last executing test programs: 819.85764ms ago: executing program 0 (id=1): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) r0 = getpid() sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000001700)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000200)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) bind$unix(r3, &(0x7f0000000180)=@file={0x1, './file1\x00'}, 0x6e) syz_usb_disconnect(0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1e, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x39}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) 703.596993ms ago: executing program 3 (id=4): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x10, 0x3, 0x288, 0x0, 0x160, 0x160, 0x0, 0x0, 0x1b8, 0x280, 0x280, 0x1b8, 0x1c0, 0x3, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x22}, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, [0xff, 0xff, 0xffffff00, 0xff], [0xff000000, 0xffffff00, 0xff000000, 0xd77f34f63d84d220], 'bridge_slave_1\x00', 'vlan0\x00', {}, {}, 0x0, 0x5, 0x5}, 0x0, 0xa8, 0xe8, 0x0, {0x0, 0xa4}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x1, 0x90, {0xffffffffffff0000}}}}, {{@ipv6={@loopback, @mcast2, [0xff, 0xff000000, 0xffffffff, 0x5df796c821d44b05], [0x0, 0xff000000, 0xff, 0xff], 'ipvlan0\x00', 'dvmrp1\x00', {}, {}, 0x1d, 0x5, 0x5, 0x20}, 0x0, 0xa8, 0xd0}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x5}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2e8) syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000002f40)={[{@nobarrier}, {@dioread_lock}, {@barrier_val={'barrier', 0x3d, 0x4}}, {@nolazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x10}}, {@bh}, {@init_itable}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x1395439, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) open(&(0x7f00000001c0)='./file2\x00', 0xe6c42, 0x20) 659.546584ms ago: executing program 1 (id=2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="083c86dd0001110004600000a60c6eec00be000000000000000000000000aaff02000000000000000000000000000100000000000000a410e8"], 0xfdef) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0x4d, 0xa, 0xa, 0x0, 0x0, 0x71, 0x10, 0x11}}, &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1}, 0x94) 597.734005ms ago: executing program 4 (id=5): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1900000004000000080000000800000000000000", @ANYRES32, @ANYBLOB="00000000000000000000000000ff0100000000001342ed936e6a0dd08cddea791b414c11012299070cb9b91cd7473e6db0bbcb5e5e83d72cd629a6113b92147096319235ba161ae10c22407b7d1e9ecf667132e667bc0c9fb30f13c502f2e2e4e8ffeae60d8c326fe045c2290aac9fe30e6feac4342c59952b0ad29461554aac5dbb07b526fb4961bed048230e559f21fb", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) syz_mount_image$f2fs(&(0x7f0000005700), &(0x7f0000000680)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="636865636b706f696e743d64697361626c652c6a71666d743d7666736f6c642c7573726a71756f74613d6e6f696e6c696e650700000074727bbd0426b776aa2dd559defbabe1bb7c2990cf2327e9af29b6214ca1a0f50decac5eab7e9507cc6949f5ddd3e28e8b57ddee3b3e5d8d0f008c19753fb6357ce5402421cdf43ebd58fe035a2c7265737569643d", @ANYRES16, @ANYRESHEX], 0xfd, 0x554e, &(0x7f000000b080)="$eJzs3E1vG1UXAODjpGnTj7dvhFiw60gVUiLVVp1+CHYFWvEhWlUFFqzAsV3Lre2JYtcNXXXBErHgnyCQWLHkN7BgzQ6xALFDAnnuuDRQpEpxYpI8jzQ+M3euz5xrRZHOjOUAjqyV7LdfKnE2TkbEYkSciSj2K+VWuJbCSxFxLiIWntoq5fiTgeMRcSoizk6Sp5yV8tQXF8bnr/z8zq/ffn/i2Okvv/lhfqsG5u3liOhvpv2H/RTzTor3yvHGuFvE/uVxGdOJ3nI638/T+MP2RpHhYWM6r1HES500P998MJzEu71GcxI73bvF+OYgXXA47kzzFG+419gqjlvtjSJ2h3kRO4/Sdbcfpf9tj4ajlKdV5vukSB+j0TSm8fZ2O61n834Rm4NROZ7y5q329iSOy1heLpp5r1XUsbGLD/o/7t3u4MF2Nm5vDbv5ILtSq79Sq1+t1rfyVnvUvlxt9FtXL2ernd5kWnXUbvSvdfK802vXmnl/LVvtNJvVej1bvd7e6DYGWb1eu1S7WL2yVu5dyN689UHWa2Wrk/h6d/Bg1O0Ns7v5VpbesZat1y69upadr2fv3byd3b5z48bN2+9/dP3DW6/dfPuNctLxstZqvfK4KCtbXb+4vl6tX6yu19cO//qflPVpWfQM1w+7Upl3AQAHj/4fmId/9v/Lz93/9++Xx8/s/7fuROx9/x/6/5k4UP3vtKyj2v/vwfphV/T/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABH1o9LX71V7Kyk49Pl+P/KoRfK40pELETEH8+wGMd35Fws8yz9y/ylv9XwXSWKDJNrnCi3UxFxrdx+//9efwoAAABweH39+NznqVtPLyvzLoj9lG7aLJz5eEb5liNiaeWnGWVbmLy8OKNkxd/3sdieUbbiBtbyjJKlW27HZpXtuSzuCMtPhUoKC/taDgAAsC92dgL724UAAACwnz6bdwHMRyWmjzKnz4KLb97/9UDw5I4jAAAA4ACqzLsAAAAAYM8V/b/f/wMAAIDDLf3+HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Cc795OzNBDGAfht+Sr4LxLjwp1XcQfH8AguXRoO4CU4gAvO4AU4A+48gqGGzohgWGA6beOX50nK0An8mCGweGeSAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCF9b3ZNfH73pW/Ose2nzGwAAACAWw7Nbt09Wab757n/Ze56ne+riKgjon2bOy5q91k8ucqc5Zzmz8u+Xtb6zV9j+BbRJZw+Y56vZxHxPl8/Xw35DQAAAMDjtt9sV6laTw/LqQfEmNKiTf3iQ6G8KiKa5Y9CafUp702hsO73/RCfCqV1C1iLQmFpye2hVNpdur/7edVucdFUqalvvu08yGJzBwAARjS7asatQgAAABjTx6kHwDSq+L2Ved4KnKcmb+89vboDAAAA/kPV1AMAAAAABtfV//98/t8Nd5z/1zr/DwAAAKaRzv8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgSIdmt95vtqu+Oce2nzKzAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBf7M87CoRAGITB3vWdydz/sNKgqalJFQgff2MwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDmd3/5PzE1ziRzr42l55Fk7dTYOjX2zo2jP4yvXwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCxPy8pDMNADEBVt81nF3z/wwaB7xAC74GNbDGLAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN7os05Gr1+Sb3+u9RgN/1YzydaqYW/VcHSg4ezAfHobAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuNm5n9Y4yjAA4M/u7GxNqxij5BARBQ96sem2tvYmHpTgwY8ghHRbo1v/tDnYUsRcvEnOvYgeRQQl3vodem6hl3rrIYcK4nFl/iXTNuImtDPb5PeDd95nhsm8zzsLIc+8kwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgMrWeztxkm1mi7hbHrt1/9pK1t9+qM/c2LizkLUs7jSZ9NPhlfpOZ769RAAAADg8kqq+j4i76eZS1ndn8/o/rc7Jav4fnyviqp5/uO6v+qr2z9ofv997aXug2WKc7KLnV0fDE4+m0ntys5xuz//vGb38zufPXpL8A+l+uP7iVprfz873N2++38/DI01kCwDsx/GqL4Pq76GsH7SZGACHRq9WeFf1fzLbbk4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATdhaj2NV3ImIhd5OnLl9/9rKbv2NjTsLVTtz/fpGfLtzzewSaUScXx0NTzQ6m+l2+crVz5ZHo+GlxxDMlNec8KdejYjHOPqegnerVD+e4OSIFjLcT/DPEx6i1/YE9xd0yw97WvJpPUhigpNb+oUEAMCBlZYtq+vvpptL2bHOXMT4pwfr/zdqcUxY/9/75Myt+lj1+n/Q2Ayn3+LaxS8XL1+5+tbqxeULwwvDz98+OXhncOrs6dNnF/NnJYuemAAAALBn4/F4vL3TL1tW1ydl/d+de3T9/2gtjgnr/69+GHxTHzhR/+9qZ9Gv7UwAAAAOtxde+/uvzi7HO/1+fL28tnZpUGy3908W2xZS3bMjZauv/ydzbWcFAAAANGFrvfPA+v+5WhwTrv8/+/PLv9avmUTETLn+f3zli9G55qYz1Zr4l+O25wgAAEC7ZspWX/9P8/f/u9uvPHQj4s3Xi7j4GsBjEfHf9X9a1v/JB9/9Uh+r/v7/qSYnOU3KL+jrzhf3I+/nI3rzbScGAADAQfZM2bJi/890c+nT345+1Pf+PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDT/g0AAP//3hkvlw==") close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_mount_image$msdos(&(0x7f0000000180), &(0x7f0000000040)='.\x00', 0x18920f4, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, &(0x7f0000000100)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0xc4) pwrite64(r1, &(0x7f0000000100)='\n', 0x1, 0x8000c5b) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x181441, 0x148) fallocate(r2, 0x20, 0x4000, 0x8000) syz_clone3(&(0x7f0000001b80)={0x269084000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)=0x0, {0x36}, &(0x7f0000000a40)=""/4096, 0x1000, &(0x7f0000001a40)=""/227, &(0x7f0000001b40)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) sched_setscheduler(r3, 0x0, &(0x7f0000001c00)=0x2) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020752500000000002020206b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000000000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x412, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$F2FS_IOC_DEFRAGMENT(r4, 0xc010f508, &(0x7f00000000c0)={0x94, 0xb56c}) 269.181433ms ago: executing program 2 (id=3): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000280)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) ioperm(0x2, 0x7ff, 0x8) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0) ioperm(0x9, 0x6, 0x0) 109.964048ms ago: executing program 1 (id=6): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f00000003c0)=0x5) madvise(&(0x7f0000498000/0x2000)=nil, 0x2000, 0x17) futex(&(0x7f0000004000)=0x8007, 0x4, 0x0, 0x0, 0x0, 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x841, 0x0) sendfile(r1, r0, 0x0, 0x2000000000051b7) 102.153997ms ago: executing program 2 (id=7): syz_usb_connect$uac2(0x2, 0x87, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0xd8c, 0x14, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x75, 0x3, 0x1, 0x84, 0x80, 0x2, {0x8, 0xb, 0x1, 0x1, 0x1, 0xff, 0x20, 0xfe}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xffff, 0xff, 0x15, 0x2}, [@output_terminal={0xc, 0x24, 0x3, 0x1, 0x101, 0xfc, 0x2, 0x1, 0xb61, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x6, 0x6, 0x26, {0x8, 0x25, 0x1, 0x81, 0xc, 0x83, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x12, 0x8c, 0x5, {0x8, 0x25, 0x1, 0x80, 0x3c, 0x2, 0x85}}}}}}}}]}}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @local, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x2, @local, @remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @remote}}}}, 0x0) 9.11594ms ago: executing program 1 (id=8): syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000002040)='net/tcp\x00') read$FUSE(r1, &(0x7f0000000000)={0x2020}, 0x96) close(r0) read$FUSE(r1, &(0x7f0000004440)={0x2020}, 0x2020) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x2, 0x7, @rand_addr=' \x01\x00', 0x7}, 0x1c) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000022, 0x0, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='reno', 0x4) sendto$inet6(r3, &(0x7f0000000180)="d9", 0x1, 0x1340ae453ecab964, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) timerfd_create(0x8, 0x0) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f00000004c0)={0x0, 0x3, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, 0x10) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) getsockname$inet6(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r7, 0x1, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x7fff, r6, &(0x7f0000000140)="b7", 0x1, 0x0, 0x0, 0x2}]) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0x7, &(0x7f0000000000)={0x7fffffff, 0x7, 0x8, 0xc}, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x0) shutdown(r3, 0x1) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000240)=[@text64={0x40, 0x0}], 0x1, 0x22, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000dc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x200010, &(0x7f0000000b80), 0x1, 0x474, &(0x7f0000000500)="$eJzs3MtvG0UYAPBvN3bSJwmoPPoAAgVR8UiatJQeuIBA4gASEhzKMSRpVZo2qAkSrSoICJUjqsQdcUTiL+AEFwScKnGFO6pUoV5aOBmtvds4juPGxqmT+veTNp7ZR2Y+7856ZidOAH1rNPuRROyKiD8iYriWXbnDaO3l1o1L0//cuDSdRKXyzt9Jdb+bNy5NF7sWx+0sMqWI9Isk9jcpd+HCxTNTc3Oz5/P8+OLZD8cXLlx84fTZqVOzp2bPTR4/fvTIxEvHJl9sXvHt7cWZxXVz3yfzB/a+8d6Vt6ZPXHn/1++TIv6GOLpktNXGpyuVLhfXW7vr0kmp+rLUs8qwbgO1ZhrlavsfjoEo3d42HK9/3tPKARuqUqlUHlq9Or+Fx1IFuIcl0esaAL1RfOBn499iuZv9j167/kptAJTFfStfaltKkUbtOUa5YXzbTaMRcWLp32+yJdp/DrFtg6oFANzDfsz6P8836/+lUf9c6L58DmUkIu6PiAci4lhE7ImIByOq+z4cEY+0WX7jJElW/sqZkfRaZ5GtT9b/ezmf28qW8nK5RWJkIM/trsZfTk6enps9nL8nh6I8lOUnWpTx02u/f7XWtvr+X7ZkdSj6gnk9rpWGVh4zM7U41XHADa5/FrGvtBz/cv83uT0TkETE3ojY12EZp5/97sBa2+4cfwulDitUp/JtxDO1878UDfEXktbzk+PbYm728HhxVaz229XLb69V/v+Kvwuy878jmp//3EhSP1+70H4Zl//8cs0xzYr4i+HMqus/WRqqG+xk1/9g8u6K3/Px1OLi+YmIweTNWqXr10827De5vH8W/6GDefyD9fGn1Xtc8U7sj4jsIn40Ih6LiMfzuj8REU9GxMEW8f/y6lMf3Dn+ytDq87/xw7ss/pm2zv9yYjAa1zRPDJz5+YcVhY40i7/V/e9oNXUoX7OO+9/V9dSrs6sZAAAAtp40InZFko7dTqfp2Fjtb/j3xI50bn5h8bmT8x+dm6l9R2AkymnxpGu47nnoRD6sL/KTDfkj+XPjrwe2V/Nj0/NzM70OHvrczjXaf+avgV7XDthwXZhHA7Yo7R/6l/YP/Uv7h/7VpP23+e91gK2q2ef/p2vuXd7QugB3V0P7N+0HfcT4H/qX9g/9S/uHvrSwPe78Jfk+SZQ7PHwwfy83RxR3KxHppqjG5k+U2z1qc1xIPb4xAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMl/AQAA//+ZdtvW") 0s ago: executing program 3 (id=9): syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @local, @void, {@arp={0x806, @ether_ipv4={0x306, 0x800, 0x6, 0x4, 0x2, @local, @remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @remote}}}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.73' (ED25519) to the list of known hosts. [ 23.661215][ T24] audit: type=1400 audit(1786210914.410:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.664472][ T271] cgroup: Unknown subsys name 'net' [ 23.684001][ T24] audit: type=1400 audit(1786210914.410:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.711370][ T24] audit: type=1400 audit(1786210914.440:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.711778][ T271] cgroup: Unknown subsys name 'devices' [ 23.851463][ T271] cgroup: Unknown subsys name 'hugetlb' [ 23.857088][ T271] cgroup: Unknown subsys name 'rlimit' [ 23.997868][ T24] audit: type=1400 audit(1786210914.740:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.021190][ T24] audit: type=1400 audit(1786210914.740:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.045964][ T24] audit: type=1400 audit(1786210914.740:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.064385][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 24.078300][ T24] audit: type=1400 audit(1786210914.820:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.104000][ T24] audit: type=1400 audit(1786210914.820:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.137443][ T24] audit: type=1400 audit(1786210914.880:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.163078][ T24] audit: type=1400 audit(1786210914.880:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 24.189276][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 24.776787][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.784008][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.791529][ T280] device bridge_slave_0 entered promiscuous mode [ 24.799321][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.806452][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.814233][ T280] device bridge_slave_1 entered promiscuous mode [ 24.871089][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.878168][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.885713][ T281] device bridge_slave_0 entered promiscuous mode [ 24.892716][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.899827][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.907189][ T281] device bridge_slave_1 entered promiscuous mode [ 24.951675][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.958746][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.966358][ T282] device bridge_slave_0 entered promiscuous mode [ 24.975764][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.982852][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.990318][ T282] device bridge_slave_1 entered promiscuous mode [ 25.027117][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.034229][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.041801][ T279] device bridge_slave_0 entered promiscuous mode [ 25.064800][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.071879][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.080214][ T279] device bridge_slave_1 entered promiscuous mode [ 25.108525][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.115668][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.123135][ T283] device bridge_slave_0 entered promiscuous mode [ 25.132457][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.139510][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.147091][ T283] device bridge_slave_1 entered promiscuous mode [ 25.220518][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.227595][ T282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.234917][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.241999][ T282] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.261578][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.268682][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.276042][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.283102][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.334859][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.342145][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.349528][ T112] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.356927][ T112] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.365074][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 25.372538][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.380091][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.388367][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.396802][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.403873][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.411485][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.429688][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.442503][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.450919][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.459064][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.466146][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.491074][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.498940][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.508661][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.515771][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.523327][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.531607][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.538660][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.556408][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.564589][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.571665][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.579101][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.587751][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.596230][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.603274][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.611279][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.619240][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.637796][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.645820][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.653939][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.683044][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.690607][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 25.707032][ T281] device veth0_vlan entered promiscuous mode [ 25.720925][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.730569][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.738905][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.747415][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.754918][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.762710][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.771708][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.780105][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.787136][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.794543][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.802867][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.809941][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 25.818714][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 25.826712][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 25.841629][ T282] device veth0_vlan entered promiscuous mode [ 25.848253][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 25.855880][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 25.863519][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 25.872099][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 25.880190][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 25.888200][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 25.896308][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 25.904541][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 25.918206][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 25.926687][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 25.938335][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 25.946722][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 25.955038][ T112] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.962103][ T112] bridge0: port 1(bridge_slave_0) entered forwarding state [ 25.970123][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 25.978396][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 25.986979][ T112] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.994068][ T112] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.002450][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 26.010101][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.017983][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.027388][ T281] device veth1_macvtap entered promiscuous mode [ 26.036209][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.044049][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.051649][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.062964][ T279] device veth0_vlan entered promiscuous mode [ 26.071645][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.079837][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.088230][ T280] device veth0_vlan entered promiscuous mode [ 26.096816][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.104412][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.125762][ T279] device veth1_macvtap entered promiscuous mode [ 26.134520][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.143050][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.151651][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.160389][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.168648][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.176936][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.185587][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 26.193698][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 26.201805][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 26.210384][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 26.218318][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.226495][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.234816][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.242546][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.250723][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.262276][ T282] device veth1_macvtap entered promiscuous mode [ 26.271558][ T280] device veth1_macvtap entered promiscuous mode [ 26.278885][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.287201][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.295527][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.303950][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.314589][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 26.323123][ T112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 26.340291][ T281] request_module fs-gadgetfs succeeded, but still no fs? [ 26.348931][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.357697][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.366375][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.375189][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.383586][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.391992][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.406243][ T283] device veth0_vlan entered promiscuous mode [ 26.412874][ T281] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 26.422929][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.431524][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.440666][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.449206][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.459514][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 26.469138][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 26.477406][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 26.485037][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 26.501684][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 26.509973][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 26.532198][ T283] device veth1_macvtap entered promiscuous mode [ 26.603940][ T305] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 26.625228][ T305] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 26.635301][ T305] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 26.674791][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 26.684502][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 26.732573][ T310] EXT4-fs (loop3): Ignoring removed bh option [ 27.001817][ T310] EXT4-fs (loop3): mounted filesystem without journal. Opts: nobarrier,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000010,bh,init_itable, [ 27.074942][ T310] EXT4-fs error (device loop3): ext4_find_dest_de:2079: inode #12: block 7: comm syz.3.4: bad entry in directory: rec_len is too small for name_len - offset=16, inode=14, rec_len=40, size=56 fake=0 [ 27.203718][ T310] EXT4-fs (loop3): Remounting filesystem read-only [ 27.211796][ T310] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2799: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 27.259725][ T280] EXT4-fs error (device loop3): ext4_read_inline_dir:1622: inode #12: block 7: comm syz-executor: path /0/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 27.324675][ T324] ================================================================== [ 27.333424][ T324] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 27.342282][ T324] Read of size 4 at addr ffff88810ee33c00 by task syz.2.3/324 [ 27.349138][ T280] EXT4-fs error (device loop3): ext4_read_inline_dir:1622: inode #12: block 7: comm syz-executor: path /0/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 27.350154][ T324] [ 27.350175][ T324] CPU: 1 PID: 324 Comm: syz.2.3 Not tainted syzkaller #0 [ 27.350181][ T324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 27.350196][ T324] Call Trace: [ 27.394821][ T324] __dump_stack+0x21/0x24 [ 27.399184][ T324] dump_stack_lvl+0x1a7/0x208 [ 27.403882][ T324] ? show_regs_print_info+0x18/0x18 [ 27.409096][ T324] ? thaw_kernel_threads+0x220/0x220 [ 27.414409][ T324] print_address_description+0x7f/0x2c0 [ 27.419970][ T324] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 27.425701][ T324] kasan_report+0x100/0x140 [ 27.430591][ T324] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 27.436346][ T324] __asan_report_load4_noabort+0x14/0x20 [ 27.442009][ T324] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 27.447612][ T324] pppol2tp_release+0x150/0x2b0 [ 27.452515][ T324] sock_close+0xb8/0x200 [ 27.456788][ T324] ? sock_mmap+0xa0/0xa0 [ 27.461159][ T324] __fput+0x2dc/0x730 [ 27.465195][ T324] ____fput+0x15/0x20 [ 27.469201][ T324] task_work_run+0x127/0x190 [ 27.473809][ T324] do_exit+0xa7c/0x24e0 [ 27.478353][ T324] ? __kasan_check_write+0x14/0x20 [ 27.483484][ T324] ? switch_fpu_return+0x19c/0x330 [ 27.488611][ T324] ? put_task_struct+0x90/0x90 [ 27.493494][ T324] ? __secure_computing+0xea/0x290 [ 27.498632][ T324] __x64_sys_exit+0x40/0x40 [ 27.503154][ T324] do_syscall_64+0x31/0x40 [ 27.507995][ T324] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.513901][ T324] RIP: 0033:0x7fccdc1c30d9 [ 27.518339][ T324] Code: Unable to access opcode bytes at RIP 0x7fccdc1c30af. [ 27.526136][ T324] RSP: 002b:00007fccdac1bef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 27.534571][ T324] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fccdc1c30d9 [ 27.540156][ T313] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 27.542586][ T324] RDX: 00007fccdac1c9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 27.558021][ T324] RBP: 00007fccdc25a024 R08: 0000000000000000 R09: 0000000000000058 [ 27.566417][ T324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 27.574589][ T324] R13: 00007fccdc44b038 R14: 00007fccdc44afa0 R15: 00007ffea5780df8 [ 27.583367][ T324] [ 27.585717][ T324] Allocated by task 323: [ 27.589974][ T324] __kasan_kmalloc+0xd4/0x100 [ 27.594677][ T324] __kmalloc+0x19f/0x330 [ 27.598943][ T324] l2tp_session_create+0x39/0xb60 [ 27.603989][ T324] pppol2tp_connect+0xbf5/0x1640 [ 27.608941][ T324] __sys_connect+0x3ce/0x450 [ 27.613552][ T324] __x64_sys_connect+0x7a/0x90 [ 27.618333][ T324] do_syscall_64+0x31/0x40 [ 27.622776][ T324] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 27.628674][ T324] [ 27.631382][ T324] Freed by task 300: [ 27.635290][ T324] kasan_set_track+0x4a/0x70 [ 27.639897][ T324] kasan_set_free_info+0x23/0x40 [ 27.644854][ T324] ____kasan_slab_free+0x125/0x160 [ 27.649991][ T324] __kasan_slab_free+0x11/0x20 [ 27.654770][ T324] slab_free_freelist_hook+0xc5/0x190 [ 27.660759][ T324] kfree+0xc0/0x270 [ 27.664590][ T324] l2tp_session_put+0xb2/0x1a0 [ 27.669370][ T324] l2tp_session_delete+0x3a9/0x4a0 [ 27.672296][ T331] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 27.674501][ T324] l2tp_tunnel_del_work+0x180/0x3d0 [ 27.674539][ T324] process_one_work+0x6fd/0xbc0 [ 27.697628][ T324] worker_thread+0xa8e/0x13c0 [ 27.702353][ T324] kthread+0x324/0x3b0 [ 27.706442][ T324] ret_from_fork+0x1f/0x30 [ 27.710863][ T324] [ 27.713213][ T324] The buggy address belongs to the object at ffff88810ee33c00 [ 27.713213][ T324] which belongs to the cache kmalloc-512 of size 512 [ 27.718430][ T331] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 27.727675][ T324] The buggy address is located 0 bytes inside of [ 27.727675][ T324] 512-byte region [ffff88810ee33c00, ffff88810ee33e00) [ 27.727680][ T324] The buggy address belongs to the page: [ 27.727742][ T324] page:ffffea00043b8c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ee30 [ 27.766672][ T324] head:ffffea00043b8c00 order:2 compound_mapcount:0 compound_pincount:0 [ 27.775600][ T324] flags: 0x4000000000010200(slab|head) [ 27.781347][ T324] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 [ 27.789426][ T331] EXT4-fs error (device loop1): ext4_find_inline_data_nolock:163: inode #15: comm syz.1.8: inline data xattr refers to an external xattr inode [ 27.789950][ T324] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 27.789955][ T324] page dumped because: kasan: bad access detected [ 27.789960][ T324] page_owner tracks the page as allocated [ 27.789978][ T324] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 313, ts 27029740797, free_ts 26971375034 [ 27.789993][ T324] prep_new_page+0x176/0x190 [ 27.790003][ T324] get_page_from_freelist+0x225f/0x23f0 [ 27.790012][ T324] __alloc_pages_nodemask+0x29a/0x640 [ 27.790020][ T324] new_slab+0x84/0x3f0 [ 27.790040][ T324] ___slab_alloc+0x2f8/0x4c0 [ 27.790048][ T324] __slab_alloc+0x63/0xa0 [ 27.790056][ T324] __kmalloc_track_caller+0x1e4/0x310 [ 27.790064][ T324] __alloc_skb+0xdc/0x520 [ 27.790075][ T324] __ipv6_ifa_notify+0x200/0xe70 [ 27.790084][ T324] addrconf_dad_completed+0x18c/0xe30 [ 27.790093][ T324] addrconf_dad_work+0xc5f/0x1480 [ 27.790102][ T324] process_one_work+0x6fd/0xbc0 [ 27.790111][ T324] worker_thread+0xa8e/0x13c0 [ 27.790120][ T324] kthread+0x324/0x3b0 [ 27.790130][ T324] ret_from_fork+0x1f/0x30 [ 27.790133][ T324] page last free stack trace: [ 27.790152][ T324] __free_pages_ok+0x80b/0x830 [ 27.790162][ T324] __free_pages+0xd8/0x390 [ 27.790171][ T324] __free_slab+0xcf/0x190 [ 27.790179][ T324] unfreeze_partials+0x150/0x180 [ 27.790214][ T324] put_cpu_partial+0xc1/0x180 [ 27.815983][ T331] EXT4-fs error (device loop1): ext4_orphan_get:1406: comm syz.1.8: couldn't read orphan inode 15 (err -117) [ 27.819737][ T324] __slab_free+0x2c9/0x3a0 [ 27.819750][ T324] ___cache_free+0x10e/0x130 [ 27.819794][ T324] qlink_free+0x50/0x90 [ 27.836011][ T331] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 27.845276][ T324] qlist_free_all+0x5f/0xb0 [ 27.845288][ T324] kasan_quarantine_reduce+0x14a/0x160 [ 27.845297][ T324] __kasan_slab_alloc+0x2f/0xe0 [ 27.845309][ T324] slab_post_alloc_hook+0x5d/0x2f0 [ 27.845319][ T324] kmem_cache_alloc_trace+0x155/0x2e0 [ 27.845330][ T324] __get_vm_area_node+0x113/0x450 [ 27.845340][ T324] __vmalloc_node_range+0xe7/0x7a0 [ 27.845349][ T324] vzalloc+0x78/0x90 [ 27.845353][ T324] [ 27.845356][ T324] Memory state around the buggy address: [ 27.845367][ T324] ffff88810ee33b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.845374][ T324] ffff88810ee33b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.845382][ T324] >ffff88810ee33c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.845386][ T324] ^ [ 27.845394][ T324] ffff88810ee33c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.845402][ T324] ffff88810ee33d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 27.845406][ T324] ================================================================== [ 27.845409][ T324] Disabling lock debugging due to kernel taint [ 28.091673][ T324] ------------[ cut here ]------------ [ 28.098001][ T324] WARNING: CPU: 1 PID: 324 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 28.113829][ T324] Modules linked in: [ 28.121238][ T324] CPU: 0 PID: 324 Comm: syz.2.3 Tainted: G B syzkaller #0 [ 28.131216][ T324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.142177][ T324] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 28.148647][ T324] Code: 5d c3 e8 8c dc 35 fd be 02 00 00 00 eb 0a e8 80 dc 35 fd be 01 00 00 00 4c 89 f7 e8 f3 32 0f fe e9 0f ff ff ff e8 69 dc 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 58 dc 35 fd 4c 89 f7 be 03 [ 28.156630][ T319] F2FS-fs (loop4): invalid crc value [ 28.170257][ T324] RSP: 0018:ffffc90007a87c40 EFLAGS: 00010293 [ 28.180918][ T324] RAX: ffffffff842ec977 RBX: ffff88810f4c2000 RCX: ffff88810d7662c0 [ 28.182029][ T319] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 10241044815247771109) [ 28.209928][ T324] RDX: 0000000000000000 RSI: 000000000b319480 RDI: 000000000c04eb7d [ 28.218606][ T324] RBP: ffffc90007a87c60 R08: 0000000000000003 R09: 0000000000000004 [ 28.226880][ T324] R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: dffffc0000000000 [ 28.235292][ T324] R13: dffffc0000000000 R14: 000000000b319480 R15: ffff88810ee33c00 [ 28.240501][ T313] usb 3-1: not running at top speed; connect to a high speed hub [ 28.244666][ T324] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 28.260452][ T324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.267275][ T324] CR2: 0000200000316030 CR3: 000000010d4c8000 CR4: 00000000003506a0 [ 28.275510][ T324] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 28.283700][ T324] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 28.292735][ T324] Call Trace: [ 28.296283][ T324] pppol2tp_release+0x150/0x2b0 [ 28.309941][ T324] sock_close+0xb8/0x200 [ 28.315163][ T324] ? sock_mmap+0xa0/0xa0 [ 28.339963][ T324] __fput+0x2dc/0x730 [ 28.344074][ T324] ____fput+0x15/0x20 [ 28.348142][ T324] task_work_run+0x127/0x190 [ 28.352865][ T324] do_exit+0xa7c/0x24e0 [ 28.357153][ T324] ? __kasan_check_write+0x14/0x20 [ 28.362642][ T324] ? switch_fpu_return+0x19c/0x330 [ 28.367847][ T324] ? put_task_struct+0x90/0x90 [ 28.370129][ T313] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 18, changing to 4 [ 28.373601][ T324] ? __secure_computing+0xea/0x290 [ 28.388921][ T324] __x64_sys_exit+0x40/0x40 [ 28.393717][ T324] do_syscall_64+0x31/0x40 [ 28.398219][ T324] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 28.404226][ T324] RIP: 0033:0x7fccdc1c30d9 [ 28.408898][ T324] Code: Unable to access opcode bytes at RIP 0x7fccdc1c30af. [ 28.416287][ T319] F2FS-fs (loop4): Cannot turn on quotas: -2 on 0 [ 28.417351][ T319] F2FS-fs (loop4): Start checkpoint disabled! [ 28.422860][ T324] RSP: 002b:00007fccdac1bef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 28.432131][ T319] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e6 [ 28.437752][ T324] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fccdc1c30d9 [ 28.454972][ T324] RDX: 00007fccdac1c9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 28.463624][ T324] RBP: 00007fccdc25a024 R08: 0000000000000000 R09: 0000000000000058 [ 28.471851][ T324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 28.486325][ T324] R13: 00007fccdc44b038 R14: 00007fccdc44afa0 R15: 00007ffea5780df8 [ 28.499696][ T324] ---[ end trace d262699ab90fb46a ]--- [ 28.532581][ T319] ====================================================== [ 28.532581][ T319] WARNING: the mand mount option is being deprecated and [ 28.532581][ T319] will be removed in v5.15! [ 28.532581][ T319] ====================================================== [ 28.561985][ T319] attempt to access beyond end of device [ 28.561985][ T319] loop4: rw=2049, want=45104, limit=40427 [ 28.573439][ T313] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40 [ 28.584111][ T319] attempt to access beyond end of device [ 28.584111][ T319] loop4: rw=2049, want=45104, limit=40427 [ 28.595969][ T313] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 28.604324][ T313] usb 3-1: Product: syz [ 28.612253][ T313] usb 3-1: Manufacturer: syz [ 28.621246][ T313] usb 3-1: SerialNumber: syz [ 28.650256][ T300] attempt to access beyond end of device [ 28.650256][ T300] loop4: rw=2049, want=45112, limit=40427 [ 28.999796][ T313] usb 3-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 29.019978][ T313] usb 3-1: unit 2 not found! [ 29.027962][ T313] usb 3-1: USB disconnect, device number 2 [ 29.034366][ T339] udevd[339]: setting owner of /dev/snd/controlC0 to uid=0, gid=29 failed: No such file or directory