From: Chenyuan Yang <chenyuan0y@gmail.com>
To: linux-btrfs@vger.kernel.org, clm@fb.com, josef@toxicpanda.com,
dsterba@suse.com
Cc: linux-kernel@vger.kernel.org, syzkaller@googlegroups.com,
Zijie Zhao <zzjas98@gmail.com>
Subject: [Linux Kernel Bug] kernel BUG in btrfs_get_root_ref (assertion failed: !anon_dev) and general protection fault in btrfs_update_reloc_root
Date: Fri, 19 Jan 2024 22:15:09 -0600 [thread overview]
Message-ID: <CALGdzuo6awWdau3X=8XK547x2vX_-VoFmH1aPsqosRTQ5WzJVA@mail.gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 2049 bytes --]
Dear Linux Kernel Developers for BTRFS,
We encountered "kernel BUG in btrfs_get_root_ref" and "general
protection fault in btrfs_update_reloc_root" when testing BTRFS with
Syzkaller and our generated specifications.
For "kernel BUG in btrfs_get_root_ref", it is an internal assertion
failure `ASSERT(!anon_dev)` in `btrfs_get_root_ref`
(https://elixir.bootlin.com/linux/latest/source/fs/btrfs/disk-io.c#L1319),
which asserts the `anno_dev` should be NULL but it is preallocated
here. I've attached the reproducible C program and report.
For "general protection fault in btrfs_update_reloc_root", it attempts
to deference the null pointer in `refcount_inc_not_zero(&root->refs)`
(https://elixir.bootlin.com/linux/latest/source/fs/btrfs/disk-io.h#L101),
which is invoked by `btrfs_update_reloc_root`
(https://elixir.bootlin.com/linux/v6.7/source/fs/btrfs/relocation.c#L926).
Here is the call trace:
```
general protection fault, probably for non-canonical address
0xdffffc00000000cd: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000668-0x000000000000066f]
[ 1904.856783][T69219] Call Trace:
[ 1904.857057][T69219] <TASK>
[1904.857312][T69219] ? show_regs (arch/x86/kernel/dumpstack.c:479)
[1904.857693][T69219] ? die_addr (arch/x86/kernel/dumpstack.c:421
arch/x86/kernel/dumpstack.c:460)
[1904.858074][T69219] ? exc_general_protection
(arch/x86/kernel/traps.c:700 arch/x86/kernel/traps.c:642)
[1904.858515][T69219] ? asm_exc_general_protection
(./arch/x86/include/asm/idtentry.h:564)
[1904.858941][T69219] ? btrfs_update_reloc_root
(./include/linux/refcount.h:162 ./include/linux/refcount.h:227
./include/linux/refcount.h:245 fs/btrfs/disk-io.h:101
fs/btrfs/relocation.c:926)
[1904.859402][T69219] ? btrfs_update_reloc_root (fs/btrfs/relocation.c:929)
```
Unfortunately, we failed to find the reproducible program for
"general protection fault in btrfs_update_reloc_root". I have attached
the report and log for it.
If you have any questions or require more information, please feel
free to contact us.
Best,
Chenyuan
[-- Attachment #2: btrfs_update_reloc_root.report --]
[-- Type: application/octet-stream, Size: 4176 bytes --]
general protection fault, probably for non-canonical address 0xdffffc00000000cd: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000668-0x000000000000066f]
CPU: 0 PID: 69219 Comm: syz-executor.0 Not tainted 6.6.0-gd2f51b3516da #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:btrfs_update_reloc_root+0x25b/0xab0 fs/btrfs/relocation.c:929
Code: 00 0f 85 51 07 00 00 48 8b 04 24 48 8b a8 38 11 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bd 6d 06 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 22 07 00 00
RSP: 0018:ffffc900197477f8 EFLAGS: 00010213
RAX: dffffc0000000000 RBX: ffff8880221e4000 RCX: ffffffff8379d4a4
RDX: 00000000000000cd RSI: ffffffff8379d4b2 RDI: 000000000000066d
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000001 R12: ffff8880221e4038
R13: ffff88806c9d6000 R14: 0000000000000002 R15: 0000000000000001
FS: 00007f80b2dba640(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1c76583000 CR3: 000000006ba98000 CR4: 0000000000350ef0
Call Trace:
<TASK>
commit_fs_roots+0x35e/0x7b0 fs/btrfs/transaction.c:1539
btrfs_commit_transaction+0x1289/0x3a30 fs/btrfs/transaction.c:2470
_btrfs_ioctl_set_received_subvol+0x7be/0xd10 fs/btrfs/ioctl.c:4019
btrfs_ioctl_set_received_subvol fs/btrfs/ioctl.c:4087 [inline]
btrfs_ioctl+0x2335/0x5cf0 fs/btrfs/ioctl.c:4654
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0xe0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f80b208fd2d
Code: c3 e8 97 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f80b2dba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f80b21cbf80 RCX: 00007f80b208fd2d
RDX: 0000000020000140 RSI: 00000000c0c89425 RDI: 0000000000000003
RBP: 00007f80b20f14a6 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f80b21cbf80 R15: 00007f80b2d9a000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:btrfs_update_reloc_root+0x25b/0xab0 fs/btrfs/relocation.c:929
Code: 00 0f 85 51 07 00 00 48 8b 04 24 48 8b a8 38 11 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bd 6d 06 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 22 07 00 00
RSP: 0018:ffffc900197477f8 EFLAGS: 00010213
RAX: dffffc0000000000 RBX: ffff8880221e4000 RCX: ffffffff8379d4a4
RDX: 00000000000000cd RSI: ffffffff8379d4b2 RDI: 000000000000066d
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000001 R12: ffff8880221e4038
R13: ffff88806c9d6000 R14: 0000000000000002 R15: 0000000000000001
FS: 00007f80b2dba640(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1aff953a80 CR3: 000000006ba98000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 00 0f add %cl,(%rdi)
2: 85 51 07 test %edx,0x7(%rcx)
5: 00 00 add %al,(%rax)
7: 48 8b 04 24 mov (%rsp),%rax
b: 48 8b a8 38 11 00 00 mov 0x1138(%rax),%rbp
12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
19: fc ff df
1c: 48 8d bd 6d 06 00 00 lea 0x66d(%rbp),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 48 89 fa mov %rdi,%rdx
31: 83 e2 07 and $0x7,%edx
34: 38 d0 cmp %dl,%al
36: 7f 08 jg 0x40
38: 84 c0 test %al,%al
3a: 0f 85 22 07 00 00 jne 0x762
[-- Attachment #3: btrfs_update_reloc_root.log --]
[-- Type: application/octet-stream, Size: 1060159 bytes --]
[-- Attachment #4: btrfs_get_root_ref-repro.report --]
[-- Type: application/octet-stream, Size: 3402 bytes --]
assertion failed: !anon_dev, in fs/btrfs/disk-io.c:1319
------------[ cut here ]------------
kernel BUG at fs/btrfs/disk-io.c:1319!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 12138 Comm: syz-executor301 Not tainted 6.6.0-gd2f51b3516da #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:btrfs_get_root_ref.part.0+0x9aa/0xa60 fs/btrfs/disk-io.c:1319
Code: ed e9 5f fd ff ff e8 c5 86 1e fe b9 27 05 00 00 48 c7 c2 40 18 37 8a 48 c7 c6 60 51 37 8a 48 c7 c7 c0 18 37 8a e8 46 ec 01 fe <0f> 0b e8 0f 86 71 fe e9 8d fb ff ff 49 c7 c5 fe ff ff ff e9 f2 fd
RSP: 0018:ffffc9000352f6e0 EFLAGS: 00010286
RAX: 0000000000000037 RBX: 000000000000003c RCX: ffffffff816673f9
RDX: 0000000000000000 RSI: ffffffff816704ce RDI: 0000000000000005
RBP: ffff888051c386e8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888051c38000 R14: ffffc9000352f758 R15: 0000000000000001
FS: 00007f69a57d8640(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffeaebee980 CR3: 000000004edfe000 CR4: 0000000000350ef0
Call Trace:
<TASK>
btrfs_get_root_ref fs/btrfs/disk-io.c:1313 [inline]
btrfs_get_new_fs_root+0xd3/0xf0 fs/btrfs/disk-io.c:1405
create_subvol+0xd02/0x1650 fs/btrfs/ioctl.c:724
btrfs_mksubvol+0xe95/0x12b0 fs/btrfs/ioctl.c:997
__btrfs_ioctl_snap_create+0x2f9/0x4f0 fs/btrfs/ioctl.c:1272
btrfs_ioctl_snap_create+0x16b/0x200 fs/btrfs/ioctl.c:1321
btrfs_ioctl+0x35f0/0x5cf0 fs/btrfs/ioctl.c:4579
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x19d/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0xe0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f69a603e20d
Code: c3 e8 b7 28 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f69a57d80d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f69a60e2388 RCX: 00007f69a603e20d
RDX: 0000000020000140 RSI: 000000005000940e RDI: 0000000000000003
RBP: 00007f69a60e2380 R08: 00007f69a57d8640 R09: 0000000000000000
R10: 00007f69a57d8640 R11: 0000000000000246 R12: 00007f69a60e238c
R13: 000000000000000b R14: 00007f69a5ffec90 R15: 00007f69a57b8000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:btrfs_get_root_ref.part.0+0x9aa/0xa60 fs/btrfs/disk-io.c:1319
Code: ed e9 5f fd ff ff e8 c5 86 1e fe b9 27 05 00 00 48 c7 c2 40 18 37 8a 48 c7 c6 60 51 37 8a 48 c7 c7 c0 18 37 8a e8 46 ec 01 fe <0f> 0b e8 0f 86 71 fe e9 8d fb ff ff 49 c7 c5 fe ff ff ff e9 f2 fd
RSP: 0018:ffffc9000352f6e0 EFLAGS: 00010286
RAX: 0000000000000037 RBX: 000000000000003c RCX: ffffffff816673f9
RDX: 0000000000000000 RSI: ffffffff816704ce RDI: 0000000000000005
RBP: ffff888051c386e8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888051c38000 R14: ffffc9000352f758 R15: 0000000000000001
FS: 00007f69a57d8640(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff330201a10 CR3: 000000004edfe000 CR4: 0000000000350ef0
[-- Attachment #5: btrfs_get_root_ref-repro.cprog --]
[-- Type: application/octet-stream, Size: 189424 bytes --]
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <netinet/in.h>
#include <pthread.h>
#include <sched.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/epoll.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/swap.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/capability.h>
#include <linux/falloc.h>
#include <linux/futex.h>
#include <linux/genetlink.h>
#include <linux/if_addr.h>
#include <linux/if_ether.h>
#include <linux/if_link.h>
#include <linux/if_tun.h>
#include <linux/in6.h>
#include <linux/ip.h>
#include <linux/loop.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/nl80211.h>
#include <linux/rfkill.h>
#include <linux/rtnetlink.h>
#include <linux/tcp.h>
#include <linux/veth.h>
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif
static unsigned long long procid;
static __thread int clone_ongoing;
static __thread int skip_segv;
static __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
exit(sig);
}
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
int valid = addr < prog_start || addr > prog_end;
if (skip && valid) {
_longjmp(segv_env, 1);
}
exit(sig);
}
static void install_segv_handler(void)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_handler = SIG_IGN;
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) ({ int ok = 1; __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); if (_setjmp(segv_env) == 0) { __VA_ARGS__; } else ok = 0; __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); ok; })
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
int state;
} event_t;
static void event_init(event_t* ev)
{
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
if (ev->state)
exit(1);
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}
static void event_wait(event_t* ev)
{
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}
static int event_isset(event_t* ev)
{
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
for (;;) {
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
return 1;
now = current_time_ms();
if (now - start > timeout)
return 0;
}
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
struct nlmsg {
char* pos;
int nesting;
struct nlattr* nested[8];
char buf[4096];
};
static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
const void* data, int size)
{
memset(nlmsg, 0, sizeof(*nlmsg));
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
hdr->nlmsg_type = typ;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
memcpy(hdr + 1, data, size);
nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}
static void netlink_attr(struct nlmsg* nlmsg, int typ,
const void* data, int size)
{
struct nlattr* attr = (struct nlattr*)nlmsg->pos;
attr->nla_len = sizeof(*attr) + size;
attr->nla_type = typ;
if (size > 0)
memcpy(attr + 1, data, size);
nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
}
static void netlink_nest(struct nlmsg* nlmsg, int typ)
{
struct nlattr* attr = (struct nlattr*)nlmsg->pos;
attr->nla_type = typ;
nlmsg->pos += sizeof(*attr);
nlmsg->nested[nlmsg->nesting++] = attr;
}
static void netlink_done(struct nlmsg* nlmsg)
{
struct nlattr* attr = nlmsg->nested[--nlmsg->nesting];
attr->nla_len = nlmsg->pos - (char*)attr;
}
static int netlink_send_ext(struct nlmsg* nlmsg, int sock,
uint16_t reply_type, int* reply_len, bool dofail)
{
if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
exit(1);
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
struct sockaddr_nl addr;
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr));
if (n != (ssize_t)hdr->nlmsg_len) {
if (dofail)
exit(1);
return -1;
}
n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
if (reply_len)
*reply_len = 0;
if (n < 0) {
if (dofail)
exit(1);
return -1;
}
if (n < (ssize_t)sizeof(struct nlmsghdr)) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
if (hdr->nlmsg_type == NLMSG_DONE)
return 0;
if (reply_len && hdr->nlmsg_type == reply_type) {
*reply_len = n;
return 0;
}
if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
if (hdr->nlmsg_type != NLMSG_ERROR) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
errno = -((struct nlmsgerr*)(hdr + 1))->error;
return -errno;
}
static int netlink_send(struct nlmsg* nlmsg, int sock)
{
return netlink_send_ext(nlmsg, sock, 0, NULL, true);
}
static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail)
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = CTRL_CMD_GETFAMILY;
netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1);
int n = 0;
int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
if (err < 0) {
return -1;
}
uint16_t id = 0;
struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr)));
for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
id = *(uint16_t*)(attr + 1);
break;
}
}
if (!id) {
errno = EINVAL;
return -1;
}
recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
return id;
}
static int netlink_next_msg(struct nlmsg* nlmsg, unsigned int offset,
unsigned int total_len)
{
struct nlmsghdr* hdr = (struct nlmsghdr*)(nlmsg->buf + offset);
if (offset == total_len || offset + hdr->nlmsg_len > total_len)
return -1;
return hdr->nlmsg_len;
}
static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type,
const char* name, bool up)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
if (up)
hdr.ifi_flags = hdr.ifi_change = IFF_UP;
netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr));
if (name)
netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name));
netlink_nest(nlmsg, IFLA_LINKINFO);
netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type));
}
static void netlink_add_device(struct nlmsg* nlmsg, int sock, const char* type,
const char* name)
{
netlink_add_device_impl(nlmsg, type, name, false);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_veth(struct nlmsg* nlmsg, int sock, const char* name,
const char* peer)
{
netlink_add_device_impl(nlmsg, "veth", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_nest(nlmsg, VETH_INFO_PEER);
nlmsg->pos += sizeof(struct ifinfomsg);
netlink_attr(nlmsg, IFLA_IFNAME, peer, strlen(peer));
netlink_done(nlmsg);
netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_xfrm(struct nlmsg* nlmsg, int sock, const char* name)
{
netlink_add_device_impl(nlmsg, "xfrm", name, true);
netlink_nest(nlmsg, IFLA_INFO_DATA);
int if_id = 1;
netlink_attr(nlmsg, 2, &if_id, sizeof(if_id));
netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_hsr(struct nlmsg* nlmsg, int sock, const char* name,
const char* slave1, const char* slave2)
{
netlink_add_device_impl(nlmsg, "hsr", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
int ifindex1 = if_nametoindex(slave1);
netlink_attr(nlmsg, IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1));
int ifindex2 = if_nametoindex(slave2);
netlink_attr(nlmsg, IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2));
netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_linked(struct nlmsg* nlmsg, int sock, const char* type, const char* name, const char* link)
{
netlink_add_device_impl(nlmsg, type, name, false);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_vlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t id, uint16_t proto)
{
netlink_add_device_impl(nlmsg, "vlan", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_attr(nlmsg, IFLA_VLAN_ID, &id, sizeof(id));
netlink_attr(nlmsg, IFLA_VLAN_PROTOCOL, &proto, sizeof(proto));
netlink_done(nlmsg);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_macvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link)
{
netlink_add_device_impl(nlmsg, "macvlan", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
uint32_t mode = MACVLAN_MODE_BRIDGE;
netlink_attr(nlmsg, IFLA_MACVLAN_MODE, &mode, sizeof(mode));
netlink_done(nlmsg);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_add_geneve(struct nlmsg* nlmsg, int sock, const char* name, uint32_t vni, struct in_addr* addr4, struct in6_addr* addr6)
{
netlink_add_device_impl(nlmsg, "geneve", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_attr(nlmsg, IFLA_GENEVE_ID, &vni, sizeof(vni));
if (addr4)
netlink_attr(nlmsg, IFLA_GENEVE_REMOTE, addr4, sizeof(*addr4));
if (addr6)
netlink_attr(nlmsg, IFLA_GENEVE_REMOTE6, addr6, sizeof(*addr6));
netlink_done(nlmsg);
netlink_done(nlmsg);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
#define IFLA_IPVLAN_FLAGS 2
#define IPVLAN_MODE_L3S 2
#undef IPVLAN_F_VEPA
#define IPVLAN_F_VEPA 2
static void netlink_add_ipvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t mode, uint16_t flags)
{
netlink_add_device_impl(nlmsg, "ipvlan", name, false);
netlink_nest(nlmsg, IFLA_INFO_DATA);
netlink_attr(nlmsg, IFLA_IPVLAN_MODE, &mode, sizeof(mode));
netlink_attr(nlmsg, IFLA_IPVLAN_FLAGS, &flags, sizeof(flags));
netlink_done(nlmsg);
netlink_done(nlmsg);
int ifindex = if_nametoindex(link);
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static void netlink_device_change(struct nlmsg* nlmsg, int sock, const char* name, bool up,
const char* master, const void* mac, int macsize,
const char* new_name)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
if (up)
hdr.ifi_flags = hdr.ifi_change = IFF_UP;
hdr.ifi_index = if_nametoindex(name);
netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr));
if (new_name)
netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name));
if (master) {
int ifindex = if_nametoindex(master);
netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex));
}
if (macsize)
netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev,
const void* addr, int addrsize)
{
struct ifaddrmsg hdr;
memset(&hdr, 0, sizeof(hdr));
hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6;
hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120;
hdr.ifa_scope = RT_SCOPE_UNIVERSE;
hdr.ifa_index = if_nametoindex(dev);
netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr));
netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize);
netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize);
return netlink_send(nlmsg, sock);
}
static void netlink_add_addr4(struct nlmsg* nlmsg, int sock,
const char* dev, const char* addr)
{
struct in_addr in_addr;
inet_pton(AF_INET, addr, &in_addr);
int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr));
if (err < 0) {
}
}
static void netlink_add_addr6(struct nlmsg* nlmsg, int sock,
const char* dev, const char* addr)
{
struct in6_addr in6_addr;
inet_pton(AF_INET6, addr, &in6_addr);
int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr));
if (err < 0) {
}
}
static void netlink_add_neigh(struct nlmsg* nlmsg, int sock, const char* name,
const void* addr, int addrsize, const void* mac, int macsize)
{
struct ndmsg hdr;
memset(&hdr, 0, sizeof(hdr));
hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6;
hdr.ndm_ifindex = if_nametoindex(name);
hdr.ndm_state = NUD_PERMANENT;
netlink_init(nlmsg, RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr));
netlink_attr(nlmsg, NDA_DST, addr, addrsize);
netlink_attr(nlmsg, NDA_LLADDR, mac, macsize);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static struct nlmsg nlmsg;
static int tunfd = -1;
#define TUN_IFACE "syz_tun"
#define LOCAL_MAC 0xaaaaaaaaaaaa
#define REMOTE_MAC 0xaaaaaaaaaabb
#define LOCAL_IPV4 "172.20.20.170"
#define REMOTE_IPV4 "172.20.20.187"
#define LOCAL_IPV6 "fe80::aa"
#define REMOTE_IPV6 "fe80::bb"
#define IFF_NAPI 0x0010
static void initialize_tun(void)
{
tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK);
if (tunfd == -1) {
printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n");
printf("otherwise fuzzing or reproducing might not work as intended\n");
return;
}
const int kTunFd = 200;
if (dup2(tunfd, kTunFd) < 0)
exit(1);
close(tunfd);
tunfd = kTunFd;
struct ifreq ifr;
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ);
ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) {
exit(1);
}
char sysctl[64];
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE);
write_file(sysctl, "0");
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE);
write_file(sysctl, "0");
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
netlink_add_addr4(&nlmsg, sock, TUN_IFACE, LOCAL_IPV4);
netlink_add_addr6(&nlmsg, sock, TUN_IFACE, LOCAL_IPV6);
uint64_t macaddr = REMOTE_MAC;
struct in_addr in_addr;
inet_pton(AF_INET, REMOTE_IPV4, &in_addr);
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in_addr, sizeof(in_addr), &macaddr, ETH_ALEN);
struct in6_addr in6_addr;
inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr);
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in6_addr, sizeof(in6_addr), &macaddr, ETH_ALEN);
macaddr = LOCAL_MAC;
netlink_device_change(&nlmsg, sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN, NULL);
close(sock);
}
#define DEVLINK_FAMILY_NAME "devlink"
#define DEVLINK_CMD_PORT_GET 5
#define DEVLINK_ATTR_BUS_NAME 1
#define DEVLINK_ATTR_DEV_NAME 2
#define DEVLINK_ATTR_NETDEV_NAME 7
static struct nlmsg nlmsg2;
static void initialize_devlink_ports(const char* bus_name, const char* dev_name,
const char* netdev_prefix)
{
struct genlmsghdr genlhdr;
int len, total_len, id, err, offset;
uint16_t netdev_index;
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock == -1)
exit(1);
int rtsock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (rtsock == -1)
exit(1);
id = netlink_query_family_id(&nlmsg, sock, DEVLINK_FAMILY_NAME, true);
if (id == -1)
goto error;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = DEVLINK_CMD_PORT_GET;
netlink_init(&nlmsg, id, NLM_F_DUMP, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, DEVLINK_ATTR_BUS_NAME, bus_name, strlen(bus_name) + 1);
netlink_attr(&nlmsg, DEVLINK_ATTR_DEV_NAME, dev_name, strlen(dev_name) + 1);
err = netlink_send_ext(&nlmsg, sock, id, &total_len, true);
if (err < 0) {
goto error;
}
offset = 0;
netdev_index = 0;
while ((len = netlink_next_msg(&nlmsg, offset, total_len)) != -1) {
struct nlattr* attr = (struct nlattr*)(nlmsg.buf + offset + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr)));
for (; (char*)attr < nlmsg.buf + offset + len; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
if (attr->nla_type == DEVLINK_ATTR_NETDEV_NAME) {
char* port_name;
char netdev_name[IFNAMSIZ];
port_name = (char*)(attr + 1);
snprintf(netdev_name, sizeof(netdev_name), "%s%d", netdev_prefix, netdev_index);
netlink_device_change(&nlmsg2, rtsock, port_name, true, 0, 0, 0, netdev_name);
break;
}
}
offset += len;
netdev_index++;
}
error:
close(rtsock);
close(sock);
}
#define WIFI_INITIAL_DEVICE_COUNT 2
#define WIFI_MAC_BASE { 0x08, 0x02, 0x11, 0x00, 0x00, 0x00 }
#define WIFI_IBSS_BSSID { 0x50, 0x50, 0x50, 0x50, 0x50, 0x50 }
#define WIFI_IBSS_SSID { 0x10, 0x10, 0x10, 0x10, 0x10, 0x10 }
#define WIFI_DEFAULT_FREQUENCY 2412
#define WIFI_DEFAULT_SIGNAL 0
#define WIFI_DEFAULT_RX_RATE 1
#define HWSIM_CMD_REGISTER 1
#define HWSIM_CMD_FRAME 2
#define HWSIM_CMD_NEW_RADIO 4
#define HWSIM_ATTR_SUPPORT_P2P_DEVICE 14
#define HWSIM_ATTR_PERM_ADDR 22
#define IF_OPER_UP 6
struct join_ibss_props {
int wiphy_freq;
bool wiphy_freq_fixed;
uint8_t* mac;
uint8_t* ssid;
int ssid_len;
};
static int set_interface_state(const char* interface_name, int on)
{
struct ifreq ifr;
int sock = socket(AF_INET, SOCK_DGRAM, 0);
if (sock < 0) {
return -1;
}
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, interface_name);
int ret = ioctl(sock, SIOCGIFFLAGS, &ifr);
if (ret < 0) {
close(sock);
return -1;
}
if (on)
ifr.ifr_flags |= IFF_UP;
else
ifr.ifr_flags &= ~IFF_UP;
ret = ioctl(sock, SIOCSIFFLAGS, &ifr);
close(sock);
if (ret < 0) {
return -1;
}
return 0;
}
static int nl80211_set_interface(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, uint32_t iftype)
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = NL80211_CMD_SET_INTERFACE;
netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
netlink_attr(nlmsg, NL80211_ATTR_IFTYPE, &iftype, sizeof(iftype));
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
return err;
}
static int nl80211_join_ibss(struct nlmsg* nlmsg, int sock, int nl80211_family, uint32_t ifindex, struct join_ibss_props* props)
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = NL80211_CMD_JOIN_IBSS;
netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
netlink_attr(nlmsg, NL80211_ATTR_SSID, props->ssid, props->ssid_len);
netlink_attr(nlmsg, NL80211_ATTR_WIPHY_FREQ, &(props->wiphy_freq), sizeof(props->wiphy_freq));
if (props->mac)
netlink_attr(nlmsg, NL80211_ATTR_MAC, props->mac, ETH_ALEN);
if (props->wiphy_freq_fixed)
netlink_attr(nlmsg, NL80211_ATTR_FREQ_FIXED, NULL, 0);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
return err;
}
static int get_ifla_operstate(struct nlmsg* nlmsg, int ifindex)
{
struct ifinfomsg info;
memset(&info, 0, sizeof(info));
info.ifi_family = AF_UNSPEC;
info.ifi_index = ifindex;
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1) {
return -1;
}
netlink_init(nlmsg, RTM_GETLINK, 0, &info, sizeof(info));
int n;
int err = netlink_send_ext(nlmsg, sock, RTM_NEWLINK, &n, true);
close(sock);
if (err) {
return -1;
}
struct rtattr* attr = IFLA_RTA(NLMSG_DATA(nlmsg->buf));
for (; RTA_OK(attr, n); attr = RTA_NEXT(attr, n)) {
if (attr->rta_type == IFLA_OPERSTATE)
return *((int32_t*)RTA_DATA(attr));
}
return -1;
}
static int await_ifla_operstate(struct nlmsg* nlmsg, char* interface, int operstate)
{
int ifindex = if_nametoindex(interface);
while (true) {
usleep(1000);
int ret = get_ifla_operstate(nlmsg, ifindex);
if (ret < 0)
return ret;
if (ret == operstate)
return 0;
}
return 0;
}
static int nl80211_setup_ibss_interface(struct nlmsg* nlmsg, int sock, int nl80211_family_id, char* interface, struct join_ibss_props* ibss_props)
{
int ifindex = if_nametoindex(interface);
if (ifindex == 0) {
return -1;
}
int ret = nl80211_set_interface(nlmsg, sock, nl80211_family_id, ifindex, NL80211_IFTYPE_ADHOC);
if (ret < 0) {
return -1;
}
ret = set_interface_state(interface, 1);
if (ret < 0) {
return -1;
}
ret = nl80211_join_ibss(nlmsg, sock, nl80211_family_id, ifindex, ibss_props);
if (ret < 0) {
return -1;
}
return 0;
}
static int hwsim80211_create_device(struct nlmsg* nlmsg, int sock, int hwsim_family, uint8_t mac_addr[ETH_ALEN])
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = HWSIM_CMD_NEW_RADIO;
netlink_init(nlmsg, hwsim_family, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(nlmsg, HWSIM_ATTR_SUPPORT_P2P_DEVICE, NULL, 0);
netlink_attr(nlmsg, HWSIM_ATTR_PERM_ADDR, mac_addr, ETH_ALEN);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
return err;
}
static void initialize_wifi_devices(void)
{
int rfkill = open("/dev/rfkill", O_RDWR);
if (rfkill == -1) {
if (errno != ENOENT && errno != EACCES)
exit(1);
} else {
struct rfkill_event event = {0};
event.type = RFKILL_TYPE_ALL;
event.op = RFKILL_OP_CHANGE_ALL;
if (write(rfkill, &event, sizeof(event)) != (ssize_t)(sizeof(event)))
exit(1);
close(rfkill);
}
uint8_t mac_addr[6] = WIFI_MAC_BASE;
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock < 0) {
return;
}
int hwsim_family_id = netlink_query_family_id(&nlmsg, sock, "MAC80211_HWSIM", true);
int nl80211_family_id = netlink_query_family_id(&nlmsg, sock, "nl80211", true);
uint8_t ssid[] = WIFI_IBSS_SSID;
uint8_t bssid[] = WIFI_IBSS_BSSID;
struct join_ibss_props ibss_props = {
.wiphy_freq = WIFI_DEFAULT_FREQUENCY, .wiphy_freq_fixed = true, .mac = bssid, .ssid = ssid, .ssid_len = sizeof(ssid)};
for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) {
mac_addr[5] = device_id;
int ret = hwsim80211_create_device(&nlmsg, sock, hwsim_family_id, mac_addr);
if (ret < 0)
exit(1);
char interface[6] = "wlan0";
interface[4] += device_id;
if (nl80211_setup_ibss_interface(&nlmsg, sock, nl80211_family_id, interface, &ibss_props) < 0)
exit(1);
}
for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) {
char interface[6] = "wlan0";
interface[4] += device_id;
int ret = await_ifla_operstate(&nlmsg, interface, IF_OPER_UP);
if (ret < 0)
exit(1);
}
close(sock);
}
static int runcmdline(char* cmdline)
{
int ret = system(cmdline);
if (ret) {
}
return ret;
}
#define DEV_IPV4 "172.20.20.%d"
#define DEV_IPV6 "fe80::%02x"
#define DEV_MAC 0x00aaaaaaaaaa
static void netdevsim_add(unsigned int addr, unsigned int port_count)
{
write_file("/sys/bus/netdevsim/del_device", "%u", addr);
if (write_file("/sys/bus/netdevsim/new_device", "%u %u", addr, port_count)) {
char buf[32];
snprintf(buf, sizeof(buf), "netdevsim%d", addr);
initialize_devlink_ports("netdevsim", buf, "netdevsim");
}
}
#define WG_GENL_NAME "wireguard"
enum wg_cmd {
WG_CMD_GET_DEVICE,
WG_CMD_SET_DEVICE,
};
enum wgdevice_attribute {
WGDEVICE_A_UNSPEC,
WGDEVICE_A_IFINDEX,
WGDEVICE_A_IFNAME,
WGDEVICE_A_PRIVATE_KEY,
WGDEVICE_A_PUBLIC_KEY,
WGDEVICE_A_FLAGS,
WGDEVICE_A_LISTEN_PORT,
WGDEVICE_A_FWMARK,
WGDEVICE_A_PEERS,
};
enum wgpeer_attribute {
WGPEER_A_UNSPEC,
WGPEER_A_PUBLIC_KEY,
WGPEER_A_PRESHARED_KEY,
WGPEER_A_FLAGS,
WGPEER_A_ENDPOINT,
WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
WGPEER_A_LAST_HANDSHAKE_TIME,
WGPEER_A_RX_BYTES,
WGPEER_A_TX_BYTES,
WGPEER_A_ALLOWEDIPS,
WGPEER_A_PROTOCOL_VERSION,
};
enum wgallowedip_attribute {
WGALLOWEDIP_A_UNSPEC,
WGALLOWEDIP_A_FAMILY,
WGALLOWEDIP_A_IPADDR,
WGALLOWEDIP_A_CIDR_MASK,
};
static void netlink_wireguard_setup(void)
{
const char ifname_a[] = "wg0";
const char ifname_b[] = "wg1";
const char ifname_c[] = "wg2";
const char private_a[] = "\xa0\x5c\xa8\x4f\x6c\x9c\x8e\x38\x53\xe2\xfd\x7a\x70\xae\x0f\xb2\x0f\xa1\x52\x60\x0c\xb0\x08\x45\x17\x4f\x08\x07\x6f\x8d\x78\x43";
const char private_b[] = "\xb0\x80\x73\xe8\xd4\x4e\x91\xe3\xda\x92\x2c\x22\x43\x82\x44\xbb\x88\x5c\x69\xe2\x69\xc8\xe9\xd8\x35\xb1\x14\x29\x3a\x4d\xdc\x6e";
const char private_c[] = "\xa0\xcb\x87\x9a\x47\xf5\xbc\x64\x4c\x0e\x69\x3f\xa6\xd0\x31\xc7\x4a\x15\x53\xb6\xe9\x01\xb9\xff\x2f\x51\x8c\x78\x04\x2f\xb5\x42";
const char public_a[] = "\x97\x5c\x9d\x81\xc9\x83\xc8\x20\x9e\xe7\x81\x25\x4b\x89\x9f\x8e\xd9\x25\xae\x9f\x09\x23\xc2\x3c\x62\xf5\x3c\x57\xcd\xbf\x69\x1c";
const char public_b[] = "\xd1\x73\x28\x99\xf6\x11\xcd\x89\x94\x03\x4d\x7f\x41\x3d\xc9\x57\x63\x0e\x54\x93\xc2\x85\xac\xa4\x00\x65\xcb\x63\x11\xbe\x69\x6b";
const char public_c[] = "\xf4\x4d\xa3\x67\xa8\x8e\xe6\x56\x4f\x02\x02\x11\x45\x67\x27\x08\x2f\x5c\xeb\xee\x8b\x1b\xf5\xeb\x73\x37\x34\x1b\x45\x9b\x39\x22";
const uint16_t listen_a = 20001;
const uint16_t listen_b = 20002;
const uint16_t listen_c = 20003;
const uint16_t af_inet = AF_INET;
const uint16_t af_inet6 = AF_INET6;
const struct sockaddr_in endpoint_b_v4 = {
.sin_family = AF_INET,
.sin_port = htons(listen_b),
.sin_addr = {htonl(INADDR_LOOPBACK)}};
const struct sockaddr_in endpoint_c_v4 = {
.sin_family = AF_INET,
.sin_port = htons(listen_c),
.sin_addr = {htonl(INADDR_LOOPBACK)}};
struct sockaddr_in6 endpoint_a_v6 = {
.sin6_family = AF_INET6,
.sin6_port = htons(listen_a)};
endpoint_a_v6.sin6_addr = in6addr_loopback;
struct sockaddr_in6 endpoint_c_v6 = {
.sin6_family = AF_INET6,
.sin6_port = htons(listen_c)};
endpoint_c_v6.sin6_addr = in6addr_loopback;
const struct in_addr first_half_v4 = {0};
const struct in_addr second_half_v4 = {(uint32_t)htonl(128 << 24)};
const struct in6_addr first_half_v6 = {{{0}}};
const struct in6_addr second_half_v6 = {{{0x80}}};
const uint8_t half_cidr = 1;
const uint16_t persistent_keepalives[] = {1, 3, 7, 9, 14, 19};
struct genlmsghdr genlhdr = {
.cmd = WG_CMD_SET_DEVICE,
.version = 1};
int sock;
int id, err;
sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock == -1) {
return;
}
id = netlink_query_family_id(&nlmsg, sock, WG_GENL_NAME, true);
if (id == -1)
goto error;
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_a, strlen(ifname_a) + 1);
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_a, 32);
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_a, 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[0], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v6, sizeof(endpoint_c_v6));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[1], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
err = netlink_send(&nlmsg, sock);
if (err < 0) {
}
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_b, strlen(ifname_b) + 1);
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_b, 32);
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_b, 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[2], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v4, sizeof(endpoint_c_v4));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[3], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
err = netlink_send(&nlmsg, sock);
if (err < 0) {
}
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_c, strlen(ifname_c) + 1);
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_c, 32);
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_c, 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[4], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32);
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4));
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[5], 2);
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_nest(&nlmsg, NLA_F_NESTED | 0);
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2);
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6));
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
netlink_done(&nlmsg);
err = netlink_send(&nlmsg, sock);
if (err < 0) {
}
error:
close(sock);
}
static void initialize_netdevices(void)
{
char netdevsim[16];
sprintf(netdevsim, "netdevsim%d", (int)procid);
struct {
const char* type;
const char* dev;
} devtypes[] = {
{"ip6gretap", "ip6gretap0"},
{"bridge", "bridge0"},
{"vcan", "vcan0"},
{"bond", "bond0"},
{"team", "team0"},
{"dummy", "dummy0"},
{"nlmon", "nlmon0"},
{"caif", "caif0"},
{"batadv", "batadv0"},
{"vxcan", "vxcan1"},
{"veth", 0},
{"wireguard", "wg0"},
{"wireguard", "wg1"},
{"wireguard", "wg2"},
};
const char* devmasters[] = {"bridge", "bond", "team", "batadv"};
struct {
const char* name;
int macsize;
bool noipv6;
} devices[] = {
{"lo", ETH_ALEN},
{"sit0", 0},
{"bridge0", ETH_ALEN},
{"vcan0", 0, true},
{"tunl0", 0},
{"gre0", 0},
{"gretap0", ETH_ALEN},
{"ip_vti0", 0},
{"ip6_vti0", 0},
{"ip6tnl0", 0},
{"ip6gre0", 0},
{"ip6gretap0", ETH_ALEN},
{"erspan0", ETH_ALEN},
{"bond0", ETH_ALEN},
{"veth0", ETH_ALEN},
{"veth1", ETH_ALEN},
{"team0", ETH_ALEN},
{"veth0_to_bridge", ETH_ALEN},
{"veth1_to_bridge", ETH_ALEN},
{"veth0_to_bond", ETH_ALEN},
{"veth1_to_bond", ETH_ALEN},
{"veth0_to_team", ETH_ALEN},
{"veth1_to_team", ETH_ALEN},
{"veth0_to_hsr", ETH_ALEN},
{"veth1_to_hsr", ETH_ALEN},
{"hsr0", 0},
{"dummy0", ETH_ALEN},
{"nlmon0", 0},
{"vxcan0", 0, true},
{"vxcan1", 0, true},
{"caif0", ETH_ALEN},
{"batadv0", ETH_ALEN},
{netdevsim, ETH_ALEN},
{"xfrm0", ETH_ALEN},
{"veth0_virt_wifi", ETH_ALEN},
{"veth1_virt_wifi", ETH_ALEN},
{"virt_wifi0", ETH_ALEN},
{"veth0_vlan", ETH_ALEN},
{"veth1_vlan", ETH_ALEN},
{"vlan0", ETH_ALEN},
{"vlan1", ETH_ALEN},
{"macvlan0", ETH_ALEN},
{"macvlan1", ETH_ALEN},
{"ipvlan0", ETH_ALEN},
{"ipvlan1", ETH_ALEN},
{"veth0_macvtap", ETH_ALEN},
{"veth1_macvtap", ETH_ALEN},
{"macvtap0", ETH_ALEN},
{"macsec0", ETH_ALEN},
{"veth0_to_batadv", ETH_ALEN},
{"veth1_to_batadv", ETH_ALEN},
{"batadv_slave_0", ETH_ALEN},
{"batadv_slave_1", ETH_ALEN},
{"geneve0", ETH_ALEN},
{"geneve1", ETH_ALEN},
{"wg0", 0},
{"wg1", 0},
{"wg2", 0},
};
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
unsigned i;
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++)
netlink_add_device(&nlmsg, sock, devtypes[i].type, devtypes[i].dev);
for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) {
char master[32], slave0[32], veth0[32], slave1[32], veth1[32];
sprintf(slave0, "%s_slave_0", devmasters[i]);
sprintf(veth0, "veth0_to_%s", devmasters[i]);
netlink_add_veth(&nlmsg, sock, slave0, veth0);
sprintf(slave1, "%s_slave_1", devmasters[i]);
sprintf(veth1, "veth1_to_%s", devmasters[i]);
netlink_add_veth(&nlmsg, sock, slave1, veth1);
sprintf(master, "%s0", devmasters[i]);
netlink_device_change(&nlmsg, sock, slave0, false, master, 0, 0, NULL);
netlink_device_change(&nlmsg, sock, slave1, false, master, 0, 0, NULL);
}
netlink_add_xfrm(&nlmsg, sock, "xfrm0");
netlink_device_change(&nlmsg, sock, "bridge_slave_0", true, 0, 0, 0, NULL);
netlink_device_change(&nlmsg, sock, "bridge_slave_1", true, 0, 0, 0, NULL);
netlink_add_veth(&nlmsg, sock, "hsr_slave_0", "veth0_to_hsr");
netlink_add_veth(&nlmsg, sock, "hsr_slave_1", "veth1_to_hsr");
netlink_add_hsr(&nlmsg, sock, "hsr0", "hsr_slave_0", "hsr_slave_1");
netlink_device_change(&nlmsg, sock, "hsr_slave_0", true, 0, 0, 0, NULL);
netlink_device_change(&nlmsg, sock, "hsr_slave_1", true, 0, 0, 0, NULL);
netlink_add_veth(&nlmsg, sock, "veth0_virt_wifi", "veth1_virt_wifi");
netlink_add_linked(&nlmsg, sock, "virt_wifi", "virt_wifi0", "veth1_virt_wifi");
netlink_add_veth(&nlmsg, sock, "veth0_vlan", "veth1_vlan");
netlink_add_vlan(&nlmsg, sock, "vlan0", "veth0_vlan", 0, htons(ETH_P_8021Q));
netlink_add_vlan(&nlmsg, sock, "vlan1", "veth0_vlan", 1, htons(ETH_P_8021AD));
netlink_add_macvlan(&nlmsg, sock, "macvlan0", "veth1_vlan");
netlink_add_macvlan(&nlmsg, sock, "macvlan1", "veth1_vlan");
netlink_add_ipvlan(&nlmsg, sock, "ipvlan0", "veth0_vlan", IPVLAN_MODE_L2, 0);
netlink_add_ipvlan(&nlmsg, sock, "ipvlan1", "veth0_vlan", IPVLAN_MODE_L3S, IPVLAN_F_VEPA);
netlink_add_veth(&nlmsg, sock, "veth0_macvtap", "veth1_macvtap");
netlink_add_linked(&nlmsg, sock, "macvtap", "macvtap0", "veth0_macvtap");
netlink_add_linked(&nlmsg, sock, "macsec", "macsec0", "veth1_macvtap");
char addr[32];
sprintf(addr, DEV_IPV4, 14 + 10);
struct in_addr geneve_addr4;
if (inet_pton(AF_INET, addr, &geneve_addr4) <= 0)
exit(1);
struct in6_addr geneve_addr6;
if (inet_pton(AF_INET6, "fc00::01", &geneve_addr6) <= 0)
exit(1);
netlink_add_geneve(&nlmsg, sock, "geneve0", 0, &geneve_addr4, 0);
netlink_add_geneve(&nlmsg, sock, "geneve1", 1, 0, &geneve_addr6);
netdevsim_add((int)procid, 4);
netlink_wireguard_setup();
for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) {
char addr[32];
sprintf(addr, DEV_IPV4, i + 10);
netlink_add_addr4(&nlmsg, sock, devices[i].name, addr);
if (!devices[i].noipv6) {
sprintf(addr, DEV_IPV6, i + 10);
netlink_add_addr6(&nlmsg, sock, devices[i].name, addr);
}
uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40);
netlink_device_change(&nlmsg, sock, devices[i].name, true, 0, &macaddr, devices[i].macsize, NULL);
}
close(sock);
}
static void initialize_netdevices_init(void)
{
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock == -1)
exit(1);
struct {
const char* type;
int macsize;
bool noipv6;
bool noup;
} devtypes[] = {
{"nr", 7, true},
{"rose", 5, true, true},
};
unsigned i;
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) {
char dev[32], addr[32];
sprintf(dev, "%s%d", devtypes[i].type, (int)procid);
sprintf(addr, "172.30.%d.%d", i, (int)procid + 1);
netlink_add_addr4(&nlmsg, sock, dev, addr);
if (!devtypes[i].noipv6) {
sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1);
netlink_add_addr6(&nlmsg, sock, dev, addr);
}
int macsize = devtypes[i].macsize;
uint64_t macaddr = 0xbbbbbb + ((unsigned long long)i << (8 * (macsize - 2))) +
(procid << (8 * (macsize - 1)));
netlink_device_change(&nlmsg, sock, dev, !devtypes[i].noup, 0, &macaddr, macsize, NULL);
}
close(sock);
}
static int read_tun(char* data, int size)
{
if (tunfd < 0)
return -1;
int rv = read(tunfd, data, size);
if (rv < 0) {
if (errno == EAGAIN || errno == EBADFD)
return -1;
exit(1);
}
return rv;
}
static void flush_tun()
{
char data[1000];
while (read_tun(&data[0], sizeof(data)) != -1) {
}
}
#define MAX_FDS 30
#define BTPROTO_HCI 1
#define ACL_LINK 1
#define SCAN_PAGE 2
typedef struct {
uint8_t b[6];
} __attribute__((packed)) bdaddr_t;
#define HCI_COMMAND_PKT 1
#define HCI_EVENT_PKT 4
#define HCI_VENDOR_PKT 0xff
struct hci_command_hdr {
uint16_t opcode;
uint8_t plen;
} __attribute__((packed));
struct hci_event_hdr {
uint8_t evt;
uint8_t plen;
} __attribute__((packed));
#define HCI_EV_CONN_COMPLETE 0x03
struct hci_ev_conn_complete {
uint8_t status;
uint16_t handle;
bdaddr_t bdaddr;
uint8_t link_type;
uint8_t encr_mode;
} __attribute__((packed));
#define HCI_EV_CONN_REQUEST 0x04
struct hci_ev_conn_request {
bdaddr_t bdaddr;
uint8_t dev_class[3];
uint8_t link_type;
} __attribute__((packed));
#define HCI_EV_REMOTE_FEATURES 0x0b
struct hci_ev_remote_features {
uint8_t status;
uint16_t handle;
uint8_t features[8];
} __attribute__((packed));
#define HCI_EV_CMD_COMPLETE 0x0e
struct hci_ev_cmd_complete {
uint8_t ncmd;
uint16_t opcode;
} __attribute__((packed));
#define HCI_OP_WRITE_SCAN_ENABLE 0x0c1a
#define HCI_OP_READ_BUFFER_SIZE 0x1005
struct hci_rp_read_buffer_size {
uint8_t status;
uint16_t acl_mtu;
uint8_t sco_mtu;
uint16_t acl_max_pkt;
uint16_t sco_max_pkt;
} __attribute__((packed));
#define HCI_OP_READ_BD_ADDR 0x1009
struct hci_rp_read_bd_addr {
uint8_t status;
bdaddr_t bdaddr;
} __attribute__((packed));
#define HCI_EV_LE_META 0x3e
struct hci_ev_le_meta {
uint8_t subevent;
} __attribute__((packed));
#define HCI_EV_LE_CONN_COMPLETE 0x01
struct hci_ev_le_conn_complete {
uint8_t status;
uint16_t handle;
uint8_t role;
uint8_t bdaddr_type;
bdaddr_t bdaddr;
uint16_t interval;
uint16_t latency;
uint16_t supervision_timeout;
uint8_t clk_accurancy;
} __attribute__((packed));
struct hci_dev_req {
uint16_t dev_id;
uint32_t dev_opt;
};
struct vhci_vendor_pkt_request {
uint8_t type;
uint8_t opcode;
} __attribute__((packed));
struct vhci_pkt {
uint8_t type;
union {
struct {
uint8_t opcode;
uint16_t id;
} __attribute__((packed)) vendor_pkt;
struct hci_command_hdr command_hdr;
};
} __attribute__((packed));
#define HCIDEVUP _IOW('H', 201, int)
#define HCISETSCAN _IOW('H', 221, int)
static int vhci_fd = -1;
static void rfkill_unblock_all()
{
int fd = open("/dev/rfkill", O_WRONLY);
if (fd < 0)
exit(1);
struct rfkill_event event = {0};
event.idx = 0;
event.type = RFKILL_TYPE_ALL;
event.op = RFKILL_OP_CHANGE_ALL;
event.soft = 0;
event.hard = 0;
if (write(fd, &event, sizeof(event)) < 0)
exit(1);
close(fd);
}
static void hci_send_event_packet(int fd, uint8_t evt, void* data, size_t data_len)
{
struct iovec iv[3];
struct hci_event_hdr hdr;
hdr.evt = evt;
hdr.plen = data_len;
uint8_t type = HCI_EVENT_PKT;
iv[0].iov_base = &type;
iv[0].iov_len = sizeof(type);
iv[1].iov_base = &hdr;
iv[1].iov_len = sizeof(hdr);
iv[2].iov_base = data;
iv[2].iov_len = data_len;
if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0)
exit(1);
}
static void hci_send_event_cmd_complete(int fd, uint16_t opcode, void* data, size_t data_len)
{
struct iovec iv[4];
struct hci_event_hdr hdr;
hdr.evt = HCI_EV_CMD_COMPLETE;
hdr.plen = sizeof(struct hci_ev_cmd_complete) + data_len;
struct hci_ev_cmd_complete evt_hdr;
evt_hdr.ncmd = 1;
evt_hdr.opcode = opcode;
uint8_t type = HCI_EVENT_PKT;
iv[0].iov_base = &type;
iv[0].iov_len = sizeof(type);
iv[1].iov_base = &hdr;
iv[1].iov_len = sizeof(hdr);
iv[2].iov_base = &evt_hdr;
iv[2].iov_len = sizeof(evt_hdr);
iv[3].iov_base = data;
iv[3].iov_len = data_len;
if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0)
exit(1);
}
static bool process_command_pkt(int fd, char* buf, ssize_t buf_size)
{
struct hci_command_hdr* hdr = (struct hci_command_hdr*)buf;
if (buf_size < (ssize_t)sizeof(struct hci_command_hdr) ||
hdr->plen != buf_size - sizeof(struct hci_command_hdr))
exit(1);
switch (hdr->opcode) {
case HCI_OP_WRITE_SCAN_ENABLE: {
uint8_t status = 0;
hci_send_event_cmd_complete(fd, hdr->opcode, &status, sizeof(status));
return true;
}
case HCI_OP_READ_BD_ADDR: {
struct hci_rp_read_bd_addr rp = {0};
rp.status = 0;
memset(&rp.bdaddr, 0xaa, 6);
hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp));
return false;
}
case HCI_OP_READ_BUFFER_SIZE: {
struct hci_rp_read_buffer_size rp = {0};
rp.status = 0;
rp.acl_mtu = 1021;
rp.sco_mtu = 96;
rp.acl_max_pkt = 4;
rp.sco_max_pkt = 6;
hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp));
return false;
}
}
char dummy[0xf9] = {0};
hci_send_event_cmd_complete(fd, hdr->opcode, dummy, sizeof(dummy));
return false;
}
static void* event_thread(void* arg)
{
while (1) {
char buf[1024] = {0};
ssize_t buf_size = read(vhci_fd, buf, sizeof(buf));
if (buf_size < 0)
exit(1);
if (buf_size > 0 && buf[0] == HCI_COMMAND_PKT) {
if (process_command_pkt(vhci_fd, buf + 1, buf_size - 1))
break;
}
}
return NULL;
}
#define HCI_HANDLE_1 200
#define HCI_HANDLE_2 201
#define HCI_PRIMARY 0
#define HCI_OP_RESET 0x0c03
static void initialize_vhci()
{
int hci_sock = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
if (hci_sock < 0)
exit(1);
vhci_fd = open("/dev/vhci", O_RDWR);
if (vhci_fd == -1)
exit(1);
const int kVhciFd = 202;
if (dup2(vhci_fd, kVhciFd) < 0)
exit(1);
close(vhci_fd);
vhci_fd = kVhciFd;
struct vhci_vendor_pkt_request vendor_pkt_req = {HCI_VENDOR_PKT, HCI_PRIMARY};
if (write(vhci_fd, &vendor_pkt_req, sizeof(vendor_pkt_req)) != sizeof(vendor_pkt_req))
exit(1);
struct vhci_pkt vhci_pkt;
if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt))
exit(1);
if (vhci_pkt.type == HCI_COMMAND_PKT && vhci_pkt.command_hdr.opcode == HCI_OP_RESET) {
char response[1] = {0};
hci_send_event_cmd_complete(vhci_fd, HCI_OP_RESET, response, sizeof(response));
if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt))
exit(1);
}
if (vhci_pkt.type != HCI_VENDOR_PKT)
exit(1);
int dev_id = vhci_pkt.vendor_pkt.id;
pthread_t th;
if (pthread_create(&th, NULL, event_thread, NULL))
exit(1);
int ret = ioctl(hci_sock, HCIDEVUP, dev_id);
if (ret) {
if (errno == ERFKILL) {
rfkill_unblock_all();
ret = ioctl(hci_sock, HCIDEVUP, dev_id);
}
if (ret && errno != EALREADY)
exit(1);
}
struct hci_dev_req dr = {0};
dr.dev_id = dev_id;
dr.dev_opt = SCAN_PAGE;
if (ioctl(hci_sock, HCISETSCAN, &dr))
exit(1);
struct hci_ev_conn_request request;
memset(&request, 0, sizeof(request));
memset(&request.bdaddr, 0xaa, 6);
*(uint8_t*)&request.bdaddr.b[5] = 0x10;
request.link_type = ACL_LINK;
hci_send_event_packet(vhci_fd, HCI_EV_CONN_REQUEST, &request, sizeof(request));
struct hci_ev_conn_complete complete;
memset(&complete, 0, sizeof(complete));
complete.status = 0;
complete.handle = HCI_HANDLE_1;
memset(&complete.bdaddr, 0xaa, 6);
*(uint8_t*)&complete.bdaddr.b[5] = 0x10;
complete.link_type = ACL_LINK;
complete.encr_mode = 0;
hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete, sizeof(complete));
struct hci_ev_remote_features features;
memset(&features, 0, sizeof(features));
features.status = 0;
features.handle = HCI_HANDLE_1;
hci_send_event_packet(vhci_fd, HCI_EV_REMOTE_FEATURES, &features, sizeof(features));
struct {
struct hci_ev_le_meta le_meta;
struct hci_ev_le_conn_complete le_conn;
} le_conn;
memset(&le_conn, 0, sizeof(le_conn));
le_conn.le_meta.subevent = HCI_EV_LE_CONN_COMPLETE;
memset(&le_conn.le_conn.bdaddr, 0xaa, 6);
*(uint8_t*)&le_conn.le_conn.bdaddr.b[5] = 0x11;
le_conn.le_conn.role = 1;
le_conn.le_conn.handle = HCI_HANDLE_2;
hci_send_event_packet(vhci_fd, HCI_EV_LE_META, &le_conn, sizeof(le_conn));
pthread_join(th, NULL);
close(hci_sock);
}
//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:
//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty. In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//% claim that you wrote the original software. If you use this software
//% in a product, an acknowledgment in the product documentation would be
//% appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//% misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler madler@alumni.caltech.edu
//% BEGIN CODE DERIVED FROM puff.{c,h}
#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288
struct puff_state {
unsigned char* out;
unsigned long outlen;
unsigned long outcnt;
const unsigned char* in;
unsigned long inlen;
unsigned long incnt;
int bitbuf;
int bitcnt;
jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
long val = s->bitbuf;
while (s->bitcnt < need) {
if (s->incnt == s->inlen)
longjmp(s->env, 1);
val |= (long)(s->in[s->incnt++]) << s->bitcnt;
s->bitcnt += 8;
}
s->bitbuf = (int)(val >> need);
s->bitcnt -= need;
return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
s->bitbuf = 0;
s->bitcnt = 0;
if (s->incnt + 4 > s->inlen)
return 2;
unsigned len = s->in[s->incnt++];
len |= s->in[s->incnt++] << 8;
if (s->in[s->incnt++] != (~len & 0xff) ||
s->in[s->incnt++] != ((~len >> 8) & 0xff))
return -2;
if (s->incnt + len > s->inlen)
return 2;
if (s->outcnt + len > s->outlen)
return 1;
for (; len--; s->outcnt++, s->incnt++) {
if (s->in[s->incnt])
s->out[s->outcnt] = s->in[s->incnt];
}
return 0;
}
struct puff_huffman {
short* count;
short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
int first = 0;
int index = 0;
int bitbuf = s->bitbuf;
int left = s->bitcnt;
int code = first = index = 0;
int len = 1;
short* next = h->count + 1;
while (1) {
while (left--) {
code |= bitbuf & 1;
bitbuf >>= 1;
int count = *next++;
if (code - count < first) {
s->bitbuf = bitbuf;
s->bitcnt = (s->bitcnt - len) & 7;
return h->symbol[index + (code - first)];
}
index += count;
first += count;
first <<= 1;
code <<= 1;
len++;
}
left = (MAXBITS + 1) - len;
if (left == 0)
break;
if (s->incnt == s->inlen)
longjmp(s->env, 1);
bitbuf = s->in[s->incnt++];
if (left > 8)
left = 8;
}
return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
int len;
for (len = 0; len <= MAXBITS; len++)
h->count[len] = 0;
int symbol;
for (symbol = 0; symbol < n; symbol++)
(h->count[length[symbol]])++;
if (h->count[0] == n)
return 0;
int left = 1;
for (len = 1; len <= MAXBITS; len++) {
left <<= 1;
left -= h->count[len];
if (left < 0)
return left;
}
short offs[MAXBITS + 1];
offs[1] = 0;
for (len = 1; len < MAXBITS; len++)
offs[len + 1] = offs[len] + h->count[len];
for (symbol = 0; symbol < n; symbol++)
if (length[symbol] != 0)
h->symbol[offs[length[symbol]]++] = symbol;
return left;
}
static int puff_codes(struct puff_state* s,
const struct puff_huffman* lencode,
const struct puff_huffman* distcode)
{
static const short lens[29] = {
3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
static const short lext[29] = {
0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
static const short dists[30] = {
1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
8193, 12289, 16385, 24577};
static const short dext[30] = {
0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
12, 12, 13, 13};
int symbol;
do {
symbol = puff_decode(s, lencode);
if (symbol < 0)
return symbol;
if (symbol < 256) {
if (s->outcnt == s->outlen)
return 1;
if (symbol)
s->out[s->outcnt] = symbol;
s->outcnt++;
} else if (symbol > 256) {
symbol -= 257;
if (symbol >= 29)
return -10;
int len = lens[symbol] + puff_bits(s, lext[symbol]);
symbol = puff_decode(s, distcode);
if (symbol < 0)
return symbol;
unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
if (dist > s->outcnt)
return -11;
if (s->outcnt + len > s->outlen)
return 1;
while (len--) {
if (dist <= s->outcnt && s->out[s->outcnt - dist])
s->out[s->outcnt] = s->out[s->outcnt - dist];
s->outcnt++;
}
}
} while (symbol != 256);
return 0;
}
static int puff_fixed(struct puff_state* s)
{
static int virgin = 1;
static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
static struct puff_huffman lencode, distcode;
if (virgin) {
lencode.count = lencnt;
lencode.symbol = lensym;
distcode.count = distcnt;
distcode.symbol = distsym;
short lengths[FIXLCODES];
int symbol;
for (symbol = 0; symbol < 144; symbol++)
lengths[symbol] = 8;
for (; symbol < 256; symbol++)
lengths[symbol] = 9;
for (; symbol < 280; symbol++)
lengths[symbol] = 7;
for (; symbol < FIXLCODES; symbol++)
lengths[symbol] = 8;
puff_construct(&lencode, lengths, FIXLCODES);
for (symbol = 0; symbol < MAXDCODES; symbol++)
lengths[symbol] = 5;
puff_construct(&distcode, lengths, MAXDCODES);
virgin = 0;
}
return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
static const short order[19] =
{16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
int nlen = puff_bits(s, 5) + 257;
int ndist = puff_bits(s, 5) + 1;
int ncode = puff_bits(s, 4) + 4;
if (nlen > MAXLCODES || ndist > MAXDCODES)
return -3;
short lengths[MAXCODES];
int index;
for (index = 0; index < ncode; index++)
lengths[order[index]] = puff_bits(s, 3);
for (; index < 19; index++)
lengths[order[index]] = 0;
short lencnt[MAXBITS + 1], lensym[MAXLCODES];
struct puff_huffman lencode = {lencnt, lensym};
int err = puff_construct(&lencode, lengths, 19);
if (err != 0)
return -4;
index = 0;
while (index < nlen + ndist) {
int symbol;
int len;
symbol = puff_decode(s, &lencode);
if (symbol < 0)
return symbol;
if (symbol < 16)
lengths[index++] = symbol;
else {
len = 0;
if (symbol == 16) {
if (index == 0)
return -5;
len = lengths[index - 1];
symbol = 3 + puff_bits(s, 2);
} else if (symbol == 17)
symbol = 3 + puff_bits(s, 3);
else
symbol = 11 + puff_bits(s, 7);
if (index + symbol > nlen + ndist)
return -6;
while (symbol--)
lengths[index++] = len;
}
}
if (lengths[256] == 0)
return -9;
err = puff_construct(&lencode, lengths, nlen);
if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
return -7;
short distcnt[MAXBITS + 1], distsym[MAXDCODES];
struct puff_huffman distcode = {distcnt, distsym};
err = puff_construct(&distcode, lengths + nlen, ndist);
if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
return -8;
return puff_codes(s, &lencode, &distcode);
}
static int puff(
unsigned char* dest,
unsigned long* destlen,
const unsigned char* source,
unsigned long sourcelen)
{
struct puff_state s = {
.out = dest,
.outlen = *destlen,
.outcnt = 0,
.in = source,
.inlen = sourcelen,
.incnt = 0,
.bitbuf = 0,
.bitcnt = 0,
};
int err;
if (setjmp(s.env) != 0)
err = 2;
else {
int last;
do {
last = puff_bits(&s, 1);
int type = puff_bits(&s, 2);
err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
if (err != 0)
break;
} while (!last);
}
*destlen = s.outcnt;
return err;
}
//% END CODE DERIVED FROM puff.{c,h}
#define ZLIB_HEADER_WIDTH 2
static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
if (sourcelen < ZLIB_HEADER_WIDTH)
return 0;
source += ZLIB_HEADER_WIDTH;
sourcelen -= ZLIB_HEADER_WIDTH;
const unsigned long max_destlen = 132 << 20;
void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
if (ret == MAP_FAILED)
return -1;
unsigned char* dest = (unsigned char*)ret;
unsigned long destlen = max_destlen;
int err = puff(dest, &destlen, source, sourcelen);
if (err) {
munmap(dest, max_destlen);
errno = -err;
return -1;
}
if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
munmap(dest, max_destlen);
return -1;
}
return munmap(dest, max_destlen);
}
static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
int err = 0, loopfd = -1;
int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
if (memfd == -1) {
err = errno;
goto error;
}
if (puff_zlib_to_file(data, size, memfd)) {
err = errno;
goto error_close_memfd;
}
loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
err = errno;
goto error_close_memfd;
}
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
if (errno != EBUSY) {
err = errno;
goto error_close_loop;
}
ioctl(loopfd, LOOP_CLR_FD, 0);
usleep(1000);
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
err = errno;
goto error_close_loop;
}
}
close(memfd);
*loopfd_p = loopfd;
return 0;
error_close_loop:
close(loopfd);
error_close_memfd:
close(memfd);
error:
errno = err;
return -1;
}
static long syz_mount_image(
volatile long fsarg,
volatile long dir,
volatile long flags,
volatile long optsarg,
volatile long change_dir,
volatile unsigned long size,
volatile long image)
{
unsigned char* data = (unsigned char*)image;
int res = -1, err = 0, loopfd = -1, need_loop_device = !!size;
char* mount_opts = (char*)optsarg;
char* target = (char*)dir;
char* fs = (char*)fsarg;
char* source = NULL;
char loopname[64];
if (need_loop_device) {
memset(loopname, 0, sizeof(loopname));
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
if (setup_loop_device(data, size, loopname, &loopfd) == -1)
return -1;
source = loopname;
}
mkdir(target, 0777);
char opts[256];
memset(opts, 0, sizeof(opts));
if (strlen(mount_opts) > (sizeof(opts) - 32)) {
}
strncpy(opts, mount_opts, sizeof(opts) - 32);
if (strcmp(fs, "iso9660") == 0) {
flags |= MS_RDONLY;
} else if (strncmp(fs, "ext", 3) == 0) {
bool has_remount_ro = false;
char* remount_ro_start = strstr(opts, "errors=remount-ro");
if (remount_ro_start != NULL) {
char after = *(remount_ro_start + strlen("errors=remount-ro"));
char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
}
if (strstr(opts, "errors=panic") || !has_remount_ro)
strcat(opts, ",errors=continue");
} else if (strcmp(fs, "xfs") == 0) {
strcat(opts, ",nouuid");
}
res = mount(source, target, fs, flags, opts);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
res = open(target, O_RDONLY | O_DIRECTORY);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
if (change_dir) {
res = chdir(target);
if (res == -1) {
err = errno;
}
}
error_clear_loop:
if (need_loop_device) {
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd);
}
errno = err;
return res;
}
#define XT_TABLE_SIZE 1536
#define XT_MAX_ENTRIES 10
struct xt_counters {
uint64_t pcnt, bcnt;
};
struct ipt_getinfo {
char name[32];
unsigned int valid_hooks;
unsigned int hook_entry[5];
unsigned int underflow[5];
unsigned int num_entries;
unsigned int size;
};
struct ipt_get_entries {
char name[32];
unsigned int size;
uint64_t entrytable[XT_TABLE_SIZE / sizeof(uint64_t)];
};
struct ipt_replace {
char name[32];
unsigned int valid_hooks;
unsigned int num_entries;
unsigned int size;
unsigned int hook_entry[5];
unsigned int underflow[5];
unsigned int num_counters;
struct xt_counters* counters;
uint64_t entrytable[XT_TABLE_SIZE / sizeof(uint64_t)];
};
struct ipt_table_desc {
const char* name;
struct ipt_getinfo info;
struct ipt_replace replace;
};
static struct ipt_table_desc ipv4_tables[] = {
{.name = "filter"},
{.name = "nat"},
{.name = "mangle"},
{.name = "raw"},
{.name = "security"},
};
static struct ipt_table_desc ipv6_tables[] = {
{.name = "filter"},
{.name = "nat"},
{.name = "mangle"},
{.name = "raw"},
{.name = "security"},
};
#define IPT_BASE_CTL 64
#define IPT_SO_SET_REPLACE (IPT_BASE_CTL)
#define IPT_SO_GET_INFO (IPT_BASE_CTL)
#define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1)
struct arpt_getinfo {
char name[32];
unsigned int valid_hooks;
unsigned int hook_entry[3];
unsigned int underflow[3];
unsigned int num_entries;
unsigned int size;
};
struct arpt_get_entries {
char name[32];
unsigned int size;
uint64_t entrytable[XT_TABLE_SIZE / sizeof(uint64_t)];
};
struct arpt_replace {
char name[32];
unsigned int valid_hooks;
unsigned int num_entries;
unsigned int size;
unsigned int hook_entry[3];
unsigned int underflow[3];
unsigned int num_counters;
struct xt_counters* counters;
uint64_t entrytable[XT_TABLE_SIZE / sizeof(uint64_t)];
};
struct arpt_table_desc {
const char* name;
struct arpt_getinfo info;
struct arpt_replace replace;
};
static struct arpt_table_desc arpt_tables[] = {
{.name = "filter"},
};
#define ARPT_BASE_CTL 96
#define ARPT_SO_SET_REPLACE (ARPT_BASE_CTL)
#define ARPT_SO_GET_INFO (ARPT_BASE_CTL)
#define ARPT_SO_GET_ENTRIES (ARPT_BASE_CTL + 1)
static void checkpoint_iptables(struct ipt_table_desc* tables, int num_tables, int family, int level)
{
int fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (int i = 0; i < num_tables; i++) {
struct ipt_table_desc* table = &tables[i];
strcpy(table->info.name, table->name);
strcpy(table->replace.name, table->name);
socklen_t optlen = sizeof(table->info);
if (getsockopt(fd, level, IPT_SO_GET_INFO, &table->info, &optlen)) {
switch (errno) {
case EPERM:
case ENOENT:
case ENOPROTOOPT:
continue;
}
exit(1);
}
if (table->info.size > sizeof(table->replace.entrytable))
exit(1);
if (table->info.num_entries > XT_MAX_ENTRIES)
exit(1);
struct ipt_get_entries entries;
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
table->replace.valid_hooks = table->info.valid_hooks;
table->replace.num_entries = table->info.num_entries;
table->replace.size = table->info.size;
memcpy(table->replace.hook_entry, table->info.hook_entry, sizeof(table->replace.hook_entry));
memcpy(table->replace.underflow, table->info.underflow, sizeof(table->replace.underflow));
memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
}
close(fd);
}
static void reset_iptables(struct ipt_table_desc* tables, int num_tables, int family, int level)
{
int fd = socket(family, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (int i = 0; i < num_tables; i++) {
struct ipt_table_desc* table = &tables[i];
if (table->info.valid_hooks == 0)
continue;
struct ipt_getinfo info;
memset(&info, 0, sizeof(info));
strcpy(info.name, table->name);
socklen_t optlen = sizeof(info);
if (getsockopt(fd, level, IPT_SO_GET_INFO, &info, &optlen))
exit(1);
if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
struct ipt_get_entries entries;
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
if (getsockopt(fd, level, IPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
if (memcmp(table->replace.entrytable, entries.entrytable, table->info.size) == 0)
continue;
}
struct xt_counters counters[XT_MAX_ENTRIES];
table->replace.num_counters = info.num_entries;
table->replace.counters = counters;
optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) + table->replace.size;
if (setsockopt(fd, level, IPT_SO_SET_REPLACE, &table->replace, optlen))
exit(1);
}
close(fd);
}
static void checkpoint_arptables(void)
{
int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (unsigned i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
struct arpt_table_desc* table = &arpt_tables[i];
strcpy(table->info.name, table->name);
strcpy(table->replace.name, table->name);
socklen_t optlen = sizeof(table->info);
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &table->info, &optlen)) {
switch (errno) {
case EPERM:
case ENOENT:
case ENOPROTOOPT:
continue;
}
exit(1);
}
if (table->info.size > sizeof(table->replace.entrytable))
exit(1);
if (table->info.num_entries > XT_MAX_ENTRIES)
exit(1);
struct arpt_get_entries entries;
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + table->info.size;
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
table->replace.valid_hooks = table->info.valid_hooks;
table->replace.num_entries = table->info.num_entries;
table->replace.size = table->info.size;
memcpy(table->replace.hook_entry, table->info.hook_entry, sizeof(table->replace.hook_entry));
memcpy(table->replace.underflow, table->info.underflow, sizeof(table->replace.underflow));
memcpy(table->replace.entrytable, entries.entrytable, table->info.size);
}
close(fd);
}
static void reset_arptables()
{
int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (unsigned i = 0; i < sizeof(arpt_tables) / sizeof(arpt_tables[0]); i++) {
struct arpt_table_desc* table = &arpt_tables[i];
if (table->info.valid_hooks == 0)
continue;
struct arpt_getinfo info;
memset(&info, 0, sizeof(info));
strcpy(info.name, table->name);
socklen_t optlen = sizeof(info);
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_INFO, &info, &optlen))
exit(1);
if (memcmp(&table->info, &info, sizeof(table->info)) == 0) {
struct arpt_get_entries entries;
memset(&entries, 0, sizeof(entries));
strcpy(entries.name, table->name);
entries.size = table->info.size;
optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size;
if (getsockopt(fd, SOL_IP, ARPT_SO_GET_ENTRIES, &entries, &optlen))
exit(1);
if (memcmp(table->replace.entrytable, entries.entrytable, table->info.size) == 0)
continue;
} else {
}
struct xt_counters counters[XT_MAX_ENTRIES];
table->replace.num_counters = info.num_entries;
table->replace.counters = counters;
optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) + table->replace.size;
if (setsockopt(fd, SOL_IP, ARPT_SO_SET_REPLACE, &table->replace, optlen))
exit(1);
}
close(fd);
}
#define NF_BR_NUMHOOKS 6
#define EBT_TABLE_MAXNAMELEN 32
#define EBT_CHAIN_MAXNAMELEN 32
#define EBT_BASE_CTL 128
#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
#define EBT_SO_GET_INFO (EBT_BASE_CTL)
#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO + 1)
#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES + 1)
#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO + 1)
struct ebt_replace {
char name[EBT_TABLE_MAXNAMELEN];
unsigned int valid_hooks;
unsigned int nentries;
unsigned int entries_size;
struct ebt_entries* hook_entry[NF_BR_NUMHOOKS];
unsigned int num_counters;
struct ebt_counter* counters;
char* entries;
};
struct ebt_entries {
unsigned int distinguisher;
char name[EBT_CHAIN_MAXNAMELEN];
unsigned int counter_offset;
int policy;
unsigned int nentries;
char data[0] __attribute__((aligned(__alignof__(struct ebt_replace))));
};
struct ebt_table_desc {
const char* name;
struct ebt_replace replace;
char entrytable[XT_TABLE_SIZE];
};
static struct ebt_table_desc ebt_tables[] = {
{.name = "filter"},
{.name = "nat"},
{.name = "broute"},
};
static void checkpoint_ebtables(void)
{
int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (size_t i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
struct ebt_table_desc* table = &ebt_tables[i];
strcpy(table->replace.name, table->name);
socklen_t optlen = sizeof(table->replace);
if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_INFO, &table->replace, &optlen)) {
switch (errno) {
case EPERM:
case ENOENT:
case ENOPROTOOPT:
continue;
}
exit(1);
}
if (table->replace.entries_size > sizeof(table->entrytable))
exit(1);
table->replace.num_counters = 0;
table->replace.entries = table->entrytable;
optlen = sizeof(table->replace) + table->replace.entries_size;
if (getsockopt(fd, SOL_IP, EBT_SO_GET_INIT_ENTRIES, &table->replace, &optlen))
exit(1);
}
close(fd);
}
static void reset_ebtables()
{
int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (fd == -1) {
switch (errno) {
case EAFNOSUPPORT:
case ENOPROTOOPT:
return;
}
exit(1);
}
for (unsigned i = 0; i < sizeof(ebt_tables) / sizeof(ebt_tables[0]); i++) {
struct ebt_table_desc* table = &ebt_tables[i];
if (table->replace.valid_hooks == 0)
continue;
struct ebt_replace replace;
memset(&replace, 0, sizeof(replace));
strcpy(replace.name, table->name);
socklen_t optlen = sizeof(replace);
if (getsockopt(fd, SOL_IP, EBT_SO_GET_INFO, &replace, &optlen))
exit(1);
replace.num_counters = 0;
table->replace.entries = 0;
for (unsigned h = 0; h < NF_BR_NUMHOOKS; h++)
table->replace.hook_entry[h] = 0;
if (memcmp(&table->replace, &replace, sizeof(table->replace)) == 0) {
char entrytable[XT_TABLE_SIZE];
memset(&entrytable, 0, sizeof(entrytable));
replace.entries = entrytable;
optlen = sizeof(replace) + replace.entries_size;
if (getsockopt(fd, SOL_IP, EBT_SO_GET_ENTRIES, &replace, &optlen))
exit(1);
if (memcmp(table->entrytable, entrytable, replace.entries_size) == 0)
continue;
}
for (unsigned j = 0, h = 0; h < NF_BR_NUMHOOKS; h++) {
if (table->replace.valid_hooks & (1 << h)) {
table->replace.hook_entry[h] = (struct ebt_entries*)table->entrytable + j;
j++;
}
}
table->replace.entries = table->entrytable;
optlen = sizeof(table->replace) + table->replace.entries_size;
if (setsockopt(fd, SOL_IP, EBT_SO_SET_ENTRIES, &table->replace, optlen))
exit(1);
}
close(fd);
}
static void checkpoint_net_namespace(void)
{
checkpoint_ebtables();
checkpoint_arptables();
checkpoint_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]), AF_INET, SOL_IP);
checkpoint_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]), AF_INET6, SOL_IPV6);
}
static void reset_net_namespace(void)
{
reset_ebtables();
reset_arptables();
reset_iptables(ipv4_tables, sizeof(ipv4_tables) / sizeof(ipv4_tables[0]), AF_INET, SOL_IP);
reset_iptables(ipv6_tables, sizeof(ipv6_tables) / sizeof(ipv6_tables[0]), AF_INET6, SOL_IPV6);
}
static void mount_cgroups(const char* dir, const char** controllers, int count)
{
if (mkdir(dir, 0777)) {
return;
}
char enabled[128] = {0};
int i = 0;
for (; i < count; i++) {
if (mount("none", dir, "cgroup", 0, controllers[i])) {
continue;
}
umount(dir);
strcat(enabled, ",");
strcat(enabled, controllers[i]);
}
if (enabled[0] == 0) {
if (rmdir(dir) && errno != EBUSY)
exit(1);
return;
}
if (mount("none", dir, "cgroup", 0, enabled + 1)) {
if (rmdir(dir) && errno != EBUSY)
exit(1);
}
if (chmod(dir, 0777)) {
}
}
static void mount_cgroups2(const char** controllers, int count)
{
if (mkdir("/syzcgroup/unified", 0777)) {
return;
}
if (mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL)) {
if (rmdir("/syzcgroup/unified") && errno != EBUSY)
exit(1);
return;
}
if (chmod("/syzcgroup/unified", 0777)) {
}
int control = open("/syzcgroup/unified/cgroup.subtree_control", O_WRONLY);
if (control == -1)
return;
int i;
for (i = 0; i < count; i++)
if (write(control, controllers[i], strlen(controllers[i])) < 0) {
}
close(control);
}
static void setup_cgroups()
{
const char* unified_controllers[] = {"+cpu", "+io", "+pids"};
const char* net_controllers[] = {"net", "net_prio", "devices", "blkio", "freezer"};
const char* cpu_controllers[] = {"cpuset", "cpuacct", "hugetlb", "rlimit", "memory"};
if (mkdir("/syzcgroup", 0777)) {
return;
}
mount_cgroups2(unified_controllers, sizeof(unified_controllers) / sizeof(unified_controllers[0]));
mount_cgroups("/syzcgroup/net", net_controllers, sizeof(net_controllers) / sizeof(net_controllers[0]));
mount_cgroups("/syzcgroup/cpu", cpu_controllers, sizeof(cpu_controllers) / sizeof(cpu_controllers[0]));
write_file("/syzcgroup/cpu/cgroup.clone_children", "1");
write_file("/syzcgroup/cpu/cpuset.memory_pressure_enabled", "1");
}
static void setup_cgroups_loop()
{
int pid = getpid();
char file[128];
char cgroupdir[64];
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid);
if (mkdir(cgroupdir, 0777)) {
}
snprintf(file, sizeof(file), "%s/pids.max", cgroupdir);
write_file(file, "32");
snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
write_file(file, "%d", pid);
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid);
if (mkdir(cgroupdir, 0777)) {
}
snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
write_file(file, "%d", pid);
snprintf(file, sizeof(file), "%s/memory.soft_limit_in_bytes", cgroupdir);
write_file(file, "%d", 299 << 20);
snprintf(file, sizeof(file), "%s/memory.limit_in_bytes", cgroupdir);
write_file(file, "%d", 300 << 20);
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid);
if (mkdir(cgroupdir, 0777)) {
}
snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
write_file(file, "%d", pid);
}
static void setup_cgroups_test()
{
char cgroupdir[64];
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid);
if (symlink(cgroupdir, "./cgroup")) {
}
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid);
if (symlink(cgroupdir, "./cgroup.cpu")) {
}
snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid);
if (symlink(cgroupdir, "./cgroup.net")) {
}
}
static void setup_common()
{
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
}
}
static void setup_binderfs()
{
if (mkdir("/dev/binderfs", 0777)) {
}
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
}
}
static void loop();
static void sandbox_common()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setsid();
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = (200 << 20);
setrlimit(RLIMIT_AS, &rlim);
rlim.rlim_cur = rlim.rlim_max = 32 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 136 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 128 << 20;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
if (unshare(CLONE_NEWNS)) {
}
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
}
if (unshare(CLONE_NEWIPC)) {
}
if (unshare(0x02000000)) {
}
if (unshare(CLONE_NEWUTS)) {
}
if (unshare(CLONE_SYSVSEM)) {
}
typedef struct {
const char* name;
const char* value;
} sysctl_t;
static const sysctl_t sysctls[] = {
{"/proc/sys/kernel/shmmax", "16777216"},
{"/proc/sys/kernel/shmall", "536870912"},
{"/proc/sys/kernel/shmmni", "1024"},
{"/proc/sys/kernel/msgmax", "8192"},
{"/proc/sys/kernel/msgmni", "1024"},
{"/proc/sys/kernel/msgmnb", "1024"},
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
};
unsigned i;
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
write_file(sysctls[i].name, sysctls[i].value);
}
static int wait_for_loop(int pid)
{
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, __WALL) != pid) {
}
return WEXITSTATUS(status);
}
static void drop_caps(void)
{
struct __user_cap_header_struct cap_hdr = {};
struct __user_cap_data_struct cap_data[2] = {};
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
cap_hdr.pid = getpid();
if (syscall(SYS_capget, &cap_hdr, &cap_data))
exit(1);
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
cap_data[0].effective &= ~drop;
cap_data[0].permitted &= ~drop;
cap_data[0].inheritable &= ~drop;
if (syscall(SYS_capset, &cap_hdr, &cap_data))
exit(1);
}
static int do_sandbox_none(void)
{
if (unshare(CLONE_NEWPID)) {
}
int pid = fork();
if (pid != 0)
return wait_for_loop(pid);
setup_common();
initialize_vhci();
sandbox_common();
drop_caps();
initialize_netdevices_init();
if (unshare(CLONE_NEWNET)) {
}
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
initialize_tun();
initialize_netdevices();
initialize_wifi_devices();
setup_binderfs();
loop();
exit(1);
}
#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
int iter = 0;
DIR* dp = 0;
retry:
while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
}
dp = opendir(dir);
if (dp == NULL) {
if (errno == EMFILE) {
exit(1);
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) {
}
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
int i;
for (i = 0;; i++) {
if (unlink(filename) == 0)
break;
if (errno == EPERM) {
int fd = open(filename, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno != EBUSY || i > 100)
exit(1);
if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW))
exit(1);
}
}
closedir(dp);
for (int i = 0;; i++) {
if (rmdir(dir) == 0)
break;
if (i < 100) {
if (errno == EPERM) {
int fd = open(dir, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno == EBUSY) {
if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW))
exit(1);
continue;
}
if (errno == ENOTEMPTY) {
if (iter < 100) {
iter++;
goto retry;
}
}
}
exit(1);
}
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_loop()
{
setup_cgroups_loop();
checkpoint_net_namespace();
}
static void reset_loop()
{
char buf[64];
snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
int loopfd = open(buf, O_RDWR);
if (loopfd != -1) {
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd);
}
reset_net_namespace();
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
setup_cgroups_test();
write_file("/proc/self/oom_score_adj", "1000");
flush_tun();
if (symlink("/dev/binderfs", "./binderfs")) {
}
}
static void close_fds()
{
for (int fd = 3; fd < MAX_FDS; fd++)
close(fd);
}
static void setup_binfmt_misc()
{
if (mount(0, "/proc/sys/fs/binfmt_misc", "binfmt_misc", 0, 0)) {
}
write_file("/proc/sys/fs/binfmt_misc/register", ":syz0:M:0:\x01::./file0:");
write_file("/proc/sys/fs/binfmt_misc/register", ":syz1:M:1:\x02::./file0:POC");
}
static void setup_usb()
{
if (chmod("/dev/raw-gadget", 0666))
exit(1);
}
static void setup_sysctl()
{
char mypid[32];
snprintf(mypid, sizeof(mypid), "%d", getpid());
struct {
const char* name;
const char* data;
} files[] = {
{"/sys/kernel/debug/x86/nmi_longest_ns", "10000000000"},
{"/proc/sys/kernel/hung_task_check_interval_secs", "20"},
{"/proc/sys/net/core/bpf_jit_kallsyms", "1"},
{"/proc/sys/net/core/bpf_jit_harden", "0"},
{"/proc/sys/kernel/kptr_restrict", "0"},
{"/proc/sys/kernel/softlockup_all_cpu_backtrace", "1"},
{"/proc/sys/fs/mount-max", "100"},
{"/proc/sys/vm/oom_dump_tasks", "0"},
{"/proc/sys/debug/exception-trace", "0"},
{"/proc/sys/kernel/printk", "7 4 1 3"},
{"/proc/sys/kernel/keys/gc_delay", "1"},
{"/proc/sys/vm/oom_kill_allocating_task", "1"},
{"/proc/sys/kernel/ctrl-alt-del", "0"},
{"/proc/sys/kernel/cad_pid", mypid},
};
for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) {
if (!write_file(files[i].name, files[i].data))
printf("write to %s failed: %s\n", files[i].name, strerror(errno));
}
}
#define NL802154_CMD_SET_SHORT_ADDR 11
#define NL802154_ATTR_IFINDEX 3
#define NL802154_ATTR_SHORT_ADDR 10
static void setup_802154()
{
int sock_route = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock_route == -1)
exit(1);
int sock_generic = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock_generic < 0)
exit(1);
int nl802154_family_id = netlink_query_family_id(&nlmsg, sock_generic, "nl802154", true);
for (int i = 0; i < 2; i++) {
char devname[] = "wpan0";
devname[strlen(devname) - 1] += i;
uint64_t hwaddr = 0xaaaaaaaaaaaa0002 + (i << 8);
uint16_t shortaddr = 0xaaa0 + i;
int ifindex = if_nametoindex(devname);
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = NL802154_CMD_SET_SHORT_ADDR;
netlink_init(&nlmsg, nl802154_family_id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, NL802154_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
netlink_attr(&nlmsg, NL802154_ATTR_SHORT_ADDR, &shortaddr, sizeof(shortaddr));
int err = netlink_send(&nlmsg, sock_generic);
if (err < 0) {
}
netlink_device_change(&nlmsg, sock_route, devname, true, 0, &hwaddr, sizeof(hwaddr), 0);
if (i == 0) {
netlink_add_device_impl(&nlmsg, "lowpan", "lowpan0", false);
netlink_done(&nlmsg);
netlink_attr(&nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
int err = netlink_send(&nlmsg, sock_route);
if (err < 0) {
}
}
}
close(sock_route);
close(sock_generic);
}
#define SWAP_FILE "./swap-file"
#define SWAP_FILE_SIZE (128 * 1000 * 1000)
static void setup_swap()
{
swapoff(SWAP_FILE);
unlink(SWAP_FILE);
int fd = open(SWAP_FILE, O_CREAT | O_WRONLY | O_CLOEXEC, 0600);
if (fd == -1) {
exit(1);
return;
}
fallocate(fd, FALLOC_FL_ZERO_RANGE, 0, SWAP_FILE_SIZE);
close(fd);
char cmdline[64];
sprintf(cmdline, "mkswap %s", SWAP_FILE);
if (runcmdline(cmdline)) {
exit(1);
return;
}
if (swapon(SWAP_FILE, SWAP_FLAG_PREFER) == 1) {
exit(1);
return;
}
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 3; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50 + (call == 0 ? 4000 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
close_fds();
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
setup_loop();
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
reset_loop();
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[1] = {0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
NONFAILING(memcpy((void*)0x20000040, "btrfs\000", 6));
NONFAILING(memcpy((void*)0x20005140, "./file0\000", 8));
NONFAILING(memcpy((void*)0x20000080, "treelog", 7));
NONFAILING(*(uint8_t*)0x20000087 = 0x2c);
NONFAILING(memcpy((void*)0x20000088, "max_inline", 10));
NONFAILING(*(uint8_t*)0x20000092 = 0x3d);
NONFAILING(*(uint8_t*)0x20000093 = 0x6b);
NONFAILING(*(uint8_t*)0x20000094 = 0);
NONFAILING(*(uint8_t*)0x20000095 = 0x6b);
NONFAILING(*(uint8_t*)0x20000096 = 0x36);
NONFAILING(*(uint8_t*)0x20000097 = 0x37);
NONFAILING(*(uint8_t*)0x20000098 = 0x33);
NONFAILING(*(uint8_t*)0x20000099 = 0x30);
NONFAILING(*(uint8_t*)0x2000009a = 0x2c);
NONFAILING(memcpy((void*)0x2000009b, "check_int", 9));
NONFAILING(*(uint8_t*)0x200000a4 = 0x2c);
NONFAILING(*(uint8_t*)0x200000a5 = 0);
NONFAILING(memcpy((void*)0x200051c0, "\x78\x9c\xec\xdd\x4f\x88\x55\x65\x1f\x07\xf0\xe7\xce\x9d\x71\xe6\x55\x70\xee\x2b\x04\xb6\xca\x22\x90\x6a\xe1\xe0\x26\x22\xa2\xab\x4c\x50\x51\x74\xcb\xc5\x60\x04\x4e\x2d\x82\x74\xe1\x24\x48\xb4\x10\xc4\x16\xfd\x5b\x78\x4b\x8a\x5a\x48\xae\xa4\x16\xc9\x2c\x8c\xa0\x36\x2e\xa4\x30\x02\xb7\xa1\x61\x2e\xdc\x28\x06\x92\x8b\x76\x1a\x73\xcf\x79\xee\x9c\xfb\x1c\xef\xb9\x77\x46\x6d\x4c\x3f\x1f\x99\x39\xe7\x39\xbf\xf3\x3c\xe7\xb9\x97\xb3\xb8\xdf\xeb\x9c\x73\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x84\x10\x5e\xf8\xfd\xb3\x43\x55\xf5\x53\xd7\xa6\xcf\x9c\x9b\x69\xee\x3c\xb0\x65\xe6\xf2\xbe\xe9\x75\xa7\x43\xa8\x75\xb6\xd7\xf2\xfa\x8e\xad\xcf\xbe\xf2\xe6\xb6\x1d\x2f\x4e\xc4\x0e\xb3\x2f\x67\xcb\x46\xa3\xdf\x90\x59\xd7\xf3\x59\x63\x55\xcf\xc6\x85\x7e\xbd\x3f\xaf\x87\x10\xc6\x92\x01\xea\xf9\xf2\x99\x35\xa5\x51\x8b\xab\x7b\xca\x03\x56\xba\x7e\x71\xf7\xd1\x4d\x7b\x9b\x1b\x8f\x1f\x6e\xd7\xaf\x5e\x3a\x7b\xb2\xfc\xd2\x59\x30\xb1\xd2\x13\x58\x29\xf9\x79\x75\x61\xf1\x5c\x6a\x76\x7e\x8f\x24\x7b\x74\xdb\x85\x53\xaf\xd6\x73\x8a\x66\xfd\xd3\x13\xee\x5f\x79\x11\x00\xc0\x92\x4c\xb5\x3a\x8b\xee\xc7\xd1\xfc\x23\x6e\xb7\xbd\x3f\xad\x27\xed\x66\xd2\x6e\x27\xed\xf8\x09\xa1\x5d\x6c\x2c\x47\x36\xee\xaa\x7e\xf3\xdc\x90\xd6\x57\x68\x9e\xcd\x2c\x2a\x8c\xf7\x9d\x67\x52\xcf\xdf\xff\x6e\xbb\x95\xf6\x4f\xda\x49\xd4\x58\xc2\x3c\x7b\x77\xcd\x23\xcd\x44\xbf\x79\xce\x25\xf5\x95\x9a\x27\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x9d\xe4\x91\xb7\x47\x1f\xaa\xaa\x9f\xba\x36\x7d\xe6\xdc\x4c\x73\xe7\x81\x2d\x33\x97\xf7\x4d\xaf\x3b\x1d\x42\xa3\xb3\xbd\x96\x95\x6b\xab\xdf\x3f\xdc\xfc\xeb\xdb\xad\xc7\x0e\xfc\xb8\xf9\xab\xe3\x17\x9e\x7f\xac\x9e\xf7\x8b\xcb\xd1\xc2\xce\xe1\xb7\xb8\xf2\xc4\x64\x08\x6f\x14\x2a\x17\xe2\xb0\x17\xd7\x86\xd0\xea\x2d\x74\x9a\xe1\xcb\x72\xe1\xad\xce\xca\x73\xb1\x00\x00\x00\xc0\xdd\xe4\xfe\xce\xef\x91\x6e\x3b\x8b\x83\x63\x3d\xed\x5a\x27\x4d\xd6\x3a\xff\xa2\x2c\x2c\x5e\xbf\xb8\xfb\xe8\xa6\xbd\xcd\x8d\xc7\x0f\xb7\xeb\x57\x2f\x9d\x3d\xb9\xfc\xf1\x5a\x7d\xc6\x6b\xde\x70\xbc\x6e\xbb\xb1\xf8\x53\x2b\x04\xe3\x18\x7f\xd3\xf1\x16\xeb\x71\xd7\x3d\xa5\x71\xaa\xa5\x23\xa6\x79\xfe\xf1\xf3\x53\x7f\x57\xf5\x2f\xe5\xff\x46\x75\xfe\x8f\xef\x9c\xfc\x0f\x00\x00\xc0\xcd\x90\xff\xd3\x71\xaa\x0d\xca\xff\xdf\xbd\xf6\xc7\x27\x55\xfd\x4b\xf9\x7f\x43\xcf\x21\x4b\xf9\x3f\xce\x38\xe6\xff\x91\xb0\xbc\xfc\x0f\x00\x00\x00\x77\xb2\xdb\x9d\xff\x9b\xa5\x71\xaa\x0d\xca\xff\xe3\x2f\x8d\x7d\x5d\xd5\xbf\x94\xff\xa7\x86\xcb\xff\xa3\xc5\x69\xc7\x8d\xbf\xc6\x09\xef\x9a\x0c\x61\x6a\xd0\xd4\x01\x00\x00\x80\x3e\xe2\xff\xbb\x2f\x7e\xb5\x10\xf3\x7a\xf6\xcd\x41\x9a\xd7\x9f\x7a\xf4\xe0\xb9\xaa\xf1\x4a\xf9\xbf\x39\x5c\xfe\x1f\xbb\xa5\xaf\x0a\x00\x00\x00\xb8\x19\x47\xbe\xd8\xfe\x70\x55\xbd\x94\xff\x5b\xc3\xe5\xff\xf1\xdb\x3a\x6b\x00\x00\x00\x60\x29\xde\xf9\x70\xe2\x83\xaa\x7a\x29\xff\xcf\x0e\x97\xff\x57\xe7\xcb\xfc\xca\x87\xac\xd3\x4f\xf1\xaf\x10\x0e\x4d\x86\x30\xb1\xb0\x32\x97\x15\x7e\x0e\xed\xa7\xbb\x05\x00\x00\x00\xe0\x16\x89\x39\xfd\xcf\x4f\x77\xfe\x50\xb5\x5f\x29\xff\xcf\x55\xdf\xff\x3f\xde\xe9\x20\x5e\xff\xdf\x73\xff\xbf\xd2\xf5\xff\x85\x42\x76\xd7\xbf\x27\xdd\x18\x00\x00\x00\x80\x7b\x51\xf9\x7a\xfe\x78\x7b\xfc\xec\xc9\x05\xfd\x9e\xbf\x3f\xec\xf5\xff\x0f\xfc\xef\xe0\xab\x55\xc7\x2f\xe5\xff\xfd\xc3\xe5\xff\x7a\x71\x79\x2b\x9f\xff\x07\x00\x00\x00\xcb\xf0\x5f\x7b\xfe\xdf\xf6\xd2\x38\xd5\x06\xdd\xff\xff\xbe\x8f\xde\xfd\xa5\xaa\x7f\x29\xff\xb7\x87\xcb\xff\x71\xb9\xa6\xf8\xf2\x4e\xc4\xf7\xe7\xbd\xc9\x10\xd6\x2f\xac\xe4\x77\x13\xfc\x26\x1e\x6e\x57\x52\x98\x1f\x2b\x14\x3a\x5a\x49\x8f\x6d\xb1\x47\x5e\x98\x1f\x2f\x14\x3a\xe6\x92\x1e\x9b\x27\x43\x78\x70\x61\x65\x7f\x52\xf8\x7f\x2c\xb4\x93\xc2\x95\xb5\x79\xe1\x48\x52\x38\x1d\x0b\xf9\xf9\xd0\x2d\x1c\x4b\x0a\x27\xe2\x99\xf6\xf9\xda\x7c\xba\x69\xe1\xfb\x58\xc8\x2f\xb0\x98\x8f\x57\x50\xac\xe9\x5e\x12\x91\xf4\xb8\xda\xaf\xc7\x42\xe1\x86\x3d\xce\x76\x0f\x0e\x00\x00\x70\x4f\x89\xe1\x39\xcf\xb2\x63\xbd\xcd\x90\x46\xd9\xf9\xda\xa0\x1d\x56\x0f\xda\x61\x64\xd0\x0e\xf5\x41\x3b\x8c\x26\x3b\xa4\x3b\xf6\xdb\x1e\x66\x7b\x0b\x71\x7b\xfb\xcc\xc6\xa5\x3d\xff\xff\xc8\x70\xf9\x3f\xbe\x15\xab\xb2\x45\xbf\xeb\xff\x43\xbc\xfe\x3f\x7f\xae\x61\xf7\xfa\xff\xd9\x58\x68\x24\x85\xf9\x58\x68\xa5\x77\x0c\x68\xc5\x63\x64\x61\xf7\xe3\x78\x8c\x46\x2b\xef\x71\x65\x7d\xb7\x00\x00\x00\x00\x77\xb5\xf8\xbd\x40\x7d\x85\xe7\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x3f\xec\xdd\x6b\x8c\x5c\xd5\x7d\x00\xf0\xb3\xcf\xf1\x3e\xbc\x5e\x48\xaa\x10\x1a\x25\x9b\xa4\xc6\x71\x13\xaf\xd7\x36\x90\xa8\xa5\xca\x9a\x52\x35\x22\xa5\x59\x37\x14\x54\x45\x14\x1b\x7b\x4d\x16\x2f\xd8\xb1\x4d\x89\x51\x88\x8c\x4d\x44\x23\x04\xa5\x0d\x52\xf2\xa1\x08\xa3\x28\xaa\xf9\x00\xb5\x02\x11\x49\x01\xe1\x22\xc5\x11\x2a\x8f\x88\xaa\x28\x80\x40\xa1\x35\x44\x41\xa4\x94\x24\x22\x4d\x90\x42\x35\x7b\xef\x99\xbd\x73\xee\xce\xc3\x8f\x35\x5e\xfa\xfb\x49\xde\x39\x33\xff\xf3\xbc\xf3\xf0\x9c\x7b\xef\x9c\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xff\xc3\xc1\xaf\x5c\xf3\xb7\xcd\xe2\x8f\xfe\xf6\xbc\x67\x5f\xb8\x78\xfc\x8a\x3d\x6b\x2f\x7e\xf5\xba\xf3\x4e\x7d\x32\x84\x89\x99\xc7\x3b\xb2\x70\x47\xff\x8d\xb7\x8f\xff\xfc\xee\x73\xef\xd9\xf3\xc0\xea\x3b\xee\x3b\x7c\xfe\x47\x7b\xf3\x72\x79\x3c\x0c\x54\xff\x74\xe6\x77\x6e\x88\xb5\x1e\x5e\x1c\xc2\xfd\x1d\x21\x74\xa7\x81\x15\x83\x59\xa0\x27\xbf\x3f\x18\xeb\x7b\xdf\x60\x08\xa7\x84\xd9\x40\xad\xc4\x64\x7f\x56\x22\x6d\x38\x7c\xbf\x2f\x84\x7d\x61\x36\x50\xab\xea\x7b\x7d\x21\x0c\x16\x02\x17\x3e\xf5\xc8\xc3\x37\x57\x13\xb7\xf5\x85\xb0\x34\x84\x50\x49\xdb\x78\xbe\x92\xb5\xd1\x97\x06\xce\xe8\xcd\x02\xfd\x69\x60\x6b\x77\x16\xf8\xd5\x5b\x99\x5a\xe0\xbb\x9d\x59\x00\x8e\x59\x7c\x33\xd4\x5e\xf4\x07\x26\xea\x33\x0c\xcf\x5d\xae\xc1\xeb\xaf\xe7\xb8\x75\xec\xed\x95\x0e\xaf\x2b\x26\x86\x1b\xe7\xfb\xd9\xda\x79\xee\x54\x41\x6f\xfa\xc0\xc4\x31\x3d\x6d\xa5\xea\x98\x17\xa5\xb7\xc7\x41\xef\xb6\x05\xf0\x6e\x2b\x6d\xe7\x5b\x3d\x6d\xc5\x2f\x52\xf9\x37\x94\xb7\x66\x43\x95\xd0\xb9\x69\x72\xf3\x86\xab\xa7\x77\xc6\x47\x3a\xc3\xe8\x68\x57\xa3\x9a\xe6\xe9\x79\x7e\xe6\xf5\x2f\x6d\x3c\x92\xf4\x82\x79\x1d\xc6\x0e\x0c\x1f\x97\xd7\xe1\x2d\x4f\x2c\xbd\xbb\x6b\xf9\x05\x8f\xdf\xb7\x62\xe9\xcb\xfb\x3f\xb6\xf7\x95\x63\xed\xe6\x8f\x0a\x9b\xb4\x98\x9e\x6f\x95\x90\xbf\xe6\x16\xcc\xf3\x18\x8d\xfb\x3c\x59\x00\x6f\xbf\xd2\xb7\xa4\x11\x5f\xba\x42\x08\x9b\x3f\xff\x7b\x9f\x69\x16\x2f\xcd\xff\x87\x9b\xcf\xff\xe3\xcb\x39\xde\x76\xd6\xe5\x8e\xb5\xbe\x39\x94\xcd\xcd\xe3\x23\x83\x31\xf1\xda\x50\x36\x37\x07\x00\x00\x80\x05\x63\x21\xec\x35\xdd\x3a\xfa\xd0\x27\x9a\xd5\x57\x9a\xff\x8f\xb4\x77\xfc\x3f\x1e\xf2\xcf\x27\xf3\xd9\x68\x0f\x86\x30\x3e\x93\xd8\xbb\x24\x84\xd3\x66\x1e\xcf\x02\x77\xc5\xe6\x2e\x5b\x12\xc2\x07\x67\x52\x13\xf5\x81\xb5\x49\xe0\x60\x08\xef\x9d\x49\x2c\xaf\x55\x95\x94\x58\x14\x4b\x8c\x24\x81\x9f\x0c\xe5\x81\xf1\x24\x70\x28\x06\x26\x92\xc0\xb7\x62\xe0\xd6\x24\x70\x43\x0c\x1c\x48\x02\x1b\x63\xe0\x60\x12\x38\x37\x06\xc2\x54\xfd\x38\x7e\x7f\x28\x1f\x47\xdb\x81\xbe\x18\x58\x9f\x6d\xc4\x03\xf1\x2c\x84\x5f\x0c\xc5\xd6\x92\x6d\xf5\x5c\xad\x2a\x00\x00\x80\xe3\x24\x9f\x1d\xf6\xd4\xdf\x2d\x9c\xeb\x70\xac\x19\xe2\xf4\xf2\x40\x5f\xab\x0c\xf1\x0c\xec\x86\x19\x2a\x49\x0d\xe9\x0c\xb6\x36\xad\x6a\x58\x43\x77\xab\x1a\x3a\x5b\xd5\x50\x1b\xf7\xee\xe6\xc3\x2f\xd5\xdc\xd1\xaa\xe6\xd2\x69\x18\x1d\xf5\x19\x6e\xff\xe5\xdf\x7c\x36\x34\x51\x9a\xff\x8f\x35\x9f\xff\x57\xe6\xe8\x48\x47\xe9\xf8\x7f\x08\xeb\x66\xfe\xc6\xdc\x9d\x79\x64\xba\x16\x5f\x3f\x51\x97\x01\x00\x00\x00\x38\x06\x03\xff\xfb\xe2\x37\x9b\xc5\x4b\xf3\xff\xf1\xf6\xce\xff\x8f\xfb\x44\xba\x0a\x99\xc3\x63\x71\x37\xc4\x96\x25\x21\x8c\xd5\x07\xb2\x6a\xff\xb0\x1c\xc8\x8e\x7a\x0f\xe4\x01\x00\x00\x00\x58\x08\x6a\xc7\xe3\x6b\xc7\xc2\xa7\xf2\xdb\xec\x14\xed\x74\x3e\x5d\xce\x3f\x71\x84\xf9\xe3\x81\xff\xf1\x39\xf3\xf7\x1e\x7c\x70\x7d\xb3\xfe\x96\xe6\xff\x13\xed\x9d\xff\xdf\x5f\x7f\x9b\x75\xe2\x50\xec\xc5\xd7\x96\x84\xb0\xa8\x10\xf8\x41\xec\x65\x35\x30\x63\x24\x06\x7e\xfc\xc9\xfa\x40\x3e\xfe\x43\x71\x03\xdc\x14\xab\xca\x4f\x4c\xa8\x55\x75\x53\x2c\xb1\x3e\x06\xc6\x92\xc0\xbe\x46\x25\x7e\x58\x2b\x71\x5a\x7d\x20\x7f\xb2\x6a\x8d\xef\xad\x8d\x63\x2a\x2f\x51\x08\x00\x00\x00\xc0\x09\x17\x77\x07\xc4\xe3\xf2\xf1\xfc\xff\x0f\xfd\x66\xf5\x35\xcd\xca\x95\xe6\xff\xeb\x8f\xec\xfc\xff\x99\x79\x70\xe9\xf4\xfe\xe9\x81\x10\x56\x76\x87\xd0\x95\xfe\x30\xe0\xb1\xfe\x6c\x61\xc0\x18\x18\xec\xc8\x13\x0f\xf5\x67\x75\x75\xa5\x55\x5d\xdf\x1f\xc2\x39\xd5\x81\xa5\x55\xbd\x98\xaf\xff\xdf\x9d\xae\x31\xf8\x54\x5f\x56\x55\x0c\x9c\xf6\xa1\xfd\xaf\x9f\x51\x4d\x7c\xb3\x2f\x84\x95\xc5\xc0\xd3\x9f\xbb\xf3\xac\x6a\x62\x67\x12\xa8\x35\xfe\x97\x7d\x21\x7c\xa0\x3a\xda\xb4\xf1\xef\x2c\xca\x1a\xef\x49\x1b\xff\xfa\xa2\x10\xde\x5f\x08\xd4\xaa\xba\x6c\x51\x08\xd5\xc6\x7a\xd3\xaa\x1e\xa9\xe4\xd7\x31\x48\xab\xfa\xe7\x4a\x08\xef\x2a\x04\x6a\x55\x9d\x5d\x09\x61\x57\x00\x60\x81\x8a\xff\x95\x6e\x2a\x3e\xb8\x63\xd7\xb5\x5b\x36\x4c\x4f\x4f\x6e\x9f\xc7\x44\xdc\x87\xdf\x17\x36\x4f\x4d\x4f\x8e\x6e\xdc\x3a\xbd\xa9\xd2\xa0\x4f\x9b\x92\x3e\xd7\x2d\x63\x74\x7d\x79\x4c\xed\x5e\xf9\xe6\xb9\x7c\x89\xa2\x8b\xee\x5d\x37\xd8\x4e\xba\xf6\x3b\xc1\xb1\x62\x5b\xf9\x7e\xfc\xd2\x89\x83\xf9\xfd\xf8\x5d\xa8\x67\x66\x9c\xab\x7b\xea\xee\xae\x49\x87\xfc\x91\x0f\x97\x9b\x08\x85\x6f\x52\x8d\x86\xdc\x39\xcf\x43\xee\x2f\x56\x32\xfb\x24\x96\xea\x8f\xf9\x7b\xc3\x40\x58\x74\xf5\x8e\xc9\xed\xa3\x5f\xdc\xb0\x73\xe7\xf6\x55\xd9\xdf\x76\xb3\xaf\xce\xfe\xc6\xc3\x4c\xd9\xb6\x5a\x95\x6e\xab\xfe\xb9\xfa\xd6\xc6\xcb\xa3\xe1\x6a\x59\x89\xa3\xdd\x56\xcb\x8a\x95\xac\xdc\x79\xe5\xb6\x95\x3b\x76\x5d\xbb\x62\xea\xca\x0d\x97\x4f\x5e\x3e\x79\xd5\xaa\xb3\x57\x8f\x9d\x39\xb6\x66\xec\xe3\x67\xae\xac\x8e\x6a\x2c\xfb\xdb\x62\xa8\xcb\xe6\xaa\x3a\x19\xea\x5b\x77\xb6\x39\xae\xe3\x38\xd4\xd3\xbb\x0b\x95\x9c\x88\x4f\x0d\x09\x09\x89\x85\x96\xd8\x3a\xb0\xac\xe9\xff\xc9\xa5\xf9\xff\xb6\xe6\xf3\xff\xf8\xa9\x13\x3f\xf9\xf3\xf5\x19\x1a\x1d\xff\x1f\x8e\x87\xf9\xb3\xc7\x67\x0f\xf3\xaf\x8f\x81\x7d\xed\x1e\xff\x1f\x6e\x74\x34\xbf\x76\x62\xc0\x48\x12\xd8\x1d\x03\xbb\x1d\xe6\x07\x00\x00\xe0\x9d\x21\x4e\xf2\xe3\xde\xcc\xb8\x57\xfa\xa7\xcb\xbf\xf3\x72\xb3\x72\xa5\xf9\xff\xee\xf6\x7e\xff\x7f\x9c\xd6\xff\xaf\x2d\x5d\x7f\x7e\xa3\x65\xfe\x97\xc7\x12\x63\x8d\xd6\xff\x4f\x97\xf9\xaf\xad\xff\xbf\xbb\xd1\xfa\xff\xe9\x32\xff\xb5\xf5\xff\xf7\xbd\x0d\xeb\xff\x5f\x5d\x0b\x24\x9b\xe4\x17\xd6\xff\x07\x00\x00\xde\x09\x4e\xdc\xfa\xff\x2d\x97\xf7\x4f\x2f\x10\x50\xca\xd0\x72\x79\xff\xf4\x02\x01\xa5\x0c\x2d\x97\xf1\x6f\xf7\x02\x01\x47\xbc\xfe\xff\xf3\xff\xf9\x57\xff\x1d\x9a\x28\xcd\xff\x6f\x6d\x6f\xfe\x6f\xe1\x7e\x00\x00\x00\x38\x79\x7c\xf9\xcf\xae\xf9\x9d\x66\xf1\xd2\xfc\x7f\x5f\x7b\xf3\xff\x13\xbf\xfe\x5f\x68\x74\xfe\xff\x48\xa3\xc0\x44\xa3\x85\x01\xad\xff\x07\x00\x00\xc0\x02\xd5\x68\xfd\xbf\xe1\x1b\xfb\x2f\x6d\x56\xae\x34\xff\x3f\xd0\xde\xfc\x3f\x9e\x76\xd1\x59\x97\x3b\xd6\xfa\xe6\x50\xb6\xa6\x5d\x48\xd7\xb4\x7b\x6d\xa8\xf6\x93\x01\x00\x00\x00\x58\x18\x3a\xc3\xe8\x68\x4f\x9b\x79\xeb\x56\x46\x5d\x7b\xf4\x6d\x3e\x93\x2f\x05\xda\x2c\x5d\xf4\xe2\x9f\x1c\x3e\xb2\xf3\xff\x0f\xb6\x37\xff\xaf\xfb\x5d\xc6\x2d\x4f\x2c\xbd\xbb\x6b\xf9\x05\x8f\xbf\x79\xdf\x8a\xa5\x2f\xef\xff\xd8\xde\x57\x66\x8f\xff\x03\x00\x00\x00\xf3\xa7\xdd\xfd\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xdb\xef\xc5\xff\xd8\xb3\xa6\x59\xbc\xf4\xfb\xff\xb0\x6e\xe6\xf1\x46\xbf\xff\x8f\xd7\xfd\x8b\xbf\x2f\x78\x77\x5d\xee\x58\x6b\xeb\xf5\xff\xf2\xfb\x17\x7e\xfa\x9e\x5d\x33\x4b\x16\x3e\x36\x14\xc2\x87\x8b\x81\x2d\x7b\xb6\x9c\x12\xf2\x6b\xf3\x2f\x2b\x06\x1e\xbe\x64\xf9\x7b\xaa\x89\x3d\x69\x89\x07\x5f\x38\xf7\xa5\x6a\xe2\xd2\x34\xf0\xa9\x15\xa7\xbe\x51\x4d\x9c\x93\x04\xd6\xc7\x45\x12\xdf\x9b\x06\xe2\x55\x15\xdf\x58\x9c\x04\xe2\xf2\x8a\xff\x9e\x06\xe2\xf6\x38\x90\x06\x7a\xf3\xc0\x57\x17\x67\xe3\xe8\x48\xb7\xd5\x4f\x07\xb3\x6d\xd5\x91\x6e\xab\x67\x07\x43\x58\x52\x08\xd4\xb6\xd5\xfd\x83\x59\x1b\x1d\xe9\x00\x6f\x4b\x02\xb5\x01\x7e\x21\x0d\xc4\x01\xfe\x79\x1e\xe8\x4c\x7b\x75\xcf\x40\xd6\xab\x18\x18\x8c\x45\xef\x18\xc8\x7a\x05\x00\xc0\x49\x2b\x7e\x0b\xec\x09\x9b\xa7\xa6\x27\xc7\xe2\x57\xf8\x78\x7b\x7a\x77\xfd\x6d\x54\xb7\x64\xd9\xf5\xe5\x6a\x3b\xda\x6c\xfe\xb9\x7c\x69\xb2\x8b\xee\x5d\x37\xd8\x4e\xba\x2b\xfd\x2e\x3a\x7b\xad\xf1\x9e\x50\xa9\x0e\x61\x55\xe9\xeb\x6a\x31\x4b\xc7\xcc\x28\x8f\x4f\x2d\x2d\x36\xdd\xbb\x1b\x0c\xb9\xd5\x6a\x6f\x9d\x0d\xca\xa5\x8e\x74\xd3\xf5\x36\x1e\x51\x5f\x36\xa2\xd1\x8d\x5b\xa7\x37\xf5\xb4\x1c\xf8\x9a\xd6\x59\x56\x77\xb7\xcc\xb2\xaa\x34\xd9\x29\x66\xe9\x9c\xd9\xa4\x6d\xd4\xd2\x46\x5f\xda\x18\x51\x9b\xdb\xa6\x8d\x2e\xc7\xfb\x9d\x61\x74\xb4\x2b\xc9\xf5\x07\x31\x38\x1c\xea\xb4\x7a\x45\xb4\xfb\x7b\xfd\xe2\x3a\x7f\x8d\x5e\x05\xc5\x3c\x57\x1d\xde\xfb\xab\x66\xf5\x95\xe6\xff\xc3\xed\xcd\xff\x2b\xc5\x71\xbd\x91\x5f\x0c\x60\x77\xbc\xb2\xde\xdf\x2d\xb1\xcc\x3f\x00\x00\x00\xcc\xaf\xaf\xae\xfd\xf5\x37\xe2\xbf\xcf\xde\xf8\xe8\xd3\xcd\xf2\x96\xe6\xff\x23\xed\xcd\xff\xe3\x1e\xac\xfc\x50\x70\xb6\xb7\xe3\x60\xbc\xfe\xff\xde\x25\x21\xcc\x5c\x5a\x7f\x38\x0b\xdc\x15\x9b\xbb\x6c\x49\x08\x1f\x9c\x49\x4d\xc4\x12\xd9\x05\xf5\xcf\x8f\x25\xc6\xb2\xc0\x5d\x71\x87\xc9\xf2\x58\x62\xfd\x44\x7d\x55\x8b\x62\xe0\x40\x12\xf8\xc9\x50\x1e\x38\x98\x04\x0e\xc5\x40\xbe\x97\x62\x7f\xc8\x77\xe5\xfc\xfd\x50\x08\x67\xcd\xa4\xd6\xd5\x97\xd8\x16\x4b\x0c\x27\x81\xcf\xc4\xc0\x48\x12\x18\x8d\x81\xb1\x24\xb0\x38\x06\xc6\x93\xc0\xab\x8b\xf3\xc0\x44\x12\xf8\xb7\x18\x08\x53\xf5\xdb\xea\xde\xc5\xf9\xb6\x02\x00\x00\x38\x12\xf9\x3c\xab\xa7\xfe\x6e\x48\xe7\x79\x07\xba\x5b\x65\xe8\x68\x95\xa1\xbf\x55\x86\xce\x56\x19\x2a\xad\x32\x34\x1a\x45\xbc\xff\xed\x98\xa1\x27\x39\x79\xa5\xa3\x90\xa9\x27\xad\xb5\x2f\xa9\xa5\x94\x21\x5e\x0c\xff\x88\xfb\x55\xca\x10\x7e\x58\x9f\x33\x2d\x58\x6a\x3a\x9e\x7f\x50\x3b\xdf\xa0\xa3\x3e\xc3\x03\x9f\xe8\xae\x84\x26\x4a\xf3\xff\xb1\xf6\xe6\xff\xfd\xf5\xb7\x59\xeb\x87\xe2\xfc\x7f\xf6\xfa\x7f\x59\xe0\x07\xb1\x7b\x5f\x8b\xa7\x8e\x8f\xc4\xc0\x8f\x3f\x59\x1f\xc8\x77\x0c\x1c\x8a\x93\xdd\x9b\x6a\x55\x4d\xe4\x25\xf2\x49\xfb\x4d\xb1\xc4\x78\x0c\x8c\x24\x81\x6d\x31\x30\x9e\x04\xd6\xaf\xcb\x03\xfb\xde\x53\x1f\xc8\x67\xda\xb5\xc6\xf7\xd6\x1a\x9f\xca\x4b\x14\x02\x00\x00\x00\x70\xc2\xc5\x1d\x04\x71\x37\x4d\x9c\xff\xdf\xb1\xe3\x2b\x03\xcd\xca\x95\xe6\xff\xe3\xed\xcd\xff\x63\x7b\x03\xc5\xc6\x6e\x88\xb5\x1e\x5e\x1c\xc2\xfd\x1d\xb3\xbd\xa9\x05\x56\x0c\x66\x81\xb8\x1f\x63\x30\xfe\x3c\xfe\x7d\x83\x21\x9c\x52\xd8\xc1\x51\x2b\x31\xd9\x9f\x95\xe8\x4d\x1a\x0e\xdf\xef\xcb\x7e\xa1\xde\x9b\x56\xf5\xbd\xbe\xec\xc7\x07\xf1\xfe\x85\x4f\x3d\xf2\xf0\xcd\xd5\xc4\x6d\x7d\x21\x2c\x2d\xec\x7d\xa9\xb5\xf1\x7c\x25\x6b\xa3\x2f\x0d\x9c\xd1\x9b\x05\xfa\xd3\xc0\xd6\xee\x2c\x10\xf7\xfc\xd4\x02\xdf\xed\xcc\x02\x70\xcc\x6a\x7b\x05\xe3\x0b\x2a\x3f\xd5\xa5\x66\x78\xee\x72\x0d\x5e\x7f\xef\x94\x6b\x82\xa6\xc3\x2b\xed\x03\x9d\x23\xdf\x5c\xbf\xb9\x9a\x2f\xa5\x1d\xae\xf9\x3e\xd5\x9a\x23\x7b\xda\x9a\xee\xbf\xe5\xb8\x29\xbd\x3d\x0e\x7a\xb7\x2d\xc4\x77\xdb\xb0\x77\x5b\xf1\x8b\x54\xfe\x0d\xe5\xad\xd9\x50\x25\x74\x6e\x9a\xdc\xbc\xe1\xea\xe9\x9d\xf1\x91\xe2\x2f\x59\x4b\xe6\xe9\x79\x2e\xfe\x4a\xb5\x9d\xf4\x71\x78\x1d\xee\x3e\xfa\xde\xb6\x56\x49\x3b\x30\x96\x7c\x7c\x8c\xcd\x5d\x6e\xee\xd7\x61\x47\xac\xee\x96\x27\x96\xde\xdd\xb5\xfc\x82\xc7\xef\x5b\xb1\xf4\xe5\xfd\x1f\xdb\xfb\x4a\xdb\xdd\x68\x20\xfe\x50\xf8\x91\xeb\xfe\x75\xf0\x47\x85\xcd\x3b\xdf\x2a\x21\x7f\xcd\x2d\xb8\xcf\x93\x09\x9f\x27\x0b\xf1\xbf\x81\x11\x4f\x5b\x08\x61\xdd\xab\x5f\xbf\xa9\x59\xbc\x34\xff\x9f\x68\x6f\xfe\xdf\x9d\xdc\xce\xf8\x75\xdc\x98\x3b\x96\x84\xf0\x91\xc2\xc6\x7d\x2c\x6e\xfe\x3f\x5e\x92\x7d\x0e\x16\x02\xd9\xa7\xe4\xbb\xca\x81\xec\x90\xfb\x7f\x0d\x35\xfc\xe4\x04\x00\x00\x80\xe3\xad\xb6\xbb\xa3\xb6\xbf\x60\x2a\xbf\xcd\x4e\x08\x4f\xe7\xc9\xe5\xfc\x13\x47\x98\x3f\xee\xaf\x18\x9f\x33\x7f\xbb\xfd\xee\xff\xeb\x4b\x96\x36\x8b\x97\xe6\xff\xeb\x9b\xcf\xff\x17\x25\xdd\x74\xfc\xdf\xf1\x7f\xe6\x89\xe3\xff\x73\x3a\xd9\x77\x45\x2f\x4a\x1f\xd8\x7d\x4c\xbb\xa2\x4b\xd5\x31\x2f\x1c\xff\x9f\xd3\xc9\xfe\x6e\x73\xfc\x7f\x4e\x8e\xff\x3b\xfe\x3f\x17\xc7\xff\x5b\x70\xfc\x7f\x4e\x27\xfb\xd3\x56\xfa\x96\xb4\xcd\x97\xae\x10\xc2\xcb\x7f\xf4\xd0\xb3\xcd\xe2\xa5\xf9\xff\xb6\xf6\xe6\xff\xd6\xff\x9b\x7b\xd1\xbe\xda\xfa\x7f\xeb\x1b\xad\xff\xb7\xad\xd1\xfa\x7f\xbb\xad\xff\x07\x00\x00\xcc\xab\x06\x0b\xcd\xa5\xf3\xbc\xd2\xea\x7d\xa5\x0c\xe9\xea\x7d\xa5\x0c\x2d\x17\x08\x6c\xb9\xc4\xa0\xf5\xff\x8e\x78\xfd\xbf\x97\x4e\x7f\xfe\x37\xa1\x89\xd2\xfc\x7f\x77\x7b\xf3\xff\xf8\x72\x18\x28\xb6\xbe\x50\xd6\xff\x1b\x59\xd7\xa0\xaa\x5b\x63\x60\x9b\x85\x01\x01\x00\x00\x38\x19\x35\xda\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xdb\xeb\x81\x7f\xf8\x9f\x4d\xcd\xe2\x8f\xfe\xf6\xbc\x67\x5f\xb8\x78\xfc\x8a\x3d\x6b\x2f\x7e\xf5\xba\xf3\x4e\x7d\x32\x84\xa9\x99\xc7\x3b\xb2\x70\x47\xff\x8d\xb7\x8f\xff\xfc\xee\x73\xef\xd9\xf3\xc0\xea\x3b\xee\x3b\x7c\xfe\x47\x2b\x79\xb9\x9e\xfc\xf6\x77\xeb\x72\xc7\x5a\xdf\x1c\x0a\x61\x5f\xe1\x91\xc1\x98\x78\x6d\xa8\x7a\x67\x36\x70\xe1\xa7\xef\xd9\xd5\x5d\x4d\x3c\x36\x14\xc2\x87\x8b\x81\x2d\x7b\xb6\x9c\x52\x4d\x7c\x6b\x28\x84\x65\xc5\xc0\xc3\x97\x2c\x7f\x4f\x35\xb1\x27\x2d\xf1\xe0\x0b\xe7\xbe\x54\x4d\x5c\x9a\x06\x3e\xb5\xe2\xd4\x37\xaa\x89\x73\xf2\x40\x47\xda\xdd\x7f\x5c\x9c\x75\xb7\x23\xed\xee\xcd\x8b\x43\x58\x52\x08\xd4\xba\x7b\xc5\xe2\xfa\xaa\x6a\x6d\xfc\x69\x1e\xe8\x4c\xdb\xf8\xa7\xc1\xac\x8d\x18\x18\x8c\x45\xbf\x31\x98\xb5\x11\x03\xd3\xb1\xc4\xd4\xa2\x10\x56\x76\x87\xd0\x95\x56\xf5\x68\x25\xab\xaa\x2b\xad\xea\x5f\x2a\x59\x55\x5d\x69\x55\x5f\xae\x84\x70\x4e\x08\xa1\x3b\xad\xea\x85\xde\xac\xaa\xee\x74\xe4\x4f\xf6\x66\x55\xc5\xc0\x69\x1f\xda\xff\xfa\x19\xd5\xc4\xbe\xde\x10\x56\x16\x03\x4f\x7f\xee\xce\xb3\xaa\x89\x2f\x24\x81\x5a\xe3\x7f\xd1\x1b\xc2\x07\xaa\x2f\x99\xb4\xf1\x6f\xf7\x64\x8d\xf7\xa4\x8d\xdf\xd6\x13\xc2\xfb\x43\x08\xbd\x69\x89\x5f\x76\x67\x25\x7a\xd3\x12\x2f\x76\x87\xf0\xae\x42\xa0\xd6\xf8\xe7\xbb\x43\xd8\x15\x78\x47\x88\x1f\x3e\x75\x9f\x68\x3b\x76\x5d\xbb\x65\xc3\xf4\xf4\xe4\xf6\x79\x4c\xf4\xe6\x6d\xf5\x85\xcd\x53\xd3\x93\xa3\x1b\xb7\x4e\x6f\xaa\x24\x7d\x6a\xa4\xa3\x90\x7e\xeb\xfa\xa3\x1f\xfb\x73\xaf\x7f\x69\x63\xf5\xf6\xa2\x7b\xd7\x0d\xb6\x93\xee\xce\xcb\xf5\xcc\x74\x79\x75\x4f\xdd\xdd\x35\x27\x7b\xef\x63\xbf\xfa\x8b\x95\xcc\x3e\x1f\xa5\xfa\x63\xfe\xde\x30\x10\x16\x5d\xbd\x63\x72\xfb\xe8\x17\x37\xec\xdc\xb9\x7d\x55\xf6\xb7\xdd\xec\xab\xb3\xbf\x5d\x79\x34\xdb\x56\xab\x16\xca\xb6\x5a\x56\xac\x64\xe5\xce\x2b\xb7\xad\xdc\xb1\xeb\xda\x15\x53\x57\x6e\xb8\x7c\xf2\xf2\xc9\xab\x56\x9d\xbd\x7a\xec\xcc\xb1\x35\x63\x1f\x3f\x73\x65\x75\x54\x63\xd9\xdf\xe3\x31\xd4\x3b\x4f\xfc\x50\x4f\xef\x2e\x54\x72\x22\x3e\x00\x24\x24\x24\x16\x5a\xa2\xb3\xee\xd3\x6d\xec\x64\xff\x20\x2f\x7d\xd1\x9f\xed\x68\x4f\xa8\xcc\x7c\x40\x97\xa6\x15\xc5\x2c\x1d\x33\xa3\x3c\x1e\x83\x5e\x7b\x94\x23\x3e\x9a\xef\x29\x2d\x47\xb4\xaa\x34\x71\x28\x65\x59\xdd\x3a\xcb\x9a\xd2\x64\x62\x36\x4b\x5f\x96\x65\xe6\x7b\x5d\x69\x72\x58\xac\xa9\x73\x66\x93\xc6\xfb\x9d\x61\x74\xb4\xab\xd1\x76\x18\xae\xbf\x5b\xdc\xbc\x3f\x3b\x86\xcd\xfb\x4c\xbe\xe9\xda\x4d\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x7f\xec\xc0\x81\x00\x00\x00\x00\x00\x90\xff\x6b\x23\x54\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x61\x07\x0e\x04\x00\x00\x00\x00\x80\xfc\x5f\x1b\xa1\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\x0a\x3b\x70\x2c\x00\x00\x00\x00\x20\xcc\xdf\x3a\x8c\x9e\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\x14\x00\x00\xff\xff\x03\x54\x23\x07", 20717));
res = -1;
NONFAILING(res = syz_mount_image(/*fs=*/0x20000040, /*dir=*/0x20005140, /*flags=*/0, /*opts=*/0x20000080, /*chdir=*/0, /*size=*/0x50ed, /*img=*/0x200051c0));
if (res != -1)
r[0] = res;
break;
case 1:
NONFAILING(*(uint32_t*)0x20000140 = -1);
NONFAILING(memcpy((void*)0x20000148, "\x03\xfd\x69\x02\x43\xfb\xb3\xd1\xa7\x79\xba\xbf\x54\x06\x72\x33\x0d\xe4\xcc\x81\x17\xf7\x7b\xca\xa5\x91\x59\xa7\x39\x2e\xfa\xb8\xf4\x18\xb4\xb6\x7c\x76\xf1\xd5\xab\x66\x10\xd2\xd4\xbb\x05\x5f\xc0\xf0\x57\x5b\x11\xd3\xd5\x2d\x33\x21\xea\x48\x74\xfa\xac\x1c\xe0\xe1\xf8\xee\x00\x3d\xb7\xa0\xec\x48\xc7\xc8\x09\x07\x29\x2e\xeb\x2c\xde\x08\x21\xbf\x4e\xe2\x7f\x3f\xb8\x7c\x9d\xe2\xb2\x2a\x2f\x23\x77\x4d\x88\x15\x90\xcd\x00\x0f\x5e\x4b\x6a\xc3\xff\x64\x9f\xd1\x81\x8b\x40\x08\x1f\xfd\x9a\xa0\x76\xf9\xf8\xb2\x7b\x19\x13\x87\x21\xbc\x59\x4e\xe4\xdf\xfc\x2f\x3d\x8d\x95\x12\xea\xae\x9e\xf8\xc8\x6b\x07\x43\x5c\x36\x8d\xaa\x30\x8d\x52\xc4\xdd\xa6\xf4\xb1\x9f\x80\xd5\xa5\x18\x4c\x61\xce\x67\x0c\xee\x71\x2c\xb9\x24\xc2\xa8\x15\xd5\x9c\xd2\x01\xfd\x76\x8b\x44\x83\x60\xaa\x38\xa2\x02\x8c\x4b\x4a\x24\x6f\x36\x14\x05\xfe\x02\x45\xca\x0a\xb0\xc3\xec\x2f\xac\x76\xcc\x28\x29\xa8\x7f\x28\x29\x99\x55\xc9\xbf\x70\x58\xc7\x08\x15\x8f\xae\x98\xff\x28\x30\x38\x61\x23\x8e\xf3\x95\x87\xac\xed\xe7\x51\xaf\x7c\x54\x76\xbc\xbe\xf0\xee\xfa\x84\x0a\x1e\x6c\x4e\xca\x78\x01\x58\xf7\xd6\x5f\xfa\xb3\xad\xc2\x82\xe2\x57\x41\x81\x55\xc9\x7a\x72\x16\xa6\xd1\x99\x39\xd6\x06\x7d\x74\x81\xc6\x4a\xcf\xf6\x6f\xc2\x96\xfe\x78\x0d\xef\xc4\xab\xbf\x26\x61\xbc\xcd\x85\x15\x72\x5f\x97\xa9\xfc\x30\xa7\xcc\x28\xd6\x80\xfd\xa0\xaa\xf0\x2d\x71\x80\xa9\x98\x1f\x91\x42\x1c\x58\xc5\x32\xfc\xb3\x68\x12\x91\xf9\x2c\xfc\xbf\x80\x92\x16\x5d\x95\x77\xa2\xb3\x97\xae\xbd\x17\x0c\x41\xaa\x07\x96\x16\x53\x78\xdd\x23\x1a\x4e\x01\x85\xf4\x63\xbd\x43\x83\x0e\x53\x73\xe1\x3a\x29\xd7\x5a\x9b\xe4\x63\xc7\x81\x0d\x22\xfd\x08\x2b\x0f\xba\x38\x36\xb7\x5f\x54\x4e\xec\x52\xf8\x88\x3f\xa5\x08\x56\x50\x2f\x71\x4f\xde\x7c\x46\x21\x85\xda\xae\x94\x4a\x8d\x85\x52\xce\x87\x4f\x2a\x47\xb4\xe8\x97\x25\xb0\x5e\xba\xb5\x89\xc0\xb5\x3f\x1e\x04\xde\x1a\x45\xe2\x15\x3c\xd0\xab\xc3\xcf\x71\x3f\x22\x76\x09\xe5\x3e\x81\x31\xaa\xde\x35\xc5\xd9\x22\xdf\xaa\xdd\x84\xaa\x40\x1d\x53\x7b\x5d\xf3\xdb\x82\x8a\x5b\x1d\x76\xe4\x9b\x04\x13\x4b\xc1\x4a\x7b\xae\x5d\x32\x9e\xd0\x14\x88\x63\xf4\x50\xac\xcd\xf7\x7a\x40\xed\x75\xad\x0b\xc6\x34\x55\xc3\xb5\xa7\x0a\xc4\xc9\x08\x3d\xb5\xbc\xe5\x55\x0d\x03\x5d\xd4\x4e\x3f\x54\x84\x0b\xb6\x4b\x97\x47\x2b\x61\xab\x57\x29\x8d\x25\x10\x4f\xbc\xda\xc7\x31\xb6\xab\xf8\xbc\xfe\x19\xe2\x18\xeb\x3f\x22\xa2\x2a\x8c\xb6\xf2\x38\x1d\xed\x59\x12\xde\x78\xf9\x95\xdc\xc2\x0a\x31\xc3\xab\x64\xef\xa0\xe8\x82\x28\xf4\x1f\x0c\x98\xc0\xf1\xcf\x03\x22\x1f\xbb\xd1\xb2\x3f\x5c\xc2\x9b\xff\xf7\x64\xc6\x63\xa0\xa6\xb7\x7e\xd5\x98\x89\x90\xa2\x5c\x6f\x35\xae\xa5\x39\xe1\xb1\xd2\x04\xae\xd0\x45\x4e\x30\xd2\x3b\xcf\x05\x7d\xfb\xe6\x38\x68\xa9\x93\xe1\x28\x2e\xe7\x9a\xe9\xc8\xb2\xf7\xf5\x36\x9c\xae\x40\x43\xe7\x50\x9f\x09\x67\x55\x17\x99\x57\x43\x4e\x29\x09\x98\x75\x88\x6c\xd1\x60\x58\x58\xa0\x3a\x0b\x5a\x4e\x43\x44\x28\x90\x13\x89\x45\x02\xf0\xb1\x3a\x79\x5a\x6a\x2b\x35\x1f\x3b\x40\x2c\xba\xc4\xe8\x0c\x20\x03\x1e\x68\x7d\xec\xc6\x6e\x55\x45\xef\xa8\x5e\x70\xe8\x38\x1b\x28\x84\xfe\x52\x08\x53\x66\x38\x84\xaa\xb8\x1f\x0e\xe8\x6a\x19\xbc\x2b\xcb\xf2\x74\x26\x5e\xe2\xc5\xe7\x92\xaa\x21\x15\x29\x56\xd7\x28\x67\x3f\x2c\x4d\xde\x08\x44\xe8\x60\xea\x32\x5c\x5d\x9a\x3e\x24\x33\x65\xb0\x1d\xc3\xe1\x62\x07\x56\xc0\x2b\x33\x4f\x47\x2a\xb2\x75\x58\xbf\x71\xa1\x58\x27\xcd\x0a\x63\x44\x52\x87\x51\x81\x55\x47\x0a\x18\x91\x58\xcd\xf6\xb5\x4f\xb8\xce\xe4\x04\x60\x86\x7f\x6b\x69\x15\xc5\x22\xf8\xa7\x99\xd7\x21\xca\x5b\xc4\x18\x16\xc6\x11\x82\xe1\xbe\xcc\x5f\x4a\x44\x58\x17\x81\xed\x81\x9c\x52\xe9\x24\xf3\xa0\x95\x43\xe9\x84\x9a\x18\xe8\xa6\x62\x1d\xd2\x69\x94\x34\x22\xb3\x04\x1c\x55\xc0\xdf\x38\x79\x46\x78\x50\xb8\xac\x9f\x06\x05\x24\x22\xb9\x04\xa5\x15\xfb\x78\xb0\x4b\x11\x9e\x94\xf0\x0e\x56\x33\xf7\x9c\x8a\x93\x6e\x45\xd0\x12\xa5\xc3\x89\xf5\x56\xbd\x1b\xe7\x69\x5c\xe7\x23\xa8\x1c\x57\xd8\x63\x79\x93\xbb\x61\x2c\x88\x13\x4c\xc0\x56\xe0\x23\x36\x95\x34\x08\xfe\xe8\xbd\xed\xd0\x43\xee\xa2\x09\x0c\x5a\x51\x69\x3b\x1a\x1f\x5b\x55\x69\x8f\x5d\x94\xa9\x6c\xb0\x2a\x82\xf8\x83\xaf\xc9\x18\x5b\xed\x5b\x2c\xf5\xc3\x18\xd0\x2a\x35\xd7\x52\x12\xa5\x66\x9b\xf7\xf3\x53\x5f\x3c\x5d\xa6\x57\x40\xb9\x30\x0d\xe9\x5d\x28\x65\x38\x99\x8b\x0c\x09\x48\x38\x95\xab\x38\x90\x5a\x31\x1f\x30\x73\xe3\xb0\xa6\x02\x70\x1c\x27\xc4\x73\x8f\x67\xfe\x9e\xea\xab\xe8\x9c\x7b\x9f\x1d\x3e\x78\x47\xc5\x5a\x93\x8c\x26\xd6\xc8\x00\x4e\xaa\x58\x2c\x69\x33\xa7\x02\x9e\xa7\x66\x31\x49\xac\xb4\x40\xc8\xfd\xc8\x6e\xd4\xd1\xa5\xfe\xf3\x14\xe2\x28\x13\x2c\x34\x54\xd3\xf7\x4f\x22\xd1\xfb\x19\xc7\x48\x64\xf3\x0c\x30\xfd\xcc\x72\x77\x28\xbc\x92\x57\xb4\x86\x30\xec\x85\x00\xb4\x0e\xfa\x00\x22\x45\xb7\x89\xd9\x08\xa6\x09\x49\xae\x98\xa0\xbe\xd3\xd9\x6d\x6d\xb2\x19\x68\x69\xb1\xbf\x96\xcd\x0a\x2e\xa9\x7b\xd1\x2e\xf4\x53\x0e\xaa\x06\x64\xa4\x5c\x05\x1e\x06\x3a\xa5\x43\xc7\xb7\x26\x04\x67\x3d\x49\xbb\x82\x4a\x20\x34\xac\xf0\x31\x67\x56\x79\x77\x93\xbe\x0a\xb2\x29\xdd\xd9\xe5\x0f\x07\x75\xf5\xa7\x14\x78\x1f\x7a\xf7\x1f\x4a\x45\xfb\xbd\xef\x24\x13\x44\x24\x1c\x44\xc3\xdd\x4d\xb3\xdd\x97\x72\x4e\x8f\x2c\xb2\x23\x51\xae\x45\x3c\x03\x3c\x40\xc9\xf0\xa0\xa3\x99\x61\x99\x63\xaf\xea\xac\x10\xbb\x61\x2d\x42\xab\x41\x89\xd4\xf5\x16\xbd\x75\x10\xc6\x61\xd1\x85\x92\x55\x8d\xb7\x3b\x00\x5a\xa9\x76\xd5\xb5\xe9\xa6\x6a\xc3\xc9\x82\x71\xca\xfa\xc6\x90\xf2\x2c\x46\x15\xa2\x87\xd8\xf0\x61\x21\x6e\xba\x64\x32\x64\x94\xea\x1f\x5d\xda\x48\x5c\xe3\xae\xcf\x93\xb9\x63\xd2\xb7\x08\x9f\x99\x08\x9a\x2b\x3f\xb5\x1b\xa0\x83\x34\x84\x46\xb0\x38\x69\xd3\xdd\x2b\xbb\x3c\xfa\x69\xd6\x2b\x10\xea\x69\xbb\x9c\xab\xe2\xb9\xf3\x3a\xc7\x45\xcb\x5d\xd6\xd9\xca\xba\xbe\x4d\x49\x7d\x29\xcf\x78\x8a\x10\x27\x67\xa5\x50\xa8\xdc\x6d\x1b\x30\x28\xcf\x12\x67\xe0\xc6\xbc\x64\xa4\xf4\xcd\xe8\x08\x0b\xce\x26\x33\x72\x8d\xe2\x3c\x4e\x60\x65\x7b\xea\x07\xbf\x6d\xc9\x37\x1d\xc0\xf5\x03\x9a\xbe\xb1\xbb\xd7\x28\x26\xd8\x24\x5f\xca\x8a\xfd\xd9\x57\x6f\x30\x86\xcf\x0e\x71\xcb\x41\xff\xe2\x3f\x1b\xe9\x82\x81\xc9\x80\x54\x10\xcd\x04\x2b\xdf\x01\x0c\x3b\x76\xbf\x6e\xfa\x65\x14\x5a\x5c\x9c\x4e\xd1\x79\x7b\x52\xf1\xfa\x8f\xc0\xfd\x1e\x82\x97\xca\x89\xde\x7a\x1d\x71\xf4\x41\x69\x04\x03\x55\xbd\x0a\x55\x9e\x6b\x8a\x36\x79\x54\xb4\x4f\x6c\x27\xf6\xc4\x40\xb5\xb4\x87\x51\x67\x84\x91\xb2\xf0\x95\x91\x00\x3a\x7e\x1b\x56\x8b\x73\xd3\x06\x34\x36\xe0\x91\x11\xfe\x26\xd2\xf7\xea\x09\xee\xdd\x6b\xb9\x06\x4a\xf6\x62\x87\x32\x8a\x22\x76\x40\x87\x8d\xf9\x5f\xb6\x7a\xc9\xe2\x83\x7d\xc2\x6f\x35\xb7\xab\x93\x33\x42\xca\x5d\x89\xda\xc0\x88\xcd\x23\x48\xb4\x06\x47\xf9\x86\x66\xa6\x53\x43\x83\x7b\x2e\xa5\x63\xcb\x8f\xcb\xb3\xfc\x69\xeb\xf2\xf2\x96\xda\xea\xe2\xa8\x2c\xbd\x33\x1a\x89\x61\x93\x3a\x22\x07\x38\xf9\x48\x91\x21\xd5\x45\x6d\xc5\xfd\x82\x00\xdb\x76\x96\x67\x33\xfb\xd9\xef\xc1\x2d\x2e\xcf\xd2\xe8\xa6\x37\xec\xda\x34\xb7\xa7\x7a\x57\xc7\x18\xc4\x4b\xb1\x84\x1f\x3f\x03\x2a\xff\x87\x59\x0e\xde\xd4\xcf\x74\xdd\xca\xba\x4b\x70\xf5\x62\x03\x22\x51\x39\x09\x1a\x7e\x78\xe5\xbd\xbd\x71\x6f\x90\x57\xba\xcb\x3c\x09\x00\x38\x8c\xfe\xde\xd0\xd1\xa7\x91\x02\x81\xe8\xd5\xb9\x30\x34\x0b\x13\x3c\xe7\x5c\xf9\xaa\x86\x12\xab\xc4\x54\x35\x18\x64\x02\xc0\x49\x70\xc0\x90\x40\x1c\x9e\x33\x64\x43\x58\x1a\x28\x14\xf2\xaf\xce\x68\x2d\x6b\xd0\x9b\x00\x34\x3a\x9e\x10\xeb\x7c\x22\xea\xe4\xd6\x32\x4a\x11\x19\xff\xa4\xd0\x2e\x93\x7f\x73\xbb\x8a\x11\x6b\xbe\x7c\x67\xba\x1c\xc5\x9b\x23\x06\xdc\xd2\x25\x42\x81\x32\xa1\xd4\x94\xcd\x1e\x31\xdd\xb8\x5e\x14\xb9\x77\x20\x05\x9c\xc7\x9f\xff\x82\x0e\x57\x63\xd8\x51\x8f\xf2\x20\x77\x56\x9e\x66\x9a\x5c\xcb\x51\xd7\xac\x69\x58\x60\x54\xd2\x0d\xee\x22\x58\x09\x5a\xd9\x6f\x45\x07\x9d\x52\xca\x61\x2c\x67\x85\xe1\x18\xb5\x31\xa5\x97\x22\x07\x81\x86\x2e\xbc\xb8\x7a\x59\xe1\x4d\x41\xc3\xc2\xca\xbc\x78\x85\xeb\x67\xa1\x1d\xa8\x86\x67\xa9\xf0\x3f\x4b\x3a\xa4\xe6\xd0\xbb\x6b\x12\x8b\xe7\x65\x38\x9a\x0c\x12\x25\x87\xb3\x66\xf7\x89\xa2\xb6\x3e\x22\x25\xc2\x19\xef\x2f\xc3\xee\x94\xcf\x89\x04\x4b\x60\xdd\x2a\x7f\x20\x64\xe4\xba\x1f\x4a\x7f\xb9\x46\x9f\x0b\x8e\x92\x25\x84\x08\xde\xb1\xa8\xe5\x06\xad\xf0\xcc\xda\x4e\x61\x23\x73\xd5\x1b\x24\xc7\x76\xb0\xab\x36\xd5\x22\x18\xa1\x15\xd3\xbb\xf7\xd9\x48\x5c\xf9\xa1\x20\x1c\x12\xa9\x50\x7a\x09\xd8\x10\x79\x2f\x6c\x10\x2b\x0b\x12\x66\xd9\x67\x29\xf8\x29\xe5\x4c\x0a\xcc\x18\x96\xf3\x02\xcd\xfe\xda\x82\xc4\xa8\xd3\x05\x2f\xd4\x5f\x79\x05\x85\xed\x60\xd4\x35\xbf\xe6\xf6\x76\x38\x11\x54\x47\x4a\xaf\x60\x2f\x23\x69\x89\x30\x2b\x9f\x3d\x04\x4a\xb4\xba\x6d\x50\x86\xa7\xfe\xe9\x83\x9c\x19\xab\xf0\x0b\x07\xb1\x26\x4e\xbd\xa8\x60\x42\x8f\x32\x33\x8b\x3a\x55\xac\xe5\x33\xf3\x73\xf6\x96\x57\x60\xfc\xa1\x90\xee\x2d\x61\x30\x09\x0f\x91\x6b\x97\x07\x6b\x9e\xb2\x89\x5c\x2d\x4b\xd5\xe2\x97\xce\x26\xc1\x3e\x8f\x80\xff\x1f\x1a\x25\xfa\x8f\xee\xba\x4f\xf3\xde\x57\x1b\x72\x18\xef\xaf\xc0\xed\xad\x7b\x54\x8c\x63\xf2\x99\x0b\x6a\xdf\x74\x14\xbb\xac\xd4\xab\x55\xf0\xa5\x6e\xeb\x14\x0b\x0e\x99\x34\x13\xb5\x8c\xc1\x32\xdf\x30\x71\xe5\xdb\x6e\x6b\xe3\xfa\x09\x41\xca\xd0\x1b\xe7\xa8\xc2\xe6\x2b\x91\xff\xab\xf3\xe6\x62\xa3\x36\x0a\xe7\x1b\x36\x30\x57\x8e\xe4\x59\x58\x24\x84\x2f\x74\x86\xd3\x47\xe8\xa4\x39\x92\xa1\x69\x7d\x07\x2d\x34\x9c\xe4\xc3\x6f\x68\x41\x2b\xee\xe1\x87\x5b\x6b\x05\xf7\xf0\x6a\x35\x3c\xae\x2e\x36\xb0\x99\xae\x09\x49\xcf\x95\xe7\x9a\x76\x8b\xc9\x73\x08\xc3\x4a\x95\x2b\xaf\xc1\x80\x8b\xd0\xf6\x84\xd5\x76\xbd\x97\x86\x18\x6b\x53\xf8\xb1\x3f\x5b\xe8\xa0\xe8\x0b\xd1\xcd\x88\x4a\x4a\x78\x27\xac\xf6\x56\x69\xdd\x7a\xf7\x7d\x6b\xaa\x1d\x45\xa4\x4f\x3d\xb0\x41\x74\x1a\x55\x80\xd6\xad\x3e\xff\xf5\x11\x1b\x33\xac\x88\x12\xbe\x7a\xe9\xc6\x80\x8d\x6d\x03\xf8\x93\x09\xaf\xc5\x70\x45\x41\x1f\x16\x28\x0f\x07\x19\x21\xd3\xcf\x4f\xd1\xbf\x9f\x98\x04\x00\x5c\x07\x65\xa5\x64\xbf\x8d\x67\x72\x2b\xee\x61\x9b\xcf\x1a\xfb\x0d\x8e\x82\xec\x41\xd1\xfc\x9a\x75\x2d\xf0\xa5\x11\x2a\x4d\x99\x7d\xc8\xa1\xeb\xbd\x9b\x81\xdf\x16\x55\x8a\xde\x55\xcf\xb1\x7c\x5d\xf4\x4b\x91\x83\x55\xba\xcc\xac\x32\x45\xc1\x06\x52\x83\x8b\xe5\x10\xdb\x5b\xab\x57\xb9\xac\x54\x7d\xc0\x7b\x06\x2b\x85\xf0\xd3\x7a\x50\xe8\x8c\x83\xb7\xdd\xdb\x3d\x3c\xc3\x3d\xf0\xe9\x2c\x9a\xd3\x2b\xf5\x57\xee\xca\x83\x7d\x5c\x60\xd7\x5a\x6c\x43\xbb\xec\x3b\x8d\xb2\x58\x37\xd9\x14\x12\x16\x11\x9e\xdd\x11\xc1\xc7\x97\x09\xb3\x61\xb1\x17\x8d\xd0\x1e\x24\xd5\xba\x04\x8e\xb4\xae\xb4\x7b\xcf\xd4\xb2\x42\xc7\x7e\x91\xdf\x56\xa2\xcf\x49\xc0\x53\xbe\x64\x00\xa6\x92\xeb\x85\xd4\x09\xc0\x38\xa4\xb9\xa3\xcc\xb1\xde\x65\xb4\xb3\x0c\xe1\x69\xfa\x76\xa5\x39\x5b\x77\xb6\xd1\x98\x24\x99\x97\xbd\xcd\xed\x0e\x25\xf0\xea\x82\x76\x6e\x51\xf7\x68\xf3\x86\x44\xb7\x8c\x51\x50\x13\xa2\x33\x21\xce\xf1\xda\x24\x5f\xc8\xe3\x8a\xed\x10\x77\xb0\xf6\x9b\xf9\x96\x31\x37\x45\x55\xd8\x8c\xc7\x53\xf9\x3f\xb0\xfa\x7e\x2f\x04\xa6\x70\x88\x2c\x99\x3d\x6a\x05\x63\x32\xdb\x20\xb0\x14\xd5\x9d\x4d\xab\x41\x64\x41\xd8\x05\x8c\xdb\xc5\x1f\x6a\x45\x7b\xc8\x46\x60\xad\x48\x91\x45\x52\x0c\x61\xd5\xcd\x9b\xa2\x00\x20\x04\xfe\x5d\x1b\x45\x4e\x2f\x97\x4d\x37\x35\xf1\x71\x65\x9a\x6a\x62\xb2\x6f\x35\xcf\x61\xd7\x62\xa2\xab\xb2\xf4\xf2\xc6\xe4\xed\xff\x37\x6c\x9a\x6d\xec\x86\x76\xfe\xdb\xa7\x32\xbb\xa8\xf8\x49\x9b\x81\xdf\xf0\x85\x16\xbc\xf0\x87\xdb\xe6\xef\x9b\x15\xdf\xe4\x28\xb1\x20\xd4\x91\x64\xb2\x27\xbb\x1a\xd3\x4a\x0f\x7c\xe8\x59\x72\x38\xab\x53\xb6\xb1\x87\xb6\xd4\xdc\xeb\x4e\xa0\x06\xb2\x2d\xa0\x76\x09\xaa\xaa\x48\xf1\x35\xdc\x53\xb6\x88\x0c\x06\x08\x32\x3f\x0a\x39\xe1\xc8\x9e\xc2\xc7\x63\x40\x3c\x01\xb4\xe3\xb4\xac\x59\xff\x4a\x39\x9c\xd9\x8b\x8a\x24\xda\x4b\xa9\x68\x78\x16\x17\xd3\xb4\xb4\x1e\x06\x5d\xd9\xd6\x99\xf9\x9b\xe4\x0b\x9b\xc5\xc3\x52\x9a\x29\x69\xd0\xfe\x8a\x18\x80\xc9\xd3\x29\x5f\x37\x6a\x16\x53\x24\x87\x67\x39\xdd\xba\x38\x93\xe2\x68\xcc\x13\xf8\x56\x47\x04\x0c\x69\x5e\x7c\x20\x11\xd5\xf9\x77\xec\xd4\xbd\xa5\x5e\x4b\x6c\x26\xc3\x0a\x3a\xfa\x8f\xeb\x03\x3c\x89\xd4\x85\x0f\xa7\x7e\x53\xa6\xc2\x3d\xf7\xa1\x97\xed\x35\x1c\x44\xbe\x1b\x7c\x08\xbb\xe6\xa3\x25\x98\xf6\xba\x8b\xed\xce\x5b\xf5\xb9\x3f\x17\xe8\xb1\x25\xe5\x8c\x05\xfd\x85\x42\x87\xc7\x26\xb6\x56\xa3\x49\xe1\x00\x15\x15\x19\x90\xc7\xcd\x60\xed\x12\x37\xfd\xb6\x7f\xdf\x68\x92\xfe\x6c\x61\x34\xa5\x14\xa2\xf7\x79\xca\xba\xba\x0d\x13\x99\xb4\x3c\xd0\xf7\x0b\x33\x72\xec\xe2\x7d\x63\x81\x0c\xf2\x49\x10\x6b\x74\x8a\xe3\x7a\xc0\x9f\x11\xca\x7f\x0a\xc7\x27\xc0\x97\xb0\x54\x11\x18\x57\x31\xff\xde\xfd\x2f\xef\x5c\x06\x91\xe5\x91\x5b\xff\xae\xfd\x16\x01\x23\x67\x2e\xe5\xab\x1f\x6d\x6f\xa4\x5a\xd2\x5f\x60\xe6\x37\x10\xfc\x2d\xd3\xd6\x45\xb7\xae\x62\xdf\xc6\xb3\x5c\xb0\xff\x86\x3f\x0c\x4d\x8e\x96\x41\xb4\x29\xc9\x85\x6b\xc0\x90\xea\x96\xc2\x88\x2a\x86\x05\x25\x5e\x4f\xcf\xa2\x98\x33\xfc\x94\x73\x34\x8c\x0e\x8a\x4a\x19\xc5\x12\x27\xac\xf4\x1c\xe4\xb0\xd8\xda\x63\x39\x06\x7b\x91\xc6\x21\x22\x34\x2b\x84\x41\xed\x08\x89\x3a\x29\xde\x8b\xf5\xed\x8c\x6e\xb4\x63\xb7\x1a\x0e\xda\x76\xe7\x26\x5a\xae\x39\xa7\x3d\x73\xcf\x39\xf9\x1d\x7f\xc0\x42\x79\x68\x0c\xa5\xcb\x7c\xad\x06\xac\x6e\x50\xb8\xef\x96\xb5\xee\x0a\x1d\x24\x8d\x02\x3a\xf4\xc8\x39\xbc\x87\xcd\xd9\x12\xac\x29\xa2\xf8\xa6\x69\x19\x93\xe9\xee\x22\x7f\x74\x13\x13\x81\x0a\x8f\x2a\x8a\xe4\x47\xb4\x7e\xe0\x21\xe5\x0b\x6a\x51\x14\xc7\xcd\x54\x40\x7c\xf9\xab\x47\x51\xd6\x1d\xa5\xed\xb5\x66\x30\x3d\x66\x79\x5e\x98\x97\xa4\xdd\xe9\x61\x3f\x52\x0d\xfd\xdc\xfc\x96\xda\xbd\x27\x6f\x51\x8a\x7c\x39\x6f\x74\x4a\xf1\x6f\x59\x29\xa0\x76\x38\xc4\xd8\xb1\xd5\x38\x2b\x0c\x05\xf1\x1e\x2b\x54\xd7\x63\xca\xc1\xb7\xb5\x53\x6f\x33\x9c\x7f\x2e\x76\x4b\x67\x25\x4e\x78\xf6\x80\xfb\xbd\xb1\x1e\x32\xe5\x62\xfa\xca\xd0\x90\x5e\x13\x5f\x35\x88\x48\xd1\x97\xcc\x80\xa5\xfd\x83\xa4\xd1\xb2\xed\xea\x6a\x0a\xd8\x0f\x4e\xde\x8f\xf0\x0b\x56\xc8\x3e\x16\x71\x27\xa3\xc4\xdf\x64\x50\xe9\x41\x0a\x6a\x54\xec\xdc\xad\xc1\x40\x32\x9a\xdf\x1e\x81\x8c\x6f\xcd\x1f\x87\x42\xc0\x12\x01\xed\xa1\xfe\x76\x4c\xfa\xcf\x12\x51\x4e\xe4\x0e\xe3\x4f\x6d\xc7\xa2\x74\xd8\xbc\x37\x8b\x49\x20\x47\x94\x74\x0a\xa7\x29\xb8\xb5\xf0\xaf\xf0\x65\x6c\xfd\xc2\x87\xd0\xe6\x71\x93\x4b\x13\x32\xc8\x97\xaa\x85\xa3\x86\xf7\xd7\x5a\x4d\x1d\xc0\xc3\xd1\xd9\x87\xdd\x46\x68\xeb\x9c\xfa\x32\x7a\xb2\x5d\xb8\x4d\xf7\xd2\x38\x7e\xe1\xba\x85\x5a\xf7\x39\x4a\x17\x3f\xf5\x1c\x2d\xd0\x53\x71\xa3\x27\xb6\x61\xdc\xdf\x27\x7a\x61\xd7\x2e\x96\x4e\xa5\x30\x9e\xf1\xf7\xde\x83\x57\x25\xd1\x6d\x2c\x9f\xac\xa2\xbd\xb5\x81\x4b\x66\x08\xa9\x29\x3e\x3a\xb6\x4d\x0e\xf8\xb2\x3e\x59\xe2\xd4\x8b\xf8\x2c\x88\x29\x42\x9b\x17\x13\xe3\x79\x0e\x12\x77\x22\x72\xf3\xfb\x62\x19\x4d\x64\x12\x69\xb7\x5e\xe9\xea\xbe\x3e\xdb\x35\xb1\x4f\x8c\xb8\x45\xe2\xab\x7b\xac\xab\xc1\xcc\xcb\x6d\x00\xfb\x69\xdf\x1b\x89\x82\x65\xdb\xcd\x58\x5f\x13\xf9\x2a\x12\x52\xd8\xfa\x05\xf2\x43\x9b\x4b\x18\x21\x72\xcf\x3d\x84\xa2\x8e\xd8\xb4\x17\xe9\x66\x21\x35\x33\xf9\xdd\xb3\x1a\x44\x84\xd8\xc1\x0a\xb0\xaa\x67\x92\xbd\x21\x39\x4f\x63\x5c\x8f\xb9\x61\x01\x99\x3c\x69\x33\xea\x0c\x9d\x1d\x47\xc3\x80\x70\x7a\x80\x3b\x6c\xe3\x20\xab\xa9\xee\xf7\xad\x0d\x0e\x6d\x1a\xa7\xcc\x2e\x72\x37\x86\xf4\x0b\x11\x22\x44\x0d\x59\x23\x3a\x9c\xfe\x3e\xa5\xd0\x47\x1a\xb4\x16\xf5\xb8\x4e\xf7\xa4\xd8\xba\xea\xd7\xbe\x53\x71\x67\xa9\xfa\xbd\xd1\x18\x58\x26\xe7\x7a\x28\x3b\xb9\xf4\x6c\xcd\x81\xa9\xcf\x4e\x1c\xf2\x4c\xf0\x6d\x14\xe0\xb8\xdf\xe2\x53\x8c\xc1\xf1\x54\x73\x63\xfe\xa0\x03\xef\xb0\xde\x38\x26\x52\xa1\x7a\x1e\xfb\xb9\xc6\x40\xfd\x12\xdb\x1a\x19\xf7\xee\x01\xf1\x48\xfe\x89\x45\x88\x4c\x6d\x11\xc1\x31\xd8\xa0\xd6\xe6\x14\xe6\x94\xab\x52\x6d\x39\x63\x87\xf7\xd4\x59\x61\x18\xd5\xef\xa5\x57\x2b\x1c\x3f\x40\x94\xd6\x9d\xc4\xb5\xb4\x55\x03\x54\x48\x41\xb5\xdb\x20\x78\x2c\x0a\x0c\x60\x16\x7b\xd6\x2d\x61\xe6\x1d\xf8\xe2\xe9\xce\x31\x72\xbc\xbb\x57\x96\x5b\xf7\x0a\x59\xa9\x78\xcf\xec\x27\xbb\x78\x12\xbe\xd6\x19\x0f\xcd\xd1\xef\xb3\xa2\x42\x47\xb6\xf8\xaa\x9e\x08\xfc\xb3\x17\x4c\x12\xef\x20\x98\xe2\xf3\xdf\x9a\x3e\x8e\x0e\x1e\xc7\x48\x29\x62\xdb\xd5\x7b\x5e\xd3\x6f\x15\x77\xf3\xf5\x5a\x11\xed\x17\xb6\x9c\x85\xbe\x12\xf8\x9c\x19\x24\x13\x45\x0d\xd1\x35\x36\xbb\x98\xa9\x36\x73\xc2\x6b\xbf\xba\x00\x6b\x38\x32\x59\x9f\xc9\x83\xa6\x73\xbf\x88\x0b\x21\x6e\xa2\xa3\xef\x9e\xc5\x3f\xb8\x2b\xf1\x8e\xb5\xf3\xf6\xfa\x44\x8d\x45\x75\x0d\x8d\x83\x60\x38\x26\x0a\xdf\x34\xcf\xc0\x1e\x47\x9d\x99\x4f\x28\xa7\x95\x7c\xd1\xfe\xe7\x9a\x7f\xd9\x99\x58\x82\x59\x46\xbc\x46\x64\x39\xec\x09\xeb\x8f\x61\x1e\xe0\xee\xee\xe4\x61\xda\x88\xf1\x34\xa1\x70\xcf\xd5\xa3\xe0\x2a\xa0\x15\xdb\xab\xe8\x69\x81\x46\x99\x35\xee\x28\xa3\xe3\x7e\xf6\xed\xc1\xcc\x7f\x85\xf4\xb1\x88\xc1\x2f\x70\x1d\x91\x9b\x7f\x35\xa9\x6c\xb6\x7c\x27\xce\xbd\x6f\x33\xb1\x6b\x16\x3f\x13\xea\x65\x3e\x3c\x44\xfe\x13\x07\x6a\x57\xb4\xe3\x69\x37\x12\xcc\x55\x7e\x7f\x3b\x0e\x4c\x3c\x9f\x5f\x80\xab\xf8\x4e\x49\x7f\x7b\xaf\x88\xcc\xdd\xb3\x0d\x88\x61\x7e\xd0\x11\x80\x1d\xd7\xa2\x5a\xad\x4e\x75\xde\x4f\x30\x2b\x16\xa5\x6f\x99\xca\x78\x2e\x93\x0a\x3d\x22\xb9\xf6\x10\x29\x69\xef\x50\x3f\x68\x36\x04", 4088));
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x5000940e, /*arg=*/0x20000140ul);
break;
case 2:
NONFAILING(*(uint64_t*)0x200018c0 = 0x100);
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40089413, /*arg=*/0x200018c0ul);
break;
}
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
setup_sysctl();
setup_cgroups();
setup_binfmt_misc();
setup_usb();
setup_802154();
setup_swap();
install_segv_handler();
for (procid = 0; procid < 8; procid++) {
if (fork() == 0) {
use_temporary_dir();
do_sandbox_none();
}
}
sleep(1000000);
return 0;
}
[-- Attachment #6: btrfs_get_root_ref-repro.prog --]
[-- Type: application/octet-stream, Size: 36621 bytes --]
# {Threaded:true Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Repro:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
r0 = syz_mount_image$btrfs(&(0x7f0000000040), &(0x7f0000005140)='./file0\x00', 0x0, &(0x7f0000000080)={[{@treelog}, {@max_inline={'max_inline', 0x3d, [0x6b, 0x0, 0x6b, 0x36, 0x37, 0x33, 0x30]}}, {@check_int}]}, 0x0, 0x50ed, &(0x7f00000051c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTsT3573JENYvrOR3E/wmHm5XUpgfKxQ6WkmPbbFHXpgfLxQ65pIemydDeHBhZX9S+H8stJPClbV54UhSOB0L+fnQLRxLCifimfb52ny6aeH7WMgvsJiPV1Cs6V4SkfS42q/HQuGGPc52Dw4AAHBPieE5z7Jjvc2QRtn52qAdVg/aYWTQDvVBO4wmO6Q79tseZnsLcXv7zMalPf//yHD5P74Vq7JFv+v/Q7z+P3+uYff6/9lYaCSF+VhopXcMaMVjZGH343iMRivvcWV9twAAAAB3tfi9QH2F5wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAP+zda4xc1X0A8LPP8T68XkiqEBolm6TGcROv1zaQqKXKmlI1IqVZNxRURRQbe00WL9ixTYlRiIxNRCMEpQ1S8qEIoyiq+QC1AhFJAeEixREqj4iqKIBAoTVEQaSUJCJNkEI1e++ZvXPuzsOPNV76+0neOTP/87zz8Jx775wLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPD/w8GvXPO3zeKP/va8Z1+4ePyKPWsvfvW68059MoSJmcc7snBH/423j//87nPv2fPA6jvuO3z+R3vzcnk8DFT/dOZ3boi1Hl4cwv0dIXSngRWDWaAnvz8Y63vfYAinhNlArcRkf1YibTh8vy+EfWE2UKvqe30hDBYCFz71yMM3VxO39YWwNIRQSdt4vpK10ZcGzujNAv1pYGt3FvjVW5la4LudWQCOWXwz1F70BybqMwzPXa7B66/nuHXs7ZUOrysmhhvn+9naee5UQW/6wMQxPW2l6pgXpbfHQe+2BfBuK23nWz1txS9S+TeUt2ZDldC5aXLzhqund8ZHOsPoaFejmubpeX7m9S9tPJL0gnkdxg4MH5fX4S1PLL27a/kFj9+3YunL+z+295Vj7eaPCpu0mJ5vlZC/5hbM8xiN+zxZAG+/0rekEV+6QgibP/97n2kWL83/h5vP/+PLOd521uWOtb45lM3N4yODMfHaUDY3BwAAgAVjIew13Tr60Cea1Vea/4+0d/w/HvLPJ/PZaA+GMD6T2LskhNNmHs8Cd8XmLlsSwgdnUhP1gbVJ4GAI751JLK9VlZRYFEuMJIGfDOWB8SRwKAYmksC3YuDWJHBDDBxIAhtj4GASODcGwlT9OH5/KB9H24G+GFifbcQD8SyEXwzF1pJt9VytKgAAgOMknx321N8tnOtwrBni9PJAX6sM8QzshhkqSQ3pDLY2rWpYQ3erGjpb1VAb9+7mwy/V3NGq5tJpGB31GW7/5d98NjRRmv+PNZ//V+boSEfp+H8I62b+xtydeWS6Fl8/UZcBAAAAOAYD//viN5vFS/P/8fbO/4/7RLoKmcNjcTfEliUhjNUHsmr/sBzIjnoP5AEAAABYCGrH42vHwqfy2+wU7XQ+Xc4/cYT544H/8Tnz9x58cH2z/pbm/xPtnf/fX3+bdeJQ7MXXloSwqBD4QexlNTBjJAZ+/Mn6QD7+Q3ED3BSryk9MqFV1UyyxPgbGksC+RiV+WCtxWn0gf7Jqje+tjWMqL1EIAAAAwAkXdwfE4/Lx/P8P/Wb1Nc3Kleb/64/s/P+ZeXDp9P7pgRBWdofQlf4w4LH+bGHAGBjsyBMP9Wd1daVVXd8fwjnVgaVVvZiv/9+drjH4VF9WVQyc9qH9r59RTXyzL4SVxcDTn7vzrGpiZxKoNf6XfSF8oDratPHvLMoa70kb//qiEN5fCNSqumxRCNXGetOqHqnk1zFIq/rnSgjvKgRqVZ1dCWFXAGCBiv+Vbio+uGPXtVs2TE9Pbp/HRNyH3xc2T01Pjm7cOr2p0qBPm5I+1y1jdH15TO1e+ea5fImii+5dN9hOuvY7wbFiW/l+/NKJg/n9+F2oZ2acq3vq7q5Jh/yRD5ebCIVvUo2G3DnPQ+4vVjL7JJbqj/l7w0BYdPWOye2jX9ywc+f2VdnfdrOvzv7Gw0zZtlqVbqv+ufrWxsuj4WpZiaPdVsuKlazceeW2lTt2Xbti6soNl09ePnnVqrNXj505tmbs42eurI5qLPvbYqjL5qo6Gepbd7Y5ruM41NO7C5WciE8NCQmJhZbYOrCs6f/Jpfn/tubz//ipEz/58/UZGh3/H46H+bPHZw/zr4+Bfe0e/x9udDS/dmLASBLYHQO7HeYHAADgnSFO8uPezLhX+qfLv/Nys3Kl+f/u9n7/f5zW/68tXX9+o2X+l8cSY43W/0+X+a+t/7+70fr/6TL/tfX/970N6/9fXQskm+QX1v8HAADeCU7c+v8tl/dPLxBQytByef/0AgGlDC2X8W/3AgFHvP7/8//5V/8dmijN/29tb/5v4X4AAAA4eXz5z675nWbx0vx/X3vz/xO//l9odP7/SKPARKOFAa3/BwAAwALVaP2/4Rv7L21WrjT/P9De/D+edtFZlzvW+uZQtqZdSNe0e22o9pMBAAAAWBg6w+hoT5t561ZGXXv0bT6TLwXaLF304p8cPrLz/w+2N/+v+13GLU8svbtr+QWPv3nfiqUv7//Y3ldmj/8DAAAA86fd/RIAAAAAAAAAAAAAAMDb78X/2LOmWbz0+/+wbubxRr//j9f9i78veHdd7lhr6/X/8vsXfvqeXTNLFj42FMKHi4Ete7acEvJr8y8rBh6+ZPl7qok9aYkHXzj3pWri0jTwqRWnvlFNnJME1sdFEt+bBuJVFd9YnATi8or/ngbi9jiQBnrzwFcXZ+PoSLfVTwezbdWRbqtnB0NYUgjUttX9g1kbHekAb0sCtQF+IQ3EAf55HuhMe3XPQNarGBiMRe8YyHoFAMBJK34L7Ambp6Ynx+JX+Hh7enf9bVS3ZNn15Wo72mz+uXxpsovuXTfYTror/S46e63xnlCpDmFV6etqMUvHzCiPTy0tNt27Gwy51WpvnQ3KpY500/U2HlFfNqLRjVunN/W0HPia1llWd7fMsqo02Slm6ZzZpG3U0kZf2hhRm9umjS7H+51hdLQryfUHMTgc6rR6RbT7e/3iOn+NXgXFPFcd3vurZvWV5v/D7c3/K8VxvZFfDGB3vLLe3y2xzD8AAADMr6+u/fU34r/P3vjo083ylub/I+3N/+MerPxQcLa342C8/v/eJSHMXFp/OAvcFZu7bEkIH5xJTcQS2QX1z48lxrLAXXGHyfJYYv1EfVWLYuBAEvjJUB44mAQOxUC+l2J/yHfl/P1QCGfNpNbVl9gWSwwngc/EwEgSGI2BsSSwOAbGk8Cri/PARBL4txgIU/Xb6t7F+bYCAAA4Evk8q6f+bkjneQe6W2XoaJWhv1WGzlYZKq0yNBpFvP/tmKEnOXmlo5CpJ621L6mllCFeDP+I+1XKEH5YnzMtWGo6nn9QO9+goz7DA5/oroQmSvP/sfbm//31t1nrh+L8f/b6f1ngB7F7X4unjo/EwI8/WR/IdwwcipPdm2pVTeQl8kn7TbHEeAyMJIFtMTCeBNavywP73lMfyGfatcb31hqfyksUAgAAAHDCxR0EcTdNnP/fseMrA83Kleb/4+3N/2N7A8XGboi1Hl4cwv0ds72pBVYMZoG4H2Mw/jz+fYMhnFLYwVErMdmflehNGg7f78t+od6bVvW9vuzHB/H+hU898vDN1cRtfSEsLex9qbXxfCVroy8NnNGbBfrTwNbuLBD3/NQC3+3MAnDMansF4wsqP9WlZnjucg1ef++Ua4KmwyvtA50j31y/uZovpR2u+T7VmiN72pruv+W4Kb09Dnq3LcR327B3W/GLVP4N5a3ZUCV0bprcvOHq6Z3xkeIvWUvm6Xku/kq1nfRxeB3uPvretlZJOzCWfHyMzV1u7tdhR6zulieW3t21/ILH71ux9OX9H9v7StvdaCD+UPiR6/518EeFzTvfKiF/zS24z5MJnycL8b+BEU9bCGHdq1+/qVm8NP+faG/+353czvh13Jg7loTwkcLGfSxu/j9ekn0OFgLZp+S7yoHskPt/DTX85AQAAIDjrba7o7a/YCq/zU4IT+fJ5fwTR5g/7q8YnzN/u/3u/+tLljaLl+b/65vP/xcl3XT83/F/5onj/3M62XdFL0of2H1Mu6JL1TEvHP+f08n+bnP8f06O/zv+PxfH/1tw/H9OJ/vTVvqWtM2XrhDCy3/00LPN4qX5/7b25v/W/5t70b7a+n/rG63/t63R+n+7rf8HAADMqwYLzaXzvNLqfaUM6ep9pQwtFwhsucSg9f+OeP2/l05//jehidL8f3d78//4chgotr5Q1v8bWdegqltjYJuFAQEAADgZNdpBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNvrgX/4n03N4o/+9rxnX7h4/Io9ay9+9brzTn0yhKmZxzuycEf/jbeP//zuc+/Z88DqO+47fP5HK3m5nvz2d+tyx1rfHAphX+GRwZh4bah6ZzZw4afv2dVdTTw2FMKHi4Ete7acUk18ayiEZcXAw5csf081sSct8eAL575UTVyaBj614tQ3qolz8kBH2t1/XJx1tyPt7s2LQ1hSCNS6e8Xi+qpqbfxpHuhM2/inwayNGBiMRb8xmLURA9OxxNSiEFZ2h9CVVvVoJauqK63qXypZVV1pVV+uhHBOCKE7reqF3qyq7nTkT/ZmVcXAaR/a//oZ1cS+3hBWFgNPf+7Os6qJLySBWuN/0RvCB6ovmbTxb/dkjfekjd/WE8L7Qwi9aYlfdmcletMSL3aH8K5CoNb457tD2BV4R4gfPnWfaDt2Xbtlw/T05PZ5TPTmbfWFzVPTk6Mbt05vqiR9aqSjkH7r+qMf+3Ovf2lj9faie9cNtpPuzsv1zHR5dU/d3TUne+9jv/qLlcw+H6X6Y/7eMBAWXb1jcvvoFzfs3Ll9Vfa33eyrs79deTTbVqsWyrZaVqxk5c4rt63csevaFVNXbrh88vLJq1advXrszLE1Yx8/c2V1VGPZ3+Mx1DtP/FBP7y5UciI+ACQkJBZaorPu023sZP8gL33Rn+1oT6jMfECXphXFLB0zozweg157lCM+mu8pLUe0qjRxKGVZ3TrLmtJkYjZLX5Zl5ntdaXJYrKlzZpPG+51hdLSr0XYYrr9b3Lw/O4bN+0y+6dpNAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwf+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwLAAAAAAgzN86jJ4NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALgUAAD//wNUIwc=")
ioctl$BTRFS_IOC_SUBVOL_CREATE(r0, 0x5000940e, &(0x7f0000000140)={{}, "03fd690243fbb3d1a779babf540672330de4cc8117f77bcaa59159a7392efab8f418b4b67c76f1d5ab6610d2d4bb055fc0f0575b11d3d52d3321ea4874faac1ce0e1f8ee003db7a0ec48c7c80907292eeb2cde0821bf4ee27f3fb87c9de2b22a2f23774d881590cd000f5e4b6ac3ff649fd1818b40081ffd9aa076f9f8b27b19138721bc594ee4dffc2f3d8d9512eaae9ef8c86b07435c368daa308d52c4dda6f4b19f80d5a5184c61ce670cee712cb924c2a815d59cd201fd768b448360aa38a2028c4b4a246f361405fe0245ca0ab0c3ec2fac76cc2829a87f28299955c9bf7058c708158fae98ff28303861238ef39587acede751af7c5476bcbef0eefa840a1e6c4eca780158f7d65ffab3adc282e257418155c97a7216a6d19939d6067d7481c64acff66fc296fe780defc4abbf2661bccd8515725f97a9fc30a7cc28d680fda0aaf02d7180a9981f91421c58c532fcb3681291f92cfcbf8092165d9577a2b397aebd170c41aa0796165378dd231a4e0185f463bd43830e5373e13a29d75a9be463c7810d22fd082b0fba3836b75f544eec52f8883fa50856502f714fde7c462185daae944a8d8552ce874f2a47b4e89725b05ebab589c0b53f1e04de1a45e2153cd0abc3cf713f227609e53e8131aade35c5d922dfaadd84aa401d537b5df3db828a5b1d76e49b04134bc14a7bae5d329ed0148863f450accdf77a40ed75ad0bc63455c3b5a70ac4c9083db5bce5550d035dd44e3f54840bb64b97472b61ab57298d25104fbcdac731b6abf8bcfe19e218eb3f22a22a8cb6f2381ded5912de78f995dcc20a31c3ab64efa0e88228f41f0c98c0f1cf03221fbbd1b23f5cc29bfff764c663a0a6b77ed5988990a25c6f35aea539e1b1d204aed0454e30d23bcf057dfbe63868a993e1282ee79ae9c8b2f7f5369cae4043e7509f096755179957434e29099875886cd1605858a03a0b5a4e4344289013894502f0b13a795a6a2b351f3b402cbac4e80c20031e687decc66e5545efa85e70e8381b2884fe520853663884aab81f0ee86a19bc2bcbf274265ee2c5e792aa21152956d728673f2c4dde0844e860ea325c5d9a3e243365b01dc3e1620756c02b334f472ab27558bf71a15827cd0a63445287518155470a189158cdf6b54fb8cee40460867f6b6915c522f8a799d721ca5bc41816c61182e1becc5f4a44581781ed819c52e924f3a09543e9849a18e8a6621dd269943422b3041c55c0df3879467850b8ac9f06052422b904a515fb78b04b119e94f00e5633f79c8a936e45d012a5c389f556bd1be7695ce723a81c57d8637993bb612c88134cc056e02336953408fee8bdedd043eea2090c5a51693b1a1f5b55698f5d94a96cb02a82f883afc9185bed5b2cf5c318d02a35d75212a5669bf7f3535f3c5da65740b9300de95d286538998b0c09483895ab38905a311f3073e3b0a602701c27c4738f67fe9eeaabe89c7b9f1d3e7847c55a938c26d6c8004eaa582c6933a7029ea7663149acb440c8fdc86ed4d1a5fef314e228132c3454d3f74f22d1fb19c74864f30c30fdcc727728bc9257b48630ec8500b40efa002245b789d908a60949ae98a0bed3d96d6db2196869b1bf96cd0a2ea97bd12ef4530eaa0664a45c051e063aa543c7b72604673d49bb824a2034acf0316756797793be0ab229ddd9e50f0775f5a714781f7af71f4a45fbbdef241344241c44c3dd4db3dd97724e8f2cb22351ae453c033c40c9f0a0a399619963afeaac10bb612d42ab4189d4f516bd7510c661d18592558db73b005aa976d5b5e9a66ac3c98271cafac690f22c4615a287d8f061216eba64326494ea1f5dda485ce3aecf93b963d2b7089f99089a2b3fb51ba083348446b03869d3dd2bbb3cfa69d62b10ea69bb9cabe2b9f33ac745cb5dd6d9cababe4d497d29cf788a102767a550a8dc6d1b3028cf1267e0c6bc64a4f4cde8080bce2633728de23c4e60657bea07bf6dc9371dc0f5039abeb1bbd72826d8245fca8afdd9576f3086cf0e71cb41ffe23f1be98281c9805410cd042bdf010c3b76bf6efa65145a5c9c4ed1797b52f1fa8fc0fd1e8297ca89de7a1d71f44169040355bd0a559e6b8a367954b44f6c27f6c440b5b48751678491b2f09591003a7e1b568b73d3063436e09111fe26d2f7ea09eedd6bb9064af66287328a227640878df95fb67ac9e2837dc26f35b7ab933342ca5d89dac088cd2348b40647f98666a65343837b2ea563cb8fcbb3fc69ebf2f296daeae2a82cbd331a8961933a220738f9489121d5456dc5fd8200db76966733fbd9efc12d2ecfd2e8a637ecda34b7a77a57c718c44bb1841f3f032aff87590eded4cf74ddcaba4b70f56203225139091a7e78e5bdbd716f9057bacb3c0900388cfeded0d1a7910281e8d5b930340b133ce75cf9aa8612abc45435186402c04970c090401c9e336443581a2814f2afce682d6bd09b00343a9e10eb7c22eae4d6324a1119ffa4d02e937f73bb8a116bbe7c67ba1cc59b2306dcd225428132a1d494cd1e31ddb85e14b97720059cc79fff820e5763d8518ff22077569e669a5ccb51d7ac69586054d20dee2258095ad96f45079d52ca612c6785e118b531a597220781862ebcb87a59e14d41c3c2cabc7885eb67a11da88667a9f03f4b3aa4e6d0bb6b128be765389a0c122587b366f789a2b63e2225c219ef2fc3ee94cf89044b60dd2a7f2064e4ba1f4a7fb9469f0b8e92258408deb1a8e506adf0ccda4e612373d51b24c776b0ab36d52218a115d3bbf7d9485cf9a1201c12a9507a09d810792f6c102b0b1266d96729f829e54c0acc1896f302cdfeda82c4a8d3052fd45f790585ed60d435bfe6f676381154474aaf602f236989302b9f3d044ab4ba6d5086a7fee9839c19abf00b07b1264ebda860428f32338b3a55ace533f373f6965760fca190ee2d6130090f916b97076b9eb2895c2d4bd5e297ce26c13e8f80ff1f1a25fa8feeba4ff3de571b7218efafc0edad7b548c63f2990b6adf7414bbacd4ab55f0a56eeb140b0e993413b58cc132df3071e5db6e6be3fa0941cad01be7a8c2e62b91ffabf3e662a3360ae71b3630578ee4595824842f7486d347e8a43992a1697d072d349ce4c36f68412beee1875b6b05f7f06a353cae2e36b099ae0949cf95e79a768bc97308c34a952bafc1808bd0f684d576bd9786186b53f8b13f5be8a0e80bd1cd884a4a7827acf65669dd7af77d6baa1d45a44f3db041741a5580d6ad3efff5111b33ac8812be7ae9c6808d6d03f89309afc57045411f16280f071921d3cf4fd1bf9f9804005c0765a564bf8d67722bee619bcf1afb0d8e82ec41d1fc9a752df0a5112a4d997dc8a1ebbd9b81df16558ade55cfb17c5df44b918355baccac3245c10652838be510db5bab57b9ac547dc07b062b85f0d37a50e88c83b7dddb3d3cc33df0e92c9ad32bf557eeca837d5c60d75a6c43bbec3b8db25837d9141216119edd11c1c79709b361b1178dd01e24d5ba048eb4aeb47bcfd4b242c77e91df56a2cf49c053be6400a692eb85d409c038a4b9a3ccb1de65b4b30ce169fa76a5395b77b6d198249997bdcded0e25f0ea82766e51f768f38644b78c515013a23321cef1da245fc8e38aed1077b0f69bf99631374555d88cc753f93fb0fa7e2f04a670882c993d6a056332db20b014d59d4dab416441d8058cdbc51f6a457bc84660ad489145520c61d5cd9ba2002004fe5d1b454e2f974d3735f171659a6a62b26f35cf61d762a2abb2f4f2c6e4edff376c9a6dec8676fedba732bba8f8499b81dff08516bcf087dbe6ef9b15dfe428b120d49164b227bb1ad34a0f7ce8597238ab53b6b187b6d4dceb4ea006b22da07609aaaa48f135dc53b6880c0608323f0a39e1c89ec2c763403c01b4e3b4ac59ff4a399cd98b8a24da4ba968781617d3b4b41e065dd9d699f99be40b9bc5c3529a2969d0fe8a1880c9d3295f376a165324876739ddba3893e268cc13f85647040c695e7c2011d5f977ecd4bda55e4b6c26c30a3afa8feb033c89d4850fa77e53a6c23df7a197ed351c44be1b7c08bbe6a32598f6ba8bedce5bf5b93f17e8b125e58c05fd854287c726b656a349e10015151990c7cd60ed1237fdb67fdf6892fe6c6134a514a2f779cababa0d1399b43cd0f70b3372ece27d63810cf249106b748ae37ac09f11ca7f0ac727c097b05411185731ffdefd2fef5c0691e5915bffaefd160123672ee5ab1f6d6fa45ad25f60e63710fc2dd3d645b7ae62dfc6b35cb0ff863f0c4d8e9641b429c9856bc090ea96c2882a8605255e4fcfa29833fc9473348c0e8a4a19c51227acf41ce4b0d8da6339067b91c62122342b8441ed08893a29de8bf5ed8c6eb463b71a0eda76e7265aae39a73d73cf39f91d7fc04279680ca5cb7cad06ac6e50b8ef96b5ee0a1d248d023af4c839bc87cdd912ac29a2f8a6691993e9ee227f741313810a8f2a8ae447b47ee021e50b6a5114c7cd54407cf9ab4751d61da5edb566303d66795e9897a4dde9613f520dfddcfc96dabd276f518a7c396f744af16f5929a07638c4d8b1d5382b0c05f11e2b54d763cac1b7b5536f339c7f2e764b67254e78f680fbbdb11e32e562facad0905e135f358848d197cc80a5fd83a4d1b2edea6a0ad80f4ede8ff00b56c83e167127a3c4df6450e9410a6a54ecdcadc140329adf1e818c6fcd1f8742c01201eda1fe764cfacf12514ee40ee34f6dc7a274d8bc378b49204794740aa729b8b5f0aff0656cfdc287d0e671934b1332c897aa85a386f7d75a4d1dc0c3d1d987dd4668eb9cfa327ab25db84df7d2387ee1ba855af7394a173ff51c2dd05371a327b661dcdf277a61d72e964ea5309ef1f7de835725d16d2c9faca2bdb5814b6608a9293e3ab64d0ef8b23e59e2d48bf82c8829429b1713e3790e12772272f3fb62194d641269b75ee9eabe3edb35b14f8cb845e2ab7bacabc1cccb6d00fb69df1b898265dbcd585f13f92a1252d8fa05f2439b4b182172cf3d84a28ed8b417e966213533f9ddb31a4484d8c10ab0aa6792bd21394f635c8fb96101993c6933ea0c9d1d47c380707a803b6ce320aba9eef7ad0d0e6d1aa7cc2e723786f40b1122440d59233a9cfe3ea5d0471ab416f5b84ef7a4d8baead7be537167a9fabdd1185826e77a283bb9f46ccd81a9cf4e1cf24cf06d14e0b8dfe2538cc1f1547363fea003efb0de382652a17a1efbb9c640fd12db1a19f7ee01f148fe8945884c6d11c131d8a0d6e614e694ab526d396387f7d4596118d5efa5572b1c3f4094d69dc4b5b45503544841b5db20782c0a0c60167bd62d61e61df8e2e9ce3172bcbb57965bf70a59a978cfec27bb7812bed6190fcdd1efb3a24247b6f8aa9e08fcb3174c12ef2098e2f3df9a3e8e0e1ec7482962dbd57b5ed36f1577f3f55a11ed17b69c85be12f89c192413450dd13536bb98a93673c26bbfba006b3832599fc983a673bf880b216ea2a3ef9ec53fb82bf18eb5f3f6fa448d45750d8d836038260adf34cfc01e479d994f28a7957cd1fee79a7fd99958825946bc466439ec09eb8f611ee0eeeee461da88f134a170cfd5a3e02aa015dbabe86981469935ee28a3e37ef6edc1cc7f85f4b188c12f701d919b7f35a96cb67c27cebd6f33b16b163f13ea653e3c44fe13076a57b4e3693712cc557e7f3b0e4c3c9f5f80abf84e497f7baf88ccddb30d88617ed011801dd7a25aad4e75de4f302b16a56f99ca782e930a3d22b9f6102969ef503f683604"})
ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r0, 0x40089413, &(0x7f00000018c0)=0x100)
[-- Attachment #7: btrfs_get_root_ref-repro.log --]
[-- Type: application/octet-stream, Size: 130928 bytes --]
Warning: Permanently added '[localhost]:43925' (ED25519) to the list of known hosts.
syzkaller login: [ 301.832287][ T28] audit: type=1400 audit(1703929414.357:6): avc: denied { execmem } for pid=7936 comm="syz-executor301" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
[ 301.874096][ T7936] cgroup: Unknown subsys name 'net'
[ 301.998380][ T7936] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 122.1 MiB (127995904 bytes)
no label, UUID=f2a8c069-f14b-4004-8b78-3db4ce12a2af
[ 303.913615][ T7936] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 304.017608][ T7969] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 304.022519][ T7969] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 304.028328][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 304.031068][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 304.038935][ T7975] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 304.039930][ T7975] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 304.069935][ T7972] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 304.073810][ T7972] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 304.076008][ T7972] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[ 304.080411][ T4389] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 304.093763][ T7972] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 304.106080][ T4389] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 304.106169][ T7988] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[ 304.111592][ T7988] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 304.116581][ T7988] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[ 304.119585][ T7988] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 304.120544][ T7988] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 304.122291][ T7988] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 304.123077][ T7988] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 304.124382][ T7988] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 304.126188][ T7988] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 304.147961][ T4389] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 304.152626][ T4389] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[ 304.153520][ T4389] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 304.159678][ T4389] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 304.162528][ T4389] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[ 304.163913][ T4389] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 304.172298][ T4389] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[ 304.178433][ T50] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[ 304.178981][ T4389] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 304.179532][ T50] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[ 304.182106][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 304.186743][ T7975] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 304.211060][ T4389] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 304.215007][ T4389] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[ 304.238344][ T7975] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[ 304.239072][ T7966] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[ 304.251002][ T7975] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[ 304.284621][ T7988] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[ 304.285946][ T7988] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[ 304.287204][ T7988] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[ 304.289459][ T7988] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[ 304.290633][ T7988] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[ 304.291629][ T7988] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[ 304.296946][ T50] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[ 304.299295][ T50] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[ 304.309129][ T50] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[ 304.316877][ T50] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[ 305.179267][ T7953] chnl_net:caif_netlink_parms(): no params data found
[ 305.232711][ T7958] chnl_net:caif_netlink_parms(): no params data found
[ 305.636233][ T7958] bridge0: port 1(bridge_slave_0) entered blocking state
[ 305.641003][ T7958] bridge0: port 1(bridge_slave_0) entered disabled state
[ 305.643942][ T7958] bridge_slave_0: entered allmulticast mode
[ 305.648731][ T7958] bridge_slave_0: entered promiscuous mode
[ 305.720627][ T7961] chnl_net:caif_netlink_parms(): no params data found
[ 305.744343][ T7953] bridge0: port 1(bridge_slave_0) entered blocking state
[ 305.746273][ T7953] bridge0: port 1(bridge_slave_0) entered disabled state
[ 305.750388][ T7953] bridge_slave_0: entered allmulticast mode
[ 305.753442][ T7953] bridge_slave_0: entered promiscuous mode
[ 305.763839][ T7958] bridge0: port 2(bridge_slave_1) entered blocking state
[ 305.765556][ T7958] bridge0: port 2(bridge_slave_1) entered disabled state
[ 305.767056][ T7958] bridge_slave_1: entered allmulticast mode
[ 305.769799][ T7958] bridge_slave_1: entered promiscuous mode
[ 305.934867][ T7953] bridge0: port 2(bridge_slave_1) entered blocking state
[ 305.935508][ T7953] bridge0: port 2(bridge_slave_1) entered disabled state
[ 305.936180][ T7953] bridge_slave_1: entered allmulticast mode
[ 305.939209][ T7953] bridge_slave_1: entered promiscuous mode
[ 305.999645][ T7954] chnl_net:caif_netlink_parms(): no params data found
[ 306.128666][ T50] Bluetooth: hci0: command 0x0409 tx timeout
[ 306.208202][ T7988] Bluetooth: hci3: command 0x0409 tx timeout
[ 306.209029][ T4389] Bluetooth: hci2: command 0x0409 tx timeout
[ 306.210057][ T50] Bluetooth: hci1: command 0x0409 tx timeout
[ 306.215779][ T7958] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 306.221258][ T7958] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 306.222157][ T7959] chnl_net:caif_netlink_parms(): no params data found
[ 306.246501][ T7960] chnl_net:caif_netlink_parms(): no params data found
[ 306.271443][ T7953] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 306.287734][ T50] Bluetooth: hci7: command 0x0409 tx timeout
[ 306.296861][ T50] Bluetooth: hci4: command 0x0409 tx timeout
[ 306.366927][ T50] Bluetooth: hci6: command 0x0409 tx timeout
[ 306.379479][ T50] Bluetooth: hci5: command 0x0409 tx timeout
[ 306.466593][ T7953] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 306.532336][ T7958] team0: Port device team_slave_0 added
[ 306.534776][ T7958] team0: Port device team_slave_1 added
[ 306.580437][ T7962] chnl_net:caif_netlink_parms(): no params data found
[ 306.638164][ T7961] bridge0: port 1(bridge_slave_0) entered blocking state
[ 306.638774][ T7961] bridge0: port 1(bridge_slave_0) entered disabled state
[ 306.639380][ T7961] bridge_slave_0: entered allmulticast mode
[ 306.641062][ T7961] bridge_slave_0: entered promiscuous mode
[ 306.645674][ T7953] team0: Port device team_slave_0 added
[ 306.649459][ T7961] bridge0: port 2(bridge_slave_1) entered blocking state
[ 306.649971][ T7961] bridge0: port 2(bridge_slave_1) entered disabled state
[ 306.650869][ T7961] bridge_slave_1: entered allmulticast mode
[ 306.655211][ T7961] bridge_slave_1: entered promiscuous mode
[ 306.656805][ T7954] bridge0: port 1(bridge_slave_0) entered blocking state
[ 306.657386][ T7954] bridge0: port 1(bridge_slave_0) entered disabled state
[ 306.657990][ T7954] bridge_slave_0: entered allmulticast mode
[ 306.660379][ T7954] bridge_slave_0: entered promiscuous mode
[ 306.668266][ T7964] chnl_net:caif_netlink_parms(): no params data found
[ 306.676466][ T7958] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 306.677323][ T7958] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 306.679237][ T7958] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 306.723393][ T7953] team0: Port device team_slave_1 added
[ 306.757951][ T7954] bridge0: port 2(bridge_slave_1) entered blocking state
[ 306.759121][ T7954] bridge0: port 2(bridge_slave_1) entered disabled state
[ 306.760927][ T7954] bridge_slave_1: entered allmulticast mode
[ 306.763593][ T7954] bridge_slave_1: entered promiscuous mode
[ 306.787728][ T7958] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 306.788283][ T7958] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 306.790069][ T7958] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 306.961291][ T7961] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 306.964504][ T7961] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 306.979515][ T7954] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.005573][ T7959] bridge0: port 1(bridge_slave_0) entered blocking state
[ 307.009902][ T7959] bridge0: port 1(bridge_slave_0) entered disabled state
[ 307.010582][ T7959] bridge_slave_0: entered allmulticast mode
[ 307.012638][ T7959] bridge_slave_0: entered promiscuous mode
[ 307.024415][ T7960] bridge0: port 1(bridge_slave_0) entered blocking state
[ 307.028774][ T7960] bridge0: port 1(bridge_slave_0) entered disabled state
[ 307.030459][ T7960] bridge_slave_0: entered allmulticast mode
[ 307.032999][ T7960] bridge_slave_0: entered promiscuous mode
[ 307.098686][ T7954] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 307.146114][ T7958] hsr_slave_0: entered promiscuous mode
[ 307.148350][ T7958] hsr_slave_1: entered promiscuous mode
[ 307.193403][ T7959] bridge0: port 2(bridge_slave_1) entered blocking state
[ 307.194101][ T7959] bridge0: port 2(bridge_slave_1) entered disabled state
[ 307.194733][ T7959] bridge_slave_1: entered allmulticast mode
[ 307.196387][ T7959] bridge_slave_1: entered promiscuous mode
[ 307.250680][ T7960] bridge0: port 2(bridge_slave_1) entered blocking state
[ 307.251466][ T7960] bridge0: port 2(bridge_slave_1) entered disabled state
[ 307.252153][ T7960] bridge_slave_1: entered allmulticast mode
[ 307.253935][ T7960] bridge_slave_1: entered promiscuous mode
[ 307.255916][ T7953] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 307.256418][ T7953] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.262368][ T7953] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 307.268902][ T7961] team0: Port device team_slave_0 added
[ 307.291379][ T7954] team0: Port device team_slave_0 added
[ 307.301356][ T7954] team0: Port device team_slave_1 added
[ 307.303450][ T7964] bridge0: port 1(bridge_slave_0) entered blocking state
[ 307.304832][ T7964] bridge0: port 1(bridge_slave_0) entered disabled state
[ 307.305469][ T7964] bridge_slave_0: entered allmulticast mode
[ 307.309037][ T7964] bridge_slave_0: entered promiscuous mode
[ 307.338988][ T7959] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.341370][ T7962] bridge0: port 1(bridge_slave_0) entered blocking state
[ 307.343322][ T7962] bridge0: port 1(bridge_slave_0) entered disabled state
[ 307.344229][ T7962] bridge_slave_0: entered allmulticast mode
[ 307.346202][ T7962] bridge_slave_0: entered promiscuous mode
[ 307.365608][ T7953] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 307.366142][ T7953] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.369198][ T7953] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 307.372340][ T7961] team0: Port device team_slave_1 added
[ 307.466424][ T7964] bridge0: port 2(bridge_slave_1) entered blocking state
[ 307.467978][ T7964] bridge0: port 2(bridge_slave_1) entered disabled state
[ 307.468605][ T7964] bridge_slave_1: entered allmulticast mode
[ 307.470275][ T7964] bridge_slave_1: entered promiscuous mode
[ 307.485213][ T7959] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 307.538105][ T7962] bridge0: port 2(bridge_slave_1) entered blocking state
[ 307.539489][ T7962] bridge0: port 2(bridge_slave_1) entered disabled state
[ 307.540919][ T7962] bridge_slave_1: entered allmulticast mode
[ 307.543490][ T7962] bridge_slave_1: entered promiscuous mode
[ 307.570776][ T7960] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.630491][ T7954] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 307.631028][ T7954] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.632825][ T7954] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 307.635862][ T7954] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 307.644143][ T7954] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.649047][ T7954] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 307.689325][ T7959] team0: Port device team_slave_0 added
[ 307.692851][ T7964] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.695900][ T7959] team0: Port device team_slave_1 added
[ 307.700638][ T7964] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 307.741757][ T7960] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 307.766310][ T7961] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 307.767947][ T7961] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.772845][ T7961] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 307.933300][ T7962] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 307.956543][ T7960] team0: Port device team_slave_0 added
[ 307.960655][ T7960] team0: Port device team_slave_1 added
[ 307.981744][ T7961] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 307.982349][ T7961] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 307.985204][ T7961] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 308.024205][ T7959] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 308.025459][ T7959] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.032271][ T7959] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 308.058932][ T7962] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 308.064889][ T7964] team0: Port device team_slave_0 added
[ 308.123961][ T7960] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 308.125392][ T7960] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.135833][ T7960] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 308.172655][ T7954] hsr_slave_0: entered promiscuous mode
[ 308.174696][ T7954] hsr_slave_1: entered promiscuous mode
[ 308.178287][ T7954] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.180115][ T7954] Cannot create hsr debugfs directory
[ 308.183446][ T7959] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 308.184922][ T7959] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.190698][ T7959] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 308.206824][ T50] Bluetooth: hci0: command 0x041b tx timeout
[ 308.229158][ T7964] team0: Port device team_slave_1 added
[ 308.251016][ T7953] hsr_slave_0: entered promiscuous mode
[ 308.252461][ T7953] hsr_slave_1: entered promiscuous mode
[ 308.254145][ T7953] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.254784][ T7953] Cannot create hsr debugfs directory
[ 308.261826][ T7960] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 308.263177][ T7960] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.272024][ T7960] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 308.287653][ T7988] Bluetooth: hci3: command 0x041b tx timeout
[ 308.288489][ T4389] Bluetooth: hci2: command 0x041b tx timeout
[ 308.290144][ T50] Bluetooth: hci1: command 0x041b tx timeout
[ 308.324680][ T7962] team0: Port device team_slave_0 added
[ 308.329218][ T7962] team0: Port device team_slave_1 added
[ 308.370499][ T4389] Bluetooth: hci7: command 0x041b tx timeout
[ 308.371053][ T50] Bluetooth: hci4: command 0x041b tx timeout
[ 308.376955][ T7964] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 308.378061][ T7964] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.382420][ T7964] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 308.447173][ T4389] Bluetooth: hci6: command 0x041b tx timeout
[ 308.448124][ T50] Bluetooth: hci5: command 0x041b tx timeout
[ 308.507241][ T7964] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 308.508500][ T7964] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.513218][ T7964] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 308.534350][ T7961] hsr_slave_0: entered promiscuous mode
[ 308.535496][ T7961] hsr_slave_1: entered promiscuous mode
[ 308.536376][ T7961] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.537330][ T7961] Cannot create hsr debugfs directory
[ 308.642340][ T7959] hsr_slave_0: entered promiscuous mode
[ 308.644052][ T7959] hsr_slave_1: entered promiscuous mode
[ 308.644884][ T7959] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.645700][ T7959] Cannot create hsr debugfs directory
[ 308.650687][ T7962] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 308.651839][ T7962] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.654826][ T7962] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 308.725781][ T7960] hsr_slave_0: entered promiscuous mode
[ 308.739445][ T7960] hsr_slave_1: entered promiscuous mode
[ 308.741601][ T7960] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 308.742352][ T7960] Cannot create hsr debugfs directory
[ 308.834973][ T7962] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 308.836562][ T7962] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 308.839364][ T7962] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 309.365303][ T7958] netdevsim netdevsim4 netdevsim0: renamed from eth0
[ 309.409713][ T7964] hsr_slave_0: entered promiscuous mode
[ 309.412893][ T7964] hsr_slave_1: entered promiscuous mode
[ 309.414807][ T7964] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 309.416176][ T7964] Cannot create hsr debugfs directory
[ 309.423858][ T7962] hsr_slave_0: entered promiscuous mode
[ 309.428851][ T7962] hsr_slave_1: entered promiscuous mode
[ 309.430728][ T7962] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 309.432065][ T7962] Cannot create hsr debugfs directory
[ 309.456177][ T7958] netdevsim netdevsim4 netdevsim1: renamed from eth1
[ 309.564214][ T7958] netdevsim netdevsim4 netdevsim2: renamed from eth2
[ 309.805248][ T7958] netdevsim netdevsim4 netdevsim3: renamed from eth3
[ 310.288629][ T50] Bluetooth: hci0: command 0x040f tx timeout
[ 310.319928][ T7954] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 310.324714][ T7954] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 310.331355][ T7954] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 310.353705][ T7954] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 310.367524][ T50] Bluetooth: hci1: command 0x040f tx timeout
[ 310.368020][ T50] Bluetooth: hci2: command 0x040f tx timeout
[ 310.369139][ T50] Bluetooth: hci3: command 0x040f tx timeout
[ 310.447824][ T50] Bluetooth: hci4: command 0x040f tx timeout
[ 310.449108][ T50] Bluetooth: hci7: command 0x040f tx timeout
[ 310.528101][ T4389] Bluetooth: hci5: command 0x040f tx timeout
[ 310.529371][ T4389] Bluetooth: hci6: command 0x040f tx timeout
[ 310.563735][ T7962] netdevsim netdevsim7 netdevsim0: renamed from eth0
[ 310.575139][ T7962] netdevsim netdevsim7 netdevsim1: renamed from eth1
[ 310.583243][ T7962] netdevsim netdevsim7 netdevsim2: renamed from eth2
[ 310.601496][ T7962] netdevsim netdevsim7 netdevsim3: renamed from eth3
[ 310.681300][ T7958] 8021q: adding VLAN 0 to HW filter on device bond0
[ 310.756163][ T7953] netdevsim netdevsim3 netdevsim0: renamed from eth0
[ 310.760208][ T7953] netdevsim netdevsim3 netdevsim1: renamed from eth1
[ 310.768710][ T7953] netdevsim netdevsim3 netdevsim2: renamed from eth2
[ 310.773703][ T7953] netdevsim netdevsim3 netdevsim3: renamed from eth3
[ 310.799955][ T7958] 8021q: adding VLAN 0 to HW filter on device team0
[ 310.879685][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 310.880508][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 310.951723][ T7954] 8021q: adding VLAN 0 to HW filter on device bond0
[ 310.956447][T10549] bridge0: port 2(bridge_slave_1) entered blocking state
[ 310.957159][T10549] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 310.965010][ T7960] netdevsim netdevsim6 netdevsim0: renamed from eth0
[ 310.979585][ T7960] netdevsim netdevsim6 netdevsim1: renamed from eth1
[ 310.984638][ T7960] netdevsim netdevsim6 netdevsim2: renamed from eth2
[ 311.012646][ T7960] netdevsim netdevsim6 netdevsim3: renamed from eth3
[ 311.093429][ T7962] 8021q: adding VLAN 0 to HW filter on device bond0
[ 311.231243][ T7954] 8021q: adding VLAN 0 to HW filter on device team0
[ 311.235123][ T7961] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 311.259596][ T7962] 8021q: adding VLAN 0 to HW filter on device team0
[ 311.284546][ T7961] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 311.290913][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 311.291604][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 311.294175][T10544] bridge0: port 2(bridge_slave_1) entered blocking state
[ 311.294852][T10544] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 311.295979][ T7961] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 311.308225][ T7961] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 311.385875][T10549] bridge0: port 1(bridge_slave_0) entered blocking state
[ 311.386491][T10549] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 311.390770][T10549] bridge0: port 2(bridge_slave_1) entered blocking state
[ 311.391392][T10549] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 311.539253][ T7964] netdevsim netdevsim2 netdevsim0: renamed from eth0
[ 311.544505][ T7964] netdevsim netdevsim2 netdevsim1: renamed from eth1
[ 311.560580][ T7964] netdevsim netdevsim2 netdevsim2: renamed from eth2
[ 311.565669][ T7964] netdevsim netdevsim2 netdevsim3: renamed from eth3
[ 311.598449][ T7958] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 311.892863][ T7960] 8021q: adding VLAN 0 to HW filter on device bond0
[ 311.986666][ T7959] netdevsim netdevsim5 netdevsim0: renamed from eth0
[ 311.992737][ T7959] netdevsim netdevsim5 netdevsim1: renamed from eth1
[ 312.033399][ T7959] netdevsim netdevsim5 netdevsim2: renamed from eth2
[ 312.043916][ T7959] netdevsim netdevsim5 netdevsim3: renamed from eth3
[ 312.080298][ T7960] 8021q: adding VLAN 0 to HW filter on device team0
[ 312.090335][ T7953] 8021q: adding VLAN 0 to HW filter on device bond0
[ 312.135368][ T7961] 8021q: adding VLAN 0 to HW filter on device bond0
[ 312.145757][ T7962] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 312.152498][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 312.153126][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 312.192467][ T7953] 8021q: adding VLAN 0 to HW filter on device team0
[ 312.211857][T10544] bridge0: port 2(bridge_slave_1) entered blocking state
[ 312.212985][T10544] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 312.252958][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 312.253605][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 312.265262][ T7961] 8021q: adding VLAN 0 to HW filter on device team0
[ 312.294908][T10522] bridge0: port 1(bridge_slave_0) entered blocking state
[ 312.295551][T10522] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 312.309712][T10522] bridge0: port 2(bridge_slave_1) entered blocking state
[ 312.310329][T10522] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 312.367974][ T50] Bluetooth: hci0: command 0x0419 tx timeout
[ 312.380116][ T8] bridge0: port 2(bridge_slave_1) entered blocking state
[ 312.380995][ T8] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 312.400482][ T7958] veth0_vlan: entered promiscuous mode
[ 312.447332][ T50] Bluetooth: hci3: command 0x0419 tx timeout
[ 312.447818][ T50] Bluetooth: hci1: command 0x0419 tx timeout
[ 312.448254][ T50] Bluetooth: hci2: command 0x0419 tx timeout
[ 312.505368][ T7960] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 312.528207][ T4389] Bluetooth: hci7: command 0x0419 tx timeout
[ 312.529363][ T4389] Bluetooth: hci4: command 0x0419 tx timeout
[ 312.538519][ T7954] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 312.573302][ T7958] veth1_vlan: entered promiscuous mode
[ 312.611119][ T50] Bluetooth: hci6: command 0x0419 tx timeout
[ 312.611620][ T50] Bluetooth: hci5: command 0x0419 tx timeout
[ 312.652439][ T7953] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 312.653196][ T7953] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 312.732950][ T7954] veth0_vlan: entered promiscuous mode
[ 312.791543][ T7954] veth1_vlan: entered promiscuous mode
[ 312.895071][ T7959] 8021q: adding VLAN 0 to HW filter on device bond0
[ 312.914559][ T7953] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 312.934852][ T7962] veth0_vlan: entered promiscuous mode
[ 312.961285][ T7964] 8021q: adding VLAN 0 to HW filter on device bond0
[ 312.971831][ T7958] veth0_macvtap: entered promiscuous mode
[ 312.985666][ T7962] veth1_vlan: entered promiscuous mode
[ 313.005822][ T7959] 8021q: adding VLAN 0 to HW filter on device team0
[ 313.015200][ T7958] veth1_macvtap: entered promiscuous mode
[ 313.096499][ T7954] veth0_macvtap: entered promiscuous mode
[ 313.103983][T10549] bridge0: port 1(bridge_slave_0) entered blocking state
[ 313.105754][T10549] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 313.110241][T10549] bridge0: port 2(bridge_slave_1) entered blocking state
[ 313.111680][T10549] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 313.179336][ T7961] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 313.186387][ T7953] veth0_vlan: entered promiscuous mode
[ 313.189979][ T7954] veth1_macvtap: entered promiscuous mode
[ 313.238957][ T7964] 8021q: adding VLAN 0 to HW filter on device team0
[ 313.265492][ T7953] veth1_vlan: entered promiscuous mode
[ 313.287475][ T7958] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 313.327951][T10544] bridge0: port 1(bridge_slave_0) entered blocking state
[ 313.329564][T10544] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 313.349704][ T7962] veth0_macvtap: entered promiscuous mode
[ 313.361622][ T7954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.363706][ T7954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.367355][ T7954] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 313.371280][ T7958] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 313.384755][T10549] bridge0: port 2(bridge_slave_1) entered blocking state
[ 313.386239][T10549] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 313.403681][ T7962] veth1_macvtap: entered promiscuous mode
[ 313.411881][ T7960] veth0_vlan: entered promiscuous mode
[ 313.417158][ T7954] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.418150][ T7954] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.420968][ T7954] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 313.429320][ T7954] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.430402][ T7954] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.431209][ T7954] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.432165][ T7954] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.519506][ T7958] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.520249][ T7958] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.520869][ T7958] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.521345][ T7958] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.582579][ T7960] veth1_vlan: entered promiscuous mode
[ 313.621023][ T7962] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.621759][ T7962] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.622906][ T7962] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.624310][ T7962] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.628930][ T7962] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 313.633009][ T7962] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.634113][ T7962] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.635068][ T7962] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.636531][ T7962] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.642314][ T7962] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 313.680398][ T7953] veth0_macvtap: entered promiscuous mode
[ 313.685223][ T7962] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.685817][ T7962] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.688503][ T7962] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.689570][ T7962] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.720211][ T7953] veth1_macvtap: entered promiscuous mode
[ 313.734083][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.734681][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.735216][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.735886][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.736571][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 313.740104][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.742562][ T7953] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 313.769814][ T7961] veth0_vlan: entered promiscuous mode
[ 313.784296][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.788818][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.789582][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.790291][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.790975][ T7953] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 313.791703][ T7953] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 313.794010][ T7953] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 313.857925][ T7953] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.859617][ T7953] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.861161][ T7953] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.863164][ T7953] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 313.970981][ T7960] veth0_macvtap: entered promiscuous mode
[ 314.022576][ T7961] veth1_vlan: entered promiscuous mode
[ 314.096022][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.099416][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.150373][ T7960] veth1_macvtap: entered promiscuous mode
[ 314.184964][ T7959] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 314.219872][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.220430][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.279668][ T7964] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 314.301635][ T7961] veth0_macvtap: entered promiscuous mode
[ 314.308940][ T7961] veth1_macvtap: entered promiscuous mode
[ 314.420112][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.420925][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.421655][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.422435][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.423109][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.423903][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.424623][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.466449][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.471038][ T7960] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 314.480036][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.481787][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.495400][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.499035][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.500676][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.502936][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.505142][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.506001][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.507996][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.509615][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.510669][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 314.511427][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.514600][ T7961] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 314.559968][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.560722][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.561767][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.562632][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.563941][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.565710][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.566435][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.567990][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.568507][ T7961] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.569038][ T7961] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.570778][ T7961] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 314.584673][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.585387][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.585997][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.590946][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.591643][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.592355][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.593019][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.593720][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.594393][ T7960] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 314.595131][ T7960] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 314.597561][ T7960] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 314.600626][ T7960] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.601867][ T7960] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.603079][ T7960] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.604462][ T7960] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.638772][ T139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 314.640359][ T139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 314.644985][ T7961] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.654184][ T7961] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.656153][ T7961] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 314.664109][ T7961] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
executing program
[ 315.041990][T10424] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.043136][T10424] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
executing program
[ 315.227714][T10648] loop4: detected capacity change from 0 to 32768
[ 315.240112][T10648] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (10648)
[ 315.271270][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.271914][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 315.275646][T10648] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 315.276557][T10648] BTRFS info (device loop4): max_inline at 0
[ 315.287031][T10648] BTRFS info (device loop4): using free space tree
[ 315.351423][ T7959] veth0_vlan: entered promiscuous mode
[ 315.380091][ T7964] veth0_vlan: entered promiscuous mode
[ 315.382482][T10648] BTRFS info (device loop4): enabling ssd optimizations
[ 315.383958][T10648] BTRFS info (device loop4): auto enabling async discard
[ 315.521481][ T2921] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.523128][ T2921] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 315.525288][ T7959] veth1_vlan: entered promiscuous mode
[ 315.539492][T10685] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 315.663996][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.665092][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 315.675859][ T7964] veth1_vlan: entered promiscuous mode
[ 315.752684][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 315.754537][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 315.765118][T10660] loop0: detected capacity change from 0 to 32768
[ 315.786828][T10660] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (10660)
[ 315.819884][T10660] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 315.821695][T10660] BTRFS info (device loop0): max_inline at 0
[ 315.822812][T10660] BTRFS info (device loop0): using free space tree
executing program
[ 315.872467][ T7959] veth0_macvtap: entered promiscuous mode
[ 315.915312][T10660] BTRFS info (device loop0): enabling ssd optimizations
[ 315.915867][T10660] BTRFS info (device loop0): auto enabling async discard
executing program
[ 315.977433][T10660] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 316.317169][ T7959] veth1_macvtap: entered promiscuous mode
[ 316.348942][ T2921] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 316.349598][ T2921] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
executing program
[ 316.681704][T10718] loop7: detected capacity change from 0 to 32768
[ 316.710545][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 316.711126][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 316.735513][T10718] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (10718)
executing program
[ 316.773647][T10718] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 316.774439][T10718] BTRFS info (device loop7): max_inline at 0
[ 316.775083][T10718] BTRFS info (device loop7): using free space tree
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 316.862906][ T7964] veth0_macvtap: entered promiscuous mode
[ 317.012755][T10718] BTRFS info (device loop7): enabling ssd optimizations
[ 317.013575][T10718] BTRFS info (device loop7): auto enabling async discard
[ 317.126269][T10718] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 317.185288][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.279699][T10726] loop0: detected capacity change from 0 to 32768
[ 317.282069][T10726] BTRFS: device /dev/loop0 using temp-fsid 0dde64c9-c49f-4f9b-80d2-2ed24bd398f6
[ 317.284017][T10726] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (10726)
[ 317.297201][T10726] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 317.297907][T10726] BTRFS info (device loop0): max_inline at 0
[ 317.298695][T10726] BTRFS info (device loop0): using free space tree
[ 317.305451][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.307130][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.308347][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.309830][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.311583][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.313235][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.314750][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.316498][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.322074][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.322788][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 317.323517][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.326278][ T7959] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 317.415580][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.417530][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.418380][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.419091][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.419764][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.420907][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.422275][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.423902][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.425419][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.436961][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.437809][ T7959] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 317.438804][ T7959] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 317.441957][ T7959] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 317.515523][T10726] BTRFS info (device loop0): enabling ssd optimizations
[ 317.516185][T10726] BTRFS info (device loop0): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 317.601008][ T7964] veth1_macvtap: entered promiscuous mode
[ 317.601679][T10726] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 317.683022][ T7959] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 317.737150][ T7959] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 317.738733][ T7959] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 317.740653][ T7959] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 317.840395][T10732] loop3: detected capacity change from 0 to 32768
[ 317.849316][T10732] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (10732)
[ 317.873731][T10732] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 317.874468][T10732] BTRFS info (device loop3): max_inline at 0
[ 317.875005][T10732] BTRFS info (device loop3): using free space tree
executing program
executing program
[ 318.114364][T10732] BTRFS info (device loop3): enabling ssd optimizations
[ 318.116065][T10732] BTRFS info (device loop3): auto enabling async discard
[ 318.148285][T10732] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 318.284242][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.285376][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
executing program
[ 318.356782][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.358334][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.359655][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.361251][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.362674][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.363802][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.364918][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.365830][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.366460][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.516810][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.536000][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
[ 318.556982][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.627405][ T7964] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 318.732696][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 318.793528][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.822824][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 318.854312][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.878167][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 318.884748][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 318.915402][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 318.978097][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 319.046798][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 319.048797][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 319.050746][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 319.052843][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 319.054509][ T7964] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
[ 319.056401][ T7964] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 319.084304][T10783] loop1: detected capacity change from 0 to 32768
[ 319.107620][T10783] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (10783)
executing program
[ 319.153612][T10783] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 319.154282][T10783] BTRFS info (device loop1): max_inline at 0
[ 319.159268][T10783] BTRFS info (device loop1): using free space tree
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 319.356653][T10783] BTRFS info (device loop1): enabling ssd optimizations
[ 319.357355][T10783] BTRFS info (device loop1): auto enabling async discard
[ 319.426662][ T7964] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 319.525791][T10802] loop6: detected capacity change from 0 to 32768
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 319.593138][T10783] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 319.623080][ T7964] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 319.623771][ T7964] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 319.624376][ T7964] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 319.624974][ T7964] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 319.711455][T10802] BTRFS: device /dev/loop6 using temp-fsid 8fa9bdfb-021c-4947-9d99-1fa64c1da3ed
[ 319.712171][T10802] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (10802)
[ 319.724276][T10802] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 319.725007][T10802] BTRFS info (device loop6): max_inline at 0
[ 319.726227][T10802] BTRFS info (device loop6): using free space tree
[ 319.825201][T10802] BTRFS info (device loop6): enabling ssd optimizations
[ 319.825849][T10802] BTRFS info (device loop6): auto enabling async discard
[ 319.945039][T10802] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 320.353973][T10808] loop3: detected capacity change from 0 to 32768
[ 320.362747][T10808] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (10808)
[ 320.375017][T10808] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 320.387170][T10808] BTRFS info (device loop3): max_inline at 0
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 320.387718][T10808] BTRFS info (device loop3): using free space tree
executing program
[ 320.642558][T10808] BTRFS info (device loop3): enabling ssd optimizations
[ 320.643134][T10808] BTRFS info (device loop3): auto enabling async discard
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 320.800995][T10808] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 321.743257][T10873] loop1: detected capacity change from 0 to 32768
[ 321.767667][T10873] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (10873)
[ 321.780882][T10873] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 321.781648][T10873] BTRFS info (device loop1): max_inline at 0
[ 321.782166][T10873] BTRFS info (device loop1): using free space tree
[ 321.998408][T10873] BTRFS info (device loop1): enabling ssd optimizations
[ 321.998957][T10873] BTRFS info (device loop1): auto enabling async discard
[ 322.001279][T10881] loop6: detected capacity change from 0 to 32768
[ 322.032380][T10881] BTRFS: device /dev/loop6 using temp-fsid c9363695-cd9c-4c37-a6a7-8887bf2d65c2
[ 322.033133][T10881] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (10881)
[ 322.055909][T10881] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 322.056904][T10881] BTRFS info (device loop6): max_inline at 0
[ 322.057376][T10881] BTRFS info (device loop6): using free space tree
[ 322.116495][T10873] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 322.198476][T10881] BTRFS info (device loop6): enabling ssd optimizations
[ 322.199063][T10881] BTRFS info (device loop6): auto enabling async discard
[ 322.314826][T10881] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 322.558954][ T23] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 322.559563][ T23] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 322.632883][T10889] loop3: detected capacity change from 0 to 32768
[ 322.660355][T10889] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (10889)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 322.689999][T10889] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 322.690739][T10889] BTRFS info (device loop3): max_inline at 0
[ 322.691209][T10889] BTRFS info (device loop3): using free space tree
executing program
[ 322.814017][T10895] loop7: detected capacity change from 0 to 32768
[ 322.845008][T10895] BTRFS: device /dev/loop7 using temp-fsid d3edc745-dc89-4b89-83dc-f300d5ef5c9e
[ 322.845753][T10895] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (10895)
[ 322.867313][T10895] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 322.868109][T10895] BTRFS info (device loop7): max_inline at 0
[ 322.868573][T10895] BTRFS info (device loop7): using free space tree
[ 322.901092][T10889] BTRFS info (device loop3): enabling ssd optimizations
[ 322.901665][T10889] BTRFS info (device loop3): auto enabling async discard
executing program
[ 322.962046][T10889] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 322.996357][T10895] BTRFS info (device loop7): enabling ssd optimizations
[ 322.997141][T10895] BTRFS info (device loop7): auto enabling async discard
[ 323.061459][T10895] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 323.159495][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 323.160428][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 323.163490][ T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 323.172938][ T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
executing program
[ 323.422873][T10936] loop4: detected capacity change from 0 to 32768
[ 323.434606][T10936] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (10936)
[ 323.491549][T10936] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 323.492332][T10936] BTRFS info (device loop4): max_inline at 0
[ 323.492788][T10936] BTRFS info (device loop4): using free space tree
executing program
[ 323.726666][T10936] BTRFS info (device loop4): enabling ssd optimizations
[ 323.727220][T10936] BTRFS info (device loop4): auto enabling async discard
[ 323.754305][T10424] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 323.754917][T10424] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 323.793429][T10936] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 324.248150][T10982] loop1: detected capacity change from 0 to 32768
[ 324.257211][T10982] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (10982)
[ 324.283305][T10982] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 324.284103][T10982] BTRFS info (device loop1): max_inline at 0
[ 324.284567][T10982] BTRFS info (device loop1): using free space tree
[ 324.505339][T10982] BTRFS info (device loop1): enabling ssd optimizations
[ 324.506636][T10982] BTRFS info (device loop1): auto enabling async discard
executing program
[ 324.586148][T10982] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 324.686052][T11009] loop7: detected capacity change from 0 to 32768
[ 324.755095][T11009] BTRFS: device /dev/loop7 using temp-fsid 230de0b8-8070-44f0-9344-ef091028a0f6
[ 324.756131][T11009] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11009)
[ 324.848458][T11009] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 324.849351][T11009] BTRFS info (device loop7): max_inline at 0
[ 324.850546][T11009] BTRFS info (device loop7): using free space tree
[ 324.862572][T10988] loop6: detected capacity change from 0 to 32768
[ 324.867044][T10988] BTRFS: device /dev/loop6 using temp-fsid 1aea580b-7353-46ea-a04c-448fd43f87c4
[ 324.869390][T10988] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (10988)
[ 324.911571][T10988] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 324.912270][T10988] BTRFS info (device loop6): max_inline at 0
[ 324.913887][T10988] BTRFS info (device loop6): using free space tree
[ 324.990772][T11022] loop5: detected capacity change from 0 to 32768
[ 325.005249][T11022] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11022)
[ 325.015787][T11022] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 325.020566][T11022] BTRFS info (device loop5): max_inline at 0
[ 325.023131][T11022] BTRFS info (device loop5): using free space tree
[ 325.126251][T11020] loop3: detected capacity change from 0 to 32768
[ 325.144916][T11009] BTRFS info (device loop7): enabling ssd optimizations
[ 325.145426][T11009] BTRFS info (device loop7): auto enabling async discard
[ 325.194256][T10988] BTRFS info (device loop6): enabling ssd optimizations
[ 325.194788][T10988] BTRFS info (device loop6): auto enabling async discard
[ 325.203519][T11020] BTRFS: device /dev/loop3 using temp-fsid 95406b7d-0965-46d4-af2d-3bbd24711f32
[ 325.204259][T11020] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11020)
[ 325.266390][T11020] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 325.267314][T11020] BTRFS info (device loop3): max_inline at 0
[ 325.267743][T11020] BTRFS info (device loop3): using free space tree
[ 325.275608][T11009] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 325.287748][T10988] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 325.384668][T11022] BTRFS info (device loop5): enabling ssd optimizations
[ 325.385264][T11022] BTRFS info (device loop5): auto enabling async discard
executing program
[ 325.465570][T11020] BTRFS info (device loop3): enabling ssd optimizations
[ 325.468319][T11020] BTRFS info (device loop3): auto enabling async discard
[ 325.519683][T11022] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 325.538483][T11020] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 325.566266][T11050] loop4: detected capacity change from 0 to 32768
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 325.580808][T11050] BTRFS: device /dev/loop4 using temp-fsid cf27ed18-2bc0-4743-896e-a2837101c8a5
[ 325.581573][T11050] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (11050)
[ 325.615924][T11050] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 325.616778][T11050] BTRFS info (device loop4): max_inline at 0
[ 325.617279][T11050] BTRFS info (device loop4): using free space tree
[ 325.695528][T11030] loop0: detected capacity change from 0 to 32768
[ 325.710216][T11030] BTRFS: device /dev/loop0 using temp-fsid 96a73027-fe37-4690-b694-3d3cb105aadd
[ 325.711096][T11030] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11030)
[ 325.724063][T11028] loop2: detected capacity change from 0 to 32768
[ 325.737359][T11028] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11028)
[ 325.787002][T11030] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 325.787769][T11030] BTRFS info (device loop0): max_inline at 0
[ 325.788231][T11030] BTRFS info (device loop0): using free space tree
[ 325.797426][T11050] BTRFS info (device loop4): enabling ssd optimizations
[ 325.797997][T11050] BTRFS info (device loop4): auto enabling async discard
[ 325.803063][T11028] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 325.803777][T11028] BTRFS info (device loop2): max_inline at 0
[ 325.804234][T11028] BTRFS info (device loop2): using free space tree
[ 326.001475][T11050] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 326.067778][T11028] BTRFS info (device loop2): enabling ssd optimizations
[ 326.068336][T11028] BTRFS info (device loop2): auto enabling async discard
[ 326.069306][T11030] BTRFS info (device loop0): enabling ssd optimizations
[ 326.069838][T11030] BTRFS info (device loop0): auto enabling async discard
[ 326.160659][T11028] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 326.320820][T11030] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 326.505978][T11124] loop1: detected capacity change from 0 to 32768
[ 326.514200][T11124] BTRFS: device /dev/loop1 using temp-fsid 66904ed6-cd8b-4d54-9eff-4bbc410dbbdf
[ 326.515057][T11124] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11124)
[ 326.541163][T11124] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 326.545597][T11124] BTRFS info (device loop1): max_inline at 0
[ 326.546050][T11124] BTRFS info (device loop1): using free space tree
[ 326.840652][T11124] BTRFS info (device loop1): enabling ssd optimizations
[ 326.841222][T11124] BTRFS info (device loop1): auto enabling async discard
[ 326.921159][T11124] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 327.478345][T11201] loop6: detected capacity change from 0 to 32768
[ 327.493616][T11201] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11201)
executing program
[ 327.523835][T11201] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 327.524473][T11201] BTRFS info (device loop6): max_inline at 0
[ 327.524922][T11201] BTRFS info (device loop6): using free space tree
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 327.700643][T11207] loop5: detected capacity change from 0 to 32768
[ 327.702855][T11204] loop7: detected capacity change from 0 to 32768
[ 327.713926][T11207] BTRFS: device /dev/loop5 using temp-fsid 083f8efa-feab-4831-8a65-fe73f4c0ffb9
[ 327.714710][T11207] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11207)
[ 327.723332][T11207] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 327.724065][T11207] BTRFS info (device loop5): max_inline at 0
[ 327.724652][T11207] BTRFS info (device loop5): using free space tree
executing program
executing program
[ 327.771881][T11204] BTRFS: device /dev/loop7 using temp-fsid e211aaae-d39d-4880-86e4-3dfbf192ff37
[ 327.772624][T11204] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11204)
[ 327.773821][T11201] BTRFS info (device loop6): enabling ssd optimizations
[ 327.774350][T11201] BTRFS info (device loop6): auto enabling async discard
[ 327.818445][T11201] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 327.846895][T11204] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 327.847602][T11204] BTRFS info (device loop7): max_inline at 0
[ 327.848045][T11204] BTRFS info (device loop7): using free space tree
[ 327.942534][T11207] BTRFS info (device loop5): enabling ssd optimizations
[ 327.944353][T11207] BTRFS info (device loop5): auto enabling async discard
[ 328.060256][T11207] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 328.094842][T11204] BTRFS info (device loop7): enabling ssd optimizations
[ 328.095377][T11204] BTRFS info (device loop7): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 328.158121][T11204] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 328.328507][T11232] loop4: detected capacity change from 0 to 32768
[ 328.343908][T11232] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (11232)
[ 328.427336][T11232] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 328.428115][T11232] BTRFS info (device loop4): max_inline at 0
[ 328.428663][T11232] BTRFS info (device loop4): using free space tree
[ 328.647011][T11232] BTRFS info (device loop4): enabling ssd optimizations
[ 328.647579][T11232] BTRFS info (device loop4): auto enabling async discard
[ 328.686153][T11256] loop3: detected capacity change from 0 to 32768
[ 328.766293][T11256] BTRFS: device /dev/loop3 using temp-fsid c3e5098f-5294-455a-a891-b9fdfc50d153
[ 328.769995][T11256] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11256)
[ 328.780031][T11262] loop1: detected capacity change from 0 to 32768
[ 328.783470][T11232] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 328.796126][T11256] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 328.798113][T11256] BTRFS info (device loop3): max_inline at 0
[ 328.800440][T11262] BTRFS: device /dev/loop1 using temp-fsid 287d50eb-342f-461f-a01e-d010b7cb8d9d
[ 328.801287][T11262] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11262)
[ 328.813291][T11256] BTRFS info (device loop3): using free space tree
[ 328.827215][T11262] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 328.828003][T11262] BTRFS info (device loop1): max_inline at 0
[ 328.835280][T11262] BTRFS info (device loop1): using free space tree
[ 328.962706][T11240] loop0: detected capacity change from 0 to 32768
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 328.984023][T11240] BTRFS: device /dev/loop0 using temp-fsid 2938adaf-48dc-4aed-8079-bafa007f9d75
[ 328.984774][T11240] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11240)
[ 328.991588][T11256] BTRFS info (device loop3): enabling ssd optimizations
[ 328.992164][T11256] BTRFS info (device loop3): auto enabling async discard
[ 328.995153][T11262] BTRFS info (device loop1): enabling ssd optimizations
[ 328.995741][T11262] BTRFS info (device loop1): auto enabling async discard
[ 329.025611][T11240] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 329.026377][T11240] BTRFS info (device loop0): max_inline at 0
[ 329.031013][T11240] BTRFS info (device loop0): using free space tree
[ 329.034746][T11238] loop2: detected capacity change from 0 to 32768
[ 329.039354][T11238] BTRFS: device /dev/loop2 using temp-fsid 71b0de5e-5ba1-4e08-a48b-f4b2509eae53
[ 329.040198][T11238] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11238)
[ 329.061506][T11238] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 329.062449][T11238] BTRFS info (device loop2): max_inline at 0
[ 329.062926][T11238] BTRFS info (device loop2): using free space tree
[ 329.089395][T11256] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 329.107220][T11262] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 329.243050][T11238] BTRFS info (device loop2): enabling ssd optimizations
[ 329.245398][T11238] BTRFS info (device loop2): auto enabling async discard
[ 329.253702][T11240] BTRFS info (device loop0): enabling ssd optimizations
[ 329.256238][T11240] BTRFS info (device loop0): auto enabling async discard
[ 329.372668][T11240] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 329.375277][T11238] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 329.873259][T11336] loop5: detected capacity change from 0 to 32768
[ 329.897074][T11336] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11336)
executing program
[ 329.927201][T11336] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 329.928054][T11336] BTRFS info (device loop5): max_inline at 0
[ 329.928523][T11336] BTRFS info (device loop5): using free space tree
[ 329.952046][T11323] loop6: detected capacity change from 0 to 32768
executing program
[ 329.987087][T11323] BTRFS: device /dev/loop6 using temp-fsid d7f57b5c-2a09-4e67-b65a-d872cbb9f925
[ 329.987943][T11323] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11323)
[ 330.019134][T11323] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 330.019779][T11323] BTRFS info (device loop6): max_inline at 0
[ 330.020127][T11323] BTRFS info (device loop6): using free space tree
[ 330.179467][T11336] BTRFS info (device loop5): enabling ssd optimizations
[ 330.180085][T11336] BTRFS info (device loop5): auto enabling async discard
[ 330.251350][T11323] BTRFS info (device loop6): enabling ssd optimizations
[ 330.251948][T11323] BTRFS info (device loop6): auto enabling async discard
[ 330.263658][T11336] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
executing program
[ 330.273092][T11389] loop7: detected capacity change from 0 to 32768
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 330.282266][T11389] BTRFS: device /dev/loop7 using temp-fsid bbe4b0c4-5822-4a31-9856-2b7af5d38741
[ 330.283553][T11389] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11389)
[ 330.301455][T11389] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 330.302204][T11389] BTRFS info (device loop7): max_inline at 0
[ 330.307055][T11389] BTRFS info (device loop7): using free space tree
[ 330.320052][T11323] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 330.499323][T11389] BTRFS info (device loop7): enabling ssd optimizations
[ 330.511646][T11389] BTRFS info (device loop7): auto enabling async discard
[ 330.569166][T11389] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
executing program
[ 331.115476][T11447] loop0: detected capacity change from 0 to 32768
[ 331.129410][T11447] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11447)
[ 331.147458][T11447] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 331.147992][T11447] BTRFS info (device loop0): max_inline at 0
[ 331.148333][T11447] BTRFS info (device loop0): using free space tree
[ 331.220833][T11417] loop1: detected capacity change from 0 to 32768
[ 331.224609][T11417] BTRFS: device /dev/loop1 using temp-fsid a7cba76d-db27-4de7-800f-ace056438332
[ 331.226558][T11417] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11417)
[ 331.240594][T11417] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 331.243721][T11417] BTRFS info (device loop1): max_inline at 0
[ 331.245744][T11417] BTRFS info (device loop1): using free space tree
[ 331.335853][T11414] loop3: detected capacity change from 0 to 32768
[ 331.355823][T11447] BTRFS info (device loop0): enabling ssd optimizations
[ 331.357363][T11447] BTRFS info (device loop0): auto enabling async discard
[ 331.362627][T11471] loop2: detected capacity change from 0 to 32768
[ 331.387610][T11471] BTRFS: device /dev/loop2 using temp-fsid 13b32bfa-1e8a-4277-b1a5-f7b497d52ef3
[ 331.389932][T11471] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11471)
[ 331.424675][T11447] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 331.438302][T11471] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 331.439341][T11471] BTRFS info (device loop2): max_inline at 0
[ 331.440065][T11471] BTRFS info (device loop2): using free space tree
[ 331.443534][T11414] BTRFS: device /dev/loop3 using temp-fsid aeb62d92-6b7a-467c-9952-b39ba6f7872a
[ 331.444403][T11414] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11414)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 331.539162][T11414] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 331.557078][T11414] BTRFS info (device loop3): max_inline at 0
[ 331.558691][T11414] BTRFS info (device loop3): using free space tree
[ 331.570978][T11417] BTRFS info (device loop1): enabling ssd optimizations
[ 331.572091][T11417] BTRFS info (device loop1): auto enabling async discard
[ 331.640342][T11417] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 331.764037][T11414] BTRFS info (device loop3): enabling ssd optimizations
[ 331.764991][T11414] BTRFS info (device loop3): auto enabling async discard
[ 331.765444][T11471] BTRFS info (device loop2): enabling ssd optimizations
[ 331.766214][T11471] BTRFS info (device loop2): auto enabling async discard
[ 331.846782][T11414] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 331.884344][T11471] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 332.220206][T11528] loop7: detected capacity change from 0 to 32768
[ 332.247835][T11528] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11528)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 332.266362][T11528] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 332.267988][T11528] BTRFS info (device loop7): max_inline at 0
[ 332.268291][T11528] BTRFS info (device loop7): using free space tree
executing program
executing program
[ 332.475768][T11487] loop5: detected capacity change from 0 to 32768
[ 332.480316][T11487] BTRFS: device /dev/loop5 using temp-fsid 6c1df7c3-5151-4dd3-97ee-7139066a06d1
[ 332.481013][T11487] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11487)
[ 332.494084][T11481] loop6: detected capacity change from 0 to 32768
[ 332.524830][T11481] BTRFS: device /dev/loop6 using temp-fsid ed37d40b-b0c9-4c93-86a3-636895c63dd1
[ 332.525520][T11481] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11481)
[ 332.530831][T11487] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 332.533167][T11487] BTRFS info (device loop5): max_inline at 0
[ 332.533594][T11487] BTRFS info (device loop5): using free space tree
[ 332.589624][T11481] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 332.590334][T11481] BTRFS info (device loop6): max_inline at 0
[ 332.590750][T11481] BTRFS info (device loop6): using free space tree
[ 332.595305][T11528] BTRFS info (device loop7): enabling ssd optimizations
[ 332.595811][T11528] BTRFS info (device loop7): auto enabling async discard
executing program
executing program
[ 332.707560][T11487] BTRFS info (device loop5): enabling ssd optimizations
[ 332.708094][T11487] BTRFS info (device loop5): auto enabling async discard
[ 332.721567][T11481] BTRFS info (device loop6): enabling ssd optimizations
[ 332.722052][T11481] BTRFS info (device loop6): auto enabling async discard
[ 332.730817][T11528] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 332.776039][T11487] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 332.801382][T11481] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 333.166526][T11605] loop3: detected capacity change from 0 to 32768
[ 333.187386][T11605] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11605)
[ 333.230997][T11605] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 333.231807][T11605] BTRFS info (device loop3): max_inline at 0
[ 333.232279][T11605] BTRFS info (device loop3): using free space tree
[ 333.499407][T11605] BTRFS info (device loop3): enabling ssd optimizations
[ 333.499989][T11605] BTRFS info (device loop3): auto enabling async discard
executing program
executing program
[ 333.625268][T11605] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 333.664960][T11575] loop0: detected capacity change from 0 to 32768
[ 333.688704][T11575] BTRFS: device /dev/loop0 using temp-fsid 454d59f6-54d8-417f-8085-74653532bcb6
[ 333.689286][T11575] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11575)
[ 333.712219][T11575] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 333.712792][T11575] BTRFS info (device loop0): max_inline at 0
[ 333.713118][T11575] BTRFS info (device loop0): using free space tree
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 333.825415][T11575] BTRFS info (device loop0): enabling ssd optimizations
[ 333.825862][T11575] BTRFS info (device loop0): auto enabling async discard
[ 333.871296][T11595] loop1: detected capacity change from 0 to 32768
[ 333.915156][T11595] BTRFS: device /dev/loop1 using temp-fsid 945cb25e-c31a-4a84-a45c-f97bf87afb29
[ 333.915859][T11595] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11595)
[ 333.950605][T11595] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 333.951234][T11595] BTRFS info (device loop1): max_inline at 0
[ 333.951632][T11595] BTRFS info (device loop1): using free space tree
[ 333.961633][T11575] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 334.096093][T11631] loop2: detected capacity change from 0 to 32768
[ 334.100087][T11631] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11631)
[ 334.107375][T11631] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 334.108140][T11631] BTRFS info (device loop2): max_inline at 0
[ 334.108589][T11631] BTRFS info (device loop2): using free space tree
[ 334.111985][T11595] BTRFS info (device loop1): enabling ssd optimizations
[ 334.112571][T11595] BTRFS info (device loop1): auto enabling async discard
[ 334.180050][T11595] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 334.330549][T11631] BTRFS info (device loop2): enabling ssd optimizations
[ 334.331137][T11631] BTRFS info (device loop2): auto enabling async discard
executing program
[ 334.434218][T11631] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 334.615506][T11668] loop7: detected capacity change from 0 to 32768
[ 334.634927][T11668] BTRFS: device /dev/loop7 using temp-fsid 64f691e6-2017-4f10-b4fd-618e0624aea5
[ 334.635855][T11668] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11668)
[ 334.672900][T11668] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 334.721881][T11668] BTRFS info (device loop7): max_inline at 0
[ 334.722389][T11668] BTRFS info (device loop7): using free space tree
[ 334.829912][T11689] loop4: detected capacity change from 0 to 32768
[ 334.845409][T11689] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (11689)
[ 334.897552][T11665] loop5: detected capacity change from 0 to 32768
[ 334.907854][T11689] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 334.908571][T11689] BTRFS info (device loop4): max_inline at 0
[ 334.909009][T11689] BTRFS info (device loop4): using free space tree
[ 334.929955][T11665] BTRFS: device /dev/loop5 using temp-fsid 9b97b7b2-9f7d-40c8-8607-ceedda48a256
[ 334.930676][T11665] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11665)
[ 334.957968][T11684] loop6: detected capacity change from 0 to 32768
[ 334.982381][T11668] BTRFS info (device loop7): enabling ssd optimizations
[ 334.982913][T11668] BTRFS info (device loop7): auto enabling async discard
[ 334.993085][T11684] BTRFS: device /dev/loop6 using temp-fsid 8df9225e-d32d-4e24-acf6-6592c685d640
[ 334.994251][T11684] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11684)
[ 334.997342][T11665] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 334.999247][T11665] BTRFS info (device loop5): max_inline at 0
[ 335.000301][T11665] BTRFS info (device loop5): using free space tree
executing program
[ 335.055408][T11684] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 335.072004][T11684] BTRFS info (device loop6): max_inline at 0
[ 335.082614][T11684] BTRFS info (device loop6): using free space tree
[ 335.103921][T11668] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 335.200158][T11689] BTRFS info (device loop4): enabling ssd optimizations
[ 335.200784][T11689] BTRFS info (device loop4): auto enabling async discard
[ 335.212113][T11665] BTRFS info (device loop5): enabling ssd optimizations
[ 335.212841][T11665] BTRFS info (device loop5): auto enabling async discard
executing program
[ 335.252532][T11665] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 335.284105][T11689] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 335.318941][T11684] BTRFS info (device loop6): enabling ssd optimizations
[ 335.321465][T11684] BTRFS info (device loop6): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 335.375612][T11684] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 335.398312][T11733] loop3: detected capacity change from 0 to 32768
[ 335.447060][T11733] BTRFS: device /dev/loop3 using temp-fsid 0aed2c7f-7243-4aa7-9b9f-65bfe0a65dd2
[ 335.447841][T11733] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11733)
[ 335.459185][T11733] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 335.464142][T11733] BTRFS info (device loop3): max_inline at 0
[ 335.470720][T11733] BTRFS info (device loop3): using free space tree
executing program
[ 335.751495][T11733] BTRFS info (device loop3): enabling ssd optimizations
[ 335.751997][T11733] BTRFS info (device loop3): auto enabling async discard
[ 335.825326][T11733] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 336.068724][T11791] loop1: detected capacity change from 0 to 32768
[ 336.078431][T11791] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11791)
[ 336.097229][T11791] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 336.098008][T11791] BTRFS info (device loop1): max_inline at 0
[ 336.105573][T11791] BTRFS info (device loop1): using free space tree
executing program
[ 336.272705][T11791] BTRFS info (device loop1): enabling ssd optimizations
[ 336.273317][T11791] BTRFS info (device loop1): auto enabling async discard
[ 336.360861][T11791] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 336.513350][T11764] loop0: detected capacity change from 0 to 32768
[ 336.530656][T11764] BTRFS: device /dev/loop0 using temp-fsid 00de5e74-9811-4e4b-b901-4e828a72c5a1
[ 336.531320][T11764] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (11764)
[ 336.559096][T11764] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 336.560137][T11764] BTRFS info (device loop0): max_inline at 0
[ 336.560568][T11764] BTRFS info (device loop0): using free space tree
[ 336.563624][T11809] loop2: detected capacity change from 0 to 32768
[ 336.576040][T11809] BTRFS: device /dev/loop2 using temp-fsid 13e53e93-f4ac-49d6-b6fb-ca82385201aa
[ 336.576731][T11809] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (11809)
[ 336.593832][T11809] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 336.594881][T11809] BTRFS info (device loop2): max_inline at 0
[ 336.595322][T11809] BTRFS info (device loop2): using free space tree
[ 336.684534][T11764] BTRFS info (device loop0): enabling ssd optimizations
[ 336.685058][T11764] BTRFS info (device loop0): auto enabling async discard
[ 336.705963][ T1239] ieee802154 phy0 wpan0: encryption failed: -22
[ 336.706735][ T1239] ieee802154 phy1 wpan1: encryption failed: -22
[ 336.774748][T11764] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 336.790715][T11809] BTRFS info (device loop2): enabling ssd optimizations
[ 336.791276][T11809] BTRFS info (device loop2): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 336.821665][T11871] loop3: detected capacity change from 0 to 32768
[ 336.824623][T11871] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (11871)
[ 336.851764][T11871] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 336.852513][T11871] BTRFS info (device loop3): max_inline at 0
[ 336.853020][T11871] BTRFS info (device loop3): using free space tree
[ 336.914174][T11809] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 337.045900][T11876] loop6: detected capacity change from 0 to 32768
[ 337.053889][T11876] BTRFS: device /dev/loop6 using temp-fsid 745251f6-8396-4f95-8ee0-3e0cb3792496
[ 337.054611][T11876] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 scanned by syz-executor301 (11876)
[ 337.071869][T11876] BTRFS info (device loop6): using crc32c (crc32c-intel) checksum algorithm
[ 337.073824][T11876] BTRFS info (device loop6): max_inline at 0
[ 337.074295][T11876] BTRFS info (device loop6): using free space tree
executing program
[ 337.113512][T11871] BTRFS info (device loop3): enabling ssd optimizations
[ 337.114332][T11871] BTRFS info (device loop3): auto enabling async discard
[ 337.133981][T11871] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 337.198638][T11844] loop5: detected capacity change from 0 to 32768
[ 337.231666][T11844] BTRFS: device /dev/loop5 using temp-fsid ea62e781-e327-4ff4-9693-7e8ec0fcd5db
[ 337.239294][T11844] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (11844)
[ 337.299820][T11844] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 337.306547][T11844] BTRFS info (device loop5): max_inline at 0
[ 337.314703][T11876] BTRFS info (device loop6): enabling ssd optimizations
[ 337.315292][T11876] BTRFS info (device loop6): auto enabling async discard
[ 337.315722][T11844] BTRFS info (device loop5): using free space tree
[ 337.421525][T11876] BTRFS info (device loop6): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 337.458543][T11852] loop7: detected capacity change from 0 to 32768
[ 337.463454][T11852] BTRFS: device /dev/loop7 using temp-fsid b6c50a1c-8aee-4149-90f9-14268597d16e
[ 337.464191][T11852] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (11852)
[ 337.487110][T11852] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 337.489384][T11852] BTRFS info (device loop7): max_inline at 0
[ 337.490316][T11852] BTRFS info (device loop7): using free space tree
[ 337.509606][T11844] BTRFS info (device loop5): enabling ssd optimizations
[ 337.510226][T11844] BTRFS info (device loop5): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 337.688376][T11844] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 337.734614][T11852] BTRFS info (device loop7): enabling ssd optimizations
[ 337.735200][T11852] BTRFS info (device loop7): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 337.832432][T11852] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
executing program
executing program
executing program
[ 338.364786][T11933] loop1: detected capacity change from 0 to 32768
[ 338.389171][T11933] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (11933)
[ 338.409978][T11933] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 338.410759][T11933] BTRFS info (device loop1): max_inline at 0
[ 338.411200][T11933] BTRFS info (device loop1): using free space tree
executing program
[ 338.692163][T11933] BTRFS info (device loop1): enabling ssd optimizations
[ 338.692806][T11933] BTRFS info (device loop1): auto enabling async discard
[ 338.777049][T11933] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 339.111192][T11995] loop4: detected capacity change from 0 to 32768
[ 339.123470][T11995] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz-executor301 (11995)
[ 339.164026][T12010] loop3: detected capacity change from 0 to 32768
[ 339.177671][T12000] loop2: detected capacity change from 0 to 32768
[ 339.184101][T11995] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm
[ 339.184795][T11995] BTRFS info (device loop4): max_inline at 0
[ 339.185314][T11995] BTRFS info (device loop4): using free space tree
[ 339.197808][T12000] BTRFS: device /dev/loop2 using temp-fsid 1cc04a4f-aca2-4c62-b469-953396320253
[ 339.198552][T12000] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (12000)
[ 339.228690][T12000] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 339.229403][T12000] BTRFS info (device loop2): max_inline at 0
[ 339.229861][T12000] BTRFS info (device loop2): using free space tree
[ 339.241045][T12010] BTRFS: device /dev/loop3 using temp-fsid bf36d360-9931-4934-8616-89a6cd1e4766
[ 339.241779][T12010] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (12010)
[ 339.299287][T12010] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 339.300903][T12010] BTRFS info (device loop3): max_inline at 0
[ 339.301376][T12010] BTRFS info (device loop3): using free space tree
[ 339.320722][T12001] loop0: detected capacity change from 0 to 32768
[ 339.341352][T12001] BTRFS: device /dev/loop0 using temp-fsid 4dc2c25d-2502-4266-8bed-9c156750cdd3
[ 339.348297][T12001] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (12001)
[ 339.432080][T12001] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 339.433169][T12001] BTRFS info (device loop0): max_inline at 0
[ 339.433635][T12001] BTRFS info (device loop0): using free space tree
[ 339.447714][T11995] BTRFS info (device loop4): enabling ssd optimizations
[ 339.448441][T11995] BTRFS info (device loop4): auto enabling async discard
[ 339.502392][T12000] BTRFS info (device loop2): enabling ssd optimizations
[ 339.503016][T12000] BTRFS info (device loop2): auto enabling async discard
[ 339.541422][T12010] BTRFS info (device loop3): enabling ssd optimizations
[ 339.542415][T12010] BTRFS info (device loop3): auto enabling async discard
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
[ 339.629644][T12000] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 339.630957][T11995] BTRFS info (device loop4): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 339.668246][T12010] BTRFS info (device loop3): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 339.720765][T12001] BTRFS info (device loop0): enabling ssd optimizations
[ 339.721297][T12001] BTRFS info (device loop0): auto enabling async discard
[ 339.847373][T12001] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 339.898452][T12031] loop5: detected capacity change from 0 to 32768
[ 339.919047][T12031] BTRFS: device /dev/loop5 using temp-fsid 21a71d86-d028-42db-9d84-d5c1f46c6f53
[ 339.919786][T12031] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 scanned by syz-executor301 (12031)
[ 339.962258][T12031] BTRFS info (device loop5): using crc32c (crc32c-intel) checksum algorithm
[ 339.963021][T12031] BTRFS info (device loop5): max_inline at 0
[ 339.968476][T12031] BTRFS info (device loop5): using free space tree
[ 340.204577][T12031] BTRFS info (device loop5): enabling ssd optimizations
[ 340.205192][T12031] BTRFS info (device loop5): auto enabling async discard
executing program
[ 340.297323][T12031] BTRFS info (device loop5): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 340.412023][T12034] loop7: detected capacity change from 0 to 32768
[ 340.428214][T12034] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop7 scanned by syz-executor301 (12034)
[ 340.491704][T12034] BTRFS info (device loop7): using crc32c (crc32c-intel) checksum algorithm
[ 340.492967][T12034] BTRFS info (device loop7): max_inline at 0
[ 340.493436][T12034] BTRFS info (device loop7): using free space tree
executing program
executing program
executing program
[ 340.729563][T12104] loop1: detected capacity change from 0 to 32768
[ 340.743327][T12034] BTRFS info (device loop7): enabling ssd optimizations
[ 340.747874][T12034] BTRFS info (device loop7): auto enabling async discard
[ 340.750144][T12104] BTRFS: device /dev/loop1 using temp-fsid 61183919-6c06-4360-81a5-cd760479dd87
[ 340.753227][T12104] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz-executor301 (12104)
[ 340.787157][T12104] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[ 340.787965][T12104] BTRFS info (device loop1): max_inline at 0
[ 340.788423][T12104] BTRFS info (device loop1): using free space tree
[ 340.828339][T12034] BTRFS info (device loop7): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 341.018259][T12104] BTRFS info (device loop1): enabling ssd optimizations
[ 341.018850][T12104] BTRFS info (device loop1): auto enabling async discard
[ 341.091155][T12104] BTRFS info (device loop1): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
executing program
executing program
[ 341.392256][T12149] loop2: detected capacity change from 0 to 32768
[ 341.408392][T12149] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz-executor301 (12149)
[ 341.447468][T12149] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm
[ 341.448437][T12149] BTRFS info (device loop2): max_inline at 0
[ 341.448952][T12149] BTRFS info (device loop2): using free space tree
[ 341.487980][T12138] loop0: detected capacity change from 0 to 32768
[ 341.519407][T12138] BTRFS: device /dev/loop0 using temp-fsid 55c7ea20-5f54-4927-9cb7-e11c60896c76
[ 341.520167][T12138] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop0 scanned by syz-executor301 (12138)
[ 341.553606][T12138] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[ 341.554721][T12138] BTRFS info (device loop0): max_inline at 0
[ 341.555195][T12138] BTRFS info (device loop0): using free space tree
[ 341.599750][T12142] loop3: detected capacity change from 0 to 32768
[ 341.627342][T12142] BTRFS: device /dev/loop3 using temp-fsid d086c2d6-c7b9-4805-a931-65b68994d86b
[ 341.628138][T12142] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz-executor301 (12142)
executing program
[ 341.690193][T12149] BTRFS info (device loop2): enabling ssd optimizations
[ 341.690693][T12149] BTRFS info (device loop2): auto enabling async discard
[ 341.701271][T12142] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[ 341.701960][T12142] BTRFS info (device loop3): max_inline at 0
[ 341.702450][T12142] BTRFS info (device loop3): using free space tree
[ 341.776899][T12138] BTRFS info (device loop0): enabling ssd optimizations
[ 341.777447][T12138] BTRFS info (device loop0): auto enabling async discard
[ 341.781218][T12149] BTRFS info (device loop2): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
write to /proc/sys/net/core/bpf_jit_kallsyms failed: No such file or directory
write to /proc/sys/net/core/bpf_jit_harden failed: No such file or directory
[ 341.923023][T12245] BTRFS info (device loop0): setting incompat feature flag for DEFAULT_SUBVOL (0x2)
[ 341.944113][T12138] assertion failed: !anon_dev, in fs/btrfs/disk-io.c:1319
[ 341.945271][T12138] ------------[ cut here ]------------
[ 341.945705][T12138] kernel BUG at fs/btrfs/disk-io.c:1319!
[ 341.961819][T12138] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 341.962313][T12138] CPU: 0 PID: 12138 Comm: syz-executor301 Not tainted 6.6.0-gd2f51b3516da #1
[ 341.962963][T12138] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 341.963659][T12138] RIP: 0010:btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.964171][T12138] Code: ed e9 5f fd ff ff e8 c5 86 1e fe b9 27 05 00 00 48 c7 c2 40 18 37 8a 48 c7 c6 60 51 37 8a 48 c7 c7 c0 18 37 8a e8 46 ec 01 fe <0f> 0b e8 0f 86 71 fe e9 8d fb ff ff 49 c7 c5 fe ff ff ff e9 f2 fd
[ 341.965567][T12138] RSP: 0018:ffffc9000352f6e0 EFLAGS: 00010286
[ 341.966034][T12138] RAX: 0000000000000037 RBX: 000000000000003c RCX: ffffffff816673f9
[ 341.966616][T12138] RDX: 0000000000000000 RSI: ffffffff816704ce RDI: 0000000000000005
[ 341.967210][T12138] RBP: ffff888051c386e8 R08: 0000000000000005 R09: 0000000000000000
[ 341.967817][T12138] R10: 0000000080000000 R11: 0000000000000001 R12: dffffc0000000000
[ 341.968412][T12138] R13: ffff888051c38000 R14: ffffc9000352f758 R15: 0000000000000001
[ 341.969013][T12138] FS: 00007f69a57d8640(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000
[ 341.969672][T12138] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 341.970159][T12138] CR2: 00007ffeaebee980 CR3: 000000004edfe000 CR4: 0000000000350ef0
[ 341.970682][T12138] Call Trace:
[ 341.970931][T12138] <TASK>
[ 341.971161][T12138] ? show_regs+0x96/0xa0
[ 341.971524][T12138] ? die+0x38/0xb0
[ 341.971822][T12138] ? do_trap+0x22b/0x420
[ 341.972165][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.972625][T12138] ? do_error_trap+0x107/0x240
[ 341.972997][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.973442][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.973889][T12138] ? handle_invalid_op+0x34/0x40
[ 341.974288][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.974743][T12138] ? exc_invalid_op+0x5d/0x80
[ 341.975131][T12138] ? asm_exc_invalid_op+0x1a/0x20
[ 341.975517][T12138] ? __wake_up_klogd.part.0+0x99/0xf0
[ 341.975952][T12138] ? vprintk+0x7e/0x90
[ 341.976277][T12138] ? btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 341.976731][T12138] ? btrfs_init_root_free_objectid+0x290/0x290
[ 341.977213][T12138] ? free_extent_buffer+0x1b0/0x380
[ 341.977621][T12138] ? alloc_extent_buffer+0x17f0/0x17f0
[ 341.978040][T12138] btrfs_get_new_fs_root+0xd3/0xf0
[ 341.978446][T12138] create_subvol+0xd02/0x1650
[ 341.978821][T12138] ? btrfs_ioctl_get_subvol_info+0x1170/0x1170
[ 341.979276][T12138] ? security_inode_permission+0xc9/0xf0
[ 341.979705][T12138] ? inode_permission+0xdc/0x5e0
[ 341.980085][T12138] btrfs_mksubvol+0xe95/0x12b0
[ 341.980466][T12138] ? create_subvol+0x1650/0x1650
[ 341.980857][T12138] ? mnt_get_write_access+0x212/0x300
[ 341.981257][T12138] __btrfs_ioctl_snap_create+0x2f9/0x4f0
[ 341.981695][T12138] ? _copy_from_user+0x13/0xf0
[ 341.982061][T12138] btrfs_ioctl_snap_create+0x16b/0x200
[ 341.982485][T12138] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 341.982926][T12138] btrfs_ioctl+0x35f0/0x5cf0
[ 341.983291][T12138] ? tomoyo_path_number_perm+0x16a/0x550
[ 341.983763][T12138] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 341.984218][T12138] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 341.984733][T12138] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 341.985190][T12138] ? do_vfs_ioctl+0x138/0x16c0
[ 341.985577][T12138] ? vfs_fileattr_set+0xc40/0xc40
[ 341.985985][T12138] ? ioctl_has_perm.constprop.0.isra.0+0x2af/0x410
[ 341.986488][T12138] ? ioctl_has_perm.constprop.0.isra.0+0x2b8/0x410
[ 341.986984][T12138] ? selinux_bprm_creds_for_exec+0xb20/0xb20
[ 341.987450][T12138] ? __fget_files+0x1ae/0x330
[ 341.987903][T12138] ? lock_downgrade+0x64b/0x690
[ 341.988256][T12138] ? lock_downgrade+0x690/0x690
[ 341.988628][T12138] ? selinux_file_ioctl+0x184/0x280
[ 341.989023][T12138] ? selinux_file_ioctl+0xba/0x280
[ 341.989423][T12138] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 341.989937][T12138] __x64_sys_ioctl+0x19d/0x210
[ 341.990325][T12138] do_syscall_64+0x3f/0xe0
[ 341.990674][T12138] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 341.991127][T12138] RIP: 0033:0x7f69a603e20d
[ 341.991478][T12138] Code: c3 e8 b7 28 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
[ 341.992910][T12138] RSP: 002b:00007f69a57d80d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 341.993538][T12138] RAX: ffffffffffffffda RBX: 00007f69a60e2388 RCX: 00007f69a603e20d
[ 341.994130][T12138] RDX: 0000000020000140 RSI: 000000005000940e RDI: 0000000000000003
[ 341.994730][T12138] RBP: 00007f69a60e2380 R08: 00007f69a57d8640 R09: 0000000000000000
[ 341.995450][T12138] R10: 00007f69a57d8640 R11: 0000000000000246 R12: 00007f69a60e238c
[ 341.996109][T12138] R13: 000000000000000b R14: 00007f69a5ffec90 R15: 00007f69a57b8000
[ 341.996693][T12138] </TASK>
[ 341.996988][T12138] Modules linked in:
executing program
[ 342.036928][T12138] ---[ end trace 0000000000000000 ]---
[ 342.037378][T12138] RIP: 0010:btrfs_get_root_ref.part.0+0x9aa/0xa60
[ 342.037851][T12138] Code: ed e9 5f fd ff ff e8 c5 86 1e fe b9 27 05 00 00 48 c7 c2 40 18 37 8a 48 c7 c6 60 51 37 8a 48 c7 c7 c0 18 37 8a e8 46 ec 01 fe <0f> 0b e8 0f 86 71 fe e9 8d fb ff ff 49 c7 c5 fe ff ff ff e9 f2 fd
[ 342.040440][T12138] RSP: 0018:ffffc9000352f6e0 EFLAGS: 00010286
[ 342.044472][T12138] RAX: 0000000000000037 RBX: 000000000000003c RCX: ffffffff816673f9
[ 342.045187][T12138] RDX: 0000000000000000 RSI: ffffffff816704ce RDI: 0000000000000005
[ 342.046922][T12138] RBP: ffff888051c386e8 R08: 0000000000000005 R09: 0000000000000000
[ 342.047559][T12138] R10: 0000000080000000 R11: 0000000000000001 R12: dffffc0000000000
[ 342.048217][T12138] R13: ffff888051c38000 R14: ffffc9000352f758 R15: 0000000000000001
[ 342.049969][T12138] FS: 00007f69a57d8640(0000) GS:ffff88807ec00000(0000) knlGS:0000000000000000
[ 342.051262][T12138] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 342.051801][T12138] CR2: 00007ff330201a10 CR3: 000000004edfe000 CR4: 0000000000350ef0
[ 342.053696][T12142] BTRFS info (device loop3): enabling ssd optimizations
[ 342.061389][T12142] BTRFS info (device loop3): auto enabling async discard
[ 342.070083][T12138] Kernel panic - not syncing: Fatal exception
[ 342.070762][T12138] Kernel Offset: disabled
[ 342.071110][T12138] Rebooting in 86400 seconds..
VM DIAGNOSIS:
03:44:14 Registers:
info registers vcpu 0
RAX=fffffbfff20f3db0 RBX=00000000000007c3 RCX=ffffffff8163bc3a RDX=fffffbfff20f3db0
RSI=0000000000000008 RDI=ffffffff9079ed78 RBP=fffffbfff20f3daf RSP=ffffc90000e8f948
R8 =0000000000000000 R9 =fffffbfff20f3daf R10=ffffffff9079ed7f R11=0000000000000000
R12=0000000000000000 R13=0000000000000007 R14=0000000000000001 R15=ffff88801346c690
RIP=ffffffff81d5f84f RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88802cc00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007ffeaebee980 CR3=0000000028896000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000021f3d99c 000000001393e203
YMM01=0000000000000000 0000000000000000 0000000000000000 02e3e5baf5df4e6f
YMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM03=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
YMM04=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
YMM05=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffff0000
YMM06=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffffff
YMM07=0000000000000000 0000000000000000 ffffffffffffffff ffffffffffff0000
YMM08=0000000000000000 0000000000000000 36396f7369007265 6c6c616b7a797300
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 1
RAX=00000000001f05b4 RBX=00007f69a57d7660 RCX=0000000000000000 RDX=0000000000000035
RSI=0000000000000001 RDI=00007f699d3b8000 RBP=0000000000000102 RSP=00007f69a57d7600
R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000000 R11=00007f69a57d7670
R12=00007f69a57d7670 R13=00007f69a57d7700 R14=0000000000000001 R15=0000000000000000
RIP=00007f69a5fe593c RFL=00000202 [-------] CPL=3 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0033 0000000000000000 ffffffff 00a0fb00 DPL=3 CS64 [-RA]
SS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 00007f69a57d8640 00000000 00000000
GS =0000 0000000000000000 00000000 00000000
LDT=0000 fffffe4200000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f699d5a8000 CR3=00000000505e8000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM01=0000000000000000 0000000000000000 0000000000ff0000 00000000000000ff
YMM02=0000000000000000 0000000000000000 0000000000ff0000 00000000000000ff
YMM03=0000000000000000 0000000000000000 00007f69a57d7f50 00007f69a57d7f50
YMM04=0000000000000000 0000000000000000 0000000000000000 00007f69a57d7f8f
YMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM08=0000000000000000 0000000000000000 36396f7369007265 6c6c616b7a797300
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
next reply other threads:[~2024-01-20 4:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-20 4:15 Chenyuan Yang [this message]
2024-01-20 5:59 ` [Linux Kernel Bug] kernel BUG in btrfs_get_root_ref (assertion failed: !anon_dev) and general protection fault in btrfs_update_reloc_root Qu Wenruo
2024-01-20 6:25 ` Chenyuan Yang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CALGdzuo6awWdau3X=8XK547x2vX_-VoFmH1aPsqosRTQ5WzJVA@mail.gmail.com' \
--to=chenyuan0y@gmail.com \
--cc=clm@fb.com \
--cc=dsterba@suse.com \
--cc=josef@toxicpanda.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=zzjas98@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.