sys_pwrite64+0x199/0x230 [ 75.589010][ T5317] do_syscall_64+0x14d/0xf80 [ 75.591322][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.593978][ T5317] [ 75.593978][ T5317] -> #0 (&tree->tree_lock/1){+.+.}-{4:4}: [ 75.597404][ T5317] __lock_acquire+0x15a5/0x2cf0 [ 75.599576][ T5317] lock_acquire+0xf0/0x2e0 [ 75.601729][ T5317] __mutex_lock+0x19f/0x1300 [ 75.603924][ T5317] hfs_find_init+0x18e/0x300 [ 75.606187][ T5317] hfs_extend_file+0x35c/0x15e0 [ 75.608547][ T5317] hfs_bmap_reserve+0x107/0x430 [ 75.610953][ T5317] hfs_cat_create+0x20f/0x800 [ 75.613212][ T5317] hfs_create+0x75/0xe0 [ 75.615297][ T5317] path_openat+0x1395/0x3860 [ 75.617436][ T5317] do_file_open+0x23e/0x4a0 [ 75.619629][ T5317] do_sys_openat2+0x113/0x200 [ 75.621931][ T5317] __x64_sys_openat+0x138/0x170 [ 75.624718][ T5317] do_syscall_64+0x14d/0xf80 [ 75.626961][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.629777][ T5317] [ 75.629777][ T5317] other info that might help us debug this: [ 75.629777][ T5317] [ 75.634139][ T5317] Possible unsafe locking scenario: [ 75.634139][ T5317] [ 75.637347][ T5317] CPU0 CPU1 [ 75.639619][ T5317] ---- ---- [ 75.641983][ T5317] lock(&HFS_I(tree->inode)->extents_lock); [ 75.644602][ T5317] lock(&tree->tree_lock/1); [ 75.647753][ T5317] lock(&HFS_I(tree->inode)->extents_lock); [ 75.651413][ T5317] lock(&tree->tree_lock/1); [ 75.653682][ T5317] [ 75.653682][ T5317] *** DEADLOCK *** [ 75.653682][ T5317] [ 75.657086][ T5317] 4 locks held by syz.0.0/5317: [ 75.659256][ T5317] #0: ffff888037a1e420 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 75.663209][ T5317] #1: ffff888011e0bd20 (&type->i_mutex_dir_key#8){++++}-{4:4}, at: path_openat+0xb4c/0x3860 [ 75.667578][ T5317] #2: ffff8880120420b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfs_find_init+0x18e/0x300 [ 75.671727][ T5317] #3: ffff888011e0c1f8 (&HFS_I(tree->inode)->extents_lock){+.+.}-{4:4}, at: hfs_extend_file+0xf2/0x15e0 [ 75.676322][ T5317] [ 75.676322][ T5317] stack backtrace: [ 75.678844][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 75.678863][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 75.678871][ T5317] Call Trace: [ 75.678881][ T5317] [ 75.678888][ T5317] dump_stack_lvl+0xe8/0x150 [ 75.678930][ T5317] print_circular_bug+0x2e1/0x300 [ 75.678950][ T5317] check_noncircular+0x12e/0x150 [ 75.678970][ T5317] __lock_acquire+0x15a5/0x2cf0 [ 75.678986][ T5317] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 75.679005][ T5317] ? kasan_save_track+0x4f/0x80 [ 75.679025][ T5317] ? kasan_save_track+0x3e/0x80 [ 75.679041][ T5317] ? __kasan_kmalloc+0x93/0xb0 [ 75.679058][ T5317] ? __kmalloc_noprof+0x35c/0x760 [ 75.679075][ T5317] ? hfs_find_init+0xaa/0x300 [ 75.679090][ T5317] ? hfs_extend_file+0x35c/0x15e0 [ 75.679102][ T5317] ? hfs_bmap_reserve+0x107/0x430 [ 75.679113][ T5317] lock_acquire+0xf0/0x2e0 [ 75.679128][ T5317] ? hfs_find_init+0x18e/0x300 [ 75.679146][ T5317] __mutex_lock+0x19f/0x1300 [ 75.679165][ T5317] ? hfs_find_init+0x18e/0x300 [ 75.679183][ T5317] ? hfs_find_init+0x18e/0x300 [ 75.679199][ T5317] ? __pfx___mutex_lock+0x10/0x10 [ 75.679216][ T5317] ? rcu_is_watching+0x15/0xb0 [ 75.679234][ T5317] ? __kmalloc_noprof+0x37d/0x760 [ 75.679252][ T5317] ? kasan_save_track+0x4f/0x80 [ 75.679269][ T5317] ? hfs_find_init+0xaa/0x300 [ 75.679283][ T5317] ? __kmalloc_noprof+0x1b8/0x760 [ 75.679300][ T5317] hfs_find_init+0x18e/0x300 [ 75.679318][ T5317] hfs_extend_file+0x35c/0x15e0 [ 75.679332][ T5317] ? __pfx_hfs_extend_file+0x10/0x10 [ 75.679344][ T5317] ? __mutex_lock+0x319/0x1300 [ 75.679364][ T5317] ? __pfx___mutex_lock+0x10/0x10 [ 75.679382][ T5317] ? rcu_is_watching+0x15/0xb0 [ 75.679400][ T5317] hfs_bmap_reserve+0x107/0x430 [ 75.679414][ T5317] hfs_cat_create+0x20f/0x800 [ 75.679426][ T5317] ? do_raw_spin_lock+0x12b/0x2f0 [ 75.679437][ T5317] ? __pfx_hfs_cat_create+0x10/0x10 [ 75.679467][ T5317] ? _raw_spin_unlock+0x28/0x50 [ 75.679483][ T5317] ? hfs_new_inode+0x92d/0xc70 [ 75.679500][ T5317] hfs_create+0x75/0xe0 [ 75.679511][ T5317] ? __pfx_hfs_create+0x10/0x10 [ 75.679522][ T5317] path_openat+0x1395/0x3860 [ 75.679547][ T5317] ? __pfx_path_openat+0x10/0x10 [ 75.679564][ T5317] ? __x64_sys_openat+0x138/0x170 [ 75.679581][ T5317] ? __lock_acquire+0x6b5/0x2cf0 [ 75.679596][ T5317] do_file_open+0x23e/0x4a0 [ 75.679614][ T5317] ? __pfx_do_file_open+0x10/0x10 [ 75.679634][ T5317] ? _raw_spin_unlock+0x28/0x50 [ 75.679649][ T5317] ? alloc_fd+0x64b/0x6c0 [ 75.679665][ T5317] do_sys_openat2+0x113/0x200 [ 75.679679][ T5317] ? __se_sys_futex+0x3a8/0x450 [ 75.679696][ T5317] ? __pfx_do_sys_openat2+0x10/0x10 [ 75.679711][ T5317] ? rcu_is_watching+0x15/0xb0 [ 75.679728][ T5317] __x64_sys_openat+0x138/0x170 [ 75.679743][ T5317] do_syscall_64+0x14d/0xf80 [ 75.679760][ T5317] ? trace_irq_disable+0x3b/0x150 [ 75.679777][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.679790][ T5317] ? clear_bhb_loop+0x40/0x90 [ 75.679803][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 75.679815][ T5317] RIP: 0033:0x7f829019c799 [ 75.679830][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.679840][ T5317] RSP: 002b:00007f8290f72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 75.679854][ T5317] RAX: ffffffffffffffda RBX: 00007f8290415fa0 RCX: 00007f829019c799 [ 75.679865][ T5317] RDX: 0000000000000041 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 75.679873][ T5317] RBP: 00007f8290232bd9 R08: 0000000000000000 R09: 0000000000000000 [ 75.679881][ T5317] R10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000 [ 75.679888][ T5317] R13: 00007f8290416038 R14: 00007f8290415fa0 R15: 00007fffc6747628 [ 75.679899][ T5317]