last executing test programs: 14m20.01200065s ago: executing program 0 (id=2835): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) recvmmsg(r0, &(0x7f00000053c0)=[{{0x0, 0x0, 0x0}, 0x170}], 0x1, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), r1) recvmmsg$unix(r2, &(0x7f00000049c0)=[{{&(0x7f0000000580), 0x6e, &(0x7f0000003280)=[{&(0x7f0000000600)=""/14, 0xe}, {&(0x7f0000000640)=""/8, 0x8}, {&(0x7f0000000680)=""/217, 0xd9}, {&(0x7f0000000780)=""/128, 0x80}, {&(0x7f0000000800)=""/245, 0xf5}, {&(0x7f0000000900)=""/86, 0x56}, {&(0x7f0000002280)=""/4096, 0x1000}], 0x7}}, {{0x0, 0x0, &(0x7f0000004800)=[{&(0x7f0000003300)=""/175, 0xaf}, {&(0x7f00000033c0)=""/115, 0x73}, {&(0x7f0000003440)=""/192, 0xc0}, {&(0x7f0000003500)=""/4096, 0x1000}, {&(0x7f0000004500)=""/231, 0xe7}, {&(0x7f0000004600)}, {&(0x7f0000004640)=""/208, 0xd0}, {&(0x7f0000004740)=""/130, 0x82}], 0x8, &(0x7f0000004880)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x108}}], 0x2, 0x12060, &(0x7f0000004a40)={0x0, 0x3938700}) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000540)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB='\t\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="04002abd7000fedbdf2504000000080019000a01010105001200ec00000006001a004e21000006001c0004000000"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x40008) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001140)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000006000000040000000000000500000000010000000000000e0100000000000000000000000000000900000000002e2e2e61"], &(0x7f0000000140)=""/4096, 0x46, 0x1000, 0x1}, 0x28) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r6 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffbffff, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x8001}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0xb}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40005}, 0x8010) 14m19.160170474s ago: executing program 0 (id=2841): getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 14m18.538325283s ago: executing program 0 (id=2845): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000002c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000340)=[@iv={0x0, 0x117, 0x2, 0x0, "7c66b74a866184c3f2174e22d76c97f77645bc6980ed35b0359123e7299a67ddf6d5f40f24a995bc211879c47836d55e1a9035dcac01c353041ae4dce16a9f650fc3057b3727d706"}, @assoc={0x0, 0x117, 0x4, 0x1}], 0x1, 0x4a1ab295fe1da1cb}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)=""/97, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0xfffffffffffffefd}, 0x0) 14m17.922425501s ago: executing program 0 (id=2848): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000000140)='^', 0x1, 0x0, 0x0, 0x0) recvfrom$inet(r1, 0x0, 0x0, 0x40000022, 0x0, 0x0) listen(r1, 0xda90) accept4$inet(r1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4048004) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r2, 0x0, 0x0) 14m16.229065954s ago: executing program 0 (id=2853): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {0x1, 0xb}, {0xf, 0xfff2}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x2}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40008e4}, 0x4004890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='>', 0x1}], 0x1}, 0x8000) 14m14.870271421s ago: executing program 0 (id=2861): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48000, &(0x7f000005ffe4)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) recvmmsg(r0, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x10c4}], 0x1}}], 0x4000210, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'veth0_to_bond\x00', &(0x7f0000000540)=@ethtool_gstrings={0x1b, 0x9}}) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f00000000c0)=0xfe, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 13m59.576402921s ago: executing program 32 (id=2861): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48000, &(0x7f000005ffe4)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) recvmmsg(r0, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x10c4}], 0x1}}], 0x4000210, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'veth0_to_bond\x00', &(0x7f0000000540)=@ethtool_gstrings={0x1b, 0x9}}) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f00000000c0)=0xfe, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 47.848996978s ago: executing program 4 (id=8138): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[], 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(0x0, 0x1ff) mkdir(0x0, 0x1ff) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='rd_pages=8', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000c00)='1', 0x1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 47.100074882s ago: executing program 4 (id=8143): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x18, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000d1000c0000000000010000b7080000000000007b8af8ff00000000b70800000b0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000001100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0x7, 0x0, &(0x7f00000000c0)="9dbaac999f6983", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 46.826801205s ago: executing program 4 (id=8146): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.swap.events\x00', 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x2400c050) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x20, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000ea8f00000000000005000000181100", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b703000011282dd98500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x67a021c03d2005e9, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r4, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0x600, 0x1}}, 0x20) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(0xffffffffffffffff, 0x0, 0x800c) sendmsg$kcm(0xffffffffffffffff, 0x0, 0xd890) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x2, 0x4) bind$inet(r5, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000001c0)={'lo\x00', @local}) sendmsg$nl_xfrm(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000400)=@getspdinfo={0x14, 0x25, 0x1, 0x70bd2a, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r7, 0x1, 0xf, 0x0, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x5e21, @local}, 0x10) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) writev(r8, &(0x7f0000000000)=[{&(0x7f0000000b00)="13000000080203", 0x7}], 0x1) connect$inet(r7, &(0x7f0000000080)={0x2, 0x4e24, @empty}, 0x10) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r9, &(0x7f0000003580)={0x2, 0x0, @dev}, 0x10) setsockopt$sock_int(r9, 0x1, 0x20, 0x0, 0x0) write$cgroup_devices(r2, &(0x7f0000000140)=ANY=[], 0xa) 46.517085962s ago: executing program 4 (id=8150): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0x20044e, &(0x7f0000000340)={[{@minixdf}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1ff}}, {@stripe}, {@noblock_validity}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x8}}]}, 0x3, 0x451, &(0x7f0000000f80)="$eJzs3M2PU1UbAPDn3k6HlxdwRsQPPtRRNE78mGEAlYULNZq4wMREF7qczAwEKYxhxkQIUTAGV8aYuDcu/Rdc6cYYVyZudW9IiGEDuKq57b1MW9rCdFqq098vuXDOvedyztNzT3vuPS0BjKyp7I8kYntE/B4RE/Vsc4Gp+l/Xr55fuHH1/EIS1erbfyW1cteunl8oihbnbcsz02lE+lkSe9vUu3L23Mn5SmXpTJ6fXT31wezK2XPPnTg1f3zp+NLpg0eOHD409+ILB5/vS5xZm67t+Xh53+433vvqzaNfNMXfEkefTHU7+GS12ufqhmtHQzoZG2JDWJdSRGTdVa6N/4koxVrnTcTrnw61ccBAVavV6rbOhy9UgU0siea8IQ+jovigz+5/i611EvDy4KYfQ3fllfoNUBb39XyrHxmLNC9Tbrm/7aepiHj3wt/fZFsM5jkEAECTH7L5z7Pt5n9pPNBQ7p58bWgyIu6NiJ0RcV9E7IqI+yNqZR+MiIfWWX/rIsmt85/0ck+B3aFs/vdSvrbVPP8rZn8xWcpzO2rxl5NjJypLB/LXZDrKW7L8XJc6fnztty87HWuc/2VbVn8xF8zbcXlsS/M5i/Or8xuJudGVixF7xtrFn9xcCUgiYndE7OmxjhNPf7ev07Hbx99FH9aZqt9GPFXv/wvREn8h6b4+Ofu/qCwdmC2uilv98uultzrVv6H4+yDr//+3vf5vxj+ZNK7Xrqy/jkt/fN7xnqbX6388eaeWHs/3fTS/unpmLmI8OVpvdOP+g2vnFvmifBb/9P72439nrL0SeyMiu4gfjohHIuLRvO2PRcTjEbG/S/w/v/rE+73HP1hZ/Ivr6v+1xHi07mmfKJ386fumSidvif9G9/4/XEtN53vu5P3vTtrV29UMAAAA/z1pRGyPJJ25mU7TmZn69+V3RaSV5ZXVZ44tf3h6sf4bgckop8WTromG56Fz+W19PX8xIupfLSiOH8qfG39d2lrLzywsVxaHHTyMuG0dxn/mz9KwWwcMnN9rwegy/mF0Gf8wuox/GF1txv/WYbQDuPvaff5/MoR2AHdfy/i37AcjxP0/jK6O438z/88/QI3PfxhJK1vj9j+S75oo/qUeT9+0iSj/K5qx8UQ1adu5kQ67YRKDTAz3fQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBf/gkAAP//qmHgTw==") mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000400)={[{@dyn}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000580)=""/174, 0xff56) 46.060926301s ago: executing program 4 (id=8153): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$inet(0x2, 0x1, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = accept(r3, &(0x7f00000006c0)=@nfc_llcp, &(0x7f0000000740)=0x80) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r6, {0x2, 0x4e24, @rand_addr=0x64010100}, 0x4, 0x0, 0x1, 0x2}}, 0x2e) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x4, 0x3, 0x2, 0x0, {0xa, 0x4e21, 0x9, @rand_addr=' \x01\x00', 0x6}}}, 0x3a) 45.330514644s ago: executing program 4 (id=8158): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x18, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000d1000c0000000000010000b7080000000000007b8af8ff00000000b70800000b0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000001100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0x7, 0x0, &(0x7f00000000c0)="9dbaac999f6983", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 44.65291926s ago: executing program 33 (id=8158): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x18, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000d1000c0000000000010000b7080000000000007b8af8ff00000000b70800000b0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000001100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0x7, 0x0, &(0x7f00000000c0)="9dbaac999f6983", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 10.604792378s ago: executing program 5 (id=8282): r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc, 0x2}, 0x10) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 9.347723706s ago: executing program 5 (id=8288): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e1d, 0x9, @local, 0x2}, 0x1c) syz_emit_ethernet(0x7e, &(0x7f00000001c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @empty, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, '\x00', 0x48, 0x11, 0xe562b48021685062, @local, @mcast2, {[], {0x4e1d, 0x4e20, 0x48, 0x0, @wg=@cookie={0x3, 0x0, "dc521c259b538a2bf2a113dc2eeec0a072edf20b6d59027f", "d646c098cfc27eb8549d66e7b219c2c3b85e4508546e551af9e59631718ba089"}}}}}}}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) sendto(r3, &(0x7f0000000180)='%', 0x300000, 0x840, 0x0, 0x60) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) 8.445571448s ago: executing program 1 (id=8296): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) setns(0xc9, 0x0) r3 = gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r1, 0xa23, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0x8}, @void}}, [@NL80211_ATTR_PID={0x8, 0x52, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008880}, 0x20000084) 8.433620196s ago: executing program 7 (id=8160): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getrusage(0xffffffffffffffff, &(0x7f0000000380)) r3 = socket(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x4004000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newtfilter={0xfffffffffffffee7, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xf}, {0xd}}}, 0x24}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40810, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x6f4c}, @IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x141}]}, 0x38}, 0x1, 0x0, 0x0, 0x24040051}, 0x4000000) 7.334665772s ago: executing program 1 (id=8298): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5f1000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x0, 0x2) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) fcntl$getown(r0, 0x9) sendmsg$NFULNL_MSG_CONFIG(r0, 0x0, 0x4) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) mlock2(&(0x7f00003f3000/0x3000)=nil, 0x3000, 0x0) ioctl$INCFS_IOC_FILL_BLOCKS(r1, 0x80106720, &(0x7f0000000b80)={0x0, &(0x7f0000000a40)}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r3, &(0x7f0000000180)='10', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r4, &(0x7f0000000280)='0', 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x15, 0x8, 0x8, 0x0, 0x0, 0xffffffffffffffff, 0x3}, 0x50) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0x81}}, './file0\x00'}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@ipv4={""/10, ""/2, @private}, @in6=@remote}}, {{@in=@remote}, 0x0, @in6=@mcast2}}, &(0x7f00000002c0)=0xe4) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x129c81, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0xa, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000001000000c6"], &(0x7f00000000c0)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) 6.925025318s ago: executing program 7 (id=8300): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket$kcm(0xa, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) sendmsg$kcm(r1, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x20000001) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) recvmsg$kcm(r1, &(0x7f0000005140)={0x0, 0x0, &(0x7f0000005000)=[{&(0x7f0000000840)=""/196, 0xc4}], 0x1}, 0x10000) 6.681661425s ago: executing program 6 (id=8302): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x1d0, &(0x7f0000000b80)={@broadcast, @empty, @val={@void, {0x8100, 0x0, 0x1, 0x1}}, {@ipv6={0x86dd, @gre_packet={0x2, 0x6, "e6c7cd", 0x196, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @multicast2}, @dev={0xfe, 0x80, '\x00', 0x12}, {[@routing={0x0, 0xc, 0x2, 0x6, 0x0, [@local, @remote, @empty, @mcast1, @mcast2, @rand_addr=' \x01\x00']}], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x23, 0x2, [0x400, 0x7], "b29c099ae3fbb5b1fb8362e8c41736b3d0124473c903f673fa5fd643c5736c7b9a8bc6"}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [0x2, 0x4], "0b396df700530820bcc8277fc5a2e13a1fbd31693f3fb55b7414a4fe39f14b7c187241ecaa6e8d3f4484f05ce226973a47964e4757fb08aebc65b52439645b42d215c372bc18611e069bdf387e68c36dd057d0287cc08c7eb6f70b978d2e4e908a7b77"}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [0x8, 0x1], "c88ca27c32fde32373fb05d715aa37bd999071d70aa6864e0375079c0e2273f97c3664b1a41d32ec21350dfeda95fcdf1432eb7da6d1cfc0d6e220664a9e9f7cf5945ca666bb89b96e0c"}, {0x8, 0x88be, 0x2, {{0x5, 0x1, 0x7, 0x2, 0x0, 0x1, 0x0, 0xf}, 0x1, {0x4}}}, {0x8, 0x22eb, 0x1, {{0x7, 0x2, 0x9, 0x3, 0x1, 0x1, 0x5, 0x3}, 0x2, {0x80000000, 0x6, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1}}}, {0x8, 0x6558, 0x2, "6df1e0151cbb8f2b8664f43a4f6d"}}}}}}}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d00000000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000007608000000c0000018000000000000000000000000000000950000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41100, 0xc}, 0x94) 6.309300884s ago: executing program 3 (id=8303): syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd/3\x00') r1 = socket(0x1d, 0x2, 0x6) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 6.181511732s ago: executing program 6 (id=8304): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_TABLE(r0, 0x0, 0xcf, &(0x7f0000000040)=0xfc, 0x4) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, 0x0, 0x0) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @address_request}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, &(0x7f0000000180)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c5805000000451697efe42811ee1df0fa9264f7d866b19705487b00", 0xb2, 0xfffffff7, 0x4, 0xe}, 0x3c) 6.055508437s ago: executing program 2 (id=8305): socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x29, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$igmp6(0xa, 0x3, 0x2) r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x200000, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa0100ff}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x36}}, {0x2, 0x4e24, @rand_addr=0x64010100}, 0x1d7, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x8, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 5.99887602s ago: executing program 3 (id=8306): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4000003, &(0x7f0000000080), 0x106, 0x2}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000300)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x4e23, 0x4, @mcast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000480)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xffff, 0x647, @empty, 0xa098}, {0xa, 0x4ea5, 0x9, @dev={0xfe, 0x80, '\x00', 0x3f}, 0xc}, r2, 0x8001}}, 0x48) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 5.878281688s ago: executing program 7 (id=8307): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x1c}, 0x60) sendto(r1, &(0x7f00000005c0)="a1bfc48b", 0x4, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 5.800115244s ago: executing program 6 (id=8308): r0 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x5b5f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_SENDMSG_ZC={0x30, 0x0, 0x20, 0xffffffffffffffff, 0x0, &(0x7f0000000d40)={0x0, 0x0, &(0x7f00000009c0)=[{0x0}, {&(0x7f0000000480)}, {0x0}], 0x3, &(0x7f0000000a40)=ANY=[], 0x2b8}, 0x2, 0x48000, 0x1, {0x2}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 5.660156993s ago: executing program 3 (id=8309): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000020000000a0000000000000a07000000080000000000000b0400000009000000010000130c0000000740"], 0x0, 0x4a, 0x0, 0x1, 0x7fe, 0x10000}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x19, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000050000008500000006"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff70, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'macvlan0\x00', @random="bdbd67c12945"}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001000000000000dfff000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e65766530000000000000000000140001006c6f0000000000000000000000000000080002"], 0xb4}}, 0x0) 5.604719602s ago: executing program 2 (id=8310): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) setns(0xc9, 0x0) gettid() sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, 0x0, 0x20000084) 5.496804284s ago: executing program 7 (id=8311): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x48, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x48}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902"], 0x0) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000050) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x1c, 0x8, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x8, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x0, 0x1}]}, &(0x7f0000000240)='GPL\x00'}, 0x90) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) close(0x4) 5.489352s ago: executing program 6 (id=8312): sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000006180)={0x0, 0x0, &(0x7f0000006140)={&(0x7f0000000000)=ANY=[@ANYBLOB='L\x00\x00', @ANYRES16], 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x20004014) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x275a, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a0b1600000000000000000200000a3800048018000180080001006f7366000c00028008000140000000041c000180090001006d617371000000000c00028008000240000000170900010073797a30000000000900020073797a320000000014000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x850}, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) setsockopt$SO_BINDTODEVICE_wg(r4, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) sendto$inet(r4, &(0x7f0000000040)="e5", 0xffffffe4, 0x0, 0x0, 0x0) 5.317859504s ago: executing program 3 (id=8313): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_mount_image$f2fs(&(0x7f0000000100), &(0x7f00000000c0)='./file0\x00', 0x410, &(0x7f0000000400)=ANY=[@ANYBLOB="6163746976655f6c6f67733d342c66617374626f6f742c746573745f64756d6d795f656e6372797074696f6e2c6673796e635f6d6f64653d7374726963742c00200da779e57c52e33a83fdbd563a5b7c6b958cb6e49387a5ba5a89b0887c0292eb888cc8efa81040100d83ba748033542625bc334eaf793332891541000f3c63c0a5f0af254a5bd1f4b81d0c5188ddcadf07eff7b49004e0b243a8a4d93632fbe9ab868d88310829d8e04a3c0572143a3d3d1472cc5da6f72bb097f5f7b95a09e442c0a1463aaa90db7dcbc542dc5bced278eda11583f810469b706968e793db3230", @ANYRES16, @ANYRES32=0x0], 0x1, 0x105d6, &(0x7f0000010640)="$eJzs3E1rY1UYB/AnU+fVcRxkXnTlBREaMKFpO0VBpOoMOmCH4svClaZJGjKT5JYmfXHWuho/gltBxJ2fwY1fY3AhiAvB3YiSe29lqrNwOmlT298Pbv/nnpz75JxLNie3JIBj62Ly+2+luBBnI2IqIs5HZO1ScWQW83g+Il6MiBMPHaWi/++OUxFxLiIujIrnNUvFSwt/3H/w9Qs3X7/37f1y7edvvprcqoFJezkiemt5e6uXZ9rO83bRX9/sZNmb3ywyf6F3pzhP89xqrWQVtuo74+pZzrXz8enaxmCUq916Y5TtzmrWv9bP33Cw2d6pk11wu76enTdbK1l2BmmW7bv5vLaLvDsY5nWaRb3PsvIxHO5k3t/abuXrWbuTZaM/LPrzummztT3KzSKLt4tG2m1m81jZ820+9N7r9De2k83W+qCT9pNr1dqr1dpCpbaeNlvD1nyl3msuzCfT7e5oWGXYqvcW22na7raqjbRXTqbbjUalVkumr7dWOvV+UqtV56ozlWvlovVK8s6tj5JuM5ke5Vud/saw0x0kq+l6kl9RTmarc6+Vk5dqyQdLy8ny+zduLC1/+Mn1j2+9uXTz7WLQv6aVTM/OzM5WajOV2Vr5cK7/VFF/jOufin1Yf+nJLue48wECeGz2/8Ak2P8/zv4/2fN9PuyOyP7/13vHe/17ZvvGE/EBAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4tn46+f27WeNifv500f9M0fVcRFyNiCsRcTki/nyEqTi1q+aliCgV7UeNP/mPOfxQiqzC6JrTxXEuIhaL48Gz+30XAAAA4Oj67sfPv4iYGjWzP29MekIcpOJLmzPjqpd95fPUuKpdyoptj6na5Z2SY3ElIk5e/GVM1a5GxInzn46p2n8ytSvOPBSlPE4c5GwAAICDsXsnMLbdGwAAAIfOl5OeAJORPa8t/he/eBZ8Oo/igeDZXWcAAADA/1Bp0hMAAAAA9l22//f7fwAAAHC05b//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwF/s3E+uEjEcB/Af4Aj4JxLDn6uwMi5ZcAiP4NID6G3ccQYTwjlw5xEMGDqVAOLmTXlM3vt8kplOJ/Bth4RFWygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAt/axWi++br9+a5uz2zZR5GgAAAOCabbVapItRXX+d77/Nt95HxCwiphExiYhrY/devDxJ7MQ4nWvXXl9d9OFHREo4vKefj1cR8TEfv9/d/nMAAACAp2qzni8jeofLdPpwvOIZyJM2g1J5acrnRam0cQr7Uiht8jeyiGlEVKNfhdJmEdF98ynX/vv9GxZq7qSRXAxOik5ddAs2BgAAtMT5SKDY6A0AAIDW+XzvDnAfab02/xY/rwX36yIvCA7PagAAAEB7Xf7b/qjzuP0AAAAA7iCN///Z/y/PCjx8/7+w/x8AAAC0SL3/HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALe0rVaLzXq+bJqz2zdT5mkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4w/68o0AIhEEY7F3fdxq8/7GkQVNTkyoQPv7GYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDe/+8v/ialxJpl7bSw9jyRrp8bWqbF3bhz9YXz9GgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgYn/uTiAEgiAM9p3/OS3mH5Y0aAwiVMHCxwzzsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX/S7X/5PTI0zydxpY+l4JFm7amxdNfYeNI4ejLd/AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFztwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7MCBAAAAAACQ/2sjVFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWEHDgQAAAAAgPxfG6GqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoKO3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdife9uEgTCOw6+dRInbZIT0Fh8z0FAhGIEPCcmSZ2AAFqKhorVYBFYAAQctnSl4nub/0+mKOwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgPZ2e3viIiOzzkXnkw9Xf4XLwFfm6aQbf18w2x339c8vJdjdK+Rvj/yIiisha+A0AQPvK+6ZYLKt5J203bS9tP205ravZKx8NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwZucOWqJ4wwCAv7s6699/p44qRNChLrmpWQZeOgjeg6BuoptIa4XuQcWLnyDqtNe+Qt7qK/QFgg4leOjgoaBLEMXuzuq7pKIEM4P7+8Ez8+jCzPvuwrDPPO8sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAuBzvhUjcvhRBGB4/ylo/ftheP279/+Wm0G1/vv7sSH7N1iCSE8GSlXruV4VyKbn1z6+lCvV5bk/RDMpR+7EUZj6SwSXyVKOVzcQIA4EJJ0mh9u/yS7M63/leaDeH3m976/3qUh1Pq//3mSBKaI2P7zZGxXxsfGvG54vp/IrMZFsbQSS9UG6svquubWzdXVheWa8u1Z1NTk9N3pm/fuztZbd8rqbpjAgAAwL+ppBHX/+XZv/v//0d5OL3+H+vGw7nHj+JzDfR3/X+io6Zf3iMBAADob5ev/vh+3OrLUqUSNhYajbWJzvbw78nONoehnttQGnH9PzCb96gAAACALBzslHr6/0tRHs7Y/x9/u70XH3MghDCc9v/HF5/Xl7KbTqFl8Thx3nMEAAAgX8NpxP3/pL3+v3y45KEcQrhxrZOnPwN4pvr/8+sHPQ+tx+v/p7KbYiGVZzrvR3s/E8LgTN4jAgAA4CL7L41Wsb+X7M6v/Xw1V7H+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4w44dozQQRGEA3uxmtRIDVmrlBUQvELEQxMZDiILgCUQQDyC2lt7B0jukVrCxsEzhDeTN7qikCVjsKvk+mLxHGDIvkyb/AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNd0/7uv4mXU9GX73vPH1UnUl5ka3u/XN2NFP+hy6H9nr+8BAAAAWBBVzvdFUbzVj4dRy3HK/3XeE5n/YaXpc56fzf25Pt29buT8f328dfl10Kg5Jz707PzidKezb/j3rc7dMUw3n569VOkHKY9u1qZ1us/B7WRysJTa5S6mBQB+YzvXtsn/h6Lu9jkYAAtj2K7iR/6vxv3OBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCFzwAAAP//9JxdmQ==") 5.202325816s ago: executing program 2 (id=8314): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x202000, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=@newtfilter={0x488, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r6, {0xffff, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x458, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_POLICE={0x444, 0xa, 0x0, 0x1, [@TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x1, 0x40, 0xdc2, 0x1000, {0x7, 0x2, 0xe, 0x6, 0x6, 0x1}, {0x0, 0x1, 0x94, 0x9, 0x401}, 0x9, 0x1, 0x6}}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x6, 0x5, 0x5, 0x0, 0x1, 0x7, 0x4, 0x4, 0x7, 0x3e97, 0x5, 0x18, 0xd, 0xfff, 0x0, 0x5, 0x8, 0x6, 0x0, 0xfce, 0x9, 0x8, 0x5, 0xfff, 0x6, 0xf, 0x6, 0x0, 0x8, 0x5edaf873, 0x1, 0xffff, 0xf1, 0x7, 0x7fffffff, 0x7ff, 0x8, 0x5, 0x4, 0x963e, 0x3, 0x56, 0xfff, 0x875, 0x29c, 0x1000, 0x400, 0x2, 0x1, 0x9, 0x9, 0xfffffffe, 0x7, 0x400, 0xffffff81, 0x0, 0x9, 0x2000, 0x1e2, 0x5, 0xfffffff8, 0x4, 0x0, 0x0, 0x2, 0x7f, 0x0, 0x621, 0x0, 0xff, 0x1ff, 0x3, 0x0, 0x2, 0x9, 0x8, 0x5, 0x3568, 0x4, 0x10001, 0x4, 0x6, 0x5, 0x7fff, 0x4, 0x5, 0x877, 0x6, 0x7, 0x5, 0x7, 0x1, 0x1ff, 0x200, 0x0, 0x9, 0x8, 0x0, 0x7b, 0x3ff, 0x4e, 0xf, 0x3, 0x400, 0x101, 0xfffffff4, 0x1, 0x3, 0x2332, 0x732d4911, 0x9, 0x7, 0xa48, 0x6, 0x7fff, 0x8, 0x6, 0x8, 0xfffffffd, 0x18b, 0x9, 0x7fffffff, 0x5, 0x51e, 0xfffffff8, 0x5, 0x1, 0x7fffffff, 0x6, 0x5, 0x0, 0x0, 0x7ff, 0xa, 0x80000001, 0xde, 0x7a, 0x5, 0x3, 0x1, 0x2, 0x7, 0x6, 0x2792, 0x7, 0x1, 0x8, 0x5, 0x5, 0xa, 0x5, 0x7, 0x400, 0x7, 0x3, 0x2, 0x5, 0x2, 0x252, 0x1, 0x4, 0x40000, 0x3, 0x6, 0x101, 0x1, 0x10, 0x3, 0x4, 0xc, 0xfffff801, 0x8, 0x0, 0x1, 0x6, 0x80000000, 0x1c, 0xd810, 0x1, 0x8001, 0x80, 0x5, 0x1, 0xfffffff8, 0x800, 0x4, 0x9, 0x9, 0x90000000, 0x5, 0x8, 0x6, 0x3ff, 0x53b2, 0x0, 0x9, 0x7, 0x7f, 0x6, 0x1, 0x4, 0xc7, 0x5, 0x6, 0x5, 0x5, 0x7fff, 0x12bc, 0x3, 0xffffffff, 0x1, 0xd, 0xa64, 0x5, 0xfffffff9, 0x2, 0x8, 0x8, 0x200, 0x8, 0xe512, 0xb5, 0x3, 0x0, 0x9f, 0x0, 0x7f, 0x6, 0x1, 0x3b1c, 0xc7, 0x2, 0xfffffffc, 0xa0, 0x100, 0x2, 0x6, 0x101, 0x3ff, 0x2, 0x8, 0x70, 0xd5, 0xffffffff, 0xf, 0xc, 0x1, 0x401, 0xffffffff, 0x1, 0x19d, 0x10001, 0x8fde, 0x8, 0x9]}]}]}}]}, 0x488}, 0x1, 0x0, 0x0, 0x884}, 0x40) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, r6, 0x17}, 0x80, &(0x7f0000003500)=[{&(0x7f00000001c0)="27030200dc0f14000e00", 0xa}, {0x0}], 0x2}, 0x8000) 3.88479061s ago: executing program 5 (id=8315): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet(0xa, 0x801, 0x84) connect$inet(r3, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) 3.865443898s ago: executing program 1 (id=8316): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000100)="0000000000000000000051229dc9", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_open_dev$tty1(0xc, 0x4, 0x1) landlock_restrict_self(r0, 0x2) getresuid(&(0x7f0000002900), &(0x7f0000002940), &(0x7f0000002980)) r2 = syz_open_dev$video(&(0x7f0000000000), 0x8, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f00000000c0)={0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f911, 0x9c, '\x00', @p_u8=&(0x7f0000000100)=0x6}}) 3.38985012s ago: executing program 2 (id=8317): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x1e, 0x4, 0x0) r2 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc, 0x2}, 0x10) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) close_range(r0, 0xffffffffffffffff, 0x0) 3.388445814s ago: executing program 1 (id=8318): syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd/3\x00') r1 = socket(0x1d, 0x2, 0x6) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 3.103948496s ago: executing program 6 (id=8319): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket$kcm(0xa, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$kcm(r1, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x20000001) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r2}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) recvmsg$kcm(r1, &(0x7f0000005140)={0x0, 0x0, &(0x7f0000005000)=[{&(0x7f0000000840)=""/196, 0xc4}], 0x1}, 0x10000) 3.057698608s ago: executing program 2 (id=8320): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a0b1600000000000000000200000a3800048018000180080001006f7366000c00028008000140000000041c000180090001006d617371000000000c00028008000240000000170900010073797a30000000000900020073797a320000000014000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x850}, 0x0) 3.047674985s ago: executing program 1 (id=8321): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4000003, &(0x7f0000000080), 0x106, 0x2}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000300)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x4e23, 0x4, @mcast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000480), 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 2.857649106s ago: executing program 5 (id=8322): r0 = eventfd2(0x0, 0x80801) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) splice(r1, 0x0, r0, 0x0, 0x1, 0x8) 2.728039481s ago: executing program 2 (id=8323): syz_mount_image$f2fs(&(0x7f0000000100), &(0x7f0000000040)='./file0\x00', 0x8, &(0x7f00000059c0)=ANY=[@ANYBLOB="6e6f646973636172642c6e6f636865636b706f696e745f6d657267652c616c6c6f635f6d6f64653d64656661756c742c6163746976655f6c6f67733d362c666c7573685f6d657267652c6661756c745f696e6a656374696f6e3d30303030303030303030303030303030303235362c646973636172642c6e6f61636c2c6673796e635f6d6f64653d706f7369782c616c6c6f635f6d6f64653d64656661756c742c6e6f657874656e745f63616368652c6163746976655f6c6f67733d322c6661756c745f747970653d30303030303030303030303031363737373231342c0002d1c71f8348abae1fff96ec907a723dca530cf5ae5a70e4108d30dd0a1b6e467d05c6c0237e3772dfb37da0e9705c62c7f6dc21ef782f52303a65f3196af86a3d58c8bfb0ef60c974b0e0b44af5ce33f407facb3838bd4bf9b7a99d612518ac3ddddf95b10ead9f78580da79051b5011a94bc44336ebf9378b479860af435366b6d4cdb9c5ffd949b52f82ac9c92de853"], 0x5, 0x5505, &(0x7f0000000340)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYoIAfSQhqgBnJLCRFEeBwCEYdIHttK9H2SMxnL/HiD4DAz0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF26r9aL26vf121zdvt28owGAAAAuGRbrRf1P7PU/9rc/97c+tn0i4goI+LS3H0Un84yR01O9fL8zenz1asa7iLqhMN7TJrrS0T8aa7HH11/CgAAAPBxbZareZqtpz+zoQuiT2nRpvz2N1NeERHV7CFTWnnI+5UprP5+j+N/prR6AWuaKSwtuY1zpb1J/XM/rtpNT5oiNeXFlx2LzDZ2AACgR6Ozpt9ZCAAAAH36N3QBDKOI563M41bgJDXN9t7nsx4AAADwDhVDFwAAAAB0rp7/93T+3975fwAAADCMdP4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXdpW68VmuZq3zdnt28kzGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHhif95RIATCIAz2ru9M5v6HlQZNTU2qQPj4G4MBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3v/vL/4mpcSaZe20sPY8ka6fG1qmxd24c/WF8/RoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIv9eUmBEAiCKJgz/nfS9z+sJOgZRIiAhkcVtWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4It+98v/ialxJpk7bSwdjyRrV42tq8beg8bRg/H2bwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIud+3mNo4oDAP5mZmdrq+IaZQ8RUfCgF7vd1tbexIMSPPgnCCHd1titP9ocbCliLt4k515EjyKCEm/9H3JOIJd4y2EPETwrMzuTnfwA118zm+TzgTfvu8Mw7/tmIeQ77yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACURm9P4iQ7dMZxXJzb3Hu4lPVbh/rM47Xt+axlcVRn0ifDi9UPUbe5RAAAADg7krK+DyHspOsLWR938vo/La/Jav5vnx7HZT1/uO4v+7L2z9ovP+8+vz9QZzxOdtOby8PBpaOptP6/Wc62Z/7yilb+5PN3L0n+hcTvrT43SvPnGX29sfFOOw/P1ZEtAPBPXCz7Iih/H8r6fpOJAXBmtCqFd1n/J51mcwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACow2g1PFnGUQhhvjWJM1t7D5eO6x+vbc+X7dqjR2vhy8k9s1ukIYSby8PBpVpnM9vu3X9we3E4HNytP3gphNDU6G8V07/9wRQXh9DI8xH8R0FcfNmzks/JCBr8oQQAwKmUFi2r63fS9YXsXDQXwh/fHaz/X63EYcr6f/fDa5vVsar1f7+2Gc6+3sqdT3v37j94ffnO4q3BrcHHb1zuv9m/cv3q1eu9/F1JzxsTAAAA/p120ar1fzx3dP3/QiUOU9b/n33T/6I6VqL+P9Zk0a/pTAAAAM62Z1/+/bfomPNRux0+X1xZudsfH/c/Xx4fG0j1bztXtGr9n8w1nRUAAABQh9FqdGD9/0YlDlOu/z/1/Qs/Vu+ZhBDOF+v/F5c+Gd6obzozrY4/J256jgAAADTrfNGq6/9pvv8/3t/yEIcQXntlHBf/BnCq+j9596sfqmNV9/9fqW+KMynujp9H3ndDaHWbzggAAIDT7ImiZcX+r+n6wkc/XXi/bf8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN3+DAAA//962D6S") mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x117) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x8041, 0x104) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./bus\x00', 0x20020, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, 0x0, 0x40090) 2.561302136s ago: executing program 1 (id=8324): r0 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) statx(0xffffffffffffffff, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000540)='./file0\x00', 0x175a978679bbbe1d, 0x80a0a1240160183d) r3 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x4) renameat(r2, &(0x7f0000000080)='./file0\x00', r3, &(0x7f0000000180)='./file1\x00') mkdir(&(0x7f0000000240)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x42, 0x0) pwrite64(r4, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) lseek(r4, 0x5, 0x4) 1.952093029s ago: executing program 5 (id=8325): socket$tipc(0x1e, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x8000000003c) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='naa.6', 0x5) 1.144045587s ago: executing program 6 (id=8326): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000020000000a0000000000000a07000000080000000000000b0400000009000000010000130c0000000740"], 0x0, 0x4a, 0x0, 0x1, 0x7fe, 0x10000}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x19, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="18010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000050000008500000006"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff70, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'macvlan0\x00', @random="bdbd67c12945"}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x3, 0x0, &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001000000000000dfff000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e65766530000000000000000000140001006c6f0000000000000000000000000000080002"], 0xb4}}, 0x0) 1.069645075s ago: executing program 3 (id=8327): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="fc000000", @ANYBLOB="010000000000", @ANYRES32, @ANYBLOB="e0005a80dc0000801400030020380000080003000600000003000800040002004a0002"], 0xfc}, 0x1, 0x0, 0x0, 0x4008821}, 0x8840) r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f00000000c0)=@usbdevfs_connect) 955.883224ms ago: executing program 5 (id=8328): socket$nl_generic(0x10, 0x3, 0x10) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448c9, 0x0) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0x0, 0x2}, 0x1) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000000000011800018014000240ff01000000000000000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4841) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x4000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c00000000050000040800044000000001080005400000000408000a40000000020900010073797a300000000008000340000000100900020073797a3200000000140000001100010000000000000000000200000a"], 0x74}, 0x1, 0x0, 0x0, 0x8000}, 0x20000854) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='d\x00'], 0x64}}, 0x4800) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0xffffffff}, 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket(0x10, 0x803, 0x0) r7 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x58, 0x10, 0x401, 0x0, 0x100, {0x0, 0x0, 0x0, r8, 0x100, 0x306c}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x28, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}, @IFLA_IPTUN_ENCAP_LIMIT={0x5, 0x6, 0x1}]}}}]}, 0x58}}, 0xeb64d656001f6f32) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x40000) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, 0x0, 0x0) 0s ago: executing program 3 (id=8329): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) rmdir(&(0x7f0000000340)='./config/usb_gadget/g1/functions/phonet.usb0\x00') kernel console output (not intermixed with test programs): er parsing attributes in process `syz.1.6882'. [ 1362.883154][T27175] Quota error (device loop3): do_check_range: Getting dqdh_next_free 256 out of range 0-7 [ 1362.947254][T27175] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 1362.971735][T27175] EXT4-fs error (device loop3): ext4_acquire_dquot:7041: comm syz.3.6884: Failed to acquire dquot type 1 [ 1363.047679][T27175] loop3: lost filesystem error report for type 5 error -117 [ 1363.051543][ C0] EXT4-fs (loop3): error count since last fsck: 1 [ 1363.065400][ C0] EXT4-fs (loop3): initial error at time 1786567523: ext4_acquire_dquot:7041 [ 1363.074281][ C0] EXT4-fs (loop3): last error at time 1786567523: ext4_acquire_dquot:7041 [ 1363.165111][T27175] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #16: comm syz.3.6884: corrupted inode contents [ 1363.202721][T27175] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1363.211145][T27175] EXT4-fs error (device loop3): ext4_dirty_inode:6639: inode #16: comm syz.3.6884: mark_inode_dirty error [ 1363.267378][T27175] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1363.268194][T27175] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #16: comm syz.3.6884: corrupted inode contents [ 1363.335296][T27175] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1363.337562][T27175] EXT4-fs error (device loop3): __ext4_ext_dirty:207: inode #16: comm syz.3.6884: mark_inode_dirty error [ 1363.388873][T27175] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1363.390335][T27175] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #16: comm syz.3.6884: corrupted inode contents [ 1363.414455][T27190] loop5: detected capacity change from 0 to 128 [ 1363.459390][T27175] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1363.460928][T27175] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 1363.521424][T27175] loop3: lost filesystem error report for type 5 error -117 [ 1363.524238][T27175] EXT4-fs error (device loop3): ext4_do_update_inode:5742: inode #16: comm syz.3.6884: corrupted inode contents [ 1363.627697][T27175] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1363.635469][T27175] EXT4-fs error (device loop3): ext4_truncate:4691: inode #16: comm syz.3.6884: mark_inode_dirty error [ 1363.730763][T27175] loop3: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 1363.731295][T27175] EXT4-fs error (device loop3) in ext4_process_orphan:345: Corrupt filesystem [ 1363.823649][T27175] loop3: lost filesystem error report for type 5 error -117 [ 1363.828127][T27175] EXT4-fs (loop3): 1 truncate cleaned up [ 1363.883345][T27175] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1363.966008][T27175] ext4 filesystem being mounted at /419/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1364.245479][T19256] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1364.517879][T27217] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6900'. [ 1364.570064][T27219] syzkaller1: entered promiscuous mode [ 1364.585489][T27219] syzkaller1: entered allmulticast mode [ 1365.080117][T27237] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6889'. [ 1365.299818][T27242] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6905'. [ 1365.596162][T27253] netlink: 32 bytes leftover after parsing attributes in process `syz.5.6909'. [ 1365.875033][T27264] loop5: detected capacity change from 0 to 128 [ 1365.926690][T27264] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1365.957774][T27264] ext4 filesystem being mounted at /542/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1366.018438][T27260] 9p: Bad value for 'wfdno' [ 1367.166741][T17660] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1367.496350][T27294] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6921'. [ 1367.780908][T27230] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1369.363922][ T5718] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 1369.493838][T27329] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6932'. [ 1370.139973][ T5718] usb 4-1: Using ep0 maxpacket: 32 [ 1370.173348][ T5718] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1371.248044][ T5718] usb 4-1: config index 0 descriptor too short (expected 156, got 27) [ 1371.286534][ T5718] usb 4-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1371.330581][ T5718] usb 4-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1371.384429][ T5718] usb 4-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1371.438879][ T5718] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1371.471325][ T5718] usb 4-1: string descriptor 0 read error: -71 [ 1371.490887][ T5718] usb 4-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1371.554447][ T5718] usb 4-1: config 0 descriptor?? [ 1371.589991][ T5718] usb 4-1: can't set config #0, error -71 [ 1371.621252][ T5718] usb 4-1: USB disconnect, device number 53 [ 1372.534904][T27382] sg_write: data in/out 441308/186 bytes for SCSI command 0x0-- guessing data in; [ 1372.534904][T27382] program syz.5.6947 not setting count and/or reply_len properly [ 1373.398523][T27387] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6949'. [ 1373.475262][T27387] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6949'. [ 1373.920472][T27385] loop5: detected capacity change from 0 to 1024 [ 1374.123266][T27385] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1374.609800][T27363] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1374.878400][T27416] sg_write: data in/out 441308/186 bytes for SCSI command 0x0-- guessing data in; [ 1374.878400][T27416] program syz.1.6960 not setting count and/or reply_len properly [ 1374.896855][T27398] loop6: detected capacity change from 0 to 131072 [ 1374.922952][T27398] F2FS-fs (loop6): invalid crc value [ 1375.054183][T27398] F2FS-fs (loop6): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 1375.069839][T27398] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e4 [ 1375.147065][T17660] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1376.244577][T27441] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6966'. [ 1376.802315][T27456] program syz.2.6970 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1377.770414][T27476] loop5: detected capacity change from 0 to 4096 [ 1377.808232][T27476] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1378.778037][T27489] loop1: detected capacity change from 0 to 128 [ 1378.841298][T17660] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1378.867235][T27489] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1378.904237][T27489] ext4 filesystem being mounted at /485/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1379.213024][T27502] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6987'. [ 1379.737480][T18746] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1380.069550][T27504] loop6: detected capacity change from 0 to 2048 [ 1380.598519][T27512] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6989'. [ 1381.004803][ T4975] Alternate GPT is invalid, using primary GPT. [ 1381.025489][ T4975] loop6: p2 p3 p7 [ 1381.053501][T27514] loop5: detected capacity change from 0 to 8192 [ 1381.128345][ T30] audit: type=1800 audit(1786567541.854:614): pid=27514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.6985" name="file2" dev="loop5" ino=1048743 res=0 errno=0 [ 1381.492586][T17673] udevd[17673]: inotify_add_watch(7, /dev/loop6p3, 10) failed: No such file or directory [ 1381.514624][T16140] udevd[16140]: inotify_add_watch(7, /dev/loop6p7, 10) failed: No such file or directory [ 1381.528037][T16157] udevd[16157]: inotify_add_watch(7, /dev/loop6p2, 10) failed: No such file or directory [ 1381.603485][T27536] loop6: detected capacity change from 0 to 1024 [ 1381.651086][T27536] EXT4-fs: Ignoring removed bh option [ 1381.677476][T27538] program syz.4.6998 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1381.747716][T27536] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1383.549674][T25460] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1383.656368][T27568] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7006'. [ 1384.065175][T27584] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7013'. [ 1384.348093][T27593] program syz.1.7015 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1384.376208][T27597] 9pnet_virtio: no channels available for device [ 1384.376208][T27597] [ 1384.866329][T27601] syzkaller0: entered promiscuous mode [ 1384.891968][T27601] syzkaller0: entered allmulticast mode [ 1384.906744][T27619] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7028'. [ 1385.094576][T27629] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7031'. [ 1385.888518][T27635] loop5: detected capacity change from 0 to 8192 [ 1386.008917][ T30] audit: type=1800 audit(1786567546.754:615): pid=27635 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.7033" name="file2" dev="loop5" ino=1048744 res=0 errno=0 [ 1387.898850][T27623] IPVS: Unknown mcast interface: macsec0 [ 1388.783755][T27680] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7051'. [ 1388.998010][ T5608] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1389.013746][ T5608] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1389.037497][ T5608] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1389.047163][ T5608] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1389.062867][ T5608] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1389.669210][T27117] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1389.729951][T27700] loop2: detected capacity change from 0 to 8192 [ 1389.747423][T27650] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1389.791737][ T30] audit: type=1800 audit(1786567550.534:616): pid=27700 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.7058" name="file2" dev="loop2" ino=1048745 res=0 errno=0 [ 1390.110038][T27713] program syz.6.7064 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1390.189555][T27117] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.367686][T20233] Bluetooth: hci6: command tx timeout [ 1391.596770][T27730] netlink: 16 bytes leftover after parsing attributes in process `syz.6.7068'. [ 1391.920085][T27117] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1392.058539][T27745] syzkaller0: entered promiscuous mode [ 1392.082185][T27745] syzkaller0: entered allmulticast mode [ 1392.173093][T27751] program syz.2.7074 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1392.443535][T27117] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1392.475219][T27749] syzkaller0: entered promiscuous mode [ 1392.480859][T27749] syzkaller0: entered allmulticast mode [ 1392.535432][T27755] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 1392.779102][T27773] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7079'. [ 1392.817215][T27773] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7079'. [ 1393.037138][T27781] sg_write: data in/out 422876/114 bytes for SCSI command 0x0-- guessing data in; [ 1393.037138][T27781] program syz.6.7081 not setting count and/or reply_len properly [ 1393.349115][T27117] bridge_slave_1: left allmulticast mode [ 1393.364499][T27117] bridge_slave_1: left promiscuous mode [ 1393.381172][ T30] audit: type=1800 audit(1786567554.124:617): pid=27795 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.7087" name="nexus" dev="configfs" ino=81246 res=0 errno=0 [ 1393.382802][T27117] bridge0: port 2(bridge_slave_1) entered disabled state [ 1393.418820][T27117] bridge_slave_0: left allmulticast mode [ 1393.425360][T27117] bridge_slave_0: left promiscuous mode [ 1393.434279][T27117] bridge0: port 1(bridge_slave_0) entered disabled state [ 1393.454143][T20233] Bluetooth: hci6: command tx timeout [ 1393.475459][T27798] program syz.2.7088 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1394.733913][T27117] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1394.745410][T27117] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1394.758588][T27117] bond0 (unregistering): Released all slaves [ 1394.777650][T27117] bond1 (unregistering): (slave veth3): Releasing active interface [ 1394.787859][T27117] bond1 (unregistering): (slave veth5): Releasing active interface [ 1394.797490][T27117] bond1 (unregistering): Released all slaves [ 1394.864725][T27789] syzkaller0: entered promiscuous mode [ 1394.870213][T27789] syzkaller0: entered allmulticast mode [ 1395.338032][T27767] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1395.531910][T20233] Bluetooth: hci6: command tx timeout [ 1397.604186][T20233] Bluetooth: hci6: command tx timeout [ 1398.799675][T27834] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7097'. [ 1398.828690][T27831] syzkaller0: entered promiscuous mode [ 1398.843146][T27831] syzkaller0: entered allmulticast mode [ 1399.649716][T27117] hsr_slave_0: left promiscuous mode [ 1399.656795][T27117] hsr_slave_1: left promiscuous mode [ 1399.692220][T27117] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1399.709262][T27117] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1399.718443][T27117] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1399.730205][T27117] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1399.787156][T27117] veth1_vlan: left promiscuous mode [ 1399.801633][T27117] veth0_vlan: left promiscuous mode [ 1400.292736][T27117] team0 (unregistering): Port device team_slave_1 removed [ 1400.310931][T27117] team0 (unregistering): Port device team_slave_0 removed [ 1400.531337][T27683] bridge0: port 1(bridge_slave_0) entered blocking state [ 1400.563092][T27683] bridge0: port 1(bridge_slave_0) entered disabled state [ 1400.588567][T27683] bridge_slave_0: entered allmulticast mode [ 1400.597735][T27683] bridge_slave_0: entered promiscuous mode [ 1400.623148][T27683] bridge0: port 2(bridge_slave_1) entered blocking state [ 1400.630527][T27683] bridge0: port 2(bridge_slave_1) entered disabled state [ 1400.637900][T27683] bridge_slave_1: entered allmulticast mode [ 1400.645505][T27683] bridge_slave_1: entered promiscuous mode [ 1400.719922][T27683] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1400.752776][T27683] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1400.762842][T27908] syzkaller0: entered promiscuous mode [ 1400.768844][T27908] syzkaller0: entered allmulticast mode [ 1400.856300][T27683] team0: Port device team_slave_0 added [ 1400.864395][T27683] team0: Port device team_slave_1 added [ 1400.899068][T27683] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1400.906106][T27683] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1400.932812][T27683] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1400.945546][T27683] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1400.961977][T27683] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1400.996332][T27683] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1401.112580][T27910] syzkaller0: entered promiscuous mode [ 1401.118303][T27910] syzkaller0: entered allmulticast mode [ 1401.148730][T27858] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1401.157612][T27683] hsr_slave_0: entered promiscuous mode [ 1401.158762][T27683] hsr_slave_1: entered promiscuous mode [ 1401.190958][T27683] debugfs: 'hsr0' already exists in 'hsr' [ 1401.215647][T27683] Cannot create hsr debugfs directory [ 1401.459437][T27916] sg_write: data in/out 439260/178 bytes for SCSI command 0x0-- guessing data in; [ 1401.459437][T27916] program syz.1.7114 not setting count and/or reply_len properly [ 1402.257377][T27947] loop1: detected capacity change from 0 to 4096 [ 1402.307873][T27947] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1403.262887][T18746] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1403.604594][T27962] program syz.1.7126 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1405.510083][T27922] syzkaller0: entered promiscuous mode [ 1405.516184][T27922] syzkaller0: entered allmulticast mode [ 1406.181443][T27992] loop1: detected capacity change from 0 to 4096 [ 1406.264177][T27992] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1407.276696][T18746] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1407.499820][ T5270] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1407.532804][T28013] program syz.5.7138 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1407.600679][T28012] loop1: detected capacity change from 0 to 4096 [ 1407.686462][T28012] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1408.528485][T28023] syzkaller0: entered promiscuous mode [ 1408.542715][T28023] syzkaller0: entered allmulticast mode [ 1408.661194][T18746] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1408.713544][T27982] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1410.409565][T28069] loop3: detected capacity change from 0 to 1024 [ 1410.477811][T28069] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1410.570306][T28076] program syz.5.7151 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1410.582360][T19256] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1412.204362][T28052] syzkaller0: entered promiscuous mode [ 1412.209901][T28052] syzkaller0: entered allmulticast mode [ 1412.520878][T28094] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7156'. [ 1412.978363][T27683] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1413.043321][T27683] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1413.062734][T27683] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1413.114162][T27683] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1413.138939][T27683] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1413.188917][T27683] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1413.209009][T27683] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1413.231426][T27683] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1413.251746][T28126] loop1: detected capacity change from 0 to 128 [ 1413.306083][T28126] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1413.342378][T28126] ext4 filesystem being mounted at /524/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1414.323937][T28148] program syz.2.7171 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1414.353716][T28150] syzkaller0: entered promiscuous mode [ 1414.368430][T28150] syzkaller0: entered allmulticast mode [ 1414.373548][T18746] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1414.418947][T28150] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 1415.261062][T28183] syzkaller0: entered promiscuous mode [ 1415.266988][T28183] syzkaller0: entered allmulticast mode [ 1415.918145][T28112] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1418.307345][T28255] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7191'. [ 1418.949968][T27683] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1419.128636][T27683] 8021q: adding VLAN 0 to HW filter on device team0 [ 1419.178371][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 1419.185560][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1419.291218][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 1419.298415][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1420.637935][T28280] loop6: detected capacity change from 0 to 1024 [ 1420.657732][T28280] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1421.057319][T28327] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7206'. [ 1421.109459][T28300] syzkaller0: entered promiscuous mode [ 1421.123953][T28300] syzkaller0: entered allmulticast mode [ 1421.193607][T25460] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1422.328253][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1422.335057][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1424.347802][T28402] syzkaller0: entered promiscuous mode [ 1424.363249][T28402] syzkaller0: entered allmulticast mode [ 1424.728149][T27683] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1425.130475][T28427] syzkaller0: entered promiscuous mode [ 1425.136223][T28427] syzkaller0: entered allmulticast mode [ 1427.740230][T28417] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1427.939939][T28458] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7228'. [ 1428.080940][T27683] veth0_vlan: entered promiscuous mode [ 1428.140725][T28464] syzkaller0: entered promiscuous mode [ 1428.160375][T28464] syzkaller0: entered allmulticast mode [ 1428.204686][T27683] veth1_vlan: entered promiscuous mode [ 1428.769431][T27683] veth0_macvtap: entered promiscuous mode [ 1428.829514][T27683] veth1_macvtap: entered promiscuous mode [ 1428.904388][T27683] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1428.984683][T27683] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1429.072465][ T3271] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1429.082283][T28477] loop1: detected capacity change from 0 to 1024 [ 1429.128718][ T3271] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1429.172623][T28477] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1429.362095][T13634] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1429.372804][T13634] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1429.496763][T18746] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1429.713630][T28513] program syz.1.7245 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1429.874128][T28517] syzkaller0: entered promiscuous mode [ 1429.889553][T28517] syzkaller0: entered allmulticast mode [ 1430.055281][T28526] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7252'. [ 1430.108404][T28525] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7252'. [ 1430.173330][T28525] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1430.444445][T28540] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7258'. [ 1430.632422][T28547] netlink: 'syz.6.7261': attribute type 3 has an invalid length. [ 1430.657923][T28547] netlink: 3 bytes leftover after parsing attributes in process `syz.6.7261'. [ 1431.250218][T28564] syzkaller0: entered promiscuous mode [ 1431.256664][T28564] syzkaller0: entered allmulticast mode [ 1431.427236][T28566] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7267'. [ 1431.464666][T28566] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7267'. [ 1431.479600][T28566] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1431.675060][T28573] syzkaller0: entered promiscuous mode [ 1431.682108][T28573] syzkaller0: entered allmulticast mode [ 1431.925359][T28489] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1432.039416][T13634] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1432.082579][T13634] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1432.254170][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1432.261338][T28583] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7274'. [ 1432.284960][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1432.518509][T28591] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7278'. [ 1432.586358][T28583] bridge0: entered allmulticast mode [ 1432.937393][T28600] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7050'. [ 1434.649893][ T5608] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1434.672588][ T5608] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1434.875836][ T5608] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1434.907013][ T5608] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1434.930693][ T5608] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1436.194839][T28642] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7291'. [ 1436.488467][T28651] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7293'. [ 1436.736647][T28654] 9p: Bad value for 'wfdno' [ 1437.043121][T20233] Bluetooth: hci0: command tx timeout [ 1438.362868][ T3271] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1438.656685][ T3271] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1438.870827][ T3271] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1439.073349][ T3271] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1439.121851][T20233] Bluetooth: hci0: command tx timeout [ 1439.656411][T28713] syzkaller0: entered promiscuous mode [ 1439.666499][T28713] syzkaller0: entered allmulticast mode [ 1439.848277][ T3271] bridge_slave_1: left allmulticast mode [ 1439.886265][ T3271] bridge_slave_1: left promiscuous mode [ 1439.895872][ T3271] bridge0: port 2(bridge_slave_1) entered disabled state [ 1439.908720][ T3271] bridge_slave_0: left allmulticast mode [ 1439.921745][ T3271] bridge_slave_0: left promiscuous mode [ 1439.928815][ T3271] bridge0: port 1(bridge_slave_0) entered disabled state [ 1440.096108][T28718] loop6: detected capacity change from 0 to 1024 [ 1440.113430][T28718] EXT4-fs: Ignoring removed bh option [ 1440.152330][T28718] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1440.430155][T28724] 9p: Bad value for 'wfdno' [ 1440.599075][ T3271] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1440.612951][ T3271] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1440.626883][ T3271] bond0 (unregistering): Released all slaves [ 1440.648762][ T3271] bond2 (unregistering): Released all slaves [ 1440.691860][T28730] hub 8-0:1.0: USB hub found [ 1440.706569][T28730] hub 8-0:1.0: 1 port detected [ 1440.784568][T28675] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1441.003405][T28624] bridge0: port 1(bridge_slave_0) entered blocking state [ 1441.010778][T28624] bridge0: port 1(bridge_slave_0) entered disabled state [ 1441.018131][T28624] bridge_slave_0: entered allmulticast mode [ 1441.045197][T28624] bridge_slave_0: entered promiscuous mode [ 1441.060260][T25460] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1441.070368][ T3271] tipc: Left network mode [ 1441.072587][T28624] bridge0: port 2(bridge_slave_1) entered blocking state [ 1441.149187][T28624] bridge0: port 2(bridge_slave_1) entered disabled state [ 1441.187246][T28624] bridge_slave_1: entered allmulticast mode [ 1441.201761][T20233] Bluetooth: hci0: command tx timeout [ 1441.245328][T28624] bridge_slave_1: entered promiscuous mode [ 1441.945885][T28624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1442.203250][T28624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1442.601000][T28624] team0: Port device team_slave_0 added [ 1442.638278][T28624] team0: Port device team_slave_1 added [ 1442.879747][T28624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1442.951031][T28624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1443.087262][T28624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1443.199384][T28624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1443.237164][T28624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1443.293890][T20233] Bluetooth: hci0: command tx timeout [ 1443.323239][T28624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1443.401263][ T3271] hsr_slave_0: left promiscuous mode [ 1443.446309][ T3271] hsr_slave_1: left promiscuous mode [ 1443.469408][ T3271] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1443.497477][ T3271] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1443.640503][ T3271] veth1_vlan: left promiscuous mode [ 1443.654956][ T3271] veth0_vlan: left promiscuous mode [ 1444.315914][T28741] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1444.619479][ T30] audit: type=1800 audit(1786567605.364:618): pid=28802 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.7324" name="nexus" dev="configfs" ino=85005 res=0 errno=0 [ 1444.946685][ T3271] team0 (unregistering): Port device team_slave_1 removed [ 1444.997334][ T3271] team0 (unregistering): Port device team_slave_0 removed [ 1445.368994][T28773] syzkaller0: entered promiscuous mode [ 1445.384419][T28773] syzkaller0: entered allmulticast mode [ 1445.415796][ T5270] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1446.290391][T28624] hsr_slave_0: entered promiscuous mode [ 1446.334572][T28624] hsr_slave_1: entered promiscuous mode [ 1446.377039][T28624] debugfs: 'hsr0' already exists in 'hsr' [ 1446.397786][T28624] Cannot create hsr debugfs directory [ 1446.787473][T28839] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7336'. [ 1446.909221][T28836] syzkaller0: entered promiscuous mode [ 1446.923464][T28836] syzkaller0: entered allmulticast mode [ 1447.228298][T28846] hub 8-0:1.0: USB hub found [ 1447.281316][T28846] hub 8-0:1.0: 1 port detected [ 1447.682539][T28852] syzkaller0: entered promiscuous mode [ 1447.710143][T28852] syzkaller0: entered allmulticast mode [ 1448.373165][T28854] tipc: Enabling of bearer rejected, failed to enable media [ 1448.394473][T28859] syzkaller0: entered promiscuous mode [ 1448.439382][T28859] syzkaller0: entered allmulticast mode [ 1448.478971][T28860] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 1449.778864][ T5270] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1450.727162][T28903] syzkaller0: entered promiscuous mode [ 1450.758270][T28903] syzkaller0: entered allmulticast mode [ 1451.276074][T28911] syzkaller0: entered promiscuous mode [ 1451.294391][T28911] syzkaller0: entered allmulticast mode [ 1455.121706][T16233] Bluetooth: hci2: command 0x0406 tx timeout [ 1458.176256][T28941] tipc: Enabling of bearer rejected, failed to enable media [ 1459.140846][T28624] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1459.376297][T28624] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1459.385111][T28624] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1459.571652][T28624] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1459.590351][T28624] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1461.071872][T28624] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1461.118216][T28624] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1461.188391][T28624] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1461.664259][T29041] syzkaller0: entered promiscuous mode [ 1461.694637][T29041] syzkaller0: entered allmulticast mode [ 1461.942502][T29051] syzkaller0: entered promiscuous mode [ 1461.970152][T29051] syzkaller0: entered allmulticast mode [ 1462.127455][T29050] syzkaller0: entered promiscuous mode [ 1462.134655][T29050] syzkaller0: entered allmulticast mode [ 1462.454042][ T30] audit: type=1800 audit(1786567623.204:619): pid=29061 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.7386" name="nexus" dev="configfs" ino=85449 res=0 errno=0 [ 1465.923229][T29044] tipc: Enabled bearer , priority 0 [ 1465.937288][T28624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1465.954637][T29043] tipc: Resetting bearer [ 1466.043413][T29043] tipc: Disabling bearer [ 1466.153820][T28624] 8021q: adding VLAN 0 to HW filter on device team0 [ 1466.190753][T27117] bridge0: port 1(bridge_slave_0) entered blocking state [ 1466.197941][T27117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1466.266007][T27117] bridge0: port 2(bridge_slave_1) entered blocking state [ 1466.273218][T27117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1468.940714][T29116] syzkaller0: entered promiscuous mode [ 1468.946446][T29116] syzkaller0: entered allmulticast mode [ 1469.124619][T29087] loop6: detected capacity change from 0 to 1024 [ 1469.240195][T29087] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1469.609599][T28624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1470.809411][T25460] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1471.053583][T29137] syzkaller0: entered promiscuous mode [ 1471.069196][T29137] syzkaller0: entered allmulticast mode [ 1471.358652][T29144] syzkaller0: entered promiscuous mode [ 1471.427457][T29144] syzkaller0: entered allmulticast mode [ 1471.490263][T29148] tipc: Enabled bearer , priority 0 [ 1471.582455][T29142] tipc: Resetting bearer [ 1471.586911][ T30] audit: type=1800 audit(1786567632.334:620): pid=29154 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.7412" name="memory_backed" dev="configfs" ino=84975 res=0 errno=0 [ 1471.837421][T29142] tipc: Disabling bearer [ 1472.026168][T28624] veth0_vlan: entered promiscuous mode [ 1472.083007][T28624] veth1_vlan: entered promiscuous mode [ 1472.225931][T28624] veth0_macvtap: entered promiscuous mode [ 1472.268904][T28624] veth1_macvtap: entered promiscuous mode [ 1472.373599][T28624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1472.418700][T28624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1472.505261][ T3271] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1472.603528][ T3280] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1472.637995][ T3280] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1472.717107][T29185] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 1472.744456][T29185] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1476.175112][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1476.193895][ T57] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1476.208037][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1476.535919][ T3294] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1476.766148][ T3294] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1476.920928][T29221] loop4: detected capacity change from 0 to 512 [ 1477.607244][T29221] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 219 vs 220 free clusters [ 1477.623259][T29221] EXT4-fs (loop4): Remounting filesystem read-only [ 1477.631366][T29221] EXT4-fs (loop4): 1 truncate cleaned up [ 1477.637021][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 1477.637039][ C0] EXT4-fs (loop4): initial error at time 1786567638: ext4_mb_generate_buddy:1317 [ 1477.637061][ C0] EXT4-fs (loop4): last error at time 1786567638: ext4_mb_generate_buddy:1317 [ 1477.664178][T29221] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1478.105557][T29221] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1478.143342][T29226] fuse: Bad value for 'fd' [ 1479.553596][T29234] syzkaller0: entered promiscuous mode [ 1479.584021][T29234] syzkaller0: entered allmulticast mode [ 1480.391982][T29251] syzkaller0: entered promiscuous mode [ 1480.420875][T29251] syzkaller0: entered allmulticast mode [ 1480.431230][T29255] loop5: detected capacity change from 0 to 1024 [ 1480.497332][T29255] EXT4-fs: Ignoring removed bh option [ 1481.240662][T29255] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1483.311015][T28624] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1483.514050][T29259] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1483.522853][T29259] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1483.554874][T29259] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1483.597055][T29259] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1483.641638][T29259] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1483.705974][T29259] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1483.736831][T29259] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1483.773771][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1483.781653][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1483.851657][T29259] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1483.999786][T29259] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1484.026508][T29259] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1484.030159][T29286] fuse: Bad value for 'fd' [ 1484.132576][T29259] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1484.231761][ T5608] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1484.257686][ T5608] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1484.265890][ T5608] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1484.275683][ T5608] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1484.284648][ T5608] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1484.481269][T18001] tipc: Resetting bearer [ 1484.662814][T18001] tipc: Disabling bearer [ 1485.601634][T16233] Bluetooth: hci2: command 0x0406 tx timeout [ 1485.603434][ T5608] Bluetooth: hci5: command 0x0406 tx timeout [ 1485.607720][T20233] Bluetooth: hci3: command 0x0c1a tx timeout [ 1485.639763][T29304] netlink: 44 bytes leftover after parsing attributes in process `syz.4.7456'. [ 1485.664847][T29308] loop1: detected capacity change from 0 to 1024 [ 1485.706910][T29308] EXT4-fs: Ignoring removed bh option [ 1485.767449][ T5608] Bluetooth: hci6: command 0x0c1a tx timeout [ 1485.827030][T29308] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1485.890320][T29313] syzkaller0: entered promiscuous mode [ 1485.953573][T29313] syzkaller0: entered allmulticast mode [ 1486.023379][ T5608] Bluetooth: hci0: command 0x0c1a tx timeout [ 1486.402204][ T5608] Bluetooth: hci1: command tx timeout [ 1486.862333][T29336] loop3: detected capacity change from 0 to 64 [ 1487.727998][ T5608] Bluetooth: hci2: command 0x0406 tx timeout [ 1487.841538][ T5608] Bluetooth: hci6: command 0x0c1a tx timeout [ 1488.081737][ T5608] Bluetooth: hci0: command 0x0c1a tx timeout [ 1488.188264][ T5608] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 1488.482821][ T5608] Bluetooth: hci1: command tx timeout [ 1489.063288][T29346] syzkaller0: entered promiscuous mode [ 1489.106034][T29346] syzkaller0: entered allmulticast mode [ 1489.169782][T29357] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1489.274487][T29357] block device autoloading is deprecated and will be removed. [ 1489.392453][T29202] bridge_slave_1: left allmulticast mode [ 1489.431745][T29202] bridge_slave_1: left promiscuous mode [ 1489.445416][T29202] bridge0: port 2(bridge_slave_1) entered disabled state [ 1489.503339][T29202] bridge_slave_0: left allmulticast mode [ 1489.538345][T29202] bridge_slave_0: left promiscuous mode [ 1489.563268][T29202] bridge0: port 1(bridge_slave_0) entered disabled state [ 1489.922903][ T5608] Bluetooth: hci6: command 0x0c1a tx timeout [ 1489.929045][T18746] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1490.165151][ T5608] Bluetooth: hci0: command 0x0c1a tx timeout [ 1490.245645][T29202] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1490.276577][T29202] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1490.302399][T29202] bond0 (unregistering): Released all slaves [ 1490.338899][T29368] netlink: 44 bytes leftover after parsing attributes in process `syz.6.7474'. [ 1490.459191][T29202] tipc: Left network mode [ 1490.561766][ T5608] Bluetooth: hci1: command tx timeout [ 1490.718608][ T5270] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1490.975401][T29405] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7483'. [ 1491.009229][T29404] Bluetooth: MGMT ver 1.23 [ 1491.124771][T29202] hsr_slave_0: left promiscuous mode [ 1491.167643][T29202] hsr_slave_1: left promiscuous mode [ 1491.183764][T29202] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1491.196493][T29202] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1492.641674][ T5608] Bluetooth: hci1: command tx timeout [ 1493.163874][T29202] team0 (unregistering): Port device team_slave_1 removed [ 1493.287321][T29202] team0 (unregistering): Port device team_slave_0 removed [ 1493.781343][T29440] netlink: 44 bytes leftover after parsing attributes in process `syz.5.7491'. [ 1493.795310][T29443] syzkaller0: entered promiscuous mode [ 1493.819794][T29443] syzkaller0: entered allmulticast mode [ 1493.858841][ T5270] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1494.081293][T29466] netlink: 32 bytes leftover after parsing attributes in process `syz.5.7496'. [ 1494.333777][T29279] bridge0: port 1(bridge_slave_0) entered blocking state [ 1494.346278][T29279] bridge0: port 1(bridge_slave_0) entered disabled state [ 1494.353506][T29279] bridge_slave_0: entered allmulticast mode [ 1494.364610][T29279] bridge_slave_0: entered promiscuous mode [ 1494.385054][T29279] bridge0: port 2(bridge_slave_1) entered blocking state [ 1494.416100][T29279] bridge0: port 2(bridge_slave_1) entered disabled state [ 1494.441040][T29279] bridge_slave_1: entered allmulticast mode [ 1494.823520][T29279] bridge_slave_1: entered promiscuous mode [ 1495.429713][T29279] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1495.624755][T29481] syzkaller0: entered promiscuous mode [ 1495.659681][T29481] syzkaller0: entered allmulticast mode [ 1495.696371][T29279] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1496.236654][T29484] loop1: detected capacity change from 0 to 32768 [ 1496.527927][T29484] JBD2: Ignoring recovery information on journal [ 1496.681341][T29484] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 1496.998178][T29518] OCFS2: ERROR (device loop1): int ocfs2_validate_gd_parent(struct super_block *, struct ocfs2_dinode *, struct buffer_head *, int): Group descriptor #17056 has bad parent pointer (3298534883402, expected 74) [ 1497.029890][T29518] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted. [ 1497.042641][T29518] OCFS2: File system is now read-only. [ 1497.056852][T29518] (syz.1.7502,29518,0):ocfs2_search_chain:1935 ERROR: status = -30 [ 1497.065080][T29518] (syz.1.7502,29518,0):ocfs2_search_chain:2058 ERROR: status = -30 [ 1497.080542][T29518] (syz.1.7502,29518,0):ocfs2_claim_suballoc_bits:2145 ERROR: status = -30 [ 1497.096015][T29518] (syz.1.7502,29518,0):ocfs2_claim_suballoc_bits:2198 ERROR: status = -30 [ 1497.113552][T29518] (syz.1.7502,29518,0):ocfs2_claim_new_inode:2439 ERROR: status = -30 [ 1497.122050][T29518] (syz.1.7502,29518,0):ocfs2_claim_new_inode:2454 ERROR: status = -30 [ 1497.130339][T29518] (syz.1.7502,29518,0):ocfs2_mknod_locked:642 ERROR: status = -30 [ 1497.150792][T29518] (syz.1.7502,29518,0):ocfs2_mknod:389 ERROR: status = -30 [ 1497.171339][T29518] (syz.1.7502,29518,1):ocfs2_mknod:506 ERROR: status = -30 [ 1497.182897][T29518] (syz.1.7502,29518,1):ocfs2_create:679 ERROR: status = -30 [ 1497.375796][T18746] ocfs2: Unmounting device (7,1) on (node local) [ 1498.888018][T29496] syzkaller0: entered promiscuous mode [ 1498.894840][T29496] syzkaller0: entered allmulticast mode [ 1498.901995][T29500] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 1498.948889][ T5270] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1499.053564][T29279] team0: Port device team_slave_0 added [ 1499.077760][T29279] team0: Port device team_slave_1 added [ 1499.090217][ T30] audit: type=1800 audit(1786567659.834:621): pid=29548 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.7513" name="nexus" dev="configfs" ino=86726 res=0 errno=0 [ 1499.225188][T29279] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1499.280388][T29279] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1499.354387][T29279] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1499.595250][T29279] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1499.613103][T29279] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1499.706330][T29279] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1499.717602][T27820] usb 2-1: new low-speed USB device number 73 using dummy_hcd [ 1499.851364][T29279] hsr_slave_0: entered promiscuous mode [ 1499.863487][T29279] hsr_slave_1: entered promiscuous mode [ 1499.882334][T27820] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1499.907224][T27820] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1499.927137][T27820] usb 2-1: config 0 has no interface number 0 [ 1499.948546][T27820] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1499.994103][T27820] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1500.038365][T27820] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1500.076132][T27820] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1500.107569][T27820] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 1500.136138][T27820] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1500.212321][T27820] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1500.232129][T27820] usb 2-1: config 0 descriptor?? [ 1500.242516][T29555] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1500.260432][T29555] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1500.350985][T27820] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1500.846793][T17278] usb 2-1: USB disconnect, device number 73 [ 1500.936626][T17278] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 1501.022979][T29583] syzkaller0: entered promiscuous mode [ 1501.074914][T29583] syzkaller0: entered allmulticast mode [ 1501.155814][ T30] audit: type=1800 audit(1786567661.904:622): pid=29592 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.7527" name="nexus" dev="configfs" ino=87507 res=0 errno=0 [ 1502.379459][T29616] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7532'. [ 1502.918987][T29635] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7537'. [ 1503.387525][T29643] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7539'. [ 1503.865193][T29642] 9pnet_virtio: no channels available for device syz [ 1506.670389][T29279] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1506.758107][T29279] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1506.840321][T29279] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1506.896402][T29279] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1506.927458][T29673] syzkaller0: entered promiscuous mode [ 1506.947663][T29673] syzkaller0: entered allmulticast mode [ 1506.974841][T29683] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7549'. [ 1506.985535][T29279] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1507.007717][T29686] loop3: detected capacity change from 0 to 128 [ 1507.026435][T29279] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1507.497840][T29279] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1507.973709][T29279] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1508.147095][T29700] netlink: 60 bytes leftover after parsing attributes in process `syz.6.7552'. [ 1508.565935][T29279] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1509.462887][T29720] 9pnet_virtio: no channels available for device syz [ 1509.733851][T29279] 8021q: adding VLAN 0 to HW filter on device team0 [ 1509.824959][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 1509.832146][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1509.844050][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 1509.851223][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1509.993808][T29730] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7564'. [ 1512.030211][T29744] netlink: 60 bytes leftover after parsing attributes in process `syz.6.7566'. [ 1513.919863][T29279] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1514.100377][T29279] veth0_vlan: entered promiscuous mode [ 1514.148911][T29279] veth1_vlan: entered promiscuous mode [ 1514.267839][T29279] veth0_macvtap: entered promiscuous mode [ 1514.295979][T29279] veth1_macvtap: entered promiscuous mode [ 1514.356316][T29279] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1514.406484][T29279] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1514.472925][ T1165] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1514.507900][ T1165] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1514.656862][T13634] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1514.791828][ T3271] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1515.201496][T16233] Bluetooth: hci2: command 0x0406 tx timeout [ 1515.389821][T29795] 9pnet_virtio: no channels available for device syz [ 1515.428548][T29798] netlink: 60 bytes leftover after parsing attributes in process `syz.1.7582'. [ 1517.567787][T16233] Bluetooth: hci2: command 0x0406 tx timeout [ 1517.664037][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1517.688818][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1517.831771][T29813] netlink: 32 bytes leftover after parsing attributes in process `syz.1.7584'. [ 1517.882716][T13634] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1517.919366][T13634] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1519.447222][T29842] fuse: Bad value for 'fd' [ 1519.806617][T29857] tipc: Enabling of bearer rejected, failed to enable media [ 1519.917452][T29816] loop4: detected capacity change from 0 to 32768 [ 1520.028188][T29865] dummy0: entered promiscuous mode [ 1520.033760][T29865] dummy0: entered allmulticast mode [ 1521.009440][T29816] read_mapping_page failed! [ 1521.095359][T29816] jfs_mount: Failed to read AGGREGATE_I [ 1521.110255][T29816] Mount JFS Failure: -5 [ 1521.444623][T29879] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7602'. [ 1523.078948][T16233] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1523.095765][T16233] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1523.105946][T16233] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1523.123130][T16233] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1523.133978][T16233] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1523.580411][T29914] tipc: Enabling of bearer rejected, failed to enable media [ 1523.614620][T29896] svc: failed to register nfsdv3 RPC service (errno 111). [ 1523.661641][T29896] svc: failed to register nfsaclv3 RPC service (errno 111). [ 1523.918255][T18746] tipc: Resetting bearer [ 1524.071855][T18746] tipc: Disabling bearer [ 1525.211802][ T5608] Bluetooth: hci4: command tx timeout [ 1525.430914][ T48] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1525.441014][T29921] loop5: detected capacity change from 0 to 32768 [ 1527.282149][ T5608] Bluetooth: hci4: command tx timeout [ 1527.775151][ T48] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1527.858177][T29976] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7623'. [ 1529.361531][T16233] Bluetooth: hci4: command tx timeout [ 1529.889702][T17278] libceph: connect (1)[c::]:6789 error -101 [ 1529.909428][T29981] ceph: No mds server is up or the cluster is laggy [ 1529.968121][T17278] libceph: mon0 (1)[c::]:6789 connect error [ 1530.288591][ T48] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1530.659854][T30001] loop3: detected capacity change from 0 to 4096 [ 1530.737562][ T48] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1530.748740][T30001] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1530.912221][T29994] tipc: Enabling of bearer rejected, failed to enable media [ 1531.441590][T16233] Bluetooth: hci4: command tx timeout [ 1532.907220][T30038] netlink: 'syz.5.7636': attribute type 1 has an invalid length. [ 1533.132593][T30038] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1533.338281][T30040] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 1533.364470][T13634] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1533.618653][T23792] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1533.644631][T19256] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1533.725545][T30043] bond1: (slave dummy0): Enslaving as a backup interface with an up link [ 1534.258593][T30069] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7641'. [ 1534.267689][T30069] netlink: 348 bytes leftover after parsing attributes in process `syz.2.7641'. [ 1534.276841][T30069] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7641'. [ 1534.286127][T30069] netlink: 348 bytes leftover after parsing attributes in process `syz.2.7641'. [ 1534.295903][T30069] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7641'. [ 1536.459309][ T48] bridge_slave_1: left allmulticast mode [ 1536.482834][ T48] bridge_slave_1: left promiscuous mode [ 1536.494325][T30054] loop4: detected capacity change from 0 to 32768 [ 1536.506451][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 1536.565590][ T48] bridge_slave_0: left allmulticast mode [ 1536.592865][ T48] bridge_slave_0: left promiscuous mode [ 1536.625457][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 1540.966092][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1541.210855][ T48] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1541.223924][ T48] bond0 (unregistering): Released all slaves [ 1541.998771][T29897] bridge0: port 1(bridge_slave_0) entered blocking state [ 1542.006752][T29897] bridge0: port 1(bridge_slave_0) entered disabled state [ 1542.016635][T29897] bridge_slave_0: entered allmulticast mode [ 1542.139014][T29897] bridge_slave_0: entered promiscuous mode [ 1542.326712][T29897] bridge0: port 2(bridge_slave_1) entered blocking state [ 1542.348015][T29897] bridge0: port 2(bridge_slave_1) entered disabled state [ 1542.399285][T29897] bridge_slave_1: entered allmulticast mode [ 1542.445619][T29897] bridge_slave_1: entered promiscuous mode [ 1542.459960][ T48] tipc: Left network mode [ 1542.510447][ T48] IPVS: stopping backup sync thread 19773 ... [ 1542.668296][T29897] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1543.454606][T29897] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1543.747270][T29897] team0: Port device team_slave_0 added [ 1543.772818][T29897] team0: Port device team_slave_1 added [ 1544.737784][T30153] netlink: 'syz.4.7666': attribute type 3 has an invalid length. [ 1544.780839][T29897] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1544.799371][T30153] netlink: 3 bytes leftover after parsing attributes in process `syz.4.7666'. [ 1544.821831][T29897] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1544.826843][T30122] loop5: detected capacity change from 0 to 32768 [ 1544.919647][T29897] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1545.082950][T29897] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1545.109354][T29897] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1545.199346][T29897] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1545.215666][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.224301][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.710436][ T48] hsr_slave_0: left promiscuous mode [ 1546.888591][ T48] hsr_slave_1: left promiscuous mode [ 1546.960223][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1547.097253][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1547.768466][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1547.848126][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1548.007892][ T48] veth1_macvtap: left promiscuous mode [ 1548.237297][ T48] veth0_macvtap: left promiscuous mode [ 1548.448907][ T48] veth1_vlan: left promiscuous mode [ 1548.506126][ T48] veth0_vlan: left promiscuous mode [ 1548.520197][T30201] netlink: 'syz.2.7679': attribute type 1 has an invalid length. [ 1548.585617][T30201] netlink: 'syz.2.7679': attribute type 2 has an invalid length. [ 1548.703463][T30207] netlink: 'syz.5.7682': attribute type 3 has an invalid length. [ 1548.755082][T30207] netlink: 3 bytes leftover after parsing attributes in process `syz.5.7682'. [ 1548.823402][T30203] loop4: detected capacity change from 0 to 4096 [ 1548.861226][T30203] ntfs3(loop4): Different NTFS sector size (2048) and media sector size (512). [ 1549.076707][T30203] ntfs3(loop4): Failed to initialize $Extend/$ObjId. [ 1550.016272][T30218] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7686'. [ 1550.595139][ T30] audit: type=1800 audit(1786567711.344:623): pid=30225 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.7689" name="power" dev="configfs" ino=89943 res=0 errno=0 [ 1551.330054][T30225] null_blk: disk my_zoned_dev created [ 1551.509394][T30205] loop3: detected capacity change from 0 to 32768 [ 1551.558954][ T48] team0 (unregistering): Port device team_slave_1 removed [ 1551.711281][ T48] team0 (unregistering): Port device team_slave_0 removed [ 1554.927080][ T5270] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1554.952317][T30286] syz_tun: entered allmulticast mode [ 1555.052549][T29897] hsr_slave_0: entered promiscuous mode [ 1555.105225][T29897] hsr_slave_1: entered promiscuous mode [ 1555.134873][T29897] debugfs: 'hsr0' already exists in 'hsr' [ 1555.173166][T29897] Cannot create hsr debugfs directory [ 1555.378741][T30305] "syz.4.7715" (30305) uses obsolete ecb(arc4) skcipher [ 1557.651668][T30345] CIFS: Attempting to mount //127.0.0.1/share [ 1558.925744][T29897] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1558.944193][T29897] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1558.969285][T29897] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1558.993122][T30345] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1559.018583][T29897] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1559.035984][T29897] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1559.088787][T29897] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1559.112383][T30345] CIFS: VFS: cifs_mount failed w/return code = -4 [ 1559.119542][T29897] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1559.175304][T29897] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1559.440534][T29897] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1559.559096][T29897] 8021q: adding VLAN 0 to HW filter on device team0 [ 1559.626136][T13634] bridge0: port 1(bridge_slave_0) entered blocking state [ 1559.633423][T13634] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1559.716143][ T3294] bridge0: port 2(bridge_slave_1) entered blocking state [ 1559.723465][ T3294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1560.026034][T30381] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7733'. [ 1560.041473][T30381] netlink: 348 bytes leftover after parsing attributes in process `syz.2.7733'. [ 1560.050512][T30381] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7733'. [ 1560.059790][T30381] netlink: 348 bytes leftover after parsing attributes in process `syz.2.7733'. [ 1560.069394][T30381] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7733'. [ 1560.260438][T30387] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 1561.773227][T30411] bridge1: entered promiscuous mode [ 1562.003898][T17278] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 1562.205974][T17278] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1562.232746][T17278] usb 4-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 1562.270459][T17278] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 1562.313873][T17278] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1562.341462][T17278] usb 4-1: Product: syz [ 1562.353232][T17278] usb 4-1: Manufacturer: syz [ 1562.366720][T17278] usb 4-1: SerialNumber: syz [ 1562.605413][T29897] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1562.628614][T30420] loop2: detected capacity change from 0 to 32768 [ 1562.647852][T17278] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1562.648935][T30420] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.7745 (30420) [ 1562.718879][T30420] BTRFS info (device loop2): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 1562.768899][T29897] veth0_vlan: entered promiscuous mode [ 1562.777921][T30420] BTRFS info (device loop2): using blake2b checksum algorithm [ 1562.824428][T29897] veth1_vlan: entered promiscuous mode [ 1562.969461][T30420] BTRFS info (device loop2): enabling ssd optimizations [ 1562.990795][T29897] veth0_macvtap: entered promiscuous mode [ 1563.009277][T30420] BTRFS info (device loop2): turning on async discard [ 1563.023295][T29897] veth1_macvtap: entered promiscuous mode [ 1563.048667][T29897] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1563.062622][T30420] BTRFS info (device loop2): enabling free space tree [ 1563.069450][T30420] BTRFS info (device loop2): use zstd compression, level 3 [ 1563.093328][T29897] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1563.185948][T23792] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.243861][T13634] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.283143][T13634] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.330233][T13634] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.484117][T17278] usb 4-1: failed to enable PITCH for EP 0x82 [ 1563.511202][T17278] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 1563.547383][T17278] usb 4-1: clock source 0 is not valid, cannot use [ 1563.574191][T17278] usb 4-1: 2:1: cannot get freq (v2/v3): err -71 [ 1563.605588][T17278] usb 4-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 1563.687456][T13634] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1563.734114][T13634] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1563.887913][T17278] usb 4-1: USB disconnect, device number 54 [ 1563.970011][T23792] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1563.996544][T23792] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1564.633623][T30482] netlink: 'syz.5.7755': attribute type 3 has an invalid length. [ 1564.712735][T30482] netlink: 3 bytes leftover after parsing attributes in process `syz.5.7755'. [ 1564.855235][T16164] udevd[16164]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1565.891363][T29279] BTRFS info (device loop2): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 1566.371376][T30508] syzkaller0: entered promiscuous mode [ 1566.391473][T30508] syzkaller0: entered allmulticast mode [ 1566.617533][T30518] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7762'. [ 1566.858523][T30525] syz_tun: entered allmulticast mode [ 1566.888363][ T30] audit: type=1800 audit(1786567727.624:624): pid=30527 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.7770" name="nexus" dev="configfs" ino=90490 res=0 errno=0 [ 1567.004282][T30526] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1567.063667][T30534] netlink: 'syz.6.7772': attribute type 3 has an invalid length. [ 1567.072290][T30534] netlink: 3 bytes leftover after parsing attributes in process `syz.6.7772'. [ 1567.248625][T30538] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7774'. [ 1567.289771][T30538] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7774'. [ 1569.488284][T30568] syz_tun: entered allmulticast mode [ 1569.690688][T30544] loop4: detected capacity change from 0 to 32768 [ 1569.722003][T30544] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.7777 (30544) [ 1569.807077][T30544] BTRFS info (device loop4): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 1569.851501][T30544] BTRFS info (device loop4): using blake2b checksum algorithm [ 1569.982858][T30544] BTRFS info (device loop4): enabling ssd optimizations [ 1570.021526][T30544] BTRFS info (device loop4): turning on async discard [ 1570.028728][T30544] BTRFS info (device loop4): enabling free space tree [ 1570.036311][T30544] BTRFS info (device loop4): use lzo compression, level 1 [ 1570.083683][ T30] audit: type=1800 audit(1786567730.834:625): pid=30544 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.7777" name="file1" dev="loop4" ino=260 res=0 errno=0 [ 1570.216971][T30598] netlink: 'syz.3.7792': attribute type 3 has an invalid length. [ 1570.260183][T30598] netlink: 3 bytes leftover after parsing attributes in process `syz.3.7792'. [ 1570.315648][T27683] BTRFS info (device loop4): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 1573.889033][T30620] syz_tun: entered allmulticast mode [ 1581.363207][T30659] syz_tun: entered allmulticast mode [ 1581.659873][T30669] bridge: RTM_NEWNEIGH with invalid ether address [ 1582.754283][T30692] loop3: detected capacity change from 0 to 1024 [ 1583.184527][ T30] audit: type=1800 audit(1786567743.934:626): pid=30692 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.7826" name="file1" dev="loop3" ino=20 res=0 errno=0 [ 1584.522076][T17278] bond_slave_0: entered promiscuous mode [ 1584.531347][T17278] bond_slave_1: entered promiscuous mode [ 1585.475482][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 1585.559144][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 1585.615396][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x186b instead [ 1585.657128][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0x83ca instead [ 1585.695263][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 1585.745876][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 1585.767802][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 1586.186552][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 1586.211795][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 1587.249636][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 1587.301510][T30733] jffs2: Further such events for this erase block will not be printed [ 1587.349649][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 1587.382814][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 1587.469517][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0x186b instead [ 1587.494027][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0x83ca instead [ 1587.541033][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 1587.608068][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 1587.690479][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 1587.784390][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 1587.883374][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 1587.928677][T30733] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 1587.975535][T30733] jffs2: Further such events for this erase block will not be printed [ 1588.018364][T30733] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 1588.096704][T30733] jffs2: empty_blocks 30, bad_blocks 0, c->nr_blocks 32 [ 1589.416954][T30781] syzkaller0: entered promiscuous mode [ 1589.441797][T30781] syzkaller0: entered allmulticast mode [ 1590.107516][T30806] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7869'. [ 1590.131591][T30806] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1590.164478][T30806] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1590.510315][T30820] netlink: 'syz.6.7876': attribute type 3 has an invalid length. [ 1590.534426][T30820] netlink: 3 bytes leftover after parsing attributes in process `syz.6.7876'. [ 1590.621768][ T5608] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1590.636859][ T5608] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1590.646111][ T5608] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1590.654453][ T5608] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1590.662976][ T5608] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1590.883056][T30831] syzkaller0: entered promiscuous mode [ 1590.894594][T30831] syzkaller0: entered allmulticast mode [ 1591.929083][T19256] tipc: Resetting bearer [ 1592.068712][T19256] syz_tun (unregistering): left allmulticast mode [ 1592.214115][T19256] tipc: Disabling bearer [ 1592.562530][T30786] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1592.721536][ T5608] Bluetooth: hci3: command tx timeout [ 1594.804576][ T5608] Bluetooth: hci3: command tx timeout [ 1596.532204][ T5799] bond_slave_0: entered promiscuous mode [ 1596.537910][ T5799] bond_slave_1: entered promiscuous mode [ 1596.893753][ T5608] Bluetooth: hci3: command tx timeout [ 1597.096553][T30875] loop5: detected capacity change from 0 to 32768 [ 1597.520801][ T3294] bridge_slave_1: left allmulticast mode [ 1598.174123][ T3294] bridge_slave_1: left promiscuous mode [ 1598.323661][ T3294] bridge0: port 2(bridge_slave_1) entered disabled state [ 1598.485210][ T3294] bridge_slave_0: left allmulticast mode [ 1598.507449][ T3294] bridge_slave_0: left promiscuous mode [ 1598.513612][ T3294] bridge0: port 1(bridge_slave_0) entered disabled state [ 1598.672730][T17278] usb 2-1: new low-speed USB device number 74 using dummy_hcd [ 1598.783067][T30931] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7911'. [ 1598.842995][T17278] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1598.871062][T17278] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1598.886122][T17278] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1598.915178][T17278] usb 2-1: config 0 has no interface number 0 [ 1598.942917][T17278] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1598.967945][T17278] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1598.973879][ T5608] Bluetooth: hci3: command tx timeout [ 1599.031094][T17278] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1599.078897][T17278] usb 2-1: config 0 descriptor?? [ 1599.112382][T30927] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1599.154224][T17278] ldusb 2-1:0.55: Interrupt in endpoint not found [ 1599.258290][ T3294] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1599.268953][ T3294] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1599.287339][ T3294] bond0 (unregistering): (slave team0): Releasing backup interface [ 1599.318510][ T3294] bond0 (unregistering): Released all slaves [ 1599.355945][ T3294] bond1 (unregistering): Released all slaves [ 1599.417338][ T3294] bond2 (unregistering): Released all slaves [ 1599.473409][T17278] usb 2-1: USB disconnect, device number 74 [ 1599.695556][ T3294] tipc: Left network mode [ 1599.720936][ T3294] IPVS: stopping backup sync thread 23780 ... [ 1599.815663][T30931] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1599.824594][T30931] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1599.849831][T30931] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1599.865782][T30931] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1600.549829][T30952] tipc: Started in network mode [ 1600.574953][T30952] tipc: Node identity aac2f89eb543, cluster identity 4711 [ 1600.624462][T30952] tipc: Enabled bearer , priority 0 [ 1600.681317][T30965] syzkaller0: entered promiscuous mode [ 1600.697970][T30965] syzkaller0: entered allmulticast mode [ 1600.722883][T30823] bridge0: port 1(bridge_slave_0) entered blocking state [ 1600.744623][T30823] bridge0: port 1(bridge_slave_0) entered disabled state [ 1600.760901][T30823] bridge_slave_0: entered allmulticast mode [ 1600.784706][T30823] bridge_slave_0: entered promiscuous mode [ 1600.864814][T30979] tipc: Resetting bearer [ 1600.933272][T30950] tipc: Resetting bearer [ 1601.018110][T30950] tipc: Disabling bearer [ 1601.041367][T30823] bridge0: port 2(bridge_slave_1) entered blocking state [ 1601.071657][T30823] bridge0: port 2(bridge_slave_1) entered disabled state [ 1601.098236][T30823] bridge_slave_1: entered allmulticast mode [ 1601.122583][T30823] bridge_slave_1: entered promiscuous mode [ 1601.216045][T30967] loop5: detected capacity change from 0 to 32768 [ 1601.232076][ T5270] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1601.412459][ T3294] hsr_slave_0: left promiscuous mode [ 1601.442846][ T3294] hsr_slave_1: left promiscuous mode [ 1601.939776][T31006] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7928'. [ 1602.577506][ T3294] team0 (unregistering): Port device team_slave_1 removed [ 1602.633353][ T3294] team0 (unregistering): Port device team_slave_0 removed [ 1602.742956][T27117] smbdirect: ib_dev[syz1] removed [ 1602.881334][T30823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1602.987156][T30823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1603.002769][ T5718] infiniband syz1: ib_query_port failed (-19) [ 1603.080533][ T5718] IPVS: starting estimator thread 0... [ 1603.206926][T31019] IPVS: using max 24 ests per chain, 57600 per kthread [ 1603.221341][T30823] team0: Port device team_slave_0 added [ 1603.344672][T30823] team0: Port device team_slave_1 added [ 1603.377465][T31023] tipc: Started in network mode [ 1603.410468][T31023] tipc: Node identity 121dee496f28, cluster identity 4711 [ 1603.530874][T31023] tipc: Enabled bearer , priority 0 [ 1603.714515][T31026] syzkaller0: entered promiscuous mode [ 1603.815593][T31026] syzkaller0: entered allmulticast mode [ 1603.947961][T30823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1603.966700][T30823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1604.032567][T30823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1604.073570][T31023] tipc: Resetting bearer [ 1604.094827][T31022] tipc: Resetting bearer [ 1604.174396][T31022] tipc: Disabling bearer [ 1604.206000][T30823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1604.223671][T30823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1604.256579][T31047] loop2: detected capacity change from 0 to 4096 [ 1604.302146][T30823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1604.312626][T31047] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1604.370332][T30823] hsr_slave_0: entered promiscuous mode [ 1604.378807][T30823] hsr_slave_1: entered promiscuous mode [ 1604.388244][T30823] debugfs: 'hsr0' already exists in 'hsr' [ 1604.394371][T30823] Cannot create hsr debugfs directory [ 1604.714996][T31032] loop5: detected capacity change from 0 to 32768 [ 1605.254387][T31066] loop4: detected capacity change from 0 to 8 [ 1605.354553][T29279] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1606.458107][T31083] netlink: 'syz.4.7951': attribute type 3 has an invalid length. [ 1606.479230][T31083] netlink: 3 bytes leftover after parsing attributes in process `syz.4.7951'. [ 1606.646771][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1606.654851][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.681605][T31101] binder: 31099:31101 ioctl c0306201 200000000040 returned -22 [ 1608.099375][T31108] loop5: detected capacity change from 0 to 4096 [ 1608.173893][T31108] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1608.441068][T31122] CIFS: Attempting to mount //127.0.0.1/share [ 1608.449836][T31122] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1608.457307][T31122] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1609.046446][T28624] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1609.715350][T30823] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1611.687851][T30823] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1611.779479][T31150] bridge0: port 2(bridge_slave_1) entered disabled state [ 1611.786838][T31150] bridge0: port 1(bridge_slave_0) entered disabled state [ 1611.794451][T31150] bridge0: entered allmulticast mode [ 1611.966847][T30823] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1612.014981][T30823] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1612.064069][T31157] netlink: 'syz.6.7971': attribute type 3 has an invalid length. [ 1612.084687][T31157] netlink: 3 bytes leftover after parsing attributes in process `syz.6.7971'. [ 1612.404273][T30823] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1612.451964][T30823] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1612.498772][T30823] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1612.578938][T30823] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1614.602079][T30823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1614.673736][T30823] 8021q: adding VLAN 0 to HW filter on device team0 [ 1614.730369][ T3294] bridge0: port 1(bridge_slave_0) entered blocking state [ 1614.737600][ T3294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1614.817644][ T3294] bridge0: port 2(bridge_slave_1) entered blocking state [ 1614.824845][ T3294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1614.971553][ T5799] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 1615.058189][ T30] audit: type=1326 audit(1786567775.804:627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72759e0d9 code=0x7ffc0000 [ 1615.181624][ T5799] usb 2-1: Using ep0 maxpacket: 16 [ 1615.195111][ T5799] usb 2-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 1615.220687][ T5799] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 1615.256248][ T30] audit: type=1326 audit(1786567775.834:628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fc727597e57 code=0x7ffc0000 [ 1615.273729][ T5799] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1615.354849][ T30] audit: type=1326 audit(1786567775.834:629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc72753f459 code=0x7ffc0000 [ 1615.399390][ T5799] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1615.419689][ T30] audit: type=1326 audit(1786567775.834:630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72759e0d9 code=0x7ffc0000 [ 1615.506633][ T5799] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 1615.514887][ T30] audit: type=1326 audit(1786567775.834:631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72759e0d9 code=0x7ffc0000 [ 1615.548430][T17278] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 1615.598298][ T30] audit: type=1326 audit(1786567775.834:632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc72755e90e code=0x7ffc0000 [ 1615.673306][ T5799] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1615.696056][ T30] audit: type=1326 audit(1786567775.844:634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc72755e90e code=0x7ffc0000 [ 1615.743605][T17278] usb 6-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 1615.756380][T17278] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1615.772926][ T30] audit: type=1326 audit(1786567775.844:633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fc727597e57 code=0x7ffc0000 [ 1615.804870][T17278] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1615.830661][T17278] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1615.870637][ T5799] usb 2-1: config 0 descriptor?? [ 1615.905329][ T30] audit: type=1326 audit(1786567775.844:635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fc72753f459 code=0x7ffc0000 [ 1615.963969][T17278] usb 6-1: config 0 descriptor?? [ 1616.020643][ T30] audit: type=1326 audit(1786567775.844:636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31208 comm="syz.6.7982" exe="/root/ci-upstream-kasan-gce-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc72759e0d9 code=0x7ffc0000 [ 1616.056997][T31237] netlink: 'syz.2.7988': attribute type 3 has an invalid length. [ 1616.075751][T31237] netlink: 3 bytes leftover after parsing attributes in process `syz.2.7988'. [ 1616.367328][ T5799] input: HID 0458:5013 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5013.001D/input/input39 [ 1616.396119][T17278] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 1616.435591][T17278] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 1616.478793][T17278] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 1616.520027][T17278] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 1616.566958][ T5799] input: HID 0458:5013 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5013.001D/input/input40 [ 1616.572278][T17278] playstation 0003:054C:0DF2.001E: unknown main item tag 0x0 [ 1616.689168][T17278] playstation 0003:054C:0DF2.001E: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.5-1/input0 [ 1616.703135][ T5799] kye 0003:0458:5013.001D: input,hiddev0,hidraw1: USB HID vff.fa Device [HID 0458:5013] on usb-dummy_hcd.1-1/input0 [ 1616.817850][ T5799] usb 2-1: USB disconnect, device number 75 [ 1616.912396][T17278] playstation 0003:054C:0DF2.001E: Failed to retrieve feature with reportID 9: -71 [ 1616.972488][T17278] playstation 0003:054C:0DF2.001E: Failed to retrieve DualSense pairing info: -71 [ 1617.034017][T17278] playstation 0003:054C:0DF2.001E: Failed to get MAC address from DualSense [ 1617.077546][T31219] loop4: detected capacity change from 0 to 32768 [ 1617.080605][T17278] playstation 0003:054C:0DF2.001E: Failed to create dualsense. [ 1617.156732][T31251] fido_id[31251]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 1617.278614][T17278] playstation 0003:054C:0DF2.001E: probe with driver playstation failed with error -71 [ 1617.464008][T17278] usb 6-1: USB disconnect, device number 41 [ 1617.512462][T30823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1618.046433][T30823] veth0_vlan: entered promiscuous mode [ 1619.090367][T30823] veth1_vlan: entered promiscuous mode [ 1619.365584][T30823] veth0_macvtap: entered promiscuous mode [ 1620.134364][T30823] veth1_macvtap: entered promiscuous mode [ 1620.306062][T30823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1620.398426][T30823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1620.551620][T27117] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1620.595917][T27117] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1620.672944][T23792] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1620.723739][T23792] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1620.741703][ T5718] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 1620.924310][ T5718] usb 6-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1621.912410][ T5718] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1621.944514][ T5718] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1622.256669][ T5718] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1622.281427][ T5718] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1622.315387][ T5718] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1622.354483][ T5718] usb 6-1: Product: syz [ 1622.376768][ T5718] usb 6-1: Manufacturer: syz [ 1622.398821][ T5718] usb 6-1: SerialNumber: syz [ 1622.461558][T13634] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1622.518956][T13634] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1622.661328][ T5718] usb 6-1: usb_control_msg returned -71 [ 1622.682594][T13634] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1622.701628][ T5718] usbtmc 6-1:1.0: can't read capabilities [ 1622.717896][T13634] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1622.759658][ T5718] usb 6-1: USB disconnect, device number 42 [ 1622.828843][T31316] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8008'. [ 1623.059027][T31322] netlink: 28 bytes leftover after parsing attributes in process `syz.6.8008'. [ 1623.546692][T31326] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8008'. [ 1624.478528][T16233] Bluetooth: hci1: command 0x0406 tx timeout [ 1625.219842][T31326] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1626.174217][T31353] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 1626.180976][T31353] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1626.244489][T31353] vhci_hcd vhci_hcd.0: Device attached [ 1626.668113][ T5718] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 1628.080444][T31355] vhci_hcd: connection reset by peer [ 1628.475236][ T57] vhci_hcd vhci_hcd.4: stop threads [ 1628.516813][ T57] vhci_hcd vhci_hcd.4: release socket [ 1628.562303][ T57] vhci_hcd vhci_hcd.4: disconnect device [ 1629.950274][T31397] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8030'. [ 1629.956787][T31399] 9p: Bad value for 'wfdno' [ 1630.062127][T31401] netlink: 28 bytes leftover after parsing attributes in process `syz.6.8030'. [ 1630.144898][T31408] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8030'. [ 1630.192964][T31408] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1630.228449][T31405] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8033'. [ 1630.414655][T31414] loop1: detected capacity change from 0 to 4096 [ 1630.503789][T31414] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1631.732559][T29897] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1632.231538][ T5718] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 1632.375441][T31451] 9p: Bad value for 'wfdno' [ 1632.812742][ T5723] usb 2-1: new low-speed USB device number 76 using dummy_hcd [ 1633.313330][ T5723] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1633.348171][T31461] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8051'. [ 1633.350092][ T5723] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1633.393575][T31461] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8051'. [ 1633.400359][ T5723] usb 2-1: config 0 has no interface number 0 [ 1633.430851][ T5723] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1633.436241][T31461] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8051'. [ 1633.456435][ T5723] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1633.485947][ T5723] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1633.513738][ T5723] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1633.542583][ T5723] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1633.566669][ T5723] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1633.604081][ T5723] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1633.662773][ T5723] usb 2-1: config 0 descriptor?? [ 1633.686556][T31456] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1633.726939][ T5723] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1633.902766][T31471] loop4: detected capacity change from 0 to 4096 [ 1633.946496][T31456] ldusb 2-1:0.55: Couldn't submit interrupt_in_urb -90 [ 1633.963784][ T5723] usb 2-1: USB disconnect, device number 76 [ 1633.995472][ T5723] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 1634.169221][T31471] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1635.292963][T27683] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1635.602071][T31495] 9p: Bad value for 'wfdno' [ 1636.023943][T31508] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8067'. [ 1636.079356][T31508] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8067'. [ 1636.089534][T31508] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8067'. [ 1636.100321][T31508] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1639.721045][T31550] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8083'. [ 1639.794009][T31550] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8083'. [ 1640.230111][T31555] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8084'. [ 1640.447420][T31559] loop4: detected capacity change from 0 to 2048 [ 1640.525981][T31559] UDF-fs: error (device loop4): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 1640.574578][T31559] UDF-fs: warning (device loop4): udf_load_vrs: No anchor found [ 1640.612257][T31564] xt_hashlimit: size too large, truncated to 1048576 [ 1640.625347][T31559] UDF-fs: Scanning with blocksize 512 failed [ 1640.721480][T31559] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1642.752028][T31582] hub 8-0:1.0: USB hub found [ 1642.758542][T31582] hub 8-0:1.0: 1 port detected [ 1644.128803][T31595] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8097'. [ 1644.326721][T31602] netlink: 28 bytes leftover after parsing attributes in process `syz.5.8100'. [ 1644.363974][T31596] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1644.859625][T31608] syzkaller0: entered promiscuous mode [ 1644.884592][T31608] syzkaller0: entered allmulticast mode [ 1647.798576][T31639] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8113'. [ 1649.251685][ T5718] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 1649.565033][T31659] loop3: detected capacity change from 0 to 256 [ 1649.791509][ T5718] usb 3-1: Using ep0 maxpacket: 32 [ 1650.847836][ T5718] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1651.339826][ T5718] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 1651.396711][ T5718] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1651.467009][ T5718] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1651.526751][ T5718] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1651.594694][ T5718] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1651.637180][ T5718] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1651.699515][ T5718] usb 3-1: Product: syz [ 1651.738835][ T5718] usb 3-1: Manufacturer: syz [ 1651.761948][ T5718] usb 3-1: SerialNumber: syz [ 1651.791539][ T5718] usb 3-1: config 0 descriptor?? [ 1651.820439][ T5718] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1651.896627][ T5718] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1651.998399][T16820] usb 3-1: USB disconnect, device number 53 [ 1652.039721][T16820] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 1652.121718][ T5723] usb 4-1: new low-speed USB device number 55 using dummy_hcd [ 1652.425552][ T5723] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1653.098748][ T5723] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 1653.189538][ T5723] usb 4-1: config 0 has no interface number 0 [ 1653.244256][ T5723] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1653.289900][ T5723] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1653.315274][T31688] tipc: Enabled bearer , priority 0 [ 1653.329812][ T5723] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1653.384736][T31688] syzkaller0: entered promiscuous mode [ 1653.492199][T31688] syzkaller0: entered allmulticast mode [ 1653.819533][T31691] sch_tbf: peakrate 11 is lower than or equals to rate 2048 ! [ 1654.007220][ T5723] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1654.153954][T31688] tipc: Resetting bearer [ 1654.172552][ T5723] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 1654.183418][ T5723] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1654.197443][ T5723] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1654.211081][ T5723] usb 4-1: config 0 descriptor?? [ 1654.219226][T31669] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1654.226632][T31669] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1654.233674][T31687] tipc: Resetting bearer [ 1654.237951][ T5723] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1654.370763][T31687] tipc: Disabling bearer [ 1654.462904][ T5723] usb 4-1: USB disconnect, device number 55 [ 1654.489378][ T5723] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 1654.718522][T31711] 9p: Bad value for 'rfdno' [ 1654.789713][T31714] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 1655.182394][T31729] syzkaller0: entered promiscuous mode [ 1655.196577][T31729] syzkaller0: entered allmulticast mode [ 1655.836876][T31723] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 1656.027870][T31745] syzkaller0: entered promiscuous mode [ 1656.055645][T31745] syzkaller0: entered allmulticast mode [ 1656.143003][T31748] loop4: detected capacity change from 0 to 512 [ 1656.170628][T31748] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 1656.226616][T31748] EXT4-fs (loop4): 1 truncate cleaned up [ 1656.267098][T31748] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1656.320902][T31756] 9p: Bad value for 'rfdno' [ 1656.347627][T31750] tipc: Started in network mode [ 1656.363117][T31750] tipc: Node identity 56b45995cdf2, cluster identity 4711 [ 1656.380912][T31750] tipc: Enabled bearer , priority 0 [ 1656.405877][T31757] syzkaller0: entered promiscuous mode [ 1656.458335][ T9] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1656.468866][T31757] syzkaller0: entered allmulticast mode [ 1656.519137][T31750] sch_tbf: peakrate 11 is lower than or equals to rate 2048 ! [ 1656.575804][T31750] tipc: Resetting bearer [ 1656.595927][T31749] tipc: Resetting bearer [ 1656.663509][ T9] usb 4-1: New USB device found, idVendor=1235, idProduct=8201, bcdDevice= 1.00 [ 1656.680116][T31749] tipc: Disabling bearer [ 1656.695061][ T9] usb 4-1: config index 0 descriptor too short (expected 69, got 51) [ 1656.719917][ T9] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1656.731479][ T9357] usb 3-1: new low-speed USB device number 54 using dummy_hcd [ 1656.807799][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1656.825922][ T9] usb 4-1: Product: syz [ 1656.838907][T27683] syz_tun (unregistering): left allmulticast mode [ 1656.855107][ T9] usb 4-1: Manufacturer: syz [ 1656.887541][ T9] usb 4-1: SerialNumber: syz [ 1656.906057][ T9357] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1656.936073][ T9357] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 1656.946490][ T9357] usb 3-1: config 0 has no interface number 0 [ 1656.958928][ T9357] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1656.971312][ T9357] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1656.985482][ T9] usb 4-1: Focusrite Scarlett Gen 2 Mixer Driver enabled (pid=0x8201); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 1656.995026][T27683] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1657.016637][ T9357] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1657.031099][ T9357] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1657.064862][ T9357] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 1657.065021][T31765] syzkaller0: entered promiscuous mode [ 1657.076343][ T9357] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1657.094387][T31765] syzkaller0: entered allmulticast mode [ 1657.165926][ T9357] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1657.243441][ T9357] usb 3-1: config 0 descriptor?? [ 1657.273421][T31759] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1657.315659][T31759] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1657.396871][ T9357] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1657.625070][T27820] usb 3-1: USB disconnect, device number 54 [ 1657.663520][T27820] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 1657.971344][ T30] kauditd_printk_skb: 67 callbacks suppressed [ 1657.991722][ T30] audit: type=1800 audit(1786567818.714:704): pid=31774 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.8163" name="nexus" dev="configfs" ino=95004 res=0 errno=0 [ 1658.300613][T31787] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1658.313007][T31787] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1658.321284][T31787] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1658.340568][T31787] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1658.349069][T31787] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1658.399323][T31789] 9p: Bad value for 'rfdno' [ 1658.412179][ T9] usb 4-1: Scarlett Gen 2 USB request timed out, cmd 0 [ 1658.439433][ T9] usb 4-1: Error initialising Scarlett Gen 2 Mixer Driver: -110 [ 1658.742994][ T9] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -110 [ 1658.948505][T30646] udevd[30646]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1659.271563][T31800] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8170'. [ 1660.094433][ T5608] Bluetooth: hci4: command 0x0406 tx timeout [ 1660.401937][T16233] Bluetooth: hci5: command tx timeout [ 1660.454388][ T5718] usb 4-1: USB disconnect, device number 56 [ 1660.554289][T31822] syzkaller0: entered promiscuous mode [ 1660.574463][T31822] syzkaller0: entered allmulticast mode [ 1660.937885][T31835] 9pnet_fd: Insufficient options for proto=fd [ 1660.961502][T16820] usb 3-1: new low-speed USB device number 55 using dummy_hcd [ 1661.209622][T16820] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1661.288959][T16820] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 1661.344606][T16820] usb 3-1: config 0 has no interface number 0 [ 1661.410164][T16820] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1661.522856][T16820] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1661.632059][T16820] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1661.694908][T16820] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1661.714551][T16820] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 1661.725912][T16820] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1661.777802][T16820] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1661.833879][T16820] usb 3-1: config 0 descriptor?? [ 1661.839897][T31828] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1661.859854][T31828] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1662.063364][T16820] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1662.109571][T16820] usb 3-1: USB disconnect, device number 55 [ 1662.140563][T16820] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 1662.296470][T31848] netlink: 348 bytes leftover after parsing attributes in process `syz.5.8183'. [ 1662.306017][T31848] netlink: 348 bytes leftover after parsing attributes in process `syz.5.8183'. [ 1662.483475][T16233] Bluetooth: hci5: command tx timeout [ 1664.561839][T16233] Bluetooth: hci5: command tx timeout [ 1664.797519][T31866] netlink: 148 bytes leftover after parsing attributes in process `syz.5.8188'. [ 1664.824197][T31866] netlink: 164 bytes leftover after parsing attributes in process `syz.5.8188'. [ 1665.036823][T31780] bridge0: port 1(bridge_slave_0) entered blocking state [ 1665.087932][T31780] bridge0: port 1(bridge_slave_0) entered disabled state [ 1665.147004][T31780] bridge_slave_0: entered allmulticast mode [ 1665.166651][T31780] bridge_slave_0: entered promiscuous mode [ 1665.210043][T31780] bridge0: port 2(bridge_slave_1) entered blocking state [ 1665.244192][T31780] bridge0: port 2(bridge_slave_1) entered disabled state [ 1665.272442][T31780] bridge_slave_1: entered allmulticast mode [ 1665.272986][T31877] 9pnet_fd: Insufficient options for proto=fd [ 1665.288087][T31780] bridge_slave_1: entered promiscuous mode [ 1665.300185][T31878] syzkaller0: entered promiscuous mode [ 1665.306010][T31878] syzkaller0: entered allmulticast mode [ 1665.605268][T31780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1665.650737][T31780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1665.803054][T31780] team0: Port device team_slave_0 added [ 1665.812514][T31780] team0: Port device team_slave_1 added [ 1665.903967][T31780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1665.925520][T31780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1665.989366][T31893] loop1: detected capacity change from 0 to 128 [ 1666.021057][T31893] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 1666.091999][T31780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1666.112434][T31893] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 1666.160948][T31780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1666.202313][T31780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1666.265578][T31780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1666.536817][T31780] hsr_slave_0: entered promiscuous mode [ 1667.529175][T16233] Bluetooth: hci5: command tx timeout [ 1667.571916][T31780] hsr_slave_1: entered promiscuous mode [ 1668.541968][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.549307][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1668.690258][T31780] debugfs: 'hsr0' already exists in 'hsr' [ 1668.774869][T30024] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 1668.799155][T31780] Cannot create hsr debugfs directory [ 1669.148071][T31920] 9pnet_fd: Insufficient options for proto=fd [ 1669.415407][T31927] syzkaller0: entered promiscuous mode [ 1669.423334][T31927] syzkaller0: entered allmulticast mode [ 1669.740508][ T30] audit: type=1800 audit(1786567830.484:705): pid=31937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.8214" name="nexus" dev="configfs" ino=96400 res=0 errno=0 [ 1670.007832][T31780] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1670.605146][T31780] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1670.897309][T31947] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8216'. [ 1670.927974][T31780] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1670.948465][T31780] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1670.961429][T31780] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1671.015671][T31780] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1671.049774][T31780] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1671.112747][T31780] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1671.214606][T31957] 9pnet_fd: Insufficient options for proto=fd [ 1671.409043][T31780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1671.417353][T31968] loop1: detected capacity change from 0 to 512 [ 1672.154990][T31968] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1672.176952][T31968] ext4 filesystem being mounted at /91/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1672.218510][T31780] 8021q: adding VLAN 0 to HW filter on device team0 [ 1672.275387][ T3271] bridge0: port 1(bridge_slave_0) entered blocking state [ 1672.282587][ T3271] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1672.343768][ T3271] bridge0: port 2(bridge_slave_1) entered blocking state [ 1672.350966][ T3271] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1673.013434][T31985] syzkaller0: entered promiscuous mode [ 1673.036198][T31985] syzkaller0: entered allmulticast mode [ 1674.556917][T32000] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8232'. [ 1674.598657][T29897] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1674.655162][ T3280] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1674.801796][T31993] syzkaller0: entered promiscuous mode [ 1674.816118][T31993] syzkaller0: entered allmulticast mode [ 1675.068296][T32008] loop1: detected capacity change from 0 to 8 [ 1675.136046][T32008] SQUASHFS error: xz decompression failed, data probably corrupt [ 1675.151647][T32008] SQUASHFS error: Failed to read block 0x108: -5 [ 1675.185416][ T3280] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1675.191440][T32008] SQUASHFS error: Unable to read metadata cache entry [106] [ 1675.237636][T31997] loop5: detected capacity change from 0 to 32768 [ 1675.251017][T32008] SQUASHFS error: Unable to read inode 0x11f [ 1675.415070][T31997] XFS (loop5): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 1675.506074][ T3280] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1675.825817][T31997] XFS (loop5): Starting recovery (logdev: internal) [ 1675.838439][ T3280] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1675.931675][T31997] XFS (loop5): Ending recovery (logdev: internal) [ 1678.549569][T28624] XFS (loop5): Unmounting Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4 [ 1679.417098][ T3280] bridge_slave_1: left allmulticast mode [ 1679.445490][ T3280] bridge_slave_1: left promiscuous mode [ 1679.471935][ T3280] bridge0: port 2(bridge_slave_1) entered disabled state [ 1679.594240][ T3280] bridge_slave_0: left allmulticast mode [ 1679.662577][ T3280] bridge_slave_0: left promiscuous mode [ 1679.726390][ T3280] bridge0: port 1(bridge_slave_0) entered disabled state [ 1682.612913][T32094] hub 8-0:1.0: USB hub found [ 1682.619365][T32094] hub 8-0:1.0: 1 port detected [ 1682.700666][T32093] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8256'. [ 1682.948214][T32101] fuse: Bad value for 'fd' [ 1683.400691][ T3280] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1683.433700][ T3280] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1683.467268][ T3280] bond0 (unregistering): Released all slaves [ 1683.514770][ T5270] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1683.668104][ T3280] tipc: Left network mode [ 1683.933183][T31780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1686.917175][ T3280] hsr_slave_0: left promiscuous mode [ 1686.945500][ T3280] hsr_slave_1: left promiscuous mode [ 1687.075184][T32155] hub 8-0:1.0: USB hub found [ 1687.081718][T32155] hub 8-0:1.0: 1 port detected [ 1687.300516][ T3280] veth1_macvtap: left promiscuous mode [ 1687.455781][ T3280] veth0_macvtap: left promiscuous mode [ 1687.599130][ T3280] veth1_vlan: left promiscuous mode [ 1687.734769][ T3280] veth0_vlan: left promiscuous mode [ 1690.293745][ T3280] team0 (unregistering): Port device team_slave_1 removed [ 1690.345470][ T3280] team0 (unregistering): Port device team_slave_0 removed [ 1691.836773][ T5270] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1692.219081][T31780] veth0_vlan: entered promiscuous mode [ 1692.280184][T31780] veth1_vlan: entered promiscuous mode [ 1692.378319][T31780] veth0_macvtap: entered promiscuous mode [ 1692.421683][T31780] veth1_macvtap: entered promiscuous mode [ 1692.502013][T31780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1692.576599][T31780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1692.701975][T30023] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1692.876667][ T1165] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1693.079632][T23792] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1693.297214][T27117] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1693.566592][T23792] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1693.623421][T23792] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1693.817901][T23792] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1693.853693][T23792] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1694.364681][T32274] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8160'. [ 1695.106879][T32274] bridge0: port 2(bridge_slave_1) entered disabled state [ 1695.114610][T32274] bridge0: port 1(bridge_slave_0) entered disabled state [ 1695.268146][T32274] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1695.280446][T32274] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1695.544598][T30094] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1695.641624][T32048] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1695.705020][T32048] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1695.744632][T32048] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1695.825574][ T5270] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1697.685491][T32335] syzkaller0: entered promiscuous mode [ 1697.702227][T32335] syzkaller0: entered allmulticast mode [ 1697.702620][ T10] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 1697.804689][T32308] syz.1.8298 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 1697.867707][T32308] CPU: 1 UID: 0 PID: 32308 Comm: syz.1.8298 Tainted: G L syzkaller #0 PREEMPT(full) [ 1697.867746][T32308] Tainted: [L]=SOFTLOCKUP [ 1697.867756][T32308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1697.867772][T32308] Call Trace: [ 1697.867782][T32308] [ 1697.867792][T32308] dump_stack_lvl+0xe8/0x150 [ 1697.867839][T32308] dump_header+0xd3/0x4b0 [ 1697.867873][T32308] oom_kill_process+0x3ab/0x970 [ 1697.867905][T32308] out_of_memory+0x1064/0x1480 [ 1697.867927][T32308] ? try_charge_memcg+0xbca/0x1590 [ 1697.867962][T32308] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1697.868007][T32308] ? __pfx_out_of_memory+0x10/0x10 [ 1697.868045][T32308] ? do_raw_spin_unlock+0xf5/0x210 [ 1697.868085][T32308] try_charge_memcg+0xc74/0x1590 [ 1697.868124][T32308] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1697.868168][T32308] ? __pfx_try_charge_memcg+0x10/0x10 [ 1697.868210][T32308] ? percpu_ref_tryget+0x15/0x180 [ 1697.868249][T32308] ? __memcg_slab_post_alloc_hook+0x710/0xf10 [ 1697.868285][T32308] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1697.868318][T32308] ? __memcg_slab_post_alloc_hook+0x710/0xf10 [ 1697.868350][T32308] ? __memcg_slab_post_alloc_hook+0x710/0xf10 [ 1697.868383][T32308] __memcg_slab_post_alloc_hook+0x909/0xf10 [ 1697.868437][T32308] kmem_cache_alloc_noprof+0x350/0x5f0 [ 1697.868468][T32308] ? kmem_cache_alloc_noprof+0x150/0x5f0 [ 1697.868495][T32308] ? alloc_empty_file+0x5b/0x1d0 [ 1697.868526][T32308] ? alloc_empty_file+0x5b/0x1d0 [ 1697.868566][T32308] alloc_empty_file+0x5b/0x1d0 [ 1697.868600][T32308] path_openat+0x8f/0x3830 [ 1697.868644][T32308] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1697.868673][T32308] ? kasan_save_track+0x4f/0x80 [ 1697.868705][T32308] ? kasan_save_track+0x3e/0x80 [ 1697.868739][T32308] ? __kasan_slab_alloc+0x6c/0x80 [ 1697.868772][T32308] ? kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 1697.868800][T32308] ? do_getname+0x2e/0x250 [ 1697.868833][T32308] ? do_sys_openat2+0xcc/0x200 [ 1697.868863][T32308] ? __x64_sys_openat+0x138/0x170 [ 1697.868893][T32308] ? do_syscall_64+0x174/0x580 [ 1697.868929][T32308] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1697.868964][T32308] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1697.868994][T32308] ? __lock_acquire+0x683/0x2cf0 [ 1697.869041][T32308] do_file_open+0x23e/0x4a0 [ 1697.869087][T32308] ? __pfx_do_file_open+0x10/0x10 [ 1697.869151][T32308] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1697.869180][T32308] ? _raw_spin_unlock+0x28/0x50 [ 1697.869209][T32308] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1697.869238][T32308] ? alloc_fd+0x651/0x6c0 [ 1697.869283][T32308] do_sys_openat2+0x115/0x200 [ 1697.869315][T32308] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1697.869344][T32308] ? __se_sys_futex+0x3a8/0x450 [ 1697.869384][T32308] ? __pfx_do_sys_openat2+0x10/0x10 [ 1697.869424][T32308] ? rcu_is_watching+0x15/0xb0 [ 1697.869463][T32308] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1697.869498][T32308] __x64_sys_openat+0x138/0x170 [ 1697.869535][T32308] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1697.869563][T32308] do_syscall_64+0x174/0x580 [ 1697.869596][T32308] ? trace_irq_disable+0x3b/0x140 [ 1697.869633][T32308] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1697.869658][T32308] RIP: 0033:0x7fed6f59e0d9 [ 1697.869682][T32308] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1697.869703][T32308] RSP: 002b:00007fed6d7d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1697.869731][T32308] RAX: ffffffffffffffda RBX: 00007fed6f826090 RCX: 00007fed6f59e0d9 [ 1697.869750][T32308] RDX: 0000000000129c81 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 1697.869769][T32308] RBP: 00007fed6f635024 R08: 0000000000000000 R09: 0000000000000000 [ 1697.869785][T32308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1697.869802][T32308] R13: 00007fed6f826128 R14: 00007fed6f826090 R15: 00007ffc0e7c9368 [ 1697.869849][T32308] [ 1698.261466][ T10] usb 8-1: Using ep0 maxpacket: 8 [ 1698.330595][T32308] memory: usage 0kB, limit 0kB, failcnt 55 [ 1698.336492][T32308] memory+swap: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1698.346867][T32308] kmem: usage 0kB, limit 9007199254740988kB, failcnt 0 [ 1698.353838][T32308] Memory cgroup stats for /syz1/test: [ 1698.354130][T32308] cache 0 [ 1698.362543][T32308] rss 0 [ 1698.365309][T32308] rss_huge 0 [ 1698.368482][T32308] shmem 0 [ 1698.371423][T32308] mapped_file 0 [ 1698.374862][T32308] dirty 0 [ 1698.377772][T32308] writeback 0 [ 1698.381029][T32308] workingset_refault_anon 0 [ 1698.385533][T32308] workingset_refault_file 0 [ 1698.390010][T32308] swap 0 [ 1698.392878][T32308] swapcached 0 [ 1698.396227][T32308] pgpgin 0 [ 1698.399224][T32308] pgpgout 0 [ 1698.402346][T32308] pgfault 0 [ 1698.405452][T32308] pgmajfault 0 [ 1698.408797][T32308] inactive_anon 0 [ 1698.412441][T32308] active_anon 0 [ 1698.415877][T32308] inactive_file 0 [ 1698.419487][T32308] active_file 0 [ 1698.422950][T32308] unevictable 0 [ 1698.426386][T32308] hierarchical_memory_limit 0 [ 1698.431654][T32308] hierarchical_memsw_limit 9223372036854771712 [ 1698.437791][T32308] total_cache 0 [ 1698.441225][T32308] total_rss 0 [ 1698.444860][T32308] total_rss_huge 0 [ 1698.448559][T32308] total_shmem 0 [ 1698.452048][T32308] total_mapped_file 0 [ 1698.456009][T32308] total_dirty 0 [ 1698.459442][T32308] total_writeback 0 [ 1698.463291][T32308] total_workingset_refault_anon 0 [ 1698.468292][T32308] total_workingset_refault_file 0 [ 1698.473328][T32308] total_swap 0 [ 1698.476682][T32308] total_swapcached 0 [ 1698.480550][T32308] total_pgpgin 0 [ 1698.500310][T32308] total_pgpgout 0 [ 1698.503967][T32308] total_pgfault 0 [ 1698.507579][T32308] total_pgmajfault 0 [ 1698.511530][T32308] total_inactive_anon 0 [ 1698.515667][T32308] total_active_anon 0 [ 1698.519622][T32308] total_inactive_file 0 [ 1698.523776][T32308] total_active_file 0 [ 1698.527731][T32308] total_unevictable 0 [ 1698.532625][T32308] anon_cost 0 [ 1698.535893][T32308] file_cost 0 [ 1698.539152][T32308] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1/test,task_memcg=/syz1/test,task=syz.1.8298,pid=32282,uid=0 [ 1698.555038][T32308] Memory cgroup out of memory: Killed process 32308 (syz.1.8298) total-vm:104564kB, anon-rss:12912kB, file-rss:23180kB, shmem-rss:0kB, UID:0 pgtables:156kB oom_score_adj:1000 [ 1698.666835][ T10] usb 8-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1698.677128][ T10] usb 8-1: config 0 has no interfaces? [ 1698.683014][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1698.922823][ T10] usb 8-1: config 0 descriptor?? [ 1699.288989][ T5270] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1701.469553][ T30] audit: type=1800 audit(1786567862.214:706): pid=32373 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.8325" name="nexus" dev="configfs" ino=98124 res=0 errno=0 [ 1701.664824][T32378] usb 8-1: USB disconnect, device number 2 [ 1701.738818][T32378] hub 8-0:1.0: USB hub found [ 1701.746485][T32378] hub 8-0:1.0: 1 port detected [ 1702.641500][ T9357] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 1702.948207][T32387] [ 1702.950567][T32387] ====================================================== [ 1702.957575][T32387] WARNING: possible circular locking dependency detected [ 1702.964590][T32387] syzkaller #0 Tainted: G L [ 1702.970566][T32387] ------------------------------------------------------ [ 1702.977573][T32387] syz.3.8329/32387 is trying to acquire lock: [ 1702.983637][T32387] ffffffff8f9eb2a8 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5f0/0x950 [ 1702.993395][T32387] [ 1702.993395][T32387] but task is already holding lock: [ 1703.000749][T32387] ffff88802ad5c600 (&sb->s_type->i_mutex_key#37){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 1703.010434][T32387] [ 1703.010434][T32387] which lock already depends on the new lock. [ 1703.010434][T32387] [ 1703.020834][T32387] [ 1703.020834][T32387] the existing dependency chain (in reverse order) is: [ 1703.029843][T32387] [ 1703.029843][T32387] -> #2 (&sb->s_type->i_mutex_key#37){++++}-{4:4}: [ 1703.038554][T32387] down_write+0x96/0x200 [ 1703.043339][T32387] configfs_depend_item_unlocked+0x153/0x420 [ 1703.049836][T32387] usbg_make_tpg+0x1f6/0x590 [ 1703.054947][T32387] target_fabric_make_tpg+0xa8/0x6d0 [ 1703.060756][T32387] configfs_mkdir+0x4f6/0x9e0 [ 1703.065947][T32387] vfs_mkdir+0x406/0x620 [ 1703.070703][T32387] filename_mkdirat+0x285/0x510 [ 1703.076067][T32387] __se_sys_mkdirat+0x35/0x150 [ 1703.081351][T32387] do_syscall_64+0x174/0x580 [ 1703.086466][T32387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.092878][T32387] [ 1703.092878][T32387] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 1703.100533][T32387] __mutex_lock+0x19d/0x1550 [ 1703.105654][T32387] tcm_set_name+0x2b/0xd0 [ 1703.110507][T32387] function_make+0x1a8/0x360 [ 1703.115623][T32387] configfs_mkdir+0x4f6/0x9e0 [ 1703.120818][T32387] vfs_mkdir+0x406/0x620 [ 1703.125573][T32387] filename_mkdirat+0x285/0x510 [ 1703.130937][T32387] __se_sys_mkdirat+0x35/0x150 [ 1703.136217][T32387] do_syscall_64+0x174/0x580 [ 1703.141337][T32387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.147753][T32387] [ 1703.147753][T32387] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 1703.156012][T32387] __lock_acquire+0x1520/0x2cf0 [ 1703.161390][T32387] lock_acquire+0x106/0x350 [ 1703.166416][T32387] __mutex_lock+0x19d/0x1550 [ 1703.171530][T32387] configfs_rmdir+0x5f0/0x950 [ 1703.176893][T32387] vfs_rmdir+0x3e6/0x6a0 [ 1703.181651][T32387] filename_rmdir+0x292/0x520 [ 1703.186840][T32387] __se_sys_rmdir+0x2e/0x140 [ 1703.191943][T32387] do_syscall_64+0x174/0x580 [ 1703.197057][T32387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.203463][T32387] [ 1703.203463][T32387] other info that might help us debug this: [ 1703.203463][T32387] [ 1703.213676][T32387] Chain exists of: [ 1703.213676][T32387] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#37 [ 1703.213676][T32387] [ 1703.228383][T32387] Possible unsafe locking scenario: [ 1703.228383][T32387] [ 1703.235816][T32387] CPU0 CPU1 [ 1703.241171][T32387] ---- ---- [ 1703.246525][T32387] lock(&sb->s_type->i_mutex_key#37); [ 1703.251991][T32387] lock(&opts->dep_lock); [ 1703.258920][T32387] lock(&sb->s_type->i_mutex_key#37); [ 1703.266905][T32387] lock(gadget_subsys.su_mutex); [ 1703.271927][T32387] [ 1703.271927][T32387] *** DEADLOCK *** [ 1703.271927][T32387] [ 1703.280051][T32387] 3 locks held by syz.3.8329/32387: [ 1703.285234][T32387] #0: ffff88801d758450 (sb_writers#21){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 1703.294502][T32387] #1: ffff888079262740 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x1cd/0x520 [ 1703.305864][T32387] #2: ffff88802ad5c600 (&sb->s_type->i_mutex_key#37){++++}-{4:4}, at: vfs_rmdir+0xf8/0x6a0 [ 1703.315995][T32387] [ 1703.315995][T32387] stack backtrace: [ 1703.321876][T32387] CPU: 1 UID: 0 PID: 32387 Comm: syz.3.8329 Tainted: G L syzkaller #0 PREEMPT(full) [ 1703.321909][T32387] Tainted: [L]=SOFTLOCKUP [ 1703.321918][T32387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1703.321933][T32387] Call Trace: [ 1703.321944][T32387] [ 1703.321955][T32387] dump_stack_lvl+0xe8/0x150 [ 1703.321992][T32387] print_circular_bug+0x2e1/0x300 [ 1703.322034][T32387] check_noncircular+0x12e/0x150 [ 1703.322076][T32387] __lock_acquire+0x1520/0x2cf0 [ 1703.322112][T32387] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1703.322140][T32387] ? __bfs+0x153/0x290 [ 1703.322171][T32387] ? __pfx_hlock_conflict+0x10/0x10 [ 1703.322210][T32387] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1703.322238][T32387] ? check_path+0x21/0x40 [ 1703.322272][T32387] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1703.322299][T32387] ? check_noncircular+0xda/0x150 [ 1703.322339][T32387] ? configfs_rmdir+0x5f0/0x950 [ 1703.322360][T32387] lock_acquire+0x106/0x350 [ 1703.322390][T32387] ? configfs_rmdir+0x5f0/0x950 [ 1703.322415][T32387] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1703.322447][T32387] __mutex_lock+0x19d/0x1550 [ 1703.322480][T32387] ? configfs_rmdir+0x5f0/0x950 [ 1703.322507][T32387] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1703.322535][T32387] ? reacquire_held_locks+0x104/0x190 [ 1703.322570][T32387] ? configfs_rmdir+0x5f0/0x950 [ 1703.322591][T32387] ? fast_dput+0x29c/0x670 [ 1703.322622][T32387] ? __pfx___mutex_lock+0x10/0x10 [ 1703.322666][T32387] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1703.322694][T32387] ? _raw_spin_unlock+0x28/0x50 [ 1703.322721][T32387] ? fast_dput+0x469/0x670 [ 1703.322753][T32387] configfs_rmdir+0x5f0/0x950 [ 1703.322782][T32387] vfs_rmdir+0x3e6/0x6a0 [ 1703.322805][T32387] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1703.322836][T32387] filename_rmdir+0x292/0x520 [ 1703.322863][T32387] ? __pfx_filename_rmdir+0x10/0x10 [ 1703.322890][T32387] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1703.322918][T32387] ? do_getname+0x151/0x250 [ 1703.322946][T32387] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.322971][T32387] __se_sys_rmdir+0x2e/0x140 [ 1703.322995][T32387] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.323020][T32387] do_syscall_64+0x174/0x580 [ 1703.323053][T32387] ? trace_irq_disable+0x3b/0x140 [ 1703.323085][T32387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.323110][T32387] RIP: 0033:0x7f991cd9e0d9 [ 1703.323132][T32387] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1703.323152][T32387] RSP: 002b:00007f991dcce028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 1703.323177][T32387] RAX: ffffffffffffffda RBX: 00007f991d025fa0 RCX: 00007f991cd9e0d9 [ 1703.323196][T32387] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000340 [ 1703.323211][T32387] RBP: 00007f991ce35024 R08: 0000000000000000 R09: 0000000000000000 [ 1703.323227][T32387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1703.323241][T32387] R13: 00007f991d026038 R14: 00007f991d025fa0 R15: 00007ffd56269508 [ 1703.323269][T32387] [ 1704.821302][T32325] Set syz1 is full, maxelem 65536 reached