From: Chenyuan Yang <chenyuan0y@gmail.com>
To: linux-btrfs@vger.kernel.org, clm@fb.com, josef@toxicpanda.com,
dsterba@suse.com
Cc: linux-kernel@vger.kernel.org, syzkaller@googlegroups.com,
Zijie Zhao <zzjas98@gmail.com>
Subject: [Linux Kernel Bug] kernel BUG in btrfs_get_root_ref (assertion failed: !anon_dev) and general protection fault in btrfs_update_reloc_root
Date: Fri, 19 Jan 2024 22:15:09 -0600 [thread overview]
Message-ID: <CALGdzuo6awWdau3X=8XK547x2vX_-VoFmH1aPsqosRTQ5WzJVA@mail.gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 2049 bytes --]
Dear Linux Kernel Developers for BTRFS,
We encountered "kernel BUG in btrfs_get_root_ref" and "general
protection fault in btrfs_update_reloc_root" when testing BTRFS with
Syzkaller and our generated specifications.
For "kernel BUG in btrfs_get_root_ref", it is an internal assertion
failure `ASSERT(!anon_dev)` in `btrfs_get_root_ref`
(https://elixir.bootlin.com/linux/latest/source/fs/btrfs/disk-io.c#L1319),
which asserts the `anno_dev` should be NULL but it is preallocated
here. I've attached the reproducible C program and report.
For "general protection fault in btrfs_update_reloc_root", it attempts
to deference the null pointer in `refcount_inc_not_zero(&root->refs)`
(https://elixir.bootlin.com/linux/latest/source/fs/btrfs/disk-io.h#L101),
which is invoked by `btrfs_update_reloc_root`
(https://elixir.bootlin.com/linux/v6.7/source/fs/btrfs/relocation.c#L926).
Here is the call trace:
```
general protection fault, probably for non-canonical address
0xdffffc00000000cd: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000668-0x000000000000066f]
[ 1904.856783][T69219] Call Trace:
[ 1904.857057][T69219] <TASK>
[1904.857312][T69219] ? show_regs (arch/x86/kernel/dumpstack.c:479)
[1904.857693][T69219] ? die_addr (arch/x86/kernel/dumpstack.c:421
arch/x86/kernel/dumpstack.c:460)
[1904.858074][T69219] ? exc_general_protection
(arch/x86/kernel/traps.c:700 arch/x86/kernel/traps.c:642)
[1904.858515][T69219] ? asm_exc_general_protection
(./arch/x86/include/asm/idtentry.h:564)
[1904.858941][T69219] ? btrfs_update_reloc_root
(./include/linux/refcount.h:162 ./include/linux/refcount.h:227
./include/linux/refcount.h:245 fs/btrfs/disk-io.h:101
fs/btrfs/relocation.c:926)
[1904.859402][T69219] ? btrfs_update_reloc_root (fs/btrfs/relocation.c:929)
```
Unfortunately, we failed to find the reproducible program for
"general protection fault in btrfs_update_reloc_root". I have attached
the report and log for it.
If you have any questions or require more information, please feel
free to contact us.
Best,
Chenyuan
[-- Attachment #2: btrfs_update_reloc_root.report --]
[-- Type: application/octet-stream, Size: 4176 bytes --]
general protection fault, probably for non-canonical address 0xdffffc00000000cd: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000668-0x000000000000066f]
CPU: 0 PID: 69219 Comm: syz-executor.0 Not tainted 6.6.0-gd2f51b3516da #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:btrfs_update_reloc_root+0x25b/0xab0 fs/btrfs/relocation.c:929
Code: 00 0f 85 51 07 00 00 48 8b 04 24 48 8b a8 38 11 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bd 6d 06 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 22 07 00 00
RSP: 0018:ffffc900197477f8 EFLAGS: 00010213
RAX: dffffc0000000000 RBX: ffff8880221e4000 RCX: ffffffff8379d4a4
RDX: 00000000000000cd RSI: ffffffff8379d4b2 RDI: 000000000000066d
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000001 R12: ffff8880221e4038
R13: ffff88806c9d6000 R14: 0000000000000002 R15: 0000000000000001
FS: 00007f80b2dba640(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1c76583000 CR3: 000000006ba98000 CR4: 0000000000350ef0
Call Trace:
<TASK>
commit_fs_roots+0x35e/0x7b0 fs/btrfs/transaction.c:1539
btrfs_commit_transaction+0x1289/0x3a30 fs/btrfs/transaction.c:2470
_btrfs_ioctl_set_received_subvol+0x7be/0xd10 fs/btrfs/ioctl.c:4019
btrfs_ioctl_set_received_subvol fs/btrfs/ioctl.c:4087 [inline]
btrfs_ioctl+0x2335/0x5cf0 fs/btrfs/ioctl.c:4654
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0xe0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f80b208fd2d
Code: c3 e8 97 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f80b2dba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f80b21cbf80 RCX: 00007f80b208fd2d
RDX: 0000000020000140 RSI: 00000000c0c89425 RDI: 0000000000000003
RBP: 00007f80b20f14a6 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f80b21cbf80 R15: 00007f80b2d9a000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:btrfs_update_reloc_root+0x25b/0xab0 fs/btrfs/relocation.c:929
Code: 00 0f 85 51 07 00 00 48 8b 04 24 48 8b a8 38 11 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bd 6d 06 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 22 07 00 00
RSP: 0018:ffffc900197477f8 EFLAGS: 00010213
RAX: dffffc0000000000 RBX: ffff8880221e4000 RCX: ffffffff8379d4a4
RDX: 00000000000000cd RSI: ffffffff8379d4b2 RDI: 000000000000066d
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000001 R12: ffff8880221e4038
R13: ffff88806c9d6000 R14: 0000000000000002 R15: 0000000000000001
FS: 00007f80b2dba640(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1aff953a80 CR3: 000000006ba98000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 00 0f add %cl,(%rdi)
2: 85 51 07 test %edx,0x7(%rcx)
5: 00 00 add %al,(%rax)
7: 48 8b 04 24 mov (%rsp),%rax
b: 48 8b a8 38 11 00 00 mov 0x1138(%rax),%rbp
12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
19: fc ff df
1c: 48 8d bd 6d 06 00 00 lea 0x66d(%rbp),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 48 89 fa mov %rdi,%rdx
31: 83 e2 07 and $0x7,%edx
34: 38 d0 cmp %dl,%al
36: 7f 08 jg 0x40
38: 84 c0 test %al,%al
3a: 0f 85 22 07 00 00 jne 0x762
[-- Attachment #3: btrfs_update_reloc_root.log --]
[-- Type: application/octet-stream, Size: 1060159 bytes --]
[-- Attachment #4: btrfs_get_root_ref-repro.report --]
[-- Type: application/octet-stream, Size: 3402 bytes --]
assertion failed: !anon_dev, in fs/btrfs/disk-io.c:1319
------------[ cut here ]------------
kernel BUG at fs/btrfs/disk-io.c:1319!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 12138 Comm: syz-executor301 Not tainted 6.6.0-gd2f51b3516da #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:btrfs_get_root_ref.part.0+0x9aa/0xa60 fs/btrfs/disk-io.c:1319
Code: ed e9 5f fd ff ff e8 c5 86 1e fe b9 27 05 00 00 48 c7 c2 40 18 37 8a 48 c7 c6 60 51 37 8a 48 c7 c7 c0 18 37 8a e8 46 ec 01 fe <0f> 0b e8 0f 86 71 fe e9 8d fb ff ff 49 c7 c5 fe ff ff ff e9 f2 fd
RSP: 0018:ffffc9000352f6e0 EFLAGS: 00010286
RAX: 0000000000000037 RBX: 000000000000003c RCX: ffffffff816673f9
RDX: 0000000000000000 RSI: ffffffff816704ce RDI: 0000000000000005
RBP: ffff888051c386e8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888051c38000 R14: ffffc9000352f758 R15: 0000000000000001
FS: 00007f69a57d8640(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffeaebee980 CR3: 000000004edfe000 CR4: 0000000000350ef0
Call Trace:
<TASK>
btrfs_get_root_ref fs/btrfs/disk-io.c:1313 [inline]
btrfs_get_new_fs_root+0xd3/0xf0 fs/btrfs/disk-io.c:1405
create_subvol+0xd02/0x1650 fs/btrfs/ioctl.c:724
btrfs_mksubvol+0xe95/0x12b0 fs/btrfs/ioctl.c:997
__btrfs_ioctl_snap_create+0x2f9/0x4f0 fs/btrfs/ioctl.c:1272
btrfs_ioctl_snap_create+0x16b/0x200 fs/btrfs/ioctl.c:1321
btrfs_ioctl+0x35f0/0x5cf0 fs/btrfs/ioctl.c:4579
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0xe0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f69a603e20d
Code: c3 e8 b7 28 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f69a57d80d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f69a60e2388 RCX: 00007f69a603e20d
RDX: 0000000020000140 RSI: 000000005000940e RDI: 0000000000000003
RBP: 00007f69a60e2380 R08: 00007f69a57d8640 R09: 0000000000000000
R10: 00007f69a57d8640 R11: 0000000000000246 R12: 00007f69a60e238c
R13: 000000000000000b R14: 00007f69a5ffec90 R15: 00007f69a57b8000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:btrfs_get_root_ref.part.0+0x9aa/0xa60 fs/btrfs/disk-io.c:1319
Code: ed e9 5f fd ff ff e8 c5 86 1e fe b9 27 05 00 00 48 c7 c2 40 18 37 8a 48 c7 c6 60 51 37 8a 48 c7 c7 c0 18 37 8a e8 46 ec 01 fe <0f> 0b e8 0f 86 71 fe e9 8d fb ff ff 49 c7 c5 fe ff ff ff e9 f2 fd
RSP: 0018:ffffc9000352f6e0 EFLAGS: 00010286
RAX: 0000000000000037 RBX: 000000000000003c RCX: ffffffff816673f9
RDX: 0000000000000000 RSI: ffffffff816704ce RDI: 0000000000000005
RBP: ffff888051c386e8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888051c38000 R14: ffffc9000352f758 R15: 0000000000000001
FS: 00007f69a57d8640(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff330201a10 CR3: 000000004edfe000 CR4: 0000000000350ef0
[-- Attachment #5: btrfs_get_root_ref-repro.cprog --]
[-- Type: application/octet-stream, Size: 189424 bytes --]
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <netinet/in.h>
#include <pthread.h>
#include <sched.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/epoll.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/swap.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/capability.h>
#include <linux/falloc.h>
#include <linux/futex.h>
#include <linux/genetlink.h>
#include <linux/if_addr.h>
#include <linux/if_ether.h>
#include <linux/if_link.h>
#include <linux/if_tun.h>
#include <linux/in6.h>
#include <linux/ip.h>
#include <linux/loop.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/nl80211.h>
#include <linux/rfkill.h>
#include <linux/rtnetlink.h>
#include <linux/tcp.h>
#include <linux/veth.h>
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif
static unsigned long long procid;
static __thread int clone_ongoing;
static __thread int skip_segv;
static __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
exit(sig);
}
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
int valid = addr < prog_start || addr > prog_end;
if (skip && valid) {
_longjmp(segv_env, 1);
}
exit(sig);
}
static void install_segv_handler(void)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_handler = SIG_IGN;
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) ({ int ok = 1; __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); if (_setjmp(segv_env) == 0) { __VA_ARGS__; } else ok = 0; __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); ok; })
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
int state;
} event_t;
static void event_init(event_t* ev)
{
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
if (ev->state)
exit(1);
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}
static void event_wait(event_t* ev)
{
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}
static int event_isset(event_t* ev)
{
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
for (;;) {
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
return 1;
now = current_time_ms();
if (now - start > timeout)
return 0;
}
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
struct nlmsg {
char* pos;
int nesting;
struct nlattr* nested[8];
char buf[4096];
};
static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
const void* data, int size)
{
memset(nlmsg, 0, sizeof(*nlmsg));
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
hdr->nlmsg_type = typ;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
memcpy(hdr + 1, data, size);
nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}
static void netlink_attr(struct nlmsg* nlmsg, int typ,
const void* data, int size)
{
struct nlattr* attr = (struct nlattr*)nlmsg->pos;
attr->nla_len = sizeof(*attr) + size;
attr->nla_type = typ;
if (size > 0)
memcpy(attr + 1, data, size);
nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
}
static void netlink_nest(struct nlmsg* nlmsg, int typ)
{
struct nlattr* attr = (struct nlattr*)nlmsg->pos;
attr->nla_type = typ;
nlmsg->pos += sizeof(*attr);
nlmsg->nested[nlmsg->nesting++] = attr;
}
static void netlink_done(struct nlmsg* nlmsg)
{
struct nlattr* attr = nlmsg->nested[--nlmsg->nesting];
attr->nla_len = nlmsg->pos - (char*)attr;
}
static int netlink_send_ext(struct nlmsg* nlmsg, int sock,
uint16_t reply_type, int* reply_len, bool dofail)
{
if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
exit(1);
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
struct sockaddr_nl addr;
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr));
if (n != (ssize_t)hdr->nlmsg_len) {
if (dofail)
exit(1);
return -1;
}
n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
if (reply_len)
*reply_len = 0;
if (n < 0) {
if (dofail)
exit(1);
return -1;
}
if (n < (ssize_t)sizeof(struct nlmsghdr)) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
if (hdr->nlmsg_type == NLMSG_DONE)
return 0;
if (reply_len && hdr->nlmsg_type == reply_type) {
*reply_len = n;
return 0;
}
if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
if (hdr->nlmsg_type != NLMSG_ERROR) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
errno = -((struct nlmsgerr*)(hdr + 1))->error;
return -errno;
}
static int netlink_send(struct nlmsg* nlmsg, int sock)
{
return netlink_send_ext(nlmsg, sock, 0, NULL, true);
}
static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail)
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = CTRL_CMD_GETFAMILY;
netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1);
int n = 0;
int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
if (err < 0) {
return -1;
}
uint16_t id = 0;
struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr)));
for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
id = *(uint16_t*)(attr + 1);
break;
}
}
if (!id) {
errno = EINVAL;
return -1;
}
recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
return id;
}
static int netlink_next_msg(struct nlmsg* nlmsg, unsigned int offset,
unsigned int total_len)
{
struct nlmsghdr* hdr = (struct nlmsghdr*)(nlmsg->buf + offset);
if (offset == total_len || offset + hdr->nlmsg_len > total_len)
return -1;
return hdr->nlmsg_len;
}
static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type,
const char* name, bool up)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
if (up)
hdr.ifi_flags = hdr.ifi_change = IFF_UP;
netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr));
if (name)
netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name));
netlink_nest(nlmsg, IFLA_LINKINFO);
netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type));
}
static void netlink_add_device(struct nlmsg* nlmsg, int sock, const char* type,
const char* name)
{
netlink_add_device_impl(nlmsg, type, name, false);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_veth(struct nlmsg* nlmsg, int sock, const char* name,
const char* peer)
{
netlink_add_device_impl(nlmsg, "veth", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_nest(nlmsg, VETH_INFO_PEER);
nlmsg->pos += sizeof(struct ifinfomsg);
netlink_attr(nlmsg, IFLA_IFNAME, peer, strlen(peer));
netlink_done(nlmsg);
netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_xfrm(struct nlmsg* nlmsg, int sock, const char* name)
{
netlink_add_device_impl(nlmsg, "xfrm", name, true);
netlink_nest(nlmsg, IFLA_INFO_DATA);
int if_id = 1;
netlink_attr(nlmsg, 2, &if_id, sizeof(if_id));
netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_hsr(struct nlmsg* nlmsg, int sock, const char* name,
const char* slave1, const char* slave2)
{
netlink_add_device_impl(nlmsg, "hsr", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
int ifindex1 = if_nametoindex(slave1);
netlink_attr(nlmsg, IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1));
int ifindex2 = if_nametoindex(slave2);
netlink_attr(nlmsg, IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2));
netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_linked(struct nlmsg* nlmsg, int sock, const char* type, const char* name, const char* link)
{
netlink_add_device_impl(nlmsg, type, name, false);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_vlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t id, uint16_t proto)
{
netlink_add_device_impl(nlmsg, "vlan", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_attr(nlmsg, IFLA_VLAN_ID, &id, sizeof(id));
netlink_attr(nlmsg, IFLA_VLAN_PROTOCOL, &proto, sizeof(proto));
netlink_done(nlmsg);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_macvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link)
{
netlink_add_device_impl(nlmsg, "macvlan", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
uint32_t mode = MACVLAN_MODE_BRIDGE;
netlink_attr(nlmsg, IFLA_MACVLAN_MODE, &mode, sizeof(mode));
netlink_done(nlmsg);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_geneve(struct nlmsg* nlmsg, int sock, const char* name, uint32_t vni, struct in_addr* addr4, struct in6_addr* addr6)
{
netlink_add_device_impl(nlmsg, "geneve", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_attr(nlmsg, IFLA_GENEVE_ID, &vni, sizeof(vni));
if (addr4)
netlink_attr(nlmsg, IFLA_GENEVE_REMOTE, addr4, sizeof(*addr4));
if (addr6)
netlink_attr(nlmsg, IFLA_GENEVE_REMOTE6, addr6, sizeof(*addr6));
netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
#define IFLA_IPVLAN_FLAGS 2
#define IPVLAN_MODE_L3S 2
#undef IPVLAN_F_VEPA
#define IPVLAN_F_VEPA 2
static void netlink_add_ipvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t mode, uint16_t flags)
{
netlink_add_device_impl(nlmsg, "ipvlan", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_attr(nlmsg, IFLA_IPVLAN_MODE, &mode, sizeof(mode));
netlink_attr(nlmsg, IFLA_IPVLAN_FLAGS, &flags, sizeof(flags));
netlink_done(nlmsg);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_device_change(struct nlmsg* nlmsg, int sock, const char* name, bool up,
const char* master, const void* mac, int macsize,
const char* new_name)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
if (up)
hdr.ifi_flags = hdr.ifi_change = IFF_UP;
hdr.ifi_index = if_nametoindex(name);
netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr));
if (new_name)
netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name));
if (master) {
int ifindex = if_nametoindex(master);
netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex));
}
if (macsize)
netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev,
const void* addr, int addrsize)
{
struct ifaddrmsg hdr;
memset(&hdr, 0, sizeof(hdr));
hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6;
hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120;
hdr.ifa_scope = RT_SCOPE_UNIVERSE;
hdr.ifa_index = if_nametoindex(dev);
netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr));
netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize);
netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize);
return netlink_send(nlmsg, sock);
}
static void netlink_add_addr4(struct nlmsg* nlmsg, int sock,
const char* dev, const char* addr)
{
struct in_addr in_addr;
inet_pton(AF_INET, addr, &in_addr);
int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr));
if (err < 0) {
}
}
static void netlink_add_addr6(struct nlmsg* nlmsg, int sock,
const char* dev, const char* addr)
{
struct in6_addr in6_addr;
inet_pton(AF_INET6, addr, &in6_addr);
int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr));
if (err < 0) {
}
}
static void netlink_add_neigh(struct nlmsg* nlmsg, int sock, const char* name,
const void* addr, int addrsize, const void* mac, int macsize)
{
struct ndmsg hdr;
memset(&hdr, 0, sizeof(hdr));
hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6;
hdr.ndm_ifindex = if_nametoindex(name);
hdr.ndm_state = NUD_PERMANENT;
netlink_init(nlmsg, RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr));
netlink_attr(nlmsg, NDA_DST, addr, addrsize);
netlink_attr(nlmsg, NDA_LLADDR, mac, macsize);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static struct nlmsg nlmsg;
static int tunfd = -1;
#define TUN_IFACE "syz_tun"
#define LOCAL_MAC 0xaaaaaaaaaaaa
#define REMOTE_MAC 0xaaaaaaaaaabb
#define LOCAL_IPV4 "172.20.20.170"
#define REMOTE_IPV4 "172.20.20.187"
#define LOCAL_IPV6 "fe80::aa"
#define REMOTE_IPV6 "fe80::bb"
#define IFF_NAPI 0x0010
static void initialize_tun(void)
{
tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK);
if (tunfd == -1) {
printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n");
printf("otherwise fuzzing or reproducing might not work as intended\n");
return;
}
const int kTunFd = 200;
if (dup2(tunfd, kTunFd) < 0)
exit(1);
close(tunfd);
tunfd = kTunFd;
struct ifreq ifr;
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ);
ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) {
exit(1);
}
char sysctl[64];
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE);
write_file(sysctl, "0");
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE);
write_file(sysctl, "0");
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
netlink_add_addr4(&nlmsg, sock, TUN_IFACE, LOCAL_IPV4);
netlink_add_addr6(&nlmsg, sock, TUN_IFACE, LOCAL_IPV6);
uint64_t macaddr = REMOTE_MAC;
struct in_addr in_addr;
inet_pton(AF_INET, REMOTE_IPV4, &in_addr);
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in_addr, sizeof(in_addr), &macaddr, ETH_ALEN);
struct in6_addr in6_addr;
inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr);
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in6_addr, sizeof(in6_addr), &macaddr, ETH_ALEN);
macaddr = LOCAL_MAC;
netlink_device_change(&nlmsg, sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN, NULL);
close(sock);
}
#define DEVLINK_FAMILY_NAME "devlink"
#define DEVLINK_CMD_PORT_GET 5
#define DEVLINK_ATTR_BUS_NAME 1
#define DEVLINK_ATTR_DEV_NAME 2
#define DEVLINK_ATTR_NETDEV_NAME 7
static struct nlmsg nlmsg2;
static void initialize_devlink_ports(const char* bus_name, const char* dev_name,
const char* netdev_prefix)
{
struct genlmsghdr genlhdr;
int len, total_len, id, err, offset;
uint16_t netdev_index;
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock == -1)
exit(1);
int rtsock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (rtsock == -1)
exit(1);
id = netlink_query_family_id(&nlmsg, sock, DEVLINK_FAMILY_NAME, true);
if (id == -1)
goto error;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = DEVLINK_CMD_PORT_GET;
netlink_init(&nlmsg, id, NLM_F_DUMP, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, DEVLINK_ATTR_BUS_NAME, bus_name, strlen(bus_name) + 1);
netlink_attr(&nlmsg, DEVLINK_ATTR_DEV_NAME, dev_name, strlen(dev_name) + 1);
err = netlink_send_ext(&nlmsg, sock, id, &total_len, true);
if (err < 0) {
goto error;
}
offset = 0;
netdev_index = 0;
while ((len = netlink_next_msg(&nlmsg, offset, total_len)) != -1) {
struct nlattr* attr = (struct nlattr*)(nlmsg.buf + offset + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr)));
for (; (char*)attr < nlmsg.buf + offset + len; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
if (attr->nla_type == DEVLINK_ATTR_NETDEV_NAME) {
char* port_name;
char netdev_name[IFNAMSIZ];
port_name = (char*)(attr + 1);
snprintf(netdev_name, sizeof(netdev_name), "%s%d", netdev_prefix, netdev_index);
netlink_device_change(&nlmsg2, rtsock, port_name, true, 0, 0, 0, netdev_name);
break;
}
}
offset += len;
netdev_index++;
}
error:
close(rtsock);
close(sock);
}
#define WIFI_INITIAL_DEVICE_COUNT 2
#define WIFI_MAC_BASE { 0x08, 0x02, 0x11, 0x00, 0x00, 0x00 }
#define WIFI_IBSS_BSSID { 0x50, 0x50, 0x50, 0x50, 0x50, 0x50 }
#define WIFI_IBSS_SSID { 0x10, 0x10, 0x10, 0x10, 0x10, 0x10 }
#define WIFI_DEFAULT_FREQUENCY 2412
#define WIFI_DEFAULT_SIGNAL 0
#define WIFI_DEFAULT_RX_RATE 1
#define HWSIM_CMD_REGISTER 1
#define HWSIM_CMD_FRAME 2
#define HWSIM_CMD_NEW_RADIO 4
#define HWSIM_ATTR_SUPPORT_P2P_DEVICE 14
#define HWSIM_ATTR_PERM_ADDR 22
#define IF_OPER_UP 6
struct join_ibss_props {
int wiphy_freq;
bool wiphy_freq_fixed;
uint8_t* mac;
uint8_t* ssid;
int ssid_len;
};
static int set_interface_state(const char* interface_name, int on)
{
struct ifreq ifr;
int sock = socket(AF_INET, SOCK_DGRAM, 0);
if (sock < 0) {
return -1;
}
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, interface_name);
int ret = ioctl(sock, SIOCGIFFLAGS, &ifr);
if (ret < 0) {
close(sock);
return -1;
}
if (on)
ifr.ifr_flags |= IFF_UP;
else
ifr.ifr_flags &= ~IFF_UP;
ret = ioctl(sock, SIOCSIFFLAGS, &ifr);
close(sock);
if (ret < 0) {
return -1;
}
return 0;
}
static int nl80211_set_interface(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, uint32_t iftype)
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = NL80211_CMD_SET_INTERFACE;
netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
netlink_attr(nlmsg, NL80211_ATTR_IFTYPE, &iftype, sizeof(iftype));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
return err;
}
static int nl80211_join_ibss(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, struct join_ibss_props* props)
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = NL80211_CMD_JOIN_IBSS;
netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
netlink_attr(nlmsg, NL80211_ATTR_SSID, props->ssid, props->ssid_len);
netlink_attr(nlmsg, NL80211_ATTR_WIPHY_FREQ, &(props->wiphy_freq), sizeof(props->wiphy_freq));
if (props->mac)
netlink_attr(nlmsg, NL80211_ATTR_MAC, props->mac, ETH_ALEN);
if (props->wiphy_freq_fixed)
netlink_attr(nlmsg, NL80211_ATTR_FREQ_FIXED, NULL, 0);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
return err;
}
static int get_ifla_operstate(struct nlmsg* nlmsg, int ifindex)
{
struct ifinfomsg info;
memset(&info, 0, sizeof(info));
info.ifi_family = AF_UNSPEC;
info.ifi_index = ifindex;
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1) {
return -1;
}
netlink_init(nlmsg, RTM_GETLINK, 0, &info, sizeof(info));
int n;
int err = netlink_send_ext(nlmsg, sock, RTM_NEWLINK, &n, true);
close(sock);
if (err) {
return -1;
}
struct rtattr* attr = IFLA_RTA(NLMSG_DATA(nlmsg->buf));
for (; RTA_OK(attr, n); attr = RTA_NEXT(attr, n)) {
if (attr->rta_type == IFLA_OPERSTATE)
return *((int32_t*)RTA_DATA(attr));
}
return -1;
}
static int await_ifla_operstate(struct nlmsg* nlmsg, char* interface, int operstate)
{
int ifindex = if_nametoindex(interface);
while (true) {
usleep(1000);
int ret = get_ifla_operstate(nlmsg, ifindex);
if (ret < 0)
return ret;
if (ret == operstate)
return 0;
}
return 0;
}
static int nl80211_setup_ibss_interface(struct nlmsg* nlmsg, int sock, int nl80211_family_id, char* interface, struct join_ibss_props* ibss_props)
{
int ifindex = if_nametoindex(interface);
if (ifindex == 0) {
return -1;
}
int ret = nl80211_set_interface(nlmsg, sock, nl80211_family_id, ifindex, NL80211_IFTYPE_ADHOC);
if (ret < 0) {
return -1;
}
ret = set_interface_state(interface, 1);
if (ret < 0) {
return -1;
}
ret = nl80211_join_ibss(nlmsg, sock, nl80211_family_id, ifindex, ibss_props);
if (ret < 0) {
return -1;
}
return 0;
}
static int hwsim80211_create_device(struct nlmsg* nlmsg, int sock, int hwsim_family, uint8_t mac_addr[ETH_ALEN])
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = HWSIM_CMD_NEW_RADIO;
netlink_init(nlmsg, hwsim_family, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(nlmsg, HWSIM_ATTR_SUPPORT_P2P_DEVICE, NULL, 0);
netlink_attr(nlmsg, HWSIM_ATTR_PERM_ADDR, mac_addr, ETH_ALEN);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
return err;
}
static void initialize_wifi_devices(void)
{
int rfkill = open("/dev/rfkill", O_RDWR);
if (rfkill == -1) {
if (errno != ENOENT && errno != EACCES)
exit(1);
} else {
struct rfkill_event event = {0};
event.type = RFKILL_TYPE_ALL;
event.op = RFKILL_OP_CHANGE_ALL;
if (write(rfkill, &event, sizeof(event)) != (ssize_t)(sizeof(event)))
exit(1);
close(rfkill);
}
uint8_t mac_addr[6] = WIFI_MAC_BASE;
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock < 0) {
return;
}
int hwsim_family_id = netlink_query_family_id(&nlmsg, sock, "MAC80211_HWSIM", true);
int nl80211_family_id = netlink_query_family_id(&nlmsg, sock, "nl80211", true);
uint8_t ssid[] = WIFI_IBSS_SSID;
uint8_t bssid[] = WIFI_IBSS_BSSID;
struct join_ibss_props ibss_props = {
.wiphy_freq = WIFI_DEFAULT_FREQUENCY, .wiphy_freq_fixed = true, .mac = bssid, .ssid = ssid, .ssid_len = sizeof(ssid)};
for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) {
mac_addr[5] = device_id;
int ret = hwsim80211_create_device(&nlmsg, sock, hwsim_family_id, mac_addr);
if (ret < 0)
exit(1);
char interface[6] = "wlan0";
interface[4] += device_id;
if (nl80211_setup_ibss_interface(&nlmsg, sock, nl80211_family_id, interface, &ibss_props) < 0)
exit(1);
}
for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) {
char interface[6] = "wlan0";
interface[4] += device_id;
int ret = await_ifla_operstate(&nlmsg, interface, IF_OPER_UP);
if (ret < 0)
exit(1);
}
close(sock);
}
static int runcmdline(char* cmdline)
{
int ret = system(cmdline);
if (ret) {
}
return ret;
}
#define DEV_IPV4 "172.20.20.%d"
#define DEV_IPV6 "fe80::%02x"
#define DEV_MAC 0x00aaaaaaaaaa
static void netdevsim_add(unsigned int addr, unsigned int port_count)
{
write_file("/sys/bus/netdevsim/del_device", "%u", addr);
if (write_file("/sys/bus/netdevsim/new_device", "%u %u", addr, port_count)) {
char buf[32];
snprintf(buf, sizeof(buf), "netdevsim%d", addr);
initialize_devlink_ports("netdevsim", buf, "netdevsim");
}
}
#define WG_GENL_NAME "wireguard"
enum wg_cmd {
WG_CMD_GET_DEVICE,
WG_CMD_SET_DEVICE,
};
enum wgdevice_attribute {
WGDEVICE_A_UNSPEC,
WGDEVICE_A_IFINDEX,
WGDEVICE_A_IFNAME,
WGDEVICE_A_PRIVATE_KEY,
WGDEVICE_A_PUBLIC_KEY,
WGDEVICE_A_FLAGS,
WGDEVICE_A_LISTEN_PORT,
WGDEVICE_A_FWMARK,
WGDEVICE_A_PEERS,
};
enum wgpeer_attribute {
WGPEER_A_UNSPEC,
WGPEER_A_PUBLIC_KEY,
WGPEER_A_PRESHARED_KEY,
WGPEER_A_FLAGS,
WGPEER_A_ENDPOINT,
WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
WGPEER_A_LAST_HANDSHAKE_TIME,
WGPEER_A_RX_BYTES,
WGPEER_A_TX_BYTES,
WGPEER_A_ALLOWEDIPS,
WGPEER_A_PROTOCOL_VERSION,
};
enum wgallowedip_attribute {
WGALLOWEDIP_A_UNSPEC,
WGALLOWEDIP_A_FAMILY,
WGALLOWEDIP_A_IPADDR,
WGALLOWEDIP_A_CIDR_MASK,
};
static void netlink_wireguard_setup(void)
{
const char ifname_a[] = "wg0";
const char ifname_b[] = "wg1";
const char ifname_c[] = "wg2";
const char private_a[] = "\xa0\x5c\xa8\x4f\x6c\x9c\x8e\x38\x53\xe2\xfd\x7a\x70\xae\x0f\xb2\x0f\xa1\x52\x60\x0c\xb0\x08\x45\x17\x4f\x08\x07\x6f\x8d\x78\x43";
const char private_b[] = "\xb0\x80\x73\xe8\xd4\x4e\x91\xe3\xda\x92\x2c\x22\x43\x82\x44\xbb\x88\x5c\x69\xe2\x69\xc8\xe9\xd8\x35\xb1\x14\x29\x3a\x4d\xdc\x6e";
const char private_c[] = "\xa0\xcb\x87\x9a\x47\xf5\xbc\x64\x4c\x0e\x69\x3f\xa6\xd0\x31\xc7\x4a\x15\x53\xb6\xe9\x01\xb9\xff\x2f\x51\x8c\x78\x04\x2f\xb5\x42";
const char public_a[] = "\x97\x5c\x9d\x81\xc9\x83\xc8\x20\x9e\xe7\x81\x25\x4b\x89\x9f\x8e\xd9\x25\xae\x9f\x09\x23\xc2\x3c\x62\xf5\x3c\x57\xcd\xbf\x69\x1c";
const char public_b[] = "\xd1\x73\x28\x99\xf6\x11\xcd\x89\x94\x03\x4d\x7f\x41\x3d\xc9\x57\x63\x0e\x54\x93\xc2\x85\xac\xa4\x00\x65\xcb\x63\x11\xbe\x69\x6b";
const char public_c[] = "\xf4\x4d\xa3\x67\xa8\x8e\xe6\x56\x4f\x02\x02\x11\x45\x67\x27\x08\x2f\x5c\xeb\xee\x8b\x1b\xf5\xeb\x73\x37\x34\x1b\x45\x9b\x39\x22";
const uint16_t listen_a = 20001;
const uint16_t listen_b = 20002;
const uint16_t listen_c = 20003;
const uint16_t af_inet = AF_INET;
const uint16_t af_inet6 = AF_INET6;
const struct sockaddr_in endpoint_b_v4 = {
.sin_family = AF_INET,
.sin_port = htons(listen_b),
.sin_addr = {htonl(INADDR_LOOPBACK)}};
const struct sockaddr_in endpoint_c_v4 = {
.sin_family = AF_INET,
.sin_port = htons(listen_c),
.sin_addr = {htonl(INADDR_LOOPBACK)}};
struct sockaddr_in6 endpoint_a_v6 = {
.sin6_family = AF_INET6,
.sin6_port = htons(listen_a)};
endpoint_a_v6.sin6_addr = in6addr_loopback;
struct sockaddr_in6 endpoint_c_v6 = {
.sin6_family = AF_INET6,
.sin6_port = htons(listen_c)};
endpoint_c_v6.sin6_addr = in6addr_loopback;
const struct in_addr first_half_v4 = {0};
const struct in_addr second_half_v4 = {(uint32_t)htonl(128 << 24)};
const struct in6_addr first_half_v6 = {{{0}}};
const struct in6_addr second_half_v6 = {{{0x80}}};
const uint8_t half_cidr = 1;
const uint16_t persistent_keepalives[] = {1, 3, 7, 9, 14, 19};
struct genlmsghdr genlhdr = {
.cmd = WG_CMD_SET_DEVICE,
.version = 1};
int sock;
int id, err;
sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock == -1) {
return;
}
id = netlink_query_family_id(&nlmsg, sock, WG_GENL_NAME, true);
if (id == -1)
goto error;
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_a, strlen(ifname_a) + 1);
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_a, 32);
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_a, 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[0], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v6, sizeof(endpoint_c_v6));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[1], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
err = netlink_send(&nlmsg, sock);
if (err < 0) {
}
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_b, strlen(ifname_b) + 1);
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_b, 32);
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_b, 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[2], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v4, sizeof(endpoint_c_v4));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[3], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
err = netlink_send(&nlmsg, sock);
if (err < 0) {
}
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_c, strlen(ifname_c) + 1);
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_c, 32);
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_c, 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[4], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[5], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
err = netlink_send(&nlmsg, sock);
if (err < 0) {
}
error:
close(sock);
}
static void initialize_netdevices(void)
{
char netdevsim[16];
sprintf(netdevsim, "netdevsim%d", (int)procid);
struct {
const char* type;
const char* dev;
} devtypes[] = {
{"ip6gretap", "ip6gretap0"},
{"bridge", "bridge0"},
{"vcan", "vcan0"},
{"bond", "bond0"},
{"team", "team0"},
{"dummy", "dummy0"},
{"nlmon", "nlmon0"},
{"caif", "caif0"},
{"batadv", "batadv0"},
{"vxcan", "vxcan1"},
{"veth", 0},
{"wireguard", "wg0"},
{"wireguard", "wg1"},
{"wireguard", "wg2"},
};
const char* devmasters[] = {"bridge", "bond", "team", "batadv"};
struct {
const char* name;
int macsize;
bool noipv6;
} devices[] = {
{"lo", ETH_ALEN},
{"sit0", 0},
{"bridge0", ETH_ALEN},
{"vcan0", 0, true},
{"tunl0", 0},
{"gre0", 0},
{"gretap0", ETH_ALEN},
{"ip_vti0", 0},
{"ip6_vti0", 0},
{"ip6tnl0", 0},
{"ip6gre0", 0},
{"ip6gretap0", ETH_ALEN},
{"erspan0", ETH_ALEN},
{"bond0", ETH_ALEN},
{"veth0", ETH_ALEN},
{"veth1", ETH_ALEN},
{"team0", ETH_ALEN},
{"veth0_to_bridge", ETH_ALEN},
{"veth1_to_bridge", ETH_ALEN},
{"veth0_to_bond", ETH_ALEN},
{"veth1_to_bond", ETH_ALEN},
{"veth0_to_team", ETH_ALEN},
{"veth1_to_team", ETH_ALEN},
{"veth0_to_hsr", ETH_ALEN},
{"veth1_to_hsr", ETH_ALEN},
{"hsr0", 0},
{"dummy0", ETH_ALEN},
{"nlmon0", 0},
{"vxcan0", 0, true},
{"vxcan1", 0, true},
{"caif0", ETH_ALEN},
{"batadv0", ETH_ALEN},
{netdevsim, ETH_ALEN},
{"xfrm0", ETH_ALEN},
{"veth0_virt_wifi", ETH_ALEN},
{"veth1_virt_wifi", ETH_ALEN},
{"virt_wifi0", ETH_ALEN},
{"veth0_vlan", ETH_ALEN},
{"veth1_vlan", ETH_ALEN},
{"vlan0", ETH_ALEN},
{"vlan1", ETH_ALEN},
{"macvlan0", ETH_ALEN},
{"macvlan1", ETH_ALEN},
{"ipvlan0", ETH_ALEN},
{"ipvlan1", ETH_ALEN},
{"veth0_macvtap", ETH_ALEN},
{"veth1_macvtap", ETH_ALEN},
{"macvtap0", ETH_ALEN},
{"macsec0", ETH_ALEN},
{"veth0_to_batadv", ETH_ALEN},
{"veth1_to_batadv", ETH_ALEN},
{"batadv_slave_0", ETH_ALEN},
{"batadv_slave_1", ETH_ALEN},
{"geneve0", ETH_ALEN},
{"geneve1", ETH_ALEN},
{"wg0", 0},
{"wg1", 0},
{"wg2", 0},
};
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
unsigned i;
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++)
netlink_add_device(&nlmsg, sock, devtypes[i].type, devtypes[i].dev);
for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) {
char master[32], slave0[32], veth0[32], slave1[32], veth1[32];
sprintf(slave0, "%s_slave_0", devmasters[i]);
sprintf(veth0, "veth0_to_%s", devmasters[i]);
netlink_add_veth(&nlmsg, sock, slave0, veth0);
sprintf(slave1, "%s_slave_1", devmasters[i]);
sprintf(veth1, "veth1_to_%s", devmasters[i]);
netlink_add_veth(&nlmsg, sock, slave1, veth1);
sprintf(master, "%s0", devmasters[i]);
netlink_device_change(&nlmsg, sock, slave0, false, master, 0, 0, NULL);
netlink_device_change(&nlmsg, sock, slave1, false, master, 0, 0, NULL);
}
netlink_add_xfrm(&nlmsg, sock, "xfrm0");
netlink_device_change(&nlmsg, sock, "bridge_slave_0", true, 0, 0, 0, NULL);
netlink_device_change(&nlmsg, sock, "bridge_slave_1", true, 0, 0, 0, NULL);
netlink_add_veth(&nlmsg, sock, "hsr_slave_0", "veth0_to_hsr");
netlink_add_veth(&nlmsg, sock, "hsr_slave_1", "veth1_to_hsr");
netlink_add_hsr(&nlmsg, sock, "hsr0", "hsr_slave_0", "hsr_slave_1");
netlink_device_change(&nlmsg, sock, "hsr_slave_0", true, 0, 0, 0, NULL);
netlink_device_change(&nlmsg, sock, "hsr_slave_1", true, 0, 0, 0, NULL);
netlink_add_veth(&nlmsg, sock, "veth0_virt_wifi", "veth1_virt_wifi");
netlink_add_linked(&nlmsg, sock, "virt_wifi", "virt_wifi0", "veth1_virt_wifi");
netlink_add_veth(&nlmsg, sock, "veth0_vlan", "veth1_vlan");
netlink_add_vlan(&nlmsg, sock, "vlan0", "veth0_vlan", 0, htons(ETH_P_8021Q));
netlink_add_vlan(&nlmsg, sock, "vlan1", "veth0_vlan", 1, htons(ETH_P_8021AD));
netlink_add_macvlan(&nlmsg, sock, "macvlan0", "veth1_vlan");
netlink_add_macvlan(&nlmsg, sock, "macvlan1", "veth1_vlan");
netlink_add_ipvlan(&nlmsg, sock, "ipvlan0", "veth0_vlan", IPVLAN_MODE_L2, 0);
netlink_add_ipvlan(&nlmsg, sock, "ipvlan1", "veth0_vlan", IPVLAN_MODE_L3S, IPVLAN_F_VEPA);
netlink_add_veth(&nlmsg, sock, "veth0_macvtap", "veth1_macvtap");
netlink_add_linked(&nlmsg, sock, "macvtap", "macvtap0", "veth0_macvtap");
netlink_add_linked(&nlmsg, sock, "macsec", "macsec0", "veth1_macvtap");
char addr[32];
sprintf(addr, DEV_IPV4, 14 + 10);
struct in_addr geneve_addr4;
if (inet_pton(AF_INET, addr, &geneve_addr4) <= 0)
exit(1);
struct in6_addr geneve_addr6;
if (inet_pton(AF_INET6, "fc00::01", &geneve_addr6) <= 0)
exit(1);
netlink_add_geneve(&nlmsg, sock, "geneve0", 0, &geneve_addr4, 0);
netlink_add_geneve(&nlmsg, sock, "geneve1", 1, 0, &geneve_addr6);
netdevsim_add((int)procid, 4);
netlink_wireguard_setup();
for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) {
char addr[32];
sprintf(addr, DEV_IPV4, i + 10);
netlink_add_addr4(&nlmsg, sock, devices[i].name, addr);
if (!devices[i].noipv6) {
sprintf(addr, DEV_IPV6, i + 10);
netlink_add_addr6(&nlmsg, sock, devices[i].name, addr);
}
uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40);
netlink_device_change(&nlmsg, sock, devices[i].name, true, 0, &macaddr, devices[i].macsize, NULL);
}
close(sock);
}
static void initialize_netdevices_init(void)
{
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
struct {
const char* type;
int macsize;
bool noipv6;
bool noup;
} devtypes[] = {
{"nr", 7, true},
{"rose", 5, true, true},
};
unsigned i;
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) {
char dev[32], addr[32];
sprintf(dev, "%s%d", devtypes[i].type, (int)procid);
sprintf(addr, "172.30.%d.%d", i, (int)procid + 1);
netlink_add_addr4(&nlmsg, sock, dev, addr);
if (!devtypes[i].noipv6) {
sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1);
netlink_add_addr6(&nlmsg, sock, dev, addr);
}
int macsize = devtypes[i].macsize;
uint64_t macaddr = 0xbbbbbb + ((unsigned long long)i << (8 * (macsize - 2))) +
(procid << (8 * (macsize - 1)));
netlink_device_change(&nlmsg, sock, dev, !devtypes[i].noup, 0, &macaddr, macsize, NULL);
}
close(sock);
}
static int read_tun(char* data, int size)
{
if (tunfd < 0)
return -1;
int rv = read(tunfd, data, size);
if (rv < 0) {
if (errno == EAGAIN || errno == EBADFD)
return -1;
exit(1);
}
return rv;
}
static void flush_tun()
{
char data[1000];
while (read_tun(&data[0], sizeof(data)) != -1) {
}
}
#define MAX_FDS 30
#define BTPROTO_HCI 1
#define ACL_LINK 1
#define SCAN_PAGE 2
typedef struct {
uint8_t b[6];
} __attribute__((packed)) bdaddr_t;
#define HCI_COMMAND_PKT 1
#define HCI_EVENT_PKT 4
#define HCI_VENDOR_PKT 0xff
struct hci_command_hdr {
uint16_t opcode;
uint8_t plen;
} __attribute__((packed));
struct hci_event_hdr {
uint8_t evt;
uint8_t plen;
} __attribute__((packed));
#define HCI_EV_CONN_COMPLETE 0x03
struct hci_ev_conn_complete {
uint8_t status;
uint16_t handle;
bdaddr_t bdaddr;
uint8_t link_type;
uint8_t encr_mode;
} __attribute__((packed));
#define HCI_EV_CONN_REQUEST 0x04
struct hci_ev_conn_request {
bdaddr_t bdaddr;
uint8_t dev_class[3];
uint8_t link_type;
} __attribute__((packed));
#define HCI_EV_REMOTE_FEATURES 0x0b
struct hci_ev_remote_features {
uint8_t status;
uint16_t handle;
uint8_t features[8];
} __attribute__((packed));
#define HCI_EV_CMD_COMPLETE 0x0e
struct hci_ev_cmd_complete {
uint8_t ncmd;
uint16_t opcode;
} __attribute__((packed));
#define HCI_OP_WRITE_SCAN_ENABLE 0x0c1a
#define HCI_OP_READ_BUFFER_SIZE 0x1005
struct hci_rp_read_buffer_size {
uint8_t status;
uint16_t acl_mtu;
uint8_t sco_mtu;
uint16_t acl_max_pkt;
uint16_t sco_max_pkt;
} __attribute__((packed));
#define HCI_OP_READ_BD_ADDR 0x1009
struct hci_rp_read_bd_addr {
uint8_t status;
bdaddr_t bdaddr;
} __attribute__((packed));
#define HCI_EV_LE_META 0x3e
struct hci_ev_le_meta {
uint8_t subevent;
} __attribute__((packed));
#define HCI_EV_LE_CONN_COMPLETE 0x01
struct hci_ev_le_conn_complete {
uint8_t status;
uint16_t handle;
uint8_t role;
uint8_t bdaddr_type;
bdaddr_t bdaddr;
uint16_t interval;
uint16_t latency;
uint16_t supervision_timeout;
uint8_t clk_accurancy;
} __attribute__((packed));
struct hci_dev_req {
uint16_t dev_id;
uint32_t dev_opt;
};
struct vhci_vendor_pkt_request {
uint8_t type;
uint8_t opcode;
} __attribute__((packed));
struct vhci_pkt {
uint8_t type;
union {
struct {
uint8_t opcode;
uint16_t id;
} __attribute__((packed)) vendor_pkt;
struct hci_command_hdr command_hdr;
};
} __attribute__((packed));
#define HCIDEVUP _IOW('H', 201, int)
#define HCISETSCAN _IOW('H', 221, int)
static int vhci_fd = -1;
static void rfkill_unblock_all()
{
int fd = open("/dev/rfkill", O_WRONLY);
if (fd < 0)
exit(1);
struct rfkill_event event = {0};
event.idx = 0;
event.type = RFKILL_TYPE_ALL;
event.op = RFKILL_OP_CHANGE_ALL;
event.soft = 0;
event.hard = 0;
if (write(fd, &event, sizeof(event)) < 0)
exit(1);
close(fd);
}
static void hci_send_event_packet(int fd, uint8_t evt, void* data, size_t data_len)
{
struct iovec iv[3];
struct hci_event_hdr hdr;
hdr.evt = evt;
hdr.plen = data_len;
uint8_t type = HCI_EVENT_PKT;
iv[0].iov_base = &type;
iv[0].iov_len = sizeof(type);
iv[1].iov_base = &hdr;
iv[1].iov_len = sizeof(hdr);
iv[2].iov_base = data;
iv[2].iov_len = data_len;
if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0)
exit(1);
}
static void hci_send_event_cmd_complete(int fd, uint16_t opcode, void* data, size_t data_len)
{
struct iovec iv[4];
struct hci_event_hdr hdr;
hdr.evt = HCI_EV_CMD_COMPLETE;
hdr.plen = sizeof(struct hci_ev_cmd_complete) + data_len;
struct hci_ev_cmd_complete evt_hdr;
evt_hdr.ncmd = 1;
evt_hdr.opcode = opcode;
uint8_t type = HCI_EVENT_PKT;
iv[0].iov_base = &type;
iv[0].iov_len = sizeof(type);
iv[1].iov_base = &hdr;
iv[1].iov_len = sizeof(hdr);
iv[2].iov_base = &evt_hdr;
iv[2].iov_len = sizeof(evt_hdr);
iv[3].iov_base = data;
iv[3].iov_len = data_len;
if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0)
exit(1);
}
static bool process_command_pkt(int fd, char* buf, ssize_t buf_size)
{
struct hci_command_hdr* hdr = (struct hci_command_hdr*)buf;
if (buf_size < (ssize_t)sizeof(struct hci_command_hdr) ||
hdr->plen != buf_size - sizeof(struct hci_command_hdr))
exit(1);
switch (hdr->opcode) {
case HCI_OP_WRITE_SCAN_ENABLE: {
uint8_t status = 0;
hci_send_event_cmd_complete(fd, hdr->opcode, &status, sizeof(status));
return true;
}
case HCI_OP_READ_BD_ADDR: {
struct hci_rp_read_bd_addr rp = {0};
rp.status = 0;
memset(&rp.bdaddr, 0xaa, 6);
hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp));
return false;
}
case HCI_OP_READ_BUFFER_SIZE: {
struct hci_rp_read_buffer_size rp = {0};
rp.status = 0;
rp.acl_mtu = 1021;
rp.sco_mtu = 96;
rp.acl_max_pkt = 4;
rp.sco_max_pkt = 6;
hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp));
return false;
}
}
char dummy[0xf9] = {0};
hci_send_event_cmd_complete(fd, hdr->opcode, dummy, sizeof(dummy));
return false;
}
static void* event_thread(void* arg)
{
while (1) {
char buf[1024] = {0};
ssize_t buf_size = read(vhci_fd, buf, sizeof(buf));
if (buf_size < 0)
exit(1);
if (buf_size > 0 && buf[0] == HCI_COMMAND_PKT) {
if (process_command_pkt(vhci_fd, buf + 1, buf_size - 1))
break;
}
}
return NULL;
}
#define HCI_HANDLE_1 200
#define HCI_HANDLE_2 201
#define HCI_PRIMARY 0
#define HCI_OP_RESET 0x0c03
static void initialize_vhci()
{
int hci_sock = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
if (hci_sock < 0)
exit(1);
vhci_fd = open("/dev/vhci", O_RDWR);
if (vhci_fd == -1)
exit(1);
const int kVhciFd = 202;
if (dup2(vhci_fd, kVhciFd) < 0)
exit(1);
close(vhci_fd);
vhci_fd = kVhciFd;
struct vhci_vendor_pkt_request vendor_pkt_req = {HCI_VENDOR_PKT, HCI_PRIMARY};
if (write(vhci_fd, &vendor_pkt_req, sizeof(vendor_pkt_req)) != sizeof(vendor_pkt_req))
exit(1);
struct vhci_pkt vhci_pkt;
if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt))
exit(1);
if (vhci_pkt.type == HCI_COMMAND_PKT && vhci_pkt.command_hdr.opcode == HCI_OP_RESET) {
char response[1] = {0};
hci_send_event_cmd_complete(vhci_fd, HCI_OP_RESET, response, sizeof(response));
if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt))
exit(1);
}
if (vhci_pkt.type != HCI_VENDOR_PKT)
exit(1);
int dev_id = vhci_pkt.vendor_pkt.id;
pthread_t th;
if (pthread_create(&th, NULL, event_thread, NULL))
exit(1);
int ret = ioctl(hci_sock, HCIDEVUP, dev_id);
if (ret) {
if (errno == ERFKILL) {
rfkill_unblock_all();
ret = ioctl(hci_sock, HCIDEVUP, dev_id);
}
if (ret && errno != EALREADY)
exit(1);
}
struct hci_dev_req dr = {0};
dr.dev_id = dev_id;
dr.dev_opt = SCAN_PAGE;
if (ioctl(hci_sock, HCISETSCAN, &dr))
exit(1);
struct hci_ev_conn_request request;
memset(&request, 0, sizeof(request));
memset(&request.bdaddr, 0xaa, 6);
*(uint8_t*)&request.bdaddr.b[5] = 0x10;
request.link_type = ACL_LINK;
hci_send_event_packet(vhci_fd, HCI_EV_CONN_REQUEST, &request, sizeof(request));
struct hci_ev_conn_complete complete;
memset(&complete, 0, sizeof(complete));
complete.status = 0;
complete.handle = HCI_HANDLE_1;
memset(&complete.bdaddr, 0xaa, 6);
*(uint8_t*)&complete.bdaddr.b[5] = 0x10;
complete.link_type = ACL_LINK;
complete.encr_mode = 0;
hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete, sizeof(complete));
struct hci_ev_remote_features features;
memset(&features, 0, sizeof(features));
features.status = 0;
features.handle = HCI_HANDLE_1;
hci_send_event_packet(vhci_fd, HCI_EV_REMOTE_FEATURES, &features, sizeof(features));
struct {
struct hci_ev_le_meta le_meta;
struct hci_ev_le_conn_complete le_conn;
} le_conn;
memset(&le_conn, 0, sizeof(le_conn));
le_conn.le_meta.subevent = HCI_EV_LE_CONN_COMPLETE;
memset(&le_conn.le_conn.bdaddr, 0xaa, 6);
*(uint8_t*)&le_conn.le_conn.bdaddr.b[5] = 0x11;
le_conn.le_conn.role = 1;
le_conn.le_conn.handle = HCI_HANDLE_2;
hci_send_event_packet(vhci_fd, HCI_EV_LE_META, &le_conn, sizeof(le_conn));
pthread_join(th, NULL);
close(hci_sock);
}
//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:
//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty. In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//% claim that you wrote the original software. If you use this software
//% in a product, an acknowledgment in the product documentation would be
//% appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//% misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler madler@alumni.caltech.edu
//% BEGIN CODE DERIVED FROM puff.{c,h}
#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288
struct puff_state {
unsigned char* out;
unsigned long outlen;
unsigned long outcnt;
const unsigned char* in;
unsigned long inlen;
unsigned long incnt;
int bitbuf;
int bitcnt;
jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
long val = s->bitbuf;
while (s->bitcnt < need) {
if (s->incnt == s->inlen)
longjmp(s->env, 1);
val |= (long)(s->in[s->incnt++]) << s->bitcnt;
s->bitcnt += 8;
}
s->bitbuf = (int)(val >> need);
s->bitcnt -= need;
return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
s->bitbuf = 0;
s->bitcnt = 0;
if (s->incnt + 4 > s->inlen)
return 2;
unsigned len = s->in[s->incnt++];
len |= s->in[s->incnt++] << 8;
if (s->in[s->incnt++] != (~len & 0xff) ||
s->in[s->incnt++] != ((~len >> 8) & 0xff))
return -2;
if (s->incnt + len > s->inlen)
return 2;
if (s->outcnt + len > s->outlen)
return 1;
for (; len--; s->outcnt++, s->incnt++) {
if (s->in[s->incnt])
s->out[s->outcnt] = s->in[s->incnt];
}
return 0;
}
struct puff_huffman {
short* count;
short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
int first = 0;
int index = 0;
int bitbuf = s->bitbuf;
int left = s->bitcnt;
int code = first = index = 0;
int len = 1;
short* next = h->count + 1;
while (1) {
while (left--) {
code |= bitbuf & 1;
bitbuf >>= 1;
int count = *next++;
if (code - count < first) {
s->bitbuf = bitbuf;
s->bitcnt = (s->bitcnt - len) & 7;
return h->symbol[index + (code - first)];
}
index += count;
first += count;
first <<= 1;
code <<= 1;
len++;
}
left = (MAXBITS + 1) - len;
if (left == 0)
break;
if (s->incnt == s->inlen)
longjmp(s->env, 1);
bitbuf = s->in[s->incnt++];
if (left > 8)
left = 8;
}
return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
int len;
for (len = 0; len <= MAXBITS; len++)
h->count[len] = 0;
int symbol;
for (symbol = 0; symbol < n; symbol++)
(h->count[length[symbol]])++;
if (h->count[0] == n)
return 0;
int left = 1;
for (len = 1; len <= MAXBITS; len++) {
left <<= 1;
left -= h->count[len];
if (left < 0)
return left;
}
short offs[MAXBITS + 1];
offs[1] = 0;
for (len = 1; len < MAXBITS; len++)
offs[len + 1] = offs[len] + h->count[len];
for (symbol = 0; symbol < n; symbol++)
if (length[symbol] != 0)
h->symbol[offs[length[symbol]]++] = symbol;
return left;
}
static int puff_codes(struct puff_state* s,
const struct puff_huffman* lencode,
const struct puff_huffman* distcode)
{
static const short lens[29] = {
3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
static const short lext[29] = {
0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
static const short dists[30] = {
1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
8193, 12289, 16385, 24577};
static const short dext[30] = {
0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
12, 12, 13, 13};
int symbol;
do {
symbol = puff_decode(s, lencode);
if (symbol < 0)
return symbol;
if (symbol < 256) {
if (s->outcnt == s->outlen)
return 1;
if (symbol)
s->out[s->outcnt] = symbol;
s->outcnt++;
} else if (symbol > 256) {
symbol -= 257;
if (symbol >= 29)
return -10;
int len = lens[symbol] + puff_bits(s, lext[symbol]);
symbol = puff_decode(s, distcode);
if (symbol < 0)
return symbol;
unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
if (dist > s->outcnt)
return -11;
if (s->outcnt + len > s->outlen)
return 1;
while (len--) {
if (dist <= s->outcnt && s->out[s->outcnt - dist])
s->out[s->outcnt] = s->out[s->outcnt - dist];
s->outcnt++;
}
}
} while (symbol != 256);
return 0;
}
static int puff_fixed(struct puff_state* s)
{
static int virgin = 1;
static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
static struct puff_huffman lencode, distcode;
if (virgin) {
lencode.count = lencnt;
lencode.symbol = lensym;
distcode.count = distcnt;
distcode.symbol = distsym;
short lengths[FIXLCODES];
int symbol;
for (symbol = 0; symbol < 144; symbol++)
lengths[symbol] = 8;
for (; symbol < 256; symbol++)
lengths[symbol] = 9;
for (; symbol < 280; symbol++)
lengths[symbol] = 7;
for (; symbol < FIXLCODES; symbol++)
lengths[symbol] = 8;
puff_construct(&lencode, lengths, FIXLCODES);
for (symbol = 0; symbol < MAXDCODES; symbol++)
lengths[symbol] = 5;
puff_construct(&distcode, lengths, MAXDCODES);
virgin = 0;
}
return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
static const short order[19] =
{16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
int nlen = puff_bits(s, 5) + 257;
int ndist = puff_bits(s, 5) + 1;
int ncode = puff_bits(s, 4) + 4;
if (nlen > MAXLCODES || ndist > MAXDCODES)
return -3;
short lengths[MAXCODES];
int index;
for (index = 0; index < ncode; index++)
lengths[order[index]] = puff_bits(s, 3);
for (; index < 19; index++)
lengths[order[index]] = 0;
short lencnt[MAXBITS + 1], lensym[MAXLCODES];
struct puff_huffman lencode = {lencnt, lensym};
int err = puff_construct(&lencode, lengths, 19);
if (err != 0)
return -4;
index = 0;
while (index < nlen + ndist) {
int symbol;
int len;
symbol = puff_decode(s, &lencode);
if (symbol < 0)
return symbol;
if (symbol < 16)
lengths[index++] = symbol;
else {
len = 0;
if (symbol == 16) {
if (index == 0)
return -5;
len = lengths[index - 1];
symbol = 3 + puff_bits(s, 2);
} else if (symbol == 17)
symbol = 3 + puff_bits(s, 3);
else
symbol = 11 + puff_bits(s, 7);
if (index + symbol > nlen + ndist)
return -6;
while (symbol--)
lengths[index++] = len;
}
}
if (lengths[256] == 0)
return -9;
err = puff_construct(&lencode, lengths, nlen);
if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
return -7;
short distcnt[MAXBITS + 1], distsym[MAXDCODES];
struct puff_huffman distcode = {distcnt, distsym};
err = puff_construct(&distcode, lengths + nlen, ndist);
if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
return -8;
return puff_codes(s, &lencode, &distcode);
}
static int puff(
unsigned char* dest,
unsigned long* destlen,
const unsigned char* source,
unsigned long sourcelen)
{
struct puff_state s = {
.out = dest,
.outlen = *destlen,
.outcnt = 0,
.in = source,
.inlen = sourcelen,
.incnt = 0,
.bitbuf = 0,
.bitcnt = 0,
};
int err;
if (setjmp(s.env) != 0)
err = 2;
else {
int last;
do {
last = puff_bits(&s, 1);
int type = puff_bits(&s, 2);
err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
if (err != 0)
break;
} while (!last);
}
*destlen = s.outcnt;
return err;
}
//% END CODE DERIVED FROM puff.{c,h}
#define ZLIB_HEADER_WIDTH 2
static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
if (sourcelen < ZLIB_HEADER_WIDTH)
return 0;
source += ZLIB_HEADER_WIDTH;
sourcelen -= ZLIB_HEADER_WIDTH;
const unsigned long max_destlen = 132 << 20;
void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
if (ret == MAP_FAILED)
return -1;
unsigned char* dest = (unsigned char*)ret;
unsigned long destlen = max_destlen;
int err = puff(dest, &destlen, source, sourcelen);
if (err) {
munmap(dest, max_destlen);
errno = -err;
return -1;
}
if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
munmap(dest, max_destlen);
return -1;
}
return munmap(dest, max_destlen);
}
static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
int err = 0, loopfd = -1;
int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
if (memfd == -1) {
err = errno;
goto error;
}
if (puff_zlib_to_file(data, size, memfd)) {
err = errno;
goto error_close_memfd;
}
loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
err = errno;
goto error_close_memfd;
}
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
if (errno != EBUSY) {
err = errno;
goto error_close_loop;
}
ioctl(loopfd, LOOP_CLR_FD, 0);
usleep(1000);
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
err = errno;
goto error_close_loop;
}
}
close(memfd);
*loopfd_p = loopfd;
return 0;
error_close_loop:
close(loopfd);
error_close_memfd:
close(memfd);
error:
errno = err;
return -1;
}
static long syz_mount_image(
volatile long fsarg,
volatile long dir,
volatile long flags,
volatile long optsarg,
volatile long change_dir,
volatile unsigned long size,
volatile long image)
{
unsigned char* data = (unsigned char*)image;
int res = -1, err = 0, loopfd = -1, need_loop_device = !!size;
char* mount_opts = (char*)optsarg;
char* target = (char*)dir;
char* fs = (char*)fsarg;
char* source = NULL;
char loopname[64];
if (need_loop_device) {
memset(loopname, 0, sizeof(loopname));
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
if (setup_loop_device(data, size, loopname, &loopfd) == -1)
return -1;
source = loopname;
}
mkdir(target, 0777);
char opts[256];
memset(opts, 0, sizeof(opts));
if (strlen(mount_opts) > (sizeof(opts) - 32)) {
}
strncpy(opts, mount_opts, sizeof(opts) - 32);
if (strcmp(fs, "iso9660") == 0) {
flags |= MS_RDONLY;
} else if (strncmp(fs, "ext", 3) == 0) {
bool has_remount_ro = false;
char* remount_ro_start = strstr(opts, "errors=remount-ro");
if (remount_ro_start != NULL) {
char after = *(remount_ro_start + strlen("errors=remount-ro"));
char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
}
if (strstr(opts, "errors=panic") || !has_remount_ro)
strcat(opts, ",errors=continue");
} else if (strcmp(fs, "xfs") == 0) {
strcat(opts, ",nouuid");
}
res = mount(source, target, fs, flags, opts);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
res = open(target, O_RDONLY | O_DIRECTORY);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
if (change_dir) {
res = chdir(target);
if (res == -1) {
err = errno;
}
}
error_clear_loop:
if (need_loop_device) {
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd);
}
errno = err;
return res;
}
#define XT_TABLE_SIZE 1536
#define XT_MAX_ENTRIES 10
struct xt_counters {
uint64_t pcnt, bcnt;
};
struct ipt_getinfo {
char name[32];
unsigned int valid_hooks;
unsigned int hook_entry[5];
unsigned int underflow[5];
unsigned int num_entries;
unsigned int size;
};
struct ipt_get_entries {
char name[32];
unsigned int size;
uint64_t entrytable[XT_TABLE_SIZE / sizeof(uint64_t)];
};
struct ipt_replace {
char name[32];
unsigned int valid_hooks;
unsigned int num_entries;
unsigned int size;
unsigned int hook_entry[5];
unsigned int underflow[5];
unsigned int num_counters;
struct xt_counters* counters;
uint64_t entrytable[XT_TABLE_SIZE / sizeof(uint64_t)];
};
struct ipt_table_desc {
const char* name;
struct ipt_getinfo info;
struct ipt_replace replace;
};
static struct ipt_table_desc ipv4_tables[] = {
{.name = "filter"},
{.name = "nat"},
{.name = "mangle"},
{.name = "raw"},
{.name = "security"},
};
static struct ipt_table_desc ipv6_tables[] = {
{.name = "filter"},
{.name = "nat"},
{.name = "mangle"},
{.name = "raw"},
{.name = "security"},
};
#define IPT_BASE_CTL 64
#define IPT_SO_SET_REPLACE (IPT_BASE_CTL)
#define IPT_SO_GET_INFO (IPT_BASE_CTL)
#define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1)
struct arpt_getinfo {
char name[32];
unsigned int valid_hooks;
unsigned int hook_entry[3];
unsigned int underflow[3];
unsigned int num_entries;
unsigned int size;
};
struct arpt_get_entries {
char name[32];
unsigned int size;
uint64_t entrytable[XT_TABLE_SIZE / sizeof(uint64_t)];
};
struct arpt_replace {
char name[32];
unsigned int valid_hooks;
unsigned int num_entries;
unsigned int size;
unsigned int hook_entry[3];
unsigned int underflow[3];
unsigned int num_counters;
struct xt_counters* counters;
uint64_t entrytable[XT_TABLE_SIZE / sizeof(uint64_t)];
};
struct arpt_table_desc {
const char* name;
struct arpt_getinfo info;
struct arpt_replace replace;
};
static struct arpt_table_desc arpt_tables[] = {
{.name = "filter"},
};
#define ARPT_BASE_CTL 96
#define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
#define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
#define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)
static void checkpoint_iptables(struct ipt_table_desc* tables, int num_tables, int family, int level)
{
int fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (int i = 0; i < num_tables; i++) {
struct ipt_table_desc* table = &tables[i];
strcpy(table->info.name, table->name);
strcpy(table->replace.name, table->name);
socklen_t optlen = sizeof(table->info);
if (getsockopt(fd, level, IPT_SO_GET_INFO, &table->info, &optlen)) {
switch (errno) {
case EPERM:
case ENOENT:
case ENOPROTOOPT:
continue;
}
exit(1);
}
if (table->info.size > sizeof(table->replace.entrytable))
exit(1);
if (table->info.num_entries > XT_MAX_ENTRIES)
exit(1);
struct ipt_get_entries entries;
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
table->replace.valid_hooks = table->info.valid_hooks;
table->replace.num_entries = table->info.num_entries;
table->replace.size = table->info.size;
memcpy(table->replace.hook_entry, table->info.hook_entry, sizeof(table->replace.hook_entry));
memcpy(table->replace.underflow, table->info.underflow, sizeof(table->replace.underflow));
memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
}
close(fd);
}
static void reset_iptables(struct ipt_table_desc* tables, int num_tables, int family, int level)
{
int fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (int i = 0; i < num_tables; i++) {
struct ipt_table_desc* table = &tables[i];
if (table->info.valid_hooks == 0)
continue;
struct ipt_getinfo info;
memset(&info, 0, sizeof(info));
strcpy(info.name, table->name);
socklen_t optlen = sizeof(info);
if (getsockopt(fd, level, IPT_SO_GET_INFO, &info, &optlen))
exit(1);
if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
struct ipt_get_entries entries;
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
if (memcmp(table->replace.entrytable, entries.entrytable, table->info.size) == 0)
continue;
}
struct xt_counters counters[XT_MAX_ENTRIES];
table->replace.num_counters = info.num_entries;
table->replace.counters = counters;
optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) + table->replace.size;
if (setsockopt(fd, level, IPT_SO_SET_REPLACE, &table->replace, optlen))
exit(1);
}
close(fd);
}
static void checkpoint_arptables(void)
{
int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (unsigned i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
struct arpt_table_desc* table = &arpt_tables[i];
strcpy(table->info.name, table->name);
strcpy(table->replace.name, table->name);
socklen_t optlen = sizeof(table->info);
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &table->info, &optlen)) {
switch (errno) {
case EPERM:
case ENOENT:
case ENOPROTOOPT:
continue;
}
exit(1);
}
if (table->info.size > sizeof(table->replace.entrytable))
exit(1);
if (table->info.num_entries > XT_MAX_ENTRIES)
exit(1);
struct arpt_get_entries entries;
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
table->replace.valid_hooks = table->info.valid_hooks;
table->replace.num_entries = table->info.num_entries;
table->replace.size = table->info.size;
memcpy(table->replace.hook_entry, table->info.hook_entry, sizeof(table->replace.hook_entry));
memcpy(table->replace.underflow, table->info.underflow, sizeof(table->replace.underflow));
memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
}
close(fd);
}
static void reset_arptables()
{
int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (unsigned i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
struct arpt_table_desc* table = &arpt_tables[i];
if (table->info.valid_hooks == 0)
continue;
struct arpt_getinfo info;
memset(&info, 0, sizeof(info));
strcpy(info.name, table->name);
socklen_t optlen = sizeof(info);
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &info, &optlen))
exit(1);
if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
struct arpt_get_entries entries;
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
if (memcmp(table->replace.entrytable, entries.entrytable, table->info.size) == 0)
continue;
} else {
}
struct xt_counters counters[XT_MAX_ENTRIES];
table->replace.num_counters = info.num_entries;
table->replace.counters = counters;
optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) + table->replace.size;
if (setsockopt(fd, SOL_IP, ARPT_SO_SET_REPLACE, &table->replace, optlen))
exit(1);
}
close(fd);
}
#define NF_BR_NUMHOOKS 6
#define EBT_TABLE_MAXNAMELEN 32
#define EBT_CHAIN_MAXNAMELEN 32
#define EBT_BASE_CTL 128
#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
#define EBT_SO_GET_INFO (EBT_BASE_CTL)
#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO + 1)
#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES + 1)
#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO + 1)
struct ebt_replace {
char name[EBT_TABLE_MAXNAMELEN];
unsigned int valid_hooks;
unsigned int nentries;
unsigned int entries_size;
struct ebt_entries* hook_entry[NF_BR_NUMHOOKS];
unsigned int num_counters;
struct ebt_counter* counters;
char* entries;
};
struct ebt_entries {
unsigned int distinguisher;
char name[EBT_CHAIN_MAXNAMELEN];
unsigned int counter_offset;
int policy;
unsigned int nentries;
char data[0] __attribute__((aligned(__alignof__(struct ebt_replace))));
};
struct ebt_table_desc {
const char* name;
struct ebt_replace replace;
char entrytable[XT_TABLE_SIZE];
};
static struct ebt_table_desc ebt_tables[] = {
{.name = "filter"},
{.name = "nat"},
{.name = "broute"},
};
static void checkpoint_ebtables(void)
{
int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (size_t i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
struct ebt_table_desc* table = &ebt_tables[i];
strcpy(table->replace.name, table->name);
socklen_t optlen = sizeof(table->replace);
if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_INFO, &table->replace, &optlen)) {
switch (errno) {
case EPERM:
case ENOENT:
case ENOPROTOOPT:
continue;
}
exit(1);
}
if (table->replace.entries_size > sizeof(table->entrytable))
exit(1);
table->replace.num_counters = 0;
table->replace.entries = table->entrytable;
optlen = sizeof(table->replace) + table->replace.entries_size;
if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_ENTRIES, &table->replace, &optlen))
exit(1);
}
close(fd);
}
static void reset_ebtables()
{
int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (unsigned i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
struct ebt_table_desc* table = &ebt_tables[i];
if (table->replace.valid_hooks == 0)
continue;
struct ebt_replace replace;
memset(&replace, 0, sizeof(replace));
strcpy(replace.name, table->name);
socklen_t optlen = sizeof(replace);
if (getsockopt(fd, SOL_IP, EBT_SO_GET_INFO, &replace, &optlen))
exit(1);
replace.num_counters = 0;
table->replace.entries = 0;
for (unsigned h = 0; h < NF_BR_NUMHOOKS; h++)
table->replace.hook_entry[h] = 0;
if (memcmp(&table->replace, &replace, sizeof(table->replace)) == 0) {
char entrytable[XT_TABLE_SIZE];
memset(&entrytable, 0, sizeof(entrytable));
replace.entries = entrytable;
optlen = sizeof(replace) + replace.entries_size;
if (getsockopt(fd, SOL_IP, EBT_SO_GET_ENTRIES, &replace, &optlen))
exit(1);
if (memcmp(table->entrytable, entrytable, replace.entries_size) == 0)
continue;
}
for (unsigned j = 0, h = 0; h < NF_BR_NUMHOOKS; h++) {
if (table->replace.valid_hooks & (1 << h)) {
table->replace.hook_entry[h] = (struct ebt_entries*)table->entrytable + j;
j++;
}
}
table->replace.entries = table->entrytable;
optlen = sizeof(table->replace) + table->replace.entries_size;
if (setsockopt(fd, SOL_IP, EBT_SO_SET_ENTRIES, &table->replace, optlen))
exit(1);
}
close(fd);
}
static void checkpoint_net_namespace(void)
{
checkpoint_ebtables();
checkpoint_arptables();
checkpoint_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]), AF_INET, SOL_IP);
checkpoint_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]), AF_INET6, SOL_IPV6);
}
static void reset_net_namespace(void)
{
reset_ebtables();
reset_arptables();
reset_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]), AF_INET, SOL_IP);
reset_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]), AF_INET6, SOL_IPV6);
}
static void mount_cgroups(const char* dir, const char** controllers, int count)
{
if (mkdir(dir, 0777)) {
return;
}
char enabled[128] = {0};
int i = 0;
for (; i < count; i++) {
if (mount("none", dir, "cgroup", 0, controllers[i])) {
continue;
}
umount(dir);
strcat(enabled, ",");
strcat(enabled, controllers[i]);
}
if (enabled[0] == 0) {
if (rmdir(dir) && errno != EBUSY)
exit(1);
return;
}
if (mount("none", dir, "cgroup", 0, enabled + 1)) {
if (rmdir(dir) && errno != EBUSY)
exit(1);
}
if (chmod(dir, 0777)) {
}
}
static void mount_cgroups2(const char** controllers, int count)
{
if (mkdir("/syzcgroup/unified", 0777)) {
return;
}
if (mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL)) {
if (rmdir("/syzcgroup/unified") && errno != EBUSY)
exit(1);
return;
}
if (chmod("/syzcgroup/unified", 0777)) {
}
int control = open("/syzcgroup/unified/cgroup.subtree_control", O_WRONLY);
if (control == -1)
return;
int i;
for (i = 0; i < count; i++)
if (write(control, controllers[i], strlen(controllers[i])) < 0) {
}
close(control);
}
static void setup_cgroups()
{
const char* unified_controllers[] = {"+cpu", "+io", "+pids"};
const char* net_controllers[] = {"net", "net_prio", "devices", "blkio", "freezer"};
const char* cpu_controllers[] = {"cpuset", "cpuacct", "hugetlb", "rlimit", "memory"};
if (mkdir("/syzcgroup", 0777)) {
return;
}
mount_cgroups2(unified_controllers, sizeof(unified_controllers) / sizeof(unified_controllers[0]));
mount_cgroups("/syzcgroup/net", net_controllers, sizeof(net_controllers) / sizeof(net_controllers[0]));
mount_cgroups("/syzcgroup/cpu", cpu_controllers, sizeof(cpu_controllers) / sizeof(cpu_controllers[0]));
write_file("/syzcgroup/cpu/cgroup.clone_children", "1");
write_file("/syzcgroup/cpu/cpuset.memory_pressure_enabled", "1");
}
static void setup_cgroups_loop()
{
int pid = getpid();
char file[128];
char cgroupdir[64];
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid);
if (mkdir(cgroupdir, 0777)) {
}
snprintf(file, sizeof(file), "%s/pids.max", cgroupdir);
write_file(file, "32");
snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
write_file(file, "%d", pid);
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid);
if (mkdir(cgroupdir, 0777)) {
}
snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
write_file(file, "%d", pid);
snprintf(file, sizeof(file), "%s/memory.soft_limit_in_bytes", cgroupdir);
write_file(file, "%d", 299 << 20);
snprintf(file, sizeof(file), "%s/memory.limit_in_bytes", cgroupdir);
write_file(file, "%d", 300 << 20);
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid);
if (mkdir(cgroupdir, 0777)) {
}
snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
write_file(file, "%d", pid);
}
static void setup_cgroups_test()
{
char cgroupdir[64];
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid);
if (symlink(cgroupdir, "./cgroup")) {
}
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid);
if (symlink(cgroupdir, "./cgroup.cpu")) {
}
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid);
if (symlink(cgroupdir, "./cgroup.net")) {
}
}
static void setup_common()
{
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
}
}
static void setup_binderfs()
{
if (mkdir("/dev/binderfs", 0777)) {
}
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
}
}
static void loop();
static void sandbox_common()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setsid();
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = (200 << 20);
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 32 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 136 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
if (unshare(CLONE_NEWNS)) {
}
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
}
if (unshare(CLONE_NEWIPC)) {
}
if (unshare(0x02000000)) {
}
if (unshare(CLONE_NEWUTS)) {
}
if (unshare(CLONE_SYSVSEM)) {
}
typedef struct {
const char* name;
const char* value;
} sysctl_t;
static const sysctl_t sysctls[] = {
{"/proc/sys/kernel/shmmax", "16777216"},
{"/proc/sys/kernel/shmall", "536870912"},
{"/proc/sys/kernel/shmmni", "1024"},
{"/proc/sys/kernel/msgmax", "8192"},
{"/proc/sys/kernel/msgmni", "1024"},
{"/proc/sys/kernel/msgmnb", "1024"},
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
};
unsigned i;
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
write_file(sysctls[i].name, sysctls[i].value);
}
static int wait_for_loop(int pid)
{
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, __WALL) != pid) {
}
return WEXITSTATUS(status);
}
static void drop_caps(void)
{
struct __user_cap_header_struct cap_hdr = {};
struct __user_cap_data_struct cap_data[2] = {};
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
cap_hdr.pid = getpid();
if (syscall(SYS_capget, &cap_hdr, &cap_data))
exit(1);
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
cap_data[0].effective &= ~drop;
cap_data[0].permitted &= ~drop;
cap_data[0].inheritable &= ~drop;
if (syscall(SYS_capset, &cap_hdr, &cap_data))
exit(1);
}
static int do_sandbox_none(void)
{
if (unshare(CLONE_NEWPID)) {
}
int pid = fork();
if (pid != 0)
return wait_for_loop(pid);
setup_common();
initialize_vhci();
sandbox_common();
drop_caps();
initialize_netdevices_init();
if (unshare(CLONE_NEWNET)) {
}
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
initialize_tun();
initialize_netdevices();
initialize_wifi_devices();
setup_binderfs();
loop();
exit(1);
}
#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
int iter = 0;
DIR* dp = 0;
retry:
while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
}
dp = opendir(dir);
if (dp == NULL) {
if (errno == EMFILE) {
exit(1);
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
}
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
int i;
for (i = 0;; i++) {
if (unlink(filename) == 0)
break;
if (errno == EPERM) {
int fd = open(filename, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno != EBUSY || i > 100)
exit(1);
if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW))
exit(1);
}
}
closedir(dp);
for (int i = 0;; i++) {
if (rmdir(dir) == 0)
break;
if (i < 100) {
if (errno == EPERM) {
int fd = open(dir, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno == EBUSY) {
if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW))
exit(1);
continue;
}
if (errno == ENOTEMPTY) {
if (iter < 100) {
iter++;
goto retry;
}
}
}
exit(1);
}
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_loop()
{
setup_cgroups_loop();
checkpoint_net_namespace();
}
static void reset_loop()
{
char buf[64];
snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
int loopfd = open(buf, O_RDWR);
if (loopfd != -1) {
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd);
}
reset_net_namespace();
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
setup_cgroups_test();
write_file("/proc/self/oom_score_adj", "1000");
flush_tun();
if (symlink("/dev/binderfs", "./binderfs")) {
}
}
static void close_fds()
{
for (int fd = 3; fd < MAX_FDS; fd++)
close(fd);
}
static void setup_binfmt_misc()
{
if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0)) {
}
write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:");
write_file("/proc/sys/fs/binfmt_misc/register", ":syz1:M:1:\x02::./file0:POC");
}
static void setup_usb()
{
if (chmod("/dev/raw-gadget", 0666))
exit(1);
}
static void setup_sysctl()
{
char mypid[32];
snprintf(mypid, sizeof(mypid), "%d", getpid());
struct {
const char* name;
const char* data;
} files[] = {
{"/sys/kernel/debug/x86/nmi_longest_ns", "10000000000"},
{"/proc/sys/kernel/hung_task_check_interval_secs", "20"},
{"/proc/sys/net/core/bpf_jit_kallsyms", "1"},
{"/proc/sys/net/core/bpf_jit_harden", "0"},
{"/proc/sys/kernel/kptr_restrict", "0"},
{"/proc/sys/kernel/softlockup_all_cpu_backtrace", "1"},
{"/proc/sys/fs/mount-max", "100"},
{"/proc/sys/vm/oom_dump_tasks", "0"},
{"/proc/sys/debug/exception-trace", "0"},
{"/proc/sys/kernel/printk", "7 4 1 3"},
{"/proc/sys/kernel/keys/gc_delay", "1"},
{"/proc/sys/vm/oom_kill_allocating_task", "1"},
{"/proc/sys/kernel/ctrl-alt-del", "0"},
{"/proc/sys/kernel/cad_pid", mypid},
};
for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) {
if (!write_file(files[i].name, files[i].data))
printf("write to %s failed: %s\n", files[i].name, strerror(errno));
}
}
#define NL802154_CMD_SET_SHORT_ADDR 11
#define NL802154_ATTR_IFINDEX 3
#define NL802154_ATTR_SHORT_ADDR 10
static void setup_802154()
{
int sock_route = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock_route == -1)
exit(1);
int sock_generic = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock_generic < 0)
exit(1);
int nl802154_family_id = netlink_query_family_id(&nlmsg, sock_generic, "nl802154", true);
for (int i = 0; i < 2; i++) {
char devname[] = "wpan0";
devname[strlen(devname) - 1] += i;
uint64_t hwaddr = 0xaaaaaaaaaaaa0002 + (i << 8);
uint16_t shortaddr = 0xaaa0 + i;
int ifindex = if_nametoindex(devname);
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = NL802154_CMD_SET_SHORT_ADDR;
netlink_init(&nlmsg, nl802154_family_id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, NL802154_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
netlink_attr(&nlmsg, NL802154_ATTR_SHORT_ADDR, &shortaddr, sizeof(shortaddr));
int err = netlink_send(&nlmsg, sock_generic);
if (err < 0) {
}
netlink_device_change(&nlmsg, sock_route, devname, true, 0, &hwaddr, sizeof(hwaddr), 0);
if (i == 0) {
netlink_add_device_impl(&nlmsg, "lowpan", "lowpan0", false);
netlink_done(&nlmsg);
netlink_attr(&nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(&nlmsg, sock_route);
if (err < 0) {
}
}
}
close(sock_route);
close(sock_generic);
}
#define SWAP_FILE "./swap-file"
#define SWAP_FILE_SIZE (128 * 1000 * 1000)
static void setup_swap()
{
swapoff(SWAP_FILE);
unlink(SWAP_FILE);
int fd = open(SWAP_FILE, O_CREAT | O_WRONLY | O_CLOEXEC, 0600);
if (fd == -1) {
exit(1);
return;
}
fallocate(fd, FALLOC_FL_ZERO_RANGE, 0, SWAP_FILE_SIZE);
close(fd);
char cmdline[64];
sprintf(cmdline, "mkswap %s", SWAP_FILE);
if (runcmdline(cmdline)) {
exit(1);
return;
}
if (swapon(SWAP_FILE, SWAP_FLAG_PREFER) == 1) {
exit(1);
return;
}
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 3; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50 + (call == 0 ? 4000 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
close_fds();
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
setup_loop();
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
reset_loop();
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[1] = {0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
NONFAILING(memcpy((void*)0x20000040, "btrfs\000", 6));
NONFAILING(memcpy((void*)0x20005140, "./file0\000", 8));
NONFAILING(memcpy((void*)0x20000080, "treelog", 7));
NONFAILING(*(uint8_t*)0x20000087 = 0x2c);
NONFAILING(memcpy((void*)0x20000088, "max_inline", 10));
NONFAILING(*(uint8_t*)0x20000092 = 0x3d);
NONFAILING(*(uint8_t*)0x20000093 = 0x6b);
NONFAILING(*(uint8_t*)0x20000094 = 0);
NONFAILING(*(uint8_t*)0x20000095 = 0x6b);
NONFAILING(*(uint8_t*)0x20000096 = 0x36);
NONFAILING(*(uint8_t*)0x20000097 = 0x37);
NONFAILING(*(uint8_t*)0x20000098 = 0x33);
NONFAILING(*(uint8_t*)0x20000099 = 0x30);
NONFAILING(*(uint8_t*)0x2000009a = 0x2c);
NONFAILING(memcpy((void*)0x2000009b, "check_int", 9));
NONFAILING(*(uint8_t*)0x200000a4 = 0x2c);
NONFAILING(*(uint8_t*)0x200000a5 = 0);
NONFAILING(memcpy((void*)0x200051c0, "\x78\x9c\xec\xdd\x4f\x88\x55\x65\x1f\x07\xf0\xe7\xce\x9d\x71\xe6\x55\x70\xee\x2b\x04\xb6\xca\x22\x90\x6a\xe1\xe0\x26\x22\xa2\xab\x4c\x50\x51\x74\xcb\xc5\x60\x04\x4e\x2d\x82\x74\xe1\x24\x48\xb4\x10\xc4\x16\xfd\x5b\x78\x4b\x8a\x5a\x48\xae\xa4\x16\xc9\x2c\x8c\xa0\x36\x2e\xa4\x30\x02\xb7\xa1\x61\x2e\xdc\x28\x06\x92\x8b\x76\x1a\x73\xcf\x79\xee\x9c\xfb\x1c\xef\xb9\x77\x46\x6d\x4c\x3f\x1f\x99\x39\xe7\x39\xbf\xf3\x3c\xe7\xb9\x97\xb3\xb8\xdf\xeb\x9c\x73\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x84\x10\x5e\xf8\xfd\xb3\x43\x55\xf5\x53\xd7\xa6\xcf\x9c\x9b\x69\xee\x3c\xb0\x65\xe6\xf2\xbe\xe9\x75\xa7\x43\xa8\x75\xb6\xd7\xf2\xfa\x8e\xad\xcf\xbe\xf2\xe6\xb6\x1d\x2f\x4e\xc4\x0e\xb3\x2f\x67\xcb\x46\xa3\xdf\x90\x59\xd7\xf3\x59\x63\x55\xcf\xc6\x85\x7e\xbd\x3f\xaf\x87\x10\xc6\x92\x01\xea\xf9\xf2\x99\x35\xa5\x51\x8b\xab\x7b\xca\x03\x56\xba\x7e\x71\xf7\xd1\x4d\x7b\x9b\x1b\x8f\x1f\x6e\xd7\xaf\x5e\x3a\x7b\xb2\xfc\xd2\x59\x30\xb1\xd2\x13\x58\x29\xf9\x79\x75\x61\xf1\x5c\x6a\x76\x7e\x8f\x24\x7b\x74\xdb\x85\x53\xaf\xd6\x73\x8a\x66\xfd\xd3\x13\xee\x5f\x79\x11\x00\xc0\x92\x4c\xb5\x3a\x8b\xee\xc7\xd1\xfc\x23\x6e\xb7\xbd\x3f\xad\x27\xed\x66\xd2\x6e\x27\xed\xf8\x09\xa1\x5d\x6c\x2c\x47\x36\xee\xaa\x7e\xf3\xdc\x90\xd6\x57\x68\x9e\xcd\x2c\x2a\x8c\xf7\x9d\x67\x52\xcf\xdf\xff\x6e\xbb\x95\xf6\x4f\xda\x49\xd4\x58\xc2\x3c\x7b\x77\xcd\x23\xcd\x44\xbf\x79\xce\x25\xf5\x95\x9a\x27\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x9d\xe4\x91\xb7\x47\x1f\xaa\xaa\x9f\xba\x36\x7d\xe6\xdc\x4c\x73\xe7\x81\x2d\x33\x97\xf7\x4d\xaf\x3b\x1d\x42\xa3\xb3\xbd\x96\x95\x6b\xab\xdf\x3f\xdc\xfc\xeb\xdb\xad\xc7\x0e\xfc\xb8\xf9\xab\xe3\x17\x9e\x7f\xac\x9e\xf7\x8b\xcb\xd1\xc2\xce\xe1\xb7\xb8\xf2\xc4\x64\x08\x6f\x14\x2a\x17\xe2\xb0\x17\xd7\x86\xd0\xea\x2d\x74\x9a\xe1\xcb\x72\xe1\xad\xce\xca\x73\xb1\x00\x00\x00\xc0\xdd\xe4\xfe\xce\xef\x91\x6e\x3b\x8b\x83\x63\x3d\xed\x5a\x27\x4d\xd6\x3a\xff\xa2\x2c\x2c\x5e\xbf\xb8\xfb\xe8\xa6\xbd\xcd\x8d\xc7\x0f\xb7\xeb\x57\x2f\x9d\x3d\xb9\xfc\xf1\x5a\x7d\xc6\x6b\xde\x70\xbc\x6e\xbb\xb1\xf8\x53\x2b\x04\xe3\x18\x7f\xd3\xf1\x16\xeb\x71\xd7\x3d\xa5\x71\xaa\xa5\x23\xa6\x79\xfe\xf1\xf3\x53\x7f\x57\xf5\x2f\xe5\xff\x46\x75\xfe\x8f\xef\x9c\xfc\x0f\x00\x00\xc0\xcd\x90\xff\xd3\x71\xaa\x0d\xca\xff\xdf\xbd\xf6\xc7\x27\x55\xfd\x4b\xf9\x7f\x43\xcf\x21\x4b\xf9\x3f\xce\x38\xe6\xff\x91\xb0\xbc\xfc\x0f\x00\x00\x00\x77\xb2\xdb\x9d\xff\x9b\xa5\x71\xaa\x0d\xca\xff\xe3\x2f\x8d\x7d\x5d\xd5\xbf\x94\xff\xa7\x86\xcb\xff\xa3\xc5\x69\xc7\x8d\xbf\xc6\x09\xef\x9a\x0c\x61\x6a\xd0\xd4\x01\x00\x00\x80\x3e\xe2\xff\xbb\x2f\x7e\xb5\x10\xf3\x7a\xf6\xcd\x41\x9a\xd7\x9f\x7a\xf4\xe0\xb9\xaa\xf1\x4a\xf9\xbf\x39\x5c\xfe\x1f\xbb\xa5\xaf\x0a\x00\x00\x00\xb8\x19\x47\xbe\xd8\xfe\x70\x55\xbd\x94\xff\x5b\xc3\xe5\xff\xf1\xdb\x3a\x6b\x00\x00\x00\x60\x29\xde\xf9\x70\xe2\x83\xaa\x7a\x29\xff\xcf\x0e\x97\xff\x57\xe7\xcb\xfc\xca\x87\xac\xd3\x4f\xf1\xaf\x10\x0e\x4d\x86\x30\xb1\xb0\x32\x97\x15\x7e\x0e\xed\xa7\xbb\x05\x00\x00\x00\xe0\x16\x89\x39\xfd\xcf\x4f\x77\xfe\x50\xb5\x5f\x29\xff\xcf\x55\xdf\xff\x3f\xde\xe9\x20\x5e\xff\xdf\x73\xff\xbf\xd2\xf5\xff\x85\x42\x76\xd7\xbf\x27\xdd\x18\x00\x00\x00\x80\x7b\x51\xf9\x7a\xfe\x78\x7b\xfc\xec\xc9\x05\xfd\x9e\xbf\x3f\xec\xf5\xff\x0f\xfc\xef\xe0\xab\x55\xc7\x2f\xe5\xff\xfd\xc3\xe5\xff\x7a\x71\x79\x2b\x9f\xff\x07\x00\x00\x00\xcb\xf0\x5f\x7b\xfe\xdf\xf6\xd2\x38\xd5\x06\xdd\xff\xff\xbe\x8f\xde\xfd\xa5\xaa\x7f\x29\xff\xb7\x87\xcb\xff\x71\xb9\xa6\xf8\xf2\x4e\xc4\xf7\xe7\xbd\xc9\x10\xd6\x2f\xac\xe4\x77\x13\xfc\x26\x1e\x6e\x57\x52\x98\x1f\x2b\x14\x3a\x5a\x49\x8f\x6d\xb1\x47\x5e\x98\x1f\x2f\x14\x3a\xe6\x92\x1e\x9b\x27\x43\x78\x70\x61\x65\x7f\x52\xf8\x7f\x2c\xb4\x93\xc2\x95\xb5\x79\xe1\x48\x52\x38\x1d\x0b\xf9\xf9\xd0\x2d\x1c\x4b\x0a\x27\xe2\x99\xf6\xf9\xda\x7c\xba\x69\xe1\xfb\x58\xc8\x2f\xb0\x98\x8f\x57\x50\xac\xe9\x5e\x12\x91\xf4\xb8\xda\xaf\xc7\x42\xe1\x86\x3d\xce\x76\x0f\x0e\x00\x00\x70\x4f\x89\xe1\x39\xcf\xb2\x63\xbd\xcd\x90\x46\xd9\xf9\xda\xa0\x1d\x56\x0f\xda\x61\x64\xd0\x0e\xf5\x41\x3b\x8c\x26\x3b\xa4\x3b\xf6\xdb\x1e\x66\x7b\x0b\x71\x7b\xfb\xcc\xc6\xa5\x3d\xff\xff\xc8\x70\xf9\x3f\xbe\x15\xab\xb2\x45\xbf\xeb\xff\x43\xbc\xfe\x3f\x7f\xae\x61\xf7\xfa\xff\xd9\x58\x68\x24\x85\xf9\x58\x68\xa5\x77\x0c\x68\xc5\x63\x64\x61\xf7\xe3\x78\x8c\x46\x2b\xef\x71\x65\x7d\xb7\x00\x00\x00\x00\x77\xb5\xf8\xbd\x40\x7d\x85\xe7\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x3f\xec\xdd\x6b\x8c\x5c\xd5\x7d\x00\xf0\xb3\xcf\xf1\x3e\xbc\x5e\x48\xaa\x10\x1a\x25\x9b\xa4\xc6\x71\x13\xaf\xd7\x36\x90\xa8\xa5\xca\x9a\x52\x35\x22\xa5\x59\x37\x14\x54\x45\x14\x1b\x7b\x4d\x16\x2f\xd8\xb1\x4d\x89\x51\x88\x8c\x4d\x44\x23\x04\xa5\x0d\x52\xf2\xa1\x08\xa3\x28\xaa\xf9\x00\xb5\x02\x11\x49\x01\xe1\x22\xc5\x11\x2a\x8f\x88\xaa\x28\x80\x40\xa1\x35\x44\x41\xa4\x94\x24\x22\x4d\x90\x42\x35\x7b\xef\x99\xbd\x73\xee\xce\xc3\x8f\x35\x5e\xfa\xfb\x49\xde\x39\x33\xff\xf3\xbc\xf3\xf0\x9c\x7b\xef\x9c\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xc3\xc1\xaf\x5c\xf3\xb7\xcd\xe2\x8f\xfe\xf6\xbc\x67\x5f\xb8\x78\xfc\x8a\x3d\x6b\x2f\x7e\xf5\xba\xf3\x4e\x7d\x32\x84\x89\x99\xc7\x3b\xb2\x70\x47\xff\x8d\xb7\x8f\xff\xfc\xee\x73\xef\xd9\xf3\xc0\xea\x3b\xee\x3b\x7c\xfe\x47\x7b\xf3\x72\x79\x3c\x0c\x54\xff\x74\xe6\x77\x6e\x88\xb5\x1e\x5e\x1c\xc2\xfd\x1d\x21\x74\xa7\x81\x15\x83\x59\xa0\x27\xbf\x3f\x18\xeb\x7b\xdf\x60\x08\xa7\x84\xd9\x40\xad\xc4\x64\x7f\x56\x22\x6d\x38\x7c\xbf\x2f\x84\x7d\x61\x36\x50\xab\xea\x7b\x7d\x21\x0c\x16\x02\x17\x3e\xf5\xc8\xc3\x37\x57\x13\xb7\xf5\x85\xb0\x34\x84\x50\x49\xdb\x78\xbe\x92\xb5\xd1\x97\x06\xce\xe8\xcd\x02\xfd\x69\x60\x6b\x77\x16\xf8\xd5\x5b\x99\x5a\xe0\xbb\x9d\x59\x00\x8e\x59\x7c\x33\xd4\x5e\xf4\x07\x26\xea\x33\x0c\xcf\x5d\xae\xc1\xeb\xaf\xe7\xb8\x75\xec\xed\x95\x0e\xaf\x2b\x26\x86\x1b\xe7\xfb\xd9\xda\x79\xee\x54\x41\x6f\xfa\xc0\xc4\x31\x3d\x6d\xa5\xea\x98\x17\xa5\xb7\xc7\x41\xef\xb6\x05\xf0\x6e\x2b\x6d\xe7\x5b\x3d\x6d\xc5\x2f\x52\xf9\x37\x94\xb7\x66\x43\x95\xd0\xb9\x69\x72\xf3\x86\xab\xa7\x77\xc6\x47\x3a\xc3\xe8\x68\x57\xa3\x9a\xe6\xe9\x79\x7e\xe6\xf5\x2f\x6d\x3c\x92\xf4\x82\x79\x1d\xc6\x0e\x0c\x1f\x97\xd7\xe1\x2d\x4f\x2c\xbd\xbb\x6b\xf9\x05\x8f\xdf\xb7\x62\xe9\xcb\xfb\x3f\xb6\xf7\x95\x63\xed\xe6\x8f\x0a\x9b\xb4\x98\x9e\x6f\x95\x90\xbf\xe6\x16\xcc\xf3\x18\x8d\xfb\x3c\x59\x00\x6f\xbf\xd2\xb7\xa4\x11\x5f\xba\x42\x08\x9b\x3f\xff\x7b\x9f\x69\x16\x2f\xcd\xff\x87\x9b\xcf\xff\xe3\xcb\x39\xde\x76\xd6\xe5\x8e\xb5\xbe\x39\x94\xcd\xcd\xe3\x23\x83\x31\xf1\xda\x50\x36\x37\x07\x00\x00\x80\x05\x63\x21\xec\x35\xdd\x3a\xfa\xd0\x27\x9a\xd5\x57\x9a\xff\x8f\xb4\x77\xfc\x3f\x1e\xf2\xcf\x27\xf3\xd9\x68\x0f\x86\x30\x3e\x93\xd8\xbb\x24\x84\xd3\x66\x1e\xcf\x02\x77\xc5\xe6\x2e\x5b\x12\xc2\x07\x67\x52\x13\xf5\x81\xb5\x49\xe0\x60\x08\xef\x9d\x49\x2c\xaf\x55\x95\x94\x58\x14\x4b\x8c\x24\x81\x9f\x0c\xe5\x81\xf1\x24\x70\x28\x06\x26\x92\xc0\xb7\x62\xe0\xd6\x24\x70\x43\x0c\x1c\x48\x02\x1b\x63\xe0\x60\x12\x38\x37\x06\xc2\x54\xfd\x38\x7e\x7f\x28\x1f\x47\xdb\x81\xbe\x18\x58\x9f\x6d\xc4\x03\xf1\x2c\x84\x5f\x0c\xc5\xd6\x92\x6d\xf5\x5c\xad\x2a\x00\x00\x80\xe3\x24\x9f\x1d\xf6\xd4\xdf\x2d\x9c\xeb\x70\xac\x19\xe2\xf4\xf2\x40\x5f\xab\x0c\xf1\x0c\xec\x86\x19\x2a\x49\x0d\xe9\x0c\xb6\x36\xad\x6a\x58\x43\x77\xab\x1a\x3a\x5b\xd5\x50\x1b\xf7\xee\xe6\xc3\x2f\xd5\xdc\xd1\xaa\xe6\xd2\x69\x18\x1d\xf5\x19\x6e\xff\xe5\xdf\x7c\x36\x34\x51\x9a\xff\x8f\x35\x9f\xff\x57\xe6\xe8\x48\x47\xe9\xf8\x7f\x08\xeb\x66\xfe\xc6\xdc\x9d\x79\x64\xba\x16\x5f\x3f\x51\x97\x01\x00\x00\x00\x38\x06\x03\xff\xfb\xe2\x37\x9b\xc5\x4b\xf3\xff\xf1\xf6\xce\xff\x8f\xfb\x44\xba\x0a\x99\xc3\x63\x71\x37\xc4\x96\x25\x21\x8c\xd5\x07\xb2\x6a\xff\xb0\x1c\xc8\x8e\x7a\x0f\xe4\x01\x00\x00\x00\x58\x08\x6a\xc7\xe3\x6b\xc7\xc2\xa7\xf2\xdb\xec\x14\xed\x74\x3e\x5d\xce\x3f\x71\x84\xf9\xe3\x81\xff\xf1\x39\xf3\xf7\x1e\x7c\x70\x7d\xb3\xfe\x96\xe6\xff\x13\xed\x9d\xff\xdf\x5f\x7f\x9b\x75\xe2\x50\xec\xc5\xd7\x96\x84\xb0\xa8\x10\xf8\x41\xec\x65\x35\x30\x63\x24\x06\x7e\xfc\xc9\xfa\x40\x3e\xfe\x43\x71\x03\xdc\x14\xab\xca\x4f\x4c\xa8\x55\x75\x53\x2c\xb1\x3e\x06\xc6\x92\xc0\xbe\x46\x25\x7e\x58\x2b\x71\x5a\x7d\x20\x7f\xb2\x6a\x8d\xef\xad\x8d\x63\x2a\x2f\x51\x08\x00\x00\x00\xc0\x09\x17\x77\x07\xc4\xe3\xf2\xf1\xfc\xff\x0f\xfd\x66\xf5\x35\xcd\xca\x95\xe6\xff\xeb\x8f\xec\xfc\xff\x99\x79\x70\xe9\xf4\xfe\xe9\x81\x10\x56\x76\x87\xd0\x95\xfe\x30\xe0\xb1\xfe\x6c\x61\xc0\x18\x18\xec\xc8\x13\x0f\xf5\x67\x75\x75\xa5\x55\x5d\xdf\x1f\xc2\x39\xd5\x81\xa5\x55\xbd\x98\xaf\xff\xdf\x9d\xae\x31\xf8\x54\x5f\x56\x55\x0c\x9c\xf6\xa1\xfd\xaf\x9f\x51\x4d\x7c\xb3\x2f\x84\x95\xc5\xc0\xd3\x9f\xbb\xf3\xac\x6a\x62\x67\x12\xa8\x35\xfe\x97\x7d\x21\x7c\xa0\x3a\xda\xb4\xf1\xef\x2c\xca\x1a\xef\x49\x1b\xff\xfa\xa2\x10\xde\x5f\x08\xd4\xaa\xba\x6c\x51\x08\xd5\xc6\x7a\xd3\xaa\x1e\xa9\xe4\xd7\x31\x48\xab\xfa\xe7\x4a\x08\xef\x2a\x04\x6a\x55\x9d\x5d\x09\x61\x57\x00\x60\x81\x8a\xff\x95\x6e\x2a\x3e\xb8\x63\xd7\xb5\x5b\x36\x4c\x4f\x4f\x6e\x9f\xc7\x44\xdc\x87\xdf\x17\x36\x4f\x4d\x4f\x8e\x6e\xdc\x3a\xbd\xa9\xd2\xa0\x4f\x9b\x92\x3e\xd7\x2d\x63\x74\x7d\x79\x4c\xed\x5e\xf9\xe6\xb9\x7c\x89\xa2\x8b\xee\x5d\x37\xd8\x4e\xba\xf6\x3b\xc1\xb1\x62\x5b\xf9\x7e\xfc\xd2\x89\x83\xf9\xfd\xf8\x5d\xa8\x67\x66\x9c\xab\x7b\xea\xee\xae\x49\x87\xfc\x91\x0f\x97\x9b\x08\x85\x6f\x52\x8d\x86\xdc\x39\xcf\x43\xee\x2f\x56\x32\xfb\x24\x96\xea\x8f\xf9\x7b\xc3\x40\x58\x74\xf5\x8e\xc9\xed\xa3\x5f\xdc\xb0\x73\xe7\xf6\x55\xd9\xdf\x76\xb3\xaf\xce\xfe\xc6\xc3\x4c\xd9\xb6\x5a\x95\x6e\xab\xfe\xb9\xfa\xd6\xc6\xcb\xa3\xe1\x6a\x59\x89\xa3\xdd\x56\xcb\x8a\x95\xac\xdc\x79\xe5\xb6\x95\x3b\x76\x5d\xbb\x62\xea\xca\x0d\x97\x4f\x5e\x3e\x79\xd5\xaa\xb3\x57\x8f\x9d\x39\xb6\x66\xec\xe3\x67\xae\xac\x8e\x6a\x2c\xfb\xdb\x62\xa8\xcb\xe6\xaa\x3a\x19\xea\x5b\x77\xb6\x39\xae\xe3\x38\xd4\xd3\xbb\x0b\x95\x9c\x88\x4f\x0d\x09\x09\x89\x85\x96\xd8\x3a\xb0\xac\xe9\xff\xc9\xa5\xf9\xff\xb6\xe6\xf3\xff\xf8\xa9\x13\x3f\xf9\xf3\xf5\x19\x1a\x1d\xff\x1f\x8e\x87\xf9\xb3\xc7\x67\x0f\xf3\xaf\x8f\x81\x7d\xed\x1e\xff\x1f\x6e\x74\x34\xbf\x76\x62\xc0\x48\x12\xd8\x1d\x03\xbb\x1d\xe6\x07\x00\x00\xe0\x9d\x21\x4e\xf2\xe3\xde\xcc\xb8\x57\xfa\xa7\xcb\xbf\xf3\x72\xb3\x72\xa5\xf9\xff\xee\xf6\x7e\xff\x7f\x9c\xd6\xff\xaf\x2d\x5d\x7f\x7e\xa3\x65\xfe\x97\xc7\x12\x63\x8d\xd6\xff\x4f\x97\xf9\xaf\xad\xff\xbf\xbb\xd1\xfa\xff\xe9\x32\xff\xb5\xf5\xff\xf7\xbd\x0d\xeb\xff\x5f\x5d\x0b\x24\x9b\xe4\x17\xd6\xff\x07\x00\x00\xde\x09\x4e\xdc\xfa\xff\x2d\x97\xf7\x4f\x2f\x10\x50\xca\xd0\x72\x79\xff\xf4\x02\x01\xa5\x0c\x2d\x97\xf1\x6f\xf7\x02\x01\x47\xbc\xfe\xff\xf3\xff\xf9\x57\xff\x1d\x9a\x28\xcd\xff\x6f\x6d\x6f\xfe\x6f\xe1\x7e\x00\x00\x00\x38\x79\x7c\xf9\xcf\xae\xf9\x9d\x66\xf1\xd2\xfc\x7f\x5f\x7b\xf3\xff\x13\xbf\xfe\x5f\x68\x74\xfe\xff\x48\xa3\xc0\x44\xa3\x85\x01\xad\xff\x07\x00\x00\xc0\x02\xd5\x68\xfd\xbf\xe1\x1b\xfb\x2f\x6d\x56\xae\x34\xff\x3f\xd0\xde\xfc\x3f\x9e\x76\xd1\x59\x97\x3b\xd6\xfa\xe6\x50\xb6\xa6\x5d\x48\xd7\xb4\x7b\x6d\xa8\xf6\x93\x01\x00\x00\x00\x58\x18\x3a\xc3\xe8\x68\x4f\x9b\x79\xeb\x56\x46\x5d\x7b\xf4\x6d\x3e\x93\x2f\x05\xda\x2c\x5d\xf4\xe2\x9f\x1c\x3e\xb2\xf3\xff\x0f\xb6\x37\xff\xaf\xfb\x5d\xc6\x2d\x4f\x2c\xbd\xbb\x6b\xf9\x05\x8f\xbf\x79\xdf\x8a\xa5\x2f\xef\xff\xd8\xde\x57\x66\x8f\xff\x03\x00\x00\x00\xf3\xa7\xdd\xfd\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xdb\xef\xc5\xff\xd8\xb3\xa6\x59\xbc\xf4\xfb\xff\xb0\x6e\xe6\xf1\x46\xbf\xff\x8f\xd7\xfd\x8b\xbf\x2f\x78\x77\x5d\xee\x58\x6b\xeb\xf5\xff\xf2\xfb\x17\x7e\xfa\x9e\x5d\x33\x4b\x16\x3e\x36\x14\xc2\x87\x8b\x81\x2d\x7b\xb6\x9c\x12\xf2\x6b\xf3\x2f\x2b\x06\x1e\xbe\x64\xf9\x7b\xaa\x89\x3d\x69\x89\x07\x5f\x38\xf7\xa5\x6a\xe2\xd2\x34\xf0\xa9\x15\xa7\xbe\x51\x4d\x9c\x93\x04\xd6\xc7\x45\x12\xdf\x9b\x06\xe2\x55\x15\xdf\x58\x9c\x04\xe2\xf2\x8a\xff\x9e\x06\xe2\xf6\x38\x90\x06\x7a\xf3\xc0\x57\x17\x67\xe3\xe8\x48\xb7\xd5\x4f\x07\xb3\x6d\xd5\x91\x6e\xab\x67\x07\x43\x58\x52\x08\xd4\xb6\xd5\xfd\x83\x59\x1b\x1d\xe9\x00\x6f\x4b\x02\xb5\x01\x7e\x21\x0d\xc4\x01\xfe\x79\x1e\xe8\x4c\x7b\x75\xcf\x40\xd6\xab\x18\x18\x8c\x45\xef\x18\xc8\x7a\x05\x00\xc0\x49\x2b\x7e\x0b\xec\x09\x9b\xa7\xa6\x27\xc7\xe2\x57\xf8\x78\x7b\x7a\x77\xfd\x6d\x54\xb7\x64\xd9\xf5\xe5\x6a\x3b\xda\x6c\xfe\xb9\x7c\x69\xb2\x8b\xee\x5d\x37\xd8\x4e\xba\x2b\xfd\x2e\x3a\x7b\xad\xf1\x9e\x50\xa9\x0e\x61\x55\xe9\xeb\x6a\x31\x4b\xc7\xcc\x28\x8f\x4f\x2d\x2d\x36\xdd\xbb\x1b\x0c\xb9\xd5\x6a\x6f\x9d\x0d\xca\xa5\x8e\x74\xd3\xf5\x36\x1e\x51\x5f\x36\xa2\xd1\x8d\x5b\xa7\x37\xf5\xb4\x1c\xf8\x9a\xd6\x59\x56\x77\xb7\xcc\xb2\xaa\x34\xd9\x29\x66\xe9\x9c\xd9\xa4\x6d\xd4\xd2\x46\x5f\xda\x18\x51\x9b\xdb\xa6\x8d\x2e\xc7\xfb\x9d\x61\x74\xb4\x2b\xc9\xf5\x07\x31\x38\x1c\xea\xb4\x7a\x45\xb4\xfb\x7b\xfd\xe2\x3a\x7f\x8d\x5e\x05\xc5\x3c\x57\x1d\xde\xfb\xab\x66\xf5\x95\xe6\xff\xc3\xed\xcd\xff\x2b\xc5\x71\xbd\x91\x5f\x0c\x60\x77\xbc\xb2\xde\xdf\x2d\xb1\xcc\x3f\x00\x00\x00\xcc\xaf\xaf\xae\xfd\xf5\x37\xe2\xbf\xcf\xde\xf8\xe8\xd3\xcd\xf2\x96\xe6\xff\x23\xed\xcd\xff\xe3\x1e\xac\xfc\x50\x70\xb6\xb7\xe3\x60\xbc\xfe\xff\xde\x25\x21\xcc\x5c\x5a\x7f\x38\x0b\xdc\x15\x9b\xbb\x6c\x49\x08\x1f\x9c\x49\x4d\xc4\x12\xd9\x05\xf5\xcf\x8f\x25\xc6\xb2\xc0\x5d\x71\x87\xc9\xf2\x58\x62\xfd\x44\x7d\x55\x8b\x62\xe0\x40\x12\xf8\xc9\x50\x1e\x38\x98\x04\x0e\xc5\x40\xbe\x97\x62\x7f\xc8\x77\xe5\xfc\xfd\x50\x08\x67\xcd\xa4\xd6\xd5\x97\xd8\x16\x4b\x0c\x27\x81\xcf\xc4\xc0\x48\x12\x18\x8d\x81\xb1\x24\xb0\x38\x06\xc6\x93\xc0\xab\x8b\xf3\xc0\x44\x12\xf8\xb7\x18\x08\x53\xf5\xdb\xea\xde\xc5\xf9\xb6\x02\x00\x00\x38\x12\xf9\x3c\xab\xa7\xfe\x6e\x48\xe7\x79\x07\xba\x5b\x65\xe8\x68\x95\xa1\xbf\x55\x86\xce\x56\x19\x2a\xad\x32\x34\x1a\x45\xbc\xff\xed\x98\xa1\x27\x39\x79\xa5\xa3\x90\xa9\x27\xad\xb5\x2f\xa9\xa5\x94\x21\x5e\x0c\xff\x88\xfb\x55\xca\x10\x7e\x58\x9f\x33\x2d\x58\x6a\x3a\x9e\x7f\x50\x3b\xdf\xa0\xa3\x3e\xc3\x03\x9f\xe8\xae\x84\x26\x4a\xf3\xff\xb1\xf6\xe6\xff\xfd\xf5\xb7\x59\xeb\x87\xe2\xfc\x7f\xf6\xfa\x7f\x59\xe0\x07\xb1\x7b\x5f\x8b\xa7\x8e\x8f\xc4\xc0\x8f\x3f\x59\x1f\xc8\x77\x0c\x1c\x8a\x93\xdd\x9b\x6a\x55\x4d\xe4\x25\xf2\x49\xfb\x4d\xb1\xc4\x78\x0c\x8c\x24\x81\x6d\x31\x30\x9e\x04\xd6\xaf\xcb\x03\xfb\xde\x53\x1f\xc8\x67\xda\xb5\xc6\xf7\xd6\x1a\x9f\xca\x4b\x14\x02\x00\x00\x00\x70\xc2\xc5\x1d\x04\x71\x37\x4d\x9c\xff\xdf\xb1\xe3\x2b\x03\xcd\xca\x95\xe6\xff\xe3\xed\xcd\xff\x63\x7b\x03\xc5\xc6\x6e\x88\xb5\x1e\x5e\x1c\xc2\xfd\x1d\xb3\xbd\xa9\x05\x56\x0c\x66\x81\xb8\x1f\x63\x30\xfe\x3c\xfe\x7d\x83\x21\x9c\x52\xd8\xc1\x51\x2b\x31\xd9\x9f\x95\xe8\x4d\x1a\x0e\xdf\xef\xcb\x7e\xa1\xde\x9b\x56\xf5\xbd\xbe\xec\xc7\x07\xf1\xfe\x85\x4f\x3d\xf2\xf0\xcd\xd5\xc4\x6d\x7d\x21\x2c\x2d\xec\x7d\xa9\xb5\xf1\x7c\x25\x6b\xa3\x2f\x0d\x9c\xd1\x9b\x05\xfa\xd3\xc0\xd6\xee\x2c\x10\xf7\xfc\xd4\x02\xdf\xed\xcc\x02\x70\xcc\x6a\x7b\x05\xe3\x0b\x2a\x3f\xd5\xa5\x66\x78\xee\x72\x0d\x5e\x7f\xef\x94\x6b\x82\xa6\xc3\x2b\xed\x03\x9d\x23\xdf\x5c\xbf\xb9\x9a\x2f\xa5\x1d\xae\xf9\x3e\xd5\x9a\x23\x7b\xda\x9a\xee\xbf\xe5\xb8\x29\xbd\x3d\x0e\x7a\xb7\x2d\xc4\x77\xdb\xb0\x77\x5b\xf1\x8b\x54\xfe\x0d\xe5\xad\xd9\x50\x25\x74\x6e\x9a\xdc\xbc\xe1\xea\xe9\x9d\xf1\x91\xe2\x2f\x59\x4b\xe6\xe9\x79\x2e\xfe\x4a\xb5\x9d\xf4\x71\x78\x1d\xee\x3e\xfa\xde\xb6\x56\x49\x3b\x30\x96\x7c\x7c\x8c\xcd\x5d\x6e\xee\xd7\x61\x47\xac\xee\x96\x27\x96\xde\xdd\xb5\xfc\x82\xc7\xef\x5b\xb1\xf4\xe5\xfd\x1f\xdb\xfb\x4a\xdb\xdd\x68\x20\xfe\x50\xf8\x91\xeb\xfe\x75\xf0\x47\x85\xcd\x3b\xdf\x2a\x21\x7f\xcd\x2d\xb8\xcf\x93\x09\x9f\x27\x0b\xf1\xbf\x81\x11\x4f\x5b\x08\x61\xdd\xab\x5f\xbf\xa9\x59\xbc\x34\xff\x9f\x68\x6f\xfe\xdf\x9d\xdc\xce\xf8\x75\xdc\x98\x3b\x96\x84\xf0\x91\xc2\xc6\x7d\x2c\x6e\xfe\x3f\x5e\x92\x7d\x0e\x16\x02\xd9\xa7\xe4\xbb\xca\x81\xec\x90\xfb\x7f\x0d\x35\xfc\xe4\x04\x00\x00\x80\xe3\xad\xb6\xbb\xa3\xb6\xbf\x60\x2a\xbf\xcd\x4e\x08\x4f\xe7\xc9\xe5\xfc\x13\x47\x98\x3f\xee\xaf\x18\x9f\x33\x7f\xbb\xfd\xee\xff\xeb\x4b\x96\x36\x8b\x97\xe6\xff\xeb\x9b\xcf\xff\x17\x25\xdd\x74\xfc\xdf\xf1\x7f\xe6\x89\xe3\xff\x73\x3a\xd9\x77\x45\x2f\x4a\x1f\xd8\x7d\x4c\xbb\xa2\x4b\xd5\x31\x2f\x1c\xff\x9f\xd3\xc9\xfe\x6e\x73\xfc\x7f\x4e\x8e\xff\x3b\xfe\x3f\x17\xc7\xff\x5b\x70\xfc\x7f\x4e\x27\xfb\xd3\x56\xfa\x96\xb4\xcd\x97\xae\x10\xc2\xcb\x7f\xf4\xd0\xb3\xcd\xe2\xa5\xf9\xff\xb6\xf6\xe6\xff\xd6\xff\x9b\x7b\xd1\xbe\xda\xfa\x7f\xeb\x1b\xad\xff\xb7\xad\xd1\xfa\x7f\xbb\xad\xff\x07\x00\x00\xcc\xab\x06\x0b\xcd\xa5\xf3\xbc\xd2\xea\x7d\xa5\x0c\xe9\xea\x7d\xa5\x0c\x2d\x17\x08\x6c\xb9\xc4\xa0\xf5\xff\x8e\x78\xfd\xbf\x97\x4e\x7f\xfe\x37\xa1\x89\xd2\xfc\x7f\x77\x7b\xf3\xff\xf8\x72\x18\x28\xb6\xbe\x50\xd6\xff\x1b\x59\xd7\xa0\xaa\x5b\x63\x60\x9b\x85\x01\x01\x00\x00\x38\x19\x35\xda\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xdb\xeb\x81\x7f\xf8\x9f\x4d\xcd\xe2\x8f\xfe\xf6\xbc\x67\x5f\xb8\x78\xfc\x8a\x3d\x6b\x2f\x7e\xf5\xba\xf3\x4e\x7d\x32\x84\xa9\x99\xc7\x3b\xb2\x70\x47\xff\x8d\xb7\x8f\xff\xfc\xee\x73\xef\xd9\xf3\xc0\xea\x3b\xee\x3b\x7c\xfe\x47\x2b\x79\xb9\x9e\xfc\xf6\x77\xeb\x72\xc7\x5a\xdf\x1c\x0a\x61\x5f\xe1\x91\xc1\x98\x78\x6d\xa8\x7a\x67\x36\x70\xe1\xa7\xef\xd9\xd5\x5d\x4d\x3c\x36\x14\xc2\x87\x8b\x81\x2d\x7b\xb6\x9c\x52\x4d\x7c\x6b\x28\x84\x65\xc5\xc0\xc3\x97\x2c\x7f\x4f\x35\xb1\x27\x2d\xf1\xe0\x0b\xe7\xbe\x54\x4d\x5c\x9a\x06\x3e\xb5\xe2\xd4\x37\xaa\x89\x73\xf2\x40\x47\xda\xdd\x7f\x5c\x9c\x75\xb7\x23\xed\xee\xcd\x8b\x43\x58\x52\x08\xd4\xba\x7b\xc5\xe2\xfa\xaa\x6a\x6d\xfc\x69\x1e\xe8\x4c\xdb\xf8\xa7\xc1\xac\x8d\x18\x18\x8c\x45\xbf\x31\x98\xb5\x11\x03\xd3\xb1\xc4\xd4\xa2\x10\x56\x76\x87\xd0\x95\x56\xf5\x68\x25\xab\xaa\x2b\xad\xea\x5f\x2a\x59\x55\x5d\x69\x55\x5f\xae\x84\x70\x4e\x08\xa1\x3b\xad\xea\x85\xde\xac\xaa\xee\x74\xe4\x4f\xf6\x66\x55\xc5\xc0\x69\x1f\xda\xff\xfa\x19\xd5\xc4\xbe\xde\x10\x56\x16\x03\x4f\x7f\xee\xce\xb3\xaa\x89\x2f\x24\x81\x5a\xe3\x7f\xd1\x1b\xc2\x07\xaa\x2f\x99\xb4\xf1\x6f\xf7\x64\x8d\xf7\xa4\x8d\xdf\xd6\x13\xc2\xfb\x43\x08\xbd\x69\x89\x5f\x76\x67\x25\x7a\xd3\x12\x2f\x76\x87\xf0\xae\x42\xa0\xd6\xf8\xe7\xbb\x43\xd8\x15\x78\x47\x88\x1f\x3e\x75\x9f\x68\x3b\x76\x5d\xbb\x65\xc3\xf4\xf4\xe4\xf6\x79\x4c\xf4\xe6\x6d\xf5\x85\xcd\x53\xd3\x93\xa3\x1b\xb7\x4e\x6f\xaa\x24\x7d\x6a\xa4\xa3\x90\x7e\xeb\xfa\xa3\x1f\xfb\x73\xaf\x7f\x69\x63\xf5\xf6\xa2\x7b\xd7\x0d\xb6\x93\xee\xce\xcb\xf5\xcc\x74\x79\x75\x4f\xdd\xdd\x35\x27\x7b\xef\x63\xbf\xfa\x8b\x95\xcc\x3e\x1f\xa5\xfa\x63\xfe\xde\x30\x10\x16\x5d\xbd\x63\x72\xfb\xe8\x17\x37\xec\xdc\xb9\x7d\x55\xf6\xb7\xdd\xec\xab\xb3\xbf\x5d\x79\x34\xdb\x56\xab\x16\xca\xb6\x5a\x56\xac\x64\xe5\xce\x2b\xb7\xad\xdc\xb1\xeb\xda\x15\x53\x57\x6e\xb8\x7c\xf2\xf2\xc9\xab\x56\x9d\xbd\x7a\xec\xcc\xb1\x35\x63\x1f\x3f\x73\x65\x75\x54\x63\xd9\xdf\xe3\x31\xd4\x3b\x4f\xfc\x50\x4f\xef\x2e\x54\x72\x22\x3e\x00\x24\x24\x24\x16\x5a\xa2\xb3\xee\xd3\x6d\xec\x64\xff\x20\x2f\x7d\xd1\x9f\xed\x68\x4f\xa8\xcc\x7c\x40\x97\xa6\x15\xc5\x2c\x1d\x33\xa3\x3c\x1e\x83\x5e\x7b\x94\x23\x3e\x9a\xef\x29\x2d\x47\xb4\xaa\x34\x71\x28\x65\x59\xdd\x3a\xcb\x9a\xd2\x64\x62\x36\x4b\x5f\x96\x65\xe6\x7b\x5d\x69\x72\x58\xac\xa9\x73\x66\x93\xc6\xfb\x9d\x61\x74\xb4\xab\xd1\x76\x18\xae\xbf\x5b\xdc\xbc\x3f\x3b\x86\xcd\xfb\x4c\xbe\xe9\xda\x4d\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x7f\xec\xc0\x81\x00\x00\x00\x00\x00\x90\xff\x6b\x23\x54\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x61\x07\x0e\x04\x00\x00\x00\x00\x80\xfc\x5f\x1b\xa1\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\x0a\x3b\x70\x2c\x00\x00\x00\x00\x20\xcc\xdf\x3a\x8c\x9e\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\x14\x00\x00\xff\xff\x03\x54\x23\x07", 20717));
res = -1;
NONFAILING(res = syz_mount_image(/*fs=*/0x20000040, /*dir=*/0x20005140, /*flags=*/0, /*opts=*/0x20000080, /*chdir=*/0, /*size=*/0x50ed, /*img=*/0x200051c0));
if (res != -1)
r[0] = res;
break;
case 1:
NONFAILING(*(uint32_t*)0x20000140 = -1);
NONFAILING(memcpy((void*)0x20000148, "\x03\xfd\x69\x02\x43\xfb\xb3\xd1\xa7\x79\xba\xbf\x54\x06\x72\x33\x0d\xe4\xcc\x81\x17\xf7\x7b\xca\xa5\x91\x59\xa7\x39\x2e\xfa\xb8\xf4\x18\xb4\xb6\x7c\x76\xf1\xd5\xab\x66\x10\xd2\xd4\xbb\x05\x5f\xc0\xf0\x57\x5b\x11\xd3\xd5\x2d\x33\x21\xea\x48\x74\xfa\xac\x1c\xe0\xe1\xf8\xee\x00\x3d\xb7\xa0\xec\x48\xc7\xc8\x09\x07\x29\x2e\xeb\x2c\xde\x08\x21\xbf\x4e\xe2\x7f\x3f\xb8\x7c\x9d\xe2\xb2\x2a\x2f\x23\x77\x4d\x88\x15\x90\xcd\x00\x0f\x5e\x4b\x6a\xc3\xff\x64\x9f\xd1\x81\x8b\x40\x08\x1f\xfd\x9a\xa0\x76\xf9\xf8\xb2\x7b\x19\x13\x87\x21\xbc\x59\x4e\xe4\xdf\xfc\x2f\x3d\x8d\x95\x12\xea\xae\x9e\xf8\xc8\x6b\x07\x43\x5c\x36\x8d\xaa\x30\x8d\x52\xc4\xdd\xa6\xf4\xb1\x9f\x80\xd5\xa5\x18\x4c\x61\xce\x67\x0c\xee\x71\x2c\xb9\x24\xc2\xa8\x15\xd5\x9c\xd2\x01\xfd\x76\x8b\x44\x83\x60\xaa\x38\xa2\x02\x8c\x4b\x4a\x24\x6f\x36\x14\x05\xfe\x02\x45\xca\x0a\xb0\xc3\xec\x2f\xac\x76\xcc\x28\x29\xa8\x7f\x28\x29\x99\x55\xc9\xbf\x70\x58\xc7\x08\x15\x8f\xae\x98\xff\x28\x30\x38\x61\x23\x8e\xf3\x95\x87\xac\xed\xe7\x51\xaf\x7c\x54\x76\xbc\xbe\xf0\xee\xfa\x84\x0a\x1e\x6c\x4e\xca\x78\x01\x58\xf7\xd6\x5f\xfa\xb3\xad\xc2\x82\xe2\x57\x41\x81\x55\xc9\x7a\x72\x16\xa6\xd1\x99\x39\xd6\x06\x7d\x74\x81\xc6\x4a\xcf\xf6\x6f\xc2\x96\xfe\x78\x0d\xef\xc4\xab\xbf\x26\x61\xbc\xcd\x85\x15\x72\x5f\x97\xa9\xfc\x30\xa7\xcc\x28\xd6\x80\xfd\xa0\xaa\xf0\x2d\x71\x80\xa9\x98\x1f\x91\x42\x1c\x58\xc5\x32\xfc\xb3\x68\x12\x91\xf9\x2c\xfc\xbf\x80\x92\x16\x5d\x95\x77\xa2\xb3\x97\xae\xbd\x17\x0c\x41\xaa\x07\x96\x16\x53\x78\xdd\x23\x1a\x4e\x01\x85\xf4\x63\xbd\x43\x83\x0e\x53\x73\xe1\x3a\x29\xd7\x5a\x9b\xe4\x63\xc7\x81\x0d\x22\xfd\x08\x2b\x0f\xba\x38\x36\xb7\x5f\x54\x4e\xec\x52\xf8\x88\x3f\xa5\x08\x56\x50\x2f\x71\x4f\xde\x7c\x46\x21\x85\xda\xae\x94\x4a\x8d\x85\x52\xce\x87\x4f\x2a\x47\xb4\xe8\x97\x25\xb0\x5e\xba\xb5\x89\xc0\xb5\x3f\x1e\x04\xde\x1a\x45\xe2\x15\x3c\xd0\xab\xc3\xcf\x71\x3f\x22\x76\x09\xe5\x3e\x81\x31\xaa\xde\x35\xc5\xd9\x22\xdf\xaa\xdd\x84\xaa\x40\x1d\x53\x7b\x5d\xf3\xdb\x82\x8a\x5b\x1d\x76\xe4\x9b\x04\x13\x4b\xc1\x4a\x7b\xae\x5d\x32\x9e\xd0\x14\x88\x63\xf4\x50\xac\xcd\xf7\x7a\x40\xed\x75\xad\x0b\xc6\x34\x55\xc3\xb5\xa7\x0a\xc4\xc9\x08\x3d\xb5\xbc\xe5\x55\x0d\x03\x5d\xd4\x4e\x3f\x54\x84\x0b\xb6\x4b\x97\x47\x2b\x61\xab\x57\x29\x8d\x25\x10\x4f\xbc\xda\xc7\x31\xb6\xab\xf8\xbc\xfe\x19\xe2\x18\xeb\x3f\x22\xa2\x2a\x8c\xb6\xf2\x38\x1d\xed\x59\x12\xde\x78\xf9\x95\xdc\xc2\x0a\x31\xc3\xab\x64\xef\xa0\xe8\x82\x28\xf4\x1f\x0c\x98\xc0\xf1\xcf\x03\x22\x1f\xbb\xd1\xb2\x3f\x5c\xc2\x9b\xff\xf7\x64\xc6\x63\xa0\xa6\xb7\x7e\xd5\x98\x89\x90\xa2\x5c\x6f\x35\xae\xa5\x39\xe1\xb1\xd2\x04\xae\xd0\x45\x4e\x30\xd2\x3b\xcf\x05\x7d\xfb\xe6\x38\x68\xa9\x93\xe1\x28\x2e\xe7\x9a\xe9\xc8\xb2\xf7\xf5\x36\x9c\xae\x40\x43\xe7\x50\x9f\x09\x67\x55\x17\x99\x57\x43\x4e\x29\x09\x98\x75\x88\x6c\xd1\x60\x58\x58\xa0\x3a\x0b\x5a\x4e\x43\x44\x28\x90\x13\x89\x45\x02\xf0\xb1\x3a\x79\x5a\x6a\x2b\x35\x1f\x3b\x40\x2c\xba\xc4\xe8\x0c\x20\x03\x1e\x68\x7d\xec\xc6\x6e\x55\x45\xef\xa8\x5e\x70\xe8\x38\x1b\x28\x84\xfe\x52\x08\x53\x66\x38\x84\xaa\xb8\x1f\x0e\xe8\x6a\x19\xbc\x2b\xcb\xf2\x74\x26\x5e\xe2\xc5\xe7\x92\xaa\x21\x15\x29\x56\xd7\x28\x67\x3f\x2c\x4d\xde\x08\x44\xe8\x60\xea\x32\x5c\x5d\x9a\x3e\x24\x33\x65\xb0\x1d\xc3\xe1\x62\x07\x56\xc0\x2b\x33\x4f\x47\x2a\xb2\x75\x58\xbf\x71\xa1\x58\x27\xcd\x0a\x63\x44\x52\x87\x51\x81\x55\x47\x0a\x18\x91\x58\xcd\xf6\xb5\x4f\xb8\xce\xe4\x04\x60\x86\x7f\x6b\x69\x15\xc5\x22\xf8\xa7\x99\xd7\x21\xca\x5b\xc4\x18\x16\xc6\x11\x82\xe1\xbe\xcc\x5f\x4a\x44\x58\x17\x81\xed\x81\x9c\x52\xe9\x24\xf3\xa0\x95\x43\xe9\x84\x9a\x18\xe8\xa6\x62\x1d\xd2\x69\x94\x34\x22\xb3\x04\x1c\x55\xc0\xdf\x38\x79\x46\x78\x50\xb8\xac\x9f\x06\x05\x24\x22\xb9\x04\xa5\x15\xfb\x78\xb0\x4b\x11\x9e\x94\xf0\x0e\x56\x33\xf7\x9c\x8a\x93\x6e\x45\xd0\x12\xa5\xc3\x89\xf5\x56\xbd\x1b\xe7\x69\x5c\xe7\x23\xa8\x1c\x57\xd8\x63\x79\x93\xbb\x61\x2c\x88\x13\x4c\xc0\x56\xe0\x23\x36\x95\x34\x08\xfe\xe8\xbd\xed\xd0\x43\xee\xa2\x09\x0c\x5a\x51\x69\x3b\x1a\x1f\x5b\x55\x69\x8f\x5d\x94\xa9\x6c\xb0\x2a\x82\xf8\x83\xaf\xc9\x18\x5b\xed\x5b\x2c\xf5\xc3\x18\xd0\x2a\x35\xd7\x52\x12\xa5\x66\x9b\xf7\xf3\x53\x5f\x3c\x5d\xa6\x57\x40\xb9\x30\x0d\xe9\x5d\x28\x65\x38\x99\x8b\x0c\x09\x48\x38\x95\xab\x38\x90\x5a\x31\x1f\x30\x73\xe3\xb0\xa6\x02\x70\x1c\x27\xc4\x73\x8f\x67\xfe\x9e\xea\xab\xe8\x9c\x7b\x9f\x1d\x3e\x78\x47\xc5\x5a\x93\x8c\x26\xd6\xc8\x00\x4e\xaa\x58\x2c\x69\x33\xa7\x02\x9e\xa7\x66\x31\x49\xac\xb4\x40\xc8\xfd\xc8\x6e\xd4\xd1\xa5\xfe\xf3\x14\xe2\x28\x13\x2c\x34\x54\xd3\xf7\x4f\x22\xd1\xfb\x19\xc7\x48\x64\xf3\x0c\x30\xfd\xcc\x72\x77\x28\xbc\x92\x57\xb4\x86\x30\xec\x85\x00\xb4\x0e\xfa\x00\x22\x45\xb7\x89\xd9\x08\xa6\x09\x49\xae\x98\xa0\xbe\xd3\xd9\x6d\x6d\xb2\x19\x68\x69\xb1\xbf\x96\xcd\x0a\x2e\xa9\x7b\xd1\x2e\xf4\x53\x0e\xaa\x06\x64\xa4\x5c\x05\x1e\x06\x3a\xa5\x43\xc7\xb7\x26\x04\x67\x3d\x49\xbb\x82\x4a\x20\x34\xac\xf0\x31\x67\x56\x79\x77\x93\xbe\x0a\xb2\x29\xdd\xd9\xe5\x0f\x07\x75\xf5\xa7\x14\x78\x1f\x7a\xf7\x1f\x4a\x45\xfb\xbd\xef\x24\x13\x44\x24\x1c\x44\xc3\xdd\x4d\xb3\xdd\x97\x72\x4e\x8f\x2c\xb2\x23\x51\xae\x45\x3c\x03\x3c\x40\xc9\xf0\xa0\xa3\x99\x61\x99\x63\xaf\xea\xac\x10\xbb\x61\x2d\x42\xab\x41\x89\xd4\xf5\x16\xbd\x75\x10\xc6\x61\xd1\x85\x92\x55\x8d\xb7\x3b\x00\x5a\xa9\x76\xd5\xb5\xe9\xa6\x6a\xc3\xc9\x82\x71\xca\xfa\xc6\x90\xf2\x2c\x46\x15\xa2\x87\xd8\xf0\x61\x21\x6e\xba\x64\x32\x64\x94\xea\x1f\x5d\xda\x48\x5c\xe3\xae\xcf\x93\xb9\x63\xd2\xb7\x08\x9f\x99\x08\x9a\x2b\x3f\xb5\x1b\xa0\x83\x34\x84\x46\xb0\x38\x69\xd3\xdd\x2b\xbb\x3c\xfa\x69\xd6\x2b\x10\xea\x69\xbb\x9c\xab\xe2\xb9\xf3\x3a\xc7\x45\xcb\x5d\xd6\xd9\xca\xba\xbe\x4d\x49\x7d\x29\xcf\x78\x8a\x10\x27\x67\xa5\x50\xa8\xdc\x6d\x1b\x30\x28\xcf\x12\x67\xe0\xc6\xbc\x64\xa4\xf4\xcd\xe8\x08\x0b\xce\x26\x33\x72\x8d\xe2\x3c\x4e\x60\x65\x7b\xea\x07\xbf\x6d\xc9\x37\x1d\xc0\xf5\x03\x9a\xbe\xb1\xbb\xd7\x28\x26\xd8\x24\x5f\xca\x8a\xfd\xd9\x57\x6f\x30\x86\xcf\x0e\x71\xcb\x41\xff\xe2\x3f\x1b\xe9\x82\x81\xc9\x80\x54\x10\xcd\x04\x2b\xdf\x01\x0c\x3b\x76\xbf\x6e\xfa\x65\x14\x5a\x5c\x9c\x4e\xd1\x79\x7b\x52\xf1\xfa\x8f\xc0\xfd\x1e\x82\x97\xca\x89\xde\x7a\x1d\x71\xf4\x41\x69\x04\x03\x55\xbd\x0a\x55\x9e\x6b\x8a\x36\x79\x54\xb4\x4f\x6c\x27\xf6\xc4\x40\xb5\xb4\x87\x51\x67\x84\x91\xb2\xf0\x95\x91\x00\x3a\x7e\x1b\x56\x8b\x73\xd3\x06\x34\x36\xe0\x91\x11\xfe\x26\xd2\xf7\xea\x09\xee\xdd\x6b\xb9\x06\x4a\xf6\x62\x87\x32\x8a\x22\x76\x40\x87\x8d\xf9\x5f\xb6\x7a\xc9\xe2\x83\x7d\xc2\x6f\x35\xb7\xab\x93\x33\x42\xca\x5d\x89\xda\xc0\x88\xcd\x23\x48\xb4\x06\x47\xf9\x86\x66\xa6\x53\x43\x83\x7b\x2e\xa5\x63\xcb\x8f\xcb\xb3\xfc\x69\xeb\xf2\xf2\x96\xda\xea\xe2\xa8\x2c\xbd\x33\x1a\x89\x61\x93\x3a\x22\x07\x38\xf9\x48\x91\x21\xd5\x45\x6d\xc5\xfd\x82\x00\xdb\x76\x96\x67\x33\xfb\xd9\xef\xc1\x2d\x2e\xcf\xd2\xe8\xa6\x37\xec\xda\x34\xb7\xa7\x7a\x57\xc7\x18\xc4\x4b\xb1\x84\x1f\x3f\x03\x2a\xff\x87\x59\x0e\xde\xd4\xcf\x74\xdd\xca\xba\x4b\x70\xf5\x62\x03\x22\x51\x39\x09\x1a\x7e\x78\xe5\xbd\xbd\x71\x6f\x90\x57\xba\xcb\x3c\x09\x00\x38\x8c\xfe\xde\xd0\xd1\xa7\x91\x02\x81\xe8\xd5\xb9\x30\x34\x0b\x13\x3c\xe7\x5c\xf9\xaa\x86\x12\xab\xc4\x54\x35\x18\x64\x02\xc0\x49\x70\xc0\x90\x40\x1c\x9e\x33\x64\x43\x58\x1a\x28\x14\xf2\xaf\xce\x68\x2d\x6b\xd0\x9b\x00\x34\x3a\x9e\x10\xeb\x7c\x22\xea\xe4\xd6\x32\x4a\x11\x19\xff\xa4\xd0\x2e\x93\x7f\x73\xbb\x8a\x11\x6b\xbe\x7c\x67\xba\x1c\xc5\x9b\x23\x06\xdc\xd2\x25\x42\x81\x32\xa1\xd4\x94\xcd\x1e\x31\xdd\xb8\x5e\x14\xb9\x77\x20\x05\x9c\xc7\x9f\xff\x82\x0e\x57\x63\xd8\x51\x8f\xf2\x20\x77\x56\x9e\x66\x9a\x5c\xcb\x51\xd7\xac\x69\x58\x60\x54\xd2\x0d\xee\x22\x58\x09\x5a\xd9\x6f\x45\x07\x9d\x52\xca\x61\x2c\x67\x85\xe1\x18\xb5\x31\xa5\x97\x22\x07\x81\x86\x2e\xbc\xb8\x7a\x59\xe1\x4d\x41\xc3\xc2\xca\xbc\x78\x85\xeb\x67\xa1\x1d\xa8\x86\x67\xa9\xf0\x3f\x4b\x3a\xa4\xe6\xd0\xbb\x6b\x12\x8b\xe7\x65\x38\x9a\x0c\x12\x25\x87\xb3\x66\xf7\x89\xa2\xb6\x3e\x22\x25\xc2\x19\xef\x2f\xc3\xee\x94\xcf\x89\x04\x4b\x60\xdd\x2a\x7f\x20\x64\xe4\xba\x1f\x4a\x7f\xb9\x46\x9f\x0b\x8e\x92\x25\x84\x08\xde\xb1\xa8\xe5\x06\xad\xf0\xcc\xda\x4e\x61\x23\x73\xd5\x1b\x24\xc7\x76\xb0\xab\x36\xd5\x22\x18\xa1\x15\xd3\xbb\xf7\xd9\x48\x5c\xf9\xa1\x20\x1c\x12\xa9\x50\x7a\x09\xd8\x10\x79\x2f\x6c\x10\x2b\x0b\x12\x66\xd9\x67\x29\xf8\x29\xe5\x4c\x0a\xcc\x18\x96\xf3\x02\xcd\xfe\xda\x82\xc4\xa8\xd3\x05\x2f\xd4\x5f\x79\x05\x85\xed\x60\xd4\x35\xbf\xe6\xf6\x76\x38\x11\x54\x47\x4a\xaf\x60\x2f\x23\x69\x89\x30\x2b\x9f\x3d\x04\x4a\xb4\xba\x6d\x50\x86\xa7\xfe\xe9\x83\x9c\x19\xab\xf0\x0b\x07\xb1\x26\x4e\xbd\xa8\x60\x42\x8f\x32\x33\x8b\x3a\x55\xac\xe5\x33\xf3\x73\xf6\x96\x57\x60\xfc\xa1\x90\xee\x2d\x61\x30\x09\x0f\x91\x6b\x97\x07\x6b\x9e\xb2\x89\x5c\x2d\x4b\xd5\xe2\x97\xce\x26\xc1\x3e\x8f\x80\xff\x1f\x1a\x25\xfa\x8f\xee\xba\x4f\xf3\xde\x57\x1b\x72\x18\xef\xaf\xc0\xed\xad\x7b\x54\x8c\x63\xf2\x99\x0b\x6a\xdf\x74\x14\xbb\xac\xd4\xab\x55\xf0\xa5\x6e\xeb\x14\x0b\x0e\x99\x34\x13\xb5\x8c\xc1\x32\xdf\x30\x71\xe5\xdb\x6e\x6b\xe3\xfa\x09\x41\xca\xd0\x1b\xe7\xa8\xc2\xe6\x2b\x91\xff\xab\xf3\xe6\x62\xa3\x36\x0a\xe7\x1b\x36\x30\x57\x8e\xe4\x59\x58\x24\x84\x2f\x74\x86\xd3\x47\xe8\xa4\x39\x92\xa1\x69\x7d\x07\x2d\x34\x9c\xe4\xc3\x6f\x68\x41\x2b\xee\xe1\x87\x5b\x6b\x05\xf7\xf0\x6a\x35\x3c\xae\x2e\x36\xb0\x99\xae\x09\x49\xcf\x95\xe7\x9a\x76\x8b\xc9\x73\x08\xc3\x4a\x95\x2b\xaf\xc1\x80\x8b\xd0\xf6\x84\xd5\x76\xbd\x97\x86\x18\x6b\x53\xf8\xb1\x3f\x5b\xe8\xa0\xe8\x0b\xd1\xcd\x88\x4a\x4a\x78\x27\xac\xf6\x56\x69\xdd\x7a\xf7\x7d\x6b\xaa\x1d\x45\xa4\x4f\x3d\xb0\x41\x74\x1a\x55\x80\xd6\xad\x3e\xff\xf5\x11\x1b\x33\xac\x88\x12\xbe\x7a\xe9\xc6\x80\x8d\x6d\x03\xf8\x93\x09\xaf\xc5\x70\x45\x41\x1f\x16\x28\x0f\x07\x19\x21\xd3\xcf\x4f\xd1\xbf\x9f\x98\x04\x00\x5c\x07\x65\xa5\x64\xbf\x8d\x67\x72\x2b\xee\x61\x9b\xcf\x1a\xfb\x0d\x8e\x82\xec\x41\xd1\xfc\x9a\x75\x2d\xf0\xa5\x11\x2a\x4d\x99\x7d\xc8\xa1\xeb\xbd\x9b\x81\xdf\x16\x55\x8a\xde\x55\xcf\xb1\x7c\x5d\xf4\x4b\x91\x83\x55\xba\xcc\xac\x32\x45\xc1\x06\x52\x83\x8b\xe5\x10\xdb\x5b\xab\x57\xb9\xac\x54\x7d\xc0\x7b\x06\x2b\x85\xf0\xd3\x7a\x50\xe8\x8c\x83\xb7\xdd\xdb\x3d\x3c\xc3\x3d\xf0\xe9\x2c\x9a\xd3\x2b\xf5\x57\xee\xca\x83\x7d\x5c\x60\xd7\x5a\x6c\x43\xbb\xec\x3b\x8d\xb2\x58\x37\xd9\x14\x12\x16\x11\x9e\xdd\x11\xc1\xc7\x97\x09\xb3\x61\xb1\x17\x8d\xd0\x1e\x24\xd5\xba\x04\x8e\xb4\xae\xb4\x7b\xcf\xd4\xb2\x42\xc7\x7e\x91\xdf\x56\xa2\xcf\x49\xc0\x53\xbe\x64\x00\xa6\x92\xeb\x85\xd4\x09\xc0\x38\xa4\xb9\xa3\xcc\xb1\xde\x65\xb4\xb3\x0c\xe1\x69\xfa\x76\xa5\x39\x5b\x77\xb6\xd1\x98\x24\x99\x97\xbd\xcd\xed\x0e\x25\xf0\xea\x82\x76\x6e\x51\xf7\x68\xf3\x86\x44\xb7\x8c\x51\x50\x13\xa2\x33\x21\xce\xf1\xda\x24\x5f\xc8\xe3\x8a\xed\x10\x77\xb0\xf6\x9b\xf9\x96\x31\x37\x45\x55\xd8\x8c\xc7\x53\xf9\x3f\xb0\xfa\x7e\x2f\x04\xa6\x70\x88\x2c\x99\x3d\x6a\x05\x63\x32\xdb\x20\xb0\x14\xd5\x9d\x4d\xab\x41\x64\x41\xd8\x05\x8c\xdb\xc5\x1f\x6a\x45\x7b\xc8\x46\x60\xad\x48\x91\x45\x52\x0c\x61\xd5\xcd\x9b\xa2\x00\x20\x04\xfe\x5d\x1b\x45\x4e\x2f\x97\x4d\x37\x35\xf1\x71\x65\x9a\x6a\x62\xb2\x6f\x35\xcf\x61\xd7\x62\xa2\xab\xb2\xf4\xf2\xc6\xe4\xed\xff\x37\x6c\x9a\x6d\xec\x86\x76\xfe\xdb\xa7\x32\xbb\xa8\xf8\x49\x9b\x81\xdf\xf0\x85\x16\xbc\xf0\x87\xdb\xe6\xef\x9b\x15\xdf\xe4\x28\xb1\x20\xd4\x91\x64\xb2\x27\xbb\x1a\xd3\x4a\x0f\x7c\xe8\x59\x72\x38\xab\x53\xb6\xb1\x87\xb6\xd4\xdc\xeb\x4e\xa0\x06\xb2\x2d\xa0\x76\x09\xaa\xaa\x48\xf1\x35\xdc\x53\xb6\x88\x0c\x06\x08\x32\x3f\x0a\x39\xe1\xc8\x9e\xc2\xc7\x63\x40\x3c\x01\xb4\xe3\xb4\xac\x59\xff\x4a\x39\x9c\xd9\x8b\x8a\x24\xda\x4b\xa9\x68\x78\x16\x17\xd3\xb4\xb4\x1e\x06\x5d\xd9\xd6\x99\xf9\x9b\xe4\x0b\x9b\xc5\xc3\x52\x9a\x29\x69\xd0\xfe\x8a\x18\x80\xc9\xd3\x29\x5f\x37\x6a\x16\x53\x24\x87\x67\x39\xdd\xba\x38\x93\xe2\x68\xcc\x13\xf8\x56\x47\x04\x0c\x69\x5e\x7c\x20\x11\xd5\xf9\x77\xec\xd4\xbd\xa5\x5e\x4b\x6c\x26\xc3\x0a\x3a\xfa\x8f\xeb\x03\x3c\x89\xd4\x85\x0f\xa7\x7e\x53\xa6\xc2\x3d\xf7\xa1\x97\xed\x35\x1c\x44\xbe\x1b\x7c\x08\xbb\xe6\xa3\x25\x98\xf6\xba\x8b\xed\xce\x5b\xf5\xb9\x3f\x17\xe8\xb1\x25\xe5\x8c\x05\xfd\x85\x42\x87\xc7\x26\xb6\x56\xa3\x49\xe1\x00\x15\x15\x19\x90\xc7\xcd\x60\xed\x12\x37\xfd\xb6\x7f\xdf\x68\x92\xfe\x6c\x61\x34\xa5\x14\xa2\xf7\x79\xca\xba\xba\x0d\x13\x99\xb4\x3c\xd0\xf7\x0b\x33\x72\xec\xe2\x7d\x63\x81\x0c\xf2\x49\x10\x6b\x74\x8a\xe3\x7a\xc0\x9f\x11\xca\x7f\x0a\xc7\x27\xc0\x97\xb0\x54\x11\x18\x57\x31\xff\xde\xfd\x2f\xef\x5c\x06\x91\xe5\x91\x5b\xff\xae\xfd\x16\x01\x23\x67\x2e\xe5\xab\x1f\x6d\x6f\xa4\x5a\xd2\x5f\x60\xe6\x37\x10\xfc\x2d\xd3\xd6\x45\xb7\xae\x62\xdf\xc6\xb3\x5c\xb0\xff\x86\x3f\x0c\x4d\x8e\x96\x41\xb4\x29\xc9\x85\x6b\xc0\x90\xea\x96\xc2\x88\x2a\x86\x05\x25\x5e\x4f\xcf\xa2\x98\x33\xfc\x94\x73\x34\x8c\x0e\x8a\x4a\x19\xc5\x12\x27\xac\xf4\x1c\xe4\xb0\xd8\xda\x63\x39\x06\x7b\x91\xc6\x21\x22\x34\x2b\x84\x41\xed\x08\x89\x3a\x29\xde\x8b\xf5\xed\x8c\x6e\xb4\x63\xb7\x1a\x0e\xda\x76\xe7\x26\x5a\xae\x39\xa7\x3d\x73\xcf\x39\xf9\x1d\x7f\xc0\x42\x79\x68\x0c\xa5\xcb\x7c\xad\x06\xac\x6e\x50\xb8\xef\x96\xb5\xee\x0a\x1d\x24\x8d\x02\x3a\xf4\xc8\x39\xbc\x87\xcd\xd9\x12\xac\x29\xa2\xf8\xa6\x69\x19\x93\xe9\xee\x22\x7f\x74\x13\x13\x81\x0a\x8f\x2a\x8a\xe4\x47\xb4\x7e\xe0\x21\xe5\x0b\x6a\x51\x14\xc7\xcd\x54\x40\x7c\xf9\xab\x47\x51\xd6\x1d\xa5\xed\xb5\x66\x30\x3d\x66\x79\x5e\x98\x97\xa4\xdd\xe9\x61\x3f\x52\x0d\xfd\xdc\xfc\x96\xda\xbd\x27\x6f\x51\x8a\x7c\x39\x6f\x74\x4a\xf1\x6f\x59\x29\xa0\x76\x38\xc4\xd8\xb1\xd5\x38\x2b\x0c\x05\xf1\x1e\x2b\x54\xd7\x63\xca\xc1\xb7\xb5\x53\x6f\x33\x9c\x7f\x2e\x76\x4b\x67\x25\x4e\x78\xf6\x80\xfb\xbd\xb1\x1e\x32\xe5\x62\xfa\xca\xd0\x90\x5e\x13\x5f\x35\x88\x48\xd1\x97\xcc\x80\xa5\xfd\x83\xa4\xd1\xb2\xed\xea\x6a\x0a\xd8\x0f\x4e\xde\x8f\xf0\x0b\x56\xc8\x3e\x16\x71\x27\xa3\xc4\xdf\x64\x50\xe9\x41\x0a\x6a\x54\xec\xdc\xad\xc1\x40\x32\x9a\xdf\x1e\x81\x8c\x6f\xcd\x1f\x87\x42\xc0\x12\x01\xed\xa1\xfe\x76\x4c\xfa\xcf\x12\x51\x4e\xe4\x0e\xe3\x4f\x6d\xc7\xa2\x74\xd8\xbc\x37\x8b\x49\x20\x47\x94\x74\x0a\xa7\x29\xb8\xb5\xf0\xaf\xf0\x65\x6c\xfd\xc2\x87\xd0\xe6\x71\x93\x4b\x13\x32\xc8\x97\xaa\x85\xa3\x86\xf7\xd7\x5a\x4d\x1d\xc0\xc3\xd1\xd9\x87\xdd\x46\x68\xeb\x9c\xfa\x32\x7a\xb2\x5d\xb8\x4d\xf7\xd2\x38\x7e\xe1\xba\x85\x5a\xf7\x39\x4a\x17\x3f\xf5\x1c\x2d\xd0\x53\x71\xa3\x27\xb6\x61\xdc\xdf\x27\x7a\x61\xd7\x2e\x96\x4e\xa5\x30\x9e\xf1\xf7\xde\x83\x57\x25\xd1\x6d\x2c\x9f\xac\xa2\xbd\xb5\x81\x4b\x66\x08\xa9\x29\x3e\x3a\xb6\x4d\x0e\xf8\xb2\x3e\x59\xe2\xd4\x8b\xf8\x2c\x88\x29\x42\x9b\x17\x13\xe3\x79\x0e\x12\x77\x22\x72\xf3\xfb\x62\x19\x4d\x64\x12\x69\xb7\x5e\xe9\xea\xbe\x3e\xdb\x35\xb1\x4f\x8c\xb8\x45\xe2\xab\x7b\xac\xab\xc1\xcc\xcb\x6d\x00\xfb\x69\xdf\x1b\x89\x82\x65\xdb\xcd\x58\x5f\x13\xf9\x2a\x12\x52\xd8\xfa\x05\xf2\x43\x9b\x4b\x18\x21\x72\xcf\x3d\x84\xa2\x8e\xd8\xb4\x17\xe9\x66\x21\x35\x33\xf9\xdd\xb3\x1a\x44\x84\xd8\xc1\x0a\xb0\xaa\x67\x92\xbd\x21\x39\x4f\x63\x5c\x8f\xb9\x61\x01\x99\x3c\x69\x33\xea\x0c\x9d\x1d\x47\xc3\x80\x70\x7a\x80\x3b\x6c\xe3\x20\xab\xa9\xee\xf7\xad\x0d\x0e\x6d\x1a\xa7\xcc\x2e\x72\x37\x86\xf4\x0b\x11\x22\x44\x0d\x59\x23\x3a\x9c\xfe\x3e\xa5\xd0\x47\x1a\xb4\x16\xf5\xb8\x4e\xf7\xa4\xd8\xba\xea\xd7\xbe\x53\x71\x67\xa9\xfa\xbd\xd1\x18\x58\x26\xe7\x7a\x28\x3b\xb9\xf4\x6c\xcd\x81\xa9\xcf\x4e\x1c\xf2\x4c\xf0\x6d\x14\xe0\xb8\xdf\xe2\x53\x8c\xc1\xf1\x54\x73\x63\xfe\xa0\x03\xef\xb0\xde\x38\x26\x52\xa1\x7a\x1e\xfb\xb9\xc6\x40\xfd\x12\xdb\x1a\x19\xf7\xee\x01\xf1\x48\xfe\x89\x45\x88\x4c\x6d\x11\xc1\x31\xd8\xa0\xd6\xe6\x14\xe6\x94\xab\x52\x6d\x39\x63\x87\xf7\xd4\x59\x61\x18\xd5\xef\xa5\x57\x2b\x1c\x3f\x40\x94\xd6\x9d\xc4\xb5\xb4\x55\x03\x54\x48\x41\xb5\xdb\x20\x78\x2c\x0a\x0c\x60\x16\x7b\xd6\x2d\x61\xe6\x1d\xf8\xe2\xe9\xce\x31\x72\xbc\xbb\x57\x96\x5b\xf7\x0a\x59\xa9\x78\xcf\xec\x27\xbb\x78\x12\xbe\xd6\x19\x0f\xcd\xd1\xef\xb3\xa2\x42\x47\xb6\xf8\xaa\x9e\x08\xfc\xb3\x17\x4c\x12\xef\x20\x98\xe2\xf3\xdf\x9a\x3e\x8e\x0e\x1e\xc7\x48\x29\x62\xdb\xd5\x7b\x5e\xd3\x6f\x15\x77\xf3\xf5\x5a\x11\xed\x17\xb6\x9c\x85\xbe\x12\xf8\x9c\x19\x24\x13\x45\x0d\xd1\x35\x36\xbb\x98\xa9\x36\x73\xc2\x6b\xbf\xba\x00\x6b\x38\x32\x59\x9f\xc9\x83\xa6\x73\xbf\x88\x0b\x21\x6e\xa2\xa3\xef\x9e\xc5\x3f\xb8\x2b\xf1\x8e\xb5\xf3\xf6\xfa\x44\x8d\x45\x75\x0d\x8d\x83\x60\x38\x26\x0a\xdf\x34\xcf\xc0\x1e\x47\x9d\x99\x4f\x28\xa7\x95\x7c\xd1\xfe\xe7\x9a\x7f\xd9\x99\x58\x82\x59\x46\xbc\x46\x64\x39\xec\x09\xeb\x8f\x61\x1e\xe0\xee\xee\xe4\x61\xda\x88\xf1\x34\xa1\x70\xcf\xd5\xa3\xe0\x2a\xa0\x15\xdb\xab\xe8\x69\x81\x46\x99\x35\xee\x28\xa3\xe3\x7e\xf6\xed\xc1\xcc\x7f\x85\xf4\xb1\x88\xc1\x2f\x70\x1d\x91\x9b\x7f\x35\xa9\x6c\xb6\x7c\x27\xce\xbd\x6f\x33\xb1\x6b\x16\x3f\x13\xea\x65\x3e\x3c\x44\xfe\x13\x07\x6a\x57\xb4\xe3\x69\x37\x12\xcc\x55\x7e\x7f\x3b\x0e\x4c\x3c\x9f\x5f\x80\xab\xf8\x4e\x49\x7f\x7b\xaf\x88\xcc\xdd\xb3\x0d\x88\x61\x7e\xd0\x11\x80\x1d\xd7\xa2\x5a\xad\x4e\x75\xde\x4f\x30\x2b\x16\xa5\x6f\x99\xca\x78\x2e\x93\x0a\x3d\x22\xb9\xf6\x10\x29\x69\xef\x50\x3f\x68\x36\x04", 4088));
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x5000940e, /*arg=*/0x20000140ul);
break;
case 2:
NONFAILING(*(uint64_t*)0x200018c0 = 0x100);
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40089413, /*arg=*/0x200018c0ul);
break;
}
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
setup_sysctl();
setup_cgroups();
setup_binfmt_misc();
setup_usb();
setup_802154();
setup_swap();
install_segv_handler();
for (procid = 0; procid < 8; procid++) {
if (fork() == 0) {
use_temporary_dir();
do_sandbox_none();
}
}
sleep(1000000);
return 0;
}
[-- Attachment #6: btrfs_get_root_ref-repro.prog --]
[-- Type: application/octet-stream, Size: 36621 bytes --]
# {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
r0 = syz_mount_image$btrfs(&(0x7f0000000040), &(0x7f0000005140)='./file0\x00', 0x0, &(0x7f0000000080)={[{@treelog}, {@max_inline={'max_inline', 0x3d, [0x6b, 0x0, 0x6b, 0x36, 0x37, 0x33, 0x30]}}, {@check_int}]}, 0x0, 0x50ed, &(0x7f00000051c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTsT3573JENYvrOR3E/wmHm5XUpgfKxQ6WkmPbbFHXpgfLxQ65pIemydDeHBhZX9S+H8stJPClbV54UhSOB0L+fnQLRxLCifimfb52ny6aeH7WMgvsJiPV1Cs6V4SkfS42q/HQuGGPc52Dw4AAHBPieE5z7Jjvc2QRtn52qAdVg/aYWTQDvVBO4wmO6Q79tseZnsLcXv7zMalPf//yHD5P74Vq7JFv+v/Q7z+P3+uYff6/9lYaCSF+VhopXcMaMVjZGH343iMRivvcWV9twAAAAB3tfi9QH2F5wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAP+zda4xc1X0A8LPP8T68XkiqEBolm6TGcROv1zaQqKXKmlI1IqVZNxRURRQbe00WL9ixTYlRiIxNRCMEpQ1S8qEIoyiq+QC1AhFJAeEixREqj4iqKIBAoTVEQaSUJCJNkEI1e++ZvXPuzsOPNV76+0neOTP/87zz8Jx775wLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPD/w8GvXPO3zeKP/va8Z1+4ePyKPWsvfvW68059MoSJmcc7snBH/423j//87nPv2fPA6jvuO3z+R3vzcnk8DFT/dOZ3boi1Hl4cwv0dIXSngRWDWaAnvz8Y63vfYAinhNlArcRkf1YibTh8vy+EfWE2UKvqe30hDBYCFz71yMM3VxO39YWwNIRQSdt4vpK10ZcGzujNAv1pYGt3FvjVW5la4LudWQCOWXwz1F70BybqMwzPXa7B66/nuHXs7ZUOrysmhhvn+9naee5UQW/6wMQxPW2l6pgXpbfHQe+2BfBuK23nWz1txS9S+TeUt2ZDldC5aXLzhqund8ZHOsPoaFejmubpeX7m9S9tPJL0gnkdxg4MH5fX4S1PLL27a/kFj9+3YunL+z+295Vj7eaPCpu0mJ5vlZC/5hbM8xiN+zxZAG+/0rekEV+6QgibP/97n2kWL83/h5vP/+PLOd521uWOtb45lM3N4yODMfHaUDY3BwAAgAVjIew13Tr60Cea1Vea/4+0d/w/HvLPJ/PZaA+GMD6T2LskhNNmHs8Cd8XmLlsSwgdnUhP1gbVJ4GAI751JLK9VlZRYFEuMJIGfDOWB8SRwKAYmksC3YuDWJHBDDBxIAhtj4GASODcGwlT9OH5/KB9H24G+GFifbcQD8SyEXwzF1pJt9VytKgAAgOMknx321N8tnOtwrBni9PJAX6sM8QzshhkqSQ3pDLY2rWpYQ3erGjpb1VAb9+7mwy/V3NGq5tJpGB31GW7/5d98NjRRmv+PNZ//V+boSEfp+H8I62b+xtydeWS6Fl8/UZcBAAAAOAYD//viN5vFS/P/8fbO/4/7RLoKmcNjcTfEliUhjNUHsmr/sBzIjnoP5AEAAABYCGrH42vHwqfy2+wU7XQ+Xc4/cYT544H/8Tnz9x58cH2z/pbm/xPtnf/fX3+bdeJQ7MXXloSwqBD4QexlNTBjJAZ+/Mn6QD7+Q3ED3BSryk9MqFV1UyyxPgbGksC+RiV+WCtxWn0gf7Jqje+tjWMqL1EIAAAAwAkXdwfE4/Lx/P8P/Wb1Nc3Kleb/64/s/P+ZeXDp9P7pgRBWdofQlf4w4LH+bGHAGBjsyBMP9Wd1daVVXd8fwjnVgaVVvZiv/9+drjH4VF9WVQyc9qH9r59RTXyzL4SVxcDTn7vzrGpiZxKoNf6XfSF8oDratPHvLMoa70kb//qiEN5fCNSqumxRCNXGetOqHqnk1zFIq/rnSgjvKgRqVZ1dCWFXAGCBiv+Vbio+uGPXtVs2TE9Pbp/HRNyH3xc2T01Pjm7cOr2p0qBPm5I+1y1jdH15TO1e+ea5fImii+5dN9hOuvY7wbFiW/l+/NKJg/n9+F2oZ2acq3vq7q5Jh/yRD5ebCIVvUo2G3DnPQ+4vVjL7JJbqj/l7w0BYdPWOye2jX9ywc+f2VdnfdrOvzv7Gw0zZtlqVbqv+ufrWxsuj4WpZiaPdVsuKlazceeW2lTt2Xbti6soNl09ePnnVqrNXj505tmbs42eurI5qLPvbYqjL5qo6Gepbd7Y5ruM41NO7C5WciE8NCQmJhZbYOrCs6f/Jpfn/tubz//ipEz/58/UZGh3/H46H+bPHZw/zr4+Bfe0e/x9udDS/dmLASBLYHQO7HeYHAADgnSFO8uPezLhX+qfLv/Nys3Kl+f/u9n7/f5zW/68tXX9+o2X+l8cSY43W/0+X+a+t/7+70fr/6TL/tfX/970N6/9fXQskm+QX1v8HAADeCU7c+v8tl/dPLxBQytByef/0AgGlDC2X8W/3AgFHvP7/8//5V/8dmijN/29tb/5v4X4AAAA4eXz5z675nWbx0vx/X3vz/xO//l9odP7/SKPARKOFAa3/BwAAwALVaP2/4Rv7L21WrjT/P9De/D+edtFZlzvW+uZQtqZdSNe0e22o9pMBAAAAWBg6w+hoT5t561ZGXXv0bT6TLwXaLF304p8cPrLz/w+2N/+v+13GLU8svbtr+QWPv3nfiqUv7//Y3ldmj/8DAAAA86fd/RIAAAAAAAAAAAAAAMDb78X/2LOmWbz0+/+wbubxRr//j9f9i78veHdd7lhr6/X/8vsXfvqeXTNLFj42FMKHi4Ete7acEvJr8y8rBh6+ZPl7qok9aYkHXzj3pWri0jTwqRWnvlFNnJME1sdFEt+bBuJVFd9YnATi8or/ngbi9jiQBnrzwFcXZ+PoSLfVTwezbdWRbqtnB0NYUgjUttX9g1kbHekAb0sCtQF+IQ3EAf55HuhMe3XPQNarGBiMRe8YyHoFAMBJK34L7Ambp6Ynx+JX+Hh7enf9bVS3ZNn15Wo72mz+uXxpsovuXTfYTror/S46e63xnlCpDmFV6etqMUvHzCiPTy0tNt27Gwy51WpvnQ3KpY500/U2HlFfNqLRjVunN/W0HPia1llWd7fMsqo02Slm6ZzZpG3U0kZf2hhRm9umjS7H+51hdLQryfUHMTgc6rR6RbT7e/3iOn+NXgXFPFcd3vurZvWV5v/D7c3/K8VxvZFfDGB3vLLe3y2xzD8AAADMr6+u/fU34r/P3vjo083ylub/I+3N/+MerPxQcLa342C8/v/eJSHMXFp/OAvcFZu7bEkIH5xJTcQS2QX1z48lxrLAXXGHyfJYYv1EfVWLYuBAEvjJUB44mAQOxUC+l2J/yHfl/P1QCGfNpNbVl9gWSwwngc/EwEgSGI2BsSSwOAbGk8Cri/PARBL4txgIU/Xb6t7F+bYCAAA4Evk8q6f+bkjneQe6W2XoaJWhv1WGzlYZKq0yNBpFvP/tmKEnOXmlo5CpJ621L6mllCFeDP+I+1XKEH5YnzMtWGo6nn9QO9+goz7DA5/oroQmSvP/sfbm//31t1nrh+L8f/b6f1ngB7F7X4unjo/EwI8/WR/IdwwcipPdm2pVTeQl8kn7TbHEeAyMJIFtMTCeBNavywP73lMfyGfatcb31hqfyksUAgAAAHDCxR0EcTdNnP/fseMrA83Kleb/4+3N/2N7A8XGboi1Hl4cwv0ds72pBVYMZoG4H2Mw/jz+fYMhnFLYwVErMdmflehNGg7f78t+od6bVvW9vuzHB/H+hU898vDN1cRtfSEsLex9qbXxfCVroy8NnNGbBfrTwNbuLBD3/NQC3+3MAnDMansF4wsqP9WlZnjucg1ef++Ua4KmwyvtA50j31y/uZovpR2u+T7VmiN72pruv+W4Kb09Dnq3LcR327B3W/GLVP4N5a3ZUCV0bprcvOHq6Z3xkeIvWUvm6Xku/kq1nfRxeB3uPvretlZJOzCWfHyMzV1u7tdhR6zulieW3t21/ILH71ux9OX9H9v7StvdaCD+UPiR6/518EeFzTvfKiF/zS24z5MJnycL8b+BEU9bCGHdq1+/qVm8NP+faG/+353czvh13Jg7loTwkcLGfSxu/j9ekn0OFgLZp+S7yoHskPt/DTX85AQAAIDjrba7o7a/YCq/zU4IT+fJ5fwTR5g/7q8YnzN/u/3u/+tLljaLl+b/65vP/xcl3XT83/F/5onj/3M62XdFL0of2H1Mu6JL1TEvHP+f08n+bnP8f06O/zv+PxfH/1tw/H9OJ/vTVvqWtM2XrhDCy3/00LPN4qX5/7b25v/W/5t70b7a+n/rG63/t63R+n+7rf8HAADMqwYLzaXzvNLqfaUM6ep9pQwtFwhsucSg9f+OeP2/l05//jehidL8f3d78//4chgotr5Q1v8bWdegqltjYJuFAQEAADgZNdpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNvrgX/4n03N4o/+9rxnX7h4/Io9ay9+9brzTn0yhKmZxzuycEf/jbeP//zuc+/Z88DqO+47fP5HK3m5nvz2d+tyx1rfHAphX+GRwZh4bah6ZzZw4afv2dVdTTw2FMKHi4Ete7acUk18ayiEZcXAw5csf081sSct8eAL575UTVyaBj614tQ3qolz8kBH2t1/XJx1tyPt7s2LQ1hSCNS6e8Xi+qpqbfxpHuhM2/inwayNGBiMRb8xmLURA9OxxNSiEFZ2h9CVVvVoJauqK63qXypZVV1pVV+uhHBOCKE7reqF3qyq7nTkT/ZmVcXAaR/a//oZ1cS+3hBWFgNPf+7Os6qJLySBWuN/0RvCB6ovmbTxb/dkjfekjd/WE8L7Qwi9aYlfdmcletMSL3aH8K5CoNb457tD2BV4R4gfPnWfaDt2Xbtlw/T05PZ5TPTmbfWFzVPTk6Mbt05vqiR9aqSjkH7r+qMf+3Ovf2lj9faie9cNtpPuzsv1zHR5dU/d3TUne+9jv/qLlcw+H6X6Y/7eMBAWXb1jcvvoFzfs3Ll9Vfa33eyrs79deTTbVqsWyrZaVqxk5c4rt63csevaFVNXbrh88vLJq1advXrszLE1Yx8/c2V1VGPZ3+Mx1DtP/FBP7y5UciI+ACQkJBZaorPu023sZP8gL33Rn+1oT6jMfECXphXFLB0zozweg157lCM+mu8pLUe0qjRxKGVZ3TrLmtJkYjZLX5Zl5ntdaXJYrKlzZpPG+51hdLSr0XYYrr9b3Lw/O4bN+0y+6dpNAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwf+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwLAAAAAAgzN86jJ4NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALgUAAD//wNUIwc=")
ioctl$BTRFS_IOC_SUBVOL_CREATE(r0, 0x5000940e, &(0x7f0000000140)={{}, "03fd690243fbb3d1a779babf540672330de4cc8117f77bcaa59159a7392efab8f418b4b67c76f1d5ab6610d2d4bb055fc0f0575b11d3d52d3321ea4874faac1ce0e1f8ee003db7a0ec48c7c80907292eeb2cde0821bf4ee27f3fb87c9de2b22a2f23774d881590cd000f5e4b6ac3ff649fd1818b40081ffd9aa076f9f8b27b19138721bc594ee4dffc2f3d8d9512eaae9ef8c86b07435c368daa308d52c4dda6f4b19f80d5a5184c61ce670cee712cb924c2a815d59cd201fd768b448360aa38a2028c4b4a246f361405fe0245ca0ab0c3ec2fac76cc2829a87f28299955c9bf7058c708158fae98ff28303861238ef39587acede751af7c5476bcbef0eefa840a1e6c4eca780158f7d65ffab3adc282e257418155c97a7216a6d19939d6067d7481c64acff66fc296fe780defc4abbf2661bccd8515725f97a9fc30a7cc28d680fda0aaf02d7180a9981f91421c58c532fcb3681291f92cfcbf8092165d9577a2b397aebd170c41aa0796165378dd231a4e0185f463bd43830e5373e13a29d75a9be463c7810d22fd082b0fba3836b75f544eec52f8883fa50856502f714fde7c462185daae944a8d8552ce874f2a47b4e89725b05ebab589c0b53f1e04de1a45e2153cd0abc3cf713f227609e53e8131aade35c5d922dfaadd84aa401d537b5df3db828a5b1d76e49b04134bc14a7bae5d329ed0148863f450accdf77a40ed75ad0bc63455c3b5a70ac4c9083db5bce5550d035dd44e3f54840bb64b97472b61ab57298d25104fbcdac731b6abf8bcfe19e218eb3f22a22a8cb6f2381ded5912de78f995dcc20a31c3ab64efa0e88228f41f0c98c0f1cf03221fbbd1b23f5cc29bfff764c663a0a6b77ed5988990a25c6f35aea539e1b1d204aed0454e30d23bcf057dfbe63868a993e1282ee79ae9c8b2f7f5369cae4043e7509f096755179957434e29099875886cd1605858a03a0b5a4e4344289013894502f0b13a795a6a2b351f3b402cbac4e80c20031e687decc66e5545efa85e70e8381b2884fe520853663884aab81f0ee86a19bc2bcbf274265ee2c5e792aa21152956d728673f2c4dde0844e860ea325c5d9a3e243365b01dc3e1620756c02b334f472ab27558bf71a15827cd0a63445287518155470a189158cdf6b54fb8cee40460867f6b6915c522f8a799d721ca5bc41816c61182e1becc5f4a44581781ed819c52e924f3a09543e9849a18e8a6621dd269943422b3041c55c0df3879467850b8ac9f06052422b904a515fb78b04b119e94f00e5633f79c8a936e45d012a5c389f556bd1be7695ce723a81c57d8637993bb612c88134cc056e02336953408fee8bdedd043eea2090c5a51693b1a1f5b55698f5d94a96cb02a82f883afc9185bed5b2cf5c318d02a35d75212a5669bf7f3535f3c5da65740b9300de95d286538998b0c09483895ab38905a311f3073e3b0a602701c27c4738f67fe9eeaabe89c7b9f1d3e7847c55a938c26d6c8004eaa582c6933a7029ea7663149acb440c8fdc86ed4d1a5fef314e228132c3454d3f74f22d1fb19c74864f30c30fdcc727728bc9257b48630ec8500b40efa002245b789d908a60949ae98a0bed3d96d6db2196869b1bf96cd0a2ea97bd12ef4530eaa0664a45c051e063aa543c7b72604673d49bb824a2034acf0316756797793be0ab229ddd9e50f0775f5a714781f7af71f4a45fbbdef241344241c44c3dd4db3dd97724e8f2cb22351ae453c033c40c9f0a0a399619963afeaac10bb612d42ab4189d4f516bd7510c661d18592558db73b005aa976d5b5e9a66ac3c98271cafac690f22c4615a287d8f061216eba64326494ea1f5dda485ce3aecf93b963d2b7089f99089a2b3fb51ba083348446b03869d3dd2bbb3cfa69d62b10ea69bb9cabe2b9f33ac745cb5dd6d9cababe4d497d29cf788a102767a550a8dc6d1b3028cf1267e0c6bc64a4f4cde8080bce2633728de23c4e60657bea07bf6dc9371dc0f5039abeb1bbd72826d8245fca8afdd9576f3086cf0e71cb41ffe23f1be98281c9805410cd042bdf010c3b76bf6efa65145a5c9c4ed1797b52f1fa8fc0fd1e8297ca89de7a1d71f44169040355bd0a559e6b8a367954b44f6c27f6c440b5b48751678491b2f09591003a7e1b568b73d3063436e09111fe26d2f7ea09eedd6bb9064af66287328a227640878df95fb67ac9e2837dc26f35b7ab933342ca5d89dac088cd2348b40647f98666a65343837b2ea563cb8fcbb3fc69ebf2f296daeae2a82cbd331a8961933a220738f9489121d5456dc5fd8200db76966733fbd9efc12d2ecfd2e8a637ecda34b7a77a57c718c44bb1841f3f032aff87590eded4cf74ddcaba4b70f56203225139091a7e78e5bdbd716f9057bacb3c0900388cfeded0d1a7910281e8d5b930340b133ce75cf9aa8612abc45435186402c04970c090401c9e336443581a2814f2afce682d6bd09b00343a9e10eb7c22eae4d6324a1119ffa4d02e937f73bb8a116bbe7c67ba1cc59b2306dcd225428132a1d494cd1e31ddb85e14b97720059cc79fff820e5763d8518ff22077569e669a5ccb51d7ac69586054d20dee2258095ad96f45079d52ca612c6785e118b531a597220781862ebcb87a59e14d41c3c2cabc7885eb67a11da88667a9f03f4b3aa4e6d0bb6b128be765389a0c122587b366f789a2b63e2225c219ef2fc3ee94cf89044b60dd2a7f2064e4ba1f4a7fb9469f0b8e92258408deb1a8e506adf0ccda4e612373d51b24c776b0ab36d52218a115d3bbf7d9485cf9a1201c12a9507a09d810792f6c102b0b1266d96729f829e54c0acc1896f302cdfeda82c4a8d3052fd45f790585ed60d435bfe6f676381154474aaf602f236989302b9f3d044ab4ba6d5086a7fee9839c19abf00b07b1264ebda860428f32338b3a55ace533f373f6965760fca190ee2d6130090f916b97076b9eb2895c2d4bd5e297ce26c13e8f80ff1f1a25fa8feeba4ff3de571b7218efafc0edad7b548c63f2990b6adf7414bbacd4ab55f0a56eeb140b0e993413b58cc132df3071e5db6e6be3fa0941cad01be7a8c2e62b91ffabf3e662a3360ae71b3630578ee4595824842f7486d347e8a43992a1697d072d349ce4c36f68412beee1875b6b05f7f06a353cae2e36b099ae0949cf95e79a768bc97308c34a952bafc1808bd0f684d576bd9786186b53f8b13f5be8a0e80bd1cd884a4a7827acf65669dd7af77d6baa1d45a44f3db041741a5580d6ad3efff5111b33ac8812be7ae9c6808d6d03f89309afc57045411f16280f071921d3cf4fd1bf9f9804005c0765a564bf8d67722bee619bcf1afb0d8e82ec41d1fc9a752df0a5112a4d997dc8a1ebbd9b81df16558ade55cfb17c5df44b918355baccac3245c10652838be510db5bab57b9ac547dc07b062b85f0d37a50e88c83b7dddb3d3cc33df0e92c9ad32bf557eeca837d5c60d75a6c43bbec3b8db25837d9141216119edd11c1c79709b361b1178dd01e24d5ba048eb4aeb47bcfd4b242c77e91df56a2cf49c053be6400a692eb85d409c038a4b9a3ccb1de65b4b30ce169fa76a5395b77b6d198249997bdcded0e25f0ea82766e51f768f38644b78c515013a23321cef1da245fc8e38aed1077b0f69bf99631374555d88cc753f93fb0fa7e2f04a670882c993d6a056332db20b014d59d4dab416441d8058cdbc51f6a457bc84660ad489145520c61d5cd9ba2002004fe5d1b454e2f974d3735f171659a6a62b26f35cf61d762a2abb2f4f2c6e4edff376c9a6dec8676fedba732bba8f8499b81dff08516bcf087dbe6ef9b15dfe428b120d49164b227bb1ad34a0f7ce8597238ab53b6b187b6d4dceb4ea006b22da07609aaaa48f135dc53b6880c0608323f0a39e1c89ec2c763403c01b4e3b4ac59ff4a399cd98b8a24da4ba968781617d3b4b41e065dd9d699f99be40b9bc5c3529a2969d0fe8a1880c9d3295f376a165324876739ddba3893e268cc13f85647040c695e7c2011d5f977ecd4bda55e4b6c26c30a3afa8feb033c89d4850fa77e53a6c23df7a197ed351c44be1b7c08bbe6a32598f6ba8bedce5bf5b93f17e8b125e58c05fd854287c726b656a349e10015151990c7cd60ed1237fdb67fdf6892fe6c6134a514a2f779cababa0d1399b43cd0f70b3372ece27d63810cf249106b748ae37ac09f11ca7f0ac727c097b05411185731ffdefd2fef5c0691e5915bffaefd160123672ee5ab1f6d6fa45ad25f60e63710fc2dd3d645b7ae62dfc6b35cb0ff863f0c4d8e9641b429c9856bc090ea96c2882a8605255e4fcfa29833fc9473348c0e8a4a19c51227acf41ce4b0d8da6339067b91c62122342b8441ed08893a29de8bf5ed8c6eb463b71a0eda76e7265aae39a73d73cf39f91d7fc04279680ca5cb7cad06ac6e50b8ef96b5ee0a1d248d023af4c839bc87cdd912ac29a2f8a6691993e9ee227f741313810a8f2a8ae447b47ee021e50b6a5114c7cd54407cf9ab4751d61da5edb566303d66795e9897a4dde9613f520dfddcfc96dabd276f518a7c396f744af16f5929a07638c4d8b1d5382b0c05f11e2b54d763cac1b7b5536f339c7f2e764b67254e78f680fbbdb11e32e562facad0905e135f358848d197cc80a5fd83a4d1b2edea6a0ad80f4ede8ff00b56c83e167127a3c4df6450e9410a6a54ecdcadc140329adf1e818c6fcd1f8742c01201eda1fe764cfacf12514ee40ee34f6dc7a274d8bc378b49204794740aa729b8b5f0aff0656cfdc287d0e671934b1332c897aa85a386f7d75a4d1dc0c3d1d987dd4668eb9cfa327ab25db84df7d2387ee1ba855af7394a173ff51c2dd05371a327b661dcdf277a61d72e964ea5309ef1f7de835725d16d2c9faca2bdb5814b6608a9293e3ab64d0ef8b23e59e2d48bf82c8829429b1713e3790e12772272f3fb62194d641269b75ee9eabe3edb35b14f8cb845e2ab7bacabc1cccb6d00fb69df1b898265dbcd585f13f92a1252d8fa05f2439b4b182172cf3d84a28ed8b417e966213533f9ddb31a4484d8c10ab0aa6792bd21394f635c8fb96101993c6933ea0c9d1d47c380707a803b6ce320aba9eef7ad0d0e6d1aa7cc2e723786f40b1122440d59233a9cfe3ea5d0471ab416f5b84ef7a4d8baead7be537167a9fabdd1185826e77a283bb9f46ccd81a9cf4e1cf24cf06d14e0b8dfe2538cc1f1547363fea003efb0de382652a17a1efbb9c640fd12db1a19f7ee01f148fe8945884c6d11c131d8a0d6e614e694ab526d396387f7d4596118d5efa5572b1c3f4094d69dc4b5b45503544841b5db20782c0a0c60167bd62d61e61df8e2e9ce3172bcbb57965bf70a59a978cfec27bb7812bed6190fcdd1efb3a24247b6f8aa9e08fcb3174c12ef2098e2f3df9a3e8e0e1ec7482962dbd57b5ed36f1577f3f55a11ed17b69c85be12f89c192413450dd13536bb98a93673c26bbfba006b3832599fc983a673bf880b216ea2a3ef9ec53fb82bf18eb5f3f6fa448d45750d8d836038260adf34cfc01e479d994f28a7957cd1fee79a7fd99958825946bc466439ec09eb8f611ee0eeeee461da88f134a170cfd5a3e02aa015dbabe86981469935ee28a3e37ef6edc1cc7f85f4b188c12f701d919b7f35a96cb67c27cebd6f33b16b163f13ea653e3c44fe13076a57b4e3693712cc557e7f3b0e4c3c9f5f80abf84e497f7baf88ccddb30d88617ed011801dd7a25aad4e75de4f302b16a56f99ca782e930a3d22b9f6102969ef503f683604"})
ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r0, 0x40089413, &(0x7f00000018c0)=0x100)
[-- Attachment #7: btrfs_get_root_ref-repro.log --]
[-- Type: application/octet-stream, Size: 130928 bytes --]
Warning: Permanently added '[localhost]:43925' (ED25519) to the list of known hosts.
syzkaller login: [ 301.832287][ T28] audit: type=1400 audit(1703929414.357:6): avc: denied { execmem } for pid=7936 comm="syz-executor301" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[ 301.874096][ T7936] cgroup: Unknown subsys name 'net'
[ 301.998380][ T7936] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 122.1 MiB (127995904 bytes)
no label, UUID=f2a8c069-f14b-4004-8b78-3db4ce12a2af
[ 303.913615][ T7936] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 304.017608][ T7969] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 304.022519][ T7969] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 304.028328][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 304.031068][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 304.038935][ T7975] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 304.039930][ T7975] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 304.069935][ T7972] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 304.073810][ T7972] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 304.076008][ T7972] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[ 304.080411][ T4389] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 304.093763][ T7972] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 304.106080][ T4389] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 304.106169][ T7988] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[ 304.111592][ T7988] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 304.116581][ T7988] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[ 304.119585][ T7988] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 304.120544][ T7988] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 304.122291][ T7988] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 304.123077][ T7988] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 304.124382][ T7988] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 304.126188][ T7988] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 304.147961][ T4389] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 304.152626][ T4389] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[ 304.153520][ T4389] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 304.159678][ T4389] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 304.162528][ T4389] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[ 304.163913][ T4389] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 304.172298][ T4389] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[ 304.178433][ T50] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[ 304.178981][ T4389] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 304.179532][ T50] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[ 304.182106][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 304.186743][ T7975] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 304.211060][ T4389] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 304.215007][ T4389] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[ 304.238344][ T7975] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 304.239072][ T7966] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[ 304.251002][ T7975] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[ 304.284621][ T7988] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[ 304.285946][ T7988] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[ 304.287204][ T7988] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[ 304.289459][ T7988] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[ 304.290633][ T7988] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[ 304.291629][ T7988] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[ 304.296946][ T50] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[ 304.299295][ T50] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[ 304.309129][ T50] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[ 304.316877][ T50] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[ 305.179267][ T7953] chnl_net:caif_netlink_parms(): no params data found
[ 305.232711][ T7958] chnl_net:caif_netlink_parms(): no params data found
[ 305.636233][ T7958] bridge0: port 1(bridge_slave_0) entered blocking state
[ 305.641003][ T7958] bridge0: port 1(bridge_slave_0) entered disabled state
[ 305.643942][ T7958] bridge_slave_0: entered allmulticast mode
[ 305.648731][ T7958] bridge_slave_0: entered promiscuous mode
[ 305.720627][ T7961] chnl_net:caif_netlink_parms(): no params data found
[ 305.744343][ T7953] bridge0: port 1(bridge_slave_0) entered blocking state
[ 305.746273][ T7953] bridge0: port 1(bridge_slave_0) entered disabled state
[ 305.750388][ T7953] bridge_slave_0: entered allmulticast mode
[ 305.753442][ T7953] bridge_slave_0: entered promiscuous mode
[ 305.763839][ T7958] bridge0: port 2(bridge_slave_1) entered blocking state
[ 305.765556][ T7958] bridge0: port 2(bridge_slave_1) entered disabled state
[ 305.767056][ T7958] bridge_slave_1: entered allmulticast mode
[ 305.769799][ T7958] bridge_slave_1: entered promiscuous mode
[ 305.934867][ T7953] bridge0: port 2(bridge_slave_1) entered blocking state
[ 305.935508][ T7953] bridge0: port 2(bridge_slave_1) entered disabled state
[ 305.936180][ T7953] bridge_slave_1: entered allmulticast mode
[ 305.939209][ T7953] bridge_slave_1: entered promiscuous mode
[ 305.999645][ T7954] chnl_net:caif_netlink_parms(): no params data found
[ 306.128666][ T50] Bluetooth: hci0: command 0x0409 tx timeout
[ 306.208202][ T7988] Bluetooth: hci3: command 0x0409 tx timeout
[ 306.209029][ T4389] Bluetooth: hci2: command 0x0409 tx timeout
[ 306.210057][ T50] Bluetooth: hci1: command 0x0409 tx timeout
[ 306.215779][ T7958] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 306.221258][ T7958] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 306.222157][ T7959] chnl_net:caif_netlink_parms(): no params data found
[ 306.246501][ T7960] chnl_net:caif_netlink_parms(): no params data found
[ 306.271443][ T7953] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 306.287734][ T50] Bluetooth: hci7: command 0x0409 tx timeout
[ 306.296861][ T50] Bluetooth: hci4: command 0x0409 tx timeout
[ 306.366927][ T50] Bluetooth: hci6: command 0x0409 tx timeout
[ 306.379479][ T50] Bluetooth: hci5: command 0x0409 tx timeout
[ 306.466593][ T7953] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 306.532336][ T7958] team0: Port device team_slave_0 added
[ 306.534776][ T7958] team0: Port device team_slave_1 added
[ 306.580437][ T7962] chnl_net:caif_netlink_parms(): no params data found
[ 306.638164][ T7961] bridge0: port 1(bridge_slave_0) entered blocking state
[ 306.638774][ T7961] bridge0: port 1(bridge_slave_0) entered disabled state
[ 306.639380][ T7961] bridge_slave_0: entered allmulticast mode
[ 306.641062][ T7961] bridge_slave_0: entered promiscuous mode
[ 306.645674][ T7953] team0: Port device team_slave_0 added
[ 306.649459][ T7961] bridge0: port 2(bridge_slave_1) entered blocking state
[ 306.649971][ T7961] bridge0: port 2(bridge_slave_1) entered disabled state
[ 306.650869][ T7961] bridge_slave_1: entered allmulticast mode
[ 306.655211][ T7961] bridge_slave_1: entered promiscuous mode
[ 306.656805][ T7954] bridge0: port 1(bridge_slave_0) entered blocking state
[ 306.657386][ T7954] bridge0: port 1(bridge_slave_0) entered disabled state
[ 306.657990][ T7954] bridge_slave_0: entered allmulticast mode
[ 306.660379][ T7954] bridge_slave_0: entered promiscuous mode
[ 306.668266][ T7964] chnl_net:caif_netlink_parms(): no params data found
[ 306.676466][ T7958] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 306.677323][ T7958] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 306.679237][ T7958] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 306.723393][ T7953] team0: Port device team_slave_1 added
[ 306.757951][ T7954] bridge0: port 2(bridge_slave_1) entered blocking state
[ 306.759121][ T7954] bridge0: port 2(bridge_slave_1) entered disabled state
[ 306.760927][ T7954] bridge_slave_1: entered allmulticast mode
[ 306.763593][ T7954] bridge_slave_1: entered promiscuous mode
[ 306.787728][ T7958] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 306.788283][ T7958] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 306.790069][ T7958] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 306.961291][ T7961] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 306.964504][ T7961] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 306.979515][ T7954] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.005573][ T7959] bridge0: port 1(bridge_slave_0) entered blocking state
[ 307.009902][ T7959] bridge0: port 1(bridge_slave_0) entered disabled state
[ 307.010582][ T7959] bridge_slave_0: entered allmulticast mode
[ 307.012638][ T7959] bridge_slave_0: entered promiscuous mode
[ 307.024415][ T7960] bridge0: port 1(bridge_slave_0) entered blocking state
[ 307.028774][ T7960] bridge0: port 1(bridge_slave_0) entered disabled state
[ 307.030459][ T7960] bridge_slave_0: entered allmulticast mode
[ 307.032999][ T7960] bridge_slave_0: entered promiscuous mode
[ 307.098686][ T7954] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 307.146114][ T7958] hsr_slave_0: entered promiscuous mode
[ 307.148350][ T7958] hsr_slave_1: entered promiscuous mode
[ 307.193403][ T7959] bridge0: port 2(bridge_slave_1) entered blocking state
[ 307.194101][ T7959] bridge0: port 2(bridge_slave_1) entered disabled state
[ 307.194733][ T7959] bridge_slave_1: entered allmulticast mode
[ 307.196387][ T7959] bridge_slave_1: entered promiscuous mode
[ 307.250680][ T7960] bridge0: port 2(bridge_slave_1) entered blocking state
[ 307.251466][ T7960] bridge0: port 2(bridge_slave_1) entered disabled state
[ 307.252153][ T7960] bridge_slave_1: entered allmulticast mode
[ 307.253935][ T7960] bridge_slave_1: entered promiscuous mode
[ 307.255916][ T7953] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 307.256418][ T7953] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.262368][ T7953] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 307.268902][ T7961] team0: Port device team_slave_0 added
[ 307.291379][ T7954] team0: Port device team_slave_0 added
[ 307.301356][ T7954] team0: Port device team_slave_1 added
[ 307.303450][ T7964] bridge0: port 1(bridge_slave_0) entered blocking state
[ 307.304832][ T7964] bridge0: port 1(bridge_slave_0) entered disabled state
[ 307.305469][ T7964] bridge_slave_0: entered allmulticast mode
[ 307.309037][ T7964] bridge_slave_0: entered promiscuous mode
[ 307.338988][ T7959] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.341370][ T7962] bridge0: port 1(bridge_slave_0) entered blocking state
[ 307.343322][ T7962] bridge0: port 1(bridge_slave_0) entered disabled state
[ 307.344229][ T7962] bridge_slave_0: entered allmulticast mode
[ 307.346202][ T7962] bridge_slave_0: entered promiscuous mode
[ 307.365608][ T7953] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 307.366142][ T7953] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.369198][ T7953] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 307.372340][ T7961] team0: Port device team_slave_1 added
[ 307.466424][ T7964] bridge0: port 2(bridge_slave_1) entered blocking state
[ 307.467978][ T7964] bridge0: port 2(bridge_slave_1) entered disabled state
[ 307.468605][ T7964] bridge_slave_1: entered allmulticast mode
[ 307.470275][ T7964] bridge_slave_1: entered promiscuous mode
[ 307.485213][ T7959] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 307.538105][ T7962] bridge0: port 2(bridge_slave_1) entered blocking state
[ 307.539489][ T7962] bridge0: port 2(bridge_slave_1) entered disabled state
[ 307.540919][ T7962] bridge_slave_1: entered allmulticast mode
[ 307.543490][ T7962] bridge_slave_1: entered promiscuous mode
[ 307.570776][ T7960] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.630491][ T7954] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 307.631028][ T7954] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.632825][ T7954] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 307.635862][ T7954] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 307.644143][ T7954] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.649047][ T7954] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 307.689325][ T7959] team0: Port device team_slave_0 added
[ 307.692851][ T7964] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.695900][ T7959] team0: Port device team_slave_1 added
[ 307.700638][ T7964] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 307.741757][ T7960] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 307.766310][ T7961] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 307.767947][ T7961] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.772845][ T7961] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 307.933300][ T7962] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.956543][ T7960] team0: Port device team_slave_0 added
[ 307.960655][ T7960] team0: Port device team_slave_1 added
[ 307.981744][ T7961] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 307.982349][ T7961] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.985204][ T7961] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 308.024205][ T7959] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 308.025459][ T7959] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.032271][ T7959] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 308.058932][ T7962] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 308.064889][ T7964] team0: Port device team_slave_0 added
[ 308.123961][ T7960] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 308.125392][ T7960] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.135833][ T7960] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 308.172655][ T7954] hsr_slave_0: entered promiscuous mode
[ 308.174696][ T7954] hsr_slave_1: entered promiscuous mode
[ 308.178287][ T7954] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.180115][ T7954] Cannot create hsr debugfs directory
[ 308.183446][ T7959] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 308.184922][ T7959] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.190698][ T7959] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 308.206824][ T50] Bluetooth: hci0: command 0x041b tx timeout
[ 308.229158][ T7964] team0: Port device team_slave_1 added
[ 308.251016][ T7953] hsr_slave_0: entered promiscuous mode
[ 308.252461][ T7953] hsr_slave_1: entered promiscuous mode
[ 308.254145][ T7953] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.254784][ T7953] Cannot create hsr debugfs directory
[ 308.261826][ T7960] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 308.263177][ T7960] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.272024][ T7960] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 308.287653][ T7988] Bluetooth: hci3: command 0x041b tx timeout
[ 308.288489][ T4389] Bluetooth: hci2: command 0x041b tx timeout
[ 308.290144][ T50] Bluetooth: hci1: command 0x041b tx timeout
[ 308.324680][ T7962] team0: Port device team_slave_0 added
[ 308.329218][ T7962] team0: Port device team_slave_1 added
[ 308.370499][ T4389] Bluetooth: hci7: command 0x041b tx timeout
[ 308.371053][ T50] Bluetooth: hci4: command 0x041b tx timeout
[ 308.376955][ T7964] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 308.378061][ T7964] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.382420][ T7964] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 308.447173][ T4389] Bluetooth: hci6: command 0x041b tx timeout
[ 308.448124][ T50] Bluetooth: hci5: command 0x041b tx timeout
[ 308.507241][ T7964] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 308.508500][ T7964] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.513218][ T7964] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 308.534350][ T7961] hsr_slave_0: entered promiscuous mode
[ 308.535496][ T7961] hsr_slave_1: entered promiscuous mode
[ 308.536376][ T7961] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.537330][ T7961] Cannot create hsr debugfs directory
[ 308.642340][ T7959] hsr_slave_0: entered promiscuous mode
[ 308.644052][ T7959] hsr_slave_1: entered promiscuous mode
[ 308.644884][ T7959] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.645700][ T7959] Cannot create hsr debugfs directory
[ 308.650687][ T7962] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 308.651839][ T7962] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.654826][ T7962] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 308.725781][ T7960] hsr_slave_0: entered promiscuous mode
[ 308.739445][ T7960] hsr_slave_1: entered promiscuous mode
[ 308.741601][ T7960] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.742352][ T7960] Cannot create hsr debugfs directory
[ 308.834973][ T7962] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 308.836562][ T7962] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.839364][ T7962] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 309.365303][ T7958] netdevsim netdevsim4 netdevsim0: renamed from eth0
[ 309.409713][ T7964] hsr_slave_0: entered promiscuous mode
[ 309.412893][ T7964] hsr_slave_1: entered promiscuous mode
[ 309.414807][ T7964] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 309.416176][ T7964] Cannot create hsr debugfs directory
[ 309.423858][ T7962] hsr_slave_0: entered promiscuous mode
[ 309.428851][ T7962] hsr_slave_1: entered promiscuous mode
[ 309.430728][ T7962] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 309.432065][ T7962] Cannot create hsr debugfs directory
[ 309.456177][ T7958] netdevsim netdevsim4 netdevsim1: renamed from eth1
[ 309.564214][ T7958] netdevsim netdevsim4 netdevsim2: renamed from eth2
[ 309.805248][ T7958] netdevsim netdevsim4 netdevsim3: renamed from eth3
[ 310.288629][ T50] Bluetooth: hci0: command 0x040f tx timeout
[ 310.319928][ T7954] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 310.324714][ T7954] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 310.331355][ T7954] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 310.353705][ T7954] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 310.367524][ T50] Bluetooth: hci1: command 0x040f tx timeout
[ 310.368020][ T50] Bluetooth: hci2: command 0x040f tx timeout
[ 310.369139][ T50] Bluetooth: hci3: command 0x040f tx timeout
[ 310.447824][ T50] Bluetooth: hci4: command 0x040f tx timeout
[ 310.449108][ T50] Bluetooth: hci7: command 0x040f tx timeout
[ 310.528101][ T4389] Bluetooth: hci5: command 0x040f tx timeout
[ 310.529371][ T4389] Bluetooth: hci6: command 0x040f tx timeout
[ 310.563735][ T7962] netdevsim netdevsim7 netdevsim0: renamed from eth0
[ 310.575139][ T7962] netdevsim netdevsim7 netdevsim1: renamed from eth1
[ 310.583243][ T7962] netdevsim netdevsim7 netdevsim2: renamed from eth2
[ 310.601496][ T7962] netdevsim netdevsim7 netdevsim3: renamed from eth3
[ 310.681300][ T7958] 8021q: adding VLAN 0 to HW filter on device bond0
[ 310.756163][ T7953] netdevsim netdevsim3 netdevsim0: renamed from eth0
[ 310.760208][ T7953] netdevsim netdevsim3 netdevsim1: renamed from eth1
[ 310.768710][ T7953] netdevsim netdevsim3 netdevsim2: renamed from eth2
[ 310.773703][ T7953] netdevsim netdevsim3 netdevsim3: renamed from eth3
[ 310.799955][ T7958] 8021q: adding VLAN 0 to HW filter on device team0
[ 310.879685][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 310.880508][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 310.951723][ T7954] 8021q: adding VLAN 0 to HW filter on device bond0
[ 310.956447][T10549] bridge0: port 2(bridge_slave_1) entered blocking state
[ 310.957159][T10549] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 310.965010][ T7960] netdevsim netdevsim6 netdevsim0: renamed from eth0
[ 310.979585][ T7960] netdevsim netdevsim6 netdevsim1: renamed from eth1
[ 310.984638][ T7960] netdevsim netdevsim6 netdevsim2: renamed from eth2
[ 311.012646][ T7960] netdevsim netdevsim6 netdevsim3: renamed from eth3
[ 311.093429][ T7962] 8021q: adding VLAN 0 to HW filter on device bond0
[ 311.231243][ T7954] 8021q: adding VLAN 0 to HW filter on device team0
[ 311.235123][ T7961] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 311.259596][ T7962] 8021q: adding VLAN 0 to HW filter on device team0
[ 311.284546][ T7961] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 311.290913][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 311.291604][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 311.294175][T10544] bridge0: port 2(bridge_slave_1) entered blocking state
[ 311.294852][T10544] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 311.295979][ T7961] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 311.308225][ T7961] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 311.385875][T10549] bridge0: port 1(bridge_slave_0) entered blocking state
[ 311.386491][T10549] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 311.390770][T10549] bridge0: port 2(bridge_slave_1) entered blocking state
[ 311.391392][T10549] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 311.539253][ T7964] netdevsim netdevsim2 netdevsim0: renamed from eth0
[ 311.544505][ T7964] netdevsim netdevsim2 netdevsim1: renamed from eth1
[ 311.560580][ T7964] netdevsim netdevsim2 netdevsim2: renamed from eth2
[ 311.565669][ T7964] netdevsim netdevsim2 netdevsim3: renamed from eth3
[ 311.598449][ T7958] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 311.892863][ T7960] 8021q: adding VLAN 0 to HW filter on device bond0
[ 311.986666][ T7959] netdevsim netdevsim5 netdevsim0: renamed from eth0
[ 311.992737][ T7959] netdevsim netdevsim5 netdevsim1: renamed from eth1
[ 312.033399][ T7959] netdevsim netdevsim5 netdevsim2: renamed from eth2
[ 312.043916][ T7959] netdevsim netdevsim5 netdevsim3: renamed from eth3
[ 312.080298][ T7960] 8021q: adding VLAN 0 to HW filter on device team0
[ 312.090335][ T7953] 8021q: adding VLAN 0 to HW filter on device bond0
[ 312.135368][ T7961] 8021q: adding VLAN 0 to HW filter on device bond0
[ 312.145757][ T7962] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 312.152498][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 312.153126][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 312.192467][ T7953] 8021q: adding VLAN 0 to HW filter on device team0
[ 312.211857][T10544] bridge0: port 2(bridge_slave_1) entered blocking state
[ 312.212985][T10544] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 312.252958][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 312.253605][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 312.265262][ T7961] 8021q: adding VLAN 0 to HW filter on device team0
[ 312.294908][T10522] bridge0: port 1(bridge_slave_0) entered blocking state
[ 312.295551][T10522] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 312.309712][T10522] bridge0: port 2(bridge_slave_1) entered blocking state
[ 312.310329][T10522] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 312.367974][ T50] Bluetooth: hci0: command 0x0419 tx timeout
[ 312.380116][ T8] bridge0: port 2(bridge_slave_1) entered blocking state
[ 312.380995][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 312.400482][ T7958] veth0_vlan: entered promiscuous mode
[ 312.447332][ T50] Bluetooth: hci3: command 0x0419 tx timeout
[ 312.447818][ T50] Bluetooth: hci1: command 0x0419 tx timeout
[ 312.448254][ T50] Bluetooth: hci2: command 0x0419 tx timeout
[ 312.505368][ T7960] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 312.528207][ T4389] Bluetooth: hci7: command 0x0419 tx timeout
[ 312.529363][ T4389] Bluetooth: hci4: command 0x0419 tx timeout
[ 312.538519][ T7954] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 312.573302][ T7958] veth1_vlan: entered promiscuous mode
[ 312.611119][ T50] Bluetooth: hci6: command 0x0419 tx timeout
[ 312.611620][ T50] Bluetooth: hci5: command 0x0419 tx timeout
[ 312.652439][ T7953] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 312.653196][ T7953] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 312.732950][ T7954] veth0_vlan: entered promiscuous mode
[ 312.791543][ T7954] veth1_vlan: entered promiscuous mode
[ 312.895071][ T7959] 8021q: adding VLAN 0 to HW filter on device bond0
[ 312.914559][ T7953] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 312.934852][ T7962] veth0_vlan: entered promiscuous mode
[ 312.961285][ T7964] 8021q: adding VLAN 0 to HW filter on device bond0
[ 312.971831][ T7958] veth0_macvtap: entered promiscuous mode
[ 312.985666][ T7962] veth1_vlan: entered promiscuous mode
[ 313.005822][ T7959] 8021q: adding VLAN 0 to HW filter on device team0
[ 313.015200][ T7958] veth1_macvtap: entered promiscuous mode
[ 313.096499][ T7954] veth0_macvtap: entered promiscuous mode
[ 313.103983][T10549] bridge0: port 1(bridge_slave_0) entered blocking state
[ 313.105754][T10549] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 313.110241][T10549] bridge0: port 2(bridge_slave_1) entered blocking state
[ 313.111680][T10549] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 313.179336][ T7961] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 313.186387][ T7953] veth0_vlan: entered promiscuous mode
[ 313.189979][ T7954] veth1_macvtap: entered promiscuous mode
[ 313.238957][ T7964] 8021q: adding VLAN 0 to HW filter on device team0
[ 313.265492][ T7953] veth1_vlan: entered promiscuous mode
[ 313.287475][ T7958] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 313.327951][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 313.329564][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 313.349704][ T7962] veth0_macvtap: entered promiscuous mode
[ 313.361622][ T7954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.363706][ T7954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.367355][ T7954] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 313.371280][ T7958] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 313.384755][T10549] bridge0: port 2(bridge_slave_1) entered blocking state
[ 313.386239][T10549] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 313.403681][ T7962] veth1_macvtap: entered promiscuous mode
[ 313.411881][ T7960] veth0_vlan: entered promiscuous mode
[ 313.417158][ T7954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.418150][ T7954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.420968][ T7954] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 313.429320][ T7954] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.430402][ T7954] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.431209][ T7954] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.432165][ T7954] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.519506][ T7958] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.520249][ T7958] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.520869][ T7958] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.521345][ T7958] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.582579][ T7960] veth1_vlan: entered promiscuous mode
[ 313.621023][ T7962] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.621759][ T7962] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.622906][ T7962] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.624310][ T7962] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.628930][ T7962] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 313.633009][ T7962] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.634113][ T7962] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.635068][ T7962] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.636531][ T7962] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.642314][ T7962] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 313.680398][ T7953] veth0_macvtap: entered promiscuous mode
[ 313.685223][ T7962] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.685817][ T7962] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.688503][ T7962] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.689570][ T7962] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.720211][ T7953] veth1_macvtap: entered promiscuous mode
[ 313.734083][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.734681][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.735216][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.735886][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.736571][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.740104][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.742562][ T7953] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 313.769814][ T7961] veth0_vlan: entered promiscuous mode
[ 313.784296][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.788818][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.789582][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.790291][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.790975][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.791703][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.794010][ T7953] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 313.857925][ T7953] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.859617][ T7953] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.861161][ T7953] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.863164][ T7953] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.970981][ T7960] veth0_macvtap: entered promiscuous mode
[ 314.022576][ T7961] veth1_vlan: entered promiscuous mode
[ 314.096022][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.099416][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.150373][ T7960] veth1_macvtap: entered promiscuous mode
[ 314.184964][ T7959] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 314.219872][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.220430][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.279668][ T7964] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 314.301635][ T7961] veth0_macvtap: entered promiscuous mode
[ 314.308940][ T7961] veth1_macvtap: entered promiscuous mode
[ 314.420112][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.420925][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.421655][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.422435][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.423109][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.423903][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.424623][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.466449][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.471038][ T7960] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 314.480036][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.481787][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.495400][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.499035][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.500676][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.502936][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.505142][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.506001][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.507996][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.509615][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.510669][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.511427][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.514600][ T7961] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 314.559968][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.560722][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.561767][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.562632][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.563941][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.565710][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.566435][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.567990][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.568507][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.569038][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.570778][ T7961] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 314.584673][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.585387][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.585997][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.590946][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.591643][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.592355][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.593019][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.593720][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.594393][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.595131][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.597561][ T7960] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 314.600626][ T7960] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.601867][ T7960] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.603079][ T7960] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.604462][ T7960] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.638772][ T139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.640359][ T139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.644985][ T7961] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.654184][ T7961] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.656153][ T7961] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.664109][ T7961] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
executing program
[ 315.041990][T10424] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.043136][T10424] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
executing program
[ 315.227714][T10648] loop4: detected capacity change from 0 to 32768
[ 315.240112][T10648] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (10648)
[ 315.271270][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.271914][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 315.275646][T10648] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 315.276557][T10648] BTRFS info (device loop4): max_inline at 0
[ 315.287031][T10648] BTRFS info (device loop4): using free space tree
[ 315.351423][ T7959] veth0_vlan: entered promiscuous mode
[ 315.380091][ T7964] veth0_vlan: entered promiscuous mode
[ 315.382482][T10648] BTRFS info (device loop4): enabling ssd optimizations
[ 315.383958][T10648] BTRFS info (device loop4): auto enabling async discard
[ 315.521481][ T2921] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.523128][ T2921] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 315.525288][ T7959] veth1_vlan: entered promiscuous mode
[ 315.539492][T10685] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 315.663996][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.665092][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 315.675859][ T7964] veth1_vlan: entered promiscuous mode
[ 315.752684][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.754537][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 315.765118][T10660] loop0: detected capacity change from 0 to 32768
[ 315.786828][T10660] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (10660)
[ 315.819884][T10660] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 315.821695][T10660] BTRFS info (device loop0): max_inline at 0
[ 315.822812][T10660] BTRFS info (device loop0): using free space tree
executing program
[ 315.872467][ T7959] veth0_macvtap: entered promiscuous mode
[ 315.915312][T10660] BTRFS info (device loop0): enabling ssd optimizations
[ 315.915867][T10660] BTRFS info (device loop0): auto enabling async discard
executing program
[ 315.977433][T10660] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 316.317169][ T7959] veth1_macvtap: entered promiscuous mode
[ 316.348942][ T2921] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 316.349598][ T2921] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
executing program
[ 316.681704][T10718] loop7: detected capacity change from 0 to 32768
[ 316.710545][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 316.711126][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 316.735513][T10718] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (10718)
executing program
[ 316.773647][T10718] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 316.774439][T10718] BTRFS info (device loop7): max_inline at 0
[ 316.775083][T10718] BTRFS info (device loop7): using free space tree
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 316.862906][ T7964] veth0_macvtap: entered promiscuous mode
[ 317.012755][T10718] BTRFS info (device loop7): enabling ssd optimizations
[ 317.013575][T10718] BTRFS info (device loop7): auto enabling async discard
[ 317.126269][T10718] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 317.185288][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.279699][T10726] loop0: detected capacity change from 0 to 32768
[ 317.282069][T10726] BTRFS: device /dev/loop0 using temp-fsid 0dde64c9-c49f-4f9b-80d2-2ed24bd398f6
[ 317.284017][T10726] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (10726)
[ 317.297201][T10726] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 317.297907][T10726] BTRFS info (device loop0): max_inline at 0
[ 317.298695][T10726] BTRFS info (device loop0): using free space tree
[ 317.305451][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.307130][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.308347][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.309830][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.311583][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.313235][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.314750][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.316498][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.322074][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.322788][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.323517][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.326278][ T7959] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 317.415580][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.417530][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.418380][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.419091][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.419764][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.420907][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.422275][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.423902][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.425419][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.436961][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.437809][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.438804][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.441957][ T7959] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 317.515523][T10726] BTRFS info (device loop0): enabling ssd optimizations
[ 317.516185][T10726] BTRFS info (device loop0): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 317.601008][ T7964] veth1_macvtap: entered promiscuous mode
[ 317.601679][T10726] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 317.683022][ T7959] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 317.737150][ T7959] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 317.738733][ T7959] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 317.740653][ T7959] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 317.840395][T10732] loop3: detected capacity change from 0 to 32768
[ 317.849316][T10732] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (10732)
[ 317.873731][T10732] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 317.874468][T10732] BTRFS info (device loop3): max_inline at 0
[ 317.875005][T10732] BTRFS info (device loop3): using free space tree
executing program
executing program
[ 318.114364][T10732] BTRFS info (device loop3): enabling ssd optimizations
[ 318.116065][T10732] BTRFS info (device loop3): auto enabling async discard
[ 318.148285][T10732] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 318.284242][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.285376][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
executing program
[ 318.356782][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.358334][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.359655][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.361251][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.362674][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.363802][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.364918][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.365830][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.366460][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.516810][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.536000][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.556982][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.627405][ T7964] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 318.732696][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 318.793528][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.822824][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 318.854312][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.878167][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 318.884748][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.915402][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 318.978097][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 319.046798][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 319.048797][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 319.050746][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 319.052843][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 319.054509][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 319.056401][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 319.084304][T10783] loop1: detected capacity change from 0 to 32768
[ 319.107620][T10783] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (10783)
executing program
[ 319.153612][T10783] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 319.154282][T10783] BTRFS info (device loop1): max_inline at 0
[ 319.159268][T10783] BTRFS info (device loop1): using free space tree
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 319.356653][T10783] BTRFS info (device loop1): enabling ssd optimizations
[ 319.357355][T10783] BTRFS info (device loop1): auto enabling async discard
[ 319.426662][ T7964] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 319.525791][T10802] loop6: detected capacity change from 0 to 32768
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 319.593138][T10783] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 319.623080][ T7964] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 319.623771][ T7964] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 319.624376][ T7964] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 319.624974][ T7964] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 319.711455][T10802] BTRFS: device /dev/loop6 using temp-fsid 8fa9bdfb-021c-4947-9d99-1fa64c1da3ed
[ 319.712171][T10802] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (10802)
[ 319.724276][T10802] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 319.725007][T10802] BTRFS info (device loop6): max_inline at 0
[ 319.726227][T10802] BTRFS info (device loop6): using free space tree
[ 319.825201][T10802] BTRFS info (device loop6): enabling ssd optimizations
[ 319.825849][T10802] BTRFS info (device loop6): auto enabling async discard
[ 319.945039][T10802] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 320.353973][T10808] loop3: detected capacity change from 0 to 32768
[ 320.362747][T10808] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (10808)
[ 320.375017][T10808] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 320.387170][T10808] BTRFS info (device loop3): max_inline at 0
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 320.387718][T10808] BTRFS info (device loop3): using free space tree
executing program
[ 320.642558][T10808] BTRFS info (device loop3): enabling ssd optimizations
[ 320.643134][T10808] BTRFS info (device loop3): auto enabling async discard
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 320.800995][T10808] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 321.743257][T10873] loop1: detected capacity change from 0 to 32768
[ 321.767667][T10873] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (10873)
[ 321.780882][T10873] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 321.781648][T10873] BTRFS info (device loop1): max_inline at 0
[ 321.782166][T10873] BTRFS info (device loop1): using free space tree
[ 321.998408][T10873] BTRFS info (device loop1): enabling ssd optimizations
[ 321.998957][T10873] BTRFS info (device loop1): auto enabling async discard
[ 322.001279][T10881] loop6: detected capacity change from 0 to 32768
[ 322.032380][T10881] BTRFS: device /dev/loop6 using temp-fsid c9363695-cd9c-4c37-a6a7-8887bf2d65c2
[ 322.033133][T10881] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (10881)
[ 322.055909][T10881] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 322.056904][T10881] BTRFS info (device loop6): max_inline at 0
[ 322.057376][T10881] BTRFS info (device loop6): using free space tree
[ 322.116495][T10873] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 322.198476][T10881] BTRFS info (device loop6): enabling ssd optimizations
[ 322.199063][T10881] BTRFS info (device loop6): auto enabling async discard
[ 322.314826][T10881] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 322.558954][ T23] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 322.559563][ T23] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 322.632883][T10889] loop3: detected capacity change from 0 to 32768
[ 322.660355][T10889] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (10889)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 322.689999][T10889] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 322.690739][T10889] BTRFS info (device loop3): max_inline at 0
[ 322.691209][T10889] BTRFS info (device loop3): using free space tree
executing program
[ 322.814017][T10895] loop7: detected capacity change from 0 to 32768
[ 322.845008][T10895] BTRFS: device /dev/loop7 using temp-fsid d3edc745-dc89-4b89-83dc-f300d5ef5c9e
[ 322.845753][T10895] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (10895)
[ 322.867313][T10895] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 322.868109][T10895] BTRFS info (device loop7): max_inline at 0
[ 322.868573][T10895] BTRFS info (device loop7): using free space tree
[ 322.901092][T10889] BTRFS info (device loop3): enabling ssd optimizations
[ 322.901665][T10889] BTRFS info (device loop3): auto enabling async discard
executing program
[ 322.962046][T10889] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 322.996357][T10895] BTRFS info (device loop7): enabling ssd optimizations
[ 322.997141][T10895] BTRFS info (device loop7): auto enabling async discard
[ 323.061459][T10895] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 323.159495][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 323.160428][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 323.163490][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 323.172938][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
executing program
[ 323.422873][T10936] loop4: detected capacity change from 0 to 32768
[ 323.434606][T10936] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (10936)
[ 323.491549][T10936] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 323.492332][T10936] BTRFS info (device loop4): max_inline at 0
[ 323.492788][T10936] BTRFS info (device loop4): using free space tree
executing program
[ 323.726666][T10936] BTRFS info (device loop4): enabling ssd optimizations
[ 323.727220][T10936] BTRFS info (device loop4): auto enabling async discard
[ 323.754305][T10424] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 323.754917][T10424] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 323.793429][T10936] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 324.248150][T10982] loop1: detected capacity change from 0 to 32768
[ 324.257211][T10982] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (10982)
[ 324.283305][T10982] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 324.284103][T10982] BTRFS info (device loop1): max_inline at 0
[ 324.284567][T10982] BTRFS info (device loop1): using free space tree
[ 324.505339][T10982] BTRFS info (device loop1): enabling ssd optimizations
[ 324.506636][T10982] BTRFS info (device loop1): auto enabling async discard
executing program
[ 324.586148][T10982] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 324.686052][T11009] loop7: detected capacity change from 0 to 32768
[ 324.755095][T11009] BTRFS: device /dev/loop7 using temp-fsid 230de0b8-8070-44f0-9344-ef091028a0f6
[ 324.756131][T11009] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11009)
[ 324.848458][T11009] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 324.849351][T11009] BTRFS info (device loop7): max_inline at 0
[ 324.850546][T11009] BTRFS info (device loop7): using free space tree
[ 324.862572][T10988] loop6: detected capacity change from 0 to 32768
[ 324.867044][T10988] BTRFS: device /dev/loop6 using temp-fsid 1aea580b-7353-46ea-a04c-448fd43f87c4
[ 324.869390][T10988] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (10988)
[ 324.911571][T10988] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 324.912270][T10988] BTRFS info (device loop6): max_inline at 0
[ 324.913887][T10988] BTRFS info (device loop6): using free space tree
[ 324.990772][T11022] loop5: detected capacity change from 0 to 32768
[ 325.005249][T11022] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11022)
[ 325.015787][T11022] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 325.020566][T11022] BTRFS info (device loop5): max_inline at 0
[ 325.023131][T11022] BTRFS info (device loop5): using free space tree
[ 325.126251][T11020] loop3: detected capacity change from 0 to 32768
[ 325.144916][T11009] BTRFS info (device loop7): enabling ssd optimizations
[ 325.145426][T11009] BTRFS info (device loop7): auto enabling async discard
[ 325.194256][T10988] BTRFS info (device loop6): enabling ssd optimizations
[ 325.194788][T10988] BTRFS info (device loop6): auto enabling async discard
[ 325.203519][T11020] BTRFS: device /dev/loop3 using temp-fsid 95406b7d-0965-46d4-af2d-3bbd24711f32
[ 325.204259][T11020] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11020)
[ 325.266390][T11020] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 325.267314][T11020] BTRFS info (device loop3): max_inline at 0
[ 325.267743][T11020] BTRFS info (device loop3): using free space tree
[ 325.275608][T11009] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 325.287748][T10988] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 325.384668][T11022] BTRFS info (device loop5): enabling ssd optimizations
[ 325.385264][T11022] BTRFS info (device loop5): auto enabling async discard
executing program
[ 325.465570][T11020] BTRFS info (device loop3): enabling ssd optimizations
[ 325.468319][T11020] BTRFS info (device loop3): auto enabling async discard
[ 325.519683][T11022] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 325.538483][T11020] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 325.566266][T11050] loop4: detected capacity change from 0 to 32768
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 325.580808][T11050] BTRFS: device /dev/loop4 using temp-fsid cf27ed18-2bc0-4743-896e-a2837101c8a5
[ 325.581573][T11050] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (11050)
[ 325.615924][T11050] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 325.616778][T11050] BTRFS info (device loop4): max_inline at 0
[ 325.617279][T11050] BTRFS info (device loop4): using free space tree
[ 325.695528][T11030] loop0: detected capacity change from 0 to 32768
[ 325.710216][T11030] BTRFS: device /dev/loop0 using temp-fsid 96a73027-fe37-4690-b694-3d3cb105aadd
[ 325.711096][T11030] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11030)
[ 325.724063][T11028] loop2: detected capacity change from 0 to 32768
[ 325.737359][T11028] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11028)
[ 325.787002][T11030] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 325.787769][T11030] BTRFS info (device loop0): max_inline at 0
[ 325.788231][T11030] BTRFS info (device loop0): using free space tree
[ 325.797426][T11050] BTRFS info (device loop4): enabling ssd optimizations
[ 325.797997][T11050] BTRFS info (device loop4): auto enabling async discard
[ 325.803063][T11028] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 325.803777][T11028] BTRFS info (device loop2): max_inline at 0
[ 325.804234][T11028] BTRFS info (device loop2): using free space tree
[ 326.001475][T11050] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 326.067778][T11028] BTRFS info (device loop2): enabling ssd optimizations
[ 326.068336][T11028] BTRFS info (device loop2): auto enabling async discard
[ 326.069306][T11030] BTRFS info (device loop0): enabling ssd optimizations
[ 326.069838][T11030] BTRFS info (device loop0): auto enabling async discard
[ 326.160659][T11028] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 326.320820][T11030] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 326.505978][T11124] loop1: detected capacity change from 0 to 32768
[ 326.514200][T11124] BTRFS: device /dev/loop1 using temp-fsid 66904ed6-cd8b-4d54-9eff-4bbc410dbbdf
[ 326.515057][T11124] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11124)
[ 326.541163][T11124] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 326.545597][T11124] BTRFS info (device loop1): max_inline at 0
[ 326.546050][T11124] BTRFS info (device loop1): using free space tree
[ 326.840652][T11124] BTRFS info (device loop1): enabling ssd optimizations
[ 326.841222][T11124] BTRFS info (device loop1): auto enabling async discard
[ 326.921159][T11124] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 327.478345][T11201] loop6: detected capacity change from 0 to 32768
[ 327.493616][T11201] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11201)
executing program
[ 327.523835][T11201] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 327.524473][T11201] BTRFS info (device loop6): max_inline at 0
[ 327.524922][T11201] BTRFS info (device loop6): using free space tree
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 327.700643][T11207] loop5: detected capacity change from 0 to 32768
[ 327.702855][T11204] loop7: detected capacity change from 0 to 32768
[ 327.713926][T11207] BTRFS: device /dev/loop5 using temp-fsid 083f8efa-feab-4831-8a65-fe73f4c0ffb9
[ 327.714710][T11207] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11207)
[ 327.723332][T11207] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 327.724065][T11207] BTRFS info (device loop5): max_inline at 0
[ 327.724652][T11207] BTRFS info (device loop5): using free space tree
executing program
executing program
[ 327.771881][T11204] BTRFS: device /dev/loop7 using temp-fsid e211aaae-d39d-4880-86e4-3dfbf192ff37
[ 327.772624][T11204] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11204)
[ 327.773821][T11201] BTRFS info (device loop6): enabling ssd optimizations
[ 327.774350][T11201] BTRFS info (device loop6): auto enabling async discard
[ 327.818445][T11201] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 327.846895][T11204] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 327.847602][T11204] BTRFS info (device loop7): max_inline at 0
[ 327.848045][T11204] BTRFS info (device loop7): using free space tree
[ 327.942534][T11207] BTRFS info (device loop5): enabling ssd optimizations
[ 327.944353][T11207] BTRFS info (device loop5): auto enabling async discard
[ 328.060256][T11207] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 328.094842][T11204] BTRFS info (device loop7): enabling ssd optimizations
[ 328.095377][T11204] BTRFS info (device loop7): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 328.158121][T11204] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 328.328507][T11232] loop4: detected capacity change from 0 to 32768
[ 328.343908][T11232] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (11232)
[ 328.427336][T11232] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 328.428115][T11232] BTRFS info (device loop4): max_inline at 0
[ 328.428663][T11232] BTRFS info (device loop4): using free space tree
[ 328.647011][T11232] BTRFS info (device loop4): enabling ssd optimizations
[ 328.647579][T11232] BTRFS info (device loop4): auto enabling async discard
[ 328.686153][T11256] loop3: detected capacity change from 0 to 32768
[ 328.766293][T11256] BTRFS: device /dev/loop3 using temp-fsid c3e5098f-5294-455a-a891-b9fdfc50d153
[ 328.769995][T11256] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11256)
[ 328.780031][T11262] loop1: detected capacity change from 0 to 32768
[ 328.783470][T11232] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 328.796126][T11256] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 328.798113][T11256] BTRFS info (device loop3): max_inline at 0
[ 328.800440][T11262] BTRFS: device /dev/loop1 using temp-fsid 287d50eb-342f-461f-a01e-d010b7cb8d9d
[ 328.801287][T11262] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11262)
[ 328.813291][T11256] BTRFS info (device loop3): using free space tree
[ 328.827215][T11262] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 328.828003][T11262] BTRFS info (device loop1): max_inline at 0
[ 328.835280][T11262] BTRFS info (device loop1): using free space tree
[ 328.962706][T11240] loop0: detected capacity change from 0 to 32768
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 328.984023][T11240] BTRFS: device /dev/loop0 using temp-fsid 2938adaf-48dc-4aed-8079-bafa007f9d75
[ 328.984774][T11240] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11240)
[ 328.991588][T11256] BTRFS info (device loop3): enabling ssd optimizations
[ 328.992164][T11256] BTRFS info (device loop3): auto enabling async discard
[ 328.995153][T11262] BTRFS info (device loop1): enabling ssd optimizations
[ 328.995741][T11262] BTRFS info (device loop1): auto enabling async discard
[ 329.025611][T11240] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 329.026377][T11240] BTRFS info (device loop0): max_inline at 0
[ 329.031013][T11240] BTRFS info (device loop0): using free space tree
[ 329.034746][T11238] loop2: detected capacity change from 0 to 32768
[ 329.039354][T11238] BTRFS: device /dev/loop2 using temp-fsid 71b0de5e-5ba1-4e08-a48b-f4b2509eae53
[ 329.040198][T11238] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11238)
[ 329.061506][T11238] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 329.062449][T11238] BTRFS info (device loop2): max_inline at 0
[ 329.062926][T11238] BTRFS info (device loop2): using free space tree
[ 329.089395][T11256] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 329.107220][T11262] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 329.243050][T11238] BTRFS info (device loop2): enabling ssd optimizations
[ 329.245398][T11238] BTRFS info (device loop2): auto enabling async discard
[ 329.253702][T11240] BTRFS info (device loop0): enabling ssd optimizations
[ 329.256238][T11240] BTRFS info (device loop0): auto enabling async discard
[ 329.372668][T11240] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 329.375277][T11238] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 329.873259][T11336] loop5: detected capacity change from 0 to 32768
[ 329.897074][T11336] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11336)
executing program
[ 329.927201][T11336] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 329.928054][T11336] BTRFS info (device loop5): max_inline at 0
[ 329.928523][T11336] BTRFS info (device loop5): using free space tree
[ 329.952046][T11323] loop6: detected capacity change from 0 to 32768
executing program
[ 329.987087][T11323] BTRFS: device /dev/loop6 using temp-fsid d7f57b5c-2a09-4e67-b65a-d872cbb9f925
[ 329.987943][T11323] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11323)
[ 330.019134][T11323] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 330.019779][T11323] BTRFS info (device loop6): max_inline at 0
[ 330.020127][T11323] BTRFS info (device loop6): using free space tree
[ 330.179467][T11336] BTRFS info (device loop5): enabling ssd optimizations
[ 330.180085][T11336] BTRFS info (device loop5): auto enabling async discard
[ 330.251350][T11323] BTRFS info (device loop6): enabling ssd optimizations
[ 330.251948][T11323] BTRFS info (device loop6): auto enabling async discard
[ 330.263658][T11336] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
executing program
[ 330.273092][T11389] loop7: detected capacity change from 0 to 32768
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 330.282266][T11389] BTRFS: device /dev/loop7 using temp-fsid bbe4b0c4-5822-4a31-9856-2b7af5d38741
[ 330.283553][T11389] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11389)
[ 330.301455][T11389] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 330.302204][T11389] BTRFS info (device loop7): max_inline at 0
[ 330.307055][T11389] BTRFS info (device loop7): using free space tree
[ 330.320052][T11323] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 330.499323][T11389] BTRFS info (device loop7): enabling ssd optimizations
[ 330.511646][T11389] BTRFS info (device loop7): auto enabling async discard
[ 330.569166][T11389] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
executing program
[ 331.115476][T11447] loop0: detected capacity change from 0 to 32768
[ 331.129410][T11447] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11447)
[ 331.147458][T11447] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 331.147992][T11447] BTRFS info (device loop0): max_inline at 0
[ 331.148333][T11447] BTRFS info (device loop0): using free space tree
[ 331.220833][T11417] loop1: detected capacity change from 0 to 32768
[ 331.224609][T11417] BTRFS: device /dev/loop1 using temp-fsid a7cba76d-db27-4de7-800f-ace056438332
[ 331.226558][T11417] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11417)
[ 331.240594][T11417] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 331.243721][T11417] BTRFS info (device loop1): max_inline at 0
[ 331.245744][T11417] BTRFS info (device loop1): using free space tree
[ 331.335853][T11414] loop3: detected capacity change from 0 to 32768
[ 331.355823][T11447] BTRFS info (device loop0): enabling ssd optimizations
[ 331.357363][T11447] BTRFS info (device loop0): auto enabling async discard
[ 331.362627][T11471] loop2: detected capacity change from 0 to 32768
[ 331.387610][T11471] BTRFS: device /dev/loop2 using temp-fsid 13b32bfa-1e8a-4277-b1a5-f7b497d52ef3
[ 331.389932][T11471] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11471)
[ 331.424675][T11447] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 331.438302][T11471] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 331.439341][T11471] BTRFS info (device loop2): max_inline at 0
[ 331.440065][T11471] BTRFS info (device loop2): using free space tree
[ 331.443534][T11414] BTRFS: device /dev/loop3 using temp-fsid aeb62d92-6b7a-467c-9952-b39ba6f7872a
[ 331.444403][T11414] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11414)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 331.539162][T11414] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 331.557078][T11414] BTRFS info (device loop3): max_inline at 0
[ 331.558691][T11414] BTRFS info (device loop3): using free space tree
[ 331.570978][T11417] BTRFS info (device loop1): enabling ssd optimizations
[ 331.572091][T11417] BTRFS info (device loop1): auto enabling async discard
[ 331.640342][T11417] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 331.764037][T11414] BTRFS info (device loop3): enabling ssd optimizations
[ 331.764991][T11414] BTRFS info (device loop3): auto enabling async discard
[ 331.765444][T11471] BTRFS info (device loop2): enabling ssd optimizations
[ 331.766214][T11471] BTRFS info (device loop2): auto enabling async discard
[ 331.846782][T11414] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 331.884344][T11471] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 332.220206][T11528] loop7: detected capacity change from 0 to 32768
[ 332.247835][T11528] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11528)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 332.266362][T11528] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 332.267988][T11528] BTRFS info (device loop7): max_inline at 0
[ 332.268291][T11528] BTRFS info (device loop7): using free space tree
executing program
executing program
[ 332.475768][T11487] loop5: detected capacity change from 0 to 32768
[ 332.480316][T11487] BTRFS: device /dev/loop5 using temp-fsid 6c1df7c3-5151-4dd3-97ee-7139066a06d1
[ 332.481013][T11487] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11487)
[ 332.494084][T11481] loop6: detected capacity change from 0 to 32768
[ 332.524830][T11481] BTRFS: device /dev/loop6 using temp-fsid ed37d40b-b0c9-4c93-86a3-636895c63dd1
[ 332.525520][T11481] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11481)
[ 332.530831][T11487] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 332.533167][T11487] BTRFS info (device loop5): max_inline at 0
[ 332.533594][T11487] BTRFS info (device loop5): using free space tree
[ 332.589624][T11481] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 332.590334][T11481] BTRFS info (device loop6): max_inline at 0
[ 332.590750][T11481] BTRFS info (device loop6): using free space tree
[ 332.595305][T11528] BTRFS info (device loop7): enabling ssd optimizations
[ 332.595811][T11528] BTRFS info (device loop7): auto enabling async discard
executing program
executing program
[ 332.707560][T11487] BTRFS info (device loop5): enabling ssd optimizations
[ 332.708094][T11487] BTRFS info (device loop5): auto enabling async discard
[ 332.721567][T11481] BTRFS info (device loop6): enabling ssd optimizations
[ 332.722052][T11481] BTRFS info (device loop6): auto enabling async discard
[ 332.730817][T11528] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 332.776039][T11487] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 332.801382][T11481] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 333.166526][T11605] loop3: detected capacity change from 0 to 32768
[ 333.187386][T11605] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11605)
[ 333.230997][T11605] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 333.231807][T11605] BTRFS info (device loop3): max_inline at 0
[ 333.232279][T11605] BTRFS info (device loop3): using free space tree
[ 333.499407][T11605] BTRFS info (device loop3): enabling ssd optimizations
[ 333.499989][T11605] BTRFS info (device loop3): auto enabling async discard
executing program
executing program
[ 333.625268][T11605] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 333.664960][T11575] loop0: detected capacity change from 0 to 32768
[ 333.688704][T11575] BTRFS: device /dev/loop0 using temp-fsid 454d59f6-54d8-417f-8085-74653532bcb6
[ 333.689286][T11575] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11575)
[ 333.712219][T11575] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 333.712792][T11575] BTRFS info (device loop0): max_inline at 0
[ 333.713118][T11575] BTRFS info (device loop0): using free space tree
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 333.825415][T11575] BTRFS info (device loop0): enabling ssd optimizations
[ 333.825862][T11575] BTRFS info (device loop0): auto enabling async discard
[ 333.871296][T11595] loop1: detected capacity change from 0 to 32768
[ 333.915156][T11595] BTRFS: device /dev/loop1 using temp-fsid 945cb25e-c31a-4a84-a45c-f97bf87afb29
[ 333.915859][T11595] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11595)
[ 333.950605][T11595] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 333.951234][T11595] BTRFS info (device loop1): max_inline at 0
[ 333.951632][T11595] BTRFS info (device loop1): using free space tree
[ 333.961633][T11575] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 334.096093][T11631] loop2: detected capacity change from 0 to 32768
[ 334.100087][T11631] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11631)
[ 334.107375][T11631] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 334.108140][T11631] BTRFS info (device loop2): max_inline at 0
[ 334.108589][T11631] BTRFS info (device loop2): using free space tree
[ 334.111985][T11595] BTRFS info (device loop1): enabling ssd optimizations
[ 334.112571][T11595] BTRFS info (device loop1): auto enabling async discard
[ 334.180050][T11595] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 334.330549][T11631] BTRFS info (device loop2): enabling ssd optimizations
[ 334.331137][T11631] BTRFS info (device loop2): auto enabling async discard
executing program
[ 334.434218][T11631] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 334.615506][T11668] loop7: detected capacity change from 0 to 32768
[ 334.634927][T11668] BTRFS: device /dev/loop7 using temp-fsid 64f691e6-2017-4f10-b4fd-618e0624aea5
[ 334.635855][T11668] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11668)
[ 334.672900][T11668] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 334.721881][T11668] BTRFS info (device loop7): max_inline at 0
[ 334.722389][T11668] BTRFS info (device loop7): using free space tree
[ 334.829912][T11689] loop4: detected capacity change from 0 to 32768
[ 334.845409][T11689] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (11689)
[ 334.897552][T11665] loop5: detected capacity change from 0 to 32768
[ 334.907854][T11689] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 334.908571][T11689] BTRFS info (device loop4): max_inline at 0
[ 334.909009][T11689] BTRFS info (device loop4): using free space tree
[ 334.929955][T11665] BTRFS: device /dev/loop5 using temp-fsid 9b97b7b2-9f7d-40c8-8607-ceedda48a256
[ 334.930676][T11665] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11665)
[ 334.957968][T11684] loop6: detected capacity change from 0 to 32768
[ 334.982381][T11668] BTRFS info (device loop7): enabling ssd optimizations
[ 334.982913][T11668] BTRFS info (device loop7): auto enabling async discard
[ 334.993085][T11684] BTRFS: device /dev/loop6 using temp-fsid 8df9225e-d32d-4e24-acf6-6592c685d640
[ 334.994251][T11684] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11684)
[ 334.997342][T11665] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 334.999247][T11665] BTRFS info (device loop5): max_inline at 0
[ 335.000301][T11665] BTRFS info (device loop5): using free space tree
executing program
[ 335.055408][T11684] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 335.072004][T11684] BTRFS info (device loop6): max_inline at 0
[ 335.082614][T11684] BTRFS info (device loop6): using free space tree
[ 335.103921][T11668] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 335.200158][T11689] BTRFS info (device loop4): enabling ssd optimizations
[ 335.200784][T11689] BTRFS info (device loop4): auto enabling async discard
[ 335.212113][T11665] BTRFS info (device loop5): enabling ssd optimizations
[ 335.212841][T11665] BTRFS info (device loop5): auto enabling async discard
executing program
[ 335.252532][T11665] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 335.284105][T11689] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 335.318941][T11684] BTRFS info (device loop6): enabling ssd optimizations
[ 335.321465][T11684] BTRFS info (device loop6): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 335.375612][T11684] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 335.398312][T11733] loop3: detected capacity change from 0 to 32768
[ 335.447060][T11733] BTRFS: device /dev/loop3 using temp-fsid 0aed2c7f-7243-4aa7-9b9f-65bfe0a65dd2
[ 335.447841][T11733] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11733)
[ 335.459185][T11733] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 335.464142][T11733] BTRFS info (device loop3): max_inline at 0
[ 335.470720][T11733] BTRFS info (device loop3): using free space tree
executing program
[ 335.751495][T11733] BTRFS info (device loop3): enabling ssd optimizations
[ 335.751997][T11733] BTRFS info (device loop3): auto enabling async discard
[ 335.825326][T11733] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 336.068724][T11791] loop1: detected capacity change from 0 to 32768
[ 336.078431][T11791] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11791)
[ 336.097229][T11791] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 336.098008][T11791] BTRFS info (device loop1): max_inline at 0
[ 336.105573][T11791] BTRFS info (device loop1): using free space tree
executing program
[ 336.272705][T11791] BTRFS info (device loop1): enabling ssd optimizations
[ 336.273317][T11791] BTRFS info (device loop1): auto enabling async discard
[ 336.360861][T11791] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 336.513350][T11764] loop0: detected capacity change from 0 to 32768
[ 336.530656][T11764] BTRFS: device /dev/loop0 using temp-fsid 00de5e74-9811-4e4b-b901-4e828a72c5a1
[ 336.531320][T11764] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11764)
[ 336.559096][T11764] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 336.560137][T11764] BTRFS info (device loop0): max_inline at 0
[ 336.560568][T11764] BTRFS info (device loop0): using free space tree
[ 336.563624][T11809] loop2: detected capacity change from 0 to 32768
[ 336.576040][T11809] BTRFS: device /dev/loop2 using temp-fsid 13e53e93-f4ac-49d6-b6fb-ca82385201aa
[ 336.576731][T11809] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11809)
[ 336.593832][T11809] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 336.594881][T11809] BTRFS info (device loop2): max_inline at 0
[ 336.595322][T11809] BTRFS info (device loop2): using free space tree
[ 336.684534][T11764] BTRFS info (device loop0): enabling ssd optimizations
[ 336.685058][T11764] BTRFS info (device loop0): auto enabling async discard
[ 336.705963][ T1239] ieee802154 phy0 wpan0: encryption failed: -22
[ 336.706735][ T1239] ieee802154 phy1 wpan1: encryption failed: -22
[ 336.774748][T11764] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 336.790715][T11809] BTRFS info (device loop2): enabling ssd optimizations
[ 336.791276][T11809] BTRFS info (device loop2): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 336.821665][T11871] loop3: detected capacity change from 0 to 32768
[ 336.824623][T11871] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11871)
[ 336.851764][T11871] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 336.852513][T11871] BTRFS info (device loop3): max_inline at 0
[ 336.853020][T11871] BTRFS info (device loop3): using free space tree
[ 336.914174][T11809] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 337.045900][T11876] loop6: detected capacity change from 0 to 32768
[ 337.053889][T11876] BTRFS: device /dev/loop6 using temp-fsid 745251f6-8396-4f95-8ee0-3e0cb3792496
[ 337.054611][T11876] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11876)
[ 337.071869][T11876] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 337.073824][T11876] BTRFS info (device loop6): max_inline at 0
[ 337.074295][T11876] BTRFS info (device loop6): using free space tree
executing program
[ 337.113512][T11871] BTRFS info (device loop3): enabling ssd optimizations
[ 337.114332][T11871] BTRFS info (device loop3): auto enabling async discard
[ 337.133981][T11871] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 337.198638][T11844] loop5: detected capacity change from 0 to 32768
[ 337.231666][T11844] BTRFS: device /dev/loop5 using temp-fsid ea62e781-e327-4ff4-9693-7e8ec0fcd5db
[ 337.239294][T11844] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11844)
[ 337.299820][T11844] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 337.306547][T11844] BTRFS info (device loop5): max_inline at 0
[ 337.314703][T11876] BTRFS info (device loop6): enabling ssd optimizations
[ 337.315292][T11876] BTRFS info (device loop6): auto enabling async discard
[ 337.315722][T11844] BTRFS info (device loop5): using free space tree
[ 337.421525][T11876] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 337.458543][T11852] loop7: detected capacity change from 0 to 32768
[ 337.463454][T11852] BTRFS: device /dev/loop7 using temp-fsid b6c50a1c-8aee-4149-90f9-14268597d16e
[ 337.464191][T11852] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11852)
[ 337.487110][T11852] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 337.489384][T11852] BTRFS info (device loop7): max_inline at 0
[ 337.490316][T11852] BTRFS info (device loop7): using free space tree
[ 337.509606][T11844] BTRFS info (device loop5): enabling ssd optimizations
[ 337.510226][T11844] BTRFS info (device loop5): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 337.688376][T11844] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 337.734614][T11852] BTRFS info (device loop7): enabling ssd optimizations
[ 337.735200][T11852] BTRFS info (device loop7): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 337.832432][T11852] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
executing program
executing program
executing program
[ 338.364786][T11933] loop1: detected capacity change from 0 to 32768
[ 338.389171][T11933] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11933)
[ 338.409978][T11933] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 338.410759][T11933] BTRFS info (device loop1): max_inline at 0
[ 338.411200][T11933] BTRFS info (device loop1): using free space tree
executing program
[ 338.692163][T11933] BTRFS info (device loop1): enabling ssd optimizations
[ 338.692806][T11933] BTRFS info (device loop1): auto enabling async discard
[ 338.777049][T11933] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 339.111192][T11995] loop4: detected capacity change from 0 to 32768
[ 339.123470][T11995] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (11995)
[ 339.164026][T12010] loop3: detected capacity change from 0 to 32768
[ 339.177671][T12000] loop2: detected capacity change from 0 to 32768
[ 339.184101][T11995] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 339.184795][T11995] BTRFS info (device loop4): max_inline at 0
[ 339.185314][T11995] BTRFS info (device loop4): using free space tree
[ 339.197808][T12000] BTRFS: device /dev/loop2 using temp-fsid 1cc04a4f-aca2-4c62-b469-953396320253
[ 339.198552][T12000] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (12000)
[ 339.228690][T12000] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 339.229403][T12000] BTRFS info (device loop2): max_inline at 0
[ 339.229861][T12000] BTRFS info (device loop2): using free space tree
[ 339.241045][T12010] BTRFS: device /dev/loop3 using temp-fsid bf36d360-9931-4934-8616-89a6cd1e4766
[ 339.241779][T12010] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (12010)
[ 339.299287][T12010] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 339.300903][T12010] BTRFS info (device loop3): max_inline at 0
[ 339.301376][T12010] BTRFS info (device loop3): using free space tree
[ 339.320722][T12001] loop0: detected capacity change from 0 to 32768
[ 339.341352][T12001] BTRFS: device /dev/loop0 using temp-fsid 4dc2c25d-2502-4266-8bed-9c156750cdd3
[ 339.348297][T12001] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (12001)
[ 339.432080][T12001] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 339.433169][T12001] BTRFS info (device loop0): max_inline at 0
[ 339.433635][T12001] BTRFS info (device loop0): using free space tree
[ 339.447714][T11995] BTRFS info (device loop4): enabling ssd optimizations
[ 339.448441][T11995] BTRFS info (device loop4): auto enabling async discard
[ 339.502392][T12000] BTRFS info (device loop2): enabling ssd optimizations
[ 339.503016][T12000] BTRFS info (device loop2): auto enabling async discard
[ 339.541422][T12010] BTRFS info (device loop3): enabling ssd optimizations
[ 339.542415][T12010] BTRFS info (device loop3): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 339.629644][T12000] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 339.630957][T11995] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 339.668246][T12010] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 339.720765][T12001] BTRFS info (device loop0): enabling ssd optimizations
[ 339.721297][T12001] BTRFS info (device loop0): auto enabling async discard
[ 339.847373][T12001] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 339.898452][T12031] loop5: detected capacity change from 0 to 32768
[ 339.919047][T12031] BTRFS: device /dev/loop5 using temp-fsid 21a71d86-d028-42db-9d84-d5c1f46c6f53
[ 339.919786][T12031] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (12031)
[ 339.962258][T12031] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 339.963021][T12031] BTRFS info (device loop5): max_inline at 0
[ 339.968476][T12031] BTRFS info (device loop5): using free space tree
[ 340.204577][T12031] BTRFS info (device loop5): enabling ssd optimizations
[ 340.205192][T12031] BTRFS info (device loop5): auto enabling async discard
executing program
[ 340.297323][T12031] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 340.412023][T12034] loop7: detected capacity change from 0 to 32768
[ 340.428214][T12034] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (12034)
[ 340.491704][T12034] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 340.492967][T12034] BTRFS info (device loop7): max_inline at 0
[ 340.493436][T12034] BTRFS info (device loop7): using free space tree
executing program
executing program
executing program
[ 340.729563][T12104] loop1: detected capacity change from 0 to 32768
[ 340.743327][T12034] BTRFS info (device loop7): enabling ssd optimizations
[ 340.747874][T12034] BTRFS info (device loop7): auto enabling async discard
[ 340.750144][T12104] BTRFS: device /dev/loop1 using temp-fsid 61183919-6c06-4360-81a5-cd760479dd87
[ 340.753227][T12104] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (12104)
[ 340.787157][T12104] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 340.787965][T12104] BTRFS info (device loop1): max_inline at 0
[ 340.788423][T12104] BTRFS info (device loop1): using free space tree
[ 340.828339][T12034] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 341.018259][T12104] BTRFS info (device loop1): enabling ssd optimizations
[ 341.018850][T12104] BTRFS info (device loop1): auto enabling async discard
[ 341.091155][T12104] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 341.392256][T12149] loop2: detected capacity change from 0 to 32768
[ 341.408392][T12149] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (12149)
[ 341.447468][T12149] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 341.448437][T12149] BTRFS info (device loop2): max_inline at 0
[ 341.448952][T12149] BTRFS info (device loop2): using free space tree
[ 341.487980][T12138] loop0: detected capacity change from 0 to 32768
[ 341.519407][T12138] BTRFS: device /dev/loop0 using temp-fsid 55c7ea20-5f54-4927-9cb7-e11c60896c76
[ 341.520167][T12138] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (12138)
[ 341.553606][T12138] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 341.554721][T12138] BTRFS info (device loop0): max_inline at 0
[ 341.555195][T12138] BTRFS info (device loop0): using free space tree
[ 341.599750][T12142] loop3: detected capacity change from 0 to 32768
[ 341.627342][T12142] BTRFS: device /dev/loop3 using temp-fsid d086c2d6-c7b9-4805-a931-65b68994d86b
[ 341.628138][T12142] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (12142)
executing program
[ 341.690193][T12149] BTRFS info (device loop2): enabling ssd optimizations
[ 341.690693][T12149] BTRFS info (device loop2): auto enabling async discard
[ 341.701271][T12142] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 341.701960][T12142] BTRFS info (device loop3): max_inline at 0
[ 341.702450][T12142] BTRFS info (device loop3): using free space tree
[ 341.776899][T12138] BTRFS info (device loop0): enabling ssd optimizations
[ 341.777447][T12138] BTRFS info (device loop0): auto enabling async discard
[ 341.781218][T12149] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 341.923023][T12245] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 341.944113][T12138] assertion failed: !anon_dev, in fs/btrfs/disk-io.c:1319
[ 341.945271][T12138] ------------[ cut here ]------------
[ 341.945705][T12138] kernel BUG at fs/btrfs/disk-io.c:1319!
[ 341.961819][T12138] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 341.962313][T12138] CPU: 0 PID: 12138 Comm: syz-executor301 Not tainted 6.6.0-gd2f51b3516da #1
[ 341.962963][T12138] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 341.963659][T12138] RIP: 0010:btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.964171][T12138] Code: ed e9 5f fd ff ff e8 c5 86 1e fe b9 27 05 00 00 48 c7 c2 40 18 37 8a 48 c7 c6 60 51 37 8a 48 c7 c7 c0 18 37 8a e8 46 ec 01 fe <0f> 0b e8 0f 86 71 fe e9 8d fb ff ff 49 c7 c5 fe ff ff ff e9 f2 fd
[ 341.965567][T12138] RSP: 0018:ffffc9000352f6e0 EFLAGS: 00010286
[ 341.966034][T12138] RAX: 0000000000000037 RBX: 000000000000003c RCX: ffffffff816673f9
[ 341.966616][T12138] RDX: 0000000000000000 RSI: ffffffff816704ce RDI: 0000000000000005
[ 341.967210][T12138] RBP: ffff888051c386e8 R08: 0000000000000005 R09: 0000000000000000
[ 341.967817][T12138] R10: 0000000080000000 R11: 0000000000000001 R12: dffffc0000000000
[ 341.968412][T12138] R13: ffff888051c38000 R14: ffffc9000352f758 R15: 0000000000000001
[ 341.969013][T12138] FS: 00007f69a57d8640(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000
[ 341.969672][T12138] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 341.970159][T12138] CR2: 00007ffeaebee980 CR3: 000000004edfe000 CR4: 0000000000350ef0
[ 341.970682][T12138] Call Trace:
[ 341.970931][T12138] <TASK>
[ 341.971161][T12138] ? show_regs+0x96/0xa0
[ 341.971524][T12138] ? die+0x38/0xb0
[ 341.971822][T12138] ? do_trap+0x22b/0x420
[ 341.972165][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.972625][T12138] ? do_error_trap+0x107/0x240
[ 341.972997][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.973442][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.973889][T12138] ? handle_invalid_op+0x34/0x40
[ 341.974288][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.974743][T12138] ? exc_invalid_op+0x5d/0x80
[ 341.975131][T12138] ? asm_exc_invalid_op+0x1a/0x20
[ 341.975517][T12138] ? __wake_up_klogd.part.0+0x99/0xf0
[ 341.975952][T12138] ? vprintk+0x7e/0x90
[ 341.976277][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.976731][T12138] ? btrfs_init_root_free_objectid+0x290/0x290
[ 341.977213][T12138] ? free_extent_buffer+0x1b0/0x380
[ 341.977621][T12138] ? alloc_extent_buffer+0x17f0/0x17f0
[ 341.978040][T12138] btrfs_get_new_fs_root+0xd3/0xf0
[ 341.978446][T12138] create_subvol+0xd02/0x1650
[ 341.978821][T12138] ? btrfs_ioctl_get_subvol_info+0x1170/0x1170
[ 341.979276][T12138] ? security_inode_permission+0xc9/0xf0
[ 341.979705][T12138] ? inode_permission+0xdc/0x5e0
[ 341.980085][T12138] btrfs_mksubvol+0xe95/0x12b0
[ 341.980466][T12138] ? create_subvol+0x1650/0x1650
[ 341.980857][T12138] ? mnt_get_write_access+0x212/0x300
[ 341.981257][T12138] __btrfs_ioctl_snap_create+0x2f9/0x4f0
[ 341.981695][T12138] ? _copy_from_user+0x13/0xf0
[ 341.982061][T12138] btrfs_ioctl_snap_create+0x16b/0x200
[ 341.982485][T12138] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 341.982926][T12138] btrfs_ioctl+0x35f0/0x5cf0
[ 341.983291][T12138] ? tomoyo_path_number_perm+0x16a/0x550
[ 341.983763][T12138] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 341.984218][T12138] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 341.984733][T12138] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 341.985190][T12138] ? do_vfs_ioctl+0x138/0x16c0
[ 341.985577][T12138] ? vfs_fileattr_set+0xc40/0xc40
[ 341.985985][T12138] ? ioctl_has_perm.constprop.0.isra.0+0x2af/0x410
[ 341.986488][T12138] ? ioctl_has_perm.constprop.0.isra.0+0x2b8/0x410
[ 341.986984][T12138] ? selinux_bprm_creds_for_exec+0xb20/0xb20
[ 341.987450][T12138] ? __fget_files+0x1ae/0x330
[ 341.987903][T12138] ? lock_downgrade+0x64b/0x690
[ 341.988256][T12138] ? lock_downgrade+0x690/0x690
[ 341.988628][T12138] ? selinux_file_ioctl+0x184/0x280
[ 341.989023][T12138] ? selinux_file_ioctl+0xba/0x280
[ 341.989423][T12138] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 341.989937][T12138] __x64_sys_ioctl+0x19d/0x210
[ 341.990325][T12138] do_syscall_64+0x3f/0xe0
[ 341.990674][T12138] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 341.991127][T12138] RIP: 0033:0x7f69a603e20d
[ 341.991478][T12138] Code: c3 e8 b7 28 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 341.992910][T12138] RSP: 002b:00007f69a57d80d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 341.993538][T12138] RAX: ffffffffffffffda RBX: 00007f69a60e2388 RCX: 00007f69a603e20d
[ 341.994130][T12138] RDX: 0000000020000140 RSI: 000000005000940e RDI: 0000000000000003
[ 341.994730][T12138] RBP: 00007f69a60e2380 R08: 00007f69a57d8640 R09: 0000000000000000
[ 341.995450][T12138] R10: 00007f69a57d8640 R11: 0000000000000246 R12: 00007f69a60e238c
[ 341.996109][T12138] R13: 000000000000000b R14: 00007f69a5ffec90 R15: 00007f69a57b8000
[ 341.996693][T12138] </TASK>
[ 341.996988][T12138] Modules linked in:
executing program
[ 342.036928][T12138] ---[ end trace 0000000000000000 ]---
[ 342.037378][T12138] RIP: 0010:btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 342.037851][T12138] Code: ed e9 5f fd ff ff e8 c5 86 1e fe b9 27 05 00 00 48 c7 c2 40 18 37 8a 48 c7 c6 60 51 37 8a 48 c7 c7 c0 18 37 8a e8 46 ec 01 fe <0f> 0b e8 0f 86 71 fe e9 8d fb ff ff 49 c7 c5 fe ff ff ff e9 f2 fd
[ 342.040440][T12138] RSP: 0018:ffffc9000352f6e0 EFLAGS: 00010286
[ 342.044472][T12138] RAX: 0000000000000037 RBX: 000000000000003c RCX: ffffffff816673f9
[ 342.045187][T12138] RDX: 0000000000000000 RSI: ffffffff816704ce RDI: 0000000000000005
[ 342.046922][T12138] RBP: ffff888051c386e8 R08: 0000000000000005 R09: 0000000000000000
[ 342.047559][T12138] R10: 0000000080000000 R11: 0000000000000001 R12: dffffc0000000000
[ 342.048217][T12138] R13: ffff888051c38000 R14: ffffc9000352f758 R15: 0000000000000001
[ 342.049969][T12138] FS: 00007f69a57d8640(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
[ 342.051262][T12138] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 342.051801][T12138] CR2: 00007ff330201a10 CR3: 000000004edfe000 CR4: 0000000000350ef0
[ 342.053696][T12142] BTRFS info (device loop3): enabling ssd optimizations
[ 342.061389][T12142] BTRFS info (device loop3): auto enabling async discard
[ 342.070083][T12138] Kernel panic - not syncing: Fatal exception
[ 342.070762][T12138] Kernel Offset: disabled
[ 342.071110][T12138] Rebooting in 86400 seconds..
VM DIAGNOSIS:
03:44:14 Registers:
info registers vcpu 0
RAX=fffffbfff20f3db0 RBX=00000000000007c3 RCX=ffffffff8163bc3a RDX=fffffbfff20f3db0
RSI=0000000000000008 RDI=ffffffff9079ed78 RBP=fffffbfff20f3daf RSP=ffffc90000e8f948
R8 =0000000000000000 R9 =fffffbfff20f3daf R10=ffffffff9079ed7f R11=0000000000000000
R12=0000000000000000 R13=0000000000000007 R14=0000000000000001 R15=ffff88801346c690
RIP=ffffffff81d5f84f RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88802cc00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffeaebee980 CR3=0000000028896000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000021f3d99c 000000001393e203
YMM01=0000000000000000 0000000000000000 0000000000000000 02e3e5baf5df4e6f
YMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM03=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
YMM04=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
YMM05=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffff0000
YMM06=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
YMM07=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffff0000
YMM08=0000000000000000 0000000000000000 36396f7369007265 6c6c616b7a797300
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 1
RAX=00000000001f05b4 RBX=00007f69a57d7660 RCX=0000000000000000 RDX=0000000000000035
RSI=0000000000000001 RDI=00007f699d3b8000 RBP=0000000000000102 RSP=00007f69a57d7600
R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000000 R11=00007f69a57d7670
R12=00007f69a57d7670 R13=00007f69a57d7700 R14=0000000000000001 R15=0000000000000000
RIP=00007f69a5fe593c RFL=00000202 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0033 0000000000000000 ffffffff 00a0fb00 DPL=3 CS64 [-RA]
SS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f69a57d8640 00000000 00000000
GS =0000 0000000000000000 00000000 00000000
LDT=0000 fffffe4200000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f699d5a8000 CR3=00000000505e8000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM01=0000000000000000 0000000000000000 0000000000ff0000 00000000000000ff
YMM02=0000000000000000 0000000000000000 0000000000ff0000 00000000000000ff
YMM03=0000000000000000 0000000000000000 00007f69a57d7f50 00007f69a57d7f50
YMM04=0000000000000000 0000000000000000 0000000000000000 00007f69a57d7f8f
YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM08=0000000000000000 0000000000000000 36396f7369007265 6c6c616b7a797300
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
next reply other threads:[~2024-01-20 4:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-20 4:15 Chenyuan Yang [this message]
2024-01-20 5:59 ` [Linux Kernel Bug] kernel BUG in btrfs_get_root_ref (assertion failed: !anon_dev) and general protection fault in btrfs_update_reloc_root Qu Wenruo
2024-01-20 6:25 ` Chenyuan Yang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CALGdzuo6awWdau3X=8XK547x2vX_-VoFmH1aPsqosRTQ5WzJVA@mail.gmail.com' \
--to=chenyuan0y@gmail.com \
--cc=clm@fb.com \
--cc=dsterba@suse.com \
--cc=josef@toxicpanda.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=zzjas98@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).