last executing test programs: 24.427307108s ago: executing program 3 (id=86): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000540)={'macvtap0\x00', &(0x7f0000000240)=@ethtool_per_queue_op={0x4b, 0x21, [0x8, 0x1, 0x2, 0xc, 0x9, 0xf94, 0xed, 0x37, 0x9, 0x80000001, 0x1, 0x6, 0x1, 0x5, 0x7f, 0x2, 0x80000000, 0x2, 0x0, 0x9, 0x8, 0x8, 0x7, 0x2, 0x6, 0x1675, 0x1, 0xff, 0x4, 0x200, 0x4, 0x4107a2b1, 0x358827d1, 0x6, 0x2, 0xff, 0x80000001, 0xc0010, 0x9c, 0x4, 0x2, 0x7, 0x101, 0xfffffffc, 0x200, 0x5, 0x4, 0x5, 0x0, 0x1, 0x1, 0x80000000, 0x4928, 0x3, 0xffffffff, 0x7, 0x4, 0x5, 0x80000004, 0x0, 0x9733, 0x6, 0x5, 0x8, 0x9fd8, 0x5, 0x9, 0x8, 0x8, 0x4, 0x101, 0x12b4000, 0x71, 0x0, 0x6, 0x10006, 0x3, 0x5, 0x165, 0x9, 0x6, 0x4, 0x9, 0x8, 0x40, 0x6, 0x5, 0x7, 0x0, 0x1, 0x2, 0x2, 0x1, 0xa, 0xffffffff, 0x471, 0x4, 0x0, 0x7, 0x3, 0x6, 0x1001000, 0x3, 0x2, 0xb, 0xffff, 0x80, 0x4, 0x4, 0x2, 0x40, 0x8, 0xfffffffd, 0x5, 0x7, 0x0, 0x2, 0x2, 0x0, 0x7, 0x5, 0x8000, 0x1, 0xa, 0x200fffd, 0xa1, 0x6, 0x9]}}) sendmsg$nl_route(r0, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000300)=ANY=[@ANYBLOB="540000001e000126bd7000fedbdf250700000000", @ANYRES32=0x0, @ANYBLOB="00000400080009"], 0x54}, 0x1, 0x0, 0x0, 0x4040840}, 0x20000800) read(r0, &(0x7f0000000480)=""/154, 0x9a) 24.364199748s ago: executing program 2 (id=91): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000380)={0x2, 0x0, [{0x4000000c, 0x5, 0x4, 0x7, 0x4, 0x200}, {0x7, 0xa, 0x1, 0xffffffff, 0x4, 0x7, 0xff}]}) 24.351641368s ago: executing program 3 (id=93): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) waitid(0x0, r0, 0x0, 0x8, &(0x7f0000000080)) ptrace$getenv(0x4201, r0, 0x37e, &(0x7f0000000040)) 24.320279678s ago: executing program 3 (id=95): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001280)=@newqdisc={0x170, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x2}, {0xffff, 0xffff}, {0x0, 0xd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x140, 0x2, {{0x0, 0x0, 0x0, 0x7fffffff}, [@TCA_NETEM_LOSS={0x72, 0x5, 0x0, 0x1, [@NETEM_LOSS_GE={0x14, 0x2, {0xffffffff, 0x1, 0x6818622a, 0xb}}]}, @TCA_NETEM_LOSS={0xe8, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0x0, 0x8, 0x0, 0x8, 0x1}}, @NETEM_LOSS_GE={0x14, 0x2, {0x6, 0x200400, 0xe0000, 0x8}}, @NETEM_LOSS_GI={0x18, 0x1, {0x4, 0xfff, 0x7f, 0xfffffff8, 0x3}}, @NETEM_LOSS_GE={0x14, 0x2, {0x9, 0xa7, 0xfff, 0x1000}}, @NETEM_LOSS_GE={0x14, 0x2, {0x1, 0x3bd, 0x4, 0x9}}, @NETEM_LOSS_GE={0x0, 0x2, {0xe485, 0x1, 0xfffffffd, 0x7}}, @NETEM_LOSS_GI={0x18, 0x1, {0xb8, 0x5, 0x0, 0x7, 0x5}}, @NETEM_LOSS_GI={0x12, 0x1, {0x2, 0x1, 0x8, 0x8, 0x4}}, @NETEM_LOSS_GI={0x18, 0x1, {0x7ff, 0x0, 0x5, 0x6, 0x6}}, @NETEM_LOSS_GI={0x18, 0x1, {0x81, 0x4, 0x0, 0x7fffffff, 0x9}}]}, @TCA_NETEM_RATE={0x14, 0x6, {0x6, 0x2029ff0c, 0x7fffffff, 0x7fff}}, @TCA_NETEM_CORR={0x10, 0x1, {0xb3c, 0xccd3, 0x6}}]}}}]}, 0x170}}, 0x0) 24.283940949s ago: executing program 3 (id=97): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000140)='./file0\x00', 0x1000801, &(0x7f00000000c0)=ANY=[], 0x0, 0x1cc, &(0x7f00000006c0)="$eJzsmT/v0kAYx793LX9jTFwcXDSRREygtEUNiwO+AhPw3yaRStACBjoAiQNxcfFl+BYcmBzc3Fx1UBMTBxmda+442rOAQn4hP5Lf80m4fnt/nnvuKf0OAIIgzizfv/3++uZOrVkCcA4FZFT/TyOew7X5X7JKfH77oX/+5TwZjwEIw933NwG8rxsI1H0Y/r26oK5N8EjfA8d1pR+AwVL6MTjuK+2B4ZHSzzQ9yCnhe9aTgd9+2vU9WzSOaFzRVJP5LWYMbQBZlR/TxkeT6fOW73vDpEiFq33WhvYV/6mfuahz3NbqJ57Xw9evZuJ+VRtbq58DDkfpKhgaSteQgWVZcUm0818y4/jGLuc/BnGhHPekkXwepSPIkMQpCKb15IQQL3TUc3Ex/7i+6schE7ty2CNDefba0Kf8ySKv3qmNc2L/FJZ7TfMnE2bkH5Wg96IymkzL3V6r43W8vutWb9k3bPumW5FGtGz/4X9Z6U95LX5qy9w0S2PcCoKhMwaCoRPdu8tWc9zGu8EvuYZL/+MoXl3GEF8VeezM5j2Y+nB5FapobE2eIAiCIAiCIAiCIAiCIAhiLy6DyV9B1R9V4Rbcu3L2nwAAAP//2B1hWA==") chdir(&(0x7f0000000140)='./file0\x00') mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) listxattr(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 24.257568878s ago: executing program 2 (id=98): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x11000) write$binfmt_misc(r1, &(0x7f0000000180)='5', 0x1) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 24.14186601s ago: executing program 3 (id=99): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001140)='net\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) fstat(r0, 0x0) 24.136366349s ago: executing program 2 (id=101): futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000040), &(0x7f0000048000), 0x0) 23.276454524s ago: executing program 2 (id=117): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) mount(0x0, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000380)='proc\x00', 0x0, 0x0) umount2(&(0x7f0000000680)='./file0\x00', 0x9) 23.222439834s ago: executing program 2 (id=119): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000140001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a00"], 0xb8}}, 0x2c000010) 23.037202865s ago: executing program 2 (id=123): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000200)={0x3, 0x0, @ioapic={0x4, 0x3, 0x2, 0x10, 0x0, [{0xaa, 0x8, 0xf8}, {0x1, 0x6, 0x9, '\x00', 0x4}, {0x0, 0xb, 0x0, '\x00', 0x78}, {0x7e, 0xa, 0xb, '\x00', 0x1}, {0xa7, 0x81, 0x9}, {0x2, 0x5, 0x3, '\x00', 0xde}, {0xcf, 0x9b, 0xd, '\x00', 0x8}, {0x6, 0x5a, 0x5, '\x00', 0x89}, {0xc, 0x5, 0x0, '\x00', 0x8}, {0x4, 0x5, 0xe, '\x00', 0xb}, {0x6, 0x0, 0x7, '\x00', 0x4}, {0x7, 0x2, 0xa, '\x00', 0x6}, {0x0, 0x9, 0xb8, '\x00', 0x6e}, {0x0, 0xf6, 0x4, '\x00', 0xfa}, {0x4, 0x3, 0x2, '\x00', 0xe}, {0x2, 0xff, 0xa6, '\x00', 0x6}, {0x3, 0x7, 0x1, '\x00', 0x6}, {0x3, 0x3, 0x2, '\x00', 0x8}, {0xb, 0x8, 0x7, '\x00', 0xff}, {0x6, 0x1, 0x5, '\x00', 0x2}, {0x9, 0x4, 0x5, '\x00', 0x3}, {0x6, 0x4, 0x0, '\x00', 0x8}, {0x2, 0x5a, 0x8, '\x00', 0x8}, {0x10, 0x1, 0x1, '\x00', 0x5}]}}) 23.030510655s ago: executing program 32 (id=123): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x3, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000200)={0x3, 0x0, @ioapic={0x4, 0x3, 0x2, 0x10, 0x0, [{0xaa, 0x8, 0xf8}, {0x1, 0x6, 0x9, '\x00', 0x4}, {0x0, 0xb, 0x0, '\x00', 0x78}, {0x7e, 0xa, 0xb, '\x00', 0x1}, {0xa7, 0x81, 0x9}, {0x2, 0x5, 0x3, '\x00', 0xde}, {0xcf, 0x9b, 0xd, '\x00', 0x8}, {0x6, 0x5a, 0x5, '\x00', 0x89}, {0xc, 0x5, 0x0, '\x00', 0x8}, {0x4, 0x5, 0xe, '\x00', 0xb}, {0x6, 0x0, 0x7, '\x00', 0x4}, {0x7, 0x2, 0xa, '\x00', 0x6}, {0x0, 0x9, 0xb8, '\x00', 0x6e}, {0x0, 0xf6, 0x4, '\x00', 0xfa}, {0x4, 0x3, 0x2, '\x00', 0xe}, {0x2, 0xff, 0xa6, '\x00', 0x6}, {0x3, 0x7, 0x1, '\x00', 0x6}, {0x3, 0x3, 0x2, '\x00', 0x8}, {0xb, 0x8, 0x7, '\x00', 0xff}, {0x6, 0x1, 0x5, '\x00', 0x2}, {0x9, 0x4, 0x5, '\x00', 0x3}, {0x6, 0x4, 0x0, '\x00', 0x8}, {0x2, 0x5a, 0x8, '\x00', 0x8}, {0x10, 0x1, 0x1, '\x00', 0x5}]}}) 19.450656805s ago: executing program 3 (id=225): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000000000096000040"]) 19.372203855s ago: executing program 33 (id=225): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000000000096000040"]) 4.723681755s ago: executing program 0 (id=746): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x58, 0x10, 0x401, 0x2000000, 0x0, {0x0, 0x0, 0xffff, 0x0, 0x1c42}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_IF_ID={0x8, 0x2, 0x1}, @IFLA_XFRM_LINK={0x8, 0x1, 0x2}]}}}, @IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}]}, 0x58}}, 0x0) 4.582394805s ago: executing program 0 (id=748): syz_mount_image$f2fs(&(0x7f0000000100), &(0x7f0000010600)='./file0\x00', 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="6163746976655f6c6f67733d342c66617374626f6f742c746573745f64756d6d795f656e6372797074696f6e2c6673796e635f6d6f64653d7374726963742c00200da779e57c52e33a83fdbd563a5b7c6b958cb6e49387a5ba5a89b0887c0292eb888cc8efa81040100dc3ba748033542625bc334eaf793332891541000f3c63c0a5f0af254a5bd1f4b81d0c5188ddcadf07eff7b49004e0b243a8a4d93632fbe9ab868d88310829d8e04a3c0572143a3d3d1472cc5da6f72bb097f5f7b95a09e442c0a1463aaa90db7dcbc542dc5bced278eda11583f810469b706968e793db3230"], 0x1, 0x1059a, &(0x7f0000010640)="$eJzs3M1rI2UcB/Bftu6r61pkX/TkgAgNmNC03aIgUnUXXbBL8eXgSdNkGrKbZEqTvrhnPemf4FUQ8ebf4MV/Y/EgeBK8rSiZmcpW96A226zbzwem32eePPPL84RcnkyZAI6t2eTXXypxIc5GxExEnI/I25XyyK0U8WxEPB8RJ+47KmX/nx2nIuJcRFwYFy9qVsqXln+7e++r5268+vk3d6uNn77+cnqrBqbtxYjobxbt3X6RWafIW2V/c6ebZ39pp8zihf7t8jwrcjddzyvsNvfHNfNc7BTjs83t4Tg3es3WODvdjbx/c1C84XCns18nv+BWcys/b6freXaHWZ6dO8W89sq8MxwVddplvU/y8jEa7WfRn+6lxXo2b+fZGozK/qJu1k73xrlTZvl20cp67Xwe6//5Y37kvdMdbO8lO+nWsJsNkqv1xsv1xnKtsZW101G6VGv228tLyVynNx5WG6XN/konyzq9tN7K+tVkrtNq1RqNZO5aut5tDpJGo75Yn69drZatl5K3bn6Q9NrJ3Djf6A62R93eMNnItpLiimqyUF98pZq80EjeW11L1t69fn117f2Prn148/XVG2+Wg/42rWRuYX5hodaYry00qtZ/GJXDXc5x5wsE8K/Z/wPTYP9v/x/2v8d+/bZvHIovEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAsfXjye/ezhuzxfmTZf9TZdczEXElIi5HxKWI+P0BZuLUgZoXI6JSth80/uRf5vB9JfIK42tOl8e5iFgpj3tPP+xPAQAAAB5f3/7w6WcRM+Nm/ue1aU+Io1T+aHNmUvXyn3yemFS1i3mxvQlVu7RfciIuR8TJ2Z8nVO1KRJw4//GEqv0jMwfizH1RKeLEUc4GAAA4Ggd3AhPbvQEAAPDI+WLaE2A68vu15f/il/eCTxdR3hA8e+AMAAAA+B+qTHsCAAAAwEOX7/89/w8AAAAeb8Xz/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD/YuZfcNGI4DsB/oFPoS0UVj6uwqrpkwSF6hC57gPY22XGGSIhzkF2OEEHEjIMyhN2YAZHvkwbbI/jJRmJhmzEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACc00OxnN+t//1vmrPdNZNnNAAAAMApm2I5LyvDqv0l3f+Wbv2IiGlETCJiHBGn5u69+FjLHEVEJ9VPvb846sN9RJmw/0w/XZ8j4le6nr6f+1sAAACA27VezRYRvX21fPl5qPEOpEWbQa68csnnQ660URn2N1Pa+CUyi0lEFMPHTGnTiOh+/Z1arfz+erVi8KroVEW3jV4AAADtqs8Ess3eAAAAuDp/Lt0BLqPcr03/xU97wf2qSBuCn2otAAAA4HodP21/0Gm3HwAAAMAFlPP/N+f/pVUB5/8BAADAbajO/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCcNsVyvl7NFk1ztrtm8owGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAntmfdxQIgTAIg73r+06D9z+WNGhqalIFwsffGAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALz53V/+T0yNM8nca2PpeSRZOzW2To29c+PoD+Pr1wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXOzP3QmEQBCEwb7zP6fF/MOSBo1BhCpY+JhhHhYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+KLf/fJ/YmqcSeZOG0vHI8naVWPrqrH3oHH0YLz9GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4GIHDgQAAAAAgPxfG6GqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoKO3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdiBAwEAAAAAIP/XRqiqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrCDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwAwcCAAAAAED+r41QVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhR04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqirswIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgr7c2+bMBDGcfi1kyhxm4yQ3uJjBhoqBCPwISFZ8gwMwEI0VLQWi8AKIOCgpTMFz9P8fzpdcQcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7+n09MZHRGSfj8wjH67+DpeDr8jXTTP4vma2Oe7rn1tOtrtRyt8Y/xcRUUTWwm8AANpX3jfFYlnNO2m7aXtp+2nLaV3NXvloAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzuzcsWpTURgA4JOkiVYnRyuI4KCLjU2sRsjiUOguCLqFNpZiqpJmaEuXPoHo5Oor2E1fwRcQHLTg4NBBwUUQJclNeoJBUoR7Q/0++O/9c4dzz8kQ+O9/bgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgWA73wtlBngshzM0c5V3vv+6ujDu/ffZhbhBf7ry5GI/ZHaIYQni43mpeT3Et025ze+dRo9VqtiUSiWSYZP3LBADASVNMolvXfyruL3ev5eoh/Ho1Wv9fifLwl/r/88vzFwbxc+tdJ75XXP8vpLbC6VfubDwtb27vXFvfaKw115qPq9XK4s3FG7dvVcq9ZyVlT0wAAAD4N6Uk4vo/X/+z/38mysOE9f+9pQf343sV1P9jHTX9sp4JAADA/+3cpe/fcmOu50qlsNXodNoL/ePwc6V/zGCqx3Yqibj+L9SznhUAAACQhsO93Ej/fzXKw4T9//nXuwfxmIUQwmzS/59fedJaTW85Uy2N14mzXiMAAADZmk0i7v8Xe/v/88MtD/kQwtXL/Tz5G8CJ6v+PL+6OvLQe7/+vprfEqZSv9b+P3rkWwkwt6xkBAABwkp1OolvsHxT3l9s/ni+V7P8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDf7NgxSgNBFAbgzW5WKzFgpVZeQLSzClgIYuMhREHwBCKIBxBbS+9g6R1SK9hYWKbwBvJmd1TSBCx2lXwfTN4jDJmXSZN/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgrun+d1/Fy6jpy/a954+rk6gvMzW8369vxop+0OXQ/9Bgr+8JAAAAWARVzvdFUbzVj4dRy3HK/3XeE5n/YaXpc56fzf25Pt29buT8f328dfl10Kg5Jz707PzidKezb/j3rc7dMUw3n569VOkHKY9u1qZ1us/B7WRysJTa5S6mBQB+YzvXtsn/h6Lu9jkYAAtj2K7iR/6vxv3OBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCFzwAAAP//OCtiEg==") symlinkat(&(0x7f0000000040)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(0xffffffffffffffff, 0x8040942d, 0x0) lstat(&(0x7f0000000000)='./file1\x00', &(0x7f0000000140)) 2.064139929s ago: executing program 0 (id=784): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='kfree\x00', r0}, 0x18) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=@newtaction={0x88c, 0x30, 0xffff, 0x3, 0x0, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1, 0x4, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x8000002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9, 0x0, 0xffffffff, 0x0, 0x0, 0x4, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0x0, 0x0, 0x2000000, 0xffffffff, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14880, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x4, 0x20000000, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x8, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7fff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x7, 0x0, 0x0, 0xfffffffe, {0x3, 0x0, 0x0, 0x0, 0xb, 0x3}, {0x4, 0x2, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x3, 0x2}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0xfffffffe, 0x0, 0x0, 0x401, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x80000000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x504, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x3, 0x0, 0x0, 0x6, 0x2, 0x24, 0xfffffffe, 0x0, 0x0, 0x1, 0x25d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0xfffffffe, 0x0, 0x0, 0x2, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x80004, 0x0, 0x0, 0x0, 0xf7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xfffffffe, 0x0, 0x0, 0x76, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x1bde, 0x0, 0x1, 0x4, 0x0, 0x0, 0xffffff7d, 0x0, 0x0, 0xffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x10, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5, 0x2, 0x8]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x1}}}}]}]}, 0x88c}}, 0x40844) 1.88252547s ago: executing program 1 (id=787): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) bind$tipc(r1, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x41, 0x3, 0x1}, 0x10) 1.80549193s ago: executing program 1 (id=789): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_deliver\x00', r1}, 0x10) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) 1.78895191s ago: executing program 0 (id=791): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000900)=ANY=[@ANYBLOB="b70000000000000007000000000000009500000000000000bdc5072e4c75223f007e6ca306000000000000009c91420b66f0980e90dc0a9900d145243692fe648adf4cbc1dc631c378820861eccfa60822e798d6526600eea6c33dd5b2a7762091bffe56a9440bf23deb4dc8947d2bafec88ae3708013fdc5b2a1dbc7d50fcb6d9a01d03491c35fee5ff00002e40db34dea1063eaf2e3d6959435775943a5a7090b1c08454a248811ed0850a0e16793732f7c9af95af00100000955133044fd041b55379c29cc8ca9e1e5223ceb6f2e4980e5be2d3f36ae968af01953b6e4b3aa3fe0c375b2e17019ccdf4b9b5caccc4722cf3e6cfa6567c5a8e01bf465f0a27e54911827c4fa432ca89bf5ac89effedbe12b66ce9643697ac0e12a966dcea592613f479d71eb2597dd9000000000000000000000000001d5bdafcd419016b45507fedc616a94a06268d9b21e956eabc"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000280)=0x8, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f00000001c0)={0x1, &(0x7f0000f07000)=[{0x6}]}, 0x10) setsockopt$sock_attach_bpf(r1, 0x1, 0x34, &(0x7f0000009000)=r0, 0x4) 1.783146281s ago: executing program 1 (id=792): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000500)=[{{0x0, 0x0, &(0x7f0000003640)=[{&(0x7f0000002440)="4137a29b58", 0x5}], 0x1}}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000480)="eadbe8", 0x3}], 0x1}}], 0x2, 0x4000001) 1.753907921s ago: executing program 1 (id=793): syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x87, 0x2, 0x7}, 0x0}) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000020000082505a1a44000010203010902"], 0x0) ioctl$EVIOCRMFF(r0, 0xc0085508, &(0x7f0000000500)=0x1d) 1.712485091s ago: executing program 0 (id=797): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80004}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x28, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.670671731s ago: executing program 6 (id=801): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a40)={&(0x7f0000000980)='sys_enter\x00', r1}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r0}, &(0x7f00000002c0), &(0x7f0000000300)=r1}, 0x20) exit(0x6) 1.617249222s ago: executing program 0 (id=803): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x47f, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) 1.480925742s ago: executing program 4 (id=813): link(0x0, &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, &(0x7f0000000a00)={[{@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noauto_da_alloc}, {@dioread_nolock}, {@test_dummy_encryption}, {@nobarrier}, {@dax_inode}, {@minixdf}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x40}}], [{@func={'func', 0x3d, 'POLICY_CHECK'}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@smackfsdef={'smackfsdef', 0x3d, '&#()'}}, {@euid_lt}, {@fsname}, {@smackfsdef={'smackfsdef', 0x3d, 'syzkaller\x00'}}, {@obj_role={'obj_role', 0x3d, 'dioread_nolock'}}, {@smackfstransmute={'smackfstransmute', 0x3d, './(\'+'}}, {@fowner_gt}, {@fscontext={'fscontext', 0x3d, 'user_u'}}]}, 0x1, 0xba6, &(0x7f0000000c00)="$eJzs3M1rXFUUAPDzXj7bRicVEeumEZEWxGlaSbFFsJWKGxeCboWGdFJCph8kkZo0i4n+A6KuBTeCWpQu7LobBbdutG4tLoQisVEQ0cibjyQ2M0naTvJq8vvBzbt3zpvcc/KYeffCTALYsQayH2nEvog4nUQU6o+nEdFd7fVGVGrnLczPjvwxPzuSxOLi678mkUTE7fnZkcbvSurHPfVBb0R891ISj7y7et7J6Znx4XK5NFEfH5o6d/HQ5PTMs2Pnhs+WzpbOHz76/NCRoaODx4baVuufP5249vuTr/xc+euzv6/89sEnSZyIvnpsZR3tMhADS3+TlTojYrjdk+Wko17PyjqTznWelG5yUgAAtJSuWMM9FoXoiOXFWyG+/j7X5AAAAIC2WOyIWAQAAAC2ucT+HwAAALa5xucAbs/PjjRavp9I2Fq3TkZEf63+hXqrRTqjUj32RldE7L6dxMqvtSa1p923gYi4+eOxL7MWm/Q95LVU5iLi8WbXP6nW31/9Fvfq+tOIGGzD/AN3jP9P9Z9ow/x51w/AznT9ZO1Gtvr+ly6tf6LJ/a+zyb3rXuR9/2us/xZWrf+W6+9osf57bYNzXP70o0utYln9L1x7+YtGy+bPjvdV1F24NRfxRGez+pOl+pMW9Z/e4ByFfy6VWsXyrn/x44gD0bz+hmTt/090aHSsXBqs/Ww6x9y3Q5+3mj/v+rPrv7tF/etd/4sbnOPNU6eutoqtX3/6S3fyRrXXXX/k7eGpqYnDEd3Jq6sfP7J2Lo1zGr8jq//gU2u//pvVn70nVOp/h2wvMFc/ZuN37pjzxSuXv1qr/mzvl+f1P3OP1/+9Dc7x9DfvH2wVW7n/zVo2/82kthcGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIY0IvoiSYtL/TQtFiP2RMSjsTstX5icemb0wlvnz2SxiP7oSkfHyqXBiCjUxkk2PlztL4+P3DF+LiL2RsSHhV3VcXHkQvlM3sUDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwZE9E9EWSFiMijYiFQpoWi3lnBQAAALRdf94JAAAAAJvO/h8AAAC2P/t/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANtne/ddvJBFROb6r2jLd9VhXrpkBmy3NOwEgNx15JwDkpjPvBIDc3OUe33IBtqFknXhvy0hP23MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4MF1YN/1G0lEVI7vqrZMdz3W1fQZ+7cwO2AzpXknAOSmY61g59blAWw9L3HYuZrv8YGdJFkn3rt8TuW/kZ5NywkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB09ftSVpMSLSaj9Ni8WIhyKiP7qS0bFyaTAiHo6IHwpdPdm4J++kAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaLvJ6Znx4XK5NKGjo5NvJ3kw0qh18n5nAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD5PTM+PD5XJpYjLvTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC8TU7PjA+Xy6WJDXSu3s3JKzp51wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQH7+DQAA//+LYA3r") r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x64, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 1.441053612s ago: executing program 4 (id=814): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x5, 0x4, 0x7fdf, 0x1}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfe}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = dup2(r1, r0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r2}, 0x10) fremovexattr(0xffffffffffffffff, 0x0) 1.428452452s ago: executing program 4 (id=815): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=@framed={{}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x18) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1058, [{0x11}, {0x0, 0x100000000000000}]}, 0x68) 1.371011733s ago: executing program 4 (id=816): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000014c0)='kmem_cache_free\x00', r0, 0x0, 0x7}, 0x18) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000080), 0xb) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x1a08700, &(0x7f0000000700)={[{@nodioread_nolock}, {@nouid32}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x5c}}, {@nouid32}, {@resgid}, {@usrquota}, {@journal_dev={'journal_dev', 0x3d, 0x1}}]}, 0x0, 0x470, &(0x7f0000001040)="$eJzs281rHGUYAPBnJh9t7UdirR+tVaNFCIpJk1btwYuiIFJR0EM9xiQtodtGmii2FpuKeBKkoGfxKPoXeBNB1JPg1ZMnKRTtpa2nyMzOpJvtJjHNphOzvx9s9n1n3t15nszXu++7G0DHGsj+JBE7IuL3iOirVxc3GKg/Xb96fvzG1fPjSczPv/FXkre7dvX8eNm0fN32ojKYRqQfJ8VGFps5e+7kWK02eaaoD8+eemd45uy5p947NXZi8sTk6dEjRw4fGnn2mdGn25Jnlte1fR9O79/78luXXh0/duntn7/N4t1RrG/Mo10GssT/ns81r3u83Rur2M6GctJdYSCsSldEZLurJz//+6Irbu68vnjpo0qDA9ZVdm/asvTquXlgE0ui6giAapQ3+uzzb/m4Q12PDeHK8/UPQFne14tHfU13pEWbnqbPt+00EBHH5v75MnvEOo1DAAA0+nT8i6O9EfHBjW9eyfoefQtr0rgvf/4j/7urmEPpj4i7I2J3RNwTEXsi4t6IvO39EfHAGuO5tf+TXl7jWy4r6/89V8xtLe7/lb2/6O8qajvz/HuS41O1yYPF/2QwerZk9ZFltvH9i799ttS6xv5f9si2X/YFizgudzcN0E2MzY7lndI2uHIxYl93q/yThZmAJCL2RsS+1b31rrIw9cTX+5dqtHL+rVxcXSTLmP8qS28uy38umvIvJY3zk1O3zE8Ob43a5MHh8qi41S+/fvL6Utu/vfzb58pk/blh/zc36U8a52tn2rv92zz+097kzXyeubdY9v7Y7OyZkYje5GheX7R89OZry3rZPjv+Bw+0Pv93F6/J8n8wIrKD+KGIeDgiHilifzQiHouIA8vk+NMLK+cfaUX7/2LERMvr38Lx37T/V1/oOvnjd0tt/7/t/8N5abBYkl//VtAqnOx61hzgWv53AAAA8H+R5t+BT9KhhXKaDg3Vv8O/J+5Ka9Mzs08en3739ET9u/L90ZOWI119xXhobao2OZLMFe9YHx8dLcaKy/HSQ8W48edd2/L60Ph0baLi3KHTbV/i/M/82VV1dMA629Zy6WjvHQ8EqEDz7zXTxdULr4WLAWxWfq8NnWuF87+pO6AzAJuJ+z90rlbn/4WmurkA2Jzc/6FzOf+hQ6U/VB0BUCH3f+hIa/ld/zoWtm6MMKopbNSdkhciykK6IeJRWKdC1VcmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA9vg3AAD//5wI5wQ=") 1.348895793s ago: executing program 4 (id=818): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f00000000c0)='syzkaller\x00'}, 0x90) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f00000000c0)='block_bio_remap\x00', r0}, 0x10) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000023c0)={r1, 0x87, &(0x7f0000000800)}, 0x10) 1.223806593s ago: executing program 4 (id=820): r0 = syz_usb_connect$cdc_ncm(0x2, 0x76, &(0x7f0000000bc0)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904010001020d0000052406000105240000000d240f0100000000000000000006241a00000008241c00000008000905810300020000000904010000020d00000904010102020d0000090582020002"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000880)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x0, 0x0, 0xb, 0x1, 0x1, 0x4, 0x7, 0x40, 0x6, 0xe, 0x0, 0x1004}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 793.205156ms ago: executing program 6 (id=828): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x972, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) pipe(&(0x7f0000000000)) 704.561466ms ago: executing program 6 (id=830): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r1}, 0x10) syz_clone(0x43001000, 0x0, 0x0, 0x0, 0x0, 0x0) 623.421597ms ago: executing program 6 (id=831): openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000e, 0x204031, 0xffffffffffffffff, 0xd0c6f000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000013c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 528.085587ms ago: executing program 5 (id=833): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x5}, {0xfff1, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001300)=@deltfilter={0x38, 0x2d, 0x1, 0x78bd2f, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xfff3, 0xfff1}, {0x0, 0xffff}, {0x4, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4c0c5}, 0x20044000) 509.384498ms ago: executing program 5 (id=834): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000300)=ANY=[@ANYBLOB="14000000", @ANYRES16, @ANYBLOB="04"], 0x14}}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000200), r0) sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000400)={0x14, r1, 0x1, 0x0, 0x0, {0x19}}, 0x14}}, 0x0) 457.180347ms ago: executing program 5 (id=835): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x12, 0x17, 0x8, 0xd, 0x0, 0xffffffffffffffff, 0x10000}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r1}, &(0x7f0000000840), &(0x7f0000000880)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r1}, &(0x7f0000000340), &(0x7f0000000380)=r0}, 0x20) 456.953907ms ago: executing program 5 (id=836): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000001b40)=ANY=[@ANYBLOB="180000000000000000000000fdffffff18110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) write$selinux_attr(r2, 0x0, 0x0) 266.669499ms ago: executing program 5 (id=837): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$incfs(&(0x7f0000000240)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x0, 0x0) 253.743859ms ago: executing program 1 (id=839): syz_mount_image$ext4(&(0x7f00000005c0)='ext4\x00', &(0x7f0000000600)='./file0\x00', 0x0, &(0x7f00000000c0)={[{@nojournal_checksum}]}, 0x1, 0x5bc, &(0x7f0000001440)="$eJzs3V2IXGcdB+D/md1N87E1H7Zqa2xWQ20gdGez2YREvLDEj1qTWlG8CIWwZKe7IbM7a3YD3algizeiIII3IggVe2FFNJCbSqntRYs3Ckr9oKIxoIIIRSsFEdSRdz620+akCe7uHJrzPHBm3/Oe2X3f2eE355w57zkngNIaSw9ZxGhEXIyI7Z3Z1z9hrPOjefDCXJqyaLU+/bes/byZgxfmek/t/d629DAcsTkidh3LYu/Ile0urTTPTtfrtXPd+ery/GJ1aaV595n56dnabG3h0JGpo5OHp45Mrd9rnfjZ1lv/fOf9l594/p///tZvDv8g9Xe0u6z/dayXsRjr/k9GYmdf/XAWcd96N1aQoc5bHXf21WXDBXaI69Zq7fp+ev/eHhF72/nfHkPRefNeevrBf2yPX91bdB+BjdPqyV/8Sgu4YVXa28BZZTwiOuVKZXy8sw1/S2yt1BtLy/sfapxfmOlsK++IkcpDZ+q1ie6+wo4YydL8gXb5tfnJN8wfjGhvA39paEt7fvx0oz4z6A87oG004tLFz53etO0N+f/LUCf/wI0r5f+XLzz1bCq/OlR0b4BBSvn/3qvznwj5h9KRfygv+Yfykn8oL/mH8pJ/KC/5h/KSfygv+Yfykn8or17+HzhxIh44caLV7J7/vtCYPXN2bvHo5MT4/PnT46cb5xbHZxuN2fYZO/PX/rv1RmPxwGScf7i6XFtari6tNE/NN84vLJ9qn9d/qpZzKQCgACcvb75v557nXsoi4tEPbGlPyabuclmFG1urlUXR5yADxbDrD+XlUm1QXvbxgewayzdfbUF9/fsCDEal6A4AhbnrNsf/oKx8/w/l5ft/KC/b+IDv/6F8fP8P5TV6lft/3dx3766JiHhbRPx0aOSm3r2+gLeU1+3qj0ZcuvSdz1ZX78OtoKCgsFoo7oMKGIzXQl90T4CizBy8MNebBtXmM7ODagnI8/I9nUFAKffN7tRZMrx6bGBkg8YJ7bwjPf7o94/vmxtKU3Q/hzagKSDHo49FxLvy1v9Z+9jAju7zdnWeFrdExK0R8Y6IeOca2/7GpyLG4oVaf538w+Bcb/5vi4i0ur49It4dEbsj4j1rbPsXF1P+f72lv07+oRw+/3zRPQCK8vGniu4BUJSTxhhAaX33kaJ7ABTl6R8W3QOgKF99segeQLk9d09ETOQd/6u0j/f3jHSvC3hT91oAWyJia0Rs655DeHP3HMHtfccMr+XUJyPG4o4f99c5/geD0xv/17xi/F9ldfzfUETsWUMbz3xw9Ct59dO7U/6feKQ3/i9Nqf3eWEBgY738WMTtufnPVsf8ZpFyGvHe/7ONsS9cfjKv/sX7098d+bn8QzFa3454f+TnvyeVqsvzi9Wllebd7ft4z9YWDh2ZOjp5eOrIVLV9iZBq70IhOY7//ZX9efW/m0z5/+Yh+YdipPX/1qvkv3/7/31raOPY1798Mq9+9I8p/7ufffP8V/66KftMe753X4KHp5eXzx2I2JQdv7J+cg0dhRtcLyO9DKX879ubv/+/q/s7af1/LCI+nLYXIuI/EfHfiPhIRHw0Ij4WEfe+SZtfu2v2cl79H55M+X/8rPU/FCPlf+Ya6//0819raGP/vp98Ma/+Q3tS/sd/+6fjDw6nSf4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1t/SSvPsdL1eO7eBhaJfIwAAAAAAAJTF/wIAAP//d8Uzog==") creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x40) creat(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x12) symlink(&(0x7f00000008c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000007c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') creat(&(0x7f0000000b80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x104) 253.471609ms ago: executing program 6 (id=840): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r1}, 0x4) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000002, 0x11, r1, 0x5a718000) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@bridge_newvlan={0x24, 0x76, 0x709, 0x0, 0xffffffff, {0x7, 0x2}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x0, 0x1}}}]}, 0x24}, 0x1, 0x5502000000000000, 0x0, 0x24040010}, 0x0) 202.136819ms ago: executing program 5 (id=841): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000280)=0x2, 0x4) recvmmsg(r0, &(0x7f0000002e80), 0x1, 0x12002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) 136.844149ms ago: executing program 6 (id=842): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 0s ago: executing program 1 (id=843): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000d"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r1}, 0xc) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.33' (ED25519) to the list of known hosts. [ 19.032783][ T28] audit: type=1400 audit(1761758193.370:64): avc: denied { mounton } for pid=261 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.033936][ T261] cgroup: Unknown subsys name 'net' [ 19.036091][ T28] audit: type=1400 audit(1761758193.370:65): avc: denied { mount } for pid=261 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.040269][ T28] audit: type=1400 audit(1761758193.370:66): avc: denied { unmount } for pid=261 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.040401][ T261] cgroup: Unknown subsys name 'devices' [ 19.163435][ T261] cgroup: Unknown subsys name 'hugetlb' [ 19.169028][ T261] cgroup: Unknown subsys name 'rlimit' [ 19.271536][ T28] audit: type=1400 audit(1761758193.600:67): avc: denied { setattr } for pid=261 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.294710][ T28] audit: type=1400 audit(1761758193.610:68): avc: denied { mounton } for pid=261 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.319477][ T28] audit: type=1400 audit(1761758193.610:69): avc: denied { mount } for pid=261 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.327815][ T277] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 19.351452][ T28] audit: type=1400 audit(1761758193.680:70): avc: denied { relabelto } for pid=277 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.377463][ T28] audit: type=1400 audit(1761758193.690:71): avc: denied { write } for pid=277 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.453213][ T28] audit: type=1400 audit(1761758193.790:72): avc: denied { read } for pid=261 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.478748][ T28] audit: type=1400 audit(1761758193.790:73): avc: denied { open } for pid=261 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.478782][ T261] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 20.165773][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.172847][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.180288][ T283] device bridge_slave_0 entered promiscuous mode [ 20.192802][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.199935][ T284] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.207496][ T284] device bridge_slave_0 entered promiscuous mode [ 20.215423][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.222520][ T284] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.229786][ T284] device bridge_slave_1 entered promiscuous mode [ 20.242905][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.249929][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.257337][ T283] device bridge_slave_1 entered promiscuous mode [ 20.308902][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.316120][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.323538][ T285] device bridge_slave_0 entered promiscuous mode [ 20.330599][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.337860][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.345267][ T285] device bridge_slave_1 entered promiscuous mode [ 20.417556][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.424647][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.432139][ T291] device bridge_slave_0 entered promiscuous mode [ 20.453400][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.460445][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.467870][ T291] device bridge_slave_1 entered promiscuous mode [ 20.477656][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.484756][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.492116][ T287] device bridge_slave_0 entered promiscuous mode [ 20.511756][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.518815][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.526226][ T287] device bridge_slave_1 entered promiscuous mode [ 20.642850][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.649900][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.657273][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.664299][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.673917][ T284] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.680950][ T284] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.688228][ T284] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.695256][ T284] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.742402][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.749783][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.757096][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.764356][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.773283][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.780643][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.823170][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.831295][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.838330][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.845753][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.854481][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.861589][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.881586][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.890190][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.898476][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.906627][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.914787][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.921825][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.929289][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.937441][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.944571][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.951998][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.984661][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.992892][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.001168][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.009530][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.017175][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.025043][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.033227][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.040231][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.047658][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.055831][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.062884][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.070229][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.082050][ T283] device veth0_vlan entered promiscuous mode [ 21.092889][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.100727][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.108552][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.129583][ T284] device veth0_vlan entered promiscuous mode [ 21.143111][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.152113][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.160172][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.167832][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.175893][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.184006][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.192518][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.199811][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.207317][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.215288][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.223553][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.230559][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.238001][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.246218][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.253243][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.260711][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.268874][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.276075][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.283479][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.291372][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.301416][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.309213][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.320360][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.328932][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.341252][ T283] device veth1_macvtap entered promiscuous mode [ 21.348113][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.356572][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.365336][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.374273][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.382427][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.394465][ T284] device veth1_macvtap entered promiscuous mode [ 21.401439][ T285] device veth0_vlan entered promiscuous mode [ 21.413256][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.421445][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.429736][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.437331][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.445383][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.453601][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.461844][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.469851][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.477414][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.493819][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.502097][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.510348][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.518939][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.527447][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.535902][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.551123][ T285] device veth1_macvtap entered promiscuous mode [ 21.560662][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.569079][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.577708][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.586492][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.594814][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.602613][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.611098][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.624728][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.633206][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.644155][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.652365][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.666747][ T283] request_module fs-gadgetfs succeeded, but still no fs? [ 21.668205][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.682656][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.695300][ T291] device veth0_vlan entered promiscuous mode [ 21.706591][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.718878][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.727491][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.735942][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.745761][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.754208][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.781213][ T287] device veth0_vlan entered promiscuous mode [ 21.787571][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.801860][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.816177][ T291] device veth1_macvtap entered promiscuous mode [ 21.827236][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.844475][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.848453][ T346] loop0: detected capacity change from 0 to 1024 [ 21.852860][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.871927][ T346] EXT4-fs: Ignoring removed bh option [ 21.887945][ T287] device veth1_macvtap entered promiscuous mode [ 21.898372][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.908016][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.917570][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.926973][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.938207][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.939560][ T346] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 21.946658][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.957597][ T354] loop1: detected capacity change from 0 to 256 [ 21.990708][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.991692][ T346] EXT4-fs error (device loop0): ext4_lookup:1850: inode #2: comm syz.0.1: bad inode number: 12 [ 22.007856][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.020324][ T357] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 22.022357][ T354] exfat: Deprecated parameter 'utf8' [ 22.037432][ T346] EXT4-fs (loop0): Remounting filesystem read-only [ 22.048677][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.057180][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.067573][ T354] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xbe675ead, utbl_chksum : 0xe619d30d) [ 22.072332][ T346] EXT4-fs error (device loop0): __ext4_new_inode:1075: comm syz.0.1: reserved inode found cleared - inode=18 [ 22.117503][ T346] EXT4-fs (loop0): Remounting filesystem read-only [ 22.169010][ T285] EXT4-fs (loop0): unmounting filesystem. [ 22.220832][ T381] loop2: detected capacity change from 0 to 256 [ 22.247755][ T381] ======================================================= [ 22.247755][ T381] WARNING: The mand mount option has been deprecated and [ 22.247755][ T381] and is ignored by this kernel. Remove the mand [ 22.247755][ T381] option from the mount to silence this warning. [ 22.247755][ T381] ======================================================= [ 22.323152][ T388] syz.1.20[388] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 22.323219][ T388] syz.1.20[388] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 22.362973][ T381] FAT-fs (loop2): Directory bread(block 64) failed [ 22.406042][ T381] FAT-fs (loop2): Directory bread(block 65) failed [ 22.416164][ T381] FAT-fs (loop2): Directory bread(block 66) failed [ 22.430686][ T381] FAT-fs (loop2): Directory bread(block 67) failed [ 22.443761][ T381] FAT-fs (loop2): Directory bread(block 68) failed [ 22.458726][ T381] FAT-fs (loop2): Directory bread(block 69) failed [ 22.469671][ T381] FAT-fs (loop2): Directory bread(block 70) failed [ 22.476758][ T381] FAT-fs (loop2): Directory bread(block 71) failed [ 22.483867][ T381] FAT-fs (loop2): Directory bread(block 72) failed [ 22.490570][ T381] FAT-fs (loop2): Directory bread(block 73) failed [ 22.502642][ T408] loop4: detected capacity change from 0 to 128 [ 22.504847][ T370] loop3: detected capacity change from 0 to 40427 [ 22.530736][ T370] F2FS-fs (loop3): heap/no_heap options were deprecated [ 22.547000][ T408] EXT4-fs: Ignoring removed nobh option [ 22.547671][ T370] F2FS-fs (loop3): fault_injection options not supported [ 22.568240][ T370] F2FS-fs (loop3): fault_type options not supported [ 22.577105][ T408] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 22.581884][ T370] F2FS-fs (loop3): invalid crc value [ 22.594291][ T408] ext4 filesystem being mounted at /5/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 22.627562][ T408] fscrypt (loop4, inode 12): Unsupported log2_data_unit_size in encryption policy: 15 [ 22.643528][ T370] F2FS-fs (loop3): Found nat_bits in checkpoint [ 22.651209][ T287] EXT4-fs (loop4): unmounting filesystem. [ 22.716172][ T370] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 22.753878][ T435] loop4: detected capacity change from 0 to 512 [ 22.766800][ T435] EXT4-fs error (device loop4): ext4_orphan_get:1400: inode #15: comm syz.4.39: casefold flag without casefold feature [ 22.779872][ T435] EXT4-fs error (device loop4): ext4_orphan_get:1405: comm syz.4.39: couldn't read orphan inode 15 (err -117) [ 22.793884][ T435] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 22.823277][ T440] loop2: detected capacity change from 0 to 256 [ 22.836675][ T287] EXT4-fs (loop4): unmounting filesystem. [ 22.863799][ T440] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x64c916ba, utbl_chksum : 0xe619d30d) [ 22.944515][ T458] loop3: detected capacity change from 0 to 256 [ 22.974717][ T458] FAT-fs (loop3): Directory bread(block 64) failed [ 22.981367][ T458] FAT-fs (loop3): Directory bread(block 65) failed [ 22.988618][ T458] FAT-fs (loop3): Directory bread(block 66) failed [ 22.996708][ T458] FAT-fs (loop3): Directory bread(block 67) failed [ 23.003316][ T458] FAT-fs (loop3): Directory bread(block 68) failed [ 23.015378][ T458] FAT-fs (loop3): Directory bread(block 69) failed [ 23.022423][ T458] FAT-fs (loop3): Directory bread(block 70) failed [ 23.035023][ T458] FAT-fs (loop3): Directory bread(block 71) failed [ 23.042083][ T458] FAT-fs (loop3): Directory bread(block 72) failed [ 23.048679][ T458] FAT-fs (loop3): Directory bread(block 73) failed [ 23.182933][ T494] loop2: detected capacity change from 0 to 256 [ 23.214842][ T494] FAT-fs (loop2): Directory bread(block 64) failed [ 23.222803][ T494] FAT-fs (loop2): Directory bread(block 65) failed [ 23.229390][ T494] FAT-fs (loop2): Directory bread(block 66) failed [ 23.238028][ T24] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 23.249731][ T494] FAT-fs (loop2): Directory bread(block 67) failed [ 23.256383][ T502] netlink: 44 bytes leftover after parsing attributes in process `syz.3.71'. [ 23.259563][ T494] FAT-fs (loop2): Directory bread(block 68) failed [ 23.274663][ T494] FAT-fs (loop2): Directory bread(block 69) failed [ 23.282361][ T494] FAT-fs (loop2): Directory bread(block 70) failed [ 23.289053][ T494] FAT-fs (loop2): Directory bread(block 71) failed [ 23.297545][ T494] FAT-fs (loop2): Directory bread(block 72) failed [ 23.303633][ T508] loop0: detected capacity change from 0 to 256 [ 23.313015][ T494] FAT-fs (loop2): Directory bread(block 73) failed [ 23.341553][ T508] FAT-fs (loop0): Directory bread(block 64) failed [ 23.359296][ T512] input: syz0 as /devices/virtual/input/input4 [ 23.369017][ T508] FAT-fs (loop0): Directory bread(block 65) failed [ 23.376558][ T508] FAT-fs (loop0): Directory bread(block 66) failed [ 23.395124][ T508] FAT-fs (loop0): Directory bread(block 67) failed [ 23.406082][ T508] FAT-fs (loop0): Directory bread(block 68) failed [ 23.408093][ T516] netlink: 4 bytes leftover after parsing attributes in process `syz.3.80'. [ 23.412952][ T508] FAT-fs (loop0): Directory bread(block 69) failed [ 23.439205][ T508] FAT-fs (loop0): Directory bread(block 70) failed [ 23.453626][ T508] FAT-fs (loop0): Directory bread(block 71) failed [ 23.462701][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 23.466022][ T508] FAT-fs (loop0): Directory bread(block 72) failed [ 23.474723][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 255, setting to 64 [ 23.480995][ T508] FAT-fs (loop0): Directory bread(block 73) failed [ 23.492432][ T24] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 23.507683][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 23.528436][ T24] usb 5-1: config 0 descriptor?? [ 23.539893][ T464] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 23.558769][ T532] netlink: 32 bytes leftover after parsing attributes in process `syz.3.86'. [ 23.588114][ T532] netlink: 32 bytes leftover after parsing attributes in process `syz.3.86'. [ 23.601899][ T538] netlink: 104 bytes leftover after parsing attributes in process `syz.1.90'. [ 23.676353][ T554] netlink: 156 bytes leftover after parsing attributes in process `syz.3.95'. [ 23.700479][ T556] loop3: detected capacity change from 0 to 16 [ 23.725326][ T556] erofs: (device loop3): mounted with root inode @ nid 36. [ 23.740449][ T556] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop3 ino=46 [ 23.751145][ T556] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop3 ino=46 [ 23.761389][ T556] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop3 ino=46 [ 23.770959][ T556] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop3 ino=46 [ 23.780146][ T556] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop3 ino=46 [ 23.793526][ T556] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop3 ino=46 [ 23.793582][ T561] SELinux: inode_doinit_use_xattr: getxattr returned 117 for dev=loop3 ino=46 [ 23.832410][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.849200][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.850705][ T566] netlink: 8 bytes leftover after parsing attributes in process `syz.1.100'. [ 23.857808][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.875432][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.884322][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.891577][ T19] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 23.893061][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.908581][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.916847][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.925333][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.933592][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.941733][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.949835][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.958308][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.960391][ T24] hid-generic 0003:04F3:0755.0001: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.4-1/input0 [ 23.966983][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.986324][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 23.995007][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.008605][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.030790][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.039913][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.048309][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.057008][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.065486][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.078477][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.082560][ T19] usb 1-1: config 0 has an invalid interface number: 192 but max is 0 [ 24.086962][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.103325][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.111458][ T19] usb 1-1: config 0 has no interface number 0 [ 24.117750][ T28] kauditd_printk_skb: 95 callbacks suppressed [ 24.117762][ T28] audit: type=1400 audit(1761758198.460:169): avc: denied { unmount } for pid=284 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 24.122011][ T19] usb 1-1: New USB device found, idVendor=c0f3, idProduct=6fdd, bcdDevice=e7.92 [ 24.125293][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.158650][ T19] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.173213][ T19] usb 1-1: config 0 descriptor?? [ 24.184432][ T19] usb-storage 1-1:0.192: USB Mass Storage device detected [ 24.213185][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.213768][ T28] audit: type=1400 audit(1761758198.550:170): avc: denied { write } for pid=461 comm="syz.4.54" name="hidraw0" dev="devtmpfs" ino=602 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 24.225525][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.244927][ T576] usb 5-1: USB disconnect, device number 2 [ 24.253597][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.266940][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.276434][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.288049][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.297350][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.306849][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.316211][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.325710][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.334053][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.342739][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.351012][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.359299][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.367754][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.376047][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.384335][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.392929][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.401243][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.402665][ T19] usb 1-1: USB disconnect, device number 2 [ 24.409571][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.423478][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.431851][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.440300][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.449637][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.458016][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.466368][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.474700][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.483962][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.492345][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.500503][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.508965][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.517387][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.530376][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.538966][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.552794][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.561291][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.569865][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.578381][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.587410][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.595696][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.604228][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.612507][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.620603][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.628832][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.637429][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.646422][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.655007][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.663394][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.671670][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.680221][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.689892][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.698420][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.710310][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.721937][ T28] audit: type=1400 audit(1761758199.050:171): avc: denied { unmount } for pid=607 comm="syz.2.117" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 24.723984][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.750489][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.753098][ T28] audit: type=1400 audit(1761758199.090:172): avc: denied { unmount } for pid=291 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 24.758934][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.799788][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.808012][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.817942][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.820734][ T615] syz.4.121[615] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 24.828306][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.836067][ T615] syz.4.121[615] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 24.851939][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.873043][ T291] syz-executor (291) used greatest stack depth: 22176 bytes left [ 24.901825][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.913169][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.934272][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.951821][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.970284][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 24.991872][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.010569][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.041774][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.050420][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.083604][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.114829][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.122958][ T28] audit: type=1400 audit(1761758199.460:173): avc: denied { read } for pid=636 comm="syz-executor" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 25.136848][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.149701][ T640] loop0: detected capacity change from 0 to 512 [ 25.166754][ T640] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 25.184970][ T28] audit: type=1400 audit(1761758199.480:174): avc: denied { open } for pid=636 comm="syz-executor" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 25.185726][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.217144][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.222795][ T640] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 25.226565][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.235530][ T28] audit: type=1400 audit(1761758199.480:175): avc: denied { mounton } for pid=636 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 25.276745][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.283642][ T640] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2818: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 25.285104][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.298432][ T640] EXT4-fs (loop0): 1 truncate cleaned up [ 25.306128][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.319923][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.328481][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.336923][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.340664][ T640] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 25.345211][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.361830][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.370772][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.379108][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.387378][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.395669][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.395911][ T28] audit: type=1400 audit(1761758199.730:176): avc: denied { mount } for pid=637 comm="syz.0.132" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 25.403871][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.426376][ T636] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.433852][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.448867][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.457131][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.465404][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.466236][ T636] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.473622][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.489282][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.497726][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.505973][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.508375][ T636] device bridge_slave_0 entered promiscuous mode [ 25.514260][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.528862][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.533495][ T28] audit: type=1400 audit(1761758199.860:177): avc: denied { append } for pid=637 comm="syz.0.132" name="file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 25.537161][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.568662][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.569596][ T285] EXT4-fs (loop0): unmounting filesystem. [ 25.576976][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.590676][ T636] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.610886][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.620444][ T636] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.627138][ T655] loop1: detected capacity change from 0 to 512 [ 25.632507][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.639253][ T28] audit: type=1400 audit(1761758199.860:178): avc: denied { open } for pid=637 comm="syz.0.132" path="/11/file2/file1" dev="loop0" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 25.642263][ T636] device bridge_slave_1 entered promiscuous mode [ 25.671422][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.672709][ T655] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 25.681390][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.691135][ T655] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 25.707054][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.710209][ T655] EXT4-fs (loop1): 1 truncate cleaned up [ 25.716936][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.722488][ T655] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 25.731092][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.768914][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.777972][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.778011][ T283] EXT4-fs (loop1): unmounting filesystem. [ 25.786376][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.800189][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.808629][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.817039][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.827900][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.841877][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.860645][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.878950][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.887819][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.896378][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.913720][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.927416][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.942842][ T10] device bridge_slave_1 left promiscuous mode [ 25.944929][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.950111][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.979343][ T10] device bridge_slave_0 left promiscuous mode [ 25.979414][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 25.985661][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.001999][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.010334][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.018548][ T10] device veth1_macvtap left promiscuous mode [ 26.019093][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.026893][ T10] device veth0_vlan left promiscuous mode [ 26.033055][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.082217][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.090483][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.099532][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.107909][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.116585][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.124955][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.133450][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.167206][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.188869][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.199715][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.215182][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.223965][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.232945][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.248029][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.258389][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.269071][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.285113][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.293826][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.302621][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.310907][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.312750][ T691] device erspan0 entered promiscuous mode [ 26.320302][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.333487][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.341925][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.350376][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.363349][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.371761][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.371875][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 26.379969][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.400502][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 26.400830][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.419851][ T60] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 26.428327][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 26.441467][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.445360][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 26.458665][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.459539][ T338] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.473815][ T338] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.478366][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.510090][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.511902][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 26.535773][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 26.541796][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.552021][ T338] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.552042][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.552194][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.569691][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.604817][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.612831][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.617020][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.640824][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.641671][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.658032][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 26.666089][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.674435][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.674699][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.691043][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.707775][ T636] device veth0_vlan entered promiscuous mode [ 26.712675][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.714742][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.730442][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.745571][ T636] device veth1_macvtap entered promiscuous mode [ 26.751182][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.767814][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.772358][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.792425][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.798828][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.802326][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.817563][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.826058][ T720] syz.1.164 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 26.836395][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.837960][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.864334][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.877144][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.885446][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.892355][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.904953][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.911816][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.913532][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.921485][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.937778][ T727] device batadv_slave_1 entered promiscuous mode [ 26.945237][ T728] netlink: 504 bytes leftover after parsing attributes in process `syz.0.168'. [ 26.951789][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.957812][ T728] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 26.962911][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 26.978805][ T725] device batadv_slave_1 left promiscuous mode [ 27.000873][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.021043][ T735] loop1: detected capacity change from 0 to 512 [ 27.022577][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.049792][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.058504][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.075984][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.088426][ T739] SELinux: ebitmap: truncated map [ 27.090251][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.102481][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.113859][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.124927][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.137705][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.156572][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.166261][ T739] SELinux: failed to load policy [ 27.174979][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.187905][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.197174][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.206028][ T751] process 'syz.5.178' launched './file0' with NULL argv: empty string added [ 27.225677][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.239256][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.240220][ T753] loop0: detected capacity change from 0 to 256 [ 27.247863][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.278971][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.287572][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.296505][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.321808][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.330176][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.341246][ T753] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 27.348778][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.379681][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.392363][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.403704][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.416224][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.429781][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.439951][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.440889][ T763] loop0: detected capacity change from 0 to 256 [ 27.450169][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.462541][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.470945][ T760] netlink: 12 bytes leftover after parsing attributes in process `syz.4.184'. [ 27.475271][ T763] exfat: Deprecated parameter 'namecase' [ 27.485882][ T763] exfat: Deprecated parameter 'namecase' [ 27.492696][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.501849][ T763] exfat: Deprecated parameter 'utf8' [ 27.511023][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.513510][ T763] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x36dfe6b4, utbl_chksum : 0xe619d30d) [ 27.520042][ T284] erofs: (device loop3): erofs_fill_dentries: bogus dirent @ nid 36 [ 27.536361][ T760] netlink: 12 bytes leftover after parsing attributes in process `syz.4.184'. [ 27.843513][ T804] loop5: detected capacity change from 0 to 256 [ 27.876928][ T804] FAT-fs (loop5): Directory bread(block 64) failed [ 27.892230][ T804] FAT-fs (loop5): Directory bread(block 65) failed [ 27.899645][ T804] FAT-fs (loop5): Directory bread(block 66) failed [ 27.917198][ T804] FAT-fs (loop5): Directory bread(block 67) failed [ 27.931759][ T804] FAT-fs (loop5): Directory bread(block 68) failed [ 27.941662][ T804] FAT-fs (loop5): Directory bread(block 69) failed [ 27.952760][ T804] FAT-fs (loop5): Directory bread(block 70) failed [ 27.959778][ T804] FAT-fs (loop5): Directory bread(block 71) failed [ 27.978930][ T804] FAT-fs (loop5): Directory bread(block 72) failed [ 28.003341][ T804] FAT-fs (loop5): Directory bread(block 73) failed [ 28.013196][ T820] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 28.200866][ T839] loop5: detected capacity change from 0 to 256 [ 28.240719][ T839] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x205ad3ec, utbl_chksum : 0xe619d30d) [ 28.410865][ T838] loop1: detected capacity change from 0 to 40427 [ 28.452639][ T838] F2FS-fs (loop1): Found nat_bits in checkpoint [ 28.505905][ T838] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 28.552073][ T859] netlink: 'syz.5.226': attribute type 5 has an invalid length. [ 28.570259][ T859] __nla_validate_parse: 3 callbacks suppressed [ 28.570276][ T859] netlink: 24 bytes leftover after parsing attributes in process `syz.5.226'. [ 28.595720][ T283] syz-executor: attempt to access beyond end of device [ 28.595720][ T283] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 28.745407][ T877] loop5: detected capacity change from 0 to 256 [ 28.761313][ T877] exFAT-fs (loop5): failed to load upcase table (idx : 0x00002e7f, chksum : 0x03279930, utbl_chksum : 0xe619d30d) [ 28.876782][ T873] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.886554][ T873] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.907156][ T873] device bridge_slave_0 entered promiscuous mode [ 28.914372][ T10] device bridge_slave_1 left promiscuous mode [ 28.920829][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.962656][ T10] device bridge_slave_0 left promiscuous mode [ 28.992964][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.000845][ T896] loop4: detected capacity change from 0 to 2048 [ 29.008377][ T10] device veth1_macvtap left promiscuous mode [ 29.017631][ T10] device veth0_vlan left promiscuous mode [ 29.045814][ T896] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 29.054626][ T896] ext4 filesystem being mounted at /45/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 29.090844][ T896] EXT4-fs (loop4): shut down requested (2) [ 29.097985][ T896] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=15 [ 29.108814][ T896] SELinux: inode_doinit_use_xattr: getxattr returned 5 for dev=loop4 ino=15 [ 29.109144][ T904] netlink: 32 bytes leftover after parsing attributes in process `syz.1.244'. [ 29.138428][ T287] EXT4-fs (loop4): unmounting filesystem. [ 29.233985][ T873] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.241690][ T873] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.249290][ T873] device bridge_slave_1 entered promiscuous mode [ 29.256440][ T897] netlink: 28 bytes leftover after parsing attributes in process `syz.0.241'. [ 29.425138][ T873] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.432315][ T873] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.439604][ T873] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.446691][ T873] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.454512][ T886] loop5: detected capacity change from 0 to 131072 [ 29.466751][ T886] F2FS-fs (loop5): Test dummy encryption mode enabled [ 29.487512][ T886] F2FS-fs (loop5): invalid crc value [ 29.507775][ T886] F2FS-fs (loop5): Found nat_bits in checkpoint [ 29.516879][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.526921][ T338] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.542540][ T338] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.548836][ T915] loop1: detected capacity change from 0 to 40427 [ 29.549731][ T886] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 29.563455][ T915] F2FS-fs (loop1): invalid crc value [ 29.586801][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.600356][ T338] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.604756][ T886] fscrypt: AES-256-XTS using implementation "xts-aes-aesni" [ 29.607555][ T338] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.621398][ T28] kauditd_printk_skb: 33 callbacks suppressed [ 29.621411][ T28] audit: type=1400 audit(2000000001.129:212): avc: denied { ioctl } for pid=885 comm="syz.5.240" path="/22/file0/memory.events.local" dev="loop5" ino=10 ioctlcmd=0xf514 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 29.624005][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.634766][ T915] F2FS-fs (loop1): Found nat_bits in checkpoint [ 29.655178][ T338] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.674386][ T338] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.696794][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.697070][ T915] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 29.712933][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.725826][ T873] device veth0_vlan entered promiscuous mode [ 29.733479][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 29.742170][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 29.750710][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 29.759077][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 29.767924][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 29.775687][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 29.790244][ T873] device veth1_macvtap entered promiscuous mode [ 29.801739][ T28] audit: type=1400 audit(2000000001.319:213): avc: denied { setattr } for pid=914 comm="syz.1.249" name="file0" dev="loop1" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 29.824662][ T675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 29.838206][ T675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 29.847253][ T283] syz-executor: attempt to access beyond end of device [ 29.847253][ T283] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 29.862422][ T675] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 29.881784][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 29.890711][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 29.907056][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 29.923981][ T338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 29.996570][ T28] audit: type=1400 audit(2000000001.509:214): avc: denied { append } for pid=944 comm="syz.6.256" name="ptp0" dev="devtmpfs" ino=264 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 30.073552][ T28] audit: type=1400 audit(2000000001.589:215): avc: denied { connect } for pid=954 comm="syz.5.259" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 30.138313][ T28] audit: type=1400 audit(2000000001.649:216): avc: denied { name_bind } for pid=966 comm="syz.1.266" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 30.204374][ T28] audit: type=1400 audit(2000000001.649:217): avc: denied { node_bind } for pid=966 comm="syz.1.266" saddr=::1 src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 30.220430][ T981] netlink: 24 bytes leftover after parsing attributes in process `syz.0.272'. [ 30.240026][ T983] netlink: 'syz.1.273': attribute type 15 has an invalid length. [ 30.298084][ T28] audit: type=1326 audit(2000000001.809:218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=989 comm="syz.1.276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbe518efc9 code=0x7ffc0000 [ 30.357858][ T28] audit: type=1326 audit(2000000001.839:219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=989 comm="syz.1.276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbe518efc9 code=0x7ffc0000 [ 30.418384][ T28] audit: type=1326 audit(2000000001.839:220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=989 comm="syz.1.276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7fdbe518efc9 code=0x7ffc0000 [ 30.442162][ T1013] Dead loop on virtual device ip6_vti0, fix it urgently! [ 30.450541][ T28] audit: type=1326 audit(2000000001.839:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=989 comm="syz.1.276" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbe518efc9 code=0x7ffc0000 [ 30.487529][ T1013] syz.0.287 (1013) used greatest stack depth: 22056 bytes left [ 30.533871][ T1020] loop6: detected capacity change from 0 to 16 [ 30.555543][ T1020] erofs: (device loop6): erofs_fc_fill_super: rootino(nid 36) is not a directory(i_mode 25144) [ 30.583810][ T1026] loop0: detected capacity change from 0 to 512 [ 30.631584][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 30.633778][ T1032] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 30.645171][ T1026] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 30.658909][ T1032] dvmrp1: linktype set to 0 [ 30.676399][ T1026] EXT4-fs warning (device loop0): dx_probe:869: inode #2: comm syz.0.292: Unimplemented hash flags: 0x0001 [ 30.698598][ T1026] EXT4-fs warning (device loop0): dx_probe:966: inode #2: comm syz.0.292: Corrupt directory, running e2fsck is recommended [ 30.734092][ T285] EXT4-fs (loop0): unmounting filesystem. [ 30.756642][ T1049] loop0: detected capacity change from 0 to 256 [ 30.784829][ T1049] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 30.798004][ T1053] netlink: 8 bytes leftover after parsing attributes in process `syz.4.306'. [ 30.820757][ T1059] loop6: detected capacity change from 0 to 256 [ 30.836273][ T1061] device sit0 entered promiscuous mode [ 30.882251][ T1063] netlink: 2 bytes leftover after parsing attributes in process `syz.1.310'. [ 30.939631][ T1075] loop5: detected capacity change from 0 to 256 [ 30.954868][ T1079] random: crng reseeded on system resumption [ 31.073541][ T1093] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 31.141634][ T334] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 31.189091][ T1065] loop0: detected capacity change from 0 to 40427 [ 31.236868][ T1065] F2FS-fs (loop0): Found nat_bits in checkpoint [ 31.273805][ T1111] can0: slcan on ttyS3. [ 31.309737][ T1065] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 31.317365][ T1111] can0 (unregistered): slcan off ttyS3. [ 31.331373][ T1111] Falling back ldisc for ttyS3. [ 31.335707][ T334] usb 5-1: New USB device found, idVendor=05ac, idProduct=029f, bcdDevice= 0.00 [ 31.365810][ T334] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.378237][ T285] syz-executor: attempt to access beyond end of device [ 31.378237][ T285] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 31.378641][ T334] usb 5-1: config 0 descriptor?? [ 31.398598][ T1126] binder: 1125:1126 ioctl c0306201 200000000040 returned -14 [ 31.442959][ T1131] loop1: detected capacity change from 0 to 1024 [ 31.449645][ T1131] EXT4-fs: Ignoring removed bh option [ 31.456831][ T1131] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 31.468296][ T1131] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 31.479188][ T1131] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (31873!=20869) [ 31.488823][ T1131] EXT4-fs (loop1): filesystem has both journal inode and journal device! [ 31.590182][ T1146] loop1: detected capacity change from 0 to 2048 [ 31.613327][ T1146] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 31.631725][ T283] EXT4-fs (loop1): unmounting filesystem. [ 31.801562][ T60] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 31.810040][ T334] apple 0003:05AC:029F.0002: unknown main item tag 0x0 [ 31.816985][ T334] apple 0003:05AC:029F.0002: unknown main item tag 0x0 [ 31.824148][ T334] apple 0003:05AC:029F.0002: unknown main item tag 0x0 [ 31.831183][ T334] apple 0003:05AC:029F.0002: unknown main item tag 0x0 [ 31.838323][ T334] apple 0003:05AC:029F.0002: unknown main item tag 0x0 [ 31.845219][ T334] apple 0003:05AC:029F.0002: unknown main item tag 0x0 [ 31.852104][ T334] apple 0003:05AC:029F.0002: unknown main item tag 0x0 [ 31.859760][ T334] apple 0003:05AC:029F.0002: hidraw0: USB HID v0.00 Device [HID 05ac:029f] on usb-dummy_hcd.4-1/input0 [ 32.002767][ T60] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 32.011123][ T60] usb 1-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 32.020102][ T60] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 32.030486][ T60] usb 1-1: config 220 has no interface number 2 [ 32.036954][ T60] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 32.050196][ T60] usb 1-1: config 220 interface 0 has no altsetting 0 [ 32.057081][ T60] usb 1-1: config 220 interface 76 has no altsetting 0 [ 32.064022][ T60] usb 1-1: config 220 interface 1 has no altsetting 0 [ 32.072396][ T60] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 32.081565][ T60] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.089574][ T60] usb 1-1: Product: syz [ 32.093885][ T60] usb 1-1: Manufacturer: syz [ 32.098476][ T60] usb 1-1: SerialNumber: syz [ 32.114411][ T334] usb 5-1: USB disconnect, device number 3 [ 32.165260][ T1174] incfs: Backing dir is not set, filesystem can't be mounted. [ 32.172982][ T1174] incfs: mount failed -2 [ 32.231771][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 32.251169][ T1188] loop5: detected capacity change from 0 to 256 [ 32.269382][ T1188] exfat: Deprecated parameter 'namecase' [ 32.277277][ T1188] exfat: Deprecated parameter 'namecase' [ 32.291324][ T1188] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x05bcf2b2, utbl_chksum : 0xe619d30d) [ 32.309168][ T60] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 32.318110][ T60] usb 1-1: No valid video chain found. [ 32.330300][ T60] usb 1-1: selecting invalid altsetting 0 [ 32.361212][ T60] usb 1-1: USB disconnect, device number 3 [ 32.474603][ T24] kernel write not supported for file /ppp (pid: 24 comm: kworker/1:0) [ 32.564318][ T1236] netlink: 27 bytes leftover after parsing attributes in process `syz.1.375'. [ 32.722450][ T1255] tap0: tun_chr_ioctl cmd 1074025677 [ 32.727799][ T1255] tap0: linktype set to 270 [ 32.750755][ T1257] support for the xor transformation has been removed. [ 32.944549][ T1286] netlink: 16 bytes leftover after parsing attributes in process `syz.0.398'. [ 32.955209][ T1286] netlink: 164 bytes leftover after parsing attributes in process `syz.0.398'. [ 33.026621][ T1296] loop6: detected capacity change from 0 to 128 [ 33.037755][ T1296] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 33.061528][ T1296] FAT-fs (loop6): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 33.070602][ T1298] syz.1.404 (1298) used greatest stack depth: 21664 bytes left [ 33.188075][ T1319] loop6: detected capacity change from 0 to 1024 [ 33.204709][ T1319] EXT4-fs: Ignoring removed nobh option [ 33.210475][ T1319] EXT4-fs: Ignoring removed bh option [ 33.216429][ T1319] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 33.233465][ T1319] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 33.253736][ T873] EXT4-fs (loop6): unmounting filesystem. [ 33.280020][ T1307] loop0: detected capacity change from 0 to 40427 [ 33.289726][ T1307] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 33.297642][ T1307] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 33.306892][ T1307] F2FS-fs (loop0): invalid crc_offset: 33558524 [ 33.325729][ T1307] F2FS-fs (loop0): Found nat_bits in checkpoint [ 33.359226][ T1307] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 33.369940][ T1307] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 33.397298][ T1337] loop5: detected capacity change from 0 to 256 [ 33.441702][ T1339] SELinux: failed to load policy [ 33.520484][ T1350] netlink: 32 bytes leftover after parsing attributes in process `syz.6.427'. [ 33.588645][ T1358] loop6: detected capacity change from 0 to 256 [ 33.614731][ T1358] exfat: Deprecated parameter 'utf8' [ 33.623191][ T1369] binder: 1368:1369 ioctl c0306201 200000000480 returned -14 [ 33.653538][ T1374] netlink: 12 bytes leftover after parsing attributes in process `syz.5.437'. [ 33.662877][ T1374] netlink: 12 bytes leftover after parsing attributes in process `syz.5.437'. [ 33.683587][ T1358] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x5441951d, utbl_chksum : 0xe619d30d) [ 33.743928][ T1385] A link change request failed with some changes committed already. Interface nicvf0 may have been left with an inconsistent configuration, please check. [ 33.766731][ T1385] Zero length message leads to an empty skb [ 33.843599][ T1405] capability: warning: `syz.5.452' uses deprecated v2 capabilities in a way that may be insecure [ 33.983954][ T1426] loop6: detected capacity change from 0 to 256 [ 34.032979][ T1426] exFAT-fs (loop6): failed to load upcase table (idx : 0x0001e4a3, chksum : 0x009ea0b8, utbl_chksum : 0x7319d30d) [ 34.240125][ T1454] capability: warning: `syz.0.475' uses 32-bit capabilities (legacy support in use) [ 34.331643][ T24] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 34.401576][ T576] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 34.522662][ T24] usb 2-1: config index 0 descriptor too short (expected 39, got 27) [ 34.537500][ T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 34.577145][ T24] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 34.593721][ T24] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 34.608678][ T1493] loop4: detected capacity change from 0 to 512 [ 34.611533][ T576] usb 7-1: Using ep0 maxpacket: 32 [ 34.615221][ T24] usb 2-1: Product: syz [ 34.625480][ T1493] EXT4-fs: Ignoring removed orlov option [ 34.631196][ T24] usb 2-1: Manufacturer: syz [ 34.636100][ T24] usb 2-1: SerialNumber: syz [ 34.636220][ T576] usb 7-1: config 0 has an invalid interface number: 83 but max is 0 [ 34.650188][ T24] usb 2-1: config 0 descriptor?? [ 34.656157][ T24] hub 2-1:0.0: bad descriptor, ignoring hub [ 34.662456][ T1493] EXT4-fs (loop4): Test dummy encryption mode enabled [ 34.664391][ T24] hub: probe of 2-1:0.0 failed with error -5 [ 34.678075][ T576] usb 7-1: config 0 has no interface number 0 [ 34.689243][ T1493] EXT4-fs (loop4): can't mount with data_err=abort, fs mounted w/o journal [ 34.698733][ T576] usb 7-1: config 0 interface 83 has no altsetting 0 [ 34.699307][ T24] snd-usb-audio: probe of 2-1:0.0 failed with error -22 [ 34.713593][ T576] usb 7-1: New USB device found, idVendor=19d2, idProduct=5dca, bcdDevice=79.6f [ 34.724542][ T576] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 34.727280][ T1496] netlink: 36 bytes leftover after parsing attributes in process `syz.0.495'. [ 34.734236][ T576] usb 7-1: Product: syz [ 34.757863][ T337] udevd[337]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 34.773554][ T28] kauditd_printk_skb: 79 callbacks suppressed [ 34.773571][ T28] audit: type=1400 audit(2000000006.269:301): avc: denied { remount } for pid=1491 comm="syz.4.493" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 34.808440][ T1498] loop4: detected capacity change from 0 to 512 [ 34.815225][ T576] usb 7-1: Manufacturer: syz [ 34.819959][ T576] usb 7-1: SerialNumber: syz [ 34.827856][ T576] usb 7-1: config 0 descriptor?? [ 34.838294][ T1498] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.497: invalid indirect mapped block 256 (level 2) [ 34.852242][ T576] usb 7-1: bad CDC descriptors [ 34.859022][ T1498] EXT4-fs (loop4): 2 truncates cleaned up [ 34.865218][ T1498] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 34.924182][ T338] EXT4-fs error (device loop4): ext4_validate_block_bitmap:429: comm kworker/u4:3: bg 0: block 5: invalid block bitmap [ 34.942442][ T338] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 32 with error 28 [ 34.984168][ T338] EXT4-fs (loop4): This should not happen!! Data will be lost [ 34.984168][ T338] [ 34.997884][ T1506] loop0: detected capacity change from 0 to 512 [ 35.004933][ T338] EXT4-fs (loop4): Total free blocks count 0 [ 35.011055][ T338] EXT4-fs (loop4): Free/Dirty block details [ 35.021613][ T576] usb 2-1: USB disconnect, device number 2 [ 35.037877][ T1506] ------------[ cut here ]------------ [ 35.043432][ T1506] EA inode 11 i_nlink=2 [ 35.043602][ T1506] WARNING: CPU: 1 PID: 1506 at fs/ext4/xattr.c:1021 ext4_xattr_inode_update_ref+0x512/0x570 [ 35.057937][ T1506] Modules linked in: [ 35.061987][ T1506] CPU: 1 PID: 1506 Comm: syz.0.500 Not tainted syzkaller #0 [ 35.069312][ T1506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 35.079510][ T1506] RIP: 0010:ext4_xattr_inode_update_ref+0x512/0x570 [ 35.086256][ T1506] Code: 7b 40 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 80 15 bb ff 49 8b 37 48 c7 c7 e0 dd 94 85 44 89 f2 e8 be e1 47 ff <0f> 0b 48 8b 5c 24 10 4c 8b 7c 24 18 4c 8d 6c 24 60 e9 00 fe ff ff [ 35.091287][ T576] usb 7-1: USB disconnect, device number 2 [ 35.105996][ T1506] RSP: 0018:ffffc9000a517080 EFLAGS: 00010246 [ 35.115441][ T338] EXT4-fs (loop4): free_blocks=0 [ 35.118251][ T1506] RAX: b7093522abf6c300 RBX: ffff88810c3c9848 RCX: 0000000000080000 [ 35.131340][ T1506] RDX: ffffc90001269000 RSI: 000000000000765d RDI: 000000000000765e [ 35.139461][ T1506] RBP: ffffc9000a517170 R08: dffffc0000000000 R09: ffffed103ee24eb4 [ 35.139483][ T338] EXT4-fs (loop4): dirty_blocks=32 [ 35.147660][ T1506] R10: ffffed103ee24eb4 R11: 1ffff1103ee24eb3 R12: dffffc0000000000 [ 35.160913][ T1506] R13: ffffc9000a5170e0 R14: 0000000000000002 R15: ffff88810c3c9888 [ 35.169038][ T1506] FS: 00007f46ccff76c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 35.178034][ T338] EXT4-fs (loop4): Block reservation details [ 35.178052][ T338] EXT4-fs (loop4): i_reserved_data_blocks=32 [ 35.178923][ T287] EXT4-fs (loop4): unmounting filesystem. [ 35.184348][ T1506] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.203635][ T1506] CR2: ffffffffdfa50000 CR3: 000000011aa84000 CR4: 00000000003506a0 [ 35.212192][ T1506] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 35.215401][ T28] audit: type=1400 audit(2000000006.729:302): avc: denied { write } for pid=1512 comm="syz.5.503" name="mcfilter6" dev="proc" ino=4026532998 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 35.220455][ T1506] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 35.252079][ T1506] Call Trace: [ 35.255389][ T1506] [ 35.258497][ T1506] ? ext4_xattr_block_csum+0x500/0x500 [ 35.264127][ T1506] ? __kasan_check_write+0x14/0x20 [ 35.269332][ T1506] ? ext4_xattr_inode_iget+0x266/0x350 [ 35.275130][ T1506] ext4_xattr_set_entry+0xc6d/0x21d0 [ 35.280414][ T1506] ext4_xattr_ibody_set+0x24e/0x6c0 [ 35.285787][ T1506] ext4_expand_extra_isize_ea+0xf7b/0x1990 [ 35.291682][ T1506] __ext4_expand_extra_isize+0x2fe/0x3e0 [ 35.297406][ T1506] __ext4_mark_inode_dirty+0x3cf/0x600 [ 35.302888][ T1506] ext4_evict_inode+0xc0b/0x1460 [ 35.307826][ T1506] ? _raw_spin_unlock+0x4c/0x70 [ 35.312778][ T1506] ? __cfi_ext4_evict_inode+0x10/0x10 [ 35.318194][ T1506] ? unlock_new_inode+0x97/0xc0 [ 35.323173][ T1506] ? __cfi_ext4_evict_inode+0x10/0x10 [ 35.328569][ T1506] evict+0x493/0x890 [ 35.332491][ T1506] ? proc_nr_inodes+0x2f0/0x2f0 [ 35.337347][ T1506] ? __kasan_check_write+0x14/0x20 [ 35.342500][ T1506] iput+0x620/0x670 [ 35.346311][ T1506] ext4_process_orphan+0x2b1/0x320 [ 35.351402][ T1506] ext4_orphan_cleanup+0xb02/0x1210 [ 35.357101][ T1506] ? __cfi_ext4_orphan_cleanup+0x10/0x10 [ 35.362824][ T1506] ? ext4_register_sysfs+0x285/0x2c0 [ 35.368129][ T1506] ? errseq_check_and_advance+0x66/0x130 [ 35.373784][ T1506] ext4_fill_super+0x7439/0x7970 [ 35.378732][ T1506] ? __cfi_ext4_fill_super+0x10/0x10 [ 35.384041][ T1506] ? snprintf+0xd7/0x120 [ 35.388287][ T1506] ? set_blocksize+0x1df/0x360 [ 35.393067][ T1506] ? sb_set_blocksize+0xaa/0xf0 [ 35.398000][ T1506] get_tree_bdev+0x444/0x680 [ 35.402623][ T1506] ? __cfi_ext4_fill_super+0x10/0x10 [ 35.407915][ T1506] ext4_get_tree+0x1c/0x20 [ 35.412353][ T1506] vfs_get_tree+0x9a/0x270 [ 35.416782][ T1506] do_new_mount+0x25a/0xa20 [ 35.421538][ T1506] path_mount+0x675/0x1010 [ 35.426098][ T1506] ? user_path_at_empty+0x161/0x1c0 [ 35.431303][ T1506] __se_sys_mount+0x318/0x380 [ 35.436028][ T1506] ? do_mkdirat+0x459/0x4c0 [ 35.440680][ T1506] ? __x64_sys_mount+0xd0/0xd0 [ 35.445660][ T1506] ? do_user_addr_fault+0x9ac/0x1050 [ 35.450959][ T1506] __x64_sys_mount+0xbf/0xd0 [ 35.455613][ T1506] x64_sys_call+0x65d/0x9a0 [ 35.460117][ T1506] do_syscall_64+0x4c/0xa0 [ 35.464578][ T1506] ? clear_bhb_loop+0x30/0x80 [ 35.469256][ T1506] ? clear_bhb_loop+0x30/0x80 [ 35.473997][ T1506] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 35.479901][ T1506] RIP: 0033:0x7f46ce59076a [ 35.484381][ T1506] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 35.504111][ T1506] RSP: 002b:00007f46ccff6e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 35.512805][ T1506] RAX: ffffffffffffffda RBX: 00007f46ccff6ef0 RCX: 00007f46ce59076a [ 35.521204][ T1506] RDX: 0000200000000180 RSI: 00002000000001c0 RDI: 00007f46ccff6eb0 [ 35.529404][ T1506] RBP: 0000200000000180 R08: 00007f46ccff6ef0 R09: 0000000001a08700 [ 35.537419][ T1506] R10: 0000000001a08700 R11: 0000000000000246 R12: 00002000000001c0 [ 35.545452][ T1506] R13: 00007f46ccff6eb0 R14: 0000000000000470 R15: 0000200000000700 [ 35.553466][ T1506] [ 35.556502][ T1506] ---[ end trace 0000000000000000 ]--- [ 35.565616][ T1506] EXT4-fs (loop0): 1 orphan inode deleted [ 35.570368][ T1521] loop4: detected capacity change from 0 to 512 [ 35.587869][ T1506] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 35.599833][ T1521] FAT-fs (loop4): error, corrupted directory (invalid entries) [ 35.630294][ T1519] loop1: detected capacity change from 0 to 40427 [ 35.649601][ T1519] F2FS-fs (loop1): invalid crc value [ 35.655525][ T1529] Driver unsupported XDP return value 0 on prog (id 137) dev N/A, expect packet loss! [ 35.672486][ T1519] F2FS-fs (loop1): Found nat_bits in checkpoint [ 35.754581][ T1519] F2FS-fs (loop1): Start checkpoint disabled! [ 35.765050][ T285] EXT4-fs (loop0): unmounting filesystem. [ 35.778435][ T1519] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 35.855525][ T28] audit: type=1400 audit(2000000007.369:303): avc: denied { create } for pid=1518 comm="syz.1.506" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 35.880413][ T28] audit: type=1400 audit(2000000007.369:304): avc: denied { setattr } for pid=1518 comm="syz.1.506" name="file0" dev="loop1" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 35.891959][ T338] kworker/u4:3: attempt to access beyond end of device [ 35.891959][ T338] loop1: rw=2049, sector=40960, nr_sectors = 16 limit=40427 [ 36.016041][ T28] audit: type=1400 audit(2000000007.529:305): avc: denied { block_suspend } for pid=1578 comm="syz.5.533" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 36.065790][ T1584] netlink: 20 bytes leftover after parsing attributes in process `syz.1.526'. [ 36.125427][ T1600] loop1: detected capacity change from 0 to 256 [ 36.137982][ T1602] netlink: 4 bytes leftover after parsing attributes in process `syz.5.543'. [ 36.140360][ T1600] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0xc465a08c, utbl_chksum : 0xe619d30d) [ 36.189175][ T28] audit: type=1400 audit(2000000007.699:306): avc: denied { remove_name } for pid=1599 comm="syz.1.542" name="file1" dev="loop1" ino=1048653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 36.194100][ T1608] device erspan0 entered promiscuous mode [ 36.221180][ T28] audit: type=1400 audit(2000000007.699:307): avc: denied { unlink } for pid=1599 comm="syz.1.542" name="file1" dev="loop1" ino=1048653 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 36.241691][ T24] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 36.305481][ T1616] loop5: detected capacity change from 0 to 512 [ 36.318893][ T1616] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 36.332014][ T1616] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 36.342921][ T1616] EXT4-fs (loop5): 1 truncate cleaned up [ 36.348573][ T1616] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 36.375238][ T636] EXT4-fs (loop5): unmounting filesystem. [ 36.451552][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 36.457906][ T24] usb 7-1: config 0 has an invalid interface number: 41 but max is 0 [ 36.466300][ T24] usb 7-1: config 0 has no interface number 0 [ 36.473461][ T24] usb 7-1: config 0 interface 41 has no altsetting 0 [ 36.481764][ T24] usb 7-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 36.496961][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 36.505284][ T24] usb 7-1: Product: syz [ 36.513896][ T24] usb 7-1: Manufacturer: syz [ 36.518607][ T24] usb 7-1: SerialNumber: syz [ 36.526660][ T24] usb 7-1: config 0 descriptor?? [ 36.535044][ T24] CoreChips: probe of 7-1:0.41 failed with error -22 [ 36.651409][ T1644] loop4: detected capacity change from 0 to 256 [ 36.676412][ T1644] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x205ad3ec, utbl_chksum : 0xe619d30d) [ 36.733419][ T28] audit: type=1400 audit(2000000008.249:308): avc: denied { write } for pid=1650 comm="syz.5.563" name="binder0" dev="binder" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 36.767278][ T334] usb 7-1: USB disconnect, device number 3 [ 36.934364][ T1684] loop1: detected capacity change from 0 to 512 [ 36.942083][ T1684] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 36.964182][ T1684] EXT4-fs (loop1): 1 truncate cleaned up [ 36.964229][ T1684] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 36.973881][ T1684] EXT4-fs warning (device loop1): ext4_group_add:1743: No reserved GDT blocks, can't resize [ 37.011709][ T283] EXT4-fs (loop1): unmounting filesystem. [ 37.090264][ T1697] netlink: 16 bytes leftover after parsing attributes in process `syz.1.585'. [ 37.209055][ T1711] loop1: detected capacity change from 0 to 512 [ 37.218380][ T1711] EXT4-fs: Ignoring removed oldalloc option [ 37.221960][ T1711] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 37.235711][ T1711] EXT4-fs (loop1): 1 truncate cleaned up [ 37.235736][ T1711] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 37.259746][ T283] EXT4-fs (loop1): unmounting filesystem. [ 37.274330][ T28] audit: type=1400 audit(2000000008.789:309): avc: denied { ioctl } for pid=1713 comm="syz.1.593" path="socket:[22718]" dev="sockfs" ino=22718 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 37.309346][ T28] audit: type=1400 audit(2000000008.819:310): avc: denied { create } for pid=1717 comm="syz.6.595" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 37.313264][ T1718] tmpfs: Unknown parameter 'indo64' [ 37.334220][ T1716] loop1: detected capacity change from 0 to 2048 [ 37.395443][ T1716] FAT-fs (loop1): error, fat_get_cluster: detected the cluster chain loop (i_pos 1) [ 37.395471][ T1716] FAT-fs (loop1): Filesystem has been set read-only [ 37.486527][ T1728] loop1: detected capacity change from 0 to 1024 [ 37.507028][ T1728] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 37.521105][ T1728] EXT4-fs error (device loop1): ext4_xattr_inode_iget:404: comm syz.1.600: inode #1668180270: comm syz.1.600: iget: illegal inode # [ 37.521310][ T1728] EXT4-fs error (device loop1): ext4_xattr_inode_iget:409: comm syz.1.600: error while reading EA inode 1668180270 err=-117 [ 37.537174][ T283] EXT4-fs (loop1): unmounting filesystem. [ 37.650252][ T1741] loop1: detected capacity change from 0 to 256 [ 37.801208][ T1739] loop4: detected capacity change from 0 to 40427 [ 37.813681][ T1739] F2FS-fs (loop4): invalid crc value [ 37.860392][ T1739] F2FS-fs (loop4): Found nat_bits in checkpoint [ 37.927379][ T1739] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 37.996452][ T1772] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 38.002037][ T1772] dvmrp1: linktype set to 0 [ 38.009619][ T287] syz-executor: attempt to access beyond end of device [ 38.009619][ T287] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 38.105398][ T1778] syzkaller1: tun_chr_ioctl cmd 2147767519 [ 38.125144][ T1786] loop6: detected capacity change from 0 to 7 [ 38.133541][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 38.142731][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 38.150809][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 38.160002][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 38.167901][ T1786] loop6: unable to read partition table [ 38.173639][ T1786] loop_reread_partitions: partition scan of loop6 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 38.231701][ T1792] support for cryptoloop has been removed. Use dm-crypt instead. [ 38.241937][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 38.251104][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 38.259365][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 38.268520][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 38.276704][ T103] loop6: unable to read partition table [ 38.425837][ T1813] netlink: 4 bytes leftover after parsing attributes in process `syz.5.635'. [ 38.531754][ T1831] loop6: detected capacity change from 0 to 128 [ 38.539973][ T1831] EXT4-fs (loop6): Test dummy encryption mode enabled [ 38.548175][ T1831] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a802c018, mo2=0082] [ 38.556277][ T1831] System zones: 1-3, 19-19, 35-36 [ 38.562054][ T1831] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 38.570874][ T1831] ext4 filesystem being mounted at /67/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 38.585772][ T1831] EXT4-fs warning (device loop6): verify_group_input:169: Last group not full [ 38.598919][ T873] EXT4-fs (loop6): unmounting filesystem. [ 38.685668][ T1835] loop6: detected capacity change from 0 to 40427 [ 38.695334][ T1835] F2FS-fs (loop6): invalid crc value [ 38.702422][ T1835] F2FS-fs (loop6): Found nat_bits in checkpoint [ 38.711540][ T19] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 38.730756][ T1835] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 38.758963][ T1835] syz.6.645: attempt to access beyond end of device [ 38.758963][ T1835] loop6: rw=2049, sector=53248, nr_sectors = 136 limit=40427 [ 38.778661][ T873] syz-executor: attempt to access beyond end of device [ 38.778661][ T873] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 38.891572][ T19] usb 6-1: Using ep0 maxpacket: 16 [ 38.898210][ T19] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 38.909120][ T19] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 38.919161][ T19] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 38.932448][ T19] usb 6-1: New USB device found, idVendor=05ac, idProduct=027b, bcdDevice= 0.00 [ 38.941776][ T19] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 38.950713][ T19] usb 6-1: config 0 descriptor?? [ 39.031627][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 39.052776][ T1845] loop6: detected capacity change from 0 to 40427 [ 39.070607][ T1845] F2FS-fs (loop6): fault_injection options not supported [ 39.089619][ T1845] F2FS-fs (loop6): invalid crc value [ 39.118436][ T1845] F2FS-fs (loop6): Found nat_bits in checkpoint [ 39.122761][ T1857] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 39.130578][ T1857] syzkaller1: linktype set to 280 [ 39.157768][ T1845] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 39.219249][ T873] syz-executor: attempt to access beyond end of device [ 39.219249][ T873] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 39.238566][ T1851] loop0: detected capacity change from 0 to 40427 [ 39.248399][ T1851] F2FS-fs (loop0): heap/no_heap options were deprecated [ 39.256066][ T1851] F2FS-fs (loop0): fault_injection options not supported [ 39.263350][ T1851] F2FS-fs (loop0): fault_type options not supported [ 39.282027][ T1851] F2FS-fs (loop0): invalid crc value [ 39.291393][ T1851] F2FS-fs (loop0): Found nat_bits in checkpoint [ 39.344934][ T1851] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 39.360776][ T19] apple 0003:05AC:027B.0003: hidraw0: USB HID v0.00 Device [HID 05ac:027b] on usb-dummy_hcd.5-1/input0 [ 39.436879][ T1871] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 39.448506][ T675] Bluetooth: hci0: Frame reassembly failed (-84) [ 39.549645][ T1880] loop6: detected capacity change from 0 to 512 [ 39.565556][ T6] usb 6-1: USB disconnect, device number 2 [ 39.577113][ T1880] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 39.586183][ T1880] ext4 filesystem being mounted at /75/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.605955][ T873] EXT4-fs (loop6): unmounting filesystem. [ 39.620123][ T1885] loop6: detected capacity change from 0 to 512 [ 39.634139][ T1885] FAT-fs (loop6): error, corrupted directory (invalid entries) [ 39.641856][ T19] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 39.679028][ T1891] loop6: detected capacity change from 0 to 1024 [ 39.702628][ T1891] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 39.720955][ T873] EXT4-fs (loop6): unmounting filesystem. [ 39.831556][ T19] usb 5-1: Using ep0 maxpacket: 16 [ 39.837918][ T19] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 39.848971][ T19] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 39.858728][ T19] usb 5-1: config 0 interface 0 has no altsetting 0 [ 39.865482][ T19] usb 5-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 39.874534][ T19] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.882961][ T19] usb 5-1: config 0 descriptor?? [ 40.031542][ T286] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 40.089994][ T1868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 40.101129][ T1906] loop5: detected capacity change from 0 to 512 [ 40.106289][ T1868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.115218][ T1906] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 40.134432][ T1906] EXT4-fs (loop5): 1 truncate cleaned up [ 40.140129][ T1906] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 40.152863][ T1906] EXT4-fs error (device loop5): ext4_generic_delete_entry:2729: inode #2: block 13: comm syz.5.671: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 40.157309][ T28] kauditd_printk_skb: 23 callbacks suppressed [ 40.157327][ T28] audit: type=1400 audit(2000000011.669:334): avc: denied { remove_name } for pid=1905 comm="syz.5.671" name="file0" dev="loop5" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 40.201880][ T1906] EXT4-fs error (device loop5) in ext4_delete_entry:2800: Corrupt filesystem [ 40.201932][ T28] audit: type=1400 audit(2000000011.669:335): avc: denied { rename } for pid=1905 comm="syz.5.671" name="file0" dev="loop5" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 40.232861][ T1906] EXT4-fs warning (device loop5): ext4_rename_delete:3778: inode #2: comm syz.5.671: Deleting old file: nlink 4, error=-117 [ 40.241607][ T286] usb 7-1: Using ep0 maxpacket: 16 [ 40.254518][ T636] EXT4-fs (loop5): unmounting filesystem. [ 40.266692][ T286] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 40.280454][ T286] usb 7-1: config 0 has no interface number 0 [ 40.292567][ T286] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 40.305096][ T286] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 40.315721][ T286] usb 7-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 40.322135][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 40.324840][ T286] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 40.350206][ T19] hid (null): invalid report_count 30637329 [ 40.356902][ T286] usb 7-1: config 0 descriptor?? [ 40.361965][ T19] hid (null): unknown global tag 0xd [ 40.378108][ T19] hid (null): invalid report_count 13293 [ 40.391573][ T19] hid (null): unknown global tag 0xe [ 40.557612][ T334] usb 5-1: USB disconnect, device number 4 [ 40.563922][ T1930] Â: renamed from pim6reg1 [ 40.611904][ T1934] netlink: 71 bytes leftover after parsing attributes in process `syz.1.684'. [ 40.974207][ T286] uclogic 0003:28BD:0071.0005: failed retrieving string descriptor #100: -71 [ 40.983266][ T286] uclogic 0003:28BD:0071.0005: failed retrieving pen parameters: -71 [ 40.991347][ T286] uclogic 0003:28BD:0071.0005: pen probing failed: -71 [ 40.999184][ T286] uclogic 0003:28BD:0071.0005: failed probing parameters: -71 [ 41.006701][ T286] uclogic: probe of 0003:28BD:0071.0005 failed with error -71 [ 41.016159][ T286] usb 7-1: USB disconnect, device number 4 [ 41.022204][ T6] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 41.202557][ T6] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 41.213821][ T6] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 41.224879][ T6] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 41.235012][ T6] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 41.258747][ T6] usb 2-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 41.267867][ T6] usb 2-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 41.276086][ T6] usb 2-1: Manufacturer: syz [ 41.284044][ T6] usb 2-1: config 0 descriptor?? [ 41.371634][ T1958] loop4: detected capacity change from 0 to 131072 [ 41.378743][ T1958] F2FS-fs (loop4): Wrong CP boundary, start(512) end(1536) blocks(0) [ 41.386906][ T1958] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 41.395798][ T1958] F2FS-fs (loop4): invalid crc value [ 41.403316][ T1958] F2FS-fs (loop4): Found nat_bits in checkpoint [ 41.428407][ T1958] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 41.435646][ T1958] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e4 [ 41.511539][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 41.511551][ T1872] Bluetooth: hci0: command 0x1003 tx timeout [ 41.695235][ T6] appleir 0003:05AC:8243.0006: item fetching failed at offset 0/1 [ 41.709844][ T6] appleir 0003:05AC:8243.0006: parse failed [ 41.751600][ T6] appleir: probe of 0003:05AC:8243.0006 failed with error -22 [ 41.906085][ T334] usb 2-1: USB disconnect, device number 3 [ 41.939755][ T28] audit: type=1400 audit(2000000013.449:336): avc: denied { attach_queue } for pid=1984 comm="syz.5.704" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 41.998372][ T1994] SELinux: security_context_str_to_sid (s) failed with errno=-22 [ 42.010527][ T28] audit: type=1400 audit(2000000013.519:337): avc: denied { setopt } for pid=1995 comm="syz.5.708" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 42.282453][ T2020] device syz_tun entered promiscuous mode [ 42.288744][ T2020] device syz_tun left promiscuous mode [ 42.305322][ T2022] bridge0: port 2(bridge_slave_1) entered disabled state [ 42.312498][ T2022] bridge0: port 1(bridge_slave_0) entered disabled state [ 42.332929][ T2024] loop4: detected capacity change from 0 to 512 [ 42.368607][ T2024] EXT4-fs (loop4): too many log groups per flexible block group [ 42.382544][ T2024] EXT4-fs (loop4): failed to initialize mballoc (-12) [ 42.389471][ T2024] EXT4-fs (loop4): mount failed [ 42.913521][ T2053] loop1: detected capacity change from 0 to 40427 [ 42.928686][ T2053] F2FS-fs (loop1): invalid crc value [ 42.932645][ T2056] loop0: detected capacity change from 0 to 40427 [ 42.951533][ T2056] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 42.959459][ T2056] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 42.963086][ T2053] F2FS-fs (loop1): Found nat_bits in checkpoint [ 42.983328][ T2056] F2FS-fs (loop0): invalid crc value [ 43.001795][ T28] audit: type=1400 audit(2000000014.519:338): avc: denied { create } for pid=2072 comm="syz.4.742" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 43.037442][ T28] audit: type=1400 audit(2000000014.539:339): avc: denied { ioctl } for pid=2072 comm="syz.4.742" path="socket:[23865]" dev="sockfs" ino=23865 ioctlcmd=0x8922 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 43.037892][ T2053] F2FS-fs (loop1): Start checkpoint disabled! [ 43.077739][ T2056] F2FS-fs (loop0): Found nat_bits in checkpoint [ 43.088799][ T2078] netlink: 28 bytes leftover after parsing attributes in process `syz.4.743'. [ 43.097807][ T2078] netlink: 28 bytes leftover after parsing attributes in process `syz.4.743'. [ 43.112364][ T2053] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6 [ 43.154064][ T675] Bluetooth: hci0: Frame reassembly failed (-84) [ 43.160629][ T2056] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 43.162448][ T2081] Bluetooth: hci0: Frame reassembly failed (-84) [ 43.169916][ T2056] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 43.226573][ T675] kworker/u4:5: attempt to access beyond end of device [ 43.226573][ T675] loop1: rw=2049, sector=40960, nr_sectors = 24 limit=40427 [ 43.258352][ T2071] loop6: detected capacity change from 0 to 40427 [ 43.271184][ T2071] F2FS-fs (loop6): Invalid SB checksum offset: 0 [ 43.278137][ T2071] F2FS-fs (loop6): Can't find valid F2FS filesystem in 2th superblock [ 43.312641][ T2071] F2FS-fs (loop6): invalid crc value [ 43.352535][ T2071] F2FS-fs (loop6): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 43.408221][ T2071] F2FS-fs (loop6): Try to recover 2th superblock, ret: 0 [ 43.415622][ T2071] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 43.467528][ T2083] f2fs_ckpt-7:6: attempt to access beyond end of device [ 43.467528][ T2083] loop6: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 43.590661][ T2099] loop5: detected capacity change from 0 to 512 [ 43.684239][ T2099] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 43.699454][ T2110] support for the xor transformation has been removed. [ 43.706736][ T2099] ext4 filesystem being mounted at /151/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 43.753363][ T2112] loop1: detected capacity change from 0 to 16 [ 43.775438][ T2112] erofs: (device loop1): mounted with root inode @ nid 36. [ 43.809364][ T28] audit: type=1400 audit(2000000015.319:340): avc: denied { remount } for pid=2070 comm="syz.6.741" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 43.829830][ T2071] F2FS-fs (loop6): Start checkpoint disabled! [ 43.830866][ T636] EXT4-fs (loop5): unmounting filesystem. [ 43.842348][ T28] audit: type=1400 audit(2000000015.319:341): avc: denied { mounton } for pid=2111 comm="syz.1.755" path="/198/file0/file0" dev="loop1" ino=46 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 43.891016][ T28] audit: type=1400 audit(2000000015.319:342): avc: denied { read } for pid=2111 comm="syz.1.755" name="file0" dev="overlay" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 43.914750][ T28] audit: type=1400 audit(2000000015.319:343): avc: denied { open } for pid=2111 comm="syz.1.755" path="/198/file0/file0/file0" dev="overlay" ino=49 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 44.034305][ T2128] loop6: detected capacity change from 0 to 512 [ 44.064663][ T2128] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 44.120061][ T2128] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1097: group 0, block bitmap and bg descriptor inconsistent: 191 vs 220 free clusters [ 44.144868][ T2128] EXT4-fs (loop6): 1 truncate cleaned up [ 44.150641][ T2128] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 44.233039][ T873] EXT4-fs (loop6): unmounting filesystem. [ 44.319129][ T2093] loop0: detected capacity change from 0 to 131072 [ 44.342886][ T2093] F2FS-fs (loop0): Test dummy encryption mode enabled [ 44.363750][ T2093] F2FS-fs (loop0): invalid crc value [ 44.386893][ T2093] F2FS-fs (loop0): Found nat_bits in checkpoint [ 45.504304][ T1875] Bluetooth: hci0: command 0x1003 tx timeout [ 45.531061][ T45] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 45.761488][ C1] sched: RT throttling activated [ 45.784705][ T2093] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 45.835013][ T2152] loop5: detected capacity change from 0 to 128 [ 45.862507][ T2093] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 45.889767][ T2156] dvmrp1: tun_chr_ioctl cmd 1074025677 [ 45.897862][ T2156] dvmrp1: linktype set to 774 [ 45.999653][ T2171] loop6: detected capacity change from 0 to 2048 [ 46.065573][ T2171] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 46.112798][ T2191] netlink: 24 bytes leftover after parsing attributes in process `syz.5.785'. [ 46.126445][ T28] kauditd_printk_skb: 1 callbacks suppressed [ 46.126460][ T28] audit: type=1400 audit(2000000017.639:345): avc: denied { bind } for pid=2189 comm="syz.1.787" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 46.161569][ T873] EXT4-fs (loop6): unmounting filesystem. [ 46.273358][ T28] audit: type=1400 audit(2000000017.789:346): avc: denied { wake_alarm } for pid=2217 comm="syz.4.799" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 46.338966][ T2228] overlayfs: missing 'lowerdir' [ 46.366984][ T2231] loop4: detected capacity change from 0 to 128 [ 46.380549][ T2231] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 46.392804][ T2231] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 46.504791][ T2247] loop4: detected capacity change from 0 to 4096 [ 46.515137][ T2247] SELinux: security_context_str_to_sid (system_u) failed with errno=-22 [ 46.564126][ T2254] loop4: detected capacity change from 0 to 512 [ 46.581581][ T286] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 46.595792][ T2254] EXT4-fs (loop4): 1 orphan inode deleted [ 46.601948][ T2254] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 46.627166][ T287] EXT4-fs (loop4): unmounting filesystem. [ 46.628841][ T28] audit: type=1400 audit(2000000018.139:347): avc: denied { read write } for pid=2256 comm="syz.5.817" name="vhost-vsock" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.667274][ T28] audit: type=1400 audit(2000000018.149:348): avc: denied { open } for pid=2256 comm="syz.5.817" path="/dev/vhost-vsock" dev="devtmpfs" ino=268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.691417][ T28] audit: type=1400 audit(2000000018.149:349): avc: denied { ioctl } for pid=2256 comm="syz.5.817" path="/dev/vhost-vsock" dev="devtmpfs" ino=268 ioctlcmd=0xaf01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.721690][ T24] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 46.772734][ T286] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 46.784355][ T286] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 46.796440][ T286] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 46.811473][ T286] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 46.820764][ T286] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 46.832822][ T286] usb 1-1: config 0 descriptor?? [ 46.846013][ T28] audit: type=1400 audit(2000000018.359:350): avc: denied { remount } for pid=2269 comm="syz.5.823" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 46.907425][ T2278] netlink: 116 bytes leftover after parsing attributes in process `syz.5.827'. [ 46.931571][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 46.937773][ T24] usb 2-1: config 0 has no interfaces? [ 46.944858][ T24] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 46.954020][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 46.962060][ T24] usb 2-1: Product: syz [ 46.966241][ T24] usb 2-1: Manufacturer: syz [ 46.970852][ T24] usb 2-1: SerialNumber: syz [ 46.976107][ T24] usb 2-1: config 0 descriptor?? [ 47.031585][ T6] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 47.183502][ T1898] usb 2-1: USB disconnect, device number 4 [ 47.222668][ T6] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 47.240739][ T6] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 47.251032][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.260295][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.270373][ T6] usb 5-1: config 1 has no interface number 0 [ 47.280495][ T6] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 47.291673][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.303824][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.317016][ T6] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 47.328474][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.336129][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.352788][ T6] usb 5-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 47.361930][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.369412][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.376929][ T6] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 47.387431][ T2284] syz.5.829 (2284) used greatest stack depth: 21248 bytes left [ 47.387923][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.403128][ T6] usb 5-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 47.417107][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.424750][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.432255][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.439742][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.447528][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.456200][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.463947][ T6] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 47.473059][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.480621][ T6] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.488679][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.496113][ T6] usb 5-1: Product: syz [ 47.500259][ T6] usb 5-1: Manufacturer: syz [ 47.505206][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.512633][ T6] usb 5-1: SerialNumber: syz [ 47.517469][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.525149][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.532635][ T2264] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 47.539805][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.547740][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.555259][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.562717][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.570154][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.577620][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.585045][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.592587][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.600194][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.607670][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.615105][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.622561][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.629962][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.637421][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.644866][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.652341][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.659860][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.667350][ T286] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0 [ 47.674904][ T286] plantronics 0003:047F:FFFF.0007: No inputs registered, leaving [ 47.685143][ T286] plantronics 0003:047F:FFFF.0007: hiddev96,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 47.720212][ T286] usb 1-1: USB disconnect, device number 4 [ 47.731705][ T2304] loop1: detected capacity change from 0 to 512 [ 47.733672][ T2306] netlink: 'syz.6.840': attribute type 1 has an invalid length. [ 47.745858][ T636] ------------[ cut here ]------------ [ 47.750881][ T2264] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 47.751349][ T636] WARNING: CPU: 1 PID: 636 at fs/inode.c:335 drop_nlink+0xc5/0x110 [ 47.766584][ T636] Modules linked in: [ 47.770698][ T636] CPU: 1 PID: 636 Comm: syz-executor Tainted: G W syzkaller #0 [ 47.779851][ T636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 47.790032][ T636] RIP: 0010:drop_nlink+0xc5/0x110 [ 47.792078][ T2307] fido_id[2307]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 47.795248][ T636] Code: 1b 48 8d bb b8 04 00 00 be 08 00 00 00 e8 a3 e4 f0 ff f0 48 ff 83 b8 04 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 9b 72 ac ff <0f> 0b eb 86 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5e ff ff ff 4c [ 47.829593][ T636] RSP: 0018:ffffc9000f6a7c38 EFLAGS: 00010293 [ 47.835901][ T636] RAX: ffffffff81c3ab85 RBX: ffff888136042288 RCX: ffff88811dc93cc0 [ 47.844118][ T636] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 47.852198][ T636] RBP: ffffc9000f6a7c60 R08: 0000000000000004 R09: 0000000000000003 [ 47.860207][ T636] R10: fffff52001ed4f78 R11: 1ffff92001ed4f78 R12: dffffc0000000000 [ 47.868237][ T636] R13: 1ffff11026c0845a R14: ffff8881360422d0 R15: 0000000000000000 [ 47.876301][ T636] FS: 0000555591973500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 47.885316][ T636] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.892108][ T636] CR2: 000055dfd361c308 CR3: 000000012e7d6000 CR4: 00000000003526a0 [ 47.900273][ T636] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 47.908394][ T636] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 47.912613][ T2304] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 47.916616][ T636] Call Trace: [ 47.928623][ T636] [ 47.931582][ T636] shmem_rmdir+0x5b/0x90 [ 47.935862][ T636] vfs_rmdir+0x393/0x500 [ 47.940109][ T636] incfs_kill_sb+0x105/0x220 [ 47.944788][ T636] deactivate_locked_super+0xb5/0x120 [ 47.950173][ T636] deactivate_super+0xaf/0xe0 [ 47.954910][ T636] cleanup_mnt+0x45f/0x4e0 [ 47.959334][ T636] __cleanup_mnt+0x19/0x20 [ 47.960756][ T2264] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 47.963802][ T636] task_work_run+0x1db/0x240 [ 47.975592][ T636] ? __cfi_task_work_run+0x10/0x10 [ 47.980711][ T636] ? __x64_sys_umount+0x125/0x160 [ 47.985857][ T636] ? __cfi___x64_sys_umount+0x10/0x10 [ 47.991232][ T636] exit_to_user_mode_loop+0x9b/0xb0 [ 47.996460][ T636] exit_to_user_mode_prepare+0x5a/0xa0 [ 48.001951][ T636] syscall_exit_to_user_mode+0x1a/0x30 [ 48.007427][ T636] do_syscall_64+0x58/0xa0 [ 48.011867][ T636] ? clear_bhb_loop+0x30/0x80 [ 48.016543][ T636] ? clear_bhb_loop+0x30/0x80 [ 48.021225][ T636] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 48.027145][ T636] RIP: 0033:0x7fcc64d902f7 [ 48.031570][ T636] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 48.051229][ T636] RSP: 002b:00007fffaaf9d2d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 48.059690][ T636] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fcc64d902f7 [ 48.067716][ T636] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffaaf9d390 [ 48.075735][ T636] RBP: 00007fffaaf9d390 R08: 0000000000000000 R09: 0000000000000000 [ 48.083759][ T636] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffaaf9e420 [ 48.091764][ T636] R13: 00007fcc64e11d7d R14: 000000000000ba54 R15: 00007fffaaf9e460 [ 48.099730][ T636] [ 48.102761][ T636] ---[ end trace 0000000000000000 ]--- [ 48.108326][ T636] ================================================================== [ 48.109998][ T283] EXT4-fs (loop1): unmounting filesystem. [ 48.116390][ T636] BUG: KASAN: null-ptr-deref in ihold+0x20/0x60 [ 48.116414][ T636] Write of size 4 at addr 0000000000000170 by task syz-executor/636 [ 48.116429][ T636] [ 48.116434][ T636] CPU: 0 PID: 636 Comm: syz-executor Tainted: G W syzkaller #0 [ 48.116451][ T636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 48.116459][ T636] Call Trace: [ 48.116465][ T636] [ 48.116471][ T636] __dump_stack+0x21/0x24 [ 48.116491][ T636] dump_stack_lvl+0xee/0x150 [ 48.116507][ T636] ? __cfi_dump_stack_lvl+0x8/0x8 [ 48.116524][ T636] ? ihold+0x20/0x60 [ 48.116539][ T636] ? ihold+0x20/0x60 [ 48.185531][ T636] print_report+0x3d/0x60 [ 48.189862][ T636] kasan_report+0x122/0x150 [ 48.194349][ T636] ? ihold+0x20/0x60 [ 48.198226][ T636] kasan_check_range+0x280/0x290 [ 48.203497][ T636] __kasan_check_write+0x14/0x20 [ 48.208416][ T636] ihold+0x20/0x60 [ 48.212119][ T636] vfs_rmdir+0x25f/0x500 [ 48.216349][ T636] incfs_kill_sb+0x105/0x220 [ 48.220945][ T636] deactivate_locked_super+0xb5/0x120 [ 48.226297][ T636] deactivate_super+0xaf/0xe0 [ 48.230957][ T636] cleanup_mnt+0x45f/0x4e0 [ 48.235350][ T636] __cleanup_mnt+0x19/0x20 [ 48.239743][ T636] task_work_run+0x1db/0x240 [ 48.244313][ T636] ? __cfi_task_work_run+0x10/0x10 [ 48.249450][ T636] ? __x64_sys_umount+0x125/0x160 [ 48.254477][ T636] ? __cfi___x64_sys_umount+0x10/0x10 [ 48.259847][ T636] exit_to_user_mode_loop+0x9b/0xb0 [ 48.265033][ T636] exit_to_user_mode_prepare+0x5a/0xa0 [ 48.270489][ T636] syscall_exit_to_user_mode+0x1a/0x30 [ 48.275962][ T636] do_syscall_64+0x58/0xa0 [ 48.280359][ T636] ? clear_bhb_loop+0x30/0x80 [ 48.285018][ T636] ? clear_bhb_loop+0x30/0x80 [ 48.289766][ T636] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 48.295649][ T636] RIP: 0033:0x7fcc64d902f7 [ 48.300047][ T636] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 48.319677][ T636] RSP: 002b:00007fffaaf9d2d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 48.328072][ T636] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fcc64d902f7 [ 48.336199][ T636] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffaaf9d390 [ 48.344156][ T636] RBP: 00007fffaaf9d390 R08: 0000000000000000 R09: 0000000000000000 [ 48.352112][ T636] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffaaf9e420 [ 48.360062][ T636] R13: 00007fcc64e11d7d R14: 000000000000ba54 R15: 00007fffaaf9e460 [ 48.368016][ T636] [ 48.371011][ T636] ================================================================== [ 48.379273][ T636] Disabling lock debugging due to kernel taint [ 48.386599][ T636] BUG: kernel NULL pointer dereference, address: 0000000000000170 [ 48.394415][ T636] #PF: supervisor write access in kernel mode [ 48.400473][ T636] #PF: error_code(0x0002) - not-present page [ 48.406446][ T636] PGD 10cd58067 P4D 10cd58067 PUD 0 [ 48.411726][ T636] Oops: 0002 [#1] PREEMPT SMP KASAN [ 48.416905][ T636] CPU: 1 PID: 636 Comm: syz-executor Tainted: G B W syzkaller #0 [ 48.425823][ T636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 48.435856][ T636] RIP: 0010:ihold+0x26/0x60 [ 48.440355][ T636] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 01 6a ac ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 e0 db f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 f1 [ 48.459940][ T636] RSP: 0018:ffffc9000f6a7c78 EFLAGS: 00010246 [ 48.465996][ T636] RAX: ffff88811dc93c00 RBX: 0000000000000000 RCX: ffff88811dc93cc0 [ 48.473972][ T636] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 48.481943][ T636] RBP: ffffc9000f6a7c88 R08: dffffc0000000000 R09: fffffbfff0f2d8fd [ 48.489987][ T636] R10: fffffbfff0f2d8fd R11: 1ffffffff0f2d8fc R12: ffff888136042294 [ 48.497947][ T636] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 48.506001][ T636] FS: 0000555591973500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 48.514928][ T636] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.521510][ T636] CR2: 0000000000000170 CR3: 000000012e7d6000 CR4: 00000000003526a0 [ 48.529469][ T636] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.537514][ T636] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.545488][ T636] Call Trace: [ 48.548849][ T636] [ 48.551765][ T636] vfs_rmdir+0x25f/0x500 [ 48.556001][ T636] incfs_kill_sb+0x105/0x220 [ 48.560575][ T636] deactivate_locked_super+0xb5/0x120 [ 48.565932][ T636] deactivate_super+0xaf/0xe0 [ 48.570686][ T636] cleanup_mnt+0x45f/0x4e0 [ 48.575092][ T636] __cleanup_mnt+0x19/0x20 [ 48.579669][ T636] task_work_run+0x1db/0x240 [ 48.584246][ T636] ? __cfi_task_work_run+0x10/0x10 [ 48.589443][ T636] ? __x64_sys_umount+0x125/0x160 [ 48.594709][ T636] ? __cfi___x64_sys_umount+0x10/0x10 [ 48.600067][ T636] exit_to_user_mode_loop+0x9b/0xb0 [ 48.605246][ T636] exit_to_user_mode_prepare+0x5a/0xa0 [ 48.610688][ T636] syscall_exit_to_user_mode+0x1a/0x30 [ 48.616137][ T636] do_syscall_64+0x58/0xa0 [ 48.620538][ T636] ? clear_bhb_loop+0x30/0x80 [ 48.625196][ T636] ? clear_bhb_loop+0x30/0x80 [ 48.629856][ T636] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 48.635739][ T636] RIP: 0033:0x7fcc64d902f7 [ 48.640140][ T636] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 48.659820][ T636] RSP: 002b:00007fffaaf9d2d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 48.668355][ T636] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fcc64d902f7 [ 48.676329][ T636] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffaaf9d390 [ 48.684306][ T636] RBP: 00007fffaaf9d390 R08: 0000000000000000 R09: 0000000000000000 [ 48.692413][ T636] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffaaf9e420 [ 48.700471][ T636] R13: 00007fcc64e11d7d R14: 000000000000ba54 R15: 00007fffaaf9e460 [ 48.708434][ T636] [ 48.711443][ T636] Modules linked in: [ 48.715346][ T636] CR2: 0000000000000170 [ 48.719490][ T636] ---[ end trace 0000000000000000 ]--- [ 48.725011][ T636] RIP: 0010:ihold+0x26/0x60 [ 48.729513][ T636] Code: 33 36 7c df 55 48 89 e5 41 56 53 48 89 fb e8 01 6a ac ff 48 8d bb 70 01 00 00 be 04 00 00 00 e8 e0 db f0 ff 41 be 01 00 00 00 44 0f c1 b3 70 01 00 00 41 ff c6 bf 02 00 00 00 44 89 f6 e8 f1 [ 48.749214][ T636] RSP: 0018:ffffc9000f6a7c78 EFLAGS: 00010246 [ 48.755277][ T636] RAX: ffff88811dc93c00 RBX: 0000000000000000 RCX: ffff88811dc93cc0 [ 48.763229][ T636] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 48.771181][ T636] RBP: ffffc9000f6a7c88 R08: dffffc0000000000 R09: fffffbfff0f2d8fd [ 48.779136][ T636] R10: fffffbfff0f2d8fd R11: 1ffffffff0f2d8fc R12: ffff888136042294 [ 48.787276][ T636] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 48.795245][ T636] FS: 0000555591973500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 48.804261][ T636] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.810833][ T636] CR2: 0000000000000170 CR3: 000000012e7d6000 CR4: 00000000003526a0 [ 48.818876][ T636] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.826837][ T636] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.834809][ T636] Kernel panic - not syncing: Fatal exception [ 48.841211][ T636] Kernel Offset: disabled [ 48.845528][ T636] Rebooting in 86400 seconds..