program: syz_mount_image$btrfs(&(0x7f00000001c0), &(0x7f0000005140)='./file0\x00', 0x103c008, &(0x7f0000000040)={[{@discard_async}]}, 0x11, 0x513e, &(0x7f00000051c0)="$eJzs3V+IVGUfB/Bn9o+7r8LuCMJr0IVdeBtSdKGyNIRBXqSTQtCFuXkRhCCL3SWYrQiCUSuBlBVowZJdyICQIGyIF3UTaJIgdGGSN10pdFcXxc45z+zMc3bOjOvWmn4+4p55zu88z3lmOBfznd3nTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAQwrrXa2+X1Sc2X7s0d37b4elDjZO3Z48fC6HS3F/J63tfeGnXm7v3vjwaO0y+km2r1W5DZl1/yRqrOnbO9+v8/0YIYTgZYDDfvjhYGLX94cHigKVunDhwdvr0zi1z6zZOXNkze6H41Jk3utITWCn5dXVn4VqqNX8OJEe02m2XXqXjEs36pxfcv/IkAID7sqne3LTejuZvcVvtI2k9adeS9kzSju8QZtobS5GNu6rbPDek9RWaZy2LCiNd55nU89e/1a6n/ZN2EjXuY56dh+aRZrTbPKeS+krNEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBhcq72zvay+sTma5fmzm87PH2ocfL27PFjIVSb+ytZufL/u6eGRm7u+Pa9W5+ffm7t9T8H835xO9R2cLgZH2weD2FfW+VOHPa3sRDqnYVmM3xSLLzVfLA9FgAAAHiUPNH8OdBqZ3FwuKNdaabJSvNflIXFGycOnJ0+vXPL3LqNE1f2zF5Y+nj1LuPVFh2v1a4u/K+0BeMYf9PxFurx0IOFccqlI6Z5/uKPOz4r61/I/9Xy/B9fOfkfAACAByH/p+OU65X/9219cqqsfyH/b+g4ZSH/xxnH/D8Qlpb/AQAA4GH2T+f/WmGccr3y/7NHX/2mrH8h/2/qL/8PtU877vwhTnj/eAibek0dAAAA6CL+3n3ho4WY17NPDtK8fv2L//1UNl4h/9fiePFvJBbP/8PL+7QAAACAB7Czeuvpsnoh/9f7+/3/SLcBZ379+qnlmjwAAADQl48rH0yX1Qv5f7K//L863+YrH7JO38W/QvhoPITR+QdTWeH7MPN8qwAAAAAsk5jTP3z/y6tlxxXy/1T5/f/jnQ7i+v+O+/8V1v+3FbK7/m11YwAAAAAeR8X1/PH2+Nk3F3T7/v1+1/+P3b77Vdn5C/n/SH/5f7B9u5zf/wcAAABL8F/7/r/XCuOU63X//z8G/rpc1r+Q/2f6y/9xu6b96V2Or8/R8RDWzz/I7yZ4Lp5uf1JoDLcVmupJj92xR15ojLQVmqaSHs+Mh9C8BcGRpLA2FmaSwr2xvHAmKVyNhfx6aBXOJ4XL8Uo7NZZPNy1cjIV8gUUjrqBY01oSkfT4vVuP+cKiPX5unRwAAOCxEsNznmWHO5shjbKNSq8DVvc6YKDXAYO9DhhKDkgP7LY/THYW4v53d539NJQo5P8z/eX/+FKsyjbd1v+HuP4//17D1vr/yVioJoVGLNTTOwbU4zmysHsinqNaz3vcW98qAAAAwCMtfi4wuMLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4m717jZHrqg8AfvY5u+v17oYgJVAECygJqZT1eoMthQThACUIJNhU5kOFImzsTbrxJjF+SDg8tHYIAqWoSUlJQIHaraD4S7KiQjwKxELFqGqqRqmEnKY8QqAICWoCUSpqkKuZe8/snXN3Hot37d3095O8c2b+53nn4Tn33jkXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP8fjt/9motbxV9/zeNf/+bDb/7wkQ8s3Pf0Fz52dwjTtce7snDXJac/1Vs59Y5vHf7hZz+z5aInzvTn5fJ42FD9053f+Uis9ScbQ/hKVwi9aeCq4SzQl98fjvW9bDiEi8JioF5iZigrkTYcvjMYwtGwGKhX9bXBEIYLge1PfPvRT1QT9w+GcFkIoZK28f1K1sZgGri8PwsMpYE7erPA/5zN1ANf7c4CcM7im6H+ol+YbswwtnS5Jq+/vhXr2IWVDq8nJsaa5/vl9avcqYL+9IHpc3raStWxKkpvjxPebevg3Vbazvd62opfpPJvKGcXQ5XQvXvm5p0H5w7ER7rDxERPs5pW6Xl+8tkP7lpOet28DmMHxlbkdfjAp3/8oc89c8NDD370LTc98tyvx8+1m6cKm7SYXm2VkL/m1s3zGG3zebIO3n6lb0njbZ+2WpEX+Jeuj//ob/+kVbw0/x9rPf+PL+d4292QO9Z6ZiSbm8dHhmPi9Eg2NwcAAIB1Yz3sNZ3/wrVTreorzf/HOzv+Hw/555P5bLQnQthWS9w1GsKltcezwPHY3HtHQ3hlLTXdGLg+CZwI4SW1xJX1qpISA7HEeBL42Uge2JYETsbAdBL4fAzcmwQ+EgMLSWBXDJxIAm+MgTDbOI4/HsnH0XFgMAZ2ZBtxIZ6F8JuR2FqyrZ6qVwUAALBC8tlhX+PdwrkO55ohTi8XBttliGdgN81QSWpIZ7D1aVXTGnrb1dDdrob6uOdbD79Uc1e7mkunYXQ1Ztj3wV/9WWihNP+fbD3/ryzRka7S8f8Qbqz9jbm788hcPb5juiEDAAAAcA42XH/79lbx0vx/W2fn/8d9Ij2FzOGxuBtiz2gIk42BrNpry4HsqPeGPAAAAADrQf14fP1Y+Gx+m52inc6ny/mnl5k/HvjftmT+n7/1dbe26m9p/j/d2fn/Q423WSdOxl58cjSEgULgu7GX1UDNeAz86A2NgXz8J+MGuCdWlZ+YUK/qnlhiRwxMJoGjzUo8Xi9xaWMgf7Lqjd9VH8dsXqIQAAAAgPMu7g6Ix+Xj+f9PHjz1plblSvP/Hcs7/782Dy6d3j+3IYRNvSH0pD8MeGwoWxgwBoa78sQ3h7K6etKqDg+FcF11YGlVT+fr//emaww+MZhVFQOXvuqLz15eTfzdYAibioHvvfvYlmriQBKoN/6uwRBeUR1t2viXB7LG+9LGHxgI4eWFQL2q9w6EUG2sP63q25X8OgZpVY9UQri4EKhXtbUSwqEAwDoV/yvdXXxw/6E79+ycm5vZt4qJuA9/MNw8OzczseuOud2VJn3anfS5YRmjw+UxNV0OKfFUvkTR8d9dM9JJuv47wcliX/L9+KUTB/P78btQX22cU30Nd69Oh/yaV5ebCIVvUhdqyEPFShafxFL9MX9/2BAGDu6f2Tfx/p0HDuzbnP3tNPtU9jcOKttWm9NtNbRU39bAy+OKYiWbDty2d9P+Q3deNXvbzltmbpm5fWrytVu2bpma3Lp1U3VUk9nfNkO9Yqmqk6GePdZ2qN0rPdSX9hYqOR+fGhISEustMX/XsQ3NPnrCUvP/va3n//FTJ37y5+szNDv+PxYP82ePLx7m3xEDRzs9/j/W7Gh+/cSA8SQwHwPzDvMDAADwwhB3R8bdjnF/Y/+xq3/Rqlxp/j/f2e//V2j9//rS9W9rtsz/lbHEZLP1/9Nl/uvr/883W/8/Xea/vv7/0Quw/v/BeiDZJL+x/j8AAPBCcP7W/2+7vH96gYBShrbL+6cXCChlaLuMf6cXCFj2+v9Tt/7wJ6GF0vz/3s7m/xbuBwAAgLXjvn969hWt4qX5/9HO5v8ru/5f8TT7Zuf/h2bn/483C0w3WxjwHNb/y/er+GEAAAAAF0Sz9f/Ojv7Fu1qVK83/Fzqb/8fTLrobcsdaz4xka9qFdE270yP1nwwAAADA+tAdJib6OszbsDLq9X94m0/mS4G2Shd999r/uqVVfaX5/4nO5v8Nv8t44NM//tDnnrnhoTMPfvQtNz3y3K/HF4//AwAAAKun0/0SAAAAAAAAAAAAAADAhXfwPf96ulW89Pv/cGPt8Wa//4/X/Yu/L3hxQ+5Ya/v1//L729/+8KHakoWPjYTw6mJgz5E9F4X82vxXFAOP3nTlJdXEkbTEN37wxp9WE+9JA2+96kXPVxPXJYEdcZHEl6SBeFXF5zcmgbi84r+ngbg9FtJAfx74+MZsHF3ptvr5cLatutJt9R/D2YURutJt9ZXhrI2udID3J4H6AN+XBuIA35EHutNePbwh61UMDMeif7Oh8XINAACsOfFbYF+4eXZuZjJ+hY+3L+1tvI0aliw7XK62p8Pmn8qXJjv+u2tGOkn3pN9FF6813hcq1SFsLn1dLWbpqo1yZWpps+le3GTI7VZ7W61N1998RIPZiCZ23TG3u6/twK9un2Wqt22WzaXJTjFLd22TdlBLB33pYEQdbpsOuhzvd4eJiZ4k1+ticCw0aPeK6PT3+sV1/pq9Cop5Ds/1/b5VfaX5/1hn8/9KcVzP5xcDmI9X1vvLUcv8AwAAwOr6+PW/fTD++8boO/+zVd7S/H+8s/l/3DGWHwrO9naciNf/v2s0hNql9ceywPHY3HtHQ3hlLTUdS2RX2n9bLDGZBY7HHSZXxhI7phurGoiBhSTws5E8cCIJnIyBfC/FF0O+K+e+kRC21FI3NpbYG0uMJYF3xsB4EpiIgckksDEGtiWBX2zMA9NJ4F9iIMw2bqt/2JhvKwAAgOXI51l9jXdDOs9b6G2XoatdhqF2GbrbZai0y9BsFPH+l2KGvuLx+DxDfKgvrXUwqaWUIV4Mf9n9KmUIjzfmTAuWmq6fSTLWmDNm2L5wZGNooTT/n+xs/j/UeJu1fjLO/xev/5cFvhu798l46vh4DPzoDY2BfMfAyTjZvade1XReIp+03xNLbIuB8SSwNwa2JYEdN+aBo5c0BvKZdr3xu+qNz+YlCgEAAAA47+IOgribJs7//3vg93/dqlxp/r+ts/l/bG9DsbGPxFp/sjGEr3Qt9qYeuGo4C8T9GMPx5/EvGw7hosIOjnqJmaGsRH/ScPjOYPYL9f60qq8NZj8+iPe3P/HtRz9RTdw/GMJlhb0v9Ta+X8naGEwDl/dngaE0cEdvFoh7fuqBr3ZnAThn9b2C8QWVn+pSN7Z0uSavvxfKNUHT4ZX2gS6Rb6nfXK2WSvpAvk+1bnlPW6k6Vke6/U8s+902WHjYu+38qPw+/z+43i/vtuIXqbPJ5qkOsXv3zM07D84diI8Uf8laskrPc/FXqp2kV+B1OP+H9zbqbhqppB2YTD4+Jpcut/TrsCtW98Cnf/yhzz1zw0MPfvQtNz3y3K/H23Ww3es3/lD49lv/d+RUYfOutkrIX3Nr/vMkfWDa58l6+G8gfWDc0xZCuHvh0t+0ipfm/9Odzf97k9ua38aNuX80hNcUNu5jcfO/aTT7HCwEsk/Ji8uB7JD7MyNNPzkBAABgpdV3d9T3F8zmt9kJ4ek8uZx/epn54/6KbUvm77TfH7jssn9sFS/N/3e0nv8PJN10/N/xf1aJ4/9LWuu7ogfSB+bPaVd0qTpWRentsfzj/5nepatbp9b6u610pMbx/+D4/5L9W4Hj/805/t+S4//r21p/2krfkvb60hVCGPzytY+3ipfm/3s7m/9b/2/pRfvq6//taLb+395m6//NW/8PAABYVU0WmkvneaXV+0oZ0tX7ShnaLhDYdolB6/8te/2/ob96969CC6X5/3xn8//4cthQbH29rP83fmOTqu6Ngb0WBgQAAGAtaraDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAvrZ6eG3twq/vprHv/6Nx9+84ePfGDhvqe/8LG7Q5itPd6VhbsuOf2p3sqpd3zr8A8/+5ktFz1xppKX68tv/6ghd6z1zEgIRwuPDMfE6ZHqncXA9rc/fKi3mnhsJIRXFwN7juy5qJr4/EgIVxQDj9505SXVxJG0xDd+8MafVhPvSQNvvepFz1cT1+WBrrS7D23MutuVdvcTG0MYLQTq3b11Y2NV9TZuyAPdaRt/P5y1EQPDseiDw1kbMTAXS8wOhLCpN4SetKp/rmRV9aRVfb2SVdWTVvXhSgjXhRB606p+0J9V1ZuO/N/6s6pi4NJXffHZy6uJo/0hbCoGvvfuY1uqifclgXrjf9ofwiuqL5m08S/1ZY33pY3f3xfCy0MI/WmJ53qzEv1piad7Q7i4EKg3/ue9IRwKvCDED5/dxQf3H7pzz865uZl9q5joz9saDDfPzs1M7Lpjbncl6VMzXYX02cPleHeHY3/q2Q/uqt4e/901I52ke/NyfbUuT/U13L16pXrftUq9j/0aKlay+HyU6o/5+8OGMHBw/8y+iffvPHBg3+bsb6fZp7K/PXk021abV2pbdeoP3VZXFCvZdOC2vZv2H7rzqtnbdt4yc8vM7VOTr92ydcvU5Natm6qjmsz+rsRQj5XjPas81Jf2Fio5Hx8AEms6EcKa6IbE2kp0N3y6Ta71/7JLX/QXO9oXKrUP6NK0opilqzbKlRj09a3jyxx0tUfNv6e0HdHm0sShlGWqfZarS5OJxSyDWZba97rS5LBYU3dtk8b73WFioun/dGONd4ub75dLbN5OPZlvuk7TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/xw4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24EAAAAAAAMj/tRGqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsAPHAgAAAADC/K3D6NkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAD///73TPQ=") r0 = open$dir(&(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0xa4, 0x7, 0x7}, {0x6, 0xfd, 0x3, 0xd}]}) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x4010, r1, 0x100000000) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000140)={0x0, 0x4}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000e80), 0x2, 0x0) write$RDMA_USER_CM_CMD_ACCEPT(r2, &(0x7f0000000f40)={0x8, 0x120, 0xfa00, {0x2, {0x5, 0x9, "2c196accf84e289843d1047286b614930c363c73a5850c360510ff920c43857003390a673bcd72cc8c3d961828554a8c8c437e6f2c6cb6bdd828765c4af65108c7b00c0f72264956e0a558facd137e23e3236115db09884c35ba360fc6267590d2fe6b997e143128898af8c8d8e39689d8d8d6a29278daefa7c56a3f3250f29f99f7a8679431dbfb2730f6b441e300c22a754784091d107d0410f0ef24a0175a619faf64662984c4c62f63e38d940329924bc6289b2d7c11bcb8df24bf57ede5135a8cf104f6f96814c7063c6a0ae6078e10154003f9fbe7d674a00350ff6334bad86c7a56241c0d57f31b004e124ba260e82560f5443c38f5498a4dd858558a", 0x6, 0x8, 0xcd, 0x1, 0x9, 0x5, 0x1}}}, 0x128) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r3 = syz_open_dev$radio(&(0x7f0000000080), 0x2, 0x2) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x0, &(0x7f00000002c0), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") r4 = open(&(0x7f0000000000)='./sys\x00', 0x1a1100, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x800000, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x20}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x3, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x5, 0x3, '\x00'}, @NFTA_TARGET_NAME={0xa, 0x1, 'AUDIT\x00'}, @NFTA_TARGET_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xcc}}, 0x0) ioctl$VIDIOC_S_HW_FREQ_SEEK(r3, 0x40305652, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x0, 0x8fc0, 0x65f40}) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x22801, 0x0) write(r6, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) [ 107.370062][ T5312] loop0: detected capacity change from 0 to 32768 [ 107.429653][ T5277] Bluetooth: hci0: command tx timeout [ 107.531874][ T25] audit: type=1326 audit(1787742202.691:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5311 comm="syz.0.0" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb0bfb9e0d9 code=0x0 [ 107.637490][ T5313] loop0: detected capacity change from 0 to 128 [ 107.694987][ T5313] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 107.709572][ T5313] ext4 filesystem being mounted at /0/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 107.726823][ T5310] kernel read not supported for file /newroot/0/sys (pid: 5310 comm: kworker/0:5) [ 107.753431][ T5313] vhci_hcd vhci_hcd.0: remove, state 4 [ 107.755999][ T5313] usb usb7: USB disconnect, device number 1 [ 107.816349][ T179] vhci_hcd vhci_hcd.0: stop threads [ 107.823185][ T179] vhci_hcd vhci_hcd.0: release socket [ 107.826253][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 107.841724][ T179] vhci_hcd vhci_hcd.0: stop threads [ 107.844533][ T179] vhci_hcd vhci_hcd.0: release socket [ 107.846968][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 107.849729][ T179] vhci_hcd vhci_hcd.0: stop threads [ 107.851936][ T179] vhci_hcd vhci_hcd.0: release socket [ 107.854438][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 107.857004][ T179] vhci_hcd vhci_hcd.0: stop threads [ 107.859767][ T179] vhci_hcd vhci_hcd.0: release socket [ 107.862016][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 107.864694][ T179] vhci_hcd vhci_hcd.0: stop threads [ 107.867079][ T179] vhci_hcd vhci_hcd.0: release socket [ 107.870309][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 107.872956][ T179] vhci_hcd vhci_hcd.0: stop threads [ 107.875298][ T179] vhci_hcd vhci_hcd.0: release socket [ 107.877735][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 107.883587][ T179] vhci_hcd vhci_hcd.0: stop threads [ 107.889662][ T179] vhci_hcd vhci_hcd.0: release socket [ 107.894180][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 107.899933][ T179] vhci_hcd vhci_hcd.0: stop threads [ 107.904959][ T179] vhci_hcd vhci_hcd.0: release socket [ 107.911866][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 107.916637][ T5313] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 107.949987][ T5313] vhci_hcd vhci_hcd.0: remove, state 4 [ 107.957539][ T5313] usb usb6: USB disconnect, device number 1 [ 108.064289][ T179] vhci_hcd vhci_hcd.0: stop threads [ 108.066372][ T179] vhci_hcd vhci_hcd.0: release socket [ 108.078408][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 108.093023][ T179] vhci_hcd vhci_hcd.0: stop threads [ 108.102706][ T179] vhci_hcd vhci_hcd.0: release socket [ 108.111635][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 108.123895][ T5313] vhci_hcd vhci_hcd.0: USB bus 6 deregistered [ 108.126651][ T179] vhci_hcd vhci_hcd.0: stop threads [ 108.132611][ T179] vhci_hcd vhci_hcd.0: release socket [ 108.139428][ T179] vhci_hcd vhci_hcd.0: disconnect device [ 108.146065][ T179] vhci_hcd vhci_hcd.0: stop threads [ 108.154173][ T179] ================================================================== [ 108.157573][ T179] BUG: KASAN: slab-use-after-free in vhci_shutdown_connection+0x1d4/0x650 [ 108.161241][ T179] Read of size 8 at addr ffff888034f1cc20 by task kworker/u4:6/179 [ 108.164601][ T179] [ 108.165650][ T179] CPU: 0 UID: 0 PID: 179 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full) [ 108.165664][ T179] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.165671][ T179] Workqueue: usbip_event event_handler [ 108.165686][ T179] Call Trace: [ 108.165692][ T179] [ 108.165698][ T179] dump_stack_lvl+0xe8/0x150 [ 108.165714][ T179] print_address_description+0x55/0x1e0 [ 108.165728][ T179] ? vhci_shutdown_connection+0x1d4/0x650 [ 108.165738][ T179] print_report+0x58/0x70 [ 108.165748][ T179] kasan_report+0x117/0x150 [ 108.165762][ T179] ? vhci_shutdown_connection+0x1d4/0x650 [ 108.165775][ T179] vhci_shutdown_connection+0x1d4/0x650 [ 108.165788][ T179] event_handler+0x2a4/0x4b0 [ 108.165797][ T179] ? process_scheduled_works+0x97a/0x1630 [ 108.165809][ T179] process_scheduled_works+0xc3d/0x1630 [ 108.165827][ T179] ? __pfx_process_scheduled_works+0x10/0x10 [ 108.165839][ T179] ? assign_work+0x3cf/0x5d0 [ 108.165850][ T179] worker_thread+0xa47/0xfb0 [ 108.165869][ T179] kthread+0x38b/0x480 [ 108.165882][ T179] ? __pfx_worker_thread+0x10/0x10 [ 108.165893][ T179] ? __pfx_kthread+0x10/0x10 [ 108.165906][ T179] ret_from_fork+0x514/0xb70 [ 108.165921][ T179] ? __pfx_ret_from_fork+0x10/0x10 [ 108.165934][ T179] ? __switch_to+0xc89/0x1420 [ 108.165946][ T179] ? __pfx_kthread+0x10/0x10 [ 108.165960][ T179] ret_from_fork_asm+0x1a/0x30 [ 108.165976][ T179] [ 108.165979][ T179] [ 108.223722][ T179] Allocated by task 1: [ 108.225465][ T179] kasan_save_track+0x3e/0x80 [ 108.227614][ T179] __kasan_kmalloc+0x93/0xb0 [ 108.229789][ T179] __kmalloc_noprof+0x379/0x720 [ 108.232295][ T179] __usb_create_hcd+0x67/0x900 [ 108.234763][ T179] vhci_hcd_probe+0x104/0x3e0 [ 108.236882][ T179] platform_probe+0xf9/0x190 [ 108.238999][ T179] really_probe+0x254/0xae0 [ 108.241529][ T179] __driver_probe_device+0x1e8/0x360 [ 108.244004][ T179] driver_probe_device+0x4f/0x240 [ 108.246097][ T179] __device_attach_driver+0x270/0x410 [ 108.248335][ T179] bus_for_each_drv+0x258/0x2f0 [ 108.250294][ T179] __device_attach+0x2c4/0x450 [ 108.252235][ T179] device_initial_probe+0xa1/0xd0 [ 108.254271][ T179] bus_probe_device+0x12a/0x220 [ 108.256211][ T179] device_add+0x7d7/0xb80 [ 108.257945][ T179] platform_device_add+0x4bd/0x860 [ 108.260103][ T179] platform_device_register_full+0x53a/0x620 [ 108.262523][ T179] vhci_hcd_init+0x227/0x360 [ 108.264558][ T179] do_one_initcall+0x250/0x870 [ 108.266548][ T179] do_initcall_level+0x10a/0x1a0 [ 108.268617][ T179] do_initcalls+0x59/0xa0 [ 108.270366][ T179] kernel_init_freeable+0x29d/0x3e0 [ 108.272677][ T179] kernel_init+0x22/0x1d0 [ 108.274563][ T179] ret_from_fork+0x514/0xb70 [ 108.276593][ T179] ret_from_fork_asm+0x1a/0x30 [ 108.278610][ T179] [ 108.279671][ T179] Freed by task 5313: [ 108.281453][ T179] kasan_save_track+0x3e/0x80 [ 108.283515][ T179] kasan_save_free_info+0x40/0x50 [ 108.285776][ T179] __kasan_slab_free+0x5c/0x80 [ 108.287844][ T179] kfree+0x1c5/0x640 [ 108.289615][ T179] vhci_hcd_remove+0xe4/0x110 [ 108.291697][ T179] device_release_driver_internal+0x48b/0x880 [ 108.294368][ T179] unbind_store+0x1a1/0x1d0 [ 108.296292][ T179] kernfs_fop_write_iter+0x3a4/0x540 [ 108.298577][ T179] vfs_write+0x612/0xba0 [ 108.300311][ T179] ksys_write+0x150/0x270 [ 108.302158][ T179] do_syscall_64+0x166/0x520 [ 108.304232][ T179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.306788][ T179] [ 108.307876][ T179] Last potentially related work creation: [ 108.310314][ T179] kasan_save_stack+0x3e/0x60 [ 108.312406][ T179] kasan_record_aux_stack+0xbd/0xd0 [ 108.314606][ T179] insert_work+0x3d/0x330 [ 108.316514][ T179] __queue_work+0xd07/0x10d0 [ 108.318543][ T179] queue_work_on+0x106/0x1d0 [ 108.320559][ T179] unlink1+0x344/0x3e0 [ 108.322074][ T179] usb_hcd_unlink_urb+0xe6/0x1e0 [ 108.323833][ T179] usb_kill_urb+0x10b/0x2f0 [ 108.325496][ T179] hub_quiesce+0x211/0x330 [ 108.327447][ T179] hub_suspend+0x904/0xad0 [ 108.329445][ T179] usb_suspend_both+0x285/0x1040 [ 108.331577][ T179] usb_runtime_suspend+0x58/0x110 [ 108.333789][ T179] __rpm_callback+0x2c7/0x950 [ 108.335749][ T179] rpm_suspend+0x89d/0x17a0 [ 108.337686][ T179] __pm_runtime_suspend+0x12f/0x1a0 [ 108.339900][ T179] usb_new_device+0xaee/0x1690 [ 108.341933][ T179] register_root_hub+0x250/0x5c0 [ 108.344130][ T179] usb_add_hcd+0xac7/0xf80 [ 108.345935][ T179] vhci_hcd_probe+0x141/0x3e0 [ 108.347924][ T179] platform_probe+0xf9/0x190 [ 108.350092][ T179] really_probe+0x254/0xae0 [ 108.352294][ T179] __driver_probe_device+0x1e8/0x360 [ 108.355137][ T179] driver_probe_device+0x4f/0x240 [ 108.357971][ T179] __device_attach_driver+0x270/0x410 [ 108.360919][ T179] bus_for_each_drv+0x258/0x2f0 [ 108.363493][ T179] __device_attach+0x2c4/0x450 [ 108.365978][ T179] device_initial_probe+0xa1/0xd0 [ 108.368249][ T179] bus_probe_device+0x12a/0x220 [ 108.370170][ T179] device_add+0x7d7/0xb80 [ 108.371759][ T179] platform_device_add+0x4bd/0x860 [ 108.373642][ T179] platform_device_register_full+0x53a/0x620 [ 108.375859][ T179] vhci_hcd_init+0x227/0x360 [ 108.377702][ T179] do_one_initcall+0x250/0x870 [ 108.379636][ T179] do_initcall_level+0x10a/0x1a0 [ 108.381722][ T179] do_initcalls+0x59/0xa0 [ 108.383523][ T179] kernel_init_freeable+0x29d/0x3e0 [ 108.385798][ T179] kernel_init+0x22/0x1d0 [ 108.388030][ T179] ret_from_fork+0x514/0xb70 [ 108.390158][ T179] ret_from_fork_asm+0x1a/0x30 [ 108.392442][ T179] [ 108.393614][ T179] Second to last potentially related work creation: [ 108.396669][ T179] kasan_save_stack+0x3e/0x60 [ 108.398871][ T179] kasan_record_aux_stack+0xbd/0xd0 [ 108.401330][ T179] insert_work+0x3d/0x330 [ 108.403405][ T179] __queue_work+0xd07/0x10d0 [ 108.405586][ T179] queue_work_on+0x106/0x1d0 [ 108.407586][ T179] usb_hcd_submit_urb+0xa3b/0x1b60 [ 108.409590][ T179] usb_start_wait_urb+0x13f/0x5b0 [ 108.411682][ T179] usb_control_msg+0x234/0x3e0 [ 108.413757][ T179] hub_ext_port_status+0x114/0x810 [ 108.415992][ T179] hub_activate+0x740/0x1b20 [ 108.418031][ T179] process_scheduled_works+0xc3d/0x1630 [ 108.420541][ T179] worker_thread+0xa47/0xfb0 [ 108.422807][ T179] kthread+0x38b/0x480 [ 108.425098][ T179] ret_from_fork+0x514/0xb70 [ 108.427550][ T179] ret_from_fork_asm+0x1a/0x30 [ 108.430117][ T179] [ 108.431410][ T179] The buggy address belongs to the object at ffff888034f1c000 [ 108.431410][ T179] which belongs to the cache kmalloc-8k of size 8192 [ 108.437849][ T179] The buggy address is located 3104 bytes inside of [ 108.437849][ T179] freed 8192-byte region [ffff888034f1c000, ffff888034f1e000) [ 108.444198][ T179] [ 108.445535][ T179] The buggy address belongs to the physical page: [ 108.448836][ T179] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34f18 [ 108.452687][ T179] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 108.456226][ T179] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 108.459368][ T179] page_type: f5(slab) [ 108.461071][ T179] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 108.464666][ T179] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 108.467824][ T179] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 108.471549][ T179] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 108.475600][ T179] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 108.479867][ T179] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 108.483480][ T179] page dumped because: kasan: bad access detected [ 108.486225][ T179] page_owner tracks the page as allocated [ 108.488641][ T179] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16920240976 [ 108.497225][ T179] post_alloc_hook+0x1f9/0x250 [ 108.499238][ T179] get_page_from_freelist+0x2209/0x2280 [ 108.501709][ T179] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 108.504526][ T179] allocate_slab+0x7c/0x5e0 [ 108.506390][ T179] refill_objects+0x2d5/0x350 [ 108.508405][ T179] __pcs_replace_empty_main+0x2c3/0x6b0 [ 108.510782][ T179] __kmalloc_noprof+0x489/0x720 [ 108.512870][ T179] __usb_create_hcd+0x67/0x900 [ 108.514854][ T179] vhci_hcd_probe+0x104/0x3e0 [ 108.516829][ T179] platform_probe+0xf9/0x190 [ 108.518787][ T179] really_probe+0x254/0xae0 [ 108.520720][ T179] __driver_probe_device+0x1e8/0x360 [ 108.522850][ T179] driver_probe_device+0x4f/0x240 [ 108.524836][ T179] __device_attach_driver+0x270/0x410 [ 108.526929][ T179] bus_for_each_drv+0x258/0x2f0 [ 108.528757][ T179] __device_attach+0x2c4/0x450 [ 108.530643][ T179] page last free pid 1 tgid 1 ts 16919904117 stack trace: [ 108.533563][ T179] __free_frozen_pages+0xc93/0xd90 [ 108.535640][ T179] __slab_free+0x274/0x2c0 [ 108.537930][ T179] qlist_free_all+0x99/0x100 [ 108.540178][ T179] kasan_quarantine_reduce+0x148/0x160 [ 108.542414][ T179] __kasan_slab_alloc+0x22/0x80 [ 108.544379][ T179] __kmalloc_node_track_caller_noprof+0x465/0x740 [ 108.546945][ T179] kstrdup+0x42/0x100 [ 108.548512][ T179] __kernfs_new_node+0xa9/0x980 [ 108.550395][ T179] kernfs_new_node+0xea/0x140 [ 108.552237][ T179] kernfs_create_link+0xa7/0x200 [ 108.554279][ T179] sysfs_do_create_link_sd+0x83/0x110 [ 108.556538][ T179] driver_sysfs_add+0x89/0x210 [ 108.558536][ T179] really_probe+0x142/0xae0 [ 108.560562][ T179] __driver_probe_device+0x1e8/0x360 [ 108.562738][ T179] driver_probe_device+0x4f/0x240 [ 108.564830][ T179] __device_attach_driver+0x270/0x410 [ 108.567142][ T179] [ 108.568214][ T179] Memory state around the buggy address: [ 108.570537][ T179] ffff888034f1cb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.573971][ T179] ffff888034f1cb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.577239][ T179] >ffff888034f1cc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.580566][ T179] ^ [ 108.582756][ T179] ffff888034f1cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.586081][ T179] ffff888034f1cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 108.589397][ T179] ==================================================================