* [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue
@ 2026-01-20 10:13 Jiaming Zhang
2026-01-20 19:17 ` Darrick J. Wong
0 siblings, 1 reply; 8+ messages in thread
From: Jiaming Zhang @ 2026-01-20 10:13 UTC (permalink / raw)
To: cem, linux-xfs; +Cc: djwong, linux-kernel, pchelkin, syzkaller
[-- Attachment #1: Type: text/plain, Size: 15782 bytes --]
Dear Linux kernel developers and maintainers,
We are writing to report a general protection fault discovered in the
xfs subsystem with our generated syzkaller specifications. This issue
is reproducible on the latest version of linux (v6.19-rc6, commit
24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7). The KASAN report from
kernel is listed below (formatted by syz-symbolize):
---
loop0: detected capacity change from 0 to 32768
XFS (loop0): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
XFS (loop0): Ending clean mount
XFS (loop0): Injecting error at file fs/xfs/libxfs/xfs_btree.c, line
309, on filesystem "loop0"
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
CPU: 1 UID: 0 PID: 9920 Comm: repro.out Not tainted 6.19.0-rc6 #24 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000002700 CR3: 00000000229e4000 CR4: 0000000000752ef0
PKRU: 55555554
Call Trace:
<TASK>
xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
xrep_revalidate_allocbt+0xf3/0x160 fs/xfs/scrub/alloc_repair.c:930
xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x45a879
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffda72db7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004004b8 RCX: 000000000045a879
RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
RBP: 00007ffda72db860 R08: 0000000000000004 R09: 0000000000000005
R10: 0000000000000004 R11: 0000000000000246 R12: 000000000040b990
R13: 0000000000000000 R14: 00000000004ca018 R15: 00000000004004b8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbbbc0430c8 CR3: 00000000229e4000 CR4: 0000000000752ef0
PKRU: 55555554
----------------
Code disassembly (best guess):
0: f2 00 66 43 repnz add %ah,0x43(%rsi)
4: c7 44 35 0d f3 f3 43 movl $0xc643f3f3,0xd(%rbp,%rsi,1)
b: c6
c: 44 35 0f f3 e8 1c rex.R xor $0x1ce8f30f,%eax
12: 44 39 fe cmp %r15d,%esi
15: 48 89 5c 24 40 mov %rbx,0x40(%rsp)
1a: 48 83 c3 48 add $0x48,%rbx
1e: 48 89 d8 mov %rbx,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 48 89 44 24 30 mov %rax,0x30(%rsp)
* 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 d6 11 00 00 jne 0x120d
37: 44 0f b6 33 movzbl (%rbx),%r14d
3b: 41 ff ce dec %r14d
3e: bf .byte 0xbf
3f: 53 push %rbx
---
The root cause of this issue is that in xchk_btree(), where the
argument cur can be NULL but the function assume cur is not NULL,
leading to a NULL pointer dereference when accessing member
(https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L701).
We can add a NULL check at the beginning of xchk_btree() to fix this issue:
```
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -693,6 +693,9 @@ xchk_btree(
int level;
int error = 0;
+ if (!cur)
+ return -EINVAL;
+
/*
* Allocate the btree scrub context from the heap, because this
* structure can get rather large. Don't let a caller feed us a
```
After applying changes above and re-running reproducer, another issues
is triggered:
---
TITLE: KASAN: slab-use-after-free Read in xchk_btree_check_block_owner
XFS (loop6): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
XFS (loop6): Ending clean mount
==================================================================
BUG: KASAN: slab-use-after-free in
xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
Read of size 8 at addr ffff88806af035d8 by task syz.6.59/14096
CPU: 1 UID: 0 PID: 14096 Comm: syz.6.59 Not tainted 6.19.0-rc6-dirty
#30 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x10e/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x17e/0x810 mm/kasan/report.c:482
kasan_report+0x147/0x180 mm/kasan/report.c:595
xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f71bddb459d
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f71bed71f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f71be045fa0 RCX: 00007f71bddb459d
RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
RBP: 00007f71bde52610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f71be046038 R14: 00007f71be045fa0 R15: 00007f71bed52000
</TASK>
Allocated by task 14096:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4953 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_noprof+0x37d/0x710 mm/slub.c:5270
xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
xfs_bnobt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:485
xchk_ag_btcur_init+0xe0/0x5d0 fs/xfs/scrub/common.c:612
xchk_ag_init fs/xfs/scrub/common.c:698 [inline]
xchk_setup_ag_btree+0x295/0x310 fs/xfs/scrub/common.c:943
xchk_setup_ag_allocbt+0x70/0x190 fs/xfs/scrub/alloc.c:35
xfs_scrub_metadata+0xa9e/0x1920 fs/xfs/scrub/scrub.c:709
xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 14096:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x58/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6670 [inline]
kmem_cache_free+0x197/0x620 mm/slub.c:6781
xchk_should_check_xref+0xf9/0x420 fs/xfs/scrub/common.c:1351
xchk_xref_is_used_space+0x14b/0x210 fs/xfs/scrub/alloc.c:190
xchk_btree_check_block_owner+0x2fe/0x600 fs/xfs/scrub/btree.c:395
xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88806af035c8
which belongs to the cache xfs_bnobt_cur of size 232
The buggy address is located 16 bytes inside of
freed 232-byte region [ffff88806af035c8, ffff88806af036b0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6af03
ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000000 ffff88801dd96a00 ffffea000094fdc0 0000000000000003
raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask
0x1052c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOLOCKDEP),
pid 13126, tgid 13119 (syz.4.29), ts 58027826746, free_ts 57929202822
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x290 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0x24e4/0x2580 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5240
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab+0x86/0x3b0 mm/slub.c:3248
new_slab mm/slub.c:3302 [inline]
___slab_alloc+0xe70/0x1860 mm/slub.c:4656
__slab_alloc+0x65/0x100 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
kmem_cache_alloc_noprof+0x40f/0x710 mm/slub.c:5270
xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
xfs_cntbt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:511
xfs_free_ag_extent+0x570/0x1890 fs/xfs/libxfs/xfs_alloc.c:2149
__xfs_free_extent+0x2a7/0x460 fs/xfs/libxfs/xfs_alloc.c:4047
xfs_extent_free_finish_item+0x299/0x840 fs/xfs/xfs_extfree_item.c:555
xfs_defer_finish_one+0x5a6/0xcc0 fs/xfs/libxfs/xfs_defer.c:595
xfs_defer_finish_noroll+0x94a/0x1300 fs/xfs/libxfs/xfs_defer.c:707
xfs_defer_finish+0x1e/0x270 fs/xfs/libxfs/xfs_defer.c:741
xrep_defer_finish+0x16e/0x240 fs/xfs/scrub/repair.c:242
page last free pid 785 tgid 785 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xbc4/0xd40 mm/page_alloc.c:2973
vfree+0x25a/0x400 mm/vmalloc.c:3466
delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3385
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xa45/0x1670 kernel/workqueue.c:3340
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Memory state around the buggy address:
ffff88806af03480: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
ffff88806af03500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88806af03580: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
^
ffff88806af03600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88806af03680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
==================================================================
---
I also analyzed the root cause of this issue. In
xchk_btree_check_block_owner(), bs->cur is an alias for
bs->sc->sa.bnocur (or rmap_cur,
https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L396-L400).
The issue occurs when error injection triggers a failure path:
1. xchk_btree_check_block_owner() calls xchk_xref_is_used_space()
2. In xchk_xref_is_used_space(), xfs_alloc_has_records() returns a
non-zero error due to error injection
3. Non-zero error causes xchk_should_check_xref() to free curpp (which
points to bs->sc->sa.bnocur).
4. Memory pointed to by bs->cur is freed.
Control returns to xchk_btree_check_block_owner(), which subsequently
accesses bs->cur->bc_ops, triggering the UAF.
P.S. this issue can also be triggered independently by syzkaller using
our generated specs.
To fix this issue, we can cache values of
xfs_btree_is_bno(bs->cur->bc_ops) and
xfs_btree_is_rmap(bs->cur->bc_ops) at the beginning of the function:
```
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -371,6 +371,8 @@ xchk_btree_check_block_owner(
xfs_agnumber_t agno;
xfs_agblock_t agbno;
bool init_sa;
+ bool is_bno;
+ bool is_rmap;
int error = 0;
if (!bs->cur)
@@ -379,6 +381,9 @@ xchk_btree_check_block_owner(
agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
+ is_bno = xfs_btree_is_bno(bs->cur->bc_ops);
+ is_rmap = xfs_btree_is_rmap(bs->cur->bc_ops);
+
/*
* If the btree being examined is not itself a per-AG btree, initialize
* sc->sa so that we can check for the presence of an ownership record
@@ -398,11 +403,11 @@ xchk_btree_check_block_owner(
* have to nullify it (to shut down further block owner checks) if
* self-xref encounters problems.
*/
- if (!bs->sc->sa.bno_cur && xfs_btree_is_bno(bs->cur->bc_ops))
+ if (!bs->sc->sa.bno_cur && is_bno)
bs->cur = NULL;
xchk_xref_is_only_owned_by(bs->sc, agbno, 1, bs->oinfo);
- if (!bs->sc->sa.rmap_cur && xfs_btree_is_rmap(bs->cur->bc_ops))
+ if (!bs->sc->sa.rmap_cur && is_rmap)
bs->cur = NULL;
out_free:
```
After applying above changes, reproducer ran for ~35 minutes without
triggering any issues.
If above solutions are acceptable, we are happy to submit patches :)
The kernel console output, kernel config, syzkaller reproducer, and C
reproducer are also attached to help with analysis.
Please let me know if any further information is required.
Best Regards,
Jiaming Zhang
[-- Attachment #2: repro.c --]
[-- Type: text/plain, Size: 208643 bytes --]
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/genetlink.h>
#include <linux/if_addr.h>
#include <linux/if_link.h>
#include <linux/in6.h>
#include <linux/loop.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <linux/veth.h>
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif
static unsigned long long procid;
static __thread int clone_ongoing;
static __thread int skip_segv;
static __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
exit(sig);
}
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
int valid = addr < prog_start || addr > prog_end;
if (skip && valid) {
_longjmp(segv_env, 1);
}
exit(sig);
}
static void install_segv_handler(void)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_handler = SIG_IGN;
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) \
({ \
int ok = 1; \
__atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); \
if (_setjmp(segv_env) == 0) { \
__VA_ARGS__; \
} else \
ok = 0; \
__atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); \
ok; \
})
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
struct nlmsg {
char* pos;
int nesting;
struct nlattr* nested[8];
char buf[4096];
};
static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
const void* data, int size)
{
memset(nlmsg, 0, sizeof(*nlmsg));
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
hdr->nlmsg_type = typ;
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
memcpy(hdr + 1, data, size);
nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}
static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data,
int size)
{
struct nlattr* attr = (struct nlattr*)nlmsg->pos;
attr->nla_len = sizeof(*attr) + size;
attr->nla_type = typ;
if (size > 0)
memcpy(attr + 1, data, size);
nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
}
static void netlink_nest(struct nlmsg* nlmsg, int typ)
{
struct nlattr* attr = (struct nlattr*)nlmsg->pos;
attr->nla_type = typ;
nlmsg->pos += sizeof(*attr);
nlmsg->nested[nlmsg->nesting++] = attr;
}
static void netlink_done(struct nlmsg* nlmsg)
{
struct nlattr* attr = nlmsg->nested[--nlmsg->nesting];
attr->nla_len = nlmsg->pos - (char*)attr;
}
static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type,
int* reply_len, bool dofail)
{
if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
exit(1);
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
struct sockaddr_nl addr;
memset(&addr, 0, sizeof(addr));
addr.nl_family = AF_NETLINK;
ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0,
(struct sockaddr*)&addr, sizeof(addr));
if (n != (ssize_t)hdr->nlmsg_len) {
if (dofail)
exit(1);
return -1;
}
n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
if (reply_len)
*reply_len = 0;
if (n < 0) {
if (dofail)
exit(1);
return -1;
}
if (n < (ssize_t)sizeof(struct nlmsghdr)) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
if (hdr->nlmsg_type == NLMSG_DONE)
return 0;
if (reply_len && hdr->nlmsg_type == reply_type) {
*reply_len = n;
return 0;
}
if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
if (hdr->nlmsg_type != NLMSG_ERROR) {
errno = EINVAL;
if (dofail)
exit(1);
return -1;
}
errno = -((struct nlmsgerr*)(hdr + 1))->error;
return -errno;
}
static int netlink_send(struct nlmsg* nlmsg, int sock)
{
return netlink_send_ext(nlmsg, sock, 0, NULL, true);
}
static int netlink_query_family_id(struct nlmsg* nlmsg, int sock,
const char* family_name, bool dofail)
{
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = CTRL_CMD_GETFAMILY;
netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name,
strnlen(family_name, GENL_NAMSIZ - 1) + 1);
int n = 0;
int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
if (err < 0) {
return -1;
}
uint16_t id = 0;
struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN +
NLMSG_ALIGN(sizeof(genlhdr)));
for (; (char*)attr < nlmsg->buf + n;
attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
id = *(uint16_t*)(attr + 1);
break;
}
}
if (!id) {
errno = EINVAL;
return -1;
}
recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
return id;
}
static unsigned int queue_count = 2;
static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type,
const char* name, bool up)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
if (up)
hdr.ifi_flags = hdr.ifi_change = IFF_UP;
netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr,
sizeof(hdr));
if (name)
netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name));
netlink_attr(nlmsg, IFLA_NUM_TX_QUEUES, &queue_count, sizeof(queue_count));
netlink_attr(nlmsg, IFLA_NUM_RX_QUEUES, &queue_count, sizeof(queue_count));
netlink_nest(nlmsg, IFLA_LINKINFO);
netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type));
}
static void netlink_device_change(struct nlmsg* nlmsg, int sock,
const char* name, bool up, const char* master,
const void* mac, int macsize,
const char* new_name)
{
struct ifinfomsg hdr;
memset(&hdr, 0, sizeof(hdr));
if (up)
hdr.ifi_flags = hdr.ifi_change = IFF_UP;
hdr.ifi_index = if_nametoindex(name);
netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr));
if (new_name)
netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name));
if (master) {
int ifindex = if_nametoindex(master);
netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex));
}
if (macsize)
netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize);
int err = netlink_send(nlmsg, sock);
if (err < 0) {
}
}
static struct nlmsg nlmsg;
//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:
//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty. In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//% claim that you wrote the original software. If you use this software
//% in a product, an acknowledgment in the product documentation would be
//% appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//% misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler madler@alumni.caltech.edu
//% BEGIN CODE DERIVED FROM puff.{c,h}
#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288
struct puff_state {
unsigned char* out;
unsigned long outlen;
unsigned long outcnt;
const unsigned char* in;
unsigned long inlen;
unsigned long incnt;
int bitbuf;
int bitcnt;
jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
long val = s->bitbuf;
while (s->bitcnt < need) {
if (s->incnt == s->inlen)
longjmp(s->env, 1);
val |= (long)(s->in[s->incnt++]) << s->bitcnt;
s->bitcnt += 8;
}
s->bitbuf = (int)(val >> need);
s->bitcnt -= need;
return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
s->bitbuf = 0;
s->bitcnt = 0;
if (s->incnt + 4 > s->inlen)
return 2;
unsigned len = s->in[s->incnt++];
len |= s->in[s->incnt++] << 8;
if (s->in[s->incnt++] != (~len & 0xff) ||
s->in[s->incnt++] != ((~len >> 8) & 0xff))
return -2;
if (s->incnt + len > s->inlen)
return 2;
if (s->outcnt + len > s->outlen)
return 1;
for (; len--; s->outcnt++, s->incnt++) {
if (s->in[s->incnt])
s->out[s->outcnt] = s->in[s->incnt];
}
return 0;
}
struct puff_huffman {
short* count;
short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
int first = 0;
int index = 0;
int bitbuf = s->bitbuf;
int left = s->bitcnt;
int code = first = index = 0;
int len = 1;
short* next = h->count + 1;
while (1) {
while (left--) {
code |= bitbuf & 1;
bitbuf >>= 1;
int count = *next++;
if (code - count < first) {
s->bitbuf = bitbuf;
s->bitcnt = (s->bitcnt - len) & 7;
return h->symbol[index + (code - first)];
}
index += count;
first += count;
first <<= 1;
code <<= 1;
len++;
}
left = (MAXBITS + 1) - len;
if (left == 0)
break;
if (s->incnt == s->inlen)
longjmp(s->env, 1);
bitbuf = s->in[s->incnt++];
if (left > 8)
left = 8;
}
return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
int len;
for (len = 0; len <= MAXBITS; len++)
h->count[len] = 0;
int symbol;
for (symbol = 0; symbol < n; symbol++)
(h->count[length[symbol]])++;
if (h->count[0] == n)
return 0;
int left = 1;
for (len = 1; len <= MAXBITS; len++) {
left <<= 1;
left -= h->count[len];
if (left < 0)
return left;
}
short offs[MAXBITS + 1];
offs[1] = 0;
for (len = 1; len < MAXBITS; len++)
offs[len + 1] = offs[len] + h->count[len];
for (symbol = 0; symbol < n; symbol++)
if (length[symbol] != 0)
h->symbol[offs[length[symbol]]++] = symbol;
return left;
}
static int puff_codes(struct puff_state* s, const struct puff_huffman* lencode,
const struct puff_huffman* distcode)
{
static const short lens[29] = {3, 4, 5, 6, 7, 8, 9, 10, 11, 13,
15, 17, 19, 23, 27, 31, 35, 43, 51, 59,
67, 83, 99, 115, 131, 163, 195, 227, 258};
static const short lext[29] = {0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2,
2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
static const short dists[30] = {
1, 2, 3, 4, 5, 7, 9, 13, 17, 25,
33, 49, 65, 97, 129, 193, 257, 385, 513, 769,
1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577};
static const short dext[30] = {0, 0, 0, 0, 1, 1, 2, 2, 3, 3,
4, 4, 5, 5, 6, 6, 7, 7, 8, 8,
9, 9, 10, 10, 11, 11, 12, 12, 13, 13};
int symbol;
do {
symbol = puff_decode(s, lencode);
if (symbol < 0)
return symbol;
if (symbol < 256) {
if (s->outcnt == s->outlen)
return 1;
if (symbol)
s->out[s->outcnt] = symbol;
s->outcnt++;
} else if (symbol > 256) {
symbol -= 257;
if (symbol >= 29)
return -10;
int len = lens[symbol] + puff_bits(s, lext[symbol]);
symbol = puff_decode(s, distcode);
if (symbol < 0)
return symbol;
unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
if (dist > s->outcnt)
return -11;
if (s->outcnt + len > s->outlen)
return 1;
while (len--) {
if (dist <= s->outcnt && s->out[s->outcnt - dist])
s->out[s->outcnt] = s->out[s->outcnt - dist];
s->outcnt++;
}
}
} while (symbol != 256);
return 0;
}
static int puff_fixed(struct puff_state* s)
{
static int virgin = 1;
static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
static struct puff_huffman lencode, distcode;
if (virgin) {
lencode.count = lencnt;
lencode.symbol = lensym;
distcode.count = distcnt;
distcode.symbol = distsym;
short lengths[FIXLCODES];
int symbol;
for (symbol = 0; symbol < 144; symbol++)
lengths[symbol] = 8;
for (; symbol < 256; symbol++)
lengths[symbol] = 9;
for (; symbol < 280; symbol++)
lengths[symbol] = 7;
for (; symbol < FIXLCODES; symbol++)
lengths[symbol] = 8;
puff_construct(&lencode, lengths, FIXLCODES);
for (symbol = 0; symbol < MAXDCODES; symbol++)
lengths[symbol] = 5;
puff_construct(&distcode, lengths, MAXDCODES);
virgin = 0;
}
return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
static const short order[19] = {16, 17, 18, 0, 8, 7, 9, 6, 10, 5,
11, 4, 12, 3, 13, 2, 14, 1, 15};
int nlen = puff_bits(s, 5) + 257;
int ndist = puff_bits(s, 5) + 1;
int ncode = puff_bits(s, 4) + 4;
if (nlen > MAXLCODES || ndist > MAXDCODES)
return -3;
short lengths[MAXCODES];
int index;
for (index = 0; index < ncode; index++)
lengths[order[index]] = puff_bits(s, 3);
for (; index < 19; index++)
lengths[order[index]] = 0;
short lencnt[MAXBITS + 1], lensym[MAXLCODES];
struct puff_huffman lencode = {lencnt, lensym};
int err = puff_construct(&lencode, lengths, 19);
if (err != 0)
return -4;
index = 0;
while (index < nlen + ndist) {
int symbol;
int len;
symbol = puff_decode(s, &lencode);
if (symbol < 0)
return symbol;
if (symbol < 16)
lengths[index++] = symbol;
else {
len = 0;
if (symbol == 16) {
if (index == 0)
return -5;
len = lengths[index - 1];
symbol = 3 + puff_bits(s, 2);
} else if (symbol == 17)
symbol = 3 + puff_bits(s, 3);
else
symbol = 11 + puff_bits(s, 7);
if (index + symbol > nlen + ndist)
return -6;
while (symbol--)
lengths[index++] = len;
}
}
if (lengths[256] == 0)
return -9;
err = puff_construct(&lencode, lengths, nlen);
if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
return -7;
short distcnt[MAXBITS + 1], distsym[MAXDCODES];
struct puff_huffman distcode = {distcnt, distsym};
err = puff_construct(&distcode, lengths + nlen, ndist);
if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
return -8;
return puff_codes(s, &lencode, &distcode);
}
static int puff(unsigned char* dest, unsigned long* destlen,
const unsigned char* source, unsigned long sourcelen)
{
struct puff_state s = {
.out = dest,
.outlen = *destlen,
.outcnt = 0,
.in = source,
.inlen = sourcelen,
.incnt = 0,
.bitbuf = 0,
.bitcnt = 0,
};
int err;
if (setjmp(s.env) != 0)
err = 2;
else {
int last;
do {
last = puff_bits(&s, 1);
int type = puff_bits(&s, 2);
err = type == 0 ? puff_stored(&s)
: (type == 1 ? puff_fixed(&s)
: (type == 2 ? puff_dynamic(&s) : -1));
if (err != 0)
break;
} while (!last);
}
*destlen = s.outcnt;
return err;
}
//% END CODE DERIVED FROM puff.{c,h}
#define ZLIB_HEADER_WIDTH 2
static int puff_zlib_to_file(const unsigned char* source,
unsigned long sourcelen, int dest_fd)
{
if (sourcelen < ZLIB_HEADER_WIDTH)
return 0;
source += ZLIB_HEADER_WIDTH;
sourcelen -= ZLIB_HEADER_WIDTH;
const unsigned long max_destlen = 132 << 20;
void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ,
MAP_PRIVATE | MAP_ANON, -1, 0);
if (ret == MAP_FAILED)
return -1;
unsigned char* dest = (unsigned char*)ret;
unsigned long destlen = max_destlen;
int err = puff(dest, &destlen, source, sourcelen);
if (err) {
munmap(dest, max_destlen);
errno = -err;
return -1;
}
if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
munmap(dest, max_destlen);
return -1;
}
return munmap(dest, max_destlen);
}
static int setup_loop_device(unsigned char* data, unsigned long size,
const char* loopname, int* loopfd_p)
{
int err = 0, loopfd = -1;
int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
if (memfd == -1) {
err = errno;
goto error;
}
if (puff_zlib_to_file(data, size, memfd)) {
err = errno;
goto error_close_memfd;
}
loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
err = errno;
goto error_close_memfd;
}
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
if (errno != EBUSY) {
err = errno;
goto error_close_loop;
}
ioctl(loopfd, LOOP_CLR_FD, 0);
usleep(1000);
if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
err = errno;
goto error_close_loop;
}
}
close(memfd);
*loopfd_p = loopfd;
return 0;
error_close_loop:
close(loopfd);
error_close_memfd:
close(memfd);
error:
errno = err;
return -1;
}
static void reset_loop_device(const char* loopname)
{
int loopfd = open(loopname, O_RDWR);
if (loopfd == -1) {
return;
}
if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
}
close(loopfd);
}
static long syz_mount_image(volatile long fsarg, volatile long dir,
volatile long flags, volatile long optsarg,
volatile long change_dir,
volatile unsigned long size, volatile long image)
{
unsigned char* data = (unsigned char*)image;
int res = -1, err = 0, need_loop_device = !!size;
char* mount_opts = (char*)optsarg;
char* target = (char*)dir;
char* fs = (char*)fsarg;
char* source = NULL;
char loopname[64];
if (need_loop_device) {
int loopfd;
memset(loopname, 0, sizeof(loopname));
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
if (setup_loop_device(data, size, loopname, &loopfd) == -1)
return -1;
close(loopfd);
source = loopname;
}
mkdir(target, 0777);
char opts[256];
memset(opts, 0, sizeof(opts));
if (strlen(mount_opts) > (sizeof(opts) - 32)) {
}
strncpy(opts, mount_opts, sizeof(opts) - 32);
if (strcmp(fs, "iso9660") == 0) {
flags |= MS_RDONLY;
} else if (strncmp(fs, "ext", 3) == 0) {
bool has_remount_ro = false;
char* remount_ro_start = strstr(opts, "errors=remount-ro");
if (remount_ro_start != NULL) {
char after = *(remount_ro_start + strlen("errors=remount-ro"));
char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
has_remount_ro = ((before == '\0' || before == ',') &&
(after == '\0' || after == ','));
}
if (strstr(opts, "errors=panic") || !has_remount_ro)
strcat(opts, ",errors=continue");
} else if (strcmp(fs, "xfs") == 0) {
strcat(opts, ",nouuid");
} else if (strncmp(fs, "gfs2", 4) == 0 &&
(strstr(opts, "errors=panic") || strstr(opts, "debug"))) {
strcat(opts, ",errors=withdraw");
}
res = mount(source, target, fs, flags, opts);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
res = open(target, O_RDONLY | O_DIRECTORY);
if (res == -1) {
err = errno;
goto error_clear_loop;
}
if (change_dir) {
res = chdir(target);
if (res == -1) {
err = errno;
}
}
error_clear_loop:
if (need_loop_device)
reset_loop_device(loopname);
errno = err;
return res;
}
#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
int iter = 0;
DIR* dp = 0;
const int umount_flags = MNT_FORCE | UMOUNT_NOFOLLOW;
retry:
while (umount2(dir, umount_flags) == 0) {
}
dp = opendir(dir);
if (dp == NULL) {
if (errno == EMFILE) {
exit(1);
}
exit(1);
}
struct dirent* ep = 0;
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
while (umount2(filename, umount_flags) == 0) {
}
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
int i;
for (i = 0;; i++) {
if (unlink(filename) == 0)
break;
if (errno == EPERM) {
int fd = open(filename, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno != EBUSY || i > 100)
exit(1);
if (umount2(filename, umount_flags))
exit(1);
}
}
closedir(dp);
for (int i = 0;; i++) {
if (rmdir(dir) == 0)
break;
if (i < 100) {
if (errno == EPERM) {
int fd = open(dir, O_RDONLY);
if (fd != -1) {
long flags = 0;
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
}
close(fd);
continue;
}
}
if (errno == EROFS) {
break;
}
if (errno == EBUSY) {
if (umount2(dir, umount_flags))
exit(1);
continue;
}
if (errno == ENOTEMPTY) {
if (iter < 100) {
iter++;
goto retry;
}
}
}
exit(1);
}
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void reset_loop()
{
char buf[64];
snprintf(buf, sizeof(buf), "/dev/loop%llu", procid);
int loopfd = open(buf, O_RDWR);
if (loopfd != -1) {
ioctl(loopfd, LOOP_CLR_FD, 0);
close(loopfd);
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
if (symlink("/dev/binderfs", "./binderfs")) {
}
}
static void setup_sysctl()
{
int cad_pid = fork();
if (cad_pid < 0)
exit(1);
if (cad_pid == 0) {
for (;;)
sleep(100);
}
char tmppid[32];
snprintf(tmppid, sizeof(tmppid), "%d", cad_pid);
struct {
const char* name;
const char* data;
} files[] = {
{"/sys/kernel/debug/x86/nmi_longest_ns", "10000000000"},
{"/proc/sys/kernel/hung_task_check_interval_secs", "20"},
{"/proc/sys/net/core/bpf_jit_kallsyms", "1"},
{"/proc/sys/net/core/bpf_jit_harden", "0"},
{"/proc/sys/kernel/kptr_restrict", "0"},
{"/proc/sys/kernel/softlockup_all_cpu_backtrace", "1"},
{"/proc/sys/fs/mount-max", "100"},
{"/proc/sys/vm/oom_dump_tasks", "0"},
{"/proc/sys/debug/exception-trace", "0"},
{"/proc/sys/kernel/printk", "7 4 1 3"},
{"/proc/sys/kernel/keys/gc_delay", "1"},
{"/proc/sys/vm/oom_kill_allocating_task", "1"},
{"/proc/sys/kernel/ctrl-alt-del", "0"},
{"/proc/sys/kernel/cad_pid", tmppid},
};
for (size_t i = 0; i < sizeof(files) / sizeof(files[0]); i++) {
if (!write_file(files[i].name, files[i].data)) {
}
}
kill(cad_pid, SIGKILL);
while (waitpid(cad_pid, NULL, 0) != cad_pid)
;
}
#define NL802154_CMD_SET_SHORT_ADDR 11
#define NL802154_ATTR_IFINDEX 3
#define NL802154_ATTR_SHORT_ADDR 10
static const char* setup_802154()
{
const char* error = NULL;
int sock_generic = -1;
int sock_route = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
if (sock_route == -1) {
error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) failed";
goto fail;
}
sock_generic = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
if (sock_generic == -1) {
error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) failed";
goto fail;
}
{
int nl802154_family_id =
netlink_query_family_id(&nlmsg, sock_generic, "nl802154", true);
if (nl802154_family_id < 0) {
error = "netlink_query_family_id failed";
goto fail;
}
for (int i = 0; i < 2; i++) {
char devname[] = "wpan0";
devname[strlen(devname) - 1] += i;
uint64_t hwaddr = 0xaaaaaaaaaaaa0002 + (i << 8);
uint16_t shortaddr = 0xaaa0 + i;
int ifindex = if_nametoindex(devname);
struct genlmsghdr genlhdr;
memset(&genlhdr, 0, sizeof(genlhdr));
genlhdr.cmd = NL802154_CMD_SET_SHORT_ADDR;
netlink_init(&nlmsg, nl802154_family_id, 0, &genlhdr, sizeof(genlhdr));
netlink_attr(&nlmsg, NL802154_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
netlink_attr(&nlmsg, NL802154_ATTR_SHORT_ADDR, &shortaddr,
sizeof(shortaddr));
if (netlink_send(&nlmsg, sock_generic) < 0) {
error = "NL802154_CMD_SET_SHORT_ADDR failed";
goto fail;
}
netlink_device_change(&nlmsg, sock_route, devname, true, 0, &hwaddr,
sizeof(hwaddr), 0);
if (i == 0) {
netlink_add_device_impl(&nlmsg, "lowpan", "lowpan0", false);
netlink_done(&nlmsg);
netlink_attr(&nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
if (netlink_send(&nlmsg, sock_route) < 0) {
error = "netlink: adding device lowpan0 type lowpan link wpan0";
goto fail;
}
}
}
}
fail:
close(sock_route);
close(sock_generic);
return error;
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
reset_loop();
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
sleep_ms(10);
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_one(void)
{
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
}
// syz_mount_image$xfs arguments: [
// fs: ptr[in, buffer] {
// buffer: {78 66 73 00} (length 0x4)
// }
// dir: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 30 00} (length 0x8)
// }
// flags: mount_flags = 0x0 (8 bytes)
// opts: ptr[in, fs_options[xfs_options]] {
// fs_options[xfs_options] {
// elems: array[fs_opt_elem[xfs_options]] {
// }
// common: array[fs_opt_elem[fs_options_common]] {
// }
// null: const = 0x0 (1 bytes)
// }
// }
// chdir: int8 = 0x1 (1 bytes)
// size: len = 0x965c (8 bytes)
// img: ptr[in, buffer] {
// buffer: (compressed buffer with length 0x965c)
// }
// ]
// returns fd_dir
NONFAILING(memcpy((void*)0x200000009680, "xfs\000", 4));
NONFAILING(memcpy((void*)0x2000000096c0, "./file0\000", 8));
NONFAILING(*(uint8_t*)0x200000009700 = 0);
NONFAILING(memcpy(
(void*)0x200000009740,
"\x78\x9c\xec\xfd\x07\xb8\x1d\x75\xa1\x78\x7f\x9f\x90\x42\x0f\x5d\x01\x89"
"\x20\x45\x7a\xef\x45\xa5\xf7\xde\xbb\xf4\x26\x4d\x40\xa5\x57\x51\x04\x94"
"\x66\xc1\x42\x55\xa4\xa9\x20\x02\x0a\x22\x22\xa8\x08\x82\x14\xb1\xa2\x82"
"\x08\x4a\xef\xbd\xbe\x4f\x48\x22\x31\x2e\xb8\x7a\xff\xf7\xf7\x72\xbd\x6b"
"\xad\xe7\x39\xd9\x67\xcf\x9e\x99\xfd\x3d\xdf\xcf\xec\x99\x93\xe8\xc3\x6c"
"\xba\xf2\x06\xcb\x0f\x0c\x4c\x30\x30\xaa\x99\x06\xc6\xed\x8c\x93\x8e\x9a"
"\x6b\xe9\x03\x56\xba\xee\xb4\x3d\x1e\x99\xf8\xfa\x45\x0f\xbb\x77\xf4\xe2"
"\xc9\x47\x3d\x8c\x18\xfd\x74\xc4\xa0\xd1\x8f\xe3\x0d\x0c\x0c\x8c\x37\x7a"
"\x3f\xa3\x97\x0d\xdf\xfb\xd2\xcb\xc6\x1b\x18\xf2\xfa\xf2\x37\x9a\x78\xc2"
"\x89\x06\x4d\x3a\x30\xb0\xd0\xe8\xa7\xcb\x8e\x7e\x5c\x7c\xd4\xc3\x14\xdb"
"\x8e\x59\xef\xb5\x71\x1a\x77\xa0\xa3\xde\xe4\xf0\x91\xdf\x1d\x3b\xea\xeb"
"\xf5\x26\x1b\xf9\x16\x23\xbf\xd9\x76\xb7\x6b\x46\x2e\x9b\x7c\xac\xed\x47"
"\x6e\x72\xcd\x3f\xfd\xa0\xd2\x36\x5d\x6e\x95\x95\xdf\xb0\xfa\xbb\xdb\x48"
"\xab\xa1\xa3\xbf\x1f\xfb\x6b\xd8\xa8\xaf\x29\xb6\x18\x18\x98\x62\xd3\x01"
"\x3e\x3e\xc6\x5e\x77\xd0\xdb\xf0\x23\x8d\x7c\xcf\x65\xf7\x3f\xfd\x9a\xab"
"\xde\x86\xf7\xfe\x8f\x6b\xd3\xe5\x56\x59\x6d\x1c\xff\x91\x9f\xc5\xc1\xa3"
"\x97\x2d\x3e\xf2\x33\x3e\xee\x67\xd0\xd8\xb8\xc7\xf9\x73\x27\x5f\x75\xd2"
"\xe8\x29\x1c\x34\x7a\xce\x86\x8c\xf3\x59\xf9\x8f\x68\xd3\xe5\x56\x5e\x73"
"\xe0\xcd\xcf\xf3\x03\x93\x1e\xbf\xf5\xe0\xd7\x46\x9d\x37\xc7\x1f\x18\x75"
"\xa1\x98\x70\x60\x60\x60\xa2\xd1\xe7\xd7\x49\xde\x6e\x97\xfa\xff\xd6\x72"
"\xcb\x2f\xbc\xfc\xc8\xf3\xfd\x98\xe7\xa3\xd9\xc7\x1c\xcb\xcb\xd2\x71\x31"
"\xdb\x2a\x37\x1d\x31\xf2\xd0\x18\x75\x9e\x18\x7e\xde\x98\x6b\x41\x55\x55"
"\x55\xfd\x67\xb4\xdc\xf2\x0b\xaf\x00\xd7\xff\x09\xde\xea\xfa\xbf\xe4\xf9"
"\x07\x5c\xdf\xf5\xbf\xaa\xaa\xea\x3f\xb7\xd5\x96\x5b\x7e\xe1\x91\xd7\xfa"
"\x71\xae\xff\x93\xbc\xd5\xf5\xff\x80\xdb\xd7\xd8\x7a\xd4\xbf\xfd\x2f\xbb"
"\xf8\xa8\xad\x5e\x7d\x7b\x7f\x88\xaa\xaa\xaa\xfa\xb7\x5a\x79\x35\xbc\xfe"
"\x4f\xfe\x56\xd7\xff\x65\x8e\x5b\xeb\xc4\xae\xff\x55\x55\x55\xff\xb9\xad"
"\xbf\xd6\xeb\xd7\xff\x49\xc6\xb9\xfe\x4f\xfd\x56\xd7\xff\x59\x1e\xda\xf3"
"\xb2\xd1\xeb\x8d\xf9\xbd\xe1\x95\xb1\x76\x39\x68\xac\xff\x3d\xe1\xa5\xb1"
"\x96\x0f\x1e\x6b\xf9\x8b\x63\x2d\x1f\x3a\xd6\x7e\xc6\x5e\x7f\xd8\x58\xcb"
"\x9f\x1f\x6b\xf9\xf8\x23\x5f\x83\xf5\x27\x1f\x18\x18\xbe\xf7\xe8\xe5\x2f"
"\xbf\xb1\x78\xf8\xe1\x03\x03\x03\x33\x8d\x5e\xfe\xc2\x58\xcb\xcf\x7c\xe3"
"\xff\xa7\x33\x62\xc8\x58\xcb\xcf\x1a\x6b\xf9\xb0\xb1\x96\x9f\x3d\x7a\xac"
"\x23\x97\x8f\x3f\xd6\xf2\x73\xc7\x5a\x7f\x82\xb7\x98\xea\xaa\xaa\xaa\xff"
"\x35\xad\xbf\xf0\xca\x2b\x0c\x8c\xf5\xff\xb3\x1f\xbd\x78\xda\x31\xaf\xd3"
"\xf5\xff\xe0\x2b\x6e\x9e\xfe\xed\x1a\x6f\x55\x55\x55\x55\x55\x55\x55\x55"
"\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55"
"\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\xd5\x7f\x62\xaf\x3e\x72"
"\xe5\xd5\x6f\xdc\xf3\xfd\xd0\x81\xb1\xee\x5d\xfd\xf7\x7b\x58\x8f\xfe\xef"
"\x02\x0e\xba\xf8\x9a\x5b\x6f\x7d\xdb\x06\xfa\xbf\xa3\x41\xff\xfc\xdf\x43"
"\x3c\xfc\xed\x1e\xd3\xff\xd7\x46\x3a\x4f\x70\xc1\x4c\x03\x03\x7b\x6e\xf4"
"\x76\x0f\xa5\xde\x86\xfe\x63\xee\x55\x5f\xff\x4f\xca\xdf\x5d\xfe\xee\xf2"
"\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee"
"\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe"
"\xee\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d"
"\xfe\xee\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf"
"\x5d\xfe\xee\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb"
"\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb"
"\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9"
"\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb\xfc\xc5\xbd\xc9\xfd\xff\x97"
"\x1d\xf3\xb8\xd5\xdd\xbb\x6e\x35\x7a\xd5\x25\x97\xbf\x76\xe8\x3d\x6f\x6c"
"\x39\x62\x60\xd7\xd1\xdf\x9d\x71\xd2\x51\x73\xed\xfa\x36\x8c\xfd\x6d\xe8"
"\xff\xea\xfd\xff\x07\x76\x1d\x34\x30\x30\xda\x77\xf2\x91\x96\x6b\x2f\xb7"
"\xfe\x86\x73\x0c\x0c\x0c\xdc\x33\xf4\xda\xe5\x17\x1b\xf8\xfb\x6b\x4b\x8c"
"\x7c\x6d\xe9\x29\x07\x0f\x0c\x7e\x7d\xd3\x39\x5e\xff\x73\xe8\x88\x37\xd9"
"\xf3\x52\xa3\x1e\x46\x1e\x4c\x03\x53\xff\x7d\x1f\x17\xbf\xbe\xff\xd5\x5e"
"\x3b\x6b\xf0\xa0\x71\x06\x31\x56\x53\x5c\x7e\xce\x39\xbb\x6c\xfa\xdc\x22"
"\xe3\x3e\xce\xfe\xe6\x3f\xc7\x78\x63\xbe\x79\xf1\xce\x83\x1e\x79\xed\xb5"
"\xd7\x5e\xfb\x87\x85\xa3\x9b\xe0\x4d\x36\x1e\xb3\xff\x31\x3f\xcb\xb8\xce"
"\xa3\xc7\x3e\xc7\xc8\xb1\xcf\xbf\xdf\x1e\x7b\xcf\xbf\xef\x01\x07\xce\xbb"
"\xeb\x1e\xdb\xee\xbc\xe3\xce\x3b\xee\xb9\xd0\x22\x8b\x2d\xbe\xd8\x42\x4b"
"\x2c\xb9\xf0\xa2\xf3\xef\xb4\xeb\xee\x3b\x2e\x30\xea\xcf\x37\x99\xb3\x99"
"\x5e\xff\x73\xf0\xbf\x32\x67\x93\x8c\x3b\x67\x8f\x2c\x37\xf6\x9c\x8d\xfb"
"\xb3\xbd\xd9\x9c\xcd\xf4\xd6\x73\xf6\xfa\x1e\x27\xb8\x71\xfe\x79\xc7\xcc"
"\xd9\x90\x7f\x73\xce\x06\xbf\xf5\x9c\xcd\xb4\xeb\xe8\x37\x1a\x31\x30\x74"
"\x60\x9b\xd7\xa7\x66\xd0\xc0\xc0\x88\x21\x43\x07\xf6\x1f\xf9\x64\xc1\xf1"
"\x07\x06\x46\x0c\x1d\xbd\xee\xb4\x23\xd7\x5d\x66\xca\xf1\x06\x06\x4e\x7c"
"\xe3\x07\x1d\xf9\xdd\xf8\x7f\x3f\x06\x07\x1d\x3e\x72\x9d\x4d\x57\xde\x60"
"\xf9\x37\x46\xf6\xcf\x3f\xe1\x3f\x7f\x4e\x5f\x6f\xf2\x51\x0f\x63\x26\x7f"
"\xc4\xe8\x37\x19\x31\xde\xa8\x21\xce\x34\xf0\xc6\xa1\x38\x7c\xef\x4b\x2f"
"\x1b\x6f\xe4\x5c\xfc\xc3\x34\x4f\x3c\xe1\x44\x83\x26\x1d\x18\x58\x68\xf4"
"\xd3\x65\x47\x3f\x2e\x39\xea\x61\xb2\x49\xc7\xac\xf7\xda\x38\x8d\x3b\xd0"
"\x51\x6f\x32\xf2\xdc\x31\xe8\xd8\x51\x5f\xa3\x76\x30\xf2\x2d\x46\x7e\xf3"
"\xec\x54\xf7\xcf\x3a\x72\xbc\xe3\x6c\xff\xff\xa2\xff\xd6\xf5\xff\x9f\xbc"
"\x96\x18\xf4\xf7\x89\x1a\x34\xfa\x6b\xf4\x3a\xa3\xbc\x96\x5b\x65\xb5\x37"
"\xde\xeb\xf5\x69\x18\x39\x77\x83\x47\x2f\x5b\x7c\xa4\xc9\xb8\x73\xf6\x3f"
"\xd9\x3f\x8d\x77\xa6\x21\x63\x0e\x06\x1c\xef\xca\xab\x2d\xbf\xf0\xc8\xc5"
"\xe3\xcc\xff\x98\x4d\xf0\xf8\x3a\xf6\xa0\x39\x6f\x18\x75\x6c\x2d\xbb\xf8"
"\xa8\xad\x5e\xfd\x6f\xa3\xd0\x78\x27\x79\x8b\xf1\xae\xb6\x1c\x8e\x77\x92"
"\xb7\x1a\xef\x2d\x33\xcf\x3f\xfe\xa8\x5d\xfd\x8f\x8d\x77\x9c\x73\xdd\x9a"
"\xa3\x5e\xfc\x57\xce\x75\x03\x6f\x7d\xae\x1b\x4c\xdb\xef\x78\xf3\x88\x71"
"\xcf\x75\x6b\xbc\xf9\x10\xff\xe1\x73\x3c\x66\x8e\xc6\x1f\x67\xa5\x37\x3b"
"\xd7\x4d\x3e\xe3\xd5\x87\x8d\xdc\xff\xc0\x5b\x9f\xeb\xd6\x1c\x39\xf6\xa1"
"\xff\x70\xae\x1b\x6f\x60\x60\xc4\xe0\x31\xe7\xba\x91\x27\xbe\x61\x43\x07"
"\x4e\x1c\xf9\x64\xa1\x91\x4f\xc6\x1f\x3a\x70\xde\xc8\x27\x0b\xbf\xfe\x64"
"\xc2\x81\x6b\x46\x3e\x99\x6f\xfb\xbd\x76\xdf\x61\xe4\x82\x09\xc6\xcc\xc9"
"\x02\x23\xf7\xbb\xec\x94\x83\x5e\x77\x9f\x63\xde\x13\xce\x7d\xed\x94\xd7"
"\x5e\x1b\x32\x7a\x2c\x67\x0e\xff\xc7\xb1\x8e\x3e\x3e\x66\x1a\xfb\x7a\xbe"
"\xdc\x94\xa3\x26\x73\xcc\xb6\x63\xf6\x3b\x72\xd5\x31\xfb\x5d\x76\x9a\x51"
"\xaf\x0d\x1b\xbd\xdf\xb3\xfe\x8d\xfd\x8e\xd9\x96\xc6\xbb\xea\xa4\xa3\x5e"
"\x1b\x7f\xf4\x7e\xcf\x1e\x67\xbf\x43\xdf\x62\xbf\x63\xb6\xfd\xa7\xcf\xc3"
"\x1c\x83\xfe\x7e\xe2\x7a\x93\xf3\xcd\xca\xe3\x9c\x6f\x46\xff\x8e\x3b\xe6"
"\xed\xfe\xe1\x6b\xd8\xa8\xaf\x29\xb6\x18\x18\x98\x62\x53\xf2\x1d\x67\xdd"
"\xff\xf2\x9c\x49\x9f\xdf\x09\xde\x62\xbc\xcb\x2d\xbf\xf0\x0a\x23\xc7\x37"
"\xce\xe7\xf7\xef\x87\x23\x7d\x7e\x87\x6e\xb7\xc8\x21\x03\x03\x03\x93\x8e"
"\xfa\x78\x0c\x3f\x6f\xcc\xd8\xff\xcd\x06\xbd\xd9\x78\x87\xbc\xf5\x78\x97"
"\x87\xf1\x0e\x79\xab\xf1\x4e\x77\xfc\x11\x4b\xff\x0f\x8c\x77\x60\xac\xf1"
"\xfe\xc3\x71\xb6\xc4\x88\x51\xc7\xca\x04\xa3\x8f\xb3\x73\xff\x8d\xe3\x77"
"\xcc\xb6\xe3\x9e\xc7\x86\xbe\xfe\xea\xa8\xd3\xfe\x04\xff\xca\x79\x6c\xa6"
"\x7f\x3a\x8f\x1d\x31\x78\xbc\x71\x26\x7b\xac\xde\xec\x77\xb6\x1d\x60\xfd"
"\x51\xdf\x4f\xfb\xf7\xbd\x3d\x3a\x7c\xad\x07\xc7\xcc\xfd\xd0\x71\xf6\xfb"
"\x5f\xfd\xce\x36\xd6\xcf\x32\x08\xce\x63\x93\x8f\xf3\xf7\xb9\x41\x77\xdc"
"\x3d\x30\x88\xe6\x7c\x81\x73\x06\x6d\xf7\xea\x7f\x31\xe7\x43\x07\xfe\xf1"
"\xef\x16\x63\xe6\x7c\xcc\xb6\x6f\x35\xe7\xe3\xff\x2b\x73\x3e\xc3\x5b\xcf"
"\xf9\xbf\xfa\x7b\xf2\x1c\xb3\x8c\x7a\x7d\xe8\x38\xe3\x1f\x7b\xce\xb7\x59"
"\x74\xef\xb9\xc7\xcc\xf9\xb0\x71\xf6\xfb\x5f\xcd\xf9\xf8\x6f\x7d\xed\xf8"
"\xe7\x39\x5f\x76\x60\x28\xcd\xf9\xba\x47\x8f\x9a\xb7\xb7\x3a\x9f\xbe\xd9"
"\x9c\x8f\xd9\x76\xcc\x9c\xbf\xee\x3f\xe5\x90\x81\x95\x06\x06\x06\x66\x1d"
"\x3d\xe7\xc3\xfe\x95\x39\x9f\xf6\x7f\xe6\x38\x9f\x08\xd6\x1f\xf5\xfd\x8e"
"\x7f\x5f\x74\xcc\x06\x8f\xcd\x33\x66\xce\xc7\x9d\xe3\xff\x6a\xce\x87\xfd"
"\xbb\x73\x3e\xd3\xdf\x8f\xf3\x59\x5f\x7f\x6d\xe6\xf1\x06\x86\x0d\x1b\xd8"
"\x7f\xdb\xfd\xf6\xdb\x67\xc1\x51\x7f\x8e\x79\xba\xd0\xa8\x3f\xf9\x5c\x74"
"\xde\x91\xa3\xe6\xf9\xad\xae\xa5\x6f\x66\x34\x66\xdb\xb7\xfa\x5c\x0c\xf9"
"\x57\x8c\x26\xff\x97\x8c\x06\xfd\x57\x46\xd3\x0f\x79\x33\xa3\x37\x3e\x5a"
"\x5b\xdf\xf5\xf4\x81\xff\xdd\x73\xd1\x90\x7f\xd7\x68\x80\xcf\x45\xb7\x5e"
"\x34\x6a\xde\xde\xea\xf7\xa2\x37\x9b\xf3\x31\xdb\xd2\x75\x70\xea\xb1\xb6"
"\x1f\xf7\xef\xa1\xeb\xaf\xf5\xfa\xef\xdd\x93\x8c\x73\x1d\x1c\xb3\x09\x5e"
"\x07\x6f\x5f\x6b\xb6\xed\xc7\xec\x72\xf4\x66\xaf\x8c\x33\xcc\x31\xd7\xd5"
"\x97\xc6\x5a\x3e\x78\xac\xe5\x2f\x8e\xb5\x7c\xe8\x58\xfb\x19\x7b\xfd\x61"
"\x63\x2d\x7f\x7e\xac\xe5\x23\x7f\x84\x61\x63\xad\x3f\x86\x75\xf2\x91\x7f"
"\xe7\x1d\xbd\xfc\xe5\x37\x56\x1f\x3e\xf2\x2f\xa9\x33\x8d\x5e\xfe\xc2\x58"
"\xcb\xcf\x7c\x63\xdb\x11\x63\xfd\x93\xc1\xf0\xb3\xc6\x5a\x3e\xd6\x29\x72"
"\xf8\xd9\x6f\x1c\x1a\x23\xc6\xfa\xb5\x7b\xf8\xb9\x63\xad\xff\x66\x87\xca"
"\x9b\x36\xe6\xdf\x24\x77\x1d\xf7\x24\x5f\xff\x6a\xfd\xfb\xbf\xbb\xfc\xdd"
"\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb\xfc"
"\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb"
"\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf"
"\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97"
"\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77"
"\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2"
"\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\x8b\x7b\x93\xfb\xff\x1f"
"\x3e\xfa\x71\xd9\xf3\xb7\xdd\x7a\xfb\xd1\xb7\x93\x1b\x7a\xdf\xf1\xc3\x4f"
"\x7d\xbb\xc7\xfb\x36\xf7\x7f\xfa\xfe\xff\xa3\x7d\xff\xe1\xfe\xff\xa7\x0e"
"\x3f\xfe\xbe\xf1\x06\xfe\xfe\xda\x5b\xde\x9f\x7d\xd4\x3a\xff\x2b\xef\xcf"
"\xbe\xf8\xa8\x87\x29\xb6\x1d\xb3\xde\xb8\xf7\x07\x1f\x77\xa0\xa3\xde\xe4"
"\xcd\xef\xcf\xbe\xf3\x2d\x57\xef\xf1\xff\xa7\xfb\xb3\xff\xb7\x1a\xf3\x59"
"\xfd\x17\xee\x8b\xd7\xf9\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5"
"\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb\xfc\xdd"
"\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb\xfc"
"\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb"
"\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf"
"\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97"
"\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77"
"\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2"
"\x77\x97\xbf\xbb\xfc\xdd\xe5\x2f\xee\x4d\xee\xff\x7f\xcd\xe8\xc7\xc3\x4f"
"\x9c\xf2\xd2\x61\xa3\x6f\x84\x3e\x74\xda\x5b\xa7\x78\xf1\xed\x1e\xef\xdb"
"\xdc\xff\xe9\xfb\xff\x8f\xf6\xfd\x87\xfb\xff\xbf\x38\xc5\xad\xd3\x8e\x37"
"\xf0\xf7\xd7\xde\xf2\xfe\xff\xa3\xd6\x71\xdc\xff\xff\xd8\x33\xa6\x1f\xfe"
"\xbf\xf9\xfe\xff\x63\x3e\xab\xdd\xff\xbf\xfe\x8b\xf2\x77\x97\xbf\xbb\xfc"
"\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb"
"\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf"
"\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97"
"\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77"
"\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2"
"\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee"
"\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe"
"\xee\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x71\x7c\xff\xff\x41\xa3"
"\x1f\x07\xae\x59\x65\xd8\x25\xb7\x8d\x7c\x1c\xf9\xfc\xc2\x7d\x5e\x3e\xe7"
"\xed\x1e\xef\xdb\xdc\xff\xd5\xfb\xff\x4f\x70\xc1\x4c\x03\x03\x7b\x6e\xf4"
"\x76\x0f\xa5\xde\x86\x3a\xff\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf\xbb"
"\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97\xbf"
"\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77\x97"
"\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2\x77"
"\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee\xf2"
"\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe\xee"
"\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d\xfe"
"\xee\xf2\x77\x97\xbf\xbb\xfc\xdd\xe5\xef\x2e\x7f\x77\xf9\xbb\xcb\xdf\x5d"
"\xfe\xee\xf2\x77\x97\xbf\xbb\xfc\xc5\x8d\xbe\xff\xff\xc0\xa8\xfb\xff\x8f"
"\x69\xd0\xb2\x1d\x17\x18\xdc\xff\xff\x3f\xbb\x37\xf1\x5f\x2e\x7f\xcc\xe2"
"\xbf\x7c\xfe\x98\xc5\x7f\x85\xfc\x31\x8b\xff\x8a\xf9\x63\x16\xff\x95\xf2"
"\xc7\x2c\xfe\x2b\xe7\x8f\x59\xfc\x57\xc9\x1f\xb3\xf8\xaf\x9a\x3f\x66\xf1"
"\x5f\x2d\x7f\xcc\xe2\xbf\x7a\xfe\x98\xc5\x7f\x8d\xfc\x31\x8b\xff\x9a\xf9"
"\x63\x16\xff\xb5\xf2\xc7\x2c\xfe\x6b\xe7\x8f\x59\xfc\xd7\xc9\x1f\xb3\xf8"
"\xaf\x9b\x3f\x66\xf1\x5f\x2f\x7f\xcc\xe2\xbf\x7e\xfe\x98\xc5\x7f\x83\xfc"
"\x31\x8b\xff\x86\xf9\x63\x16\xff\x8d\xf2\xc7\x2c\xfe\x1b\xe7\x8f\x59\xfc"
"\x37\xc9\x1f\xb3\xf8\x6f\x9a\x3f\x66\xf1\xdf\x2c\x7f\xcc\xe2\xbf\x79\xfe"
"\x98\xc5\x7f\x8b\xfc\x31\x8b\xff\x96\xf9\x63\x16\xff\xad\xf2\xc7\x2c\xfe"
"\x5b\xe7\x8f\x59\xfc\x3f\x98\x3f\x66\xf1\xdf\x26\x7f\xcc\xe2\xbf\x6d\xfe"
"\x98\xc5\x7f\xbb\xfc\x31\x8b\xff\xf6\xf9\x63\x16\xff\x1d\xf2\xc7\x2c\xfe"
"\x3b\xe6\x8f\x59\xfc\x77\xca\x1f\xb3\xf8\xef\x9c\x3f\x66\xf1\xdf\x25\x7f"
"\xcc\xe2\xbf\x6b\xfe\x98\xc5\x7f\xb7\xfc\x31\x8b\xff\x87\xf2\xc7\x2c\xfe"
"\xbb\xe7\x8f\x59\xfc\xf7\xc8\x1f\xb3\xf8\xef\x99\x3f\x66\xf1\xdf\x2b\x7f"
"\xcc\xe2\xbf\x77\xfe\x98\xc5\xff\xc3\xf9\x63\x16\xff\x7d\xf2\xc7\x2c\xfe"
"\xfb\xe6\x8f\x59\xfc\xf7\xcb\x1f\xb3\xf8\x7f\x24\x7f\xcc\xe2\xff\xd1\xfc"
"\x31\x8b\xff\xc7\xf2\xc7\x2c\xfe\xfb\xe7\x8f\x59\xfc\x0f\xc8\x1f\xb3\xf8"
"\x1f\x98\x3f\x66\xf1\x3f\x28\x7f\xcc\xe2\x7f\x70\xfe\x98\xc5\xff\x90\xfc"
"\x31\x8b\xff\xa1\xf9\x63\x16\xff\xc3\xf2\xc7\x2c\xfe\x87\xe7\x8f\x59\xfc"
"\x8f\xc8\x1f\xb3\xf8\x1f\x99\x3f\x66\xf1\x3f\x2a\x7f\xcc\xe2\xff\xf1\xfc"
"\x31\x8b\xff\xd1\xf9\x63\x16\xff\x4f\xe4\x8f\x59\xfc\x3f\x99\x3f\x66\xf1"
"\x3f\x26\x7f\xcc\xe2\xff\xa9\xfc\x31\x8b\xff\xb1\xf9\x63\x16\xff\xe3\xf2"
"\xc7\x2c\xfe\xc7\xe7\x8f\x59\xfc\x3f\x9d\x3f\x66\xf1\xff\x4c\xfe\x98\xc5"
"\xff\x84\xfc\x31\x8b\xff\x89\xf9\x63\x16\xff\x93\xf2\xc7\x2c\xfe\x27\xe7"
"\x8f\x59\xfc\x4f\xc9\x1f\xb3\xf8\x7f\x36\x7f\xcc\xe2\xff\xb9\xfc\x31\x8b"
"\xff\xe7\xf3\xc7\x2c\xfe\x5f\xc8\x1f\xb3\xf8\x9f\x9a\x3f\x66\xf1\xff\x62"
"\xfe\x98\xc5\xff\x4b\xf9\x63\x16\xff\x2f\xe7\x8f\x59\xfc\xbf\x92\x3f\x66"
"\xf1\x3f\x2d\x7f\xcc\xe2\x7f\x7a\xfe\x98\xc5\xff\x8c\xfc\x31\x8b\xff\x99"
"\xf9\x63\x16\xff\xb3\xf2\xc7\x2c\xfe\x67\xe7\x8f\x59\xfc\xbf\x9a\x3f\x66"
"\xf1\xff\x5a\xfe\x98\xc5\xff\x9c\xfc\x31\x8b\xff\xd7\xf3\xc7\x2c\xfe\xe7"
"\xe6\x8f\x59\xfc\xcf\xcb\x1f\xb3\xf8\x9f\x9f\x3f\x66\xf1\xbf\x20\x7f\xcc"
"\xe2\x7f\x61\xfe\x98\xc5\xff\x1b\xf9\x63\x16\xff\x6f\xe6\x8f\x59\xfc\xbf"
"\x95\x3f\x66\xf1\xbf\x28\x7f\xcc\xe2\x7f\x71\xfe\x98\xc5\xff\xdb\xf9\x63"
"\x16\xff\x4b\xf2\xc7\x2c\xfe\xdf\xc9\x1f\xb3\xf8\x5f\x9a\x3f\x66\xf1\xbf"
"\x2c\x7f\xcc\xe2\x7f\x79\xfe\x98\xc5\xff\xbb\xf9\x63\x16\xff\xef\xe5\x8f"
"\x59\xfc\xaf\xc8\x1f\xb3\xf8\x5f\x99\x3f\x66\xf1\xff\x7e\xfe\x98\xc5\xff"
"\xaa\xfc\x31\x8b\xff\x0f\xf2\xc7\x2c\xfe\x57\xe7\x8f\x59\xfc\x7f\x98\x3f"
"\x66\xf1\xbf\x26\x7f\xcc\xe2\xff\xa3\xfc\x31\x8b\xff\xb5\xf9\x63\x16\xff"
"\xeb\xf2\xc7\x2c\xfe\x3f\xce\x1f\xb3\xf8\xff\x24\x7f\xcc\xe2\xff\xd3\xfc"
"\x31\x8b\xff\xf5\xf9\x63\x16\xff\x9f\xe5\x8f\x59\xfc\x6f\xc8\x1f\xb3\xf8"
"\xdf\x98\x3f\x66\xf1\xff\x79\xfe\x98\xc5\xff\xa6\xfc\x31\x8b\xff\xcd\xf9"
"\x63\x16\xff\x5f\xe4\x8f\x59\xfc\x6f\xc9\x1f\xb3\xf8\xdf\x9a\x3f\x66\xf1"
"\xbf\x2d\x7f\xcc\xe2\x7f\x7b\xfe\x98\xc5\xff\x97\xf9\x63\x16\xff\x3b\xf2"
"\xc7\x2c\xfe\xbf\xca\x1f\xb3\xf8\xff\x3a\x7f\xcc\xe2\xff\x9b\xfc\x31\x8b"
"\xff\x6f\xf3\xc7\x2c\xfe\xbf\xcb\x1f\xb3\xf8\xff\x3e\x7f\xcc\xe2\x7f\x67"
"\xfe\x98\xc5\xff\x0f\xf9\x63\x16\xff\x3f\xe6\x8f\x59\xfc\xff\x94\x3f\x66"
"\xf1\xbf\x2b\x7f\xcc\xe2\x7f\x77\xfe\x98\xc5\xff\xcf\xf9\x63\x16\xff\x7b"
"\xf2\xc7\x2c\xfe\x7f\xc9\x1f\xb3\xf8\xdf\x9b\x3f\x66\xf1\xbf\x2f\x7f\xcc"
"\xe2\xff\xd7\xfc\x31\x8b\xff\xdf\xf2\xc7\x2c\xfe\xf7\xe7\x8f\x59\xfc\x1f"
"\xc8\x1f\xb3\xf8\x3f\x98\x3f\x66\xf1\x7f\x28\x7f\xcc\xe2\xff\x70\xfe\x98"
"\xc5\xff\x91\xfc\x31\x8b\xff\xa3\xf9\x63\x16\xff\xc7\xf2\xc7\x2c\xfe\x8f"
"\xe7\x8f\x59\xfc\x9f\xc8\x1f\xb3\xf8\x3f\x99\x3f\x66\xf1\x7f\x2a\x7f\xcc"
"\xe2\xff\x74\xfe\x98\xc5\xff\x99\xfc\x31\x8b\xff\xb3\xf9\x63\x16\xff\xe7"
"\xf2\xc7\x2c\xfe\xcf\xe7\x8f\x59\xfc\x5f\xc8\x1f\xb3\xf8\xbf\x98\x3f\x66"
"\xf1\x7f\x29\x7f\xcc\xe2\xff\x72\xfe\x98\xc5\xff\x95\xfc\x31\x8b\xff\xab"
"\xf9\x63\x16\xff\xd7\xf2\xc7\x24\xfe\xaf\x7f\x9b\xff\x3f\x67\xf1\x1f\x94"
"\x3f\x66\xf1\x1f\x2f\x7f\xcc\xe2\x3f\x38\x7f\xcc\xe2\x3f\x24\x7f\xcc\xe2"
"\x3f\x34\x7f\xcc\xe2\x3f\x2c\x7f\xcc\xe2\x3f\x7e\xfe\x98\xc5\x7f\x82\xfc"
"\x31\x8b\xff\x84\xf9\x63\x16\xff\x89\xf2\xc7\x2c\xfe\x13\xe7\x8f\x59\xfc"
"\x27\xc9\x1f\xb3\xf8\x4f\x9a\x3f\x66\xf1\x1f\x9e\x3f\x66\xf1\x9f\x2c\x7f"
"\xcc\xe2\x3f\x79\xfe\x98\xc5\x7f\x8a\xfc\x31\x8b\xff\x94\xf9\x63\x16\xff"
"\xa9\xf2\xc7\x2c\xfe\x53\xe7\x8f\x59\xfc\xa7\xc9\x1f\xb3\xf8\xbf\x23\x7f"
"\xcc\xe2\xff\xce\xfc\x31\x8b\xff\xb4\xf9\x63\x16\xff\xe9\xf2\xc7\x2c\xfe"
"\xd3\xe7\x8f\x59\xfc\xdf\x95\x3f\x66\xf1\x9f\x21\x7f\xcc\xe2\x3f\x22\x7f"
"\xcc\xe2\xff\xee\xfc\x31\x8b\xff\x8c\xf9\x63\x16\xff\x99\xf2\xc7\x2c\xfe"
"\xef\xc9\x1f\xb3\xf8\xcf\x9c\x3f\x66\xf1\x9f\x25\x7f\xcc\xe2\x3f\x6b\xfe"
"\x98\xc5\x7f\xb6\xfc\x31\x8b\xff\x7b\xf3\xc7\x2c\xfe\xb3\xe7\x8f\x59\xfc"
"\xe7\xc8\x1f\xb3\xf8\xcf\x99\x3f\x66\xf1\x9f\x2b\x7f\xcc\xe2\x3f\x77\xfe"
"\x98\xc5\x7f\x9e\xfc\x31\x8b\xff\xbc\xf9\x63\x16\xff\xf9\xf2\xc7\x2c\xfe"
"\xf3\xe7\x8f\x59\xfc\x17\xc8\x1f\xb3\xf8\x2f\x98\x3f\x66\xf1\x5f\x28\x7f"
"\xcc\xe2\xbf\x70\xfe\x98\xc5\x7f\x91\xfc\x31\x8b\xff\xa2\xf9\x63\x16\xff"
"\xc5\xf2\xc7\x2c\xfe\x8b\xe7\x8f\x59\xfc\x97\xc8\x1f\xb3\xf8\x2f\x99\x3f"
"\x66\xf1\x5f\x2a\x7f\xcc\xe2\xbf\x74\xfe\x98\xc5\x7f\x99\xfc\x31\x8b\xff"
"\xfb\xf2\xc7\x2c\xfe\xef\xcf\x1f\xb3\xf8\x7f\x20\x7f\xcc\xe2\xbf\x6c\xfe"
"\x98\xc5\x7f\xb9\xfc\x31\x8b\xff\xf2\xf9\x63\x16\xff\x15\xf2\xc7\x2c\xfe"
"\x2b\xe6\x8f\x59\xfc\x57\xca\x1f\xb3\xf8\xaf\x9c\x3f\x66\xf1\x5f\x25\x7f"
"\xcc\xe2\xbf\x6a\xfe\x98\xc5\x7f\xb5\xfc\x31\x8b\xff\xea\xf9\x63\x16\xff"
"\x35\xf2\xc7\x2c\xfe\x6b\xe6\x8f\x59\xfc\xd7\xca\x1f\xb3\xf8\xaf\x9d\x3f"
"\x66\xf1\x5f\x27\x7f\xcc\xe2\xbf\x6e\xfe\x98\xc5\x7f\xbd\xfc\x31\x8b\xff"
"\xfa\xf9\x63\x16\xff\x0d\xf2\xc7\x2c\xfe\x1b\xe6\x8f\x59\xfc\x37\xca\x1f"
"\xb3\xf8\x6f\x9c\x3f\x66\xf1\xdf\x24\x7f\xcc\xe2\xbf\x69\xfe\x98\xc5\x7f"
"\xb3\xfc\x31\x8b\xff\xe6\xf9\x63\x16\xff\x2d\xf2\xc7\x2c\xfe\x5b\xe6\x8f"
"\x59\xfc\xb7\xca\x1f\xb3\xf8\x6f\x9d\x3f\x66\xf1\xff\x60\xfe\x98\xc5\x7f"
"\x9b\xfc\x31\x8b\xff\xb6\xf9\x63\x16\xff\xed\xf2\xc7\x2c\xfe\xdb\xe7\x8f"
"\x59\xfc\x77\xc8\x1f\xb3\xf8\xef\x98\x3f\x66\xf1\xdf\x29\x7f\xcc\xe2\xbf"
"\x73\xfe\x98\xc5\x7f\x97\xfc\x31\x8b\xff\xae\xf9\x63\x16\xff\xdd\xf2\xc7"
"\x2c\xfe\x1f\xca\x1f\xb3\xf8\xef\x9e\x3f\x66\xf1\xdf\x23\x7f\xcc\xe2\xbf"
"\x67\xfe\x98\xc5\x7f\xaf\xfc\x31\x8b\xff\xde\xf9\x63\x16\xff\x0f\xe7\x8f"
"\x59\xfc\xf7\xc9\x1f\xb3\xf8\xef\x9b\x3f\x66\xf1\xdf\x2f\x7f\xcc\xe2\xff"
"\x91\xfc\x31\x8b\xff\x47\xf3\xc7\x2c\xfe\x1f\xcb\x1f\xb3\xf8\xef\x9f\x3f"
"\x66\xf1\x3f\x20\x7f\xcc\xe2\x7f\x60\xfe\x98\xc5\xff\xa0\xfc\x31\x8b\xff"
"\xc1\xf9\x63\x16\xff\x43\xf2\xc7\x2c\xfe\x87\xe6\x8f\x59\xfc\x0f\xcb\x1f"
"\xb3\xf8\x1f\x9e\x3f\x66\xf1\x3f\x22\x7f\xcc\xe2\x7f\x64\xfe\x98\xc5\xff"
"\xa8\xfc\x31\x8b\xff\xc7\xf3\xc7\x2c\xfe\x47\xe7\x8f\x59\xfc\x3f\x91\x3f"
"\x66\xf1\xff\x64\xfe\x98\xc5\xff\x98\xfc\x31\x8b\xff\xa7\xf2\xc7\x2c\xfe"
"\xc7\xe6\x8f\x59\xfc\x8f\xcb\x1f\xb3\xf8\x1f\x9f\x3f\x66\xf1\xff\x74\xfe"
"\x98\xc5\xff\x33\xf9\x63\x16\xff\x13\xf2\xc7\x2c\xfe\x27\xe6\x8f\x59\xfc"
"\x4f\xca\x1f\xb3\xf8\x9f\x9c\x3f\x66\xf1\x3f\x25\x7f\xcc\xe2\xff\xd9\xfc"
"\x31\x8b\xff\xe7\xf2\xc7\x2c\xfe\x9f\xcf\x1f\xb3\xf8\x7f\x21\x7f\xcc\xe2"
"\x7f\x6a\xfe\x98\xc5\xff\x8b\xf9\x63\x16\xff\x2f\xe5\x8f\x59\xfc\xbf\x9c"
"\x3f\x66\xf1\xff\x4a\xfe\x98\xc5\xff\xb4\xfc\x31\x8b\xff\xe9\xf9\x63\x16"
"\xff\x33\xf2\xc7\x2c\xfe\x67\xe6\x8f\x59\xfc\xcf\xca\x1f\xb3\xf8\x9f\x9d"
"\x3f\x66\xf1\xff\x6a\xfe\x98\xc5\xff\x6b\xf9\x63\x16\xff\x73\xf2\xc7\x2c"
"\xfe\x5f\xcf\x1f\xb3\xf8\x9f\x9b\x3f\x66\xf1\x3f\x2f\x7f\xcc\xe2\x7f\x7e"
"\xfe\x98\xc5\xff\x82\xfc\x31\x8b\xff\x85\xf9\x63\x16\xff\x6f\xe4\x8f\x59"
"\xfc\xbf\x99\x3f\x66\xf1\xff\x56\xfe\x98\xc5\xff\xa2\xfc\x31\x8b\xff\xc5"
"\xf9\x63\x16\xff\x6f\xe7\x8f\x59\xfc\x2f\xc9\x1f\xb3\xf8\x7f\x27\x7f\xcc"
"\xe2\x7f\x69\xfe\x98\xc5\xff\xb2\xfc\x31\x8b\xff\xe5\xf9\x63\x16\xff\xef"
"\xe6\x8f\x59\xfc\xbf\x97\x3f\x66\xf1\xbf\x22\x7f\xcc\xe2\x7f\x65\xfe\x98"
"\xc5\xff\xfb\xf9\x63\x16\xff\xab\xf2\xc7\x2c\xfe\x3f\xc8\x1f\xb3\xf8\x5f"
"\x9d\x3f\x66\xf1\xff\x61\xfe\x98\xc5\xff\x9a\xfc\x31\x8b\xff\x8f\xf2\xc7"
"\x2c\xfe\xd7\xe6\x8f\x59\xfc\xaf\xcb\x1f\xb3\xf8\xff\x38\x7f\xcc\xe2\xff"
"\x93\xfc\x31\x8b\xff\x4f\xf3\xc7\x2c\xfe\xd7\xe7\x8f\x59\xfc\x7f\x96\x3f"
"\x66\xf1\xbf\x21\x7f\xcc\xe2\x7f\x63\xfe\x98\xc5\xff\xe7\xf9\x63\x16\xff"
"\x9b\xf2\xc7\x2c\xfe\x37\xe7\x8f\x59\xfc\x7f\x91\x3f\x66\xf1\xbf\x25\x7f"
"\xcc\xe2\x7f\x6b\xfe\x98\xc5\xff\xb6\xfc\x31\x8b\xff\xed\xf9\x63\x16\xff"
"\x5f\xe6\x8f\x59\xfc\xef\xc8\x1f\xb3\xf8\xff\x2a\x7f\xcc\xe2\xff\xeb\xfc"
"\x31\x8b\xff\x6f\xf2\xc7\x2c\xfe\xbf\xcd\x1f\xb3\xf8\xff\x2e\x7f\xcc\xe2"
"\xff\xfb\xfc\x31\x8b\xff\x9d\xf9\x63\x16\xff\x3f\xe4\x8f\x59\xfc\xff\x98"
"\x3f\x66\xf1\xff\x53\xfe\x98\xc5\xff\xae\xfc\x31\x8b\xff\xdd\xf9\x63\x16"
"\xff\x3f\xe7\x8f\x59\xfc\xef\xc9\x1f\xb3\xf8\xff\x25\x7f\xcc\xe2\x7f\x6f"
"\xfe\x98\xc5\xff\xbe\xfc\x31\x8b\xff\x5f\xf3\xc7\x2c\xfe\x7f\xcb\x1f\xb3"
"\xf8\xdf\x9f\x3f\x66\xf1\x7f\x20\x7f\xcc\xe2\xff\x60\xfe\x98\xc5\xff\xa1"
"\xfc\x31\x8b\xff\xc3\xf9\x63\x16\xff\x47\xf2\xc7\x2c\xfe\x8f\xe6\x8f\x59"
"\xfc\x1f\xcb\x1f\xb3\xf8\x3f\x9e\x3f\x66\xf1\x7f\x22\x7f\xcc\xe2\xff\x64"
"\xfe\x98\xc5\xff\xa9\xfc\x31\x8b\xff\xd3\xf9\x63\x16\xff\x67\xf2\xc7\x2c"
"\xfe\xcf\xe6\x8f\x59\xfc\x9f\xcb\x1f\xb3\xf8\x3f\x9f\x3f\x66\xf1\x7f\x21"
"\x7f\xcc\xe2\xff\x62\xfe\x98\xc5\xff\xa5\xfc\x31\x8b\xff\xcb\xf9\x63\x16"
"\xff\x57\xf2\xc7\x2c\xfe\xaf\xe6\x8f\x59\xfc\x5f\xcb\x1f\x93\xf8\x0f\x1e"
"\xc8\x1f\xb3\xf8\x0f\xca\x1f\xb3\xf8\x8f\x97\x3f\x66\xf1\x1f\x9c\x3f\x66"
"\xf1\x1f\x92\x3f\x66\xf1\x1f\x9a\x3f\x66\xf1\x1f\x96\x3f\x66\xf1\x1f\x3f"
"\x7f\xcc\xe2\x3f\x41\xfe\x98\xc5\x7f\xc2\xfc\x31\x8b\xff\x44\xf9\x63\x16"
"\xff\x89\xf3\xc7\x2c\xfe\x93\xe4\x8f\x59\xfc\x27\xcd\x1f\xb3\xf8\x0f\xcf"
"\x1f\xb3\xf8\x4f\x96\x3f\x66\xf1\x9f\x3c\x7f\xcc\xe2\x3f\x45\xfe\x98\xc5"
"\x7f\xca\xfc\x31\x8b\xff\x54\xf9\x63\x16\xff\xa9\xf3\xc7\x2c\xfe\xd3\xe4"
"\x8f\x59\xfc\xdf\x91\x3f\x66\xf1\x7f\x67\xfe\x98\xc5\x7f\xda\xfc\x31\x8b"
"\xff\x74\xf9\x63\x16\xff\xe9\xf3\xc7\x2c\xfe\xef\xca\x1f\xb3\xf8\xcf\x90"
"\x3f\x66\xf1\x1f\x91\x3f\x66\xf1\x7f\x77\xfe\x98\xc5\x7f\xc6\xfc\x31\x8b"
"\xff\x4c\xf9\x63\x16\xff\xf7\xe4\x8f\x59\xfc\x67\xce\x1f\xb3\xf8\xcf\x92"
"\x3f\x66\xf1\x9f\x35\x7f\xcc\xe2\x3f\x5b\xfe\x98\xc5\xff\xbd\xf9\x63\x16"
"\xff\xd9\xf3\xc7\x2c\xfe\x73\xe4\x8f\x59\xfc\xe7\xcc\x1f\xb3\xf8\xcf\x95"
"\x3f\x66\xf1\x9f\x3b\x7f\xcc\xe2\x3f\x4f\xfe\x98\xc5\x7f\xde\xfc\x31\x8b"
"\xff\x7c\xf9\x63\x16\xff\xf9\xf3\xc7\x2c\xfe\x0b\xe4\x8f\x59\xfc\x17\xcc"
"\x1f\xb3\xf8\x2f\x94\x3f\x66\xf1\x5f\x38\x7f\xcc\xe2\xbf\x48\xfe\x98\xc5"
"\x7f\xd1\xfc\x31\x8b\xff\x62\xf9\x63\x16\xff\xc5\xf3\xc7\x2c\xfe\x4b\xe4"
"\x8f\x59\xfc\x97\xcc\x1f\xb3\xf8\x2f\x95\x3f\x66\xf1\x5f\x3a\x7f\xcc\xe2"
"\xbf\x4c\xfe\x98\xc5\xff\x7d\xf9\x63\x16\xff\xf7\xe7\x8f\x59\xfc\x3f\x90"
"\x3f\x66\xf1\x5f\x36\x7f\xcc\xe2\xbf\x5c\xfe\x98\xc5\x7f\xf9\xfc\x31\x8b"
"\xff\x0a\xf9\x63\x16\xff\x15\xf3\xc7\x2c\xfe\x2b\xe5\x8f\x59\xfc\x57\xce"
"\x1f\xb3\xf8\xaf\x92\x3f\x66\xf1\x5f\x35\x7f\xcc\xe2\xbf\x5a\xfe\x98\xc5"
"\x7f\xf5\xfc\x31\x8b\xff\x1a\xf9\x63\x16\xff\x35\xf3\xc7\x2c\xfe\x6b\xe5"
"\x8f\x59\xfc\xd7\xce\x1f\xb3\xf8\xaf\x93\x3f\x66\xf1\x5f\x37\x7f\xcc\xe2"
"\xbf\x5e\xfe\x98\xc5\x7f\xfd\xfc\x31\x8b\xff\x06\xf9\x63\x16\xff\x0d\xf3"
"\xc7\x2c\xfe\x1b\xe5\x8f\x59\xfc\x37\xce\x1f\xb3\xf8\x6f\x92\x3f\x66\xf1"
"\xdf\x34\x7f\xcc\xe2\xbf\x59\xfe\x98\xc5\x7f\xf3\xfc\x31\x8b\xff\x16\xf9"
"\x63\x16\xff\x2d\xf3\xc7\x2c\xfe\x5b\xe5\x8f\x59\xfc\xb7\xce\x1f\xb3\xf8"
"\x7f\x30\x7f\xcc\xe2\xbf\x4d\xfe\x98\xc5\x7f\xdb\xfc\x31\x8b\xff\x76\xf9"
"\x63\x16\xff\xed\xf3\xc7\x2c\xfe\x3b\xe4\x8f\x59\xfc\x77\xcc\x1f\xb3\xf8"
"\xef\x94\x3f\x66\xf1\xdf\x39\x7f\xcc\xe2\xbf\x4b\xfe\x98\xc5\x7f\xd7\xfc"
"\x31\x8b\xff\x6e\xf9\x63\x16\xff\x0f\xe5\x8f\x59\xfc\x77\xcf\x1f\xb3\xf8"
"\xef\x91\x3f\x66\xf1\xdf\x33\x7f\xcc\xe2\xbf\x57\xfe\x98\xc5\x7f\xef\xfc"
"\x31\x8b\xff\x87\xf3\xc7\x2c\xfe\xfb\xe4\x8f\x59\xfc\xf7\xcd\x1f\xb3\xf8"
"\xef\x97\x3f\x66\xf1\xff\x48\xfe\x98\xc5\xff\xa3\xf9\x63\x16\xff\x8f\xe5"
"\x8f\x59\xfc\xf7\xcf\x1f\xb3\xf8\x1f\x90\x3f\x66\xf1\x3f\x30\x7f\xcc\xe2"
"\x7f\x50\xfe\x98\xc5\xff\xe0\xfc\x31\x8b\xff\x21\xf9\x63\x16\xff\x43\xf3"
"\xc7\x2c\xfe\x87\xe5\x8f\x59\xfc\x0f\xcf\x1f\xb3\xf8\x1f\x91\x3f\x66\xf1"
"\x3f\x32\x7f\xcc\xe2\x7f\x54\xfe\x98\xc5\xff\xe3\xf9\x63\x16\xff\xa3\xf3"
"\xc7\x2c\xfe\x9f\xc8\x1f\xb3\xf8\x7f\x32\x7f\xcc\xe2\x7f\x4c\xfe\x98\xc5"
"\xff\x53\xf9\x63\x16\xff\x63\xf3\xc7\x2c\xfe\xc7\xe5\x8f\x59\xfc\x8f\xcf"
"\x1f\xb3\xf8\x7f\x3a\x7f\xcc\xe2\xff\x99\xfc\x31\x8b\xff\x09\xf9\x63\x16"
"\xff\x13\xf3\xc7\x2c\xfe\x27\xe5\x8f\x59\xfc\x4f\xce\x1f\xb3\xf8\x9f\x92"
"\x3f\x66\xf1\xff\x6c\xfe\x98\xc5\xff\x73\xf9\x63\x16\xff\xcf\xe7\x8f\x59"
"\xfc\xbf\x90\x3f\x66\xf1\x3f\x35\x7f\xcc\xe2\xff\xc5\xfc\x31\x8b\xff\x97"
"\xf2\xc7\x2c\xfe\x5f\xce\x1f\xb3\xf8\x7f\x25\x7f\xcc\xe2\x7f\x5a\xfe\x98"
"\xc5\xff\xf4\xfc\x31\x8b\xff\x19\xf9\x63\x16\xff\x33\xf3\xc7\x2c\xfe\x67"
"\xe5\x8f\x59\xfc\xcf\xce\x1f\xb3\xf8\x7f\x35\x7f\xcc\xe2\xff\xb5\xfc\x31"
"\x8b\xff\x39\xf9\x63\x16\xff\xaf\xe7\x8f\x59\xfc\xcf\xcd\x1f\xb3\xf8\x9f"
"\x97\x3f\x66\xf1\x3f\x3f\x7f\xcc\xe2\x7f\x41\xfe\x98\xc5\xff\xc2\xfc\x31"
"\x8b\xff\x37\xf2\xc7\x2c\xfe\xdf\xcc\x1f\xb3\xf8\x7f\x2b\x7f\xcc\xe2\x7f"
"\x51\xfe\x98\xc5\xff\xe2\xfc\x31\x8b\xff\xb7\xf3\xc7\x2c\xfe\x97\xe4\x8f"
"\x59\xfc\xbf\x93\x3f\x66\xf1\xbf\x34\x7f\xcc\xe2\x7f\x59\xfe\x98\xc5\xff"
"\xf2\xfc\x31\x8b\xff\x77\xf3\xc7\x2c\xfe\xdf\xcb\x1f\xb3\xf8\x5f\x91\x3f"
"\x66\xf1\xbf\x32\x7f\xcc\xe2\xff\xfd\xfc\x31\x8b\xff\x55\xf9\x63\x16\xff"
"\x1f\xe4\x8f\x59\xfc\xaf\xce\x1f\xb3\xf8\xff\x30\x7f\xcc\xe2\x7f\x4d\xfe"
"\x98\xc5\xff\x47\xf9\x63\x16\xff\x6b\xf3\xc7\x2c\xfe\xd7\xe5\x8f\x59\xfc"
"\x7f\x9c\x3f\x66\xf1\xff\x49\xfe\x98\xc5\xff\xa7\xf9\x63\x16\xff\xeb\xf3"
"\xc7\x2c\xfe\x3f\xcb\x1f\xb3\xf8\xdf\x90\x3f\x66\xf1\xbf\x31\x7f\xcc\xe2"
"\xff\xf3\xfc\x31\x8b\xff\x4d\xf9\x63\x16\xff\x9b\xf3\xc7\x2c\xfe\xbf\xc8"
"\x1f\xb3\xf8\xdf\x92\x3f\x66\xf1\xbf\x35\x7f\xcc\xe2\x7f\x5b\xfe\x98\xc5"
"\xff\xf6\xfc\x31\x8b\xff\x2f\xf3\xc7\x2c\xfe\x77\xe4\x8f\x59\xfc\x7f\x95"
"\x3f\x66\xf1\xff\x75\xfe\x98\xc5\xff\x37\xf9\x63\x16\xff\xdf\xe6\x8f\x59"
"\xfc\x7f\x97\x3f\x66\xf1\xff\x7d\xfe\x98\xc5\xff\xce\xfc\x31\x8b\xff\x1f"
"\xf2\xc7\x2c\xfe\x7f\xcc\x1f\xb3\xf8\xff\x29\x7f\xcc\xe2\x7f\x57\xfe\x98"
"\xc5\xff\xee\xfc\x31\x8b\xff\x9f\xf3\xc7\x2c\xfe\xf7\xe4\x8f\x59\xfc\xff"
"\x92\x3f\x66\xf1\xbf\x37\x7f\xcc\xe2\x7f\x5f\xfe\x98\xc5\xff\xaf\xf9\x63"
"\x16\xff\xbf\xe5\x8f\x59\xfc\xef\xcf\x1f\xb3\xf8\x3f\x90\x3f\x66\xf1\x7f"
"\x30\x7f\xcc\xe2\xff\x50\xfe\x98\xc5\xff\xe1\xfc\x31\x8b\xff\x23\xf9\x63"
"\x16\xff\x47\xf3\xc7\x2c\xfe\x8f\xe5\x8f\x59\xfc\x1f\xcf\x1f\xb3\xf8\x3f"
"\x91\x3f\x66\xf1\x7f\x32\x7f\xcc\xe2\xff\x54\xfe\x98\xc5\xff\xe9\xfc\x31"
"\x8b\xff\x33\xf9\x63\x16\xff\x67\xf3\xc7\x2c\xfe\xcf\xe5\x8f\x59\xfc\x9f"
"\xcf\x1f\xb3\xf8\xbf\x90\x3f\x66\xf1\x7f\x31\x7f\xcc\xe2\xff\x52\xfe\x98"
"\xc5\xff\xe5\xfc\x31\x8b\xff\x2b\xf9\x63\x16\xff\x57\xf3\xc7\x2c\xfe\xaf"
"\xe5\x8f\x49\xfc\x87\x0c\xe4\x8f\x59\xfc\x07\xe5\x8f\x59\xfc\xc7\xcb\x1f"
"\xb3\xf8\x0f\xce\x1f\xb3\xf8\x0f\xc9\x1f\xb3\xf8\x0f\xcd\x1f\xb3\xf8\x0f"
"\xcb\x1f\xb3\xf8\x8f\x9f\x3f\x66\xf1\x9f\x20\x7f\xcc\xe2\x3f\x61\xfe\x98"
"\xc5\x7f\xa2\xfc\x31\x8b\xff\xc4\xf9\x63\x16\xff\x49\xf2\xc7\x2c\xfe\x93"
"\xe6\x8f\x59\xfc\x87\xe7\x8f\x59\xfc\x27\xcb\x1f\xb3\xf8\x4f\x9e\x3f\x66"
"\xf1\x9f\x22\x7f\xcc\xe2\x3f\x65\xfe\x98\xc5\x7f\xaa\xfc\x31\x8b\xff\xd4"
"\xf9\x63\x16\xff\x69\xf2\xc7\x2c\xfe\xef\xc8\x1f\xb3\xf8\xbf\x33\x7f\xcc"
"\xe2\x3f\x6d\xfe\x98\xc5\x7f\xba\xfc\x31\x8b\xff\xf4\xf9\x63\x16\xff\x77"
"\xe5\x8f\x59\xfc\x67\xc8\x1f\xb3\xf8\x8f\xc8\x1f\xb3\xf8\xbf\x3b\x7f\xcc"
"\xe2\x3f\x63\xfe\x98\xc5\x7f\xa6\xfc\x31\x8b\xff\x7b\xf2\xc7\x2c\xfe\x33"
"\xe7\x8f\x59\xfc\x67\xc9\x1f\xb3\xf8\xcf\x9a\x3f\x66\xf1\x9f\x2d\x7f\xcc"
"\xe2\xff\xde\xfc\x31\x8b\xff\xec\xf9\x63\x16\xff\x39\xf2\xc7\x2c\xfe\x73"
"\xe6\x8f\x59\xfc\xe7\xca\x1f\xb3\xf8\xcf\x9d\x3f\x66\xf1\x9f\x27\x7f\xcc"
"\xe2\x3f\x6f\xfe\x98\xc5\x7f\xbe\xfc\x31\x8b\xff\xfc\xf9\x63\x16\xff\x05"
"\xf2\xc7\x2c\xfe\x0b\xe6\x8f\x59\xfc\x17\xca\x1f\xb3\xf8\x2f\x9c\x3f\x66"
"\xf1\x5f\x24\x7f\xcc\xe2\xbf\x68\xfe\x98\xc5\x7f\xb1\xfc\x31\x8b\xff\xe2"
"\xf9\x63\x16\xff\x25\xf2\xc7\x2c\xfe\x4b\xe6\x8f\x59\xfc\x97\xca\x1f\xb3"
"\xf8\x2f\x9d\x3f\x66\xf1\x5f\x26\x7f\xcc\xe2\xff\xbe\xfc\x31\x8b\xff\xfb"
"\xf3\xc7\x2c\xfe\x1f\xc8\x1f\xb3\xf8\x2f\x9b\x3f\x66\xf1\x5f\x2e\x7f\xcc"
"\xe2\xbf\x7c\xfe\x98\xc5\x7f\x85\xfc\x31\x8b\xff\x8a\xf9\x63\x16\xff\x95"
"\xf2\xc7\x2c\xfe\x2b\xe7\x8f\x59\xfc\x57\xc9\x1f\xb3\xf8\xaf\x9a\x3f\x66"
"\xf1\x5f\x2d\x7f\xcc\xe2\xbf\x7a\xfe\x98\xc5\x7f\x8d\xfc\x31\x8b\xff\x9a"
"\xf9\x63\x16\xff\xb5\xf2\xc7\x2c\xfe\x6b\xe7\x8f\x59\xfc\xd7\xc9\x1f\xb3"
"\xf8\xaf\x9b\x3f\x66\xf1\x5f\x2f\x7f\xcc\xe2\xbf\x7e\xfe\x98\xc5\x7f\x83"
"\xfc\x31\x8b\xff\x86\xf9\x63\x16\xff\x8d\xf2\xc7\x2c\xfe\x1b\xe7\x8f\x59"
"\xfc\x37\xc9\x1f\xb3\xf8\x6f\x9a\x3f\x66\xf1\xdf\x2c\x7f\xcc\xe2\xbf\x79"
"\xfe\x98\xc5\x7f\x8b\xfc\x31\x8b\xff\x96\xf9\x63\x16\xff\xad\xf2\xc7\x2c"
"\xfe\x5b\xe7\x8f\x59\xfc\x3f\x98\x3f\x66\xf1\xdf\x26\x7f\xcc\xe2\xbf\x6d"
"\xfe\x98\xc5\x7f\xbb\xfc\x31\x8b\xff\xf6\xf9\x63\x16\xff\x1d\xf2\xc7\x2c"
"\xfe\x3b\xe6\x8f\x59\xfc\x77\xca\x1f\xb3\xf8\xef\x9c\x3f\x66\xf1\xdf\x25"
"\x7f\xcc\xe2\xbf\x6b\xfe\x98\xc5\x7f\xb7\xfc\x31\x8b\xff\x87\xf2\xc7\x2c"
"\xfe\xbb\xe7\x8f\x59\xfc\xf7\xc8\x1f\xb3\xf8\xef\x99\x3f\x66\xf1\xdf\x2b"
"\x7f\xcc\xe2\xbf\x77\xfe\x98\xc5\xff\xc3\xf9\x63\x16\xff\x7d\xf2\xc7\x2c"
"\xfe\xfb\xe6\x8f\x59\xfc\xf7\xcb\x1f\xb3\xf8\x7f\x24\x7f\xcc\xe2\xff\xd1"
"\xfc\x31\x8b\xff\xc7\xf2\xc7\x2c\xfe\xfb\xe7\x8f\x59\xfc\x0f\xc8\x1f\xb3"
"\xf8\x1f\x98\x3f\x66\xf1\x3f\x28\x7f\xcc\xe2\x7f\x70\xfe\x98\xc5\xff\x90"
"\xfc\x31\x8b\xff\xa1\xf9\x63\x16\xff\xc3\xf2\xc7\x2c\xfe\x87\xe7\x8f\x59"
"\xfc\x8f\xc8\x1f\xb3\xf8\x1f\x99\x3f\x66\xf1\x3f\x2a\x7f\xcc\xe2\xff\xf1"
"\xfc\x31\x8b\xff\xd1\xf9\x63\x16\xff\x4f\xe4\x8f\x59\xfc\x3f\x99\x3f\x66"
"\xf1\x3f\x26\x7f\xcc\xe2\xff\xa9\xfc\x31\x8b\xff\xb1\xf9\x63\x16\xff\xe3"
"\xf2\xc7\x2c\xfe\xc7\xe7\x8f\x59\xfc\x3f\x9d\x3f\x66\xf1\xff\x4c\xfe\x98"
"\xc5\xff\x84\xfc\x31\x8b\xff\x89\xf9\x63\x16\xff\x93\xf2\xc7\x2c\xfe\x27"
"\xe7\x8f\x59\xfc\x4f\xc9\x1f\xb3\xf8\x7f\x36\x7f\xcc\xe2\xff\xb9\xfc\x31"
"\x8b\xff\xe7\xf3\xc7\x2c\xfe\x5f\xc8\x1f\xb3\xf8\x9f\x9a\x3f\x66\xf1\xff"
"\x62\xfe\x98\xc5\xff\x4b\xf9\x63\x16\xff\x2f\xe7\x8f\x59\xfc\xbf\x92\x3f"
"\x66\xf1\x3f\x2d\x7f\xcc\xe2\x7f\x7a\xfe\x98\xc5\xff\x8c\xfc\x31\x8b\xff"
"\x99\xf9\x63\x16\xff\xb3\xf2\xc7\x2c\xfe\x67\xe7\x8f\x59\xfc\xbf\x9a\x3f"
"\x66\xf1\xff\x5a\xfe\x98\xc5\xff\x9c\xfc\x31\x8b\xff\xd7\xf3\xc7\x2c\xfe"
"\xe7\xe6\x8f\x59\xfc\xcf\xcb\x1f\xb3\xf8\x9f\x9f\x3f\x66\xf1\xbf\x20\x7f"
"\xcc\xe2\x7f\x61\xfe\x98\xc5\xff\x1b\xf9\x63\x16\xff\x6f\xe6\x8f\x59\xfc"
"\xbf\x95\x3f\x66\xf1\xbf\x28\x7f\xcc\xe2\x7f\x71\xfe\x98\xc5\xff\xdb\xf9"
"\x63\x16\xff\x4b\xf2\xc7\x2c\xfe\xdf\xc9\x1f\xb3\xf8\x5f\x9a\x3f\x66\xf1"
"\xbf\x2c\x7f\xcc\xe2\x7f\x79\xfe\x98\xc5\xff\xbb\xf9\x63\x16\xff\xef\xe5"
"\x8f\x59\xfc\xaf\xc8\x1f\xb3\xf8\x5f\x99\x3f\x66\xf1\xff\x7e\xfe\x98\xc5"
"\xff\xaa\xfc\x31\x8b\xff\x0f\xf2\xc7\x2c\xfe\x57\xe7\x8f\x59\xfc\x7f\x98"
"\x3f\x66\xf1\xbf\x26\x7f\xcc\xe2\xff\xa3\xfc\x31\x8b\xff\xb5\xf9\x63\x16"
"\xff\xeb\xf2\xc7\x2c\xfe\x3f\xce\x1f\xb3\xf8\xff\x24\x7f\xcc\xe2\xff\xd3"
"\xfc\x31\x8b\xff\xf5\xf9\x63\x16\xff\x9f\xe5\x8f\x59\xfc\x6f\xc8\x1f\xb3"
"\xf8\xdf\x98\x3f\x66\xf1\xff\x79\xfe\x98\xc5\xff\xa6\xfc\x31\x8b\xff\xcd"
"\xf9\x63\x16\xff\x5f\xe4\x8f\x59\xfc\x6f\xc9\x1f\xb3\xf8\xdf\x9a\x3f\x66"
"\xf1\xbf\x2d\x7f\xcc\xe2\x7f\x7b\xfe\x98\xc5\xff\x97\xf9\x63\x16\xff\x3b"
"\xf2\xc7\x2c\xfe\xbf\xca\x1f\xb3\xf8\xff\x3a\x7f\xcc\xe2\xff\x9b\xfc\x31"
"\x8b\xff\x6f\xf3\xc7\x2c\xfe\xbf\xcb\x1f\xb3\xf8\xff\x3e\x7f\xcc\xe2\x7f"
"\x67\xfe\x98\xc5\xff\x0f\xf9\x63\x16\xff\x3f\xe6\x8f\x59\xfc\xff\x94\x3f"
"\x66\xf1\xbf\x2b\x7f\xcc\xe2\x7f\x77\xfe\x98\xc5\xff\xcf\xf9\x63\x16\xff"
"\x7b\xf2\xc7\x2c\xfe\x7f\xc9\x1f\xb3\xf8\xdf\x9b\x3f\x66\xf1\xbf\x2f\x7f"
"\xcc\xe2\xff\xd7\xfc\x31\x8b\xff\xdf\xf2\xc7\x2c\xfe\xf7\xe7\x8f\x59\xfc"
"\x1f\xc8\x1f\xb3\xf8\x3f\x98\x3f\x66\xf1\x7f\x28\x7f\xcc\xe2\xff\x70\xfe"
"\x98\xc5\xff\x91\xfc\x31\x8b\xff\xa3\xf9\x63\x16\xff\xc7\xf2\xc7\x2c\xfe"
"\x8f\xe7\x8f\x59\xfc\x9f\xc8\x1f\xb3\xf8\x3f\x99\x3f\x66\xf1\x7f\x2a\x7f"
"\xcc\xe2\xff\x74\xfe\x98\xc5\xff\x99\xfc\x31\x8b\xff\xb3\xf9\x63\x16\xff"
"\xe7\xf2\xc7\x2c\xfe\xcf\xe7\x8f\x59\xfc\x5f\xc8\x1f\xb3\xf8\xbf\x98\x3f"
"\x66\xf1\x7f\x29\x7f\xcc\xe2\xff\x72\xfe\x98\xc5\xff\x95\xfc\x31\x8b\xff"
"\xab\xf9\x63\x16\xff\xd7\xf2\xc7\x24\xfe\x43\x07\xf2\xc7\x2c\xfe\x83\xf2"
"\xc7\x2c\xfe\xe3\xe5\x8f\x59\xfc\x07\xe7\x8f\x59\xfc\x87\xe4\x8f\x59\xfc"
"\x87\xe6\x8f\x59\xfc\x87\xe5\x8f\x59\xfc\xc7\xcf\x1f\xb3\xf8\x4f\x90\x3f"
"\x66\xf1\x9f\x30\x7f\xcc\xe2\x3f\x51\xfe\x98\xc5\x7f\xe2\xfc\x31\x8b\xff"
"\x24\xf9\x63\x16\xff\x49\xf3\xc7\x2c\xfe\xc3\xf3\xc7\x2c\xfe\x93\xe5\x8f"
"\x59\xfc\x27\xcf\x1f\xb3\xf8\x4f\x91\x3f\x66\xf1\x9f\x32\x7f\xcc\xe2\x3f"
"\x55\xfe\x98\xc5\x7f\xea\xfc\x31\x8b\xff\x34\xf9\x63\x16\xff\x77\xe4\x8f"
"\x59\xfc\xdf\x99\x3f\x66\xf1\x9f\x36\x7f\xcc\xe2\x3f\x5d\xfe\x98\xc5\x7f"
"\xfa\xfc\x31\x8b\xff\xbb\xf2\xc7\x2c\xfe\x33\xe4\x8f\x59\xfc\x47\xe4\x8f"
"\x59\xfc\xdf\x9d\x3f\x66\xf1\x9f\x31\x7f\xcc\xe2\x3f\x53\xfe\x98\xc5\xff"
"\x3d\xf9\x63\x16\xff\x99\xf3\xc7\x2c\xfe\xb3\xe4\x8f\x59\xfc\x67\xcd\x1f"
"\xb3\xf8\xcf\x96\x3f\x66\xf1\x7f\x6f\xfe\x98\xc5\x7f\xf6\xfc\x31\x8b\xff"
"\x1c\xf9\x63\x16\xff\x39\xf3\xc7\x2c\xfe\x73\xe5\x8f\x59\xfc\xe7\xce\x1f"
"\xb3\xf8\xcf\x93\x3f\x66\xf1\x9f\x37\x7f\xcc\xe2\x3f\x5f\xfe\x98\xc5\x7f"
"\xfe\xfc\x31\x8b\xff\x02\xf9\x63\x16\xff\x05\xf3\xc7\x2c\xfe\x0b\xe5\x8f"
"\x59\xfc\x17\xce\x1f\xb3\xf8\x2f\x92\x3f\x66\xf1\x5f\x34\x7f\xcc\xe2\xbf"
"\x58\xfe\x98\xc5\x7f\xf1\xfc\x31\x8b\xff\x12\xf9\x63\x16\xff\x25\xf3\xc7"
"\x2c\xfe\x4b\xe5\x8f\x59\xfc\x97\xce\x1f\xb3\xf8\x2f\x93\x3f\x66\xf1\x7f"
"\x5f\xfe\x98\xc5\xff\xfd\xf9\x63\x16\xff\x0f\xe4\x8f\x59\xfc\x97\xcd\x1f"
"\xb3\xf8\x2f\x97\x3f\x66\xf1\x5f\x3e\x7f\xcc\xe2\xbf\x42\xfe\x98\xc5\x7f"
"\xc5\xfc\x31\x8b\xff\x4a\xf9\x63\x16\xff\x95\xf3\xc7\x2c\xfe\xab\xe4\x8f"
"\x59\xfc\x57\xcd\x1f\xb3\xf8\xaf\x96\x3f\x66\xf1\x5f\x3d\x7f\xcc\xe2\xbf"
"\x46\xfe\x98\xc5\x7f\xcd\xfc\x31\x8b\xff\x5a\xf9\x63\x16\xff\xb5\xf3\xc7"
"\x2c\xfe\xeb\xe4\x8f\x59\xfc\xd7\xcd\x1f\xb3\xf8\xaf\x97\x3f\x66\xf1\x5f"
"\x3f\x7f\xcc\xe2\xbf\x41\xfe\x98\xc5\x7f\xc3\xfc\x31\x8b\xff\x46\xf9\x63"
"\x16\xff\x8d\xf3\xc7\x2c\xfe\x9b\xe4\x8f\x59\xfc\x37\xcd\x1f\xb3\xf8\x6f"
"\x96\x3f\x66\xf1\xdf\x3c\x7f\xcc\xe2\xbf\x45\xfe\x98\xc5\x7f\xcb\xfc\x31"
"\x8b\xff\x56\xf9\x63\x16\xff\xad\xf3\xc7\x2c\xfe\x1f\xcc\x1f\xb3\xf8\x6f"
"\x93\x3f\x66\xf1\xdf\x36\x7f\xcc\xe2\xbf\x5d\xfe\x98\xc5\x7f\xfb\xfc\x31"
"\x8b\xff\x0e\xf9\x63\x16\xff\x1d\xf3\xc7\x2c\xfe\x3b\xe5\x8f\x59\xfc\x77"
"\xce\x1f\xb3\xf8\xef\x92\x3f\x66\xf1\xdf\x35\x7f\xcc\xe2\xbf\x5b\xfe\x98"
"\xc5\xff\x43\xf9\x63\x16\xff\xdd\xf3\xc7\x2c\xfe\x7b\xe4\x8f\x59\xfc\xf7"
"\xcc\x1f\xb3\xf8\xef\x95\x3f\x66\xf1\xdf\x3b\x7f\xcc\xe2\xff\xe1\xfc\x31"
"\x8b\xff\x3e\xf9\x63\x16\xff\x7d\xf3\xc7\x2c\xfe\xfb\xe5\x8f\x59\xfc\x3f"
"\x92\x3f\x66\xf1\xff\x68\xfe\x98\xc5\xff\x63\xf9\x63\x16\xff\xfd\xf3\xc7"
"\x2c\xfe\x07\xe4\x8f\x59\xfc\x0f\xcc\x1f\xb3\xf8\x1f\x94\x3f\x66\xf1\x3f"
"\x38\x7f\xcc\xe2\x7f\x48\xfe\x98\xc5\xff\xd0\xfc\x31\x8b\xff\x61\xf9\x63"
"\x16\xff\xc3\xf3\xc7\x2c\xfe\x47\xe4\x8f\x59\xfc\x8f\xcc\x1f\xb3\xf8\x1f"
"\x95\x3f\x66\xf1\xff\x78\xfe\x98\xc5\xff\xe8\xfc\x31\x8b\xff\x27\xf2\xc7"
"\x2c\xfe\x9f\xcc\x1f\xb3\xf8\x1f\x93\x3f\x66\xf1\xff\x54\xfe\x98\xc5\xff"
"\xd8\xfc\x31\x8b\xff\x71\xf9\x63\x16\xff\xe3\xf3\xc7\x2c\xfe\x9f\xce\x1f"
"\xb3\xf8\x7f\x26\x7f\xcc\xe2\x7f\x42\xfe\x98\xc5\xff\xc4\xfc\x31\x8b\xff"
"\x49\xf9\x63\x16\xff\x93\xf3\xc7\x2c\xfe\xa7\xe4\x8f\x59\xfc\x3f\x9b\x3f"
"\x66\xf1\xff\x5c\xfe\x98\xc5\xff\xf3\xf9\x63\x16\xff\x2f\xe4\x8f\x59\xfc"
"\x4f\xcd\x1f\xb3\xf8\x7f\x31\x7f\xcc\xe2\xff\xa5\xfc\x31\x8b\xff\x97\xf3"
"\xc7\x2c\xfe\x5f\xc9\x1f\xb3\xf8\x9f\x96\x3f\x66\xf1\x3f\x3d\x7f\xcc\xe2"
"\x7f\x46\xfe\x98\xc5\xff\xcc\xfc\x31\x8b\xff\x59\xf9\x63\x16\xff\xb3\xf3"
"\xc7\x2c\xfe\x5f\xcd\x1f\xb3\xf8\x7f\x2d\x7f\xcc\xe2\x7f\x4e\xfe\x98\xc5"
"\xff\xeb\xf9\x63\x16\xff\x73\xf3\xc7\x2c\xfe\xe7\xe5\x8f\x59\xfc\xcf\xcf"
"\x1f\xb3\xf8\x5f\x90\x3f\x66\xf1\xbf\x30\x7f\xcc\xe2\xff\x8d\xfc\x31\x8b"
"\xff\x37\xf3\xc7\x2c\xfe\xdf\xca\x1f\xb3\xf8\x5f\x94\x3f\x66\xf1\xbf\x38"
"\x7f\xcc\xe2\xff\xed\xfc\x31\x8b\xff\x25\xf9\x63\x16\xff\xef\xe4\x8f\x59"
"\xfc\x2f\xcd\x1f\xb3\xf8\x5f\x96\x3f\x66\xf1\xbf\x3c\x7f\xcc\xe2\xff\xdd"
"\xfc\x31\x8b\xff\xf7\xf2\xc7\x2c\xfe\x57\xe4\x8f\x59\xfc\xaf\xcc\x1f\xb3"
"\xf8\x7f\x3f\x7f\xcc\xe2\x7f\x55\xfe\x98\xc5\xff\x07\xf9\x63\x16\xff\xab"
"\xf3\xc7\x2c\xfe\x3f\xcc\x1f\xb3\xf8\x5f\x93\x3f\x66\xf1\xff\x51\xfe\x98"
"\xc5\xff\xda\xfc\x31\x8b\xff\x75\xf9\x63\x16\xff\x1f\xe7\x8f\x59\xfc\x7f"
"\x92\x3f\x66\xf1\xff\x69\xfe\x98\xc5\xff\xfa\xfc\x31\x8b\xff\xcf\xf2\xc7"
"\x2c\xfe\x37\xe4\x8f\x59\xfc\x6f\xcc\x1f\xb3\xf8\xff\x3c\x7f\xcc\xe2\x7f"
"\x53\xfe\x98\xc5\xff\xe6\xfc\x31\x8b\xff\x2f\xf2\xc7\x2c\xfe\xb7\xe4\x8f"
"\x59\xfc\x6f\xcd\x1f\xb3\xf8\xdf\x96\x3f\x66\xf1\xbf\x3d\x7f\xcc\xe2\xff"
"\xcb\xfc\x31\x8b\xff\x1d\xf9\x63\x16\xff\x5f\xe5\x8f\x59\xfc\x7f\x9d\x3f"
"\x66\xf1\xff\x4d\xfe\x98\xc5\xff\xb7\xf9\x63\x16\xff\xdf\xe5\x8f\x59\xfc"
"\x7f\x9f\x3f\x66\xf1\xbf\x33\x7f\xcc\xe2\xff\x87\xfc\x31\x8b\xff\x1f\xf3"
"\xc7\x2c\xfe\x7f\xca\x1f\xb3\xf8\xdf\x95\x3f\x66\xf1\xbf\x3b\x7f\xcc\xe2"
"\xff\xe7\xfc\x31\x8b\xff\x3d\xf9\x63\x16\xff\xbf\xe4\x8f\x59\xfc\xef\xcd"
"\x1f\xb3\xf8\xdf\x97\x3f\x66\xf1\xff\x6b\xfe\x98\xc5\xff\x6f\xf9\x63\x16"
"\xff\xfb\xf3\xc7\x2c\xfe\x0f\xe4\x8f\x59\xfc\x1f\xcc\x1f\xb3\xf8\x3f\x94"
"\x3f\x66\xf1\x7f\x38\x7f\xcc\xe2\xff\x48\xfe\x98\xc5\xff\xd1\xfc\x31\x8b"
"\xff\x63\xf9\x63\x16\xff\xc7\xf3\xc7\x2c\xfe\x4f\xe4\x8f\x59\xfc\x9f\xcc"
"\x1f\xb3\xf8\x3f\x95\x3f\x66\xf1\x7f\x3a\x7f\xcc\xe2\xff\x4c\xfe\x98\xc5"
"\xff\xd9\xfc\x31\x8b\xff\x73\xf9\x63\x16\xff\xe7\xf3\xc7\x2c\xfe\x2f\xe4"
"\x8f\x59\xfc\x5f\xcc\x1f\xb3\xf8\xbf\x94\x3f\x66\xf1\x7f\x39\x7f\xcc\xe2"
"\xff\x4a\xfe\x98\xc5\xff\xd5\xfc\x31\x8b\xff\x6b\xf9\x63\x12\xff\x61\x03"
"\xf9\x63\x16\xff\x41\xf9\x63\x16\xff\xf1\xf2\xc7\x2c\xfe\x83\xf3\xc7\x2c"
"\xfe\x43\xf2\xc7\x2c\xfe\x43\xf3\xc7\x2c\xfe\xc3\xf2\xc7\x2c\xfe\xe3\xe7"
"\x8f\x59\xfc\x27\xc8\x1f\xb3\xf8\x4f\x98\x3f\x66\xf1\x9f\x28\x7f\xcc\xe2"
"\x3f\x71\xfe\x98\xc5\x7f\x92\xfc\x31\x8b\xff\xa4\xf9\x63\x16\xff\xe1\xf9"
"\x63\x16\xff\xc9\xf2\xc7\x2c\xfe\x93\xe7\x8f\x59\xfc\xa7\xc8\x1f\xb3\xf8"
"\x4f\x99\x3f\x66\xf1\x9f\x2a\x7f\xcc\xe2\x3f\x75\xfe\x98\xc5\x7f\x9a\xfc"
"\x31\x8b\xff\x3b\xf2\xc7\x2c\xfe\xef\xcc\x1f\xb3\xf8\x4f\x9b\x3f\x66\xf1"
"\x9f\x2e\x7f\xcc\xe2\x3f\x7d\xfe\x98\xc5\xff\x5d\xf9\x63\x16\xff\x19\xf2"
"\xc7\x2c\xfe\x23\xf2\xc7\x2c\xfe\xef\xce\x1f\xb3\xf8\xcf\x98\x3f\x66\xf1"
"\x9f\x29\x7f\xcc\xe2\xff\x9e\xfc\x31\x8b\xff\xcc\xf9\x63\x16\xff\x59\xf2"
"\xc7\x2c\xfe\xb3\xe6\x8f\x59\xfc\x67\xcb\x1f\xb3\xf8\xbf\x37\x7f\xcc\xe2"
"\x3f\x7b\xfe\x98\xc5\x7f\x8e\xfc\x31\x8b\xff\x9c\xf9\x63\x16\xff\xb9\xf2"
"\xc7\x2c\xfe\x73\xe7\x8f\x59\xfc\xe7\xc9\x1f\xb3\xf8\xcf\x9b\x3f\x66\xf1"
"\x9f\x2f\x7f\xcc\xe2\x3f\x7f\xfe\x98\xc5\x7f\x81\xfc\x31\x8b\xff\x82\xf9"
"\x63\x16\xff\x85\xf2\xc7\x2c\xfe\x0b\xe7\x8f\x59\xfc\x17\xc9\x1f\xb3\xf8"
"\x2f\x9a\x3f\x66\xf1\x5f\x2c\x7f\xcc\xe2\xbf\x78\xfe\x98\xc5\x7f\x89\xfc"
"\x31\x8b\xff\x92\xf9\x63\x16\xff\xa5\xf2\xc7\x2c\xfe\x4b\xe7\x8f\x59\xfc"
"\x97\xc9\x1f\xb3\xf8\xbf\x2f\x7f\xcc\xe2\xff\xfe\xfc\x31\x8b\xff\x07\xf2"
"\xc7\x2c\xfe\xcb\xe6\x8f\x59\xfc\x97\xcb\x1f\xb3\xf8\x2f\x9f\x3f\x66\xf1"
"\x5f\x21\x7f\xcc\xe2\xbf\x62\xfe\x98\xc5\x7f\xa5\xfc\x31\x8b\xff\xca\xf9"
"\x63\x16\xff\x55\xf2\xc7\x2c\xfe\xab\xe6\x8f\x59\xfc\x57\xcb\x1f\xb3\xf8"
"\xaf\x9e\x3f\x66\xf1\x5f\x23\x7f\xcc\xe2\xbf\x66\xfe\x98\xc5\x7f\xad\xfc"
"\x31\x8b\xff\xda\xf9\x63\x16\xff\x75\xf2\xc7\x2c\xfe\xeb\xe6\x8f\x59\xfc"
"\xd7\xcb\x1f\xb3\xf8\xaf\x9f\x3f\x66\xf1\xdf\x20\x7f\xcc\xe2\xbf\x61\xfe"
"\x98\xc5\x7f\xa3\xfc\x31\x8b\xff\xc6\xf9\x63\x16\xff\x4d\xf2\xc7\x2c\xfe"
"\x9b\xe6\x8f\x59\xfc\x37\xcb\x1f\xb3\xf8\x6f\x9e\x3f\x66\xf1\xdf\x22\x7f"
"\xcc\xe2\xbf\x65\xfe\x98\xc5\x7f\xab\xfc\x31\x8b\xff\xd6\xf9\x63\x16\xff"
"\x0f\xe6\x8f\x59\xfc\xb7\xc9\x1f\xb3\xf8\x6f\x9b\x3f\x66\xf1\xdf\x2e\x7f"
"\xcc\xe2\xbf\x7d\xfe\x98\xc5\x7f\x87\xfc\x31\x8b\xff\x8e\xf9\x63\x16\xff"
"\x9d\xf2\xc7\x2c\xfe\x3b\xe7\x8f\x59\xfc\x77\xc9\x1f\xb3\xf8\xef\x9a\x3f"
"\x66\xf1\xdf\x2d\x7f\xcc\xe2\xff\xa1\xfc\x31\x8b\xff\xee\xf9\x63\x16\xff"
"\x3d\xf2\xc7\x2c\xfe\x7b\xe6\x8f\x59\xfc\xf7\xca\x1f\xb3\xf8\xef\x9d\x3f"
"\x66\xf1\xff\x70\xfe\x98\xc5\x7f\x9f\xfc\x31\x8b\xff\xbe\xf9\x63\x16\xff"
"\xfd\xf2\xc7\x2c\xfe\x1f\xc9\x1f\xb3\xf8\x7f\x34\x7f\xcc\xe2\xff\xb1\xfc"
"\x31\x8b\xff\xfe\xf9\x63\x16\xff\x03\xf2\xc7\x2c\xfe\x07\xe6\x8f\x59\xfc"
"\x0f\xca\x1f\xb3\xf8\x1f\x9c\x3f\x66\xf1\x3f\x24\x7f\xcc\xe2\x7f\x68\xfe"
"\x98\xc5\xff\xb0\xfc\x31\x8b\xff\xe1\xf9\x63\x16\xff\x23\xf2\xc7\x2c\xfe"
"\x47\xe6\x8f\x59\xfc\x8f\xca\x1f\xb3\xf8\x7f\x3c\x7f\xcc\xe2\x7f\x74\xfe"
"\x98\xc5\xff\x13\xf9\x63\x16\xff\x4f\xe6\x8f\x59\xfc\x8f\xc9\x1f\xb3\xf8"
"\x7f\x2a\x7f\xcc\xe2\x7f\x6c\xfe\x98\xc5\xff\xb8\xfc\x31\x8b\xff\xf1\xf9"
"\x63\x16\xff\x4f\xe7\x8f\x59\xfc\x3f\x93\x3f\x66\xf1\x3f\x21\x7f\xcc\xe2"
"\x7f\x62\xfe\x98\xc5\xff\xa4\xfc\x31\x8b\xff\xc9\xf9\x63\x16\xff\x53\xf2"
"\xc7\x2c\xfe\x9f\xcd\x1f\xb3\xf8\x7f\x2e\x7f\xcc\xe2\xff\xf9\xfc\x31\x8b"
"\xff\x17\xf2\xc7\x2c\xfe\xa7\xe6\x8f\x59\xfc\xbf\x98\x3f\x66\xf1\xff\x52"
"\xfe\x98\xc5\xff\xcb\xf9\x63\x16\xff\xaf\xe4\x8f\x59\xfc\x4f\xcb\x1f\xb3"
"\xf8\x9f\x9e\x3f\x66\xf1\x3f\x23\x7f\xcc\xe2\x7f\x66\xfe\x98\xc5\xff\xac"
"\xfc\x31\x8b\xff\xd9\xf9\x63\x16\xff\xaf\xe6\x8f\x59\xfc\xbf\x96\x3f\x66"
"\xf1\x3f\x27\x7f\xcc\xe2\xff\xf5\xfc\x31\x8b\xff\xb9\xf9\x63\x16\xff\xf3"
"\xf2\xc7\x2c\xfe\xe7\xe7\x8f\x59\xfc\x2f\xc8\x1f\xb3\xf8\x5f\x98\x3f\x66"
"\xf1\xff\x46\xfe\x98\xc5\xff\x9b\xf9\x63\x16\xff\x6f\xe5\x8f\x59\xfc\x2f"
"\xca\x1f\xb3\xf8\x5f\x9c\x3f\x66\xf1\xff\x76\xfe\x98\xc5\xff\x92\xfc\x31"
"\x8b\xff\x77\xf2\xc7\x2c\xfe\x97\xe6\x8f\x59\xfc\x2f\xcb\x1f\xb3\xf8\x5f"
"\x9e\x3f\x66\xf1\xff\x6e\xfe\x98\xc5\xff\x7b\xf9\x63\x16\xff\x2b\xf2\xc7"
"\x2c\xfe\x57\xe6\x8f\x59\xfc\xbf\x9f\x3f\x66\xf1\xbf\x2a\x7f\xcc\xe2\xff"
"\x83\xfc\x31\x8b\xff\xd5\xf9\x63\x16\xff\x1f\xe6\x8f\x59\xfc\xaf\xc9\x1f"
"\xb3\xf8\xff\x28\x7f\xcc\xe2\x7f\x6d\xfe\x98\xc5\xff\xba\xfc\x31\x8b\xff"
"\x8f\xf3\xc7\x2c\xfe\x3f\xc9\x1f\xb3\xf8\xff\x34\x7f\xcc\xe2\x7f\x7d\xfe"
"\x98\xc5\xff\x67\xf9\x63\x16\xff\x1b\xf2\xc7\x2c\xfe\x37\xe6\x8f\x59\xfc"
"\x7f\x9e\x3f\x66\xf1\xbf\x29\x7f\xcc\xe2\x7f\x73\xfe\x98\xc5\xff\x17\xf9"
"\x63\x16\xff\x5b\xf2\xc7\x2c\xfe\xb7\xe6\x8f\x59\xfc\x6f\xcb\x1f\xb3\xf8"
"\xdf\x9e\x3f\x66\xf1\xff\x65\xfe\x98\xc5\xff\x8e\xfc\x31\x8b\xff\xaf\xf2"
"\xc7\x2c\xfe\xbf\xce\x1f\xb3\xf8\xff\x26\x7f\xcc\xe2\xff\xdb\xfc\x31\x8b"
"\xff\xef\xf2\xc7\x2c\xfe\xbf\xcf\x1f\xb3\xf8\xdf\x99\x3f\x66\xf1\xff\x43"
"\xfe\x98\xc5\xff\x8f\xf9\x63\x16\xff\x3f\xe5\x8f\x59\xfc\xef\xca\x1f\xb3"
"\xf8\xdf\x9d\x3f\x66\xf1\xff\x73\xfe\x98\xc5\xff\x9e\xfc\x31\x8b\xff\x5f"
"\xf2\xc7\x2c\xfe\xf7\xe6\x8f\x59\xfc\xef\xcb\x1f\xb3\xf8\xff\x35\x7f\xcc"
"\xe2\xff\xb7\xfc\x31\x8b\xff\xfd\xf9\x63\x16\xff\x07\xf2\xc7\x2c\xfe\x0f"
"\xe6\x8f\x59\xfc\x1f\xca\x1f\xb3\xf8\x3f\x9c\x3f\x66\xf1\x7f\x24\x7f\xcc"
"\xe2\xff\x68\xfe\x98\xc5\xff\xb1\xfc\x31\x8b\xff\xe3\xf9\x63\x16\xff\x27"
"\xf2\xc7\x2c\xfe\x4f\xe6\x8f\x59\xfc\x9f\xca\x1f\xb3\xf8\x3f\x9d\x3f\x66"
"\xf1\x7f\x26\x7f\xcc\xe2\xff\x6c\xfe\x98\xc5\xff\xb9\xfc\x31\x8b\xff\xf3"
"\xf9\x63\x16\xff\x17\xf2\xc7\x2c\xfe\x2f\xe6\x8f\x59\xfc\x5f\xca\x1f\xb3"
"\xf8\xbf\x9c\x3f\x66\xf1\x7f\x25\x7f\xcc\xe2\xff\x6a\xfe\x98\xc5\xff\xb5"
"\xfc\x31\x89\xff\xf8\x03\xf9\x63\x16\xff\x41\xf9\x63\x16\xff\xf1\xf2\xc7"
"\x2c\xfe\x83\xf3\xc7\x2c\xfe\x43\xf2\xc7\x2c\xfe\x43\xf3\xc7\x2c\xfe\xc3"
"\xf2\xc7\x2c\xfe\xe3\xe7\x8f\x59\xfc\x27\xc8\x1f\xb3\xf8\x4f\x98\x3f\x66"
"\xf1\x9f\x28\x7f\xcc\xe2\x3f\x71\xfe\x98\xc5\x7f\x92\xfc\x31\x8b\xff\xa4"
"\xf9\x63\x16\xff\xe1\xf9\x63\x16\xff\xc9\xf2\xc7\x2c\xfe\x93\xe7\x8f\x59"
"\xfc\xa7\xc8\x1f\xb3\xf8\x4f\x99\x3f\x66\xf1\x9f\x2a\x7f\xcc\xe2\x3f\x75"
"\xfe\x98\xc5\x7f\x9a\xfc\x31\x8b\xff\x3b\xf2\xc7\x2c\xfe\xef\xcc\x1f\xb3"
"\xf8\x4f\x9b\x3f\x66\xf1\x9f\x2e\x7f\xcc\xe2\x3f\x7d\xfe\x98\xc5\xff\x5d"
"\xf9\x63\x16\xff\x19\xf2\xc7\x2c\xfe\x23\xf2\xc7\x2c\xfe\xef\xce\x1f\xb3"
"\xf8\xcf\x98\x3f\x66\xf1\x9f\x29\x7f\xcc\xe2\xff\x9e\xfc\x31\x8b\xff\xcc"
"\xf9\x63\x16\xff\x59\xf2\xc7\x2c\xfe\xb3\xe6\x8f\x59\xfc\x67\xcb\x1f\xb3"
"\xf8\xbf\x37\x7f\xcc\xe2\x3f\x7b\xfe\x98\xc5\x7f\x8e\xfc\x31\x8b\xff\x9c"
"\xf9\x63\x16\xff\xb9\xf2\xc7\x2c\xfe\x73\xe7\x8f\x59\xfc\xe7\xc9\x1f\xb3"
"\xf8\xcf\x9b\x3f\x66\xf1\x9f\x2f\x7f\xcc\xe2\x3f\x7f\xfe\x98\xc5\x7f\x81"
"\xfc\x31\x8b\xff\x82\xf9\x63\x16\xff\x85\xf2\xc7\x2c\xfe\x0b\xe7\x8f\x59"
"\xfc\x17\xc9\x1f\xb3\xf8\x2f\x9a\x3f\x66\xf1\x5f\x2c\x7f\xcc\xe2\xbf\x78"
"\xfe\x98\xc5\x7f\x89\xfc\x31\x8b\xff\x92\xf9\x63\x16\xff\xa5\xf2\xc7\x2c"
"\xfe\x4b\xe7\x8f\x59\xfc\x97\xc9\x1f\xb3\xf8\xbf\x2f\x7f\xcc\xe2\xff\xfe"
"\xfc\x31\x8b\xff\x07\xf2\xc7\x2c\xfe\xcb\xe6\x8f\x59\xfc\x97\xcb\x1f\xb3"
"\xf8\x2f\x9f\x3f\x66\xf1\x5f\x21\x7f\xcc\xe2\xbf\x62\xfe\x98\xc5\x7f\xa5"
"\xfc\x31\x8b\xff\xca\xf9\x63\x16\xff\x55\xf2\xc7\x2c\xfe\xab\xe6\x8f\x59"
"\xfc\x57\xcb\x1f\xb3\xf8\xaf\x9e\x3f\x66\xf1\x5f\x23\x7f\xcc\xe2\xbf\x66"
"\xfe\x98\xc5\x7f\xad\xfc\x31\x8b\xff\xda\xf9\x63\x16\xff\x75\xf2\xc7\x2c"
"\xfe\xeb\xe6\x8f\x59\xfc\xd7\xcb\x1f\xb3\xf8\xaf\x9f\x3f\x66\xf1\xdf\x20"
"\x7f\xcc\xe2\xbf\x61\xfe\x98\xc5\x7f\xa3\xfc\x31\x8b\xff\xc6\xf9\x63\x16"
"\xff\x4d\xf2\xc7\x2c\xfe\x9b\xe6\x8f\x59\xfc\x37\xcb\x1f\xb3\xf8\x6f\x9e"
"\x3f\x66\xf1\xdf\x22\x7f\xcc\xe2\xbf\x65\xfe\x98\xc5\x7f\xab\xfc\x31\x8b"
"\xff\xd6\xf9\x63\x16\xff\x0f\xe6\x8f\x59\xfc\xb7\xc9\x1f\xb3\xf8\x6f\x9b"
"\x3f\x66\xf1\xdf\x2e\x7f\xcc\xe2\xbf\x7d\xfe\x98\xc5\x7f\x87\xfc\x31\x8b"
"\xff\x8e\xf9\x63\x16\xff\x9d\xf2\xc7\x2c\xfe\x3b\xe7\x8f\x59\xfc\x77\xc9"
"\x1f\xb3\xf8\xef\x9a\x3f\x66\xf1\xdf\x2d\x7f\xcc\xe2\xff\xa1\xfc\x31\x8b"
"\xff\xee\xf9\x63\x16\xff\x3d\xf2\xc7\x2c\xfe\x7b\xe6\x8f\x59\xfc\xf7\xca"
"\x1f\xb3\xf8\xef\x9d\x3f\x66\xf1\xff\x70\xfe\x98\xc5\x7f\x9f\xfc\x31\x8b"
"\xff\xbe\xf9\x63\x16\xff\xfd\xf2\xc7\x2c\xfe\x1f\xc9\x1f\xb3\xf8\x7f\x34"
"\x7f\xcc\xe2\xff\xb1\xfc\x31\x8b\xff\xfe\xf9\x63\x16\xff\x03\xf2\xc7\x2c"
"\xfe\x07\xe6\x8f\x59\xfc\x0f\xca\x1f\xb3\xf8\x1f\x9c\x3f\x66\xf1\x3f\x24"
"\x7f\xcc\xe2\x7f\x68\xfe\x98\xc5\xff\xb0\xfc\x31\x8b\xff\xe1\xf9\x63\x16"
"\xff\x23\xf2\xc7\x2c\xfe\x47\xe6\x8f\x59\xfc\x8f\xca\x1f\xb3\xf8\x7f\x3c"
"\x7f\xcc\xe2\x7f\x74\xfe\x98\xc5\xff\x13\xf9\x63\x16\xff\x4f\xe6\x8f\x59"
"\xfc\x8f\xc9\x1f\xb3\xf8\x7f\x2a\x7f\xcc\xe2\x7f\x6c\xfe\x98\xc5\xff\xb8"
"\xfc\x31\x8b\xff\xf1\xf9\x63\x16\xff\x4f\xe7\x8f\x59\xfc\x3f\x93\x3f\x66"
"\xf1\x3f\x21\x7f\xcc\xe2\x7f\x62\xfe\x98\xc5\xff\xa4\xfc\x31\x8b\xff\xc9"
"\xf9\x63\x16\xff\x53\xf2\xc7\x2c\xfe\x9f\xcd\x1f\xb3\xf8\x7f\x2e\x7f\xcc"
"\xe2\xff\xf9\xfc\x31\x8b\xff\x17\xf2\xc7\x2c\xfe\xa7\xe6\x8f\x59\xfc\xbf"
"\x98\x3f\x66\xf1\xff\x52\xfe\x98\xc5\xff\xcb\xf9\x63\x16\xff\xaf\xe4\x8f"
"\x59\xfc\x4f\xcb\x1f\xb3\xf8\x9f\x9e\x3f\x66\xf1\x3f\x23\x7f\xcc\xe2\x7f"
"\x66\xfe\x98\xc5\xff\xac\xfc\x31\x8b\xff\xd9\xf9\x63\x16\xff\xaf\xe6\x8f"
"\x59\xfc\xbf\x96\x3f\x66\xf1\x3f\x27\x7f\xcc\xe2\xff\xf5\xfc\x31\x8b\xff"
"\xb9\xf9\x63\x16\xff\xf3\xf2\xc7\x2c\xfe\xe7\xe7\x8f\x59\xfc\x2f\xc8\x1f"
"\xb3\xf8\x5f\x98\x3f\x66\xf1\xff\x46\xfe\x98\xc5\xff\x9b\xf9\x63\x16\xff"
"\x6f\xe5\x8f\x59\xfc\x2f\xca\x1f\xb3\xf8\x5f\x9c\x3f\x66\xf1\xff\x76\xfe"
"\x98\xc5\xff\x92\xfc\x31\x8b\xff\x77\xf2\xc7\x2c\xfe\x97\xe6\x8f\x59\xfc"
"\x2f\xcb\x1f\xb3\xf8\x5f\x9e\x3f\x66\xf1\xff\x6e\xfe\x98\xc5\xff\x7b\xf9"
"\x63\x16\xff\x2b\xf2\xc7\x2c\xfe\x57\xe6\x8f\x59\xfc\xbf\x9f\x3f\x66\xf1"
"\xbf\x2a\x7f\xcc\xe2\xff\x83\xfc\x31\x8b\xff\xd5\xf9\x63\x16\xff\x1f\xe6"
"\x8f\x59\xfc\xaf\xc9\x1f\xb3\xf8\xff\x28\x7f\xcc\xe2\x7f\x6d\xfe\x98\xc5"
"\xff\xba\xfc\x31\x8b\xff\x8f\xf3\xc7\x2c\xfe\x3f\xc9\x1f\xb3\xf8\xff\x34"
"\x7f\xcc\xe2\x7f\x7d\xfe\x98\xc5\xff\x67\xf9\x63\x16\xff\x1b\xf2\xc7\x2c"
"\xfe\x37\xe6\x8f\x59\xfc\x7f\x9e\x3f\x66\xf1\xbf\x29\x7f\xcc\xe2\x7f\x73"
"\xfe\x98\xc5\xff\x17\xf9\x63\x16\xff\x5b\xf2\xc7\x2c\xfe\xb7\xe6\x8f\x59"
"\xfc\x6f\xcb\x1f\xb3\xf8\xdf\x9e\x3f\x66\xf1\xff\x65\xfe\x98\xc5\xff\x8e"
"\xfc\x31\x8b\xff\xaf\xf2\xc7\x2c\xfe\xbf\xce\x1f\xb3\xf8\xff\x26\x7f\xcc"
"\xe2\xff\xdb\xfc\x31\x8b\xff\xef\xf2\xc7\x2c\xfe\xbf\xcf\x1f\xb3\xf8\xdf"
"\x99\x3f\x66\xf1\xff\x43\xfe\x98\xc5\xff\x8f\xf9\x63\x16\xff\x3f\xe5\x8f"
"\x59\xfc\xef\xca\x1f\xb3\xf8\xdf\x9d\x3f\x66\xf1\xff\x73\xfe\x98\xc5\xff"
"\x9e\xfc\x31\x8b\xff\x5f\xf2\xc7\x2c\xfe\xf7\xe6\x8f\x59\xfc\xef\xcb\x1f"
"\xb3\xf8\xff\x35\x7f\xcc\xe2\xff\xb7\xfc\x31\x8b\xff\xfd\xf9\x63\x16\xff"
"\x07\xf2\xc7\x2c\xfe\x0f\xe6\x8f\x59\xfc\x1f\xca\x1f\xb3\xf8\x3f\x9c\x3f"
"\x66\xf1\x7f\x24\x7f\xcc\xe2\xff\x68\xfe\x98\xc5\xff\xb1\xfc\x31\x8b\xff"
"\xe3\xf9\x63\x16\xff\x27\xf2\xc7\x2c\xfe\x4f\xe6\x8f\x59\xfc\x9f\xca\x1f"
"\xb3\xf8\x3f\x9d\x3f\x66\xf1\x7f\x26\x7f\xcc\xe2\xff\x6c\xfe\x98\xc5\xff"
"\xb9\xfc\x31\x8b\xff\xf3\xf9\x63\x16\xff\x17\xf2\xc7\x2c\xfe\x2f\xe6\x8f"
"\x59\xfc\x5f\xca\x1f\xb3\xf8\xbf\x9c\x3f\x66\xf1\x7f\x25\x7f\xcc\xe2\xff"
"\x6a\xfe\x98\xc5\xff\xb5\xfc\x31\x89\xff\x04\x03\xf9\x63\x16\xff\x41\xf9"
"\x63\x16\xff\xf1\xf2\xc7\x2c\xfe\x83\xf3\xc7\x2c\xfe\x43\xf2\xc7\x2c\xfe"
"\x43\xf3\xc7\x2c\xfe\xc3\xf2\xc7\x2c\xfe\xe3\xe7\x8f\x59\xfc\x27\xc8\x1f"
"\xb3\xf8\x4f\x98\x3f\x66\xf1\x9f\x28\x7f\xcc\xe2\x3f\x71\xfe\x98\xc5\x7f"
"\x92\xfc\x31\x8b\xff\xa4\xf9\x63\x16\xff\xe1\xf9\x63\x16\xff\xc9\xf2\xc7"
"\x2c\xfe\x93\xe7\x8f\x59\xfc\xa7\xc8\x1f\xb3\xf8\x4f\x99\x3f\x66\xf1\x9f"
"\x2a\x7f\xcc\xe2\x3f\x75\xfe\x98\xc5\x7f\x9a\xfc\x31\x8b\xff\x3b\xf2\xc7"
"\x2c\xfe\xef\xcc\x1f\xb3\xf8\x4f\x9b\x3f\x66\xf1\x9f\x2e\x7f\xcc\xe2\x3f"
"\x7d\xfe\x98\xc5\xff\x5d\xf9\x63\x16\xff\x19\xf2\xc7\x2c\xfe\x23\xf2\xc7"
"\x2c\xfe\xef\xce\x1f\xb3\xf8\xcf\x98\x3f\x66\xf1\x9f\x29\x7f\xcc\xe2\xff"
"\x9e\xfc\x31\x8b\xff\xcc\xf9\x63\x16\xff\x59\xf2\xc7\x2c\xfe\xb3\xe6\x8f"
"\x59\xfc\x67\xcb\x1f\xb3\xf8\xbf\x37\x7f\xcc\xe2\x3f\x7b\xfe\x98\xc5\x7f"
"\x8e\xfc\x31\x8b\xff\x9c\xf9\x63\x16\xff\xb9\xf2\xc7\x2c\xfe\x73\xe7\x8f"
"\x59\xfc\xe7\xc9\x1f\xb3\xf8\xcf\x9b\x3f\x66\xf1\x9f\x2f\x7f\xcc\xe2\x3f"
"\x7f\xfe\x98\xc5\x7f\x81\xfc\x31\x8b\xff\x82\xf9\x63\x16\xff\x85\xf2\xc7"
"\x2c\xfe\x0b\xe7\x8f\x59\xfc\x17\xc9\x1f\xb3\xf8\x2f\x9a\x3f\x66\xf1\x5f"
"\x2c\x7f\xcc\xe2\xbf\x78\xfe\x98\xc5\x7f\x89\xfc\x31\x8b\xff\x92\xf9\x63"
"\x16\xff\xa5\xf2\xc7\x2c\xfe\x4b\xe7\x8f\x59\xfc\x97\xc9\x1f\xb3\xf8\xbf"
"\x2f\x7f\xcc\xe2\xff\xfe\xfc\x31\x8b\xff\x07\xf2\xc7\x2c\xfe\xcb\xe6\x8f"
"\x59\xfc\x97\xcb\x1f\xb3\xf8\x2f\x9f\x3f\x66\xf1\x5f\x21\x7f\xcc\xe2\xbf"
"\x62\xfe\x98\xc5\x7f\xa5\xfc\x31\x8b\xff\xca\xf9\x63\x16\xff\x55\xf2\xc7"
"\x2c\xfe\xab\xe6\x8f\x59\xfc\x57\xcb\x1f\xb3\xf8\xaf\x9e\x3f\x66\xf1\x5f"
"\x23\x7f\xcc\xe2\xbf\x66\xfe\x98\xc5\x7f\xad\xfc\x31\x8b\xff\xda\xf9\x63"
"\x16\xff\x75\xf2\xc7\x2c\xfe\xeb\xe6\x8f\x59\xfc\xd7\xcb\x1f\xb3\xf8\xaf"
"\x9f\x3f\x66\xf1\xdf\x20\x7f\xcc\xe2\xbf\x61\xfe\x98\xc5\x7f\xa3\xfc\x31"
"\x8b\xff\xc6\xf9\x63\x16\xff\x4d\xf2\xc7\x2c\xfe\x9b\xe6\x8f\x59\xfc\x37"
"\xcb\x1f\xb3\xf8\x6f\x9e\x3f\x66\xf1\xdf\x22\x7f\xcc\xe2\xbf\x65\xfe\x98"
"\xc5\x7f\xab\xfc\x31\x8b\xff\xd6\xf9\x63\x16\xff\x0f\xe6\x8f\x59\xfc\xb7"
"\xc9\x1f\xb3\xf8\x6f\x9b\x3f\x66\xf1\xdf\x2e\x7f\xcc\xe2\xbf\x7d\xfe\x98"
"\xc5\x7f\x87\xfc\x31\x8b\xff\x8e\xf9\x63\x16\xff\x9d\xf2\xc7\x2c\xfe\x3b"
"\xe7\x8f\x59\xfc\x77\xc9\x1f\xb3\xf8\xef\x9a\x3f\x66\xf1\xdf\x2d\x7f\xcc"
"\xe2\xff\xa1\xfc\x31\x8b\xff\xee\xf9\x63\x16\xff\x3d\xf2\xc7\x2c\xfe\x7b"
"\xe6\x8f\x59\xfc\xf7\xca\x1f\xb3\xf8\xef\x9d\x3f\x66\xf1\xff\x70\xfe\x98"
"\xc5\x7f\x9f\xfc\x31\x8b\xff\xbe\xf9\x63\x16\xff\xfd\xf2\xc7\x2c\xfe\x1f"
"\xc9\x1f\xb3\xf8\x7f\x34\x7f\xcc\xe2\xff\xb1\xfc\x31\x8b\xff\xfe\xf9\x63"
"\x16\xff\x03\xf2\xc7\x2c\xfe\x07\xe6\x8f\x59\xfc\x0f\xca\x1f\xb3\xf8\x1f"
"\x9c\x3f\x66\xf1\x3f\x24\x7f\xcc\xe2\x7f\x68\xfe\x98\xc5\xff\xb0\xfc\x31"
"\x8b\xff\xe1\xf9\x63\x16\xff\x23\xf2\xc7\x2c\xfe\x47\xe6\x8f\x59\xfc\x8f"
"\xca\x1f\xb3\xf8\x7f\x3c\x7f\xcc\xe2\x7f\x74\xfe\x98\xc5\xff\x13\xf9\x63"
"\x16\xff\x4f\xe6\x8f\x59\xfc\x8f\xc9\x1f\xb3\xf8\x7f\x2a\x7f\xcc\xe2\x7f"
"\x6c\xfe\x98\xc5\xff\xb8\xfc\x31\x8b\xff\xf1\xf9\x63\x16\xff\x4f\xe7\x8f"
"\x59\xfc\x3f\x93\x3f\x66\xf1\x3f\x21\x7f\xcc\xe2\x7f\x62\xfe\x98\xc5\xff"
"\xa4\xfc\x31\x8b\xff\xc9\xf9\x63\x16\xff\x53\xf2\xc7\x2c\xfe\x9f\xcd\x1f"
"\xb3\xf8\x7f\x2e\x7f\xcc\xe2\xff\xf9\xfc\x31\x8b\xff\x17\xf2\xc7\x2c\xfe"
"\xa7\xe6\x8f\x59\xfc\xbf\x98\x3f\x66\xf1\xff\x52\xfe\x98\xc5\xff\xcb\xf9"
"\x63\x16\xff\xaf\xe4\x8f\x59\xfc\x4f\xcb\x1f\xb3\xf8\x9f\x9e\x3f\x66\xf1"
"\x3f\x23\x7f\xcc\xe2\x7f\x66\xfe\x98\xc5\xff\xac\xfc\x31\x8b\xff\xd9\xf9"
"\x63\x16\xff\xaf\xe6\x8f\x59\xfc\xbf\x96\x3f\x66\xf1\x3f\x27\x7f\xcc\xe2"
"\xff\xf5\xfc\x31\x8b\xff\xb9\xf9\x63\x16\xff\xf3\xf2\xc7\x2c\xfe\xe7\xe7"
"\x8f\x59\xfc\x2f\xc8\x1f\xb3\xf8\x5f\x98\x3f\x66\xf1\xff\x46\xfe\x98\xc5"
"\xff\x9b\xf9\x63\x16\xff\x6f\xe5\x8f\x59\xfc\x2f\xca\x1f\xb3\xf8\x5f\x9c"
"\x3f\x66\xf1\xff\x76\xfe\x98\xc5\xff\x92\xfc\x31\x8b\xff\x77\xf2\xc7\x2c"
"\xfe\x97\xe6\x8f\x59\xfc\x2f\xcb\x1f\xb3\xf8\x5f\x9e\x3f\x66\xf1\xff\x6e"
"\xfe\x98\xc5\xff\x7b\xf9\x63\x16\xff\x2b\xf2\xc7\x2c\xfe\x57\xe6\x8f\x59"
"\xfc\xbf\x9f\x3f\x66\xf1\xbf\x2a\x7f\xcc\xe2\xff\x83\xfc\x31\x8b\xff\xd5"
"\xf9\x63\x16\xff\x1f\xe6\x8f\x59\xfc\xaf\xc9\x1f\xb3\xf8\xff\x28\x7f\xcc"
"\xe2\x7f\x6d\xfe\x98\xc5\xff\xba\xfc\x31\x8b\xff\x8f\xf3\xc7\x2c\xfe\x3f"
"\xc9\x1f\xb3\xf8\xff\x34\x7f\xcc\xe2\x7f\x7d\xfe\x98\xc5\xff\x67\xf9\x63"
"\x16\xff\x1b\xf2\xc7\x2c\xfe\x37\xe6\x8f\x59\xfc\x7f\x9e\x3f\x66\xf1\xbf"
"\x29\x7f\xcc\xe2\x7f\x73\xfe\x98\xc5\xff\x17\xf9\x63\x16\xff\x5b\xf2\xc7"
"\x2c\xfe\xb7\xe6\x8f\x59\xfc\x6f\xcb\x1f\xb3\xf8\xdf\x9e\x3f\x66\xf1\xff"
"\x65\xfe\x98\xc5\xff\x8e\xfc\x31\x8b\xff\xaf\xf2\xc7\x2c\xfe\xbf\xce\x1f"
"\xb3\xf8\xff\x26\x7f\xcc\xe2\xff\xdb\xfc\x31\x8b\xff\xef\xf2\xc7\x2c\xfe"
"\xbf\xcf\x1f\xb3\xf8\xdf\x99\x3f\x66\xf1\xff\x43\xfe\x98\xc5\xff\x8f\xf9"
"\x63\x16\xff\x3f\xe5\x8f\x59\xfc\xef\xca\x1f\xb3\xf8\xdf\x9d\x3f\x66\xf1"
"\xff\x73\xfe\x98\xc5\xff\x9e\xfc\x31\x8b\xff\x5f\xf2\xc7\x2c\xfe\xf7\xe6"
"\x8f\x59\xfc\xef\xcb\x1f\xb3\xf8\xff\x35\x7f\xcc\xe2\xff\xb7\xfc\x31\x8b"
"\xff\xfd\xf9\x63\x16\xff\x07\xf2\xc7\x2c\xfe\x0f\xe6\x8f\x59\xfc\x1f\xca"
"\x1f\xb3\xf8\x3f\x9c\x3f\x66\xf1\x7f\x24\x7f\xcc\xe2\xff\x68\xfe\x98\xc5"
"\xff\xb1\xfc\x31\x8b\xff\xe3\xf9\x63\x16\xff\x27\xf2\xc7\x2c\xfe\x4f\xe6"
"\x8f\x59\xfc\x9f\xca\x1f\xb3\xf8\x3f\x9d\x3f\x66\xf1\x7f\x26\x7f\xcc\xe2"
"\xff\x6c\xfe\x98\xc5\xff\xb9\xfc\x31\x8b\xff\xf3\xf9\x63\x16\xff\x17\xf2"
"\xc7\x2c\xfe\x2f\xe6\x8f\x59\xfc\x5f\xca\x1f\xb3\xf8\xbf\x9c\x3f\x66\xf1"
"\x7f\x25\x7f\xcc\xe2\xff\x6a\xfe\x98\xc5\xff\xb5\xfc\x31\x89\xff\x84\x03"
"\xf9\x63\x16\xff\x41\xf9\x63\x16\xff\xf1\xf2\xc7\x2c\xfe\x83\xf3\xc7\x2c"
"\xfe\x43\xf2\xc7\x2c\xfe\x43\xf3\xc7\x2c\xfe\xc3\xf2\xc7\x2c\xfe\xe3\xe7"
"\x8f\x59\xfc\x27\xc8\x1f\xb3\xf8\x4f\x98\x3f\x66\xf1\x9f\x28\x7f\xcc\xe2"
"\x3f\x71\xfe\x98\xc5\x7f\x92\xfc\x31\x8b\xff\xa4\xf9\x63\x16\xff\xe1\xf9"
"\x63\x16\xff\xc9\xf2\xc7\x2c\xfe\x93\xe7\x8f\x59\xfc\xa7\xc8\x1f\xb3\xf8"
"\x4f\x99\x3f\x66\xf1\x9f\x2a\x7f\xcc\xe2\x3f\x75\xfe\x98\xc5\x7f\x9a\xfc"
"\x31\x8b\xff\x3b\xf2\xc7\x2c\xfe\xef\xcc\x1f\xb3\xf8\x4f\x9b\x3f\x66\xf1"
"\x9f\x2e\x7f\xcc\xe2\x3f\x7d\xfe\x98\xc5\xff\x5d\xf9\x63\x16\xff\x19\xf2"
"\xc7\x2c\xfe\x23\xf2\xc7\x2c\xfe\xef\xce\x1f\xb3\xf8\xcf\x98\x3f\x66\xf1"
"\x9f\x29\x7f\xcc\xe2\xff\x9e\xfc\x31\x8b\xff\xcc\xf9\x63\x16\xff\x59\xf2"
"\xc7\x2c\xfe\xb3\xe6\x8f\x59\xfc\x67\xcb\x1f\xb3\xf8\xbf\x37\x7f\xcc\xe2"
"\x3f\x7b\xfe\x98\xc5\x7f\x8e\xfc\x31\x8b\xff\x9c\xf9\x63\x16\xff\xb9\xf2"
"\xc7\x2c\xfe\x73\xe7\x8f\x59\xfc\xe7\xc9\x1f\xb3\xf8\xcf\x9b\x3f\x66\xf1"
"\x9f\x2f\x7f\xcc\xe2\x3f\x7f\xfe\x98\xc5\x7f\x81\xfc\x31\x8b\xff\x82\xf9"
"\x63\x16\xff\x85\xf2\xc7\x2c\xfe\x0b\xe7\x8f\x59\xfc\x17\xc9\x1f\xb3\xf8"
"\x2f\x9a\x3f\x66\xf1\x5f\x2c\x7f\xcc\xe2\xbf\x78\xfe\x98\xc5\x7f\x89\xfc"
"\x31\x8b\xff\x92\xf9\x63\x16\xff\xa5\xf2\xc7\x2c\xfe\x4b\xe7\x8f\x59\xfc"
"\x97\xc9\x1f\xb3\xf8\xbf\x2f\x7f\xcc\xe2\xff\xfe\xfc\x31\x8b\xff\x07\xf2"
"\xc7\x2c\xfe\xcb\xe6\x8f\x59\xfc\x97\xcb\x1f\xb3\xf8\x2f\x9f\x3f\x66\xf1"
"\x5f\x21\x7f\xcc\xe2\xbf\x62\xfe\x98\xc5\x7f\xa5\xfc\x31\x8b\xff\xca\xf9"
"\x63\x16\xff\x55\xf2\xc7\x2c\xfe\xab\xe6\x8f\x59\xfc\x57\xcb\x1f\xb3\xf8"
"\xaf\x9e\x3f\x66\xf1\x5f\x23\x7f\xcc\xe2\xbf\x66\xfe\x98\xc5\x7f\xad\xfc"
"\x31\x8b\xff\xda\xf9\x63\x16\xff\x75\xf2\xc7\x2c\xfe\xeb\xe6\x8f\x59\xfc"
"\xd7\xcb\x1f\xb3\xf8\xaf\x9f\x3f\x66\xf1\xdf\x20\x7f\xcc\xe2\xbf\x61\xfe"
"\x98\xc5\x7f\xa3\xfc\x31\x8b\xff\xc6\xf9\x63\x16\xff\x4d\xf2\xc7\x2c\xfe"
"\x9b\xe6\x8f\x59\xfc\x37\xcb\x1f\xb3\xf8\x6f\x9e\x3f\x66\xf1\xdf\x22\x7f"
"\xcc\xe2\xbf\x65\xfe\x98\xc5\x7f\xab\xfc\x31\x8b\xff\xd6\xf9\x63\x16\xff"
"\x0f\xe6\x8f\x59\xfc\xb7\xc9\x1f\xb3\xf8\x6f\x9b\x3f\x66\xf1\xdf\x2e\x7f"
"\xcc\xe2\xbf\x7d\xfe\x98\xc5\x7f\x87\xfc\x31\x8b\xff\x8e\xf9\x63\x16\xff"
"\x9d\xf2\xc7\x2c\xfe\x3b\xe7\x8f\x59\xfc\x77\xc9\x1f\xb3\xf8\xef\x9a\x3f"
"\x66\xf1\xdf\x2d\x7f\xcc\xe2\xff\xa1\xfc\x31\x8b\xff\xee\xf9\x63\x16\xff"
"\x3d\xf2\xc7\x2c\xfe\x7b\xe6\x8f\x59\xfc\xf7\xca\x1f\xb3\xf8\xef\x9d\x3f"
"\x66\xf1\xff\x70\xfe\x98\xc5\x7f\x9f\xfc\x31\x8b\xff\xbe\xf9\x63\x16\xff"
"\xfd\xf2\xc7\x2c\xfe\x1f\xc9\x1f\xb3\xf8\x7f\x34\x7f\xcc\xe2\xff\xb1\xfc"
"\x31\x8b\xff\xfe\xf9\x63\x16\xff\x03\xf2\xc7\x2c\xfe\x07\xe6\x8f\x59\xfc"
"\x0f\xca\x1f\xb3\xf8\x1f\x9c\x3f\x66\xf1\x3f\x24\x7f\xcc\xe2\x7f\x68\xfe"
"\x98\xc5\xff\xb0\xfc\x31\x8b\xff\xe1\xf9\x63\x16\xff\x23\xf2\xc7\x2c\xfe"
"\x47\xe6\x8f\x59\xfc\x8f\xca\x1f\xb3\xf8\x7f\x3c\x7f\xcc\xe2\x7f\x74\xfe"
"\x98\xc5\xff\x13\xf9\x63\x16\xff\x4f\xe6\x8f\x59\xfc\x8f\xc9\x1f\xb3\xf8"
"\x7f\x2a\x7f\xcc\xe2\x7f\x6c\xfe\x98\xc5\xff\xb8\xfc\x31\x8b\xff\xf1\xf9"
"\x63\x16\xff\x4f\xe7\x8f\x59\xfc\x3f\x93\x3f\x66\xf1\x3f\x21\x7f\xcc\xe2"
"\x7f\x62\xfe\x98\xc5\xff\xa4\xfc\x31\x8b\xff\xc9\xf9\x63\x16\xff\x53\xf2"
"\xc7\x2c\xfe\x9f\xcd\x1f\xb3\xf8\x7f\x2e\x7f\xcc\xe2\xff\xf9\xfc\x31\x8b"
"\xff\x17\xf2\xc7\x2c\xfe\xa7\xe6\x8f\x59\xfc\xbf\x98\x3f\x66\xf1\xff\x52"
"\xfe\x98\xc5\xff\xcb\xf9\x63\x16\xff\xaf\xe4\x8f\x59\xfc\x4f\xcb\x1f\xb3"
"\xf8\x9f\x9e\x3f\x66\xf1\x3f\x23\x7f\xcc\xe2\x7f\x66\xfe\x98\xc5\xff\xac"
"\xfc\x31\x8b\xff\xd9\xf9\x63\x16\xff\xaf\xe6\x8f\x59\xfc\xbf\x96\x3f\x66"
"\xf1\x3f\x27\x7f\xcc\xe2\xff\xf5\xfc\x31\x8b\xff\xb9\xf9\x63\x16\xff\xf3"
"\xf2\xc7\x2c\xfe\xe7\xe7\x8f\x59\xfc\x2f\xc8\x1f\xb3\xf8\x5f\x98\x3f\x66"
"\xf1\xff\x46\xfe\x98\xc5\xff\x9b\xf9\x63\x16\xff\x6f\xe5\x8f\x59\xfc\x2f"
"\xca\x1f\xb3\xf8\x5f\x9c\x3f\x66\xf1\xff\x76\xfe\x98\xc5\xff\x92\xfc\x31"
"\x8b\xff\x77\xf2\xc7\x2c\xfe\x97\xe6\x8f\x59\xfc\x2f\xcb\x1f\xb3\xf8\x5f"
"\x9e\x3f\x66\xf1\xff\x6e\xfe\x98\xc5\xff\x7b\xf9\x63\x16\xff\x2b\xf2\xc7"
"\x2c\xfe\x57\xe6\x8f\x59\xfc\xbf\x9f\x3f\x66\xf1\xbf\x2a\x7f\xcc\xe2\xff"
"\x83\xfc\x31\x8b\xff\xd5\xf9\x63\x16\xff\x1f\xe6\x8f\x59\xfc\xaf\xc9\x1f"
"\xb3\xf8\xff\x28\x7f\xcc\xe2\x7f\x6d\xfe\x98\xc5\xff\xba\xfc\x31\x8b\xff"
"\x8f\xf3\xc7\x2c\xfe\x3f\xc9\x1f\xb3\xf8\xff\x34\x7f\xcc\xe2\x7f\x7d\xfe"
"\x98\xc5\xff\x67\xf9\x63\x16\xff\x1b\xf2\xc7\x2c\xfe\x37\xe6\x8f\x59\xfc"
"\x7f\x9e\x3f\x66\xf1\xbf\x29\x7f\xcc\xe2\x7f\x73\xfe\x98\xc5\xff\x17\xf9"
"\x63\x16\xff\x5b\xf2\xc7\x2c\xfe\xb7\xe6\x8f\x59\xfc\x6f\xcb\x1f\xb3\xf8"
"\xdf\x9e\x3f\x66\xf1\xff\x65\xfe\x98\xc5\xff\x8e\xfc\x31\x8b\xff\xaf\xf2"
"\xc7\x2c\xfe\xbf\xce\x1f\xb3\xf8\xff\x26\x7f\xcc\xe2\xff\xdb\xfc\x31\x8b"
"\xff\xef\xf2\xc7\x2c\xfe\xbf\xcf\x1f\xb3\xf8\xdf\x99\x3f\x66\xf1\xff\x43"
"\xfe\x98\xc5\xff\x8f\xf9\x63\x16\xff\x3f\xe5\x8f\x59\xfc\xef\xca\x1f\xb3"
"\xf8\xdf\x9d\x3f\x66\xf1\xff\x73\xfe\x98\xc5\xff\x9e\xfc\x31\x8b\xff\x5f"
"\xf2\xc7\x2c\xfe\xf7\xe6\x8f\x59\xfc\xef\xcb\x1f\xb3\xf8\xff\x35\x7f\xcc"
"\xe2\xff\xb7\xfc\x31\x8b\xff\xfd\xf9\x63\x16\xff\x07\xf2\xc7\x2c\xfe\x0f"
"\xe6\x8f\x59\xfc\x1f\xca\x1f\xb3\xf8\x3f\x9c\x3f\x66\xf1\x7f\x24\x7f\xcc"
"\xe2\xff\x68\xfe\x98\xc5\xff\xb1\xfc\x31\x8b\xff\xe3\xf9\x63\x16\xff\x27"
"\xf2\xc7\x2c\xfe\x4f\xe6\x8f\x59\xfc\x9f\xca\x1f\xb3\xf8\x3f\x9d\x3f\x66"
"\xf1\x7f\x26\x7f\xcc\xe2\xff\x6c\xfe\x98\xc5\xff\xb9\xfc\x31\x8b\xff\xf3"
"\xf9\x63\x16\xff\x17\xf2\xc7\x2c\xfe\x2f\xe6\x8f\x59\xfc\x5f\xca\x1f\xb3"
"\xf8\xbf\x9c\x3f\x66\xf1\x7f\x25\x7f\xcc\xe2\xff\x6a\xfe\x98\xc5\xff\xb5"
"\xfc\x31\x89\xff\x44\x03\xf9\x63\x16\xff\x41\xf9\x63\x16\xff\xf1\xf2\xc7"
"\x2c\xfe\x83\xf3\xc7\x2c\xfe\x43\xf2\xc7\x2c\xfe\x43\xf3\xc7\x2c\xfe\xc3"
"\xf2\xc7\x2c\xfe\xe3\xe7\x8f\x59\xfc\x27\xc8\x1f\xb3\xf8\x4f\x98\x3f\x66"
"\xf1\x9f\x28\x7f\xcc\xe2\x3f\x71\xfe\x98\xc5\x7f\x92\xfc\x31\x8b\xff\xa4"
"\xf9\x63\x16\xff\xe1\xf9\x63\x16\xff\xc9\xf2\xc7\x2c\xfe\x93\xe7\x8f\x59"
"\xfc\xa7\xc8\x1f\xb3\xf8\x4f\x99\x3f\x66\xf1\x9f\x2a\x7f\xcc\xe2\x3f\x75"
"\xfe\x98\xc5\x7f\x9a\xfc\x31\x8b\xff\x3b\xf2\xc7\x2c\xfe\xef\xcc\x1f\xb3"
"\xf8\x4f\x9b\x3f\x66\xf1\x9f\x2e\x7f\xcc\xe2\x3f\x7d\xfe\x98\xc5\xff\x5d"
"\xf9\x63\x16\xff\x19\xf2\xc7\x2c\xfe\x23\xf2\xc7\x2c\xfe\xef\xce\x1f\xb3"
"\xf8\xcf\x98\x3f\x66\xf1\x9f\x29\x7f\xcc\xe2\xff\x9e\xfc\x31\x8b\xff\xcc"
"\xf9\x63\x16\xff\x59\xf2\xc7\x2c\xfe\xb3\xe6\x8f\x59\xfc\x67\xcb\x1f\xb3"
"\xf8\xbf\x37\x7f\xcc\xe2\x3f\x7b\xfe\x98\xc5\x7f\x8e\xfc\x31\x8b\xff\x9c"
"\xf9\x63\x16\xff\xb9\xf2\xc7\x2c\xfe\x73\xe7\x8f\x59\xfc\xe7\xc9\x1f\xb3"
"\xf8\xcf\x9b\x3f\x66\xf1\x9f\x2f\x7f\xcc\xe2\x3f\x7f\xfe\x98\xc5\x7f\x81"
"\xfc\x31\x8b\xff\x82\xf9\x63\x16\xff\x85\xf2\xc7\x2c\xfe\x0b\xe7\x8f\x59"
"\xfc\x17\xc9\x1f\xb3\xf8\x2f\x9a\x3f\x66\xf1\x5f\x2c\x7f\xcc\xe2\xbf\x78"
"\xfe\x98\xc5\x7f\x89\xfc\x31\x8b\xff\x92\xf9\x63\x16\xff\xa5\xf2\xc7\x2c"
"\xfe\x4b\xe7\x8f\x59\xfc\x97\xc9\x1f\xb3\xf8\xbf\x2f\x7f\xcc\xe2\xff\xfe"
"\xfc\x31\x8b\xff\x07\xf2\xc7\x2c\xfe\xcb\xe6\x8f\x59\xfc\x97\xcb\x1f\xb3"
"\xf8\x2f\x9f\x3f\x66\xf1\x5f\x21\x7f\xcc\xe2\xbf\x62\xfe\x98\xc5\x7f\xa5"
"\xfc\x31\x8b\xff\xca\xf9\x63\x16\xff\x55\xf2\xc7\x2c\xfe\xab\xe6\x8f\x59"
"\xfc\x57\xcb\x1f\xb3\xf8\xaf\x9e\x3f\x66\xf1\x5f\x23\x7f\xcc\xe2\xbf\x66"
"\xfe\x98\xc5\x7f\xad\xfc\x31\x8b\xff\xda\xf9\x63\x16\xff\x75\xf2\xc7\x2c"
"\xfe\xeb\xe6\x8f\x59\xfc\xd7\xcb\x1f\xb3\xf8\xaf\x9f\x3f\x66\xf1\xdf\x20"
"\x7f\xcc\xe2\xbf\x61\xfe\x98\xc5\x7f\xa3\xfc\x31\x8b\xff\xc6\xf9\x63\x16"
"\xff\x4d\xf2\xc7\x2c\xfe\x9b\xe6\x8f\x59\xfc\x37\xcb\x1f\xb3\xf8\x6f\x9e"
"\x3f\x66\xf1\xdf\x22\x7f\xcc\xe2\xbf\x65\xfe\x98\xc5\x7f\xab\xfc\x31\x8b"
"\xff\xd6\xf9\x63\x16\xff\x0f\xe6\x8f\x59\xfc\xb7\xc9\x1f\xb3\xf8\x6f\x9b"
"\x3f\x66\xf1\xdf\x2e\x7f\xcc\xe2\xbf\x7d\xfe\x98\xc5\x7f\x87\xfc\x31\x8b"
"\xff\x8e\xf9\x63\x16\xff\x9d\xf2\xc7\x2c\xfe\x3b\xe7\x8f\x59\xfc\x77\xc9"
"\x1f\xb3\xf8\xef\x9a\x3f\x66\xf1\xdf\x2d\x7f\xcc\xe2\xff\xa1\xfc\x31\x8b"
"\xff\xee\xf9\x63\x16\xff\x3d\xf2\xc7\x2c\xfe\x7b\xe6\x8f\x59\xfc\xf7\xca"
"\x1f\xb3\xf8\xef\x9d\x3f\x66\xf1\xff\x70\xfe\x98\xc5\x7f\x9f\xfc\x31\x8b"
"\xff\xbe\xf9\x63\x16\xff\xfd\xf2\xc7\x2c\xfe\x1f\xc9\x1f\xb3\xf8\x7f\x34"
"\x7f\xcc\xe2\xff\xb1\xfc\x31\x8b\xff\xfe\xf9\x63\x16\xff\x03\xf2\xc7\x2c"
"\xfe\x07\xe6\x8f\x59\xfc\x0f\xca\x1f\xb3\xf8\x1f\x9c\x3f\x66\xf1\x3f\x24"
"\x7f\xcc\xe2\x7f\x68\xfe\x98\xc5\xff\xb0\xfc\x31\x8b\xff\xe1\xf9\x63\x16"
"\xff\x23\xf2\xc7\x2c\xfe\x47\xe6\x8f\x59\xfc\x8f\xca\x1f\xb3\xf8\x7f\x3c"
"\x7f\xcc\xe2\x7f\x74\xfe\x98\xc5\xff\x13\xf9\x63\x16\xff\x4f\xe6\x8f\x59"
"\xfc\x8f\xc9\x1f\xb3\xf8\x7f\x2a\x7f\xcc\xe2\x7f\x6c\xfe\x98\xc5\xff\xb8"
"\xfc\x31\x8b\xff\xf1\xf9\x63\x16\xff\x4f\xe7\x8f\x59\xfc\x3f\x93\x3f\x66"
"\xf1\x3f\x21\x7f\xcc\xe2\x7f\x62\xfe\x98\xc5\xff\xa4\xfc\x31\x8b\xff\xc9"
"\xf9\x63\x16\xff\x53\xf2\xc7\x2c\xfe\x9f\xcd\x1f\xb3\xf8\x7f\x2e\x7f\xcc"
"\xe2\xff\xf9\xfc\x31\x8b\xff\x17\xf2\xc7\x2c\xfe\xa7\xe6\x8f\x59\xfc\xbf"
"\x98\x3f\x66\xf1\xff\x52\xfe\x98\xc5\xff\xcb\xf9\x63\x16\xff\xaf\xe4\x8f"
"\x59\xfc\x4f\xcb\x1f\xb3\xf8\x9f\x9e\x3f\x66\xf1\x3f\x23\x7f\xcc\xe2\x7f"
"\x66\xfe\x98\xc5\xff\xac\xfc\x31\x8b\xff\xd9\xf9\x63\x16\xff\xaf\xe6\x8f"
"\x59\xfc\xbf\x96\x3f\x66\xf1\x3f\x27\x7f\xcc\xe2\xff\xf5\xfc\x31\x8b\xff"
"\xb9\xf9\x63\x16\xff\xf3\xf2\xc7\x2c\xfe\xe7\xe7\x8f\x59\xfc\x2f\xc8\x1f"
"\xb3\xf8\x5f\x98\x3f\x66\xf1\xff\x46\xfe\x98\xc5\xff\x9b\xf9\x63\x16\xff"
"\x6f\xe5\x8f\x59\xfc\x2f\xca\x1f\xb3\xf8\x5f\x9c\x3f\x66\xf1\xff\x76\xfe"
"\x98\xc5\xff\x92\xfc\x31\x8b\xff\x77\xf2\xc7\x2c\xfe\x97\xe6\x8f\x59\xfc"
"\x2f\xcb\x1f\xb3\xf8\x5f\x9e\x3f\x66\xf1\xff\x6e\xfe\x98\xc5\xff\x7b\xf9"
"\x63\x16\xff\x2b\xf2\xc7\x2c\xfe\x57\xe6\x8f\x59\xfc\xbf\x9f\x3f\x66\xf1"
"\xbf\x2a\x7f\xcc\xe2\xff\x83\xfc\x31\x8b\xff\xd5\xf9\x63\x16\xff\x1f\xe6"
"\x8f\x59\xfc\xaf\xc9\x1f\xb3\xf8\xff\x28\x7f\xcc\xe2\x7f\x6d\xfe\x98\xc5"
"\xff\xba\xfc\x31\x8b\xff\x8f\xf3\xc7\x2c\xfe\x3f\xc9\x1f\xb3\xf8\xff\x34"
"\x7f\xcc\xe2\x7f\x7d\xfe\x98\xc5\xff\x67\xf9\x63\x16\xff\x1b\xf2\xc7\x2c"
"\xfe\x37\xe6\x8f\x59\xfc\x7f\x9e\x3f\x66\xf1\xbf\x29\x7f\xcc\xe2\x7f\x73"
"\xfe\x98\xc5\xff\x17\xf9\x63\x16\xff\x5b\xf2\xc7\x2c\xfe\xb7\xe6\x8f\x59"
"\xfc\x6f\xcb\x1f\xb3\xf8\xdf\x9e\x3f\x66\xf1\xff\x65\xfe\x98\xc5\xff\x8e"
"\xfc\x31\x8b\xff\xaf\xf2\xc7\x2c\xfe\xbf\xce\x1f\xb3\xf8\xff\x26\x7f\xcc"
"\xe2\xff\xdb\xfc\x31\x8b\xff\xef\xf2\xc7\x2c\xfe\xbf\xcf\x1f\xb3\xf8\xdf"
"\x99\x3f\x66\xf1\xff\x43\xfe\x98\xc5\xff\x8f\xf9\x63\x16\xff\x3f\xe5\x8f"
"\x59\xfc\xef\xca\x1f\xb3\xf8\xdf\x9d\x3f\x66\xf1\xff\x73\xfe\x98\xc5\xff"
"\x9e\xfc\x31\x8b\xff\x5f\xf2\xc7\x2c\xfe\xf7\xe6\x8f\x59\xfc\xef\xcb\x1f"
"\xb3\xf8\xff\x35\x7f\xcc\xe2\xff\xb7\xfc\x31\x8b\xff\xfd\xf9\x63\x16\xff"
"\x07\xf2\xc7\x2c\xfe\x0f\xe6\x8f\x59\xfc\x1f\xca\x1f\xb3\xf8\x3f\x9c\x3f"
"\x66\xf1\x7f\x24\x7f\xcc\xe2\xff\x68\xfe\x98\xc5\xff\xb1\xfc\x31\x8b\xff"
"\xe3\xf9\x63\x16\xff\x27\xf2\xc7\x2c\xfe\x4f\xe6\x8f\x59\xfc\x9f\xca\x1f"
"\xb3\xf8\x3f\x9d\x3f\x66\xf1\x7f\x26\x7f\xcc\xe2\xff\x6c\xfe\x98\xc5\xff"
"\xb9\xfc\x31\x8b\xff\xf3\xf9\x63\x16\xff\x17\xf2\xc7\x2c\xfe\x2f\xe6\x8f"
"\x59\xfc\x5f\xca\x1f\xb3\xf8\xbf\x9c\x3f\x66\xf1\x7f\x25\x7f\xcc\xe2\xff"
"\x6a\xfe\x98\xc5\xff\xb5\xfc\x31\x89\xff\xc4\x03\xf9\x63\x16\xff\x41\xf9"
"\x63\x16\xff\xf1\xf2\xc7\x2c\xfe\x83\xf3\xc7\x2c\xfe\x43\xf2\xc7\x2c\xfe"
"\x43\xf3\xc7\x2c\xfe\xc3\xf2\xc7\x2c\xfe\xe3\xe7\x8f\x59\xfc\x27\xc8\x1f"
"\xb3\xf8\x4f\x98\x3f\x66\xf1\x9f\x28\x7f\xcc\xe2\x3f\x71\xfe\x98\xc5\x7f"
"\x92\xfc\x31\x8b\xff\xa4\xf9\x63\x16\xff\xe1\xf9\x63\x16\xff\xc9\xf2\xc7"
"\x2c\xfe\x93\xe7\x8f\x59\xfc\xa7\xc8\x1f\xb3\xf8\x4f\x99\x3f\x66\xf1\x9f"
"\x2a\x7f\xcc\xe2\x3f\x75\xfe\x98\xc5\x7f\x9a\xfc\x31\x8b\xff\x3b\xf2\xc7"
"\x2c\xfe\xef\xcc\x1f\xb3\xf8\x4f\x9b\x3f\x66\xf1\x9f\x2e\x7f\xcc\xe2\x3f"
"\x7d\xfe\x98\xc5\xff\x5d\xf9\x63\x16\xff\x19\xf2\xc7\x2c\xfe\x23\xf2\xc7"
"\x2c\xfe\xef\xce\x1f\xb3\xf8\xcf\x98\x3f\x66\xf1\x9f\x29\x7f\xcc\xe2\xff"
"\x9e\xfc\x31\x8b\xff\xcc\xf9\x63\x16\xff\x59\xf2\xc7\x2c\xfe\xb3\xe6\x8f"
"\x59\xfc\x67\xcb\x1f\xb3\xf8\xbf\x37\x7f\xcc\xe2\x3f\x7b\xfe\x98\xc5\x7f"
"\x8e\xfc\x31\x8b\xff\x9c\xf9\x63\x16\xff\xb9\xf2\xc7\x2c\xfe\x73\xe7\x8f"
"\x59\xfc\xe7\xc9\x1f\xb3\xf8\xcf\x9b\x3f\x66\xf1\x9f\x2f\x7f\xcc\xe2\x3f"
"\x7f\xfe\x98\xc5\x7f\x81\xfc\x31\x8b\xff\x82\xf9\x63\x16\xff\x85\xf2\xc7"
"\x2c\xfe\x0b\xe7\x8f\x59\xfc\x17\xc9\x1f\xb3\xf8\x2f\x9a\x3f\x66\xf1\x5f"
"\x2c\x7f\xcc\xe2\xbf\x78\xfe\x98\xc5\x7f\x89\xfc\x31\x8b\xff\x92\xf9\x63"
"\x16\xff\xa5\xf2\xc7\x2c\xfe\x4b\xe7\x8f\x59\xfc\x97\xc9\x1f\xb3\xf8\xbf"
"\x2f\x7f\xcc\xe2\xff\xfe\xfc\x31\x8b\xff\x07\xf2\xc7\x2c\xfe\xcb\xe6\x8f"
"\x59\xfc\x97\xcb\x1f\xb3\xf8\x2f\x9f\x3f\x66\xf1\x5f\x21\x7f\xcc\xe2\xbf"
"\x62\xfe\x98\xc5\x7f\xa5\xfc\x31\x8b\xff\xca\xf9\x63\x16\xff\x55\xf2\xc7"
"\x2c\xfe\xab\xe6\x8f\x59\xfc\x57\xcb\x1f\xb3\xf8\xaf\x9e\x3f\x66\xf1\x5f"
"\x23\x7f\xcc\xe2\xbf\x66\xfe\x98\xc5\x7f\xad\xfc\x31\x8b\xff\xda\xf9\x63"
"\x16\xff\x75\xf2\xc7\x2c\xfe\xeb\xe6\x8f\x59\xfc\xd7\xcb\x1f\xb3\xf8\xaf"
"\x9f\x3f\x66\xf1\xdf\x20\x7f\xcc\xe2\xbf\x61\xfe\x98\xc5\x7f\xa3\xfc\x31"
"\x8b\xff\xc6\xf9\x63\x16\xff\x4d\xf2\xc7\x2c\xfe\x9b\xe6\x8f\x59\xfc\x37"
"\xcb\x1f\xb3\xf8\x6f\x9e\x3f\x66\xf1\xdf\x22\x7f\xcc\xe2\xbf\x65\xfe\x98"
"\xc5\x7f\xab\xfc\x31\x8b\xff\xd6\xf9\x63\x16\xff\x0f\xe6\x8f\x59\xfc\xb7"
"\xc9\x1f\xb3\xf8\x6f\x9b\x3f\x66\xf1\xdf\x2e\x7f\xcc\xe2\xbf\x7d\xfe\x98"
"\xc5\x7f\x87\xfc\x31\x8b\xff\x8e\xf9\x63\x16\xff\x9d\xf2\xc7\x2c\xfe\x3b"
"\xe7\x8f\x59\xfc\x77\xc9\x1f\xb3\xf8\xef\x9a\x3f\x66\xf1\xdf\x2d\x7f\xcc"
"\xe2\xff\xa1\xfc\x31\x8b\xff\xee\xf9\x63\x16\xff\x3d\xf2\xc7\x2c\xfe\x7b"
"\xe6\x8f\x59\xfc\xf7\xca\x1f\xb3\xf8\xef\x9d\x3f\x66\xf1\xff\x70\xfe\x98"
"\xc5\x7f\x9f\xfc\x31\x8b\xff\xbe\xf9\x63\x16\xff\xfd\xf2\xc7\x2c\xfe\x1f"
"\xc9\x1f\xb3\xf8\x7f\x34\x7f\xcc\xe2\xff\xb1\xfc\x31\x8b\xff\xfe\xf9\x63"
"\x16\xff\x03\xf2\xc7\x2c\xfe\x07\xe6\x8f\x59\xfc\x0f\xca\x1f\xb3\xf8\x1f"
"\x9c\x3f\x66\xf1\x3f\x24\x7f\xcc\xe2\x7f\x68\xfe\x98\xc5\xff\xb0\xfc\x31"
"\x8b\xff\xe1\xf9\x63\x16\xff\x23\xf2\xc7\x2c\xfe\x47\xe6\x8f\x59\xfc\x8f"
"\xca\x1f\xb3\xf8\x7f\x3c\x7f\xcc\xe2\x7f\x74\xfe\x98\xc5\xff\x13\xf9\x63"
"\x16\xff\x4f\xe6\x8f\x59\xfc\x8f\xc9\x1f\xb3\xf8\x7f\x2a\x7f\xcc\xe2\x7f"
"\x6c\xfe\x98\xc5\xff\xb8\xfc\x31\x8b\xff\xf1\xf9\x63\x16\xff\x4f\xe7\x8f"
"\x59\xfc\x3f\x93\x3f\x66\xf1\x3f\x21\x7f\xcc\xe2\x7f\x62\xfe\x98\xc5\xff"
"\xa4\xfc\x31\x8b\xff\xc9\xf9\x63\x16\xff\x53\xf2\xc7\x2c\xfe\x9f\xcd\x1f"
"\xb3\xf8\x7f\x2e\x7f\xcc\xe2\xff\xf9\xfc\x31\x8b\xff\x17\xf2\xc7\x2c\xfe"
"\xa7\xe6\x8f\x59\xfc\xbf\x98\x3f\x66\xf1\xff\x52\xfe\x98\xc5\xff\xcb\xf9"
"\x63\x16\xff\xaf\xe4\x8f\x59\xfc\x4f\xcb\x1f\xb3\xf8\x9f\x9e\x3f\x66\xf1"
"\x3f\x23\x7f\xcc\xe2\x7f\x66\xfe\x98\xc5\xff\xac\xfc\x31\x8b\xff\xd9\xf9"
"\x63\x16\xff\xaf\xe6\x8f\x59\xfc\xbf\x96\x3f\x66\xf1\x3f\x27\x7f\xcc\xe2"
"\xff\xf5\xfc\x31\x8b\xff\xb9\xf9\x63\x16\xff\xf3\xf2\xc7\x2c\xfe\xe7\xe7"
"\x8f\x59\xfc\x2f\xc8\x1f\xb3\xf8\x5f\x98\x3f\x66\xf1\xff\x46\xfe\x98\xc5"
"\xff\x9b\xf9\x63\x16\xff\x6f\xe5\x8f\x59\xfc\x2f\xca\x1f\xb3\xf8\x5f\x9c"
"\x3f\x66\xf1\xff\x76\xfe\x98\xc5\xff\x92\xfc\x31\x8b\xff\x77\xf2\xc7\x2c"
"\xfe\x97\xe6\x8f\x59\xfc\x2f\xcb\x1f\xb3\xf8\x5f\x9e\x3f\x66\xf1\xff\x6e"
"\xfe\x98\xc5\xff\x7b\xf9\x63\x16\xff\x2b\xf2\xc7\x2c\xfe\x57\xe6\x8f\x59"
"\xfc\xbf\x9f\x3f\x66\xf1\xbf\x2a\x7f\xcc\xe2\xff\x83\xfc\x31\x8b\xff\xd5"
"\xf9\x63\x16\xff\x1f\xe6\x8f\x59\xfc\xaf\xc9\x1f\xb3\xf8\xff\x28\x7f\xcc"
"\xe2\x7f\x6d\xfe\x98\xc5\xff\xba\xfc\x31\x8b\xff\x8f\xf3\xc7\x2c\xfe\x3f"
"\xc9\x1f\xb3\xf8\xff\x34\x7f\xcc\xe2\x7f\x7d\xfe\x98\xc5\xff\x67\xf9\x63"
"\x16\xff\x1b\xf2\xc7\x2c\xfe\x37\xe6\x8f\x59\xfc\x7f\x9e\x3f\x66\xf1\xbf"
"\x29\x7f\xcc\xe2\x7f\x73\xfe\x98\xc5\xff\x17\xf9\x63\x16\xff\x5b\xf2\xc7"
"\x2c\xfe\xb7\xe6\x8f\x59\xfc\x6f\xcb\x1f\xb3\xf8\xdf\x9e\x3f\x66\xf1\xff"
"\x65\xfe\x98\xc5\xff\x8e\xfc\x31\x8b\xff\xaf\xf2\xc7\x2c\xfe\xbf\xce\x1f"
"\xb3\xf8\xff\x26\x7f\xcc\xe2\xff\xdb\xfc\x31\x8b\xff\xef\xf2\xc7\x2c\xfe"
"\xbf\xcf\x1f\xb3\xf8\xdf\x99\x3f\x66\xf1\xff\x43\xfe\x98\xc5\xff\x8f\xf9"
"\x63\x16\xff\x3f\xe5\x8f\x59\xfc\xef\xca\x1f\xb3\xf8\xdf\x9d\x3f\x66\xf1"
"\xff\x73\xfe\x98\xc5\xff\x9e\xfc\x31\x8b\xff\x5f\xf2\xc7\x2c\xfe\xf7\xe6"
"\x8f\x59\xfc\xef\xcb\x1f\xb3\xf8\xff\x35\x7f\xcc\xe2\xff\xb7\xfc\x31\x8b"
"\xff\xfd\xf9\x63\x16\xff\x07\xf2\xc7\x2c\xfe\x0f\xe6\x8f\x59\xfc\x1f\xca"
"\x1f\xb3\xf8\x3f\x9c\x3f\x66\xf1\x7f\x24\x7f\xcc\xe2\xff\x68\xfe\x98\xc5"
"\xff\xb1\xfc\x31\x8b\xff\xe3\xf9\x63\x16\xff\x27\xf2\xc7\x2c\xfe\x4f\xe6"
"\x8f\x59\xfc\x9f\xca\x1f\xb3\xf8\x3f\x9d\x3f\x66\xf1\x7f\x26\x7f\xcc\xe2"
"\xff\x6c\xfe\x98\xc5\xff\xb9\xfc\x31\x8b\xff\xf3\xf9\x63\x16\xff\x17\xf2"
"\xc7\x2c\xfe\x2f\xe6\x8f\x59\xfc\x5f\xca\x1f\xb3\xf8\xbf\x9c\x3f\x66\xf1"
"\x7f\x25\x7f\xcc\xe2\xff\x6a\xfe\x98\xc5\xff\xb5\xfc\x31\x89\xff\x24\x03"
"\xf9\x63\x16\xff\x41\xf9\x63\x16\xff\xf1\xf2\xc7\x2c\xfe\x83\xf3\xc7\x2c"
"\xfe\x43\xf2\xc7\x2c\xfe\x43\xf3\xc7\x2c\xfe\xc3\xf2\xc7\x2c\xfe\xe3\xe7"
"\x8f\x59\xfc\x27\xc8\x1f\xb3\xf8\x4f\x98\x3f\x66\xf1\x9f\x28\x7f\xcc\xe2"
"\x3f\x71\xfe\x98\xc5\x7f\x92\xfc\x31\x8b\xff\xa4\xf9\x63\x16\xff\xe1\xf9"
"\x63\x16\xff\xc9\xf2\xc7\x2c\xfe\x93\xe7\x8f\x59\xfc\xa7\xc8\x1f\xb3\xf8"
"\x4f\x99\x3f\x66\xf1\x9f\x2a\x7f\xcc\xe2\x3f\x75\xfe\x98\xc5\x7f\x9a\xfc"
"\x31\x8b\xff\x3b\xf2\xc7\x2c\xfe\xef\xcc\x1f\xb3\xf8\x4f\x9b\x3f\x66\xf1"
"\x9f\x2e\x7f\xcc\xe2\x3f\x7d\xfe\x98\xc5\xff\x5d\xf9\x63\x16\xff\x19\xf2"
"\xc7\x2c\xfe\x23\xf2\xc7\x2c\xfe\xef\xce\x1f\xb3\xf8\xcf\x98\x3f\x66\xf1"
"\x9f\x29\x7f\xcc\xe2\xff\x9e\xfc\x31\x8b\xff\xcc\xf9\x63\x16\xff\x59\xf2"
"\xc7\x2c\xfe\xb3\xe6\x8f\x59\xfc\x67\xcb\x1f\xb3\xf8\xbf\x37\x7f\xcc\xe2"
"\x3f\x7b\xfe\x98\xc5\x7f\x8e\xfc\x31\x8b\xff\x9c\xf9\x63\x16\xff\xb9\xf2"
"\xc7\x2c\xfe\x73\xe7\x8f\x59\xfc\xe7\xc9\x1f\xb3\xf8\xcf\x9b\x3f\x66\xf1"
"\x9f\x2f\x7f\xcc\xe2\x3f\x7f\xfe\x98\xc5\x7f\x81\xfc\x31\x8b\xff\x82\xf9"
"\x63\x16\xff\x85\xf2\xc7\x2c\xfe\x0b\xe7\x8f\x59\xfc\x17\xc9\x1f\xb3\xf8"
"\x2f\x9a\x3f\x66\xf1\x5f\x2c\x7f\xcc\xe2\xbf\x78\xfe\x98\xc5\x7f\x89\xfc"
"\x31\x8b\xff\x92\xf9\x63\x16\xff\xa5\xf2\xc7\x2c\xfe\x4b\xe7\x8f\x59\xfc"
"\x97\xc9\x1f\xb3\xf8\xbf\x2f\x7f\xcc\xe2\xff\xfe\xfc\x31\x8b\xff\x07\xf2"
"\xc7\x2c\xfe\xcb\xe6\x8f\x59\xfc\x97\xcb\x1f\xb3\xf8\x2f\x9f\x3f\x66\xf1"
"\x5f\x21\x7f\xcc\xe2\xbf\x62\xfe\x98\xc5\x7f\xa5\xfc\x31\x8b\xff\xca\xf9"
"\x63\x16\xff\x55\xf2\xc7\x2c\xfe\xab\xe6\x8f\x59\xfc\x57\xcb\x1f\xb3\xf8"
"\xaf\x9e\x3f\x66\xf1\x5f\x23\x7f\xcc\xe2\xbf\x66\xfe\x98\xc5\x7f\xad\xfc"
"\x31\x8b\xff\xda\xf9\x63\x16\xff\x75\xf2\xc7\x2c\xfe\xeb\xe6\x8f\x59\xfc"
"\xd7\xcb\x1f\xb3\xf8\xaf\x9f\x3f\x66\xf1\xdf\x20\x7f\xcc\xe2\xbf\x61\xfe"
"\x98\xc5\x7f\xa3\xfc\x31\x8b\xff\xc6\xf9\x63\x16\xff\x4d\xf2\xc7\x2c\xfe"
"\x9b\xe6\x8f\x59\xfc\x37\xcb\x1f\xb3\xf8\x6f\x9e\x3f\x66\xf1\xdf\x22\x7f"
"\xcc\xe2\xbf\x65\xfe\x98\xc5\x7f\xab\xfc\x31\x8b\xff\xd6\xf9\x63\x16\xff"
"\x0f\xe6\x8f\x59\xfc\xb7\xc9\x1f\xb3\xf8\x6f\x9b\x3f\x66\xf1\xdf\x2e\x7f"
"\xcc\xe2\xbf\x7d\xfe\x98\xc5\x7f\x87\xfc\x31\x8b\xff\x8e\xf9\x63\x16\xff"
"\x9d\xf2\xc7\x2c\xfe\x3b\xe7\x8f\x59\xfc\x77\xc9\x1f\xb3\xf8\xef\x9a\x3f"
"\x66\xf1\xdf\x2d\x7f\xcc\xe2\xff\xa1\xfc\x31\x8b\xff\xee\xf9\x63\x16\xff"
"\x3d\xf2\xc7\x2c\xfe\x7b\xe6\x8f\x59\xfc\xf7\xca\x1f\xb3\xf8\xef\x9d\x3f"
"\x66\xf1\xff\x70\xfe\x98\xc5\x7f\x9f\xfc\x31\x8b\xff\xbe\xf9\x63\x16\xff"
"\xfd\xf2\xc7\x2c\xfe\x1f\xc9\x1f\xb3\xf8\x7f\x34\x7f\xcc\xe2\xff\xb1\xfc"
"\x31\x8b\xff\xfe\xf9\x63\x16\xff\x03\xf2\xc7\x2c\xfe\x07\xe6\x8f\x59\xfc"
"\x0f\xca\x1f\xb3\xf8\x1f\x9c\x3f\x66\xf1\x3f\x24\x7f\xcc\xe2\x7f\x68\xfe"
"\x98\xc5\xff\xb0\xfc\x31\x8b\xff\xe1\xf9\x63\x16\xff\x23\xf2\xc7\x2c\xfe"
"\x47\xe6\x8f\x59\xfc\x8f\xca\x1f\xb3\xf8\x7f\x3c\x7f\xcc\xe2\x7f\x74\xfe"
"\x98\xc5\xff\x13\xf9\x63\x16\xff\x4f\xe6\x8f\x59\xfc\x8f\xc9\x1f\xb3\xf8"
"\x7f\x2a\x7f\xcc\xe2\x7f\x6c\xfe\x98\xc5\xff\xb8\xfc\x31\x8b\xff\xf1\xf9"
"\x63\x16\xff\x4f\xe7\x8f\x59\xfc\x3f\x93\x3f\x66\xf1\x3f\x21\x7f\xcc\xe2"
"\x7f\x62\xfe\x98\xc5\xff\xa4\xfc\x31\x8b\xff\xc9\xf9\x63\x16\xff\x53\xf2"
"\xc7\x2c\xfe\x9f\xcd\x1f\xb3\xf8\x7f\x2e\x7f\xcc\xe2\xff\xf9\xfc\x31\x8b"
"\xff\x17\xf2\xc7\x2c\xfe\xa7\xe6\x8f\x59\xfc\xbf\x98\x3f\x66\xf1\xff\x52"
"\xfe\x98\xc5\xff\xcb\xf9\x63\x16\xff\xaf\xe4\x8f\x59\xfc\x4f\xcb\x1f\xb3"
"\xf8\x9f\x9e\x3f\x66\xf1\x3f\x23\x7f\xcc\xe2\x7f\x66\xfe\x98\xc5\xff\xac"
"\xfc\x31\x8b\xff\xd9\xf9\x63\x16\xff\xaf\xe6\x8f\x59\xfc\xbf\x96\x3f\x66"
"\xf1\x3f\x27\x7f\xcc\xe2\xff\xf5\xfc\x31\x8b\xff\xb9\xf9\x63\x16\xff\xf3"
"\xf2\xc7\x2c\xfe\xe7\xe7\x8f\x59\xfc\x2f\xc8\x1f\xb3\xf8\x5f\x98\x3f\x66"
"\xf1\xff\x46\xfe\x98\xc5\xff\x9b\xf9\x63\x16\xff\x6f\xe5\x8f\x59\xfc\x2f"
"\xca\x1f\xb3\xf8\x5f\x9c\x3f\x66\xf1\xff\x76\xfe\x98\xc5\xff\x92\xfc\x31"
"\x8b\xff\x77\xf2\xc7\x2c\xfe\x97\xe6\x8f\x59\xfc\x2f\xcb\x1f\xb3\xf8\x5f"
"\x9e\x3f\x66\xf1\xff\x6e\xfe\x98\xc5\xff\x7b\xf9\x63\x16\xff\x2b\xf2\xc7"
"\x2c\xfe\x57\xe6\x8f\x59\xfc\xbf\x9f\x3f\x66\xf1\xbf\x2a\x7f\xcc\xe2\xff"
"\x83\xfc\x31\x8b\xff\xd5\xf9\x63\x16\xff\x1f\xe6\x8f\x59\xfc\xaf\xc9\x1f"
"\xb3\xf8\xff\x28\x7f\xcc\xe2\x7f\x6d\xfe\x98\xc5\xff\xba\xfc\x31\x8b\xff"
"\x8f\xf3\xc7\x2c\xfe\x3f\xc9\x1f\xb3\xf8\xff\x34\x7f\xcc\xe2\x7f\x7d\xfe"
"\x98\xc5\xff\x67\xf9\x63\x16\xff\x1b\xf2\xc7\x2c\xfe\x37\xe6\x8f\x59\xfc"
"\x7f\x9e\x3f\x66\xf1\xbf\x29\x7f\xcc\xe2\x7f\x73\xfe\x98\xc5\xff\x17\xf9"
"\x63\x16\xff\x5b\xf2\xc7\x2c\xfe\xb7\xe6\x8f\x59\xfc\x6f\xcb\x1f\xb3\xf8"
"\xdf\x9e\x3f\x66\xf1\xff\x65\xfe\x98\xc5\xff\x8e\xfc\x31\x8b\xff\xaf\xf2"
"\xc7\x2c\xfe\xbf\xce\x1f\xb3\xf8\xff\x26\x7f\xcc\xe2\xff\xdb\xfc\x31\x8b"
"\xff\xef\xf2\xc7\x2c\xfe\xbf\xcf\x1f\xb3\xf8\xdf\x99\x3f\x66\xf1\xff\x43"
"\xfe\x98\xc5\xff\x8f\xf9\x63\x16\xff\x3f\xe5\x8f\x59\xfc\xef\xca\x1f\xb3"
"\xf8\xdf\x9d\x3f\x66\xf1\xff\x73\xfe\x98\xc5\xff\x9e\xfc\x31\x8b\xff\x5f"
"\xf2\xc7\x2c\xfe\xf7\xe6\x8f\x59\xfc\xef\xcb\x1f\xb3\xf8\xff\x35\x7f\xcc"
"\xe2\xff\xb7\xfc\x31\x8b\xff\xfd\xf9\x63\x16\xff\x07\xf2\xc7\x2c\xfe\x0f"
"\xe6\x8f\x59\xfc\x1f\xca\x1f\xb3\xf8\x3f\x9c\x3f\x66\xf1\x7f\x24\x7f\xcc"
"\xe2\xff\x68\xfe\x98\xc5\xff\xb1\xfc\x31\x8b\xff\xe3\xf9\x63\x16\xff\x27"
"\xf2\xc7\x2c\xfe\x4f\xe6\x8f\x59\xfc\x9f\xca\x1f\xb3\xf8\x3f\x9d\x3f\x66"
"\xf1\x7f\x26\x7f\xcc\xe2\xff\x6c\xfe\x98\xc5\xff\xb9\xfc\x31\x8b\xff\xf3"
"\xf9\x63\x16\xff\x17\xf2\xc7\x2c\xfe\x2f\xe6\x8f\x59\xfc\x5f\xca\x1f\xb3"
"\xf8\xbf\x9c\x3f\x66\xf1\x7f\x25\x7f\xcc\xe2\xff\x6a\xfe\x98\xc5\xff\xb5"
"\xfc\x31\x89\xff\xa4\x03\xf9\x63\x16\xff\x41\xf9\x63\x16\xff\xf1\xf2\xc7"
"\x2c\xfe\x83\xf3\xc7\x2c\xfe\x43\xf2\xc7\x2c\xfe\x43\xf3\xc7\x2c\xfe\xc3"
"\xf2\xc7\x2c\xfe\xe3\xe7\x8f\x59\xfc\x27\xc8\x1f\xb3\xf8\x4f\x98\x3f\x66"
"\xf1\x9f\x28\x7f\xcc\xe2\x3f\x71\xfe\x98\xc5\x7f\x92\xfc\x31\x8b\xff\xa4"
"\xf9\x63\x16\xff\xe1\xf9\x63\x16\xff\xc9\xf2\xc7\x2c\xfe\x93\xe7\x8f\x59"
"\xfc\xa7\xc8\x1f\xb3\xf8\x4f\x99\x3f\x66\xf1\x9f\x2a\x7f\xcc\xe2\x3f\x75"
"\xfe\x98\xc5\x7f\x9a\xfc\x31\x8b\xff\x3b\xf2\xc7\x2c\xfe\xef\xcc\x1f\xb3"
"\xf8\x4f\x9b\x3f\x66\xf1\x9f\x2e\x7f\xcc\xe2\x3f\x7d\xfe\x98\xc5\xff\x5d"
"\xf9\x63\x16\xff\x19\xf2\xc7\x2c\xfe\x23\xf2\xc7\x2c\xfe\xef\xce\x1f\xb3"
"\xf8\xcf\x98\x3f\x66\xf1\x9f\x29\x7f\xcc\xe2\xff\x9e\xfc\x31\x8b\xff\xcc"
"\xf9\x63\x16\xff\x59\xf2\xc7\x2c\xfe\xb3\xe6\x8f\x59\xfc\x67\xcb\x1f\xb3"
"\xf8\xbf\x37\x7f\xcc\xe2\x3f\x7b\xfe\x98\xc5\x7f\x8e\xfc\x31\x8b\xff\x9c"
"\xf9\x63\x16\xff\xb9\xf2\xc7\x2c\xfe\x73\xe7\x8f\x59\xfc\xe7\xc9\x1f\xb3"
"\xf8\xcf\x9b\x3f\x66\xf1\x9f\x2f\x7f\xcc\xe2\x3f\x7f\xfe\x98\xc5\x7f\x81"
"\xfc\x31\x8b\xff\x82\xf9\x63\x16\xff\x85\xf2\xc7\x2c\xfe\x0b\xe7\x8f\x59"
"\xfc\x17\xc9\x1f\xb3\xf8\x2f\x9a\x3f\x66\xf1\x5f\x2c\x7f\xcc\xe2\xbf\x78"
"\xfe\x98\xc5\x7f\x89\xfc\x31\x8b\xff\x92\xf9\x63\x16\xff\xa5\xf2\xc7\x2c"
"\xfe\x4b\xe7\x8f\x59\xfc\x97\xc9\x1f\xb3\xf8\xbf\x2f\x7f\xcc\xe2\xff\xfe"
"\xfc\x31\x8b\xff\x07\xf2\xc7\x2c\xfe\xcb\xe6\x8f\x59\xfc\x97\xcb\x1f\xb3"
"\xf8\x2f\x9f\x3f\x66\xf1\x5f\x21\x7f\xcc\xe2\xbf\x62\xfe\x98\xc5\x7f\xa5"
"\xfc\x31\x8b\xff\xca\xf9\x63\x16\xff\x55\xf2\xc7\x2c\xfe\xab\xe6\x8f\x59"
"\xfc\x57\xcb\x1f\xb3\xf8\xaf\x9e\x3f\x66\xf1\x5f\x23\x7f\xcc\xe2\xbf\x66"
"\xfe\x98\xc5\x7f\xad\xfc\x31\x8b\xff\xda\xf9\x63\x16\xff\x75\xf2\xc7\x2c"
"\xfe\xeb\xe6\x8f\x59\xfc\xd7\xcb\x1f\xb3\xf8\xaf\x9f\x3f\x66\xf1\xdf\x20"
"\x7f\xcc\xe2\xbf\x61\xfe\x98\xc5\x7f\xa3\xfc\x31\x8b\xff\xc6\xf9\x63\x16"
"\xff\x4d\xf2\xc7\x2c\xfe\x9b\xe6\x8f\x59\xfc\x37\xcb\x1f\xb3\xf8\x6f\x9e"
"\x3f\x66\xf1\xdf\x22\x7f\xcc\xe2\xbf\x65\xfe\x98\xc5\x7f\xab\xfc\x31\x8b"
"\xff\xd6\xf9\x63\x16\xff\x0f\xe6\x8f\x59\xfc\xb7\xc9\x1f\xb3\xf8\x6f\x9b"
"\x3f\x66\xf1\xdf\x2e\x7f\xcc\xe2\xbf\x7d\xfe\x98\xc5\x7f\x87\xfc\x31\x8b"
"\xff\x8e\xf9\x63\x16\xff\x9d\xf2\xc7\x2c\xfe\x3b\xe7\x8f\x59\xfc\x77\xc9"
"\x1f\xb3\xf8\xef\x9a\x3f\x66\xf1\xdf\x2d\x7f\xcc\xe2\xff\xa1\xfc\x31\x8b"
"\xff\xee\xf9\x63\x16\xff\x3d\xf2\xc7\x2c\xfe\x7b\xe6\x8f\x59\xfc\xf7\xca"
"\x1f\xb3\xf8\xef\x9d\x3f\x66\xf1\xff\x70\xfe\x98\xc5\x7f\x9f\xfc\x31\x8b"
"\xff\xbe\xf9\x63\x16\xff\xfd\xf2\xc7\x2c\xfe\x1f\xc9\x1f\xb3\xf8\x7f\x34"
"\x7f\xcc\xe2\xff\xb1\xfc\x31\x8b\xff\xfe\xf9\x63\x16\xff\x03\xf2\xc7\x2c"
"\xfe\x07\xe6\x8f\x59\xfc\x0f\xca\x1f\xb3\xf8\x1f\x9c\x3f\x66\xf1\x3f\x24"
"\x7f\xcc\xe2\x7f\x68\xfe\x98\xc5\xff\xb0\xfc\x31\x8b\xff\xe1\xf9\x63\x16"
"\xff\x23\xf2\xc7\x2c\xfe\x47\xe6\x8f\x59\xfc\x8f\xca\x1f\xb3\xf8\x7f\x3c"
"\x7f\xcc\xe2\x7f\x74\xfe\x98\xc5\xff\x13\xf9\x63\x16\xff\x4f\xe6\x8f\x59"
"\xfc\x8f\xc9\x1f\xb3\xf8\x7f\x2a\x7f\xcc\xe2\x7f\x6c\xfe\x98\xc5\xff\xb8"
"\xfc\x31\x8b\xff\xf1\xf9\x63\x16\xff\x4f\xe7\x8f\x59\xfc\x3f\x93\x3f\x66"
"\xf1\x3f\x21\x7f\xcc\xe2\x7f\x62\xfe\x98\xc5\xff\xa4\xfc\x31\x8b\xff\xc9"
"\xf9\x63\x16\xff\x53\xf2\xc7\x2c\xfe\x9f\xcd\x1f\xb3\xf8\x7f\x2e\x7f\xcc"
"\xe2\xff\xf9\xfc\x31\x8b\xff\x17\xf2\xc7\x2c\xfe\xa7\xe6\x8f\x59\xfc\xbf"
"\x98\x3f\x66\xf1\xff\x52\xfe\x98\xc5\xff\xcb\xf9\x63\x16\xff\xaf\xe4\x8f"
"\x59\xfc\x4f\xcb\x1f\xb3\xf8\x9f\x9e\x3f\x66\xf1\x3f\x23\x7f\xcc\xe2\x7f"
"\x66\xfe\x98\xc5\xff\xac\xfc\x31\x8b\xff\xd9\xf9\x63\x16\xff\xaf\xe6\x8f"
"\x59\xfc\xbf\x96\x3f\x66\xf1\x3f\x27\x7f\xcc\xe2\xff\xf5\xfc\x31\x8b\xff"
"\xb9\xf9\x63\x16\xff\xf3\xf2\xc7\x2c\xfe\xe7\xe7\x8f\x59\xfc\x2f\xc8\x1f"
"\xb3\xf8\x5f\x98\x3f\x66\xf1\xff\x46\xfe\x98\xc5\xff\x9b\xf9\x63\x16\xff"
"\x6f\xe5\x8f\x59\xfc\x2f\xca\x1f\xb3\xf8\x5f\x9c\x3f\x66\xf1\xff\x76\xfe"
"\x98\xc5\xff\x92\xfc\x31\x8b\xff\x77\xf2\xc7\x2c\xfe\x97\xe6\x8f\x59\xfc"
"\x2f\xcb\x1f\xb3\xf8\x5f\x9e\x3f\x66\xf1\xff\x6e\xfe\x98\xc5\xff\x7b\xf9"
"\x63\x16\xff\x2b\xf2\xc7\x2c\xfe\x57\xe6\x8f\x59\xfc\xbf\x9f\x3f\x66\xf1"
"\xbf\x2a\x7f\xcc\xe2\xff\x83\xfc\x31\x8b\xff\xd5\xf9\x63\x16\xff\x1f\xe6"
"\x8f\x59\xfc\xaf\xc9\x1f\xb3\xf8\xff\x28\x7f\xcc\xe2\x7f\x6d\xfe\x98\xc5"
"\xff\xba\xfc\x31\x8b\xff\x8f\xf3\xc7\x2c\xfe\x3f\xc9\x1f\xb3\xf8\xff\x34"
"\x7f\xcc\xe2\x7f\x7d\xfe\x98\xc5\xff\x67\xf9\x63\x16\xff\x1b\xf2\xc7\x2c"
"\xfe\x37\xe6\x8f\x59\xfc\x7f\x9e\x3f\x66\xf1\xbf\x29\x7f\xcc\xe2\x7f\x73"
"\xfe\x98\xc5\xff\x17\xf9\x63\x16\xff\x5b\xf2\xc7\x2c\xfe\xb7\xe6\x8f\x59"
"\xfc\x6f\xcb\x1f\xb3\xf8\xdf\x9e\x3f\x66\xf1\xff\x65\xfe\x98\xc5\xff\x8e"
"\xfc\x31\x8b\xff\xaf\xf2\xc7\x2c\xfe\xbf\xce\x1f\xb3\xf8\xff\x26\x7f\xcc"
"\xe2\xff\xdb\xfc\x31\x8b\xff\xef\xf2\xc7\x2c\xfe\xbf\xcf\x1f\xb3\xf8\xdf"
"\x99\x3f\x66\xf1\xff\x43\xfe\x98\xc5\xff\x8f\xf9\x63\x16\xff\x3f\xe5\x8f"
"\x59\xfc\xef\xca\x1f\xb3\xf8\xdf\x9d\x3f\x66\xf1\xff\x73\xfe\x98\xc5\xff"
"\x9e\xfc\x31\x8b\xff\x5f\xf2\xc7\x2c\xfe\xf7\xe6\x8f\x59\xfc\xef\xcb\x1f"
"\xb3\xf8\xff\x35\x7f\xcc\xe2\xff\xb7\xfc\x31\x8b\xff\xfd\xf9\x63\x16\xff"
"\x07\xf2\xc7\x2c\xfe\x0f\xe6\x8f\x59\xfc\x1f\xca\x1f\xb3\xf8\x3f\x9c\x3f"
"\x66\xf1\x7f\x24\x7f\xcc\xe2\xff\x68\xfe\x98\xc5\xff\xb1\xfc\x31\x8b\xff"
"\xe3\xf9\x63\x16\xff\x27\xf2\xc7\x2c\xfe\x4f\xe6\x8f\x59\xfc\x9f\xca\x1f"
"\xb3\xf8\x3f\x9d\x3f\x66\xf1\x7f\x26\x7f\xcc\xe2\xff\x6c\xfe\x98\xc5\xff"
"\xb9\xfc\x31\x8b\xff\xf3\xf9\x63\x16\xff\x17\xf2\xc7\x2c\xfe\x2f\xe6\x8f"
"\x59\xfc\x5f\xca\x1f\xb3\xf8\xbf\x9c\x3f\x66\xf1\x7f\x25\x7f\xcc\xe2\xff"
"\x6a\xfe\x98\xc5\xff\xb5\xfc\x31\x89\xff\xf0\x81\xfc\x31\x8b\xff\xa0\xfc"
"\x31\x8b\xff\x78\xf9\x63\x16\xff\xc1\xf9\x63\x16\xff\x21\xf9\x63\x16\xff"
"\xa1\xf9\x63\x16\xff\x61\xf9\x63\x16\xff\xf1\xf3\xc7\x2c\xfe\x13\xe4\x8f"
"\x59\xfc\x27\xcc\x1f\xb3\xf8\x4f\x94\x3f\x66\xf1\x9f\x38\x7f\xcc\xe2\x3f"
"\x49\xfe\x98\xc5\x7f\xd2\xfc\x31\x8b\xff\xf0\xfc\x31\x8b\xff\x64\xf9\x63"
"\x16\xff\xc9\xf3\xc7\x2c\xfe\x53\xe4\x8f\x59\xfc\xa7\xcc\x1f\xb3\xf8\x4f"
"\x95\x3f\x66\xf1\x9f\x3a\x7f\xcc\xe2\x3f\x4d\xfe\x98\xc5\xff\x1d\xf9\x63"
"\x16\xff\x77\xe6\x8f\x59\xfc\xa7\xcd\x1f\xb3\xf8\x4f\x97\x3f\x66\xf1\x9f"
"\x3e\x7f\xcc\xe2\xff\xae\xfc\x31\x8b\xff\x0c\xf9\x63\x16\xff\x11\xf9\x63"
"\x16\xff\x77\xe7\x8f\x59\xfc\x67\xcc\x1f\xb3\xf8\xcf\x94\x3f\x66\xf1\x7f"
"\x4f\xfe\x98\xc5\x7f\xe6\xfc\x31\x8b\xff\x2c\xf9\x63\x16\xff\x59\xf3\xc7"
"\x2c\xfe\xb3\xe5\x8f\x59\xfc\xdf\x9b\x3f\x66\xf1\x9f\x3d\x7f\xcc\xe2\x3f"
"\x47\xfe\x98\xc5\x7f\xce\xfc\x31\x8b\xff\x5c\xf9\x63\x16\xff\xb9\xf3\xc7"
"\x2c\xfe\xf3\xe4\x8f\x59\xfc\xe7\xcd\x1f\xb3\xf8\xcf\x97\x3f\x66\xf1\x9f"
"\x3f\x7f\xcc\xe2\xbf\x40\xfe\x98\xc5\x7f\xc1\xfc\x31\x8b\xff\x42\xf9\x63"
"\x16\xff\x85\xf3\xc7\x2c\xfe\x8b\xe4\x8f\x59\xfc\x17\xcd\x1f\xb3\xf8\x2f"
"\x96\x3f\x66\xf1\x5f\x3c\x7f\xcc\xe2\xbf\x44\xfe\x98\xc5\x7f\xc9\xfc\x31"
"\x8b\xff\x52\xf9\x63\x16\xff\xa5\xf3\xc7\x2c\xfe\xcb\xe4\x8f\x59\xfc\xdf"
"\x97\x3f\x66\xf1\x7f\x7f\xfe\x98\xc5\xff\x03\xf9\x63\x16\xff\x65\xf3\xc7"
"\x2c\xfe\xcb\xe5\x8f\x59\xfc\x97\xcf\x1f\xb3\xf8\xaf\x90\x3f\x66\xf1\x5f"
"\x31\x7f\xcc\xe2\xbf\x52\xfe\x98\xc5\x7f\xe5\xfc\x31\x8b\xff\x2a\xf9\x63"
"\x16\xff\x55\xf3\xc7\x2c\xfe\xab\xe5\x8f\x59\xfc\x57\xcf\x1f\xb3\xf8\xaf"
"\x91\x3f\x66\xf1\x5f\x33\x7f\xcc\xe2\xbf\x56\xfe\x98\xc5\x7f\xed\xfc\x31"
"\x8b\xff\x3a\xf9\x63\x16\xff\x75\xf3\xc7\x2c\xfe\xeb\xe5\x8f\x59\xfc\xd7"
"\xcf\x1f\xb3\xf8\x6f\x90\x3f\x66\xf1\xdf\x30\x7f\xcc\xe2\xbf\x51\xfe\x98"
"\xc5\x7f\xe3\xfc\x31\x8b\xff\x26\xf9\x63\x16\xff\x4d\xf3\xc7\x2c\xfe\x9b"
"\xe5\x8f\x59\xfc\x37\xcf\x1f\xb3\xf8\x6f\x91\x3f\x66\xf1\xdf\x32\x7f\xcc"
"\xe2\xbf\x55\xfe\x98\xc5\x7f\xeb\xfc\x31\x8b\xff\x07\xf3\xc7\x2c\xfe\xdb"
"\xe4\x8f\x59\xfc\xb7\xcd\x1f\xb3\xf8\x6f\x97\x3f\x66\xf1\xdf\x3e\x7f\xcc"
"\xe2\xbf\x43\xfe\x98\xc5\x7f\xc7\xfc\x31\x8b\xff\x4e\xf9\x63\x16\xff\x9d"
"\xf3\xc7\x2c\xfe\xbb\xe4\x8f\x59\xfc\x77\xcd\x1f\xb3\xf8\xef\x96\x3f\x66"
"\xf1\xff\x50\xfe\x98\xc5\x7f\xf7\xfc\x31\x8b\xff\x1e\xf9\x63\x16\xff\x3d"
"\xf3\xc7\x2c\xfe\x7b\xe5\x8f\x59\xfc\xf7\xce\x1f\xb3\xf8\x7f\x38\x7f\xcc"
"\xe2\xbf\x4f\xfe\x98\xc5\x7f\xdf\xfc\x31\x8b\xff\x7e\xf9\x63\x16\xff\x8f"
"\xe4\x8f\x59\xfc\x3f\x9a\x3f\x66\xf1\xff\x58\xfe\x98\xc5\x7f\xff\xfc\x31"
"\x8b\xff\x01\xf9\x63\x16\xff\x03\xf3\xc7\x2c\xfe\x07\xe5\x8f\x59\xfc\x0f"
"\xce\x1f\xb3\xf8\x1f\x92\x3f\x66\xf1\x3f\x34\x7f\xcc\xe2\x7f\x58\xfe\x98"
"\xc5\xff\xf0\xfc\x31\x8b\xff\x11\xf9\x63\x16\xff\x23\xf3\xc7\x2c\xfe\x47"
"\xe5\x8f\x59\xfc\x3f\x9e\x3f\x66\xf1\x3f\x3a\x7f\xcc\xe2\xff\x89\xfc\x31"
"\x8b\xff\x27\xf3\xc7\x2c\xfe\xc7\xe4\x8f\x59\xfc\x3f\x95\x3f\x66\xf1\x3f"
"\x36\x7f\xcc\xe2\x7f\x5c\xfe\x98\xc5\xff\xf8\xfc\x31\x8b\xff\xa7\xf3\xc7"
"\x2c\xfe\x9f\xc9\x1f\xb3\xf8\x9f\x90\x3f\x66\xf1\x3f\x31\x7f\xcc\xe2\x7f"
"\x52\xfe\x98\xc5\xff\xe4\xfc\x31\x8b\xff\x29\xf9\x63\x16\xff\xcf\xe6\x8f"
"\x59\xfc\x3f\x97\x3f\x66\xf1\xff\x7c\xfe\x98\xc5\xff\x0b\xf9\x63\x16\xff"
"\x53\xf3\xc7\x2c\xfe\x5f\xcc\x1f\xb3\xf8\x7f\x29\x7f\xcc\xe2\xff\xe5\xfc"
"\x31\x8b\xff\x57\xf2\xc7\x2c\xfe\xa7\xe5\x8f\x59\xfc\x4f\xcf\x1f\xb3\xf8"
"\x9f\x91\x3f\x66\xf1\x3f\x33\x7f\xcc\xe2\x7f\x56\xfe\x98\xc5\xff\xec\xfc"
"\x31\x8b\xff\x57\xf3\xc7\x2c\xfe\x5f\xcb\x1f\xb3\xf8\x9f\x93\x3f\x66\xf1"
"\xff\x7a\xfe\x98\xc5\xff\xdc\xfc\x31\x8b\xff\x79\xf9\x63\x16\xff\xf3\xf3"
"\xc7\x2c\xfe\x17\xe4\x8f\x59\xfc\x2f\xcc\x1f\xb3\xf8\x7f\x23\x7f\xcc\xe2"
"\xff\xcd\xfc\x31\x8b\xff\xb7\xf2\xc7\x2c\xfe\x17\xe5\x8f\x59\xfc\x2f\xce"
"\x1f\xb3\xf8\x7f\x3b\x7f\xcc\xe2\x7f\x49\xfe\x98\xc5\xff\x3b\xf9\x63\x16"
"\xff\x4b\xf3\xc7\x2c\xfe\x97\xe5\x8f\x59\xfc\x2f\xcf\x1f\xb3\xf8\x7f\x37"
"\x7f\xcc\xe2\xff\xbd\xfc\x31\x8b\xff\x15\xf9\x63\x16\xff\x2b\xf3\xc7\x2c"
"\xfe\xdf\xcf\x1f\xb3\xf8\x5f\x95\x3f\x66\xf1\xff\x41\xfe\x98\xc5\xff\xea"
"\xfc\x31\x8b\xff\x0f\xf3\xc7\x2c\xfe\xd7\xe4\x8f\x59\xfc\x7f\x94\x3f\x66"
"\xf1\xbf\x36\x7f\xcc\xe2\x7f\x5d\xfe\x98\xc5\xff\xc7\xf9\x63\x16\xff\x9f"
"\xe4\x8f\x59\xfc\x7f\x9a\x3f\x66\xf1\xbf\x3e\x7f\xcc\xe2\xff\xb3\xfc\x31"
"\x8b\xff\x0d\xf9\x63\x16\xff\x1b\xf3\xc7\x2c\xfe\x3f\xcf\x1f\xb3\xf8\xdf"
"\x94\x3f\x66\xf1\xbf\x39\x7f\xcc\xe2\xff\x8b\xfc\x31\x8b\xff\x2d\xf9\x63"
"\x16\xff\x5b\xf3\xc7\x2c\xfe\xb7\xe5\x8f\x59\xfc\x6f\xcf\x1f\xb3\xf8\xff"
"\x32\x7f\xcc\xe2\x7f\x47\xfe\x98\xc5\xff\x57\xf9\x63\x16\xff\x5f\xe7\x8f"
"\x59\xfc\x7f\x93\x3f\x66\xf1\xff\x6d\xfe\x98\xc5\xff\x77\xf9\x63\x16\xff"
"\xdf\xe7\x8f\x59\xfc\xef\xcc\x1f\xb3\xf8\xff\x21\x7f\xcc\xe2\xff\xc7\xfc"
"\x31\x8b\xff\x9f\xf2\xc7\x2c\xfe\x77\xe5\x8f\x59\xfc\xef\xce\x1f\xb3\xf8"
"\xff\x39\x7f\xcc\xe2\x7f\x4f\xfe\x98\xc5\xff\x2f\xf9\x63\x16\xff\x7b\xf3"
"\xc7\x2c\xfe\xf7\xe5\x8f\x59\xfc\xff\x9a\x3f\x66\xf1\xff\x5b\xfe\x98\xc5"
"\xff\xfe\xfc\x31\x8b\xff\x03\xf9\x63\x16\xff\x07\xf3\xc7\x2c\xfe\x0f\xe5"
"\x8f\x59\xfc\x1f\xce\x1f\xb3\xf8\x3f\x92\x3f\x66\xf1\x7f\x34\x7f\xcc\xe2"
"\xff\x58\xfe\x98\xc5\xff\xf1\xfc\x31\x8b\xff\x13\xf9\x63\x16\xff\x27\xf3"
"\xc7\x2c\xfe\x4f\xe5\x8f\x59\xfc\x9f\xce\x1f\xb3\xf8\x3f\x93\x3f\x66\xf1"
"\x7f\x36\x7f\xcc\xe2\xff\x5c\xfe\x98\xc5\xff\xf9\xfc\x31\x8b\xff\x0b\xf9"
"\x63\x16\xff\x17\xf3\xc7\x2c\xfe\x2f\xe5\x8f\x59\xfc\x5f\xce\x1f\xb3\xf8"
"\xbf\x92\x3f\x66\xf1\x7f\x35\x7f\xcc\xe2\xff\x5a\xfe\x98\xc4\x7f\xb2\x81"
"\xfc\x31\x8b\xff\xa0\xfc\x31\x8b\xff\x78\xf9\x63\x16\xff\xc1\xf9\x63\x16"
"\xff\x21\xf9\x63\x16\xff\xa1\xf9\x63\x16\xff\x61\xf9\x63\x16\xff\xf1\xf3"
"\xc7\x2c\xfe\x13\xe4\x8f\x59\xfc\x27\xcc\x1f\xb3\xf8\x4f\x94\x3f\x66\xf1"
"\x9f\x38\x7f\xcc\xe2\x3f\x49\xfe\x98\xc5\x7f\xd2\xfc\x31\x8b\xff\xf0\xfc"
"\x31\x8b\xff\x64\xf9\x63\x16\xff\xc9\xf3\xc7\x2c\xfe\x53\xe4\x8f\x59\xfc"
"\xa7\xcc\x1f\xb3\xf8\x4f\x95\x3f\x66\xf1\x9f\x3a\x7f\xcc\xe2\x3f\x4d\xfe"
"\x98\xc5\xff\x1d\xf9\x63\x16\xff\x77\xe6\x8f\x59\xfc\xa7\xcd\x1f\xb3\xf8"
"\x4f\x97\x3f\x66\xf1\x9f\x3e\x7f\xcc\xe2\xff\xae\xfc\x31\x8b\xff\x0c\xf9"
"\x63\x16\xff\x11\xf9\x63\x16\xff\x77\xe7\x8f\x59\xfc\x67\xcc\x1f\xb3\xf8"
"\xcf\x94\x3f\x66\xf1\x7f\x4f\xfe\x98\xc5\x7f\xe6\xfc\x31\x8b\xff\x2c\xf9"
"\x63\x16\xff\x59\xf3\xc7\x2c\xfe\xb3\xe5\x8f\x59\xfc\xdf\x9b\x3f\x66\xf1"
"\x9f\x3d\x7f\xcc\xe2\x3f\x47\xfe\x98\xc5\x7f\xce\xfc\x31\x8b\xff\x5c\xf9"
"\x63\x16\xff\xb9\xf3\xc7\x2c\xfe\xf3\xe4\x8f\x59\xfc\xe7\xcd\x1f\xb3\xf8"
"\xcf\x97\x3f\x66\xf1\x9f\x3f\x7f\xcc\xe2\xbf\x40\xfe\x98\xc5\x7f\xc1\xfc"
"\x31\x8b\xff\x42\xf9\x63\x16\xff\x85\xf3\xc7\x2c\xfe\x8b\xe4\x8f\x59\xfc"
"\x17\xcd\x1f\xb3\xf8\x2f\x96\x3f\x66\xf1\x5f\x3c\x7f\xcc\xe2\xbf\x44\xfe"
"\x98\xc5\x7f\xc9\xfc\x31\x8b\xff\x52\xf9\x63\x16\xff\xa5\xf3\xc7\x2c\xfe"
"\xcb\xe4\x8f\x59\xfc\xdf\x97\x3f\x66\xf1\x7f\x7f\xfe\x98\xc5\xff\x03\xf9"
"\x63\x16\xff\x65\xf3\xc7\x2c\xfe\xcb\xe5\x8f\x59\xfc\x97\xcf\x1f\xb3\xf8"
"\xaf\x90\x3f\x66\xf1\x5f\x31\x7f\xcc\xe2\xbf\x52\xfe\x98\xc5\x7f\xe5\xfc"
"\x31\x8b\xff\x2a\xf9\x63\x16\xff\x55\xf3\xc7\x2c\xfe\xab\xe5\x8f\x59\xfc"
"\x57\xcf\x1f\xb3\xf8\xaf\x91\x3f\x66\xf1\x5f\x33\x7f\xcc\xe2\xbf\x56\xfe"
"\x98\xc5\x7f\xed\xfc\x31\x8b\xff\x3a\xf9\x63\x16\xff\x75\xf3\xc7\x2c\xfe"
"\xeb\xe5\x8f\x59\xfc\xd7\xcf\x1f\xb3\xf8\x6f\x90\x3f\x66\xf1\xdf\x30\x7f"
"\xcc\xe2\xbf\x51\xfe\x98\xc5\x7f\xe3\xfc\x31\x8b\xff\x26\xf9\x63\x16\xff"
"\x4d\xf3\xc7\x2c\xfe\x9b\xe5\x8f\x59\xfc\x37\xcf\x1f\xb3\xf8\x6f\x91\x3f"
"\x66\xf1\xdf\x32\x7f\xec\xff\xc7\x1e\x3d\x18\x0a\x62\x00\x50\x00\xab\x8d"
"\x5f\xdb\xb6\xad\x49\x6a\xdb\xb6\x6d\xdb\xb6\x6d\xdb\xb6\xdb\xb3\xad\x05"
"\xde\x04\xf7\x92\x15\xd2\xf2\xbf\xb3\xff\xa8\xe5\x7f\x17\xff\x51\xcb\xff"
"\xae\xfe\xa3\x96\xff\xdd\xfc\x47\x2d\xff\xbb\xfb\x8f\x5a\xfe\xf7\xf0\x1f"
"\xb5\xfc\xef\xe9\x3f\x6a\xf9\xdf\xcb\x7f\xd4\xf2\xbf\xb7\xff\xa8\xe5\x7f"
"\x1f\xff\x51\xcb\xff\xbe\xfe\xa3\x96\xff\xfd\xfc\x47\x2d\xff\xfb\xfb\x8f"
"\x5a\xfe\x0f\xf0\x1f\xb5\xfc\x1f\xe8\x3f\x6a\xf9\x3f\xc8\x7f\xd4\xf2\x7f"
"\xb0\xff\xa8\xe5\xff\x10\xff\x51\xcb\xff\xa1\xfe\xa3\x96\xff\xc3\xfc\x47"
"\x2d\xff\x87\xfb\x8f\x5a\xfe\x8f\xf0\x1f\xb5\xfc\x1f\xe9\x3f\x6a\xf9\x3f"
"\xca\x7f\xd4\xf2\x7f\xb4\xff\xa8\xe5\xff\x18\xff\x51\xcb\xff\xb1\xfe\xa3"
"\x96\xff\xe3\xfc\x47\x2d\xff\xc7\xfb\x8f\x5a\xfe\x4f\xf0\x1f\xb5\xfc\x9f"
"\xe8\x3f\x6a\xf9\x3f\xc9\x7f\xd4\xf2\x7f\xb2\xff\xa8\xe5\xff\x14\xff\x51"
"\xcb\xff\xa9\xfe\xa3\x96\xff\xd3\xfc\x47\x2d\xff\xa7\xfb\x8f\x5a\xfe\xcf"
"\xf0\x1f\xb5\xfc\x9f\xe9\x3f\x6a\xf9\x3f\xcb\x7f\xd4\xf2\x7f\xb6\xff\xa8"
"\xe5\xff\x1c\xff\x51\xcb\xff\xb9\xfe\xa3\x96\xff\xf3\xfc\x47\x2d\xff\xe7"
"\xfb\x8f\x5a\xfe\x2f\xf0\x1f\xb5\xfc\x5f\xe8\x3f\x6a\xf9\xbf\xc8\x7f\xd4"
"\xf2\x7f\xb1\xff\xa8\xe5\xff\x12\xff\x51\xcb\xff\xa5\xfe\xa3\x96\xff\xcb"
"\xfc\x47\x2d\xff\x97\xfb\x8f\x5a\xfe\xaf\xf0\x1f\xb5\xfc\x5f\xe9\x3f\x6a"
"\xf9\xbf\xca\x7f\xd4\xf2\x7f\xb5\xff\xa8\xe5\xff\x1a\xff\x51\xcb\xff\xb5"
"\xfe\xa3\x96\xff\xeb\xfc\x47\x2d\xff\xd7\xfb\x8f\x5a\xfe\x6f\xf0\x1f\xb5"
"\xfc\xdf\xe8\x3f\x6a\xf9\xbf\xc9\x7f\xd4\xf2\x7f\xb3\xff\xa8\xe5\xff\x16"
"\xff\x51\xcb\xff\xad\xfe\xa3\x96\xff\xdb\xfc\x47\x2d\xff\xb7\xfb\x8f\x5a"
"\xfe\xef\xf0\x1f\xb5\xfc\xdf\xe9\x3f\x6a\xf9\xbf\xcb\x7f\xd4\xf2\x7f\xb7"
"\xff\xa8\xe5\xff\x1e\xff\x51\xcb\xff\xbd\xfe\xa3\x96\xff\xfb\xfc\x47\x2d"
"\xff\xf7\xfb\x8f\x5a\xfe\x1f\xf0\x1f\xb5\xfc\x3f\xe8\x3f\x6a\xf9\x7f\xc8"
"\x7f\xd4\xf2\xff\xb0\xff\xa8\xe5\xff\x11\xff\x51\xcb\xff\xa3\xfe\xa3\x96"
"\xff\xc7\xfc\x47\x2d\xff\x8f\xfb\x8f\x5a\xfe\x9f\xf0\x1f\xb5\xfc\x3f\xe9"
"\x3f\x6a\xf9\x7f\xca\x7f\xd4\xf2\xff\xb4\xff\xa8\xe5\xff\x19\xff\x51\xcb"
"\xff\xb3\xfe\xa3\x96\xff\xe7\xfc\x47\x2d\xff\xcf\xfb\x8f\x5a\xfe\x5f\xf0"
"\x1f\xb5\xfc\xbf\xe8\x3f\x6a\xf9\x7f\xc9\x7f\xd4\xf2\xff\xb2\xff\xa8\xe5"
"\xff\x15\xff\x51\xcb\xff\xab\xfe\xa3\x96\xff\xd7\xfc\x47\x2d\xff\xaf\xfb"
"\x8f\x5a\xfe\xdf\xf0\x1f\xb5\xfc\xbf\xe9\x3f\x6a\xf9\x7f\xcb\x7f\xd4\xf2"
"\xff\xb6\xff\xa8\xe5\xff\x1d\xff\x51\xcb\xff\xbb\xfe\xa3\x96\xff\xf7\xfc"
"\x47\x2d\xff\xef\xfb\x8f\x5a\xfe\x3f\xf0\x1f\xb5\xfc\x7f\xe8\x3f\x6a\xf9"
"\xff\xc8\x7f\xd4\xf2\xff\xb1\xff\xa8\xe5\xff\x13\xff\x51\xcb\xff\xa7\xfe"
"\xa3\x96\xff\xcf\xfc\x47\x2d\xff\x9f\xfb\x8f\x5a\xfe\xbf\xf0\x1f\xb5\xfc"
"\x7f\xe9\x3f\x6a\xf9\xff\xca\x7f\xd4\xf2\xff\xb5\xff\xa8\xe5\xff\x1b\xff"
"\x51\xcb\xff\xb7\xfe\xa3\x96\xff\xef\xfc\x47\x2d\xff\xdf\xfb\x8f\x5a\xfe"
"\x7f\xf0\x1f\xb5\xfc\xff\xe8\x3f\x6a\xf9\xff\xc9\x7f\xd4\xf2\xff\xb3\xff"
"\xa8\xe5\xff\x17\xff\x51\xcb\xff\xaf\xfe\xa3\x96\xff\xdf\xfc\x47\x2d\xff"
"\xbf\xfb\x8f\x5a\xfe\xff\xf0\x1f\xb5\xfc\xff\xe9\x3f\x6a\xf9\xff\xcb\x7f"
"\xd4\xf2\xff\xb7\xff\xa8\xe5\xff\x1f\xff\x51\xcb\xff\xbf\xfe\xa3\x96\xff"
"\xff\xfc\x47\x2d\xff\xff\xfb\x8f\x5a\xfe\x07\xf9\x8f\x5a\xfe\x07\xfb\x8f"
"\x5a\xfe\x87\xf8\x8f\x5a\xfe\x87\xfa\x8f\x5a\xfe\x87\xf9\x8f\x5a\xfe\x87"
"\xfb\x8f\x5a\xfe\x47\xf8\x8f\x5a\xfe\x47\xfa\x8f\x5a\xfe\x47\xf9\x8f\x5a"
"\xfe\x47\xfb\x8f\x5a\xfe\xc7\xf8\x8f\x5a\xfe\xc7\xfa\x8f\x5a\xfe\xc7\xf9"
"\x8f\x5a\xfe\xc7\xfb\x8f\x5a\xfe\x27\xf8\x8f\x5a\xfe\x27\xfa\x8f\x5a\xfe"
"\x27\xf9\x8f\x5a\xfe\x27\xfb\x8f\x5a\xfe\xa7\xf8\x8f\x5a\xfe\xa7\xfa\x8f"
"\x5a\xfe\xa7\xf9\x8f\x5a\xfe\xa7\xfb\x8f\x4a\xfe\x07\x66\xf1\x1f\xb5\xfc"
"\xcf\xea\x3f\x6a\xf9\x9f\xcd\x7f\xd4\xf2\x3f\xbb\xff\xa8\xe5\x7f\x0e\xff"
"\x51\xcb\xff\x9c\xfe\xa3\x96\xff\xb9\xfc\x47\x2d\xff\x73\xfb\x8f\x5a\xfe"
"\xe7\xf1\x1f\xb5\xfc\xcf\xeb\x3f\x6a\xf9\x9f\xcf\x7f\xd4\xf2\x3f\xbf\xff"
"\xa8\xe5\x7f\x01\xff\x51\xcb\xff\x82\xfe\xa3\x96\xff\x85\xfc\x47\x2d\xff"
"\x0b\xfb\x8f\x5a\xfe\x07\xfc\x47\x2d\xff\x8b\xf8\x8f\x5a\xfe\x17\xf5\x1f"
"\xb5\xfc\x2f\xe6\x3f\x6a\xf9\x5f\xdc\x7f\xd4\xf2\xbf\x84\xff\xa8\xe5\x7f"
"\x49\xff\x51\xcb\xff\x52\xfe\xa3\x96\xff\xa5\xfd\x47\x2d\xff\xcb\xf8\x8f"
"\x5a\xfe\x97\xf5\x1f\xb5\xfc\x2f\xe7\x3f\x6a\xf9\x5f\xde\x7f\xd4\xf2\xbf"
"\x82\xff\xa8\xe5\x7f\x45\xff\x51\xcb\xff\x4a\xfe\xa3\x96\xff\x95\xfd\x47"
"\x2d\xff\xab\xf8\x8f\x5a\xfe\x57\xf5\x1f\xb5\xfc\xaf\xe6\x3f\x6a\xf9\x5f"
"\xdd\x7f\xd4\xf2\xbf\x86\xff\xa8\xe5\x7f\x4d\xff\x51\xcb\xff\x5a\xfe\xa3"
"\x96\xff\xb5\xfd\x47\x2d\xff\xeb\xf8\x8f\x5a\xfe\xd7\xf5\x1f\xb5\xfc\xaf"
"\xe7\x3f\x6a\xf9\x5f\xdf\x7f\xd4\xf2\xbf\x81\xff\xa8\xe5\x7f\x43\xff\x51"
"\xcb\xff\x46\xfe\xa3\x96\xff\x8d\xfd\x47\x2d\xff\x9b\xf8\x8f\x5a\xfe\x37"
"\xf5\x1f\xb5\xfc\x6f\xe6\x3f\x6a\xf9\xdf\xdc\x7f\xd4\xf2\xbf\x85\xff\xa8"
"\xe5\x7f\x4b\xff\x51\xcb\xff\x56\xfe\xa3\x96\xff\xad\xfd\x47\x2d\xff\xdb"
"\xf8\x8f\x5a\xfe\xb7\xf5\x1f\xb5\xfc\x6f\xe7\x3f\x6a\xf9\xdf\xde\x7f\xd4"
"\xf2\xbf\x83\xff\xa8\xe5\x7f\x47\xff\x51\xcb\xff\x4e\xfe\xa3\x99\xee\x1f"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x66\xb0"
"\x73\xff\x31\x5e\xd7\x05\x1c\xc7\x3f\x77\x70\x77\x08\x05\x22\x46\x48\xbd"
"\x81\xa0\x02\xc1\xe3\xe4\x8e\x5f\x82\x8a\x56\x34\xcf\xc6\x59\x61\xeb\xd7"
"\x24\x98\x9c\x02\x1d\xa9\x78\x33\x40\x16\x94\x5a\xd4\xdc\xd2\xc9\x96\xb5"
"\x48\xfd\x83\xb4\x56\x6b\x6c\xc6\x5a\x4d\xca\x6c\x8b\xd9\x8a\x9a\xf6\xc3"
"\xb9\x05\x25\xfd\x18\xeb\xd4\x8a\x6c\x91\x75\xee\x0b\xdf\xef\x79\xf7\xf5"
"\xb8\xf9\x7d\x9f\xef\x37\x7f\xf0\x78\xfc\x71\xf7\xfd\x7c\x8e\xd7\xe7\x80"
"\xed\x79\x9f\xcf\x77\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\xe0\xb5\xd3\xde\x71\x79\xcf\x88\xba\x01\xa7\x46\xf4\x3f"
"\x08\x3f\xef\x3c\xf1\x79\xfe\xbf\x3f\xb4\x6e\xcf\x9e\x7d\xe3\x2b\x9f\xcb"
"\x5f\x7e\xcf\x20\x97\xac\xef\x7f\xd0\xdb\xdb\xdb\xbb\x6d\xc2\x2f\x6e\x29"
"\x1f\x36\x15\x45\x51\xfa\x6e\x97\x95\x8f\x47\x55\x8f\x4b\xd7\xdf\xbe\x7f"
"\xea\xd9\xe5\xef\x5e\xdc\x77\xf7\x6d\xb3\x97\x6e\x59\xfe\xd8\xee\x8d\x3d"
"\x63\x7e\xba\x60\xfb\x91\x86\x13\x67\x1b\x8a\xd5\xd7\xad\xef\xea\xbc\xb0"
"\xbe\x28\xc2\x88\x86\x62\x73\xe9\x60\x5e\x5d\x51\x84\xc6\x86\xe2\xae\xd2"
"\x41\x6b\xe9\xa0\xa9\xa1\x78\xa8\x74\xd0\x76\xe2\xe0\xac\xe2\x47\xa5\x83"
"\xb9\xd7\xde\xd0\xb5\xb6\x74\xe2\x15\xdf\x1a\xce\x38\xed\x1d\x3b\x8a\x11"
"\x03\x8a\x2d\x06\xfc\x34\xe8\xdf\xff\xf6\xfd\x97\xbe\xb7\xf2\x79\x88\x4b"
"\x56\xae\x36\xb2\x28\xf7\x7f\xc5\xf7\x9f\x68\xaa\xfa\x5a\xc5\x29\xfa\xaf"
"\x5c\x3f\xd4\x55\xf7\x5f\xf3\x1f\x10\x38\xa5\xda\xfa\x5f\xf1\x7c\xe5\xf3"
"\x10\x97\x7c\xc5\xfd\xbf\xf5\x6f\x1f\x3b\x3c\xd8\xd7\x4e\xdd\x7f\xe5\xfa"
"\xa1\x5e\xff\x90\xce\x20\xcf\xff\x03\x1a\xad\x7e\xee\xaf\x7a\xfe\x9f\x36"
"\xc8\x25\xfb\xf6\xcd\x2d\x8f\x8f\x2a\xf5\xbf\x64\xf1\x7d\x1b\xca\xa7\x46"
"\xbe\x9a\xe7\xff\x97\xaf\x1f\x46\x54\xf7\x5f\x3f\xe0\xf9\xbf\xf4\x1c\x3f"
"\xb2\xf2\xfc\xdf\x54\x14\xa1\x61\x98\x7f\x1d\x70\x46\x69\xef\xf8\x74\xcf"
"\x50\xf7\xff\xa1\xfb\x1f\x39\xb9\x6a\x53\xd7\xbf\xff\xad\xc7\x0e\xad\x2a"
"\xf5\xdf\xbc\xe1\x93\xcf\x95\x4f\x35\xd4\xd8\xff\xc8\x21\xee\xff\x75\x4f"
"\x56\xfd\x5e\x81\xda\xb4\x77\x3c\xd0\x5b\x75\xff\xaf\xa1\xff\x62\xe6\x20"
"\x97\xec\xeb\xbf\xe7\xd6\xa7\x8f\x97\xfa\xff\xd3\xfe\x67\xce\xef\xf7\xb5"
"\x5a\xfa\x6f\xa8\xee\xbf\xa5\x7b\xe3\x8d\x2d\x37\x6f\xd9\xda\xbc\x7e\xe3"
"\x9a\xeb\x3b\xaf\xef\xfc\x44\xeb\xfc\x85\x8b\x16\xb6\x2e\xbe\xa8\x6d\x41"
"\xcb\x89\x47\x82\x93\x1f\x87\xf9\xb7\x02\x67\x86\xe1\xdd\xff\x8b\xd1\x55"
"\x9b\xba\xa2\xe8\xec\xdb\x5f\xf0\xdc\xca\x9d\xa5\xfe\xa7\xaf\x5f\xf9\xd9"
"\xf2\xa9\x51\x35\xf6\xdf\x38\xe4\xfd\x7f\x9a\xfb\x3f\x0c\x6a\x7a\x7d\xd1"
"\xd8\x58\x6c\x5e\xd3\xdd\xbd\x69\xde\xc9\x8f\x95\xc3\xd6\x93\x1f\x4f\xfe"
"\xb2\x41\xfa\xaf\xe1\xfd\xff\x8c\x59\xe5\x5f\x56\x79\xdf\x5d\x57\x14\x93"
"\xfa\xf6\x73\x6e\x5c\xb0\xba\xd4\xff\x83\xc7\x3e\xf7\x78\xf9\x54\x63\x8d"
"\xfd\x37\x0d\xd9\xff\x65\x85\xf7\xfb\x30\x0c\xc3\xbc\xff\xaf\xad\xda\x0c"
"\xe8\xff\xe8\x8a\xb1\xcf\x96\xfa\xff\xd2\xc3\xb3\xba\xcb\xa7\x6a\x7d\xff"
"\x3f\x6a\xc8\xfe\x0f\xbb\xff\xc3\x70\xb4\x77\x54\xfd\x0b\x3f\xaf\xb1\x52"
"\xff\x97\x8c\xdd\xfd\xf7\xb8\x75\x38\xcb\x3f\xff\x83\x74\x72\xf4\x3f\xfe"
"\xf8\x9d\x57\xc5\xad\xc3\x68\xfd\x43\x3a\x39\xfa\xff\xc8\xed\x33\x9f\x8a"
"\x5b\x87\x31\xfa\x87\x74\x72\xf4\xff\xbd\xb5\xef\x5c\x18\xb7\x0e\xaf\xd3"
"\x3f\xa4\x93\xa3\xff\x7f\x4e\xfe\xeb\xfd\x71\xeb\xf0\x7a\xfd\x43\x3a\x39"
"\xfa\x3f\xf4\xec\x7f\xa6\xc4\xad\xc3\x58\xfd\x43\x3a\x39\xfa\xdf\x75\xd7"
"\xfb\x77\xc6\xad\xc3\x38\xfd\x43\x3a\x39\xfa\x9f\xb1\xed\xc8\x1d\x71\xeb"
"\x70\xb6\xfe\x21\x9d\x1c\xfd\xaf\xab\xbf\x6a\x42\xdc\x3a\x8c\xd7\x3f\xa4"
"\x93\xa3\xff\x77\xbd\xb0\xea\xdb\x71\xeb\x70\x8e\xfe\x21\x9d\x1c\xfd\x8f"
"\xdb\xf9\xaf\xa5\x71\xeb\x30\x41\xff\x90\x4e\x8e\xfe\x7b\xd6\xdd\xfd\x64"
"\xdc\x3a\x9c\xab\x7f\x48\x27\x47\xff\x5f\x9f\xb8\xe4\x1d\x71\xeb\xf0\x06"
"\xfd\x43\x3a\x39\xfa\xff\xc2\x1f\xe7\xbc\x18\xb7\x0e\x13\xf5\x0f\xe9\xe4"
"\xe8\xff\xd1\xaf\xee\xd8\x10\xb7\x0e\x6f\xd4\x3f\xa4\x93\xa3\xff\x1f\x7e"
"\x60\xec\x60\xff\x9f\xb0\x57\x21\x4c\xd2\x3f\xa4\x93\xa3\xff\x63\x73\xf6"
"\xec\x8d\x5b\x87\xf3\xf4\x0f\xe9\xe4\xe8\xff\x77\x87\x1e\x1e\x17\xb7\x0e"
"\x93\xf5\x0f\xe9\xe4\xe8\xff\x9e\x07\xa6\x7e\x39\x6e\x1d\xde\xa4\x7f\x48"
"\x27\x47\xff\x37\x5d\x7e\xeb\x2d\x71\xeb\xf0\x66\xfd\x43\x3a\x39\xfa\x5f"
"\xb2\xec\x97\x87\xe3\xd6\x21\xe8\x1f\xd2\xc9\xd1\xff\xc4\x9f\x3d\xba\x2a"
"\x6e\x1d\xa6\xe8\x1f\xd2\xc9\xd1\xff\x35\xdf\xdd\x70\x20\x6e\x1d\xa6\xea"
"\x1f\xd2\xc9\xd1\xff\xe6\x73\xbe\xb5\x3c\x6e\x1d\xa6\xe9\x1f\xd2\xc9\xd1"
"\x7f\x5b\x57\xd3\x13\x71\xeb\xf0\x16\xfd\x43\x3a\x39\xfa\x9f\x7a\xef\xc4"
"\x8d\x71\xeb\x30\x5d\xff\x90\x4e\x8e\xfe\xaf\xfe\xf3\x23\xff\x8d\x5b\x87"
"\x19\xfa\x87\x74\x72\xf4\xbf\xaf\xf1\xa9\x73\xe3\xd6\xe1\xad\xfa\x87\x74"
"\x72\xf4\xff\xbf\xcd\x9b\x3e\x13\xb7\x0e\x6f\xd3\x3f\xa4\x93\xa3\xff\x5f"
"\xdd\x79\xed\xc5\x71\xeb\xf0\x76\xfd\x43\x3a\x39\xfa\xff\xca\x3f\x0e\x7c"
"\x33\x6e\x1d\x66\xea\x1f\xd2\xc9\xd1\xff\x91\xa5\xef\xfe\x4b\xdc\x3a\xcc"
"\xd2\x3f\xa4\x93\xa3\xff\xef\x2c\xef\xb9\x29\x6e\x1d\xce\xd7\x3f\xa4\x93"
"\xa3\xff\xdb\xf6\xbe\x78\x30\x6e\x1d\x66\xeb\x1f\xd2\xc9\xd1\xff\x81\x83"
"\x1f\xfc\x70\xdc\x3a\xcc\xd1\x3f\xa4\x93\xa3\xff\xd9\x2d\x6d\xfb\xe2\xd6"
"\xe1\x02\xfd\x43\x3a\x39\xfa\x5f\xf3\xbe\x7b\xa7\xc5\xad\x43\xb3\xfe\x21"
"\x9d\x1c\xfd\xaf\xd8\xf3\xf9\xaf\xc5\xad\xc3\x5c\xfd\x43\x3a\x39\xfa\x6f"
"\x7c\x7a\xfa\xa8\xb8\x75\x68\xd1\x3f\xa4\x93\xa3\xff\xbd\x8b\x76\x35\xc4"
"\xad\xc3\x85\xfa\x87\x74\x72\xf4\x7f\xbc\x7d\xd9\x3d\x71\xeb\x30\x4f\xff"
"\x90\x4e\x8e\xfe\x7f\xf3\xc8\xdc\xe6\xb8\x75\x68\xd5\x3f\xa4\x93\xa3\xff"
"\xdd\x8f\xdd\xf1\x83\xb8\x75\x68\xd3\x3f\xa4\x93\xa3\xff\xed\x33\xfe\x70"
"\x75\xdc\x3a\xcc\xd7\x3f\xa4\x93\xa3\xff\xf9\xd7\x5c\xf9\xe3\xb8\x75\x58"
"\xa0\x7f\x48\x27\x47\xff\x93\xbe\xf1\xd1\x6d\x71\xeb\xb0\x50\xff\x90\x4e"
"\x8e\xfe\x57\xfe\xf6\xf9\xa3\x71\xeb\xb0\x48\xff\x90\x4e\x8e\xfe\x9b\xa7"
"\x7c\xea\xc1\xb8\x75\x58\xac\x7f\x48\x27\x47\xff\xd7\xad\xfe\xf5\xbc\xb8"
"\x75\xb8\x48\xff\x90\x4e\x8e\xfe\xaf\xdc\xf5\x93\x2f\xc6\xad\xc3\x12\xfd"
"\x43\x3a\x39\xfa\xaf\x3b\x7a\xc3\x79\x71\xeb\xb0\x54\xff\x90\x4e\x8e\xfe"
"\x9f\x19\x3d\xe6\x85\xb8\x75\xb8\x58\xff\x90\x4e\x8e\xfe\x1f\xea\xbe\x7f"
"\x75\xdc\x3a\x5c\xa2\x7f\x48\x27\x47\xff\xb7\xef\xd8\xfb\xfb\xb8\x75\xb8"
"\x54\xff\x90\x4e\x8e\xfe\x0f\xfe\x7f\xf2\x15\x71\xeb\xb0\x4c\xff\x90\xce"
"\xcd\x5b\xb6\x7e\x7c\x4d\x57\x57\xe7\x26\x2f\xbc\xf0\xc2\x8b\xbe\x17\xa7"
"\xfb\x27\x13\x90\xda\xcb\xd1\x9f\xee\xdf\x09\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x70\x2a\x39\xfe\x73\xa2\xd3\xfd\x67\x04\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x25\x76\xe0\x40\x00\x00"
"\x00\x00\x00\xc8\xff\xb5\x11\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
"\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xb0"
"\x03\x07\x24\x00\x00\x00\x00\x82\xfe\xbf\x6e\x47\xa0\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x54\x00"
"\x00\x00\xff\xff\x4c\x7c\x1e\xed",
38492));
NONFAILING(syz_mount_image(/*fs=*/0x200000009680, /*dir=*/0x2000000096c0,
/*flags=*/0, /*opts=*/0x200000009700, /*chdir=*/1,
/*size=*/0x965c, /*img=*/0x200000009740));
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// flags: open_flags = 0x101042 (4 bytes)
// mode: open_mode = 0x1c6 (2 bytes)
// ]
// returns fd
NONFAILING(memcpy((void*)0x200000000040, "./file1\000", 8));
res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000040ul,
/*flags=O_SYNC|O_CREAT|O_RDWR*/ 0x101042,
/*mode=S_IWOTH|S_IROTH|S_IXUSR|S_IWUSR|S_IRUSR*/ 0x1c6);
if (res != -1)
r[0] = res;
// ioctl$XFS_IOC_ERROR_INJECTION arguments: [
// fd: fd (resource)
// cmd: const = 0x40085874 (4 bytes)
// arg: ptr[in, xfs_error_injection] {
// xfs_error_injection {
// fd: int32 = 0x5 (4 bytes)
// errtag: int32 = 0x9 (4 bytes)
// }
// }
// ]
NONFAILING(*(uint32_t*)0x200000000000 = 5);
NONFAILING(*(uint32_t*)0x200000000004 = 9);
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x40085874,
/*arg=*/0x200000000000ul);
// openat arguments: [
// fd: fd_dir (resource)
// file: ptr[in, buffer] {
// buffer: {2e 2f 66 69 6c 65 31 00} (length 0x8)
// }
// flags: open_flags = 0x42 (4 bytes)
// mode: open_mode = 0x1ff (2 bytes)
// ]
// returns fd
NONFAILING(memcpy((void*)0x200000000040, "./file1\000", 8));
res = syscall(
__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x200000000040ul,
/*flags=O_CREAT|O_RDWR*/ 0x42,
/*mode=S_IXOTH|S_IWOTH|S_IROTH|S_IXGRP|S_IWGRP|S_IRGRP|S_IXUSR|S_IWUSR|0x100*/
0x1ff);
if (res != -1)
r[1] = res;
// ioctl$XFS_IOC_SCRUBV_METADATA arguments: [
// fd: fd (resource)
// cmd: const = 0xc0285840 (4 bytes)
// arg: ptr[inout, xfs_scrub_vec_head] {
// xfs_scrub_vec_head {
// svh_ino: int64 = 0x0 (8 bytes)
// svh_gen: int32 = 0x0 (4 bytes)
// svh_agno: int32 = 0x0 (4 bytes)
// svh_flags: xfs_scrub_vec_head_flags = 0x0 (4 bytes)
// svh_rest_us: int16 = 0xfff9 (2 bytes)
// svh_nr: len = 0x1 (2 bytes)
// svh_reserved: const = 0x0 (8 bytes)
// svh_vectors: ptr[inout, array[xfs_scrub_vec]] {
// array[xfs_scrub_vec] {
// xfs_scrub_vec {
// sv_type: xfs_scrub_type = 0x5 (4 bytes)
// sv_flags: xfs_scrub_flags = 0x101 (4 bytes)
// sv_ret: int32 = 0xfffffff1 (4 bytes)
// sv_reserved: const = 0x0 (4 bytes)
// }
// }
// }
// }
// }
// ]
NONFAILING(*(uint64_t*)0x2000000000c0 = 0);
NONFAILING(*(uint32_t*)0x2000000000c8 = 0);
NONFAILING(*(uint32_t*)0x2000000000cc = 0);
NONFAILING(*(uint32_t*)0x2000000000d0 = 0);
NONFAILING(*(uint16_t*)0x2000000000d4 = 0xfff9);
NONFAILING(*(uint16_t*)0x2000000000d6 = 1);
NONFAILING(*(uint64_t*)0x2000000000d8 = 0);
NONFAILING(*(uint64_t*)0x2000000000e0 = 0x200000002700);
NONFAILING(*(uint32_t*)0x200000002700 = 5);
NONFAILING(*(uint32_t*)0x200000002704 = 0x101);
NONFAILING(*(uint32_t*)0x200000002708 = 0xfffffff1);
NONFAILING(*(uint32_t*)0x20000000270c = 0);
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xc0285840,
/*arg=*/0x2000000000c0ul);
// creat arguments: [
// file: nil
// mode: open_mode = 0x30 (8 bytes)
// ]
// returns fd
syscall(__NR_creat, /*file=*/0ul, /*mode=S_IWGRP|S_IRGRP*/ 0x30ul);
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
/*fd=*/(intptr_t)-1, /*offset=*/0ul);
setup_sysctl();
const char* reason;
(void)reason;
if ((reason = setup_802154()))
printf("the reproducer may not work as expected: 802154 injection setup "
"failed: %s\n",
reason);
install_segv_handler();
use_temporary_dir();
loop();
return 0;
}
[-- Attachment #3: kernel.log --]
[-- Type: application/octet-stream, Size: 227549 bytes --]
[-- Attachment #4: report --]
[-- Type: application/octet-stream, Size: 4393 bytes --]
loop2: detected capacity change from 0 to 32768
XFS (loop2): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
XFS (loop2): Ending clean mount
XFS (loop2): Injecting error at file fs/xfs/libxfs/xfs_btree.c, line 309, on filesystem "loop2"
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
CPU: 0 UID: 0 PID: 12918 Comm: syz.2.25 Not tainted 6.19.0-rc6 #31 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
RSP: 0018:ffffc9000a37f360 EFLAGS: 00010206
RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888011dadc40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88804b59b600
RBP: ffffc9000a37f510 R08: ffffc9000a37f540 R09: 0000000000000002
R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
R13: 1ffff9200146fe88 R14: dffffc0000000000 R15: ffffffff8ba6c880
FS: 00007f141ad1a640(0000) GS:ffff888098fe0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1419f54028 CR3: 000000006763f000 CR4: 0000000000752ef0
PKRU: 00000000
Call Trace:
<TASK>
xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
xrep_revalidate_allocbt+0xf3/0x160 fs/xfs/scrub/alloc_repair.c:930
xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1419db459d
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f141ad19f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f141a045fa0 RCX: 00007f1419db459d
RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
RBP: 00007f1419e52610 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f141a046038 R14: 00007f141a045fa0 R15: 00007f141acfa000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
RSP: 0018:ffffc9000a37f360 EFLAGS: 00010206
RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888011dadc40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88804b59b600
RBP: ffffc9000a37f510 R08: ffffc9000a37f540 R09: 0000000000000002
R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
R13: 1ffff9200146fe88 R14: dffffc0000000000 R15: ffffffff8ba6c880
FS: 00007f141ad1a640(0000) GS:ffff888098fe0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1419f54028 CR3: 000000006763f000 CR4: 0000000000752ef0
PKRU: 00000000
----------------
Code disassembly (best guess):
0: f2 00 66 43 repnz add %ah,0x43(%rsi)
4: c7 44 35 0d f3 f3 43 movl $0xc643f3f3,0xd(%rbp,%rsi,1)
b: c6
c: 44 35 0f f3 e8 1c rex.R xor $0x1ce8f30f,%eax
12: 44 39 fe cmp %r15d,%esi
15: 48 89 5c 24 40 mov %rbx,0x40(%rsp)
1a: 48 83 c3 48 add $0x48,%rbx
1e: 48 89 d8 mov %rbx,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 48 89 44 24 30 mov %rax,0x30(%rsp)
* 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 d6 11 00 00 jne 0x120d
37: 44 0f b6 33 movzbl (%rbx),%r14d
3b: 41 ff ce dec %r14d
3e: bf .byte 0xbf
3f: 53 push %rbx
[-- Attachment #5: repro.syz --]
[-- Type: application/octet-stream, Size: 51859 bytes --]
syz_mount_image$xfs(&(0x7f0000009680), &(0x7f00000096c0)='./file0\x00', 0x0, &(0x7f0000009700), 0x1, 0x965c, &(0x7f0000009740)="$eJzs/Qe4HXWheH+fkEIPXQGJIEV670Wl99679CZNQKVXUQSUZsFCVaSpIAIKIiKoCIIUsaKCCErvvb5PSCIxLrh6//f3cr1rrec52WfPnpn9Pd/P7JmT6MNsuvIGyw8MTDAwqpkGxu2Mk46aa+kDVrrutD0emfj6RQ+7d/TiyUc9jBj9dMSg0Y/jDQwMjDd6P6OXDd/70svGGxjy+vI3mnjCiQZNOjCw0Oiny45+XHzUwxTbjlnvtXEad6Cj3uTwkd8dO+rr9SYb+RYjv9l2t2tGLpt8rO1HbnLNP/2g0jZdbpWV37D6u9tIq6Gjvx/7a9iorym2GBiYYtMBPj7GXnfQ2/AjjXzPZfc//Zqr3ob3/o9r0+VWWW0c/5GfxcGjly0+8jM+7mfQ2LjH+XMnX3XS6CkcNHrOhozzWfmPaNPlVl5z4M3P8wOTHr/14NdGnTfHHxh1oZhwYGBgotHn10nebpf6/9Zyyy+8/Mjz/Zjno9nHHMvL0nEx2yo3HTHy0Bh1nhh+3phrQVVVVf1ntNzyC68A1/8J3ur6v+T5B1zf9b+qquo/t9WWW37hkdf6ca7/k7zV9f+A29fYetS//S+7+KitXn17f4iqqqr6t1p5Nbz+T/5W1/9ljlvrxK7/VVVV/7mtv9br1/9Jxrn+T/1W1/9ZHtrzstHrjfm94ZWxdjlorP894aWxlg8ea/mLYy0fOtZ+xl5/2FjLnx9r+fgjX4P1Jx8YGL736OUvv7F4+OEDAwMzjV7+wljLz3zj/6czYshYy88aa/mwsZafPXqsI5ePP9byc8daf4K3mOqqqqr/Na2/8MorDIz1/7MfvXjaMa/T9f/gK26e/u0ab1VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV1X9irz5y5dVv3PP90IGx7l3993tYj/7vAg66+Jpbb33bBvq/o0H//N9DPPztHtP/10Y6T3DBTAMDe270dg+l3ob+Y+5VX/9Pyt9d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v8xb3J/f+XHfO41d27bjV61SWXv3boPW9sOWJg19HfnXHSUXPt+jaM/W3o/+r9/wd2HTQwMNp38pGWay+3/oZzDAwM3DP02uUXG/j7a0uMfG3pKQcPDH590zle/3PoiDfZ81KjHkYeTANT/30fF7++/9VeO2vwoHEGMVZTXH7OObts+twi4z7O/uY/x3hjvnnxzoMeee211177h4Wjm+BNNh6z/zE/y7jOo8c+x8ixz7/fHnvPv+8BB8676x7b7rzjzjvuudAiiy2+2EJLLLnwovPvtOvuOy4w6s83mbOZXv9z8L8yZ5OMO2ePLDf2nI37s73ZnM301nP2+h4nuHH+ecfM2ZB/c84Gv/WczbTr6DcaMTB0YJvXp2bQwMCIIUMH9h/5ZMHxBwZGDB297rQj111myvEGBk584wcd+d34fz8GBx0+cp1NV95g+TdG9s8/4T9/Tl9v8lEPYyZ/xOg3GTHeqCHONPDGoTh870svG2/kXPzDNE884USDJh0YWGj002VHPy456mGySces99o4jTvQUW8y8twx6NhRX6N2MPItRn7z7FT3zzpyvONs//+i/9b1/5+8lhj094kaNPpr9DqjvJZbZbU33uv1aRg5d4NHL1t8pMm4c/Y/2T+Nd6YhYw4GHO/Kqy2/8MjF48z/mE3w+Dr2oDlvGHVsLbv4qK1e/W+j0HgneYvxrrYcjneStxrvLTPPP/6oXf2PjXecc92ao178V851A299rhtM2+9484hxz3VrvPkQ/+FzPGaOxh9npTc7100+49WHjdz/wFuf69YcOfah/3CuG29gYMTgMee6kSe+YUMHThz5ZKGRT8YfOnDeyCcLv/5kwoFrRj6Zb/u9dt9h5IIJxszJAiP3u+yUg153n2PeE8597ZTXXhsyeixnDv/HsY4+PmYa+3q+3JSjJnPMtmP2O3LVMftddppRrw0bvd+z/o39jtmWxrvqpKNeG3/0fs8eZ79D32K/Y7b9p8/DHIP+fuJ6k/PNyuOcb0b/jjvm7f7ha9iorym2GBiYYlPyHWfd//KcSZ/fCd5ivMstv/AKI8c3zuf374cjfX6HbrfIIQMDA5OO+ngMP2/M2P/NBr3ZeIe89XiXh/EOeavxTnf8EUv/D4x3YKzx/sNxtsSIUcfKBKOPs3P/jeN3zLbjnseGvv7qqNP+BP/KeWymfzqPHTF4vHEme6ze7He2HWD9Ud9P+/e9PTp8rQfHzP3Qcfb7X/3ONtbPMgjOY5OP8/e5QXfcPTCI5nyBcwZt9+p/MedDB/7x7xZj5nzMtm815+P/K3M+w1vP+b/6e/Ics4x6feg44x97zrdZdO+5x8z5sHH2+1/N+fhvfe345zlfdmAozfm6R4+at7c6n77ZnI/Zdsycv+4/5ZCBlQYGBmYdPefD/pU5n/Z/5jifCNYf9f2Of190zAaPzTNmzsed4/9qzof9u3M+09+P81lff23m8QaGDRvYf9v99ttnwVF/jnm60Kg/+Vx03pGj5vmtrqVvZjRm27f6XAz5V4wm/5eMBv1XRtMPeTOjNz5aW9/19IH/3XPRkH/XaIDPRbdeNGre3ur3ojeb8zHb0nVw6rG2H/fvoeuv9frv3ZOMcx0cswleB29fa7btx+xy9GavjDPMMdfVl8ZaPnis5S+OtXzoWPsZe/1hYy1/fqzlI3+EYWOtP4Z18pF/5x29/OU3Vh8+8i+pM41e/sJYy898Y9sRY/2TwfCzxlo+1ily+NlvHBojxvq1e/i5Y63/ZofKmzbm3yR3HfckX/9q/fu/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5i3uT+/8fPvpx2fO33Xr70beTG3rf8cNPfbvH+zb3f/r+/6N9/+H+/6cOP/6+8Qb+/tpb3p991Dr/K+/Pvviohym2HbPeuPcHH3ego97kze/PvvMtV+/x/6f7s/+3GvNZ/Rfui9f5313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5S/uTe7/f83ox8NPnPLSYaNvhD502lunePHtHu/b3P/p+/+P9v2H+/+/OMWt04438PfX3vL+/6PWcdz//9gzph/+v/n+/2M+q93/v/6L8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/cXz//0GjHweuWWXYJbeNfBz5/MJ9Xj7n7R7v29z/1fv/T3DBTAMDe270dg+l3oY6/7vL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zFjb7//8Co+/+PadCyHRcY3P//P7s38V8uf8ziv3z+mMV/hfwxi/+K+WMW/5Xyxyz+K+ePWfxXyR+z+K+aP2bxXy1/zOK/ev6YxX+N/DGL/5r5Yxb/tfLHLP5r549Z/NfJH7P4r5s/ZvFfL3/M4r9+/pjFf4P8MYv/hvljFv+N8scs/hvnj1n8N8kfs/hvmj9m8d8sf8ziv3n+mMV/i/wxi/+W+WMW/63yxyz+W+ePWfw/mD9m8d8mf8ziv23+mMV/u/wxi//2+WMW/x3yxyz+O+aPWfx3yh+z+O+cP2bx3yV/zOK/a/6YxX+3/DGL/4fyxyz+u+ePWfz3yB+z+O+ZP2bx3yt/zOK/d/6Yxf/D+WMW/33yxyz+++aPWfz3yx+z+H8kf8zi/9H8MYv/x/LHLP77549Z/A/IH7P4H5g/ZvE/KH/M4n9w/pjF/5D8MYv/ofljFv/D8scs/ofnj1n8j8gfs/gfmT9m8T8qf8zi//H8MYv/0fljFv9P5I9Z/D+ZP2bxPyZ/zOL/qfwxi/+x+WMW/+Pyxyz+x+ePWfw/nT9m8f9M/pjF/4T8MYv/ifljFv+T8scs/ifnj1n8T8kfs/h/Nn/M4v+5/DGL/+fzxyz+X8gfs/ifmj9m8f9i/pjF/0v5Yxb/L+ePWfy/kj9m8T8tf8zif3r+mMX/jPwxi/+Z+WMW/7Pyxyz+Z+ePWfy/mj9m8f9a/pjF/5z8MYv/1/PHLP7n5o9Z/M/LH7P4n58/ZvG/IH/M4n9h/pjF/xv5Yxb/b+aPWfy/lT9m8b8of8zif3H+mMX/2/ljFv9L8scs/t/JH7P4X5o/ZvG/LH/M4n95/pjF/7v5Yxb/7+WPWfyvyB+z+F+ZP2bx/37+mMX/qvwxi/8P8scs/lfnj1n8f5g/ZvG/Jn/M4v+j/DGL/7X5Yxb/6/LHLP4/zh+z+P8kf8zi/9P8MYv/9fljFv+f5Y9Z/G/IH7P435g/ZvH/ef6Yxf+m/DGL/835Yxb/X+SPWfxvyR+z+N+aP2bxvy1/zOJ/e/6Yxf+X+WMW/zvyxyz+v8ofs/j/On/M4v+b/DGL/2/zxyz+v8sfs/j/Pn/M4n9n/pjF/w/5Yxb/P+aPWfz/lD9m8b8rf8zif3f+mMX/z/ljFv978scs/n/JH7P435s/ZvG/L3/M4v/X/DGL/9/yxyz+9+ePWfwfyB+z+D+YP2bxfyh/zOL/cP6Yxf+R/DGL/6P5Yxb/x/LHLP6P549Z/J/IH7P4P5k/ZvF/Kn/M4v90/pjF/5n8MYv/s/ljFv/n8scs/s/nj1n8X8gfs/i/mD9m8X8pf8zi/3L+mMX/lfwxi/+r+WMW/9fyxyT+r3+b/z9n8R+UP2bxHy9/zOI/OH/M4j8kf8ziPzR/zOI/LH/M4j9+/pjFf4L8MYv/hPljFv+J8scs/hPnj1n8J8kfs/hPmj9m8R+eP2bxnyx/zOI/ef6YxX+K/DGL/5T5Yxb/qfLHLP5T549Z/KfJH7P4vyN/zOL/zvwxi/+0+WMW/+nyxyz+0+ePWfzflT9m8Z8hf8ziPyJ/zOL/7vwxi/+M+WMW/5nyxyz+78kfs/jPnD9m8Z8lf8ziP2v+mMV/tvwxi/9788cs/rPnj1n858gfs/jPmT9m8Z8rf8ziP3f+mMV/nvwxi/+8+WMW//nyxyz+8+ePWfwXyB+z+C+YP2bxXyh/zOK/cP6YxX+R/DGL/6L5Yxb/xfLHLP6L549Z/JfIH7P4L5k/ZvFfKn/M4r90/pjFf5n8MYv/+/LHLP7vzx+z+H8gf8ziv2z+mMV/ufwxi//y+WMW/xXyxyz+K+aPWfxXyh+z+K+cP2bxXyV/zOK/av6YxX+1/DGL/+r5Yxb/NfLHLP5r5o9Z/NfKH7P4r50/ZvFfJ3/M4r9u/pjFf738MYv/+vljFv8N8scs/hvmj1n8N8ofs/hvnD9m8d8kf8ziv2n+mMV/s/wxi//m+WMW/y3yxyz+W+aPWfy3yh+z+G+dP2bx/2D+mMV/m/wxi/+2+WMW/+3yxyz+2+ePWfx3yB+z+O+YP2bx3yl/zOK/c/6YxX+X/DGL/675Yxb/3fLHLP4fyh+z+O+eP2bx3yN/zOK/Z/6YxX+v/DGL/975Yxb/D+ePWfz3yR+z+O+bP2bx3y9/zOL/kfwxi/9H88cs/h/LH7P4758/ZvE/IH/M4n9g/pjF/6D8MYv/wfljFv9D8scs/ofmj1n8D8sfs/gfnj9m8T8if8zif2T+mMX/qPwxi//H88cs/kfnj1n8P5E/ZvH/ZP6Yxf+Y/DGL/6fyxyz+x+aPWfyPyx+z+B+fP2bx/3T+mMX/M/ljFv8T8scs/ifmj1n8T8ofs/ifnD9m8T8lf8zi/9n8MYv/5/LHLP6fzx+z+H8hf8zif2r+mMX/i/ljFv8v5Y9Z/L+cP2bx/0r+mMX/tPwxi//p+WMW/zPyxyz+Z+aPWfzPyh+z+J+dP2bx/2r+mMX/a/ljFv9z8scs/l/PH7P4n5s/ZvE/L3/M4n9+/pjF/4L8MYv/hfljFv9v5I9Z/L+ZP2bx/1b+mMX/ovwxi//F+WMW/2/nj1n8L8kfs/h/J3/M4n9p/pjF/7L8MYv/5fljFv/v5o9Z/L+XP2bxvyJ/zOJ/Zf6Yxf/7+WMW/6vyxyz+P8gfs/hfnT9m8f9h/pjF/5r8MYv/j/LHLP7X5o9Z/K/LH7P4/zh/zOL/k/wxi/9P88cs/tfnj1n8f5Y/ZvG/IX/M4n9j/pjF/+f5Yxb/m/LHLP43549Z/H+RP2bxvyV/zOJ/a/6Yxf+2/DGL/+35Yxb/X+aPWfzvyB+z+P8qf8zi/+v8MYv/b/LHLP6/zR+z+P8uf8zi//v8MYv/nfljFv8/5I9Z/P+YP2bx/1P+mMX/rvwxi//d+WMW/z/nj1n878kfs/j/JX/M4n9v/pjF/778MYv/X/PHLP5/yx+z+N+fP2bxfyB/zOL/YP6Yxf+h/DGL/8P5Yxb/R/LHLP6P5o9Z/B/LH7P4P54/ZvF/In/M4v9k/pjF/6n8MYv/0/ljFv9n8scs/s/mj1n8n8sfs/g/nz9m8X8hf8zi/2L+mMX/pfwxi//L+WMW/1fyxyz+r+aPWfxfyx+T+A8eyB+z+A/KH7P4j5c/ZvEfnD9m8R+SP2bxH5o/ZvEflj9m8R8/f8ziP0H+mMV/wvwxi/9E+WMW/4nzxyz+k+SPWfwnzR+z+A/PH7P4T5Y/ZvGfPH/M4j9F/pjFf8r8MYv/VPljFv+p88cs/tPkj1n835E/ZvF/Z/6YxX/a/DGL/3T5Yxb/6fPHLP7vyh+z+M+QP2bxH5E/ZvF/d/6YxX/G/DGL/0z5Yxb/9+SPWfxnzh+z+M+SP2bxnzV/zOI/W/6Yxf+9+WMW/9nzxyz+c+SPWfznzB+z+M+VP2bxnzt/zOI/T/6YxX/e/DGL/3z5Yxb/+fPHLP4L5I9Z/BfMH7P4L5Q/ZvFfOH/M4r9I/pjFf9H8MYv/YvljFv/F88cs/kvkj1n8l8wfs/gvlT9m8V86f8ziv0z+mMX/ffljFv/3549Z/D+QP2bxXzZ/zOK/XP6YxX/5/DGL/wr5Yxb/FfPHLP4r5Y9Z/FfOH7P4r5I/ZvFfNX/M4r9a/pjFf/X8MYv/GvljFv8188cs/mvlj1n8184fs/ivkz9m8V83f8ziv17+mMV//fwxi/8G+WMW/w3zxyz+G+WPWfw3zh+z+G+SP2bx3zR/zOK/Wf6YxX/z/DGL/xb5Yxb/LfPHLP5b5Y9Z/LfOH7P4fzB/zOK/Tf6YxX/b/DGL/3b5Yxb/7fPHLP475I9Z/HfMH7P475Q/ZvHfOX/M4r9L/pjFf9f8MYv/bvljFv8P5Y9Z/HfPH7P475E/ZvHfM3/M4r9X/pjFf+/8MYv/h/PHLP775I9Z/PfNH7P475c/ZvH/SP6Yxf+j+WMW/4/lj1n8988fs/gfkD9m8T8wf8zif1D+mMX/4Pwxi/8h+WMW/0Pzxyz+h+WPWfwPzx+z+B+RP2bxPzJ/zOJ/VP6Yxf/j+WMW/6Pzxyz+n8gfs/h/Mn/M4n9M/pjF/1P5Yxb/Y/PHLP7H5Y9Z/I/PH7P4fzp/zOL/mfwxi/8J+WMW/xPzxyz+J+WPWfxPzh+z+J+SP2bx/2z+mMX/c/ljFv/P549Z/L+QP2bxPzV/zOL/xfwxi/+X8scs/l/OH7P4fyV/zOJ/Wv6Yxf/0/DGL/xn5Yxb/M/PHLP5n5Y9Z/M/OH7P4fzV/zOL/tfwxi/85+WMW/6/nj1n8z80fs/iflz9m8T8/f8zif0H+mMX/wvwxi/838scs/t/MH7P4fyt/zOJ/Uf6Yxf/i/DGL/7fzxyz+l+SPWfy/kz9m8b80f8zif1n+mMX/8vwxi/9388cs/t/LH7P4X5E/ZvG/Mn/M4v/9/DGL/1X5Yxb/H+SPWfyvzh+z+P8wf8zif03+mMX/R/ljFv9r88cs/tflj1n8f5w/ZvH/Sf6Yxf+n+WMW/+vzxyz+P8sfs/jfkD9m8b8xf8zi//P8MYv/TfljFv+b88cs/r/IH7P435I/ZvG/NX/M4n9b/pjF//b8MYv/L/PHLP535I9Z/H+VP2bx/3X+mMX/N/ljFv/f5o9Z/H+XP2bx/33+mMX/zvwxi/8f8scs/n/MH7P4/yl/zOJ/V/6Yxf/u/DGL/5/zxyz+9+SPWfz/kj9m8b83f8zif1/+mMX/r/ljFv+/5Y9Z/O/PH7P4P5A/ZvF/MH/M4v9Q/pjF/+H8MYv/I/ljFv9H88cs/o/lj1n8H88fs/g/kT9m8X8yf8zi/1T+mMX/6fwxi/8z+WMW/2fzxyz+z+WPWfyfzx+z+L+QP2bxfzF/zOL/Uv6Yxf/l/DGL/yv5Yxb/V/PHLP6v5Y9J/IcM5I9Z/Aflj1n8x8sfs/gPzh+z+A/JH7P4D80fs/gPyx+z+I+fP2bxnyB/zOI/Yf6YxX+i/DGL/8T5Yxb/SfLHLP6T5o9Z/Ifnj1n8J8sfs/hPnj9m8Z8if8ziP2X+mMV/qvwxi//U+WMW/2nyxyz+78gfs/i/M3/M4j9t/pjFf7r8MYv/9PljFv935Y9Z/GfIH7P4j8gfs/i/O3/M4j9j/pjFf6b8MYv/e/LHLP4z549Z/GfJH7P4z5o/ZvGfLX/M4v/e/DGL/+z5Yxb/OfLHLP5z5o9Z/OfKH7P4z50/ZvGfJ3/M4j9v/pjFf778MYv//PljFv8F8scs/gvmj1n8F8ofs/gvnD9m8V8kf8ziv2j+mMV/sfwxi//i+WMW/yXyxyz+S+aPWfyXyh+z+C+dP2bxXyZ/zOL/vvwxi//788cs/h/IH7P4L5s/ZvFfLn/M4r98/pjFf4X8MYv/ivljFv+V8scs/ivnj1n8V8kfs/ivmj9m8V8tf8ziv3r+mMV/jfwxi/+a+WMW/7Xyxyz+a+ePWfzXyR+z+K+bP2bxXy9/zOK/fv6YxX+D/DGL/4b5Yxb/jfLHLP4b549Z/DfJH7P4b5o/ZvHfLH/M4r95/pjFf4v8MYv/lvljFv+t8scs/lvnj1n8P5g/ZvHfJn/M4r9t/pjFf7v8MYv/9vljFv8d8scs/jvmj1n8d8ofs/jvnD9m8d8lf8ziv2v+mMV/t/wxi/+H8scs/rvnj1n898gfs/jvmT9m8d8rf8ziv3f+mMX/w/ljFv998scs/vvmj1n898sfs/h/JH/M4v/R/DGL/8fyxyz+++ePWfwPyB+z+B+YP2bxPyh/zOJ/cP6Yxf+Q/DGL/6H5Yxb/w/LHLP6H549Z/I/IH7P4H5k/ZvE/Kn/M4v/x/DGL/9H5Yxb/T+SPWfw/mT9m8T8mf8zi/6n8MYv/sfljFv/j8scs/sfnj1n8P50/ZvH/TP6Yxf+E/DGL/4n5Yxb/k/LHLP4n549Z/E/JH7P4fzZ/zOL/ufwxi//n88cs/l/IH7P4n5o/ZvH/Yv6Yxf9L+WMW/y/nj1n8v5I/ZvE/LX/M4n96/pjF/4z8MYv/mfljFv+z8scs/mfnj1n8v5o/ZvH/Wv6Yxf+c/DGL/9fzxyz+5+aPWfzPyx+z+J+fP2bxvyB/zOJ/Yf6Yxf8b+WMW/2/mj1n8v5U/ZvG/KH/M4n9x/pjF/9v5Yxb/S/LHLP7fyR+z+F+aP2bxvyx/zOJ/ef6Yxf+7+WMW/+/lj1n8r8gfs/hfmT9m8f9+/pjF/6r8MYv/D/LHLP5X549Z/H+YP2bxvyZ/zOL/o/wxi/+1+WMW/+vyxyz+P84fs/j/JH/M4v/T/DGL//X5Yxb/n+WPWfxvyB+z+N+YP2bx/3n+mMX/pvwxi//N+WMW/1/kj1n8b8kfs/jfmj9m8b8tf8zif3v+mMX/l/ljFv878scs/r/KH7P4/zp/zOL/m/wxi/9v88cs/r/LH7P4/z5/zOJ/Z/6Yxf8P+WMW/z/mj1n8/5Q/ZvG/K3/M4n93/pjF/8/5Yxb/e/LHLP5/yR+z+N+bP2bxvy9/zOL/1/wxi//f8scs/vfnj1n8H8gfs/g/mD9m8X8of8zi/3D+mMX/kfwxi/+j+WMW/8fyxyz+j+ePWfyfyB+z+D+ZP2bxfyp/zOL/dP6Yxf+Z/DGL/7P5Yxb/5/LHLP7P549Z/F/IH7P4v5g/ZvF/KX/M4v9y/pjF/5X8MYv/q/ljFv/X8sck/kMH8scs/oPyxyz+4+WPWfwH549Z/Ifkj1n8h+aPWfyH5Y9Z/MfPH7P4T5A/ZvGfMH/M4j9R/pjFf+L8MYv/JPljFv9J88cs/sPzxyz+k+WPWfwnzx+z+E+RP2bxnzJ/zOI/Vf6YxX/q/DGL/zT5Yxb/d+SPWfzfmT9m8Z82f8ziP13+mMV/+vwxi/+78scs/jPkj1n8R+SPWfzfnT9m8Z8xf8ziP1P+mMX/PfljFv+Z88cs/rPkj1n8Z80fs/jPlj9m8X9v/pjFf/b8MYv/HPljFv8588cs/nPlj1n8584fs/jPkz9m8Z83f8ziP1/+mMV//vwxi/8C+WMW/wXzxyz+C+WPWfwXzh+z+C+SP2bxXzR/zOK/WP6YxX/x/DGL/xL5Yxb/JfPHLP5L5Y9Z/JfOH7P4L5M/ZvF/X/6Yxf/9+WMW/w/kj1n8l80fs/gvlz9m8V8+f8ziv0L+mMV/xfwxi/9K+WMW/5Xzxyz+q+SPWfxXzR+z+K+WP2bxXz1/zOK/Rv6YxX/N/DGL/1r5Yxb/tfPHLP7r5I9Z/NfNH7P4r5c/ZvFfP3/M4r9B/pjFf8P8MYv/RvljFv+N88cs/pvkj1n8N80fs/hvlj9m8d88f8ziv0X+mMV/y/wxi/9W+WMW/63zxyz+H8wfs/hvkz9m8d82f8ziv13+mMV/+/wxi/8O+WMW/x3zxyz+O+WPWfx3zh+z+O+SP2bx3zV/zOK/W/6Yxf9D+WMW/93zxyz+e+SPWfz3zB+z+O+VP2bx3zt/zOL/4fwxi/8++WMW/33zxyz+++WPWfw/kj9m8f9o/pjF/2P5Yxb//fPHLP4H5I9Z/A/MH7P4H5Q/ZvE/OH/M4n9I/pjF/9D8MYv/YfljFv/D88cs/kfkj1n8j8wfs/gflT9m8f94/pjF/+j8MYv/J/LHLP6fzB+z+B+TP2bx/1T+mMX/2Pwxi/9x+WMW/+Pzxyz+n84fs/h/Jn/M4n9C/pjF/8T8MYv/SfljFv+T88cs/qfkj1n8P5s/ZvH/XP6Yxf/z+WMW/y/kj1n8T80fs/h/MX/M4v+l/DGL/5fzxyz+X8kfs/iflj9m8T89f8zif0b+mMX/zPwxi/9Z+WMW/7Pzxyz+X80fs/h/LX/M4n9O/pjF/+v5Yxb/c/PHLP7n5Y9Z/M/PH7P4X5A/ZvG/MH/M4v+N/DGL/zfzxyz+38ofs/hflD9m8b84f8zi/+38MYv/JfljFv/v5I9Z/C/NH7P4X5Y/ZvG/PH/M4v/d/DGL//fyxyz+V+SPWfyvzB+z+H8/f8zif1X+mMX/B/ljFv+r88cs/j/MH7P4X5M/ZvH/Uf6Yxf/a/DGL/3X5Yxb/H+ePWfx/kj9m8f9p/pjF//r8MYv/z/LHLP435I9Z/G/MH7P4/zx/zOJ/U/6Yxf/m/DGL/y/yxyz+t+SPWfxvzR+z+N+WP2bxvz1/zOL/y/wxi/8d+WMW/1/lj1n8f50/ZvH/Tf6Yxf+3+WMW/9/lj1n8f58/ZvG/M3/M4v+H/DGL/x/zxyz+f8ofs/jflT9m8b87f8zi/+f8MYv/PfljFv+/5I9Z/O/NH7P435c/ZvH/a/6Yxf9v+WMW//vzxyz+D+SPWfwfzB+z+D+UP2bxfzh/zOL/SP6Yxf/R/DGL/2P5Yxb/x/PHLP5P5I9Z/J/MH7P4P5U/ZvF/On/M4v9M/pjF/9n8MYv/c/ljFv/n88cs/i/kj1n8X8wfs/i/lD9m8X85f8zi/0r+mMX/1fwxi/9r+WMS/2ED+WMW/0H5Yxb/8fLHLP6D88cs/kPyxyz+Q/PHLP7D8scs/uPnj1n8J8gfs/hPmD9m8Z8of8ziP3H+mMV/kvwxi/+k+WMW/+H5Yxb/yfLHLP6T549Z/KfIH7P4T5k/ZvGfKn/M4j91/pjFf5r8MYv/O/LHLP7vzB+z+E+bP2bxny5/zOI/ff6Yxf9d+WMW/xnyxyz+I/LHLP7vzh+z+M+YP2bxnyl/zOL/nvwxi//M+WMW/1nyxyz+s+aPWfxnyx+z+L83f8ziP3v+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/hfLHLP4L549Z/BfJH7P4L5o/ZvFfLH/M4r94/pjFf4n8MYv/kvljFv+l8scs/kvnj1n8l8kfs/i/L3/M4v/+/DGL/wfyxyz+y+aPWfyXyx+z+C+fP2bxXyF/zOK/Yv6YxX+l/DGL/8r5Yxb/VfLHLP6r5o9Z/FfLH7P4r54/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n818sfs/ivnz9m8d8gf8ziv2H+mMV/o/wxi//G+WMW/03yxyz+m+aPWfw3yx+z+G+eP2bx3yJ/zOK/Zf6YxX+r/DGL/9b5Yxb/D+aPWfy3yR+z+G+bP2bx3y5/zOK/ff6YxX+H/DGL/475Yxb/nfLHLP47549Z/HfJH7P475o/ZvHfLX/M4v+h/DGL/+75Yxb/PfLHLP575o9Z/PfKH7P4750/ZvH/cP6YxX+f/DGL/775Yxb//fLHLP4fyR+z+H80f8zi/7H8MYv//vljFv8D8scs/gfmj1n8D8ofs/gfnD9m8T8kf8zif2j+mMX/sPwxi//h+WMW/yPyxyz+R+aPWfyPyh+z+H88f8zif3T+mMX/E/ljFv9P5o9Z/I/JH7P4fyp/zOJ/bP6Yxf+4/DGL//H5Yxb/T+ePWfw/kz9m8T8hf8zif2L+mMX/pPwxi//J+WMW/1Pyxyz+n80fs/h/Ln/M4v/5/DGL/xfyxyz+p+aPWfy/mD9m8f9S/pjF/8v5Yxb/r+SPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/r+aPWfy/lj9m8T8nf8zi//X8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8f9G/pjF/5v5Yxb/b+WPWfwvyh+z+F+cP2bx/3b+mMX/kvwxi/938scs/pfmj1n8L8sfs/hfnj9m8f9u/pjF/3v5Yxb/K/LHLP5X5o9Z/L+fP2bxvyp/zOL/g/wxi//V+WMW/x/mj1n8r8kfs/j/KH/M4n9t/pjF/7r8MYv/j/PHLP4/yR+z+P80f8zif33+mMX/Z/ljFv8b8scs/jfmj1n8f54/ZvG/KX/M4n9z/pjF/xf5Yxb/W/LHLP635o9Z/G/LH7P4354/ZvH/Zf6Yxf+O/DGL/6/yxyz+v84fs/j/Jn/M4v/b/DGL/+/yxyz+v88fs/jfmT9m8f9D/pjF/4/5Yxb/P+WPWfzvyh+z+N+dP2bx/3P+mMX/nvwxi/9f8scs/vfmj1n878sfs/j/NX/M4v+3/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cP2bxfyV/zOL/av6Yxf+1/DGJ//gD+WMW/0H5Yxb/8fLHLP6D88cs/kPyxyz+Q/PHLP7D8scs/uPnj1n8J8gfs/hPmD9m8Z8of8ziP3H+mMV/kvwxi/+k+WMW/+H5Yxb/yfLHLP6T549Z/KfIH7P4T5k/ZvGfKn/M4j91/pjFf5r8MYv/O/LHLP7vzB+z+E+bP2bxny5/zOI/ff6Yxf9d+WMW/xnyxyz+I/LHLP7vzh+z+M+YP2bxnyl/zOL/nvwxi//M+WMW/1nyxyz+s+aPWfxnyx+z+L83f8ziP3v+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/hfLHLP4L549Z/BfJH7P4L5o/ZvFfLH/M4r94/pjFf4n8MYv/kvljFv+l8scs/kvnj1n8l8kfs/i/L3/M4v/+/DGL/wfyxyz+y+aPWfyXyx+z+C+fP2bxXyF/zOK/Yv6YxX+l/DGL/8r5Yxb/VfLHLP6r5o9Z/FfLH7P4r54/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n818sfs/ivnz9m8d8gf8ziv2H+mMV/o/wxi//G+WMW/03yxyz+m+aPWfw3yx+z+G+eP2bx3yJ/zOK/Zf6YxX+r/DGL/9b5Yxb/D+aPWfy3yR+z+G+bP2bx3y5/zOK/ff6YxX+H/DGL/475Yxb/nfLHLP47549Z/HfJH7P475o/ZvHfLX/M4v+h/DGL/+75Yxb/PfLHLP575o9Z/PfKH7P4750/ZvH/cP6YxX+f/DGL/775Yxb//fLHLP4fyR+z+H80f8zi/7H8MYv//vljFv8D8scs/gfmj1n8D8ofs/gfnD9m8T8kf8zif2j+mMX/sPwxi//h+WMW/yPyxyz+R+aPWfyPyh+z+H88f8zif3T+mMX/E/ljFv9P5o9Z/I/JH7P4fyp/zOJ/bP6Yxf+4/DGL//H5Yxb/T+ePWfw/kz9m8T8hf8zif2L+mMX/pPwxi//J+WMW/1Pyxyz+n80fs/h/Ln/M4v/5/DGL/xfyxyz+p+aPWfy/mD9m8f9S/pjF/8v5Yxb/r+SPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/r+aPWfy/lj9m8T8nf8zi//X8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8f9G/pjF/5v5Yxb/b+WPWfwvyh+z+F+cP2bx/3b+mMX/kvwxi/938scs/pfmj1n8L8sfs/hfnj9m8f9u/pjF/3v5Yxb/K/LHLP5X5o9Z/L+fP2bxvyp/zOL/g/wxi//V+WMW/x/mj1n8r8kfs/j/KH/M4n9t/pjF/7r8MYv/j/PHLP4/yR+z+P80f8zif33+mMX/Z/ljFv8b8scs/jfmj1n8f54/ZvG/KX/M4n9z/pjF/xf5Yxb/W/LHLP635o9Z/G/LH7P4354/ZvH/Zf6Yxf+O/DGL/6/yxyz+v84fs/j/Jn/M4v/b/DGL/+/yxyz+v88fs/jfmT9m8f9D/pjF/4/5Yxb/P+WPWfzvyh+z+N+dP2bx/3P+mMX/nvwxi/9f8scs/vfmj1n878sfs/j/NX/M4v+3/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cP2bxfyV/zOL/av6Yxf+1/DGJ/wQD+WMW/0H5Yxb/8fLHLP6D88cs/kPyxyz+Q/PHLP7D8scs/uPnj1n8J8gfs/hPmD9m8Z8of8ziP3H+mMV/kvwxi/+k+WMW/+H5Yxb/yfLHLP6T549Z/KfIH7P4T5k/ZvGfKn/M4j91/pjFf5r8MYv/O/LHLP7vzB+z+E+bP2bxny5/zOI/ff6Yxf9d+WMW/xnyxyz+I/LHLP7vzh+z+M+YP2bxnyl/zOL/nvwxi//M+WMW/1nyxyz+s+aPWfxnyx+z+L83f8ziP3v+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/hfLHLP4L549Z/BfJH7P4L5o/ZvFfLH/M4r94/pjFf4n8MYv/kvljFv+l8scs/kvnj1n8l8kfs/i/L3/M4v/+/DGL/wfyxyz+y+aPWfyXyx+z+C+fP2bxXyF/zOK/Yv6YxX+l/DGL/8r5Yxb/VfLHLP6r5o9Z/FfLH7P4r54/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n818sfs/ivnz9m8d8gf8ziv2H+mMV/o/wxi//G+WMW/03yxyz+m+aPWfw3yx+z+G+eP2bx3yJ/zOK/Zf6YxX+r/DGL/9b5Yxb/D+aPWfy3yR+z+G+bP2bx3y5/zOK/ff6YxX+H/DGL/475Yxb/nfLHLP47549Z/HfJH7P475o/ZvHfLX/M4v+h/DGL/+75Yxb/PfLHLP575o9Z/PfKH7P4750/ZvH/cP6YxX+f/DGL/775Yxb//fLHLP4fyR+z+H80f8zi/7H8MYv//vljFv8D8scs/gfmj1n8D8ofs/gfnD9m8T8kf8zif2j+mMX/sPwxi//h+WMW/yPyxyz+R+aPWfyPyh+z+H88f8zif3T+mMX/E/ljFv9P5o9Z/I/JH7P4fyp/zOJ/bP6Yxf+4/DGL//H5Yxb/T+ePWfw/kz9m8T8hf8zif2L+mMX/pPwxi//J+WMW/1Pyxyz+n80fs/h/Ln/M4v/5/DGL/xfyxyz+p+aPWfy/mD9m8f9S/pjF/8v5Yxb/r+SPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/r+aPWfy/lj9m8T8nf8zi//X8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8f9G/pjF/5v5Yxb/b+WPWfwvyh+z+F+cP2bx/3b+mMX/kvwxi/938scs/pfmj1n8L8sfs/hfnj9m8f9u/pjF/3v5Yxb/K/LHLP5X5o9Z/L+fP2bxvyp/zOL/g/wxi//V+WMW/x/mj1n8r8kfs/j/KH/M4n9t/pjF/7r8MYv/j/PHLP4/yR+z+P80f8zif33+mMX/Z/ljFv8b8scs/jfmj1n8f54/ZvG/KX/M4n9z/pjF/xf5Yxb/W/LHLP635o9Z/G/LH7P4354/ZvH/Zf6Yxf+O/DGL/6/yxyz+v84fs/j/Jn/M4v/b/DGL/+/yxyz+v88fs/jfmT9m8f9D/pjF/4/5Yxb/P+WPWfzvyh+z+N+dP2bx/3P+mMX/nvwxi/9f8scs/vfmj1n878sfs/j/NX/M4v+3/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cP2bxfyV/zOL/av6Yxf+1/DGJ/4QD+WMW/0H5Yxb/8fLHLP6D88cs/kPyxyz+Q/PHLP7D8scs/uPnj1n8J8gfs/hPmD9m8Z8of8ziP3H+mMV/kvwxi/+k+WMW/+H5Yxb/yfLHLP6T549Z/KfIH7P4T5k/ZvGfKn/M4j91/pjFf5r8MYv/O/LHLP7vzB+z+E+bP2bxny5/zOI/ff6Yxf9d+WMW/xnyxyz+I/LHLP7vzh+z+M+YP2bxnyl/zOL/nvwxi//M+WMW/1nyxyz+s+aPWfxnyx+z+L83f8ziP3v+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/hfLHLP4L549Z/BfJH7P4L5o/ZvFfLH/M4r94/pjFf4n8MYv/kvljFv+l8scs/kvnj1n8l8kfs/i/L3/M4v/+/DGL/wfyxyz+y+aPWfyXyx+z+C+fP2bxXyF/zOK/Yv6YxX+l/DGL/8r5Yxb/VfLHLP6r5o9Z/FfLH7P4r54/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n818sfs/ivnz9m8d8gf8ziv2H+mMV/o/wxi//G+WMW/03yxyz+m+aPWfw3yx+z+G+eP2bx3yJ/zOK/Zf6YxX+r/DGL/9b5Yxb/D+aPWfy3yR+z+G+bP2bx3y5/zOK/ff6YxX+H/DGL/475Yxb/nfLHLP47549Z/HfJH7P475o/ZvHfLX/M4v+h/DGL/+75Yxb/PfLHLP575o9Z/PfKH7P4750/ZvH/cP6YxX+f/DGL/775Yxb//fLHLP4fyR+z+H80f8zi/7H8MYv//vljFv8D8scs/gfmj1n8D8ofs/gfnD9m8T8kf8zif2j+mMX/sPwxi//h+WMW/yPyxyz+R+aPWfyPyh+z+H88f8zif3T+mMX/E/ljFv9P5o9Z/I/JH7P4fyp/zOJ/bP6Yxf+4/DGL//H5Yxb/T+ePWfw/kz9m8T8hf8zif2L+mMX/pPwxi//J+WMW/1Pyxyz+n80fs/h/Ln/M4v/5/DGL/xfyxyz+p+aPWfy/mD9m8f9S/pjF/8v5Yxb/r+SPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/r+aPWfy/lj9m8T8nf8zi//X8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8f9G/pjF/5v5Yxb/b+WPWfwvyh+z+F+cP2bx/3b+mMX/kvwxi/938scs/pfmj1n8L8sfs/hfnj9m8f9u/pjF/3v5Yxb/K/LHLP5X5o9Z/L+fP2bxvyp/zOL/g/wxi//V+WMW/x/mj1n8r8kfs/j/KH/M4n9t/pjF/7r8MYv/j/PHLP4/yR+z+P80f8zif33+mMX/Z/ljFv8b8scs/jfmj1n8f54/ZvG/KX/M4n9z/pjF/xf5Yxb/W/LHLP635o9Z/G/LH7P4354/ZvH/Zf6Yxf+O/DGL/6/yxyz+v84fs/j/Jn/M4v/b/DGL/+/yxyz+v88fs/jfmT9m8f9D/pjF/4/5Yxb/P+WPWfzvyh+z+N+dP2bx/3P+mMX/nvwxi/9f8scs/vfmj1n878sfs/j/NX/M4v+3/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cP2bxfyV/zOL/av6Yxf+1/DGJ/0QD+WMW/0H5Yxb/8fLHLP6D88cs/kPyxyz+Q/PHLP7D8scs/uPnj1n8J8gfs/hPmD9m8Z8of8ziP3H+mMV/kvwxi/+k+WMW/+H5Yxb/yfLHLP6T549Z/KfIH7P4T5k/ZvGfKn/M4j91/pjFf5r8MYv/O/LHLP7vzB+z+E+bP2bxny5/zOI/ff6Yxf9d+WMW/xnyxyz+I/LHLP7vzh+z+M+YP2bxnyl/zOL/nvwxi//M+WMW/1nyxyz+s+aPWfxnyx+z+L83f8ziP3v+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/hfLHLP4L549Z/BfJH7P4L5o/ZvFfLH/M4r94/pjFf4n8MYv/kvljFv+l8scs/kvnj1n8l8kfs/i/L3/M4v/+/DGL/wfyxyz+y+aPWfyXyx+z+C+fP2bxXyF/zOK/Yv6YxX+l/DGL/8r5Yxb/VfLHLP6r5o9Z/FfLH7P4r54/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n818sfs/ivnz9m8d8gf8ziv2H+mMV/o/wxi//G+WMW/03yxyz+m+aPWfw3yx+z+G+eP2bx3yJ/zOK/Zf6YxX+r/DGL/9b5Yxb/D+aPWfy3yR+z+G+bP2bx3y5/zOK/ff6YxX+H/DGL/475Yxb/nfLHLP47549Z/HfJH7P475o/ZvHfLX/M4v+h/DGL/+75Yxb/PfLHLP575o9Z/PfKH7P4750/ZvH/cP6YxX+f/DGL/775Yxb//fLHLP4fyR+z+H80f8zi/7H8MYv//vljFv8D8scs/gfmj1n8D8ofs/gfnD9m8T8kf8zif2j+mMX/sPwxi//h+WMW/yPyxyz+R+aPWfyPyh+z+H88f8zif3T+mMX/E/ljFv9P5o9Z/I/JH7P4fyp/zOJ/bP6Yxf+4/DGL//H5Yxb/T+ePWfw/kz9m8T8hf8zif2L+mMX/pPwxi//J+WMW/1Pyxyz+n80fs/h/Ln/M4v/5/DGL/xfyxyz+p+aPWfy/mD9m8f9S/pjF/8v5Yxb/r+SPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/r+aPWfy/lj9m8T8nf8zi//X8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8f9G/pjF/5v5Yxb/b+WPWfwvyh+z+F+cP2bx/3b+mMX/kvwxi/938scs/pfmj1n8L8sfs/hfnj9m8f9u/pjF/3v5Yxb/K/LHLP5X5o9Z/L+fP2bxvyp/zOL/g/wxi//V+WMW/x/mj1n8r8kfs/j/KH/M4n9t/pjF/7r8MYv/j/PHLP4/yR+z+P80f8zif33+mMX/Z/ljFv8b8scs/jfmj1n8f54/ZvG/KX/M4n9z/pjF/xf5Yxb/W/LHLP635o9Z/G/LH7P4354/ZvH/Zf6Yxf+O/DGL/6/yxyz+v84fs/j/Jn/M4v/b/DGL/+/yxyz+v88fs/jfmT9m8f9D/pjF/4/5Yxb/P+WPWfzvyh+z+N+dP2bx/3P+mMX/nvwxi/9f8scs/vfmj1n878sfs/j/NX/M4v+3/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cP2bxfyV/zOL/av6Yxf+1/DGJ/8QD+WMW/0H5Yxb/8fLHLP6D88cs/kPyxyz+Q/PHLP7D8scs/uPnj1n8J8gfs/hPmD9m8Z8of8ziP3H+mMV/kvwxi/+k+WMW/+H5Yxb/yfLHLP6T549Z/KfIH7P4T5k/ZvGfKn/M4j91/pjFf5r8MYv/O/LHLP7vzB+z+E+bP2bxny5/zOI/ff6Yxf9d+WMW/xnyxyz+I/LHLP7vzh+z+M+YP2bxnyl/zOL/nvwxi//M+WMW/1nyxyz+s+aPWfxnyx+z+L83f8ziP3v+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/hfLHLP4L549Z/BfJH7P4L5o/ZvFfLH/M4r94/pjFf4n8MYv/kvljFv+l8scs/kvnj1n8l8kfs/i/L3/M4v/+/DGL/wfyxyz+y+aPWfyXyx+z+C+fP2bxXyF/zOK/Yv6YxX+l/DGL/8r5Yxb/VfLHLP6r5o9Z/FfLH7P4r54/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n818sfs/ivnz9m8d8gf8ziv2H+mMV/o/wxi//G+WMW/03yxyz+m+aPWfw3yx+z+G+eP2bx3yJ/zOK/Zf6YxX+r/DGL/9b5Yxb/D+aPWfy3yR+z+G+bP2bx3y5/zOK/ff6YxX+H/DGL/475Yxb/nfLHLP47549Z/HfJH7P475o/ZvHfLX/M4v+h/DGL/+75Yxb/PfLHLP575o9Z/PfKH7P4750/ZvH/cP6YxX+f/DGL/775Yxb//fLHLP4fyR+z+H80f8zi/7H8MYv//vljFv8D8scs/gfmj1n8D8ofs/gfnD9m8T8kf8zif2j+mMX/sPwxi//h+WMW/yPyxyz+R+aPWfyPyh+z+H88f8zif3T+mMX/E/ljFv9P5o9Z/I/JH7P4fyp/zOJ/bP6Yxf+4/DGL//H5Yxb/T+ePWfw/kz9m8T8hf8zif2L+mMX/pPwxi//J+WMW/1Pyxyz+n80fs/h/Ln/M4v/5/DGL/xfyxyz+p+aPWfy/mD9m8f9S/pjF/8v5Yxb/r+SPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/r+aPWfy/lj9m8T8nf8zi//X8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8f9G/pjF/5v5Yxb/b+WPWfwvyh+z+F+cP2bx/3b+mMX/kvwxi/938scs/pfmj1n8L8sfs/hfnj9m8f9u/pjF/3v5Yxb/K/LHLP5X5o9Z/L+fP2bxvyp/zOL/g/wxi//V+WMW/x/mj1n8r8kfs/j/KH/M4n9t/pjF/7r8MYv/j/PHLP4/yR+z+P80f8zif33+mMX/Z/ljFv8b8scs/jfmj1n8f54/ZvG/KX/M4n9z/pjF/xf5Yxb/W/LHLP635o9Z/G/LH7P4354/ZvH/Zf6Yxf+O/DGL/6/yxyz+v84fs/j/Jn/M4v/b/DGL/+/yxyz+v88fs/jfmT9m8f9D/pjF/4/5Yxb/P+WPWfzvyh+z+N+dP2bx/3P+mMX/nvwxi/9f8scs/vfmj1n878sfs/j/NX/M4v+3/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cP2bxfyV/zOL/av6Yxf+1/DGJ/yQD+WMW/0H5Yxb/8fLHLP6D88cs/kPyxyz+Q/PHLP7D8scs/uPnj1n8J8gfs/hPmD9m8Z8of8ziP3H+mMV/kvwxi/+k+WMW/+H5Yxb/yfLHLP6T549Z/KfIH7P4T5k/ZvGfKn/M4j91/pjFf5r8MYv/O/LHLP7vzB+z+E+bP2bxny5/zOI/ff6Yxf9d+WMW/xnyxyz+I/LHLP7vzh+z+M+YP2bxnyl/zOL/nvwxi//M+WMW/1nyxyz+s+aPWfxnyx+z+L83f8ziP3v+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/hfLHLP4L549Z/BfJH7P4L5o/ZvFfLH/M4r94/pjFf4n8MYv/kvljFv+l8scs/kvnj1n8l8kfs/i/L3/M4v/+/DGL/wfyxyz+y+aPWfyXyx+z+C+fP2bxXyF/zOK/Yv6YxX+l/DGL/8r5Yxb/VfLHLP6r5o9Z/FfLH7P4r54/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n818sfs/ivnz9m8d8gf8ziv2H+mMV/o/wxi//G+WMW/03yxyz+m+aPWfw3yx+z+G+eP2bx3yJ/zOK/Zf6YxX+r/DGL/9b5Yxb/D+aPWfy3yR+z+G+bP2bx3y5/zOK/ff6YxX+H/DGL/475Yxb/nfLHLP47549Z/HfJH7P475o/ZvHfLX/M4v+h/DGL/+75Yxb/PfLHLP575o9Z/PfKH7P4750/ZvH/cP6YxX+f/DGL/775Yxb//fLHLP4fyR+z+H80f8zi/7H8MYv//vljFv8D8scs/gfmj1n8D8ofs/gfnD9m8T8kf8zif2j+mMX/sPwxi//h+WMW/yPyxyz+R+aPWfyPyh+z+H88f8zif3T+mMX/E/ljFv9P5o9Z/I/JH7P4fyp/zOJ/bP6Yxf+4/DGL//H5Yxb/T+ePWfw/kz9m8T8hf8zif2L+mMX/pPwxi//J+WMW/1Pyxyz+n80fs/h/Ln/M4v/5/DGL/xfyxyz+p+aPWfy/mD9m8f9S/pjF/8v5Yxb/r+SPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/r+aPWfy/lj9m8T8nf8zi//X8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8f9G/pjF/5v5Yxb/b+WPWfwvyh+z+F+cP2bx/3b+mMX/kvwxi/938scs/pfmj1n8L8sfs/hfnj9m8f9u/pjF/3v5Yxb/K/LHLP5X5o9Z/L+fP2bxvyp/zOL/g/wxi//V+WMW/x/mj1n8r8kfs/j/KH/M4n9t/pjF/7r8MYv/j/PHLP4/yR+z+P80f8zif33+mMX/Z/ljFv8b8scs/jfmj1n8f54/ZvG/KX/M4n9z/pjF/xf5Yxb/W/LHLP635o9Z/G/LH7P4354/ZvH/Zf6Yxf+O/DGL/6/yxyz+v84fs/j/Jn/M4v/b/DGL/+/yxyz+v88fs/jfmT9m8f9D/pjF/4/5Yxb/P+WPWfzvyh+z+N+dP2bx/3P+mMX/nvwxi/9f8scs/vfmj1n878sfs/j/NX/M4v+3/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cP2bxfyV/zOL/av6Yxf+1/DGJ/6QD+WMW/0H5Yxb/8fLHLP6D88cs/kPyxyz+Q/PHLP7D8scs/uPnj1n8J8gfs/hPmD9m8Z8of8ziP3H+mMV/kvwxi/+k+WMW/+H5Yxb/yfLHLP6T549Z/KfIH7P4T5k/ZvGfKn/M4j91/pjFf5r8MYv/O/LHLP7vzB+z+E+bP2bxny5/zOI/ff6Yxf9d+WMW/xnyxyz+I/LHLP7vzh+z+M+YP2bxnyl/zOL/nvwxi//M+WMW/1nyxyz+s+aPWfxnyx+z+L83f8ziP3v+mMV/jvwxi/+c+WMW/7nyxyz+c+ePWfznyR+z+M+bP2bxny9/zOI/f/6YxX+B/DGL/4L5Yxb/hfLHLP4L549Z/BfJH7P4L5o/ZvFfLH/M4r94/pjFf4n8MYv/kvljFv+l8scs/kvnj1n8l8kfs/i/L3/M4v/+/DGL/wfyxyz+y+aPWfyXyx+z+C+fP2bxXyF/zOK/Yv6YxX+l/DGL/8r5Yxb/VfLHLP6r5o9Z/FfLH7P4r54/ZvFfI3/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n818sfs/ivnz9m8d8gf8ziv2H+mMV/o/wxi//G+WMW/03yxyz+m+aPWfw3yx+z+G+eP2bx3yJ/zOK/Zf6YxX+r/DGL/9b5Yxb/D+aPWfy3yR+z+G+bP2bx3y5/zOK/ff6YxX+H/DGL/475Yxb/nfLHLP47549Z/HfJH7P475o/ZvHfLX/M4v+h/DGL/+75Yxb/PfLHLP575o9Z/PfKH7P4750/ZvH/cP6YxX+f/DGL/775Yxb//fLHLP4fyR+z+H80f8zi/7H8MYv//vljFv8D8scs/gfmj1n8D8ofs/gfnD9m8T8kf8zif2j+mMX/sPwxi//h+WMW/yPyxyz+R+aPWfyPyh+z+H88f8zif3T+mMX/E/ljFv9P5o9Z/I/JH7P4fyp/zOJ/bP6Yxf+4/DGL//H5Yxb/T+ePWfw/kz9m8T8hf8zif2L+mMX/pPwxi//J+WMW/1Pyxyz+n80fs/h/Ln/M4v/5/DGL/xfyxyz+p+aPWfy/mD9m8f9S/pjF/8v5Yxb/r+SPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/r+aPWfy/lj9m8T8nf8zi//X8MYv/ufljFv/z8scs/ufnj1n8L8gfs/hfmD9m8f9G/pjF/5v5Yxb/b+WPWfwvyh+z+F+cP2bx/3b+mMX/kvwxi/938scs/pfmj1n8L8sfs/hfnj9m8f9u/pjF/3v5Yxb/K/LHLP5X5o9Z/L+fP2bxvyp/zOL/g/wxi//V+WMW/x/mj1n8r8kfs/j/KH/M4n9t/pjF/7r8MYv/j/PHLP4/yR+z+P80f8zif33+mMX/Z/ljFv8b8scs/jfmj1n8f54/ZvG/KX/M4n9z/pjF/xf5Yxb/W/LHLP635o9Z/G/LH7P4354/ZvH/Zf6Yxf+O/DGL/6/yxyz+v84fs/j/Jn/M4v/b/DGL/+/yxyz+v88fs/jfmT9m8f9D/pjF/4/5Yxb/P+WPWfzvyh+z+N+dP2bx/3P+mMX/nvwxi/9f8scs/vfmj1n878sfs/j/NX/M4v+3/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cP2bxfyV/zOL/av6Yxf+1/DGJ//CB/DGL/6D8MYv/ePljFv/B+WMW/yH5Yxb/ofljFv9h+WMW//Hzxyz+E+SPWfwnzB+z+E+UP2bxnzh/zOI/Sf6YxX/S/DGL//D8MYv/ZPljFv/J88cs/lPkj1n8p8wfs/hPlT9m8Z86f8ziP03+mMX/HfljFv935o9Z/KfNH7P4T5c/ZvGfPn/M4v+u/DGL/wz5Yxb/EfljFv93549Z/GfMH7P4z5Q/ZvF/T/6YxX/m/DGL/yz5Yxb/WfPHLP6z5Y9Z/N+bP2bxnz1/zOI/R/6YxX/O/DGL/1z5Yxb/ufPHLP7z5I9Z/OfNH7P4z5c/ZvGfP3/M4r9A/pjFf8H8MYv/QvljFv+F88cs/ovkj1n8F80fs/gvlj9m8V88f8ziv0T+mMV/yfwxi/9S+WMW/6Xzxyz+y+SPWfzflz9m8X9//pjF/wP5Yxb/ZfPHLP7L5Y9Z/JfPH7P4r5A/ZvFfMX/M4r9S/pjFf+X8MYv/KvljFv9V88cs/qvlj1n8V88fs/ivkT9m8V8zf8ziv1b+mMV/7fwxi/86+WMW/3Xzxyz+6+WPWfzXzx+z+G+QP2bx3zB/zOK/Uf6YxX/j/DGL/yb5Yxb/TfPHLP6b5Y9Z/DfPH7P4b5E/ZvHfMn/M4r9V/pjFf+v8MYv/B/PHLP7b5I9Z/LfNH7P4b5c/ZvHfPn/M4r9D/pjFf8f8MYv/TvljFv+d88cs/rvkj1n8d80fs/jvlj9m8f9Q/pjFf/f8MYv/HvljFv8988cs/nvlj1n8984fs/h/OH/M4r9P/pjFf9/8MYv/fvljFv+P5I9Z/D+aP2bx/1j+mMV///wxi/8B+WMW/wPzxyz+B+WPWfwPzh+z+B+SP2bxPzR/zOJ/WP6Yxf/w/DGL/xH5Yxb/I/PHLP5H5Y9Z/D+eP2bxPzp/zOL/ifwxi/8n88cs/sfkj1n8P5U/ZvE/Nn/M4n9c/pjF//j8MYv/p/PHLP6fyR+z+J+QP2bxPzF/zOJ/Uv6Yxf/k/DGL/yn5Yxb/z+aPWfw/lz9m8f98/pjF/wv5Yxb/U/PHLP5fzB+z+H8pf8zi/+X8MYv/V/LHLP6n5Y9Z/E/PH7P4n5E/ZvE/M3/M4n9W/pjF/+z8MYv/V/PHLP5fyx+z+J+TP2bx/3r+mMX/3Pwxi/95+WMW//Pzxyz+F+SPWfwvzB+z+H8jf8zi/838MYv/t/LHLP4X5Y9Z/C/OH7P4fzt/zOJ/Sf6Yxf87+WMW/0vzxyz+l+WPWfwvzx+z+H83f8zi/738MYv/FfljFv8r88cs/t/PH7P4X5U/ZvH/Qf6Yxf/q/DGL/w/zxyz+1+SPWfx/lD9m8b82f8zif13+mMX/x/ljFv+f5I9Z/H+aP2bxvz5/zOL/s/wxi/8N+WMW/xvzxyz+P88fs/jflD9m8b85f8zi/4v8MYv/LfljFv9b88cs/rflj1n8b88fs/j/Mn/M4n9H/pjF/1f5Yxb/X+ePWfx/kz9m8f9t/pjF/3f5Yxb/3+ePWfzvzB+z+P8hf8zi/8f8MYv/n/LHLP535Y9Z/O/OH7P4/zl/zOJ/T/6Yxf8v+WMW/3vzxyz+9+WPWfz/mj9m8f9b/pjF//78MYv/A/ljFv8H88cs/g/lj1n8H84fs/g/kj9m8X80f8zi/1j+mMX/8fwxi/8T+WMW/yfzxyz+T+WPWfyfzh+z+D+TP2bxfzZ/zOL/XP6Yxf/5/DGL/wv5Yxb/F/PHLP4v5Y9Z/F/OH7P4v5I/ZvF/NX/M4v9a/pjEf7KB/DGL/6D8MYv/ePljFv/B+WMW/yH5Yxb/ofljFv9h+WMW//Hzxyz+E+SPWfwnzB+z+E+UP2bxnzh/zOI/Sf6YxX/S/DGL//D8MYv/ZPljFv/J88cs/lPkj1n8p8wfs/hPlT9m8Z86f8ziP03+mMX/HfljFv935o9Z/KfNH7P4T5c/ZvGfPn/M4v+u/DGL/wz5Yxb/EfljFv93549Z/GfMH7P4z5Q/ZvF/T/6YxX/m/DGL/yz5Yxb/WfPHLP6z5Y9Z/N+bP2bxnz1/zOI/R/6YxX/O/DGL/1z5Yxb/ufPHLP7z5I9Z/OfNH7P4z5c/ZvGfP3/M4r9A/pjFf8H8MYv/QvljFv+F88cs/ovkj1n8F80fs/gvlj9m8V88f8ziv0T+mMV/yfwxi/9S+WMW/6Xzxyz+y+SPWfzflz9m8X9//pjF/wP5Yxb/ZfPHLP7L5Y9Z/JfPH7P4r5A/ZvFfMX/M4r9S/pjFf+X8MYv/KvljFv9V88cs/qvlj1n8V88fs/ivkT9m8V8zf8ziv1b+mMV/7fwxi/86+WMW/3Xzxyz+6+WPWfzXzx+z+G+QP2bx3zB/zOK/Uf6YxX/j/DGL/yb5Yxb/TfPHLP6b5Y9Z/DfPH7P4b5E/ZvHfMn/s/8cePRgKYgBQAKuNX9u2rUlq27Zt27Zt27bbs60F3gT3khXS8r+z/6jlfxf/Ucv/rv6jlv/d/Ect/7v7j1r+9/Aftfzv6T9q+d/Lf9Tyv7f/qOV/H/9Ry/++/qOW//38Ry3/+/uPWv4P8B+1/B/oP2r5P8h/1PJ/sP+o5f8Q/1HL/6H+o5b/w/xHLf+H+49a/o/wH7X8H+k/avk/yn/U8n+0/6jl/xj/Ucv/sf6jlv/j/Ect/8f7j1r+T/Aftfyf6D9q+T/Jf9Tyf7L/qOX/FP9Ry/+p/qOW/9P8Ry3/p/uPWv7P8B+1/J/pP2r5P8t/1PJ/tv+o5f8c/1HL/7n+o5b/8/xHLf/n+49a/i/wH7X8X+g/avm/yH/U8n+x/6jl/xL/Ucv/pf6jlv/L/Ect/5f7j1r+r/Aftfxf6T9q+b/Kf9Tyf7X/qOX/Gv9Ry/+1/qOW/+v8Ry3/1/uPWv5v8B+1/N/oP2r5v8l/1PJ/s/+o5f8W/1HL/63+o5b/2/xHLf+3+49a/u/wH7X83+k/avm/y3/U8n+3/6jl/x7/Ucv/vf6jlv/7/Ect//f7j1r+H/Aftfw/6D9q+X/If9Ty/7D/qOX/Ef9Ry/+j/qOW/8f8Ry3/j/uPWv6f8B+1/D/pP2r5f8p/1PL/tP+o5f8Z/1HL/7P+o5b/5/xHLf/P+49a/l/wH7X8v+g/avl/yX/U8v+y/6jl/xX/Ucv/q/6jlv/X/Ect/6/7j1r+3/Aftfy/6T9q+X/Lf9Ty/7b/qOX/Hf9Ry/+7/qOW//f8Ry3/7/uPWv4/8B+1/H/oP2r5/8h/1PL/sf+o5f8T/1HL/6f+o5b/z/xHLf+f+49a/r/wH7X8f+k/avn/yn/U8v+1/6jl/xv/Ucv/t/6jlv/v/Ect/9/7j1r+f/Aftfz/6D9q+f/Jf9Ty/7P/qOX/F/9Ry/+v/qOW/9/8Ry3/v/uPWv7/8B+1/P/pP2r5/8t/1PL/t/+o5f8f/1HL/7/+o5b///xHLf//+49a/gf5j1r+B/uPWv6H+I9a/of6j1r+h/mPWv6H+49a/kf4j1r+R/qPWv5H+Y9a/kf7j1r+x/iPWv7H+o9a/sf5j1r+x/uPWv4n+I9a/if6j1r+J/mPWv4n+49a/qf4j1r+p/qPWv6n+Y9a/qf7j0r+B2bxH7X8z+o/avmfzX/U8j+7/6jlfw7/Ucv/nP6jlv+5/Ect/3P7j1r+5/EftfzP6z9q+Z/Pf9TyP7//qOV/Af9Ry/+C/qOW/4X8Ry3/C/uPWv4H/Ect/4v4j1r+F/Uftfwv5j9q+V/cf9Tyv4T/qOV/Sf9Ry/9S/qOW/6X9Ry3/y/iPWv6X9R+1/C/nP2r5X95/1PK/gv+o5X9F/1HL/0r+o5b/lf1HLf+r+I9a/lf1H7X8r+Y/avlf3X/U8r+G/6jlf03/Ucv/Wv6jlv+1/Uct/+v4j1r+1/Uftfyv5z9q+V/ff9Tyv4H/qOV/Q/9Ry/9G/qOW/439Ry3/m/iPWv439R+1/G/mP2r539x/1PK/hf+o5X9L/1HL/1b+o5b/rf1HLf/b+I9a/rf1H7X8b+c/avnf3n/U8r+D/6jlf0f/Ucv/Tv6jme4fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGawc/8xXtcFHMc/d3B3CAUiRki9gaACwePkjl+CilY0z8ZZYevXJJicAh2peDNAFpRa1NzSyZa1SP2DtFZrbMZaTcpsi9mKmvbDuQUl/Rjr1IpskXXuC9/veff1uPl9n+83f/B4/HH3/XyO1+eA7Xmfz3f+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOC1095xec+IugGnRvQ/CD/vPPF5/r8/tG7Pnn3jK5/LX37PIJes73/Q29vbu23CL24pHzYVRVH6bpeVj0dVj0vX375/6tnl717cd/dts5duWf7Y7o09Y366YPuRhhNnG4rV163v6rywvijCiIZic+lgXl1RhMaG4q7SQWvpoKmheKh00Hbi4KziR6WDudfe0LW2dOIV3xrOOO0dO4oRA4otBvw06N//9v2XvrfyeYhLVq42sij3f8X3n2iq+lrFKfqvXD/UVfdf8x8QOKXa+l/xfOXzEJd8xf2/9W8fOzzY107df+X6oV7/kM4gz/8DGq1+7q96/p82yCX79s0tj48q9b9k8X0byqdGvprn/5evH0ZU918/4Pm/9Bw/svL831QUoWGYfx1wRmnv+HTPUPf/ofsfOblqU9e//63HDq0q9d+84ZPPlU811Nj/yCHu/3VPVv1egdq0dzzQW3X/r6H/YuYgl+zrv+fWp4+X+v/T/mfO7/e1WvpvqO6/pXvjjS03b9navH7jmus7r+/8ROv8hYsWti6+qG1By4lHgpMfh/m3AmeG4d3/i9FVm7qi6OzbX/Dcyp2l/qevX/nZ8qlRNfbfOOT9f5r7Pwxqen3R2FhsXtPdvWneyY+Vw9aTH0/+skH6r+H9/4xZ5V9Wed9dVxST+vZzblywutT/g8c+93j5VGON/TcN2f9lhff7MAzDvP+vrdoM6P/oirHPlvr/0sOzusunan3/P2rI/g+7/8NwtHdU/Qs/r7FS/5eM3f33uHU4yz//g3Ry9D/++J1Xxa3DaP1DOjn6/8jtM5+KW4cx+od0cvT/vbXvXBi3Dq/TP6STo/9/Tv7r/XHr8Hr9Qzo5+j/07H+mxK3DWP1DOjn633XX+3fGrcM4/UM6Ofqfse3IHXHrcLb+IZ0c/a+rv2pC3DqM1z+kk6P/d72w6ttx63CO/iGdHP2P2/mvpXHrMEH/kE6O/nvW3f1k3Dqcq39IJ0f/X5+45B1x6/AG/UM6Ofr/wh/nvBi3DhP1D+nk6P/Rr+7YELcOb9Q/pJOj/x9+YOxg/5+wVyFM0j+kk6P/Y3P27I1bh/P0D+nk6P93hx4eF7cOk/UP6eTo/54Hpn45bh3epH9IJ0f/N11+6y1x6/Bm/UM6OfpfsuyXh+PWIegf0snR/8SfPboqbh2m6B/SydH/Nd/dcCBuHabqH9LJ0f/mc761PG4dpukf0snRf1tX0xNx6/AW/UM6Ofqfeu/EjXHrMF3/kE6O/q/+8yP/jVuHGfqHdHL0v6/xqXPj1uGt+od0cvT/v82bPhO3Dm/TP6STo/9f3XntxXHr8Hb9Qzo5+v/KPw58M24dZuof0snR/5Gl7/5L3DrM0j+kk6P/7yzvuSluHc7XP6STo//b9r54MG4dZusf0snR/4GDH/xw3DrM0T+kk6P/2S1t++LW4QL9Qzo5+l/zvnunxa1Ds/4hnRz9r9jz+a/FrcNc/UM6OfpvfHr6qLh1aNE/pJOj/72LdjXErcOF+od0cvR/vH3ZPXHrME//kE6O/n/zyNzmuHVo1T+kk6P/3Y/d8YO4dWjTP6STo//tM/5wddw6zNc/pJOj//nXXPnjuHVYoH9IJ0f/k77x0W1x67BQ/5BOjv5X/vb5o3HrsEj/kE6O/punfOrBuHVYrH9IJ0f/163+9by4dbhI/5BOjv6v3PWTL8atwxL9Qzo5+q87esN5ceuwVP+QTo7+nxk95oW4dbhY/5BOjv4f6r5/ddw6XKJ/SCdH/7fv2Pv7uHW4VP+QTo7+D/5/8hVx67BM/5DOzVu2fnxNV1fnJi+88MKLvhen+ycTkNrL0Z/u3wkAAAAAAAAAAAAAAHAqOf5zotP9ZwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgJXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwAwckAAAAAIL+v25HoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8FQAAAD//0x8Hu0=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x1c6)
ioctl$XFS_IOC_ERROR_INJECTION(r0, 0x40085874, &(0x7f0000000000)={0x5, 0x9})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x1ff)
ioctl$XFS_IOC_SCRUBV_METADATA(r1, 0xc0285840, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xfff9, 0x1, 0x0, &(0x7f0000002700)=[{0x5, 0x101, 0xfffffff1}]})
creat(0x0, 0x30)
[-- Attachment #6: .config --]
[-- Type: application/xml, Size: 273663 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue
2026-01-20 10:13 [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue Jiaming Zhang
@ 2026-01-20 19:17 ` Darrick J. Wong
2026-01-21 10:14 ` Jiaming Zhang
0 siblings, 1 reply; 8+ messages in thread
From: Darrick J. Wong @ 2026-01-20 19:17 UTC (permalink / raw)
To: Jiaming Zhang; +Cc: cem, linux-xfs, linux-kernel, pchelkin, syzkaller
On Tue, Jan 20, 2026 at 06:13:44PM +0800, Jiaming Zhang wrote:
> Dear Linux kernel developers and maintainers,
>
> We are writing to report a general protection fault discovered in the
> xfs subsystem with our generated syzkaller specifications. This issue
> is reproducible on the latest version of linux (v6.19-rc6, commit
> 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7). The KASAN report from
> kernel is listed below (formatted by syz-symbolize):
>
> ---
>
> loop0: detected capacity change from 0 to 32768
> XFS (loop0): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> XFS (loop0): Ending clean mount
> XFS (loop0): Injecting error at file fs/xfs/libxfs/xfs_btree.c, line
> 309, on filesystem "loop0"
> Oops: general protection fault, probably for non-canonical address
> 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
> CPU: 1 UID: 0 PID: 9920 Comm: repro.out Not tainted 6.19.0-rc6 #24 PREEMPT(full)
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000200000002700 CR3: 00000000229e4000 CR4: 0000000000752ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> xrep_revalidate_allocbt+0xf3/0x160 fs/xfs/scrub/alloc_repair.c:930
> xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x45a879
> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48
> 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffda72db7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00000000004004b8 RCX: 000000000045a879
> RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> RBP: 00007ffda72db860 R08: 0000000000000004 R09: 0000000000000005
> R10: 0000000000000004 R11: 0000000000000246 R12: 000000000040b990
> R13: 0000000000000000 R14: 00000000004ca018 R15: 00000000004004b8
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fbbbc0430c8 CR3: 00000000229e4000 CR4: 0000000000752ef0
> PKRU: 55555554
> ----------------
> Code disassembly (best guess):
> 0: f2 00 66 43 repnz add %ah,0x43(%rsi)
> 4: c7 44 35 0d f3 f3 43 movl $0xc643f3f3,0xd(%rbp,%rsi,1)
> b: c6
> c: 44 35 0f f3 e8 1c rex.R xor $0x1ce8f30f,%eax
> 12: 44 39 fe cmp %r15d,%esi
> 15: 48 89 5c 24 40 mov %rbx,0x40(%rsp)
> 1a: 48 83 c3 48 add $0x48,%rbx
> 1e: 48 89 d8 mov %rbx,%rax
> 21: 48 c1 e8 03 shr $0x3,%rax
> 25: 48 89 44 24 30 mov %rax,0x30(%rsp)
> * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
> 2f: 84 c0 test %al,%al
> 31: 0f 85 d6 11 00 00 jne 0x120d
> 37: 44 0f b6 33 movzbl (%rbx),%r14d
> 3b: 41 ff ce dec %r14d
> 3e: bf .byte 0xbf
> 3f: 53 push %rbx
>
> ---
>
> The root cause of this issue is that in xchk_btree(), where the
> argument cur can be NULL but the function assume cur is not NULL,
> leading to a NULL pointer dereference when accessing member
> (https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L701).
>
> We can add a NULL check at the beginning of xchk_btree() to fix this issue:
> ```
> --- a/fs/xfs/scrub/btree.c
> +++ b/fs/xfs/scrub/btree.c
> @@ -693,6 +693,9 @@ xchk_btree(
> int level;
> int error = 0;
>
> + if (!cur)
> + return -EINVAL;
Uh, no, don't just fling EINVAL up to userspace. Line 930 is the cntbt
revalidation in xrep_revalidate_allocbt. Why is that pointer
0xdffffc0000000009? Did we somehow fail to allocate a cntbt cursor in
xchk_ag_btcur_init? Did that xchk_should_check_xref free it? Did we
fail to attach the AGF to sc->sa.agf_bp?
> /*
> * Allocate the btree scrub context from the heap, because this
> * structure can get rather large. Don't let a caller feed us a
> ```
>
> After applying changes above and re-running reproducer, another issues
> is triggered:
>
> ---
> TITLE: KASAN: slab-use-after-free Read in xchk_btree_check_block_owner
>
> XFS (loop6): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> XFS (loop6): Ending clean mount
> ==================================================================
> BUG: KASAN: slab-use-after-free in
> xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> Read of size 8 at addr ffff88806af035d8 by task syz.6.59/14096
>
> CPU: 1 UID: 0 PID: 14096 Comm: syz.6.59 Not tainted 6.19.0-rc6-dirty
> #30 PREEMPT(full)
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x10e/0x190 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x17e/0x810 mm/kasan/report.c:482
> kasan_report+0x147/0x180 mm/kasan/report.c:595
> xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f71bddb459d
> Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
> 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f71bed71f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007f71be045fa0 RCX: 00007f71bddb459d
> RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> RBP: 00007f71bde52610 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f71be046038 R14: 00007f71be045fa0 R15: 00007f71bed52000
> </TASK>
>
> Allocated by task 14096:
> kasan_save_stack mm/kasan/common.c:57 [inline]
> kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> unpoison_slab_object mm/kasan/common.c:340 [inline]
> __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
> kasan_slab_alloc include/linux/kasan.h:253 [inline]
> slab_post_alloc_hook mm/slub.c:4953 [inline]
> slab_alloc_node mm/slub.c:5263 [inline]
> kmem_cache_alloc_noprof+0x37d/0x710 mm/slub.c:5270
> xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> xfs_bnobt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:485
> xchk_ag_btcur_init+0xe0/0x5d0 fs/xfs/scrub/common.c:612
> xchk_ag_init fs/xfs/scrub/common.c:698 [inline]
> xchk_setup_ag_btree+0x295/0x310 fs/xfs/scrub/common.c:943
> xchk_setup_ag_allocbt+0x70/0x190 fs/xfs/scrub/alloc.c:35
> xfs_scrub_metadata+0xa9e/0x1920 fs/xfs/scrub/scrub.c:709
> xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Freed by task 14096:
> kasan_save_stack mm/kasan/common.c:57 [inline]
> kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
> poison_slab_object mm/kasan/common.c:253 [inline]
> __kasan_slab_free+0x58/0x80 mm/kasan/common.c:285
> kasan_slab_free include/linux/kasan.h:235 [inline]
> slab_free_hook mm/slub.c:2540 [inline]
> slab_free mm/slub.c:6670 [inline]
> kmem_cache_free+0x197/0x620 mm/slub.c:6781
> xchk_should_check_xref+0xf9/0x420 fs/xfs/scrub/common.c:1351
> xchk_xref_is_used_space+0x14b/0x210 fs/xfs/scrub/alloc.c:190
> xchk_btree_check_block_owner+0x2fe/0x600 fs/xfs/scrub/btree.c:395
> xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> The buggy address belongs to the object at ffff88806af035c8
> which belongs to the cache xfs_bnobt_cur of size 232
> The buggy address is located 16 bytes inside of
> freed 232-byte region [ffff88806af035c8, ffff88806af036b0)
>
> The buggy address belongs to the physical page:
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6af03
> ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
> page_type: f5(slab)
> raw: 04fff00000000000 ffff88801dd96a00 ffffea000094fdc0 0000000000000003
> raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 0, migratetype Unmovable, gfp_mask
> 0x1052c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOLOCKDEP),
> pid 13126, tgid 13119 (syz.4.29), ts 58027826746, free_ts 57929202822
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x234/0x290 mm/page_alloc.c:1884
> prep_new_page mm/page_alloc.c:1892 [inline]
> get_page_from_freelist+0x24e4/0x2580 mm/page_alloc.c:3945
> __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5240
> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
> alloc_slab_page mm/slub.c:3075 [inline]
> allocate_slab+0x86/0x3b0 mm/slub.c:3248
> new_slab mm/slub.c:3302 [inline]
> ___slab_alloc+0xe70/0x1860 mm/slub.c:4656
> __slab_alloc+0x65/0x100 mm/slub.c:4779
> __slab_alloc_node mm/slub.c:4855 [inline]
> slab_alloc_node mm/slub.c:5251 [inline]
> kmem_cache_alloc_noprof+0x40f/0x710 mm/slub.c:5270
> xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> xfs_cntbt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:511
> xfs_free_ag_extent+0x570/0x1890 fs/xfs/libxfs/xfs_alloc.c:2149
> __xfs_free_extent+0x2a7/0x460 fs/xfs/libxfs/xfs_alloc.c:4047
> xfs_extent_free_finish_item+0x299/0x840 fs/xfs/xfs_extfree_item.c:555
> xfs_defer_finish_one+0x5a6/0xcc0 fs/xfs/libxfs/xfs_defer.c:595
> xfs_defer_finish_noroll+0x94a/0x1300 fs/xfs/libxfs/xfs_defer.c:707
> xfs_defer_finish+0x1e/0x270 fs/xfs/libxfs/xfs_defer.c:741
> xrep_defer_finish+0x16e/0x240 fs/xfs/scrub/repair.c:242
> page last free pid 785 tgid 785 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> free_pages_prepare mm/page_alloc.c:1433 [inline]
> __free_frozen_pages+0xbc4/0xd40 mm/page_alloc.c:2973
> vfree+0x25a/0x400 mm/vmalloc.c:3466
> delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3385
> process_one_work kernel/workqueue.c:3257 [inline]
> process_scheduled_works+0xa45/0x1670 kernel/workqueue.c:3340
> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
> kthread+0x711/0x8a0 kernel/kthread.c:463
> ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
>
> Memory state around the buggy address:
> ffff88806af03480: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
> ffff88806af03500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> >ffff88806af03580: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
> ^
> ffff88806af03600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff88806af03680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
> ==================================================================
> ---
>
> I also analyzed the root cause of this issue. In
> xchk_btree_check_block_owner(), bs->cur is an alias for
> bs->sc->sa.bnocur (or rmap_cur,
> https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L396-L400).
> The issue occurs when error injection triggers a failure path:
>
> 1. xchk_btree_check_block_owner() calls xchk_xref_is_used_space()
> 2. In xchk_xref_is_used_space(), xfs_alloc_has_records() returns a
> non-zero error due to error injection
> 3. Non-zero error causes xchk_should_check_xref() to free curpp (which
> points to bs->sc->sa.bnocur).
> 4. Memory pointed to by bs->cur is freed.
>
> Control returns to xchk_btree_check_block_owner(), which subsequently
> accesses bs->cur->bc_ops, triggering the UAF.
>
> P.S. this issue can also be triggered independently by syzkaller using
> our generated specs.
>
> To fix this issue, we can cache values of
> xfs_btree_is_bno(bs->cur->bc_ops) and
> xfs_btree_is_rmap(bs->cur->bc_ops) at the beginning of the function:
> ```
> --- a/fs/xfs/scrub/btree.c
> +++ b/fs/xfs/scrub/btree.c
> @@ -371,6 +371,8 @@ xchk_btree_check_block_owner(
> xfs_agnumber_t agno;
> xfs_agblock_t agbno;
> bool init_sa;
> + bool is_bno;
> + bool is_rmap;
> int error = 0;
>
> if (!bs->cur)
> @@ -379,6 +381,9 @@ xchk_btree_check_block_owner(
> agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
> agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
>
> + is_bno = xfs_btree_is_bno(bs->cur->bc_ops);
> + is_rmap = xfs_btree_is_rmap(bs->cur->bc_ops);
> +
> /*
> * If the btree being examined is not itself a per-AG btree, initialize
> * sc->sa so that we can check for the presence of an ownership record
> @@ -398,11 +403,11 @@ xchk_btree_check_block_owner(
> * have to nullify it (to shut down further block owner checks) if
> * self-xref encounters problems.
> */
> - if (!bs->sc->sa.bno_cur && xfs_btree_is_bno(bs->cur->bc_ops))
> + if (!bs->sc->sa.bno_cur && is_bno)
> bs->cur = NULL;
>
> xchk_xref_is_only_owned_by(bs->sc, agbno, 1, bs->oinfo);
> - if (!bs->sc->sa.rmap_cur && xfs_btree_is_rmap(bs->cur->bc_ops))
> + if (!bs->sc->sa.rmap_cur && is_rmap)
Indentation problems notwithstanding, that looks like a correct
resolution to the UAF problem.
> bs->cur = NULL;
>
> out_free:
> ```
>
> After applying above changes, reproducer ran for ~35 minutes without
> triggering any issues.
>
> If above solutions are acceptable, we are happy to submit patches :)
>
> The kernel console output, kernel config, syzkaller reproducer, and C
> reproducer are also attached to help with analysis.
>
> Please let me know if any further information is required.
>
> Best Regards,
> Jiaming Zhang
Please just link to your dashboard, don't send a 1MB email to dozens
of people.
--D
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue
2026-01-20 19:17 ` Darrick J. Wong
@ 2026-01-21 10:14 ` Jiaming Zhang
2026-01-21 19:23 ` Darrick J. Wong
0 siblings, 1 reply; 8+ messages in thread
From: Jiaming Zhang @ 2026-01-21 10:14 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: cem, linux-xfs, linux-kernel, pchelkin, syzkaller
Darrick J. Wong <djwong@kernel.org> 于2026年1月21日周三 03:17写道：
>
> On Tue, Jan 20, 2026 at 06:13:44PM +0800, Jiaming Zhang wrote:
> > Dear Linux kernel developers and maintainers,
> >
> > We are writing to report a general protection fault discovered in the
> > xfs subsystem with our generated syzkaller specifications. This issue
> > is reproducible on the latest version of linux (v6.19-rc6, commit
> > 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7). The KASAN report from
> > kernel is listed below (formatted by syz-symbolize):
> >
> > ---
> >
> > loop0: detected capacity change from 0 to 32768
> > XFS (loop0): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > XFS (loop0): Ending clean mount
> > XFS (loop0): Injecting error at file fs/xfs/libxfs/xfs_btree.c, line
> > 309, on filesystem "loop0"
> > Oops: general protection fault, probably for non-canonical address
> > 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
> > KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
> > CPU: 1 UID: 0 PID: 9920 Comm: repro.out Not tainted 6.19.0-rc6 #24 PREEMPT(full)
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000200000002700 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > PKRU: 55555554
> > Call Trace:
> > <TASK>
> > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > xrep_revalidate_allocbt+0xf3/0x160 fs/xfs/scrub/alloc_repair.c:930
> > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > vfs_ioctl fs/ioctl.c:51 [inline]
> > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > RIP: 0033:0x45a879
> > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48
> > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> > RSP: 002b:00007ffda72db7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > RAX: ffffffffffffffda RBX: 00000000004004b8 RCX: 000000000045a879
> > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > RBP: 00007ffda72db860 R08: 0000000000000004 R09: 0000000000000005
> > R10: 0000000000000004 R11: 0000000000000246 R12: 000000000040b990
> > R13: 0000000000000000 R14: 00000000004ca018 R15: 00000000004004b8
> > </TASK>
> > Modules linked in:
> > ---[ end trace 0000000000000000 ]---
> > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 00007fbbbc0430c8 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > PKRU: 55555554
> > ----------------
> > Code disassembly (best guess):
> > 0: f2 00 66 43 repnz add %ah,0x43(%rsi)
> > 4: c7 44 35 0d f3 f3 43 movl $0xc643f3f3,0xd(%rbp,%rsi,1)
> > b: c6
> > c: 44 35 0f f3 e8 1c rex.R xor $0x1ce8f30f,%eax
> > 12: 44 39 fe cmp %r15d,%esi
> > 15: 48 89 5c 24 40 mov %rbx,0x40(%rsp)
> > 1a: 48 83 c3 48 add $0x48,%rbx
> > 1e: 48 89 d8 mov %rbx,%rax
> > 21: 48 c1 e8 03 shr $0x3,%rax
> > 25: 48 89 44 24 30 mov %rax,0x30(%rsp)
> > * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
> > 2f: 84 c0 test %al,%al
> > 31: 0f 85 d6 11 00 00 jne 0x120d
> > 37: 44 0f b6 33 movzbl (%rbx),%r14d
> > 3b: 41 ff ce dec %r14d
> > 3e: bf .byte 0xbf
> > 3f: 53 push %rbx
> >
> > ---
> >
> > The root cause of this issue is that in xchk_btree(), where the
> > argument cur can be NULL but the function assume cur is not NULL,
> > leading to a NULL pointer dereference when accessing member
> > (https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L701).
> >
> > We can add a NULL check at the beginning of xchk_btree() to fix this issue:
> > ```
> > --- a/fs/xfs/scrub/btree.c
> > +++ b/fs/xfs/scrub/btree.c
> > @@ -693,6 +693,9 @@ xchk_btree(
> > int level;
> > int error = 0;
> >
> > + if (!cur)
> > + return -EINVAL;
>
> Uh, no, don't just fling EINVAL up to userspace. Line 930 is the cntbt
> revalidation in xrep_revalidate_allocbt. Why is that pointer
> 0xdffffc0000000009? Did we somehow fail to allocate a cntbt cursor in
> xchk_ag_btcur_init? Did that xchk_should_check_xref free it? Did we
> fail to attach the AGF to sc->sa.agf_bp?
Thanks for the feedback! I dug deeper into the root cause as you
suggested, here is what I found:
(1) The program executes XFS_IOC_ERROR_INJECTION branch in
xfs_file_ioctl(), causes xfs_btree_check_block() to return
-EFSCORRUPTED, which consequently marks the AG as sick (via
xfs_btree_mark_sick).
(2) Then, the program executes XFS_IOC_SCRUBV_METADATA branch in
xfs_file_ioctl(), the setup function (xchk_setup_ag_allocbt())
attempts to initialize the cursor. However, the sick flag makes kernel
executes xchk_ag_btree_del_cursor_if_sick(), the cursor is freed and
nullified.
(3) Lastly, the repair_eval function (xrep_revalidate_allocbt()) calls
xchk_allocbt(). Since xchk_allocbt() assumes the cursor is valid, it
passes the NULL pointer to xchk_btree, leading to the null-ptr-deref.
Based on above analysis, I think sc->sa.cnt_cur being NULL is expected
when the AG is sick. I think the appropriate fix is to check NULL
inside xchk_allocbt():
```
--- a/fs/xfs/scrub/alloc.c
+++ b/fs/xfs/scrub/alloc.c
@@ -170,6 +170,9 @@ xchk_allocbt(
return -EIO;
}
+ if (!cur)
+ return -ENOENT;
+
return xchk_btree(sc, cur, xchk_allocbt_rec, &XFS_RMAP_OINFO_AG, &ca);
}
```
What do you think? :)
>
> > /*
> > * Allocate the btree scrub context from the heap, because this
> > * structure can get rather large. Don't let a caller feed us a
> > ```
> >
> > After applying changes above and re-running reproducer, another issues
> > is triggered:
> >
> > ---
> > TITLE: KASAN: slab-use-after-free Read in xchk_btree_check_block_owner
> >
> > XFS (loop6): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > XFS (loop6): Ending clean mount
> > ==================================================================
> > BUG: KASAN: slab-use-after-free in
> > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > Read of size 8 at addr ffff88806af035d8 by task syz.6.59/14096
> >
> > CPU: 1 UID: 0 PID: 14096 Comm: syz.6.59 Not tainted 6.19.0-rc6-dirty
> > #30 PREEMPT(full)
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > Call Trace:
> > <TASK>
> > __dump_stack lib/dump_stack.c:94 [inline]
> > dump_stack_lvl+0x10e/0x190 lib/dump_stack.c:120
> > print_address_description mm/kasan/report.c:378 [inline]
> > print_report+0x17e/0x810 mm/kasan/report.c:482
> > kasan_report+0x147/0x180 mm/kasan/report.c:595
> > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > vfs_ioctl fs/ioctl.c:51 [inline]
> > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > RIP: 0033:0x7f71bddb459d
> > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
> > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> > RSP: 002b:00007f71bed71f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > RAX: ffffffffffffffda RBX: 00007f71be045fa0 RCX: 00007f71bddb459d
> > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > RBP: 00007f71bde52610 R08: 0000000000000000 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > R13: 00007f71be046038 R14: 00007f71be045fa0 R15: 00007f71bed52000
> > </TASK>
> >
> > Allocated by task 14096:
> > kasan_save_stack mm/kasan/common.c:57 [inline]
> > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > unpoison_slab_object mm/kasan/common.c:340 [inline]
> > __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
> > kasan_slab_alloc include/linux/kasan.h:253 [inline]
> > slab_post_alloc_hook mm/slub.c:4953 [inline]
> > slab_alloc_node mm/slub.c:5263 [inline]
> > kmem_cache_alloc_noprof+0x37d/0x710 mm/slub.c:5270
> > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > xfs_bnobt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:485
> > xchk_ag_btcur_init+0xe0/0x5d0 fs/xfs/scrub/common.c:612
> > xchk_ag_init fs/xfs/scrub/common.c:698 [inline]
> > xchk_setup_ag_btree+0x295/0x310 fs/xfs/scrub/common.c:943
> > xchk_setup_ag_allocbt+0x70/0x190 fs/xfs/scrub/alloc.c:35
> > xfs_scrub_metadata+0xa9e/0x1920 fs/xfs/scrub/scrub.c:709
> > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > vfs_ioctl fs/ioctl.c:51 [inline]
> > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >
> > Freed by task 14096:
> > kasan_save_stack mm/kasan/common.c:57 [inline]
> > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
> > poison_slab_object mm/kasan/common.c:253 [inline]
> > __kasan_slab_free+0x58/0x80 mm/kasan/common.c:285
> > kasan_slab_free include/linux/kasan.h:235 [inline]
> > slab_free_hook mm/slub.c:2540 [inline]
> > slab_free mm/slub.c:6670 [inline]
> > kmem_cache_free+0x197/0x620 mm/slub.c:6781
> > xchk_should_check_xref+0xf9/0x420 fs/xfs/scrub/common.c:1351
> > xchk_xref_is_used_space+0x14b/0x210 fs/xfs/scrub/alloc.c:190
> > xchk_btree_check_block_owner+0x2fe/0x600 fs/xfs/scrub/btree.c:395
> > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > vfs_ioctl fs/ioctl.c:51 [inline]
> > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> >
> > The buggy address belongs to the object at ffff88806af035c8
> > which belongs to the cache xfs_bnobt_cur of size 232
> > The buggy address is located 16 bytes inside of
> > freed 232-byte region [ffff88806af035c8, ffff88806af036b0)
> >
> > The buggy address belongs to the physical page:
> > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6af03
> > ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
> > page_type: f5(slab)
> > raw: 04fff00000000000 ffff88801dd96a00 ffffea000094fdc0 0000000000000003
> > raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
> > page dumped because: kasan: bad access detected
> > page_owner tracks the page as allocated
> > page last allocated via order 0, migratetype Unmovable, gfp_mask
> > 0x1052c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOLOCKDEP),
> > pid 13126, tgid 13119 (syz.4.29), ts 58027826746, free_ts 57929202822
> > set_page_owner include/linux/page_owner.h:32 [inline]
> > post_alloc_hook+0x234/0x290 mm/page_alloc.c:1884
> > prep_new_page mm/page_alloc.c:1892 [inline]
> > get_page_from_freelist+0x24e4/0x2580 mm/page_alloc.c:3945
> > __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5240
> > alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
> > alloc_slab_page mm/slub.c:3075 [inline]
> > allocate_slab+0x86/0x3b0 mm/slub.c:3248
> > new_slab mm/slub.c:3302 [inline]
> > ___slab_alloc+0xe70/0x1860 mm/slub.c:4656
> > __slab_alloc+0x65/0x100 mm/slub.c:4779
> > __slab_alloc_node mm/slub.c:4855 [inline]
> > slab_alloc_node mm/slub.c:5251 [inline]
> > kmem_cache_alloc_noprof+0x40f/0x710 mm/slub.c:5270
> > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > xfs_cntbt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:511
> > xfs_free_ag_extent+0x570/0x1890 fs/xfs/libxfs/xfs_alloc.c:2149
> > __xfs_free_extent+0x2a7/0x460 fs/xfs/libxfs/xfs_alloc.c:4047
> > xfs_extent_free_finish_item+0x299/0x840 fs/xfs/xfs_extfree_item.c:555
> > xfs_defer_finish_one+0x5a6/0xcc0 fs/xfs/libxfs/xfs_defer.c:595
> > xfs_defer_finish_noroll+0x94a/0x1300 fs/xfs/libxfs/xfs_defer.c:707
> > xfs_defer_finish+0x1e/0x270 fs/xfs/libxfs/xfs_defer.c:741
> > xrep_defer_finish+0x16e/0x240 fs/xfs/scrub/repair.c:242
> > page last free pid 785 tgid 785 stack trace:
> > reset_page_owner include/linux/page_owner.h:25 [inline]
> > free_pages_prepare mm/page_alloc.c:1433 [inline]
> > __free_frozen_pages+0xbc4/0xd40 mm/page_alloc.c:2973
> > vfree+0x25a/0x400 mm/vmalloc.c:3466
> > delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3385
> > process_one_work kernel/workqueue.c:3257 [inline]
> > process_scheduled_works+0xa45/0x1670 kernel/workqueue.c:3340
> > worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
> > kthread+0x711/0x8a0 kernel/kthread.c:463
> > ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> >
> > Memory state around the buggy address:
> > ffff88806af03480: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
> > ffff88806af03500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > >ffff88806af03580: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
> > ^
> > ffff88806af03600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > ffff88806af03680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
> > ==================================================================
> > ---
> >
> > I also analyzed the root cause of this issue. In
> > xchk_btree_check_block_owner(), bs->cur is an alias for
> > bs->sc->sa.bnocur (or rmap_cur,
> > https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L396-L400).
> > The issue occurs when error injection triggers a failure path:
> >
> > 1. xchk_btree_check_block_owner() calls xchk_xref_is_used_space()
> > 2. In xchk_xref_is_used_space(), xfs_alloc_has_records() returns a
> > non-zero error due to error injection
> > 3. Non-zero error causes xchk_should_check_xref() to free curpp (which
> > points to bs->sc->sa.bnocur).
> > 4. Memory pointed to by bs->cur is freed.
> >
> > Control returns to xchk_btree_check_block_owner(), which subsequently
> > accesses bs->cur->bc_ops, triggering the UAF.
> >
> > P.S. this issue can also be triggered independently by syzkaller using
> > our generated specs.
> >
> > To fix this issue, we can cache values of
> > xfs_btree_is_bno(bs->cur->bc_ops) and
> > xfs_btree_is_rmap(bs->cur->bc_ops) at the beginning of the function:
> > ```
> > --- a/fs/xfs/scrub/btree.c
> > +++ b/fs/xfs/scrub/btree.c
> > @@ -371,6 +371,8 @@ xchk_btree_check_block_owner(
> > xfs_agnumber_t agno;
> > xfs_agblock_t agbno;
> > bool init_sa;
> > + bool is_bno;
> > + bool is_rmap;
> > int error = 0;
> >
> > if (!bs->cur)
> > @@ -379,6 +381,9 @@ xchk_btree_check_block_owner(
> > agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
> > agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
> >
> > + is_bno = xfs_btree_is_bno(bs->cur->bc_ops);
> > + is_rmap = xfs_btree_is_rmap(bs->cur->bc_ops);
> > +
> > /*
> > * If the btree being examined is not itself a per-AG btree, initialize
> > * sc->sa so that we can check for the presence of an ownership record
> > @@ -398,11 +403,11 @@ xchk_btree_check_block_owner(
> > * have to nullify it (to shut down further block owner checks) if
> > * self-xref encounters problems.
> > */
> > - if (!bs->sc->sa.bno_cur && xfs_btree_is_bno(bs->cur->bc_ops))
> > + if (!bs->sc->sa.bno_cur && is_bno)
> > bs->cur = NULL;
> >
> > xchk_xref_is_only_owned_by(bs->sc, agbno, 1, bs->oinfo);
> > - if (!bs->sc->sa.rmap_cur && xfs_btree_is_rmap(bs->cur->bc_ops))
> > + if (!bs->sc->sa.rmap_cur && is_rmap)
>
> Indentation problems notwithstanding, that looks like a correct
> resolution to the UAF problem.
>
> > bs->cur = NULL;
> >
> > out_free:
> > ```
> >
> > After applying above changes, reproducer ran for ~35 minutes without
> > triggering any issues.
> >
> > If above solutions are acceptable, we are happy to submit patches :)
> >
> > The kernel console output, kernel config, syzkaller reproducer, and C
> > reproducer are also attached to help with analysis.
> >
> > Please let me know if any further information is required.
> >
> > Best Regards,
> > Jiaming Zhang
>
> Please just link to your dashboard, don't send a 1MB email to dozens
> of people.
>
> --D
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue
2026-01-21 10:14 ` Jiaming Zhang
@ 2026-01-21 19:23 ` Darrick J. Wong
2026-01-22 11:30 ` Jiaming Zhang
0 siblings, 1 reply; 8+ messages in thread
From: Darrick J. Wong @ 2026-01-21 19:23 UTC (permalink / raw)
To: Jiaming Zhang; +Cc: cem, linux-xfs, linux-kernel, pchelkin, syzkaller
On Wed, Jan 21, 2026 at 06:14:06PM +0800, Jiaming Zhang wrote:
> Darrick J. Wong <djwong@kernel.org> 于2026年1月21日周三 03:17写道：
> >
> > On Tue, Jan 20, 2026 at 06:13:44PM +0800, Jiaming Zhang wrote:
> > > Dear Linux kernel developers and maintainers,
> > >
> > > We are writing to report a general protection fault discovered in the
> > > xfs subsystem with our generated syzkaller specifications. This issue
> > > is reproducible on the latest version of linux (v6.19-rc6, commit
> > > 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7). The KASAN report from
> > > kernel is listed below (formatted by syz-symbolize):
> > >
> > > ---
> > >
> > > loop0: detected capacity change from 0 to 32768
> > > XFS (loop0): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > XFS (loop0): Ending clean mount
> > > XFS (loop0): Injecting error at file fs/xfs/libxfs/xfs_btree.c, line
> > > 309, on filesystem "loop0"
> > > Oops: general protection fault, probably for non-canonical address
> > > 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
> > > KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
> > > CPU: 1 UID: 0 PID: 9920 Comm: repro.out Not tainted 6.19.0-rc6 #24 PREEMPT(full)
> > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > CR2: 0000200000002700 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > PKRU: 55555554
> > > Call Trace:
> > > <TASK>
> > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > xrep_revalidate_allocbt+0xf3/0x160 fs/xfs/scrub/alloc_repair.c:930
> > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > RIP: 0033:0x45a879
> > > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48
> > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> > > RSP: 002b:00007ffda72db7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > RAX: ffffffffffffffda RBX: 00000000004004b8 RCX: 000000000045a879
> > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > RBP: 00007ffda72db860 R08: 0000000000000004 R09: 0000000000000005
> > > R10: 0000000000000004 R11: 0000000000000246 R12: 000000000040b990
> > > R13: 0000000000000000 R14: 00000000004ca018 R15: 00000000004004b8
> > > </TASK>
> > > Modules linked in:
> > > ---[ end trace 0000000000000000 ]---
> > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > CR2: 00007fbbbc0430c8 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > PKRU: 55555554
> > > ----------------
> > > Code disassembly (best guess):
> > > 0: f2 00 66 43 repnz add %ah,0x43(%rsi)
> > > 4: c7 44 35 0d f3 f3 43 movl $0xc643f3f3,0xd(%rbp,%rsi,1)
> > > b: c6
> > > c: 44 35 0f f3 e8 1c rex.R xor $0x1ce8f30f,%eax
> > > 12: 44 39 fe cmp %r15d,%esi
> > > 15: 48 89 5c 24 40 mov %rbx,0x40(%rsp)
> > > 1a: 48 83 c3 48 add $0x48,%rbx
> > > 1e: 48 89 d8 mov %rbx,%rax
> > > 21: 48 c1 e8 03 shr $0x3,%rax
> > > 25: 48 89 44 24 30 mov %rax,0x30(%rsp)
> > > * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
> > > 2f: 84 c0 test %al,%al
> > > 31: 0f 85 d6 11 00 00 jne 0x120d
> > > 37: 44 0f b6 33 movzbl (%rbx),%r14d
> > > 3b: 41 ff ce dec %r14d
> > > 3e: bf .byte 0xbf
> > > 3f: 53 push %rbx
> > >
> > > ---
> > >
> > > The root cause of this issue is that in xchk_btree(), where the
> > > argument cur can be NULL but the function assume cur is not NULL,
> > > leading to a NULL pointer dereference when accessing member
> > > (https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L701).
> > >
> > > We can add a NULL check at the beginning of xchk_btree() to fix this issue:
> > > ```
> > > --- a/fs/xfs/scrub/btree.c
> > > +++ b/fs/xfs/scrub/btree.c
> > > @@ -693,6 +693,9 @@ xchk_btree(
> > > int level;
> > > int error = 0;
> > >
> > > + if (!cur)
> > > + return -EINVAL;
> >
> > Uh, no, don't just fling EINVAL up to userspace. Line 930 is the cntbt
> > revalidation in xrep_revalidate_allocbt. Why is that pointer
> > 0xdffffc0000000009? Did we somehow fail to allocate a cntbt cursor in
> > xchk_ag_btcur_init? Did that xchk_should_check_xref free it? Did we
> > fail to attach the AGF to sc->sa.agf_bp?
>
> Thanks for the feedback! I dug deeper into the root cause as you
> suggested, here is what I found:
>
> (1) The program executes XFS_IOC_ERROR_INJECTION branch in
> xfs_file_ioctl(), causes xfs_btree_check_block() to return
> -EFSCORRUPTED, which consequently marks the AG as sick (via
> xfs_btree_mark_sick).
"marks the AG as sick" ... which structure, specifically? I'm guessing
XFS_SICK_AG_CNTBT from context, but it'd be useful to state these things
from the data you've collected rather than relying on me to infer what's
going on.
> (2) Then, the program executes XFS_IOC_SCRUBV_METADATA branch in
> xfs_file_ioctl(), the setup function (xchk_setup_ag_allocbt())
Which scrub type is it calling, bnobt or cntbt?
> attempts to initialize the cursor. However, the sick flag makes kernel
> executes xchk_ag_btree_del_cursor_if_sick(), the cursor is freed and
> nullified.
Are you talking about the ->setup call after we've rebuilt both free
space btrees, just prior to step three? When that happens,
xchk_ag_btree_del_cursor_if_sick will see the XREP_ALREADY_FIXED flag
and mask out sc->sick_mask from mask:
/*
* If we just repaired some AG metadata, sc->sick_mask will reflect all
* the per-AG metadata types that were repaired. Exclude these from
* the filesystem health query because we have not yet updated the
* health status and we want everything to be scanned.
*/
if ((sc->flags & XREP_ALREADY_FIXED) &&
type_to_health_flag[sc->sm->sm_type].group == XHG_AG)
mask &= ~sc->sick_mask;
> (3) Lastly, the repair_eval function (xrep_revalidate_allocbt()) calls
> xchk_allocbt(). Since xchk_allocbt() assumes the cursor is valid, it
> passes the NULL pointer to xchk_btree, leading to the null-ptr-deref.
Sure, but xrep_allocbt sets sc->sick_mask to XFS_SICK_AG_BNOBT |
XFS_SICK_AG so any pre-existing bnobt or cntbt sick state in the
xfs_group will be ignored and neither cursor will be deleted when
setting up the revalidation.
> Based on above analysis, I think sc->sa.cnt_cur being NULL is expected
> when the AG is sick. I think the appropriate fix is to check NULL
> inside xchk_allocbt():
> ```
> --- a/fs/xfs/scrub/alloc.c
> +++ b/fs/xfs/scrub/alloc.c
> @@ -170,6 +170,9 @@ xchk_allocbt(
> return -EIO;
> }
>
> + if (!cur)
> + return -ENOENT;
This is not correct either. We've just rebuilt the bnobt and cntbt for
the AG which means that cursors for both btrees should be loaded and
ready for revalidation.
I think you need to look into xchk_ag_btree_del_cursor_if_sick to figure
out exactly what the xfs_group's sick state is, what @mask is, and what
sc->sick_mask is, and from that figure out if it's really deleting the
cntbt cursor. This is made more difficult because XFS error injection
is probabilistic so it could trigger on /any/ btree.
--D
> +
> return xchk_btree(sc, cur, xchk_allocbt_rec, &XFS_RMAP_OINFO_AG, &ca);
> }
> ```
> What do you think? :)
>
> >
> > > /*
> > > * Allocate the btree scrub context from the heap, because this
> > > * structure can get rather large. Don't let a caller feed us a
> > > ```
> > >
> > > After applying changes above and re-running reproducer, another issues
> > > is triggered:
> > >
> > > ---
> > > TITLE: KASAN: slab-use-after-free Read in xchk_btree_check_block_owner
> > >
> > > XFS (loop6): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > XFS (loop6): Ending clean mount
> > > ==================================================================
> > > BUG: KASAN: slab-use-after-free in
> > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > Read of size 8 at addr ffff88806af035d8 by task syz.6.59/14096
> > >
> > > CPU: 1 UID: 0 PID: 14096 Comm: syz.6.59 Not tainted 6.19.0-rc6-dirty
> > > #30 PREEMPT(full)
> > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > Call Trace:
> > > <TASK>
> > > __dump_stack lib/dump_stack.c:94 [inline]
> > > dump_stack_lvl+0x10e/0x190 lib/dump_stack.c:120
> > > print_address_description mm/kasan/report.c:378 [inline]
> > > print_report+0x17e/0x810 mm/kasan/report.c:482
> > > kasan_report+0x147/0x180 mm/kasan/report.c:595
> > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > RIP: 0033:0x7f71bddb459d
> > > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
> > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> > > RSP: 002b:00007f71bed71f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > RAX: ffffffffffffffda RBX: 00007f71be045fa0 RCX: 00007f71bddb459d
> > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > RBP: 00007f71bde52610 R08: 0000000000000000 R09: 0000000000000000
> > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > > R13: 00007f71be046038 R14: 00007f71be045fa0 R15: 00007f71bed52000
> > > </TASK>
> > >
> > > Allocated by task 14096:
> > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > unpoison_slab_object mm/kasan/common.c:340 [inline]
> > > __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
> > > kasan_slab_alloc include/linux/kasan.h:253 [inline]
> > > slab_post_alloc_hook mm/slub.c:4953 [inline]
> > > slab_alloc_node mm/slub.c:5263 [inline]
> > > kmem_cache_alloc_noprof+0x37d/0x710 mm/slub.c:5270
> > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > xfs_bnobt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:485
> > > xchk_ag_btcur_init+0xe0/0x5d0 fs/xfs/scrub/common.c:612
> > > xchk_ag_init fs/xfs/scrub/common.c:698 [inline]
> > > xchk_setup_ag_btree+0x295/0x310 fs/xfs/scrub/common.c:943
> > > xchk_setup_ag_allocbt+0x70/0x190 fs/xfs/scrub/alloc.c:35
> > > xfs_scrub_metadata+0xa9e/0x1920 fs/xfs/scrub/scrub.c:709
> > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > >
> > > Freed by task 14096:
> > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
> > > poison_slab_object mm/kasan/common.c:253 [inline]
> > > __kasan_slab_free+0x58/0x80 mm/kasan/common.c:285
> > > kasan_slab_free include/linux/kasan.h:235 [inline]
> > > slab_free_hook mm/slub.c:2540 [inline]
> > > slab_free mm/slub.c:6670 [inline]
> > > kmem_cache_free+0x197/0x620 mm/slub.c:6781
> > > xchk_should_check_xref+0xf9/0x420 fs/xfs/scrub/common.c:1351
> > > xchk_xref_is_used_space+0x14b/0x210 fs/xfs/scrub/alloc.c:190
> > > xchk_btree_check_block_owner+0x2fe/0x600 fs/xfs/scrub/btree.c:395
> > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > >
> > > The buggy address belongs to the object at ffff88806af035c8
> > > which belongs to the cache xfs_bnobt_cur of size 232
> > > The buggy address is located 16 bytes inside of
> > > freed 232-byte region [ffff88806af035c8, ffff88806af036b0)
> > >
> > > The buggy address belongs to the physical page:
> > > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6af03
> > > ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
> > > page_type: f5(slab)
> > > raw: 04fff00000000000 ffff88801dd96a00 ffffea000094fdc0 0000000000000003
> > > raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
> > > page dumped because: kasan: bad access detected
> > > page_owner tracks the page as allocated
> > > page last allocated via order 0, migratetype Unmovable, gfp_mask
> > > 0x1052c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOLOCKDEP),
> > > pid 13126, tgid 13119 (syz.4.29), ts 58027826746, free_ts 57929202822
> > > set_page_owner include/linux/page_owner.h:32 [inline]
> > > post_alloc_hook+0x234/0x290 mm/page_alloc.c:1884
> > > prep_new_page mm/page_alloc.c:1892 [inline]
> > > get_page_from_freelist+0x24e4/0x2580 mm/page_alloc.c:3945
> > > __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5240
> > > alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
> > > alloc_slab_page mm/slub.c:3075 [inline]
> > > allocate_slab+0x86/0x3b0 mm/slub.c:3248
> > > new_slab mm/slub.c:3302 [inline]
> > > ___slab_alloc+0xe70/0x1860 mm/slub.c:4656
> > > __slab_alloc+0x65/0x100 mm/slub.c:4779
> > > __slab_alloc_node mm/slub.c:4855 [inline]
> > > slab_alloc_node mm/slub.c:5251 [inline]
> > > kmem_cache_alloc_noprof+0x40f/0x710 mm/slub.c:5270
> > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > xfs_cntbt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:511
> > > xfs_free_ag_extent+0x570/0x1890 fs/xfs/libxfs/xfs_alloc.c:2149
> > > __xfs_free_extent+0x2a7/0x460 fs/xfs/libxfs/xfs_alloc.c:4047
> > > xfs_extent_free_finish_item+0x299/0x840 fs/xfs/xfs_extfree_item.c:555
> > > xfs_defer_finish_one+0x5a6/0xcc0 fs/xfs/libxfs/xfs_defer.c:595
> > > xfs_defer_finish_noroll+0x94a/0x1300 fs/xfs/libxfs/xfs_defer.c:707
> > > xfs_defer_finish+0x1e/0x270 fs/xfs/libxfs/xfs_defer.c:741
> > > xrep_defer_finish+0x16e/0x240 fs/xfs/scrub/repair.c:242
> > > page last free pid 785 tgid 785 stack trace:
> > > reset_page_owner include/linux/page_owner.h:25 [inline]
> > > free_pages_prepare mm/page_alloc.c:1433 [inline]
> > > __free_frozen_pages+0xbc4/0xd40 mm/page_alloc.c:2973
> > > vfree+0x25a/0x400 mm/vmalloc.c:3466
> > > delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3385
> > > process_one_work kernel/workqueue.c:3257 [inline]
> > > process_scheduled_works+0xa45/0x1670 kernel/workqueue.c:3340
> > > worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
> > > kthread+0x711/0x8a0 kernel/kthread.c:463
> > > ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
> > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> > >
> > > Memory state around the buggy address:
> > > ffff88806af03480: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
> > > ffff88806af03500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > >ffff88806af03580: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
> > > ^
> > > ffff88806af03600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > ffff88806af03680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
> > > ==================================================================
> > > ---
> > >
> > > I also analyzed the root cause of this issue. In
> > > xchk_btree_check_block_owner(), bs->cur is an alias for
> > > bs->sc->sa.bnocur (or rmap_cur,
> > > https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L396-L400).
> > > The issue occurs when error injection triggers a failure path:
> > >
> > > 1. xchk_btree_check_block_owner() calls xchk_xref_is_used_space()
> > > 2. In xchk_xref_is_used_space(), xfs_alloc_has_records() returns a
> > > non-zero error due to error injection
> > > 3. Non-zero error causes xchk_should_check_xref() to free curpp (which
> > > points to bs->sc->sa.bnocur).
> > > 4. Memory pointed to by bs->cur is freed.
> > >
> > > Control returns to xchk_btree_check_block_owner(), which subsequently
> > > accesses bs->cur->bc_ops, triggering the UAF.
> > >
> > > P.S. this issue can also be triggered independently by syzkaller using
> > > our generated specs.
> > >
> > > To fix this issue, we can cache values of
> > > xfs_btree_is_bno(bs->cur->bc_ops) and
> > > xfs_btree_is_rmap(bs->cur->bc_ops) at the beginning of the function:
> > > ```
> > > --- a/fs/xfs/scrub/btree.c
> > > +++ b/fs/xfs/scrub/btree.c
> > > @@ -371,6 +371,8 @@ xchk_btree_check_block_owner(
> > > xfs_agnumber_t agno;
> > > xfs_agblock_t agbno;
> > > bool init_sa;
> > > + bool is_bno;
> > > + bool is_rmap;
> > > int error = 0;
> > >
> > > if (!bs->cur)
> > > @@ -379,6 +381,9 @@ xchk_btree_check_block_owner(
> > > agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
> > > agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
> > >
> > > + is_bno = xfs_btree_is_bno(bs->cur->bc_ops);
> > > + is_rmap = xfs_btree_is_rmap(bs->cur->bc_ops);
> > > +
> > > /*
> > > * If the btree being examined is not itself a per-AG btree, initialize
> > > * sc->sa so that we can check for the presence of an ownership record
> > > @@ -398,11 +403,11 @@ xchk_btree_check_block_owner(
> > > * have to nullify it (to shut down further block owner checks) if
> > > * self-xref encounters problems.
> > > */
> > > - if (!bs->sc->sa.bno_cur && xfs_btree_is_bno(bs->cur->bc_ops))
> > > + if (!bs->sc->sa.bno_cur && is_bno)
> > > bs->cur = NULL;
> > >
> > > xchk_xref_is_only_owned_by(bs->sc, agbno, 1, bs->oinfo);
> > > - if (!bs->sc->sa.rmap_cur && xfs_btree_is_rmap(bs->cur->bc_ops))
> > > + if (!bs->sc->sa.rmap_cur && is_rmap)
> >
> > Indentation problems notwithstanding, that looks like a correct
> > resolution to the UAF problem.
> >
> > > bs->cur = NULL;
> > >
> > > out_free:
> > > ```
> > >
> > > After applying above changes, reproducer ran for ~35 minutes without
> > > triggering any issues.
> > >
> > > If above solutions are acceptable, we are happy to submit patches :)
> > >
> > > The kernel console output, kernel config, syzkaller reproducer, and C
> > > reproducer are also attached to help with analysis.
> > >
> > > Please let me know if any further information is required.
> > >
> > > Best Regards,
> > > Jiaming Zhang
> >
> > Please just link to your dashboard, don't send a 1MB email to dozens
> > of people.
> >
> > --D
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue
2026-01-21 19:23 ` Darrick J. Wong
@ 2026-01-22 11:30 ` Jiaming Zhang
2026-01-22 23:10 ` Darrick J. Wong
0 siblings, 1 reply; 8+ messages in thread
From: Jiaming Zhang @ 2026-01-22 11:30 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: cem, linux-xfs, linux-kernel, pchelkin, syzkaller
Darrick J. Wong <djwong@kernel.org> 于2026年1月22日周四 03:23写道：
>
> On Wed, Jan 21, 2026 at 06:14:06PM +0800, Jiaming Zhang wrote:
> > Darrick J. Wong <djwong@kernel.org> 于2026年1月21日周三 03:17写道：
> > >
> > > On Tue, Jan 20, 2026 at 06:13:44PM +0800, Jiaming Zhang wrote:
> > > > Dear Linux kernel developers and maintainers,
> > > >
> > > > We are writing to report a general protection fault discovered in the
> > > > xfs subsystem with our generated syzkaller specifications. This issue
> > > > is reproducible on the latest version of linux (v6.19-rc6, commit
> > > > 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7). The KASAN report from
> > > > kernel is listed below (formatted by syz-symbolize):
> > > >
> > > > ---
> > > >
> > > > loop0: detected capacity change from 0 to 32768
> > > > XFS (loop0): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > > XFS (loop0): Ending clean mount
> > > > XFS (loop0): Injecting error at file fs/xfs/libxfs/xfs_btree.c, line
> > > > 309, on filesystem "loop0"
> > > > Oops: general protection fault, probably for non-canonical address
> > > > 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
> > > > KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
> > > > CPU: 1 UID: 0 PID: 9920 Comm: repro.out Not tainted 6.19.0-rc6 #24 PREEMPT(full)
> > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > CR2: 0000200000002700 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > > PKRU: 55555554
> > > > Call Trace:
> > > > <TASK>
> > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > xrep_revalidate_allocbt+0xf3/0x160 fs/xfs/scrub/alloc_repair.c:930
> > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > RIP: 0033:0x45a879
> > > > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48
> > > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > > 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> > > > RSP: 002b:00007ffda72db7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > > RAX: ffffffffffffffda RBX: 00000000004004b8 RCX: 000000000045a879
> > > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > > RBP: 00007ffda72db860 R08: 0000000000000004 R09: 0000000000000005
> > > > R10: 0000000000000004 R11: 0000000000000246 R12: 000000000040b990
> > > > R13: 0000000000000000 R14: 00000000004ca018 R15: 00000000004004b8
> > > > </TASK>
> > > > Modules linked in:
> > > > ---[ end trace 0000000000000000 ]---
> > > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > CR2: 00007fbbbc0430c8 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > > PKRU: 55555554
> > > > ----------------
> > > > Code disassembly (best guess):
> > > > 0: f2 00 66 43 repnz add %ah,0x43(%rsi)
> > > > 4: c7 44 35 0d f3 f3 43 movl $0xc643f3f3,0xd(%rbp,%rsi,1)
> > > > b: c6
> > > > c: 44 35 0f f3 e8 1c rex.R xor $0x1ce8f30f,%eax
> > > > 12: 44 39 fe cmp %r15d,%esi
> > > > 15: 48 89 5c 24 40 mov %rbx,0x40(%rsp)
> > > > 1a: 48 83 c3 48 add $0x48,%rbx
> > > > 1e: 48 89 d8 mov %rbx,%rax
> > > > 21: 48 c1 e8 03 shr $0x3,%rax
> > > > 25: 48 89 44 24 30 mov %rax,0x30(%rsp)
> > > > * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
> > > > 2f: 84 c0 test %al,%al
> > > > 31: 0f 85 d6 11 00 00 jne 0x120d
> > > > 37: 44 0f b6 33 movzbl (%rbx),%r14d
> > > > 3b: 41 ff ce dec %r14d
> > > > 3e: bf .byte 0xbf
> > > > 3f: 53 push %rbx
> > > >
> > > > ---
> > > >
> > > > The root cause of this issue is that in xchk_btree(), where the
> > > > argument cur can be NULL but the function assume cur is not NULL,
> > > > leading to a NULL pointer dereference when accessing member
> > > > (https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L701).
> > > >
> > > > We can add a NULL check at the beginning of xchk_btree() to fix this issue:
> > > > ```
> > > > --- a/fs/xfs/scrub/btree.c
> > > > +++ b/fs/xfs/scrub/btree.c
> > > > @@ -693,6 +693,9 @@ xchk_btree(
> > > > int level;
> > > > int error = 0;
> > > >
> > > > + if (!cur)
> > > > + return -EINVAL;
> > >
> > > Uh, no, don't just fling EINVAL up to userspace. Line 930 is the cntbt
> > > revalidation in xrep_revalidate_allocbt. Why is that pointer
> > > 0xdffffc0000000009? Did we somehow fail to allocate a cntbt cursor in
> > > xchk_ag_btcur_init? Did that xchk_should_check_xref free it? Did we
> > > fail to attach the AGF to sc->sa.agf_bp?
> >
> > Thanks for the feedback! I dug deeper into the root cause as you
> > suggested, here is what I found:
> >
> > (1) The program executes XFS_IOC_ERROR_INJECTION branch in
> > xfs_file_ioctl(), causes xfs_btree_check_block() to return
> > -EFSCORRUPTED, which consequently marks the AG as sick (via
> > xfs_btree_mark_sick).
>
> "marks the AG as sick" ... which structure, specifically? I'm guessing
> XFS_SICK_AG_CNTBT from context, but it'd be useful to state these things
> from the data you've collected rather than relying on me to infer what's
> going on.
>
> > (2) Then, the program executes XFS_IOC_SCRUBV_METADATA branch in
> > xfs_file_ioctl(), the setup function (xchk_setup_ag_allocbt())
>
> Which scrub type is it calling, bnobt or cntbt?
>
> > attempts to initialize the cursor. However, the sick flag makes kernel
> > executes xchk_ag_btree_del_cursor_if_sick(), the cursor is freed and
> > nullified.
>
> Are you talking about the ->setup call after we've rebuilt both free
> space btrees, just prior to step three? When that happens,
> xchk_ag_btree_del_cursor_if_sick will see the XREP_ALREADY_FIXED flag
> and mask out sc->sick_mask from mask:
>
> /*
> * If we just repaired some AG metadata, sc->sick_mask will reflect all
> * the per-AG metadata types that were repaired. Exclude these from
> * the filesystem health query because we have not yet updated the
> * health status and we want everything to be scanned.
> */
> if ((sc->flags & XREP_ALREADY_FIXED) &&
> type_to_health_flag[sc->sm->sm_type].group == XHG_AG)
> mask &= ~sc->sick_mask;
>
> > (3) Lastly, the repair_eval function (xrep_revalidate_allocbt()) calls
> > xchk_allocbt(). Since xchk_allocbt() assumes the cursor is valid, it
> > passes the NULL pointer to xchk_btree, leading to the null-ptr-deref.
>
> Sure, but xrep_allocbt sets sc->sick_mask to XFS_SICK_AG_BNOBT |
> XFS_SICK_AG so any pre-existing bnobt or cntbt sick state in the
> xfs_group will be ignored and neither cursor will be deleted when
> setting up the revalidation.
>
> > Based on above analysis, I think sc->sa.cnt_cur being NULL is expected
> > when the AG is sick. I think the appropriate fix is to check NULL
> > inside xchk_allocbt():
> > ```
> > --- a/fs/xfs/scrub/alloc.c
> > +++ b/fs/xfs/scrub/alloc.c
> > @@ -170,6 +170,9 @@ xchk_allocbt(
> > return -EIO;
> > }
> >
> > + if (!cur)
> > + return -ENOENT;
>
> This is not correct either. We've just rebuilt the bnobt and cntbt for
> the AG which means that cursors for both btrees should be loaded and
> ready for revalidation.
>
> I think you need to look into xchk_ag_btree_del_cursor_if_sick to figure
> out exactly what the xfs_group's sick state is, what @mask is, and what
> sc->sick_mask is, and from that figure out if it's really deleting the
> cntbt cursor. This is made more difficult because XFS error injection
> is probabilistic so it could trigger on /any/ btree.
>
> --D
>
> > +
> > return xchk_btree(sc, cur, xchk_allocbt_rec, &XFS_RMAP_OINFO_AG, &ca);
> > }
> > ```
> > What do you think? :)
> >
> > >
> > > > /*
> > > > * Allocate the btree scrub context from the heap, because this
> > > > * structure can get rather large. Don't let a caller feed us a
> > > > ```
> > > >
> > > > After applying changes above and re-running reproducer, another issues
> > > > is triggered:
> > > >
> > > > ---
> > > > TITLE: KASAN: slab-use-after-free Read in xchk_btree_check_block_owner
> > > >
> > > > XFS (loop6): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > > XFS (loop6): Ending clean mount
> > > > ==================================================================
> > > > BUG: KASAN: slab-use-after-free in
> > > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > > Read of size 8 at addr ffff88806af035d8 by task syz.6.59/14096
> > > >
> > > > CPU: 1 UID: 0 PID: 14096 Comm: syz.6.59 Not tainted 6.19.0-rc6-dirty
> > > > #30 PREEMPT(full)
> > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > > Call Trace:
> > > > <TASK>
> > > > __dump_stack lib/dump_stack.c:94 [inline]
> > > > dump_stack_lvl+0x10e/0x190 lib/dump_stack.c:120
> > > > print_address_description mm/kasan/report.c:378 [inline]
> > > > print_report+0x17e/0x810 mm/kasan/report.c:482
> > > > kasan_report+0x147/0x180 mm/kasan/report.c:595
> > > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > RIP: 0033:0x7f71bddb459d
> > > > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
> > > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > > 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> > > > RSP: 002b:00007f71bed71f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > > RAX: ffffffffffffffda RBX: 00007f71be045fa0 RCX: 00007f71bddb459d
> > > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > > RBP: 00007f71bde52610 R08: 0000000000000000 R09: 0000000000000000
> > > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > > > R13: 00007f71be046038 R14: 00007f71be045fa0 R15: 00007f71bed52000
> > > > </TASK>
> > > >
> > > > Allocated by task 14096:
> > > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > > unpoison_slab_object mm/kasan/common.c:340 [inline]
> > > > __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
> > > > kasan_slab_alloc include/linux/kasan.h:253 [inline]
> > > > slab_post_alloc_hook mm/slub.c:4953 [inline]
> > > > slab_alloc_node mm/slub.c:5263 [inline]
> > > > kmem_cache_alloc_noprof+0x37d/0x710 mm/slub.c:5270
> > > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > > xfs_bnobt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:485
> > > > xchk_ag_btcur_init+0xe0/0x5d0 fs/xfs/scrub/common.c:612
> > > > xchk_ag_init fs/xfs/scrub/common.c:698 [inline]
> > > > xchk_setup_ag_btree+0x295/0x310 fs/xfs/scrub/common.c:943
> > > > xchk_setup_ag_allocbt+0x70/0x190 fs/xfs/scrub/alloc.c:35
> > > > xfs_scrub_metadata+0xa9e/0x1920 fs/xfs/scrub/scrub.c:709
> > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > >
> > > > Freed by task 14096:
> > > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > > kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
> > > > poison_slab_object mm/kasan/common.c:253 [inline]
> > > > __kasan_slab_free+0x58/0x80 mm/kasan/common.c:285
> > > > kasan_slab_free include/linux/kasan.h:235 [inline]
> > > > slab_free_hook mm/slub.c:2540 [inline]
> > > > slab_free mm/slub.c:6670 [inline]
> > > > kmem_cache_free+0x197/0x620 mm/slub.c:6781
> > > > xchk_should_check_xref+0xf9/0x420 fs/xfs/scrub/common.c:1351
> > > > xchk_xref_is_used_space+0x14b/0x210 fs/xfs/scrub/alloc.c:190
> > > > xchk_btree_check_block_owner+0x2fe/0x600 fs/xfs/scrub/btree.c:395
> > > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > >
> > > > The buggy address belongs to the object at ffff88806af035c8
> > > > which belongs to the cache xfs_bnobt_cur of size 232
> > > > The buggy address is located 16 bytes inside of
> > > > freed 232-byte region [ffff88806af035c8, ffff88806af036b0)
> > > >
> > > > The buggy address belongs to the physical page:
> > > > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6af03
> > > > ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
> > > > page_type: f5(slab)
> > > > raw: 04fff00000000000 ffff88801dd96a00 ffffea000094fdc0 0000000000000003
> > > > raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
> > > > page dumped because: kasan: bad access detected
> > > > page_owner tracks the page as allocated
> > > > page last allocated via order 0, migratetype Unmovable, gfp_mask
> > > > 0x1052c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOLOCKDEP),
> > > > pid 13126, tgid 13119 (syz.4.29), ts 58027826746, free_ts 57929202822
> > > > set_page_owner include/linux/page_owner.h:32 [inline]
> > > > post_alloc_hook+0x234/0x290 mm/page_alloc.c:1884
> > > > prep_new_page mm/page_alloc.c:1892 [inline]
> > > > get_page_from_freelist+0x24e4/0x2580 mm/page_alloc.c:3945
> > > > __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5240
> > > > alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
> > > > alloc_slab_page mm/slub.c:3075 [inline]
> > > > allocate_slab+0x86/0x3b0 mm/slub.c:3248
> > > > new_slab mm/slub.c:3302 [inline]
> > > > ___slab_alloc+0xe70/0x1860 mm/slub.c:4656
> > > > __slab_alloc+0x65/0x100 mm/slub.c:4779
> > > > __slab_alloc_node mm/slub.c:4855 [inline]
> > > > slab_alloc_node mm/slub.c:5251 [inline]
> > > > kmem_cache_alloc_noprof+0x40f/0x710 mm/slub.c:5270
> > > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > > xfs_cntbt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:511
> > > > xfs_free_ag_extent+0x570/0x1890 fs/xfs/libxfs/xfs_alloc.c:2149
> > > > __xfs_free_extent+0x2a7/0x460 fs/xfs/libxfs/xfs_alloc.c:4047
> > > > xfs_extent_free_finish_item+0x299/0x840 fs/xfs/xfs_extfree_item.c:555
> > > > xfs_defer_finish_one+0x5a6/0xcc0 fs/xfs/libxfs/xfs_defer.c:595
> > > > xfs_defer_finish_noroll+0x94a/0x1300 fs/xfs/libxfs/xfs_defer.c:707
> > > > xfs_defer_finish+0x1e/0x270 fs/xfs/libxfs/xfs_defer.c:741
> > > > xrep_defer_finish+0x16e/0x240 fs/xfs/scrub/repair.c:242
> > > > page last free pid 785 tgid 785 stack trace:
> > > > reset_page_owner include/linux/page_owner.h:25 [inline]
> > > > free_pages_prepare mm/page_alloc.c:1433 [inline]
> > > > __free_frozen_pages+0xbc4/0xd40 mm/page_alloc.c:2973
> > > > vfree+0x25a/0x400 mm/vmalloc.c:3466
> > > > delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3385
> > > > process_one_work kernel/workqueue.c:3257 [inline]
> > > > process_scheduled_works+0xa45/0x1670 kernel/workqueue.c:3340
> > > > worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
> > > > kthread+0x711/0x8a0 kernel/kthread.c:463
> > > > ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
> > > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> > > >
> > > > Memory state around the buggy address:
> > > > ffff88806af03480: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
> > > > ffff88806af03500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > > >ffff88806af03580: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
> > > > ^
> > > > ffff88806af03600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > > ffff88806af03680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
> > > > ==================================================================
> > > > ---
> > > >
> > > > I also analyzed the root cause of this issue. In
> > > > xchk_btree_check_block_owner(), bs->cur is an alias for
> > > > bs->sc->sa.bnocur (or rmap_cur,
> > > > https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L396-L400).
> > > > The issue occurs when error injection triggers a failure path:
> > > >
> > > > 1. xchk_btree_check_block_owner() calls xchk_xref_is_used_space()
> > > > 2. In xchk_xref_is_used_space(), xfs_alloc_has_records() returns a
> > > > non-zero error due to error injection
> > > > 3. Non-zero error causes xchk_should_check_xref() to free curpp (which
> > > > points to bs->sc->sa.bnocur).
> > > > 4. Memory pointed to by bs->cur is freed.
> > > >
> > > > Control returns to xchk_btree_check_block_owner(), which subsequently
> > > > accesses bs->cur->bc_ops, triggering the UAF.
> > > >
> > > > P.S. this issue can also be triggered independently by syzkaller using
> > > > our generated specs.
> > > >
> > > > To fix this issue, we can cache values of
> > > > xfs_btree_is_bno(bs->cur->bc_ops) and
> > > > xfs_btree_is_rmap(bs->cur->bc_ops) at the beginning of the function:
> > > > ```
> > > > --- a/fs/xfs/scrub/btree.c
> > > > +++ b/fs/xfs/scrub/btree.c
> > > > @@ -371,6 +371,8 @@ xchk_btree_check_block_owner(
> > > > xfs_agnumber_t agno;
> > > > xfs_agblock_t agbno;
> > > > bool init_sa;
> > > > + bool is_bno;
> > > > + bool is_rmap;
> > > > int error = 0;
> > > >
> > > > if (!bs->cur)
> > > > @@ -379,6 +381,9 @@ xchk_btree_check_block_owner(
> > > > agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
> > > > agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
> > > >
> > > > + is_bno = xfs_btree_is_bno(bs->cur->bc_ops);
> > > > + is_rmap = xfs_btree_is_rmap(bs->cur->bc_ops);
> > > > +
> > > > /*
> > > > * If the btree being examined is not itself a per-AG btree, initialize
> > > > * sc->sa so that we can check for the presence of an ownership record
> > > > @@ -398,11 +403,11 @@ xchk_btree_check_block_owner(
> > > > * have to nullify it (to shut down further block owner checks) if
> > > > * self-xref encounters problems.
> > > > */
> > > > - if (!bs->sc->sa.bno_cur && xfs_btree_is_bno(bs->cur->bc_ops))
> > > > + if (!bs->sc->sa.bno_cur && is_bno)
> > > > bs->cur = NULL;
> > > >
> > > > xchk_xref_is_only_owned_by(bs->sc, agbno, 1, bs->oinfo);
> > > > - if (!bs->sc->sa.rmap_cur && xfs_btree_is_rmap(bs->cur->bc_ops))
> > > > + if (!bs->sc->sa.rmap_cur && is_rmap)
> > >
> > > Indentation problems notwithstanding, that looks like a correct
> > > resolution to the UAF problem.
> > >
> > > > bs->cur = NULL;
> > > >
> > > > out_free:
> > > > ```
> > > >
> > > > After applying above changes, reproducer ran for ~35 minutes without
> > > > triggering any issues.
> > > >
> > > > If above solutions are acceptable, we are happy to submit patches :)
> > > >
> > > > The kernel console output, kernel config, syzkaller reproducer, and C
> > > > reproducer are also attached to help with analysis.
> > > >
> > > > Please let me know if any further information is required.
> > > >
> > > > Best Regards,
> > > > Jiaming Zhang
> > >
> > > Please just link to your dashboard, don't send a 1MB email to dozens
> > > of people.
> > >
> > > --D
> >
Hi Darrick,
I checked the execution path again and I have to apologize, my
analysis yesterday was partly incorrect.
I have new findings today that point how the cursor is nullified
during the revalidation. I detailed below.
In xrep_revalidate_allocbt(), xchk_allocbt() is called twice (first
for BNOBT, second for CNTBT). The cause of this issue is that the
first call nullified the cursor required by the second call.
Let's first enter xrep_revalidate_allocbt() via following call chain:
xfs_file_ioctl() ->
xfs_ioc_scrubv_metadata() ->
xfs_scrub_metadata() ->
`sc->ops->repair_eval(sc)` ->
xrep_revalidate_allocbt()
xchk_allocbt() is called twice in this function. In the first call:
/* Note that sc->sm->sm_type is XFS_SCRUB_TYPE_BNOPT now */
xchk_allocbt() ->
xchk_btree() ->
`bs->scrub_rec(bs, recp)` ->
xchk_allocbt_rec() ->
xchk_allocbt_xref() ->
xchk_allocbt_xref_other()
since sm_type is XFS_SCRUB_TYPE_BNOPT, pur is set to &sc->sa.cnt_cur.
Kernel called xfs_alloc_get_rec() and returned -EFSCORRUPTED. Call
chain:
xfs_alloc_get_rec() ->
xfs_btree_get_rec() ->
xfs_btree_check_block() ->
(XFS_IS_CORRUPT || XFS_TEST_ERROR), the former is false and the latter
is true, return -EFSCORRUPTED. This should be caused by
ioctl$XFS_IOC_ERROR_INJECTION I guess.
Back to xchk_allocbt_xref_other(), after receiving -EFSCORRUPTED from
xfs_alloc_get_rec(), kernel called xchk_should_check_xref(). In this
function, *curpp (points to sc->sa.cnt_cur) is nullified.
Back to xrep_revalidate_allocbt(), since sc->sa.cnt_cur has been
nullified, it then triggered null-ptr-deref via xchk_allocbt() (second
call) -> xchk_btree().
I noticed that at the beginning of xchk_should_check_xref(), it
checked whether xref should be skipped. Can this issue be fixed if
kernel skips xref in this case? I'm not sure.
I hope the analysis is helpful. Feel free to contact me if any further
information is needed.
Best Regards,
Jiaming Zhang
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue
2026-01-22 11:30 ` Jiaming Zhang
@ 2026-01-22 23:10 ` Darrick J. Wong
2026-01-23 2:08 ` Jiaming Zhang
0 siblings, 1 reply; 8+ messages in thread
From: Darrick J. Wong @ 2026-01-22 23:10 UTC (permalink / raw)
To: Jiaming Zhang; +Cc: cem, linux-xfs, linux-kernel, pchelkin, syzkaller
On Thu, Jan 22, 2026 at 07:30:23PM +0800, Jiaming Zhang wrote:
> Darrick J. Wong <djwong@kernel.org> 于2026年1月22日周四 03:23写道：
> >
> > On Wed, Jan 21, 2026 at 06:14:06PM +0800, Jiaming Zhang wrote:
> > > Darrick J. Wong <djwong@kernel.org> 于2026年1月21日周三 03:17写道：
> > > >
> > > > On Tue, Jan 20, 2026 at 06:13:44PM +0800, Jiaming Zhang wrote:
> > > > > Dear Linux kernel developers and maintainers,
> > > > >
> > > > > We are writing to report a general protection fault discovered in the
> > > > > xfs subsystem with our generated syzkaller specifications. This issue
> > > > > is reproducible on the latest version of linux (v6.19-rc6, commit
> > > > > 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7). The KASAN report from
> > > > > kernel is listed below (formatted by syz-symbolize):
> > > > >
> > > > > ---
> > > > >
> > > > > loop0: detected capacity change from 0 to 32768
> > > > > XFS (loop0): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > > > XFS (loop0): Ending clean mount
> > > > > XFS (loop0): Injecting error at file fs/xfs/libxfs/xfs_btree.c, line
> > > > > 309, on filesystem "loop0"
> > > > > Oops: general protection fault, probably for non-canonical address
> > > > > 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
> > > > > KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
> > > > > CPU: 1 UID: 0 PID: 9920 Comm: repro.out Not tainted 6.19.0-rc6 #24 PREEMPT(full)
> > > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > > CR2: 0000200000002700 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > > > PKRU: 55555554
> > > > > Call Trace:
> > > > > <TASK>
> > > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > > xrep_revalidate_allocbt+0xf3/0x160 fs/xfs/scrub/alloc_repair.c:930
> > > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > RIP: 0033:0x45a879
> > > > > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48
> > > > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > > > 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> > > > > RSP: 002b:00007ffda72db7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > > > RAX: ffffffffffffffda RBX: 00000000004004b8 RCX: 000000000045a879
> > > > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > > > RBP: 00007ffda72db860 R08: 0000000000000004 R09: 0000000000000005
> > > > > R10: 0000000000000004 R11: 0000000000000246 R12: 000000000040b990
> > > > > R13: 0000000000000000 R14: 00000000004ca018 R15: 00000000004004b8
> > > > > </TASK>
> > > > > Modules linked in:
> > > > > ---[ end trace 0000000000000000 ]---
> > > > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > > CR2: 00007fbbbc0430c8 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > > > PKRU: 55555554
> > > > > ----------------
> > > > > Code disassembly (best guess):
> > > > > 0: f2 00 66 43 repnz add %ah,0x43(%rsi)
> > > > > 4: c7 44 35 0d f3 f3 43 movl $0xc643f3f3,0xd(%rbp,%rsi,1)
> > > > > b: c6
> > > > > c: 44 35 0f f3 e8 1c rex.R xor $0x1ce8f30f,%eax
> > > > > 12: 44 39 fe cmp %r15d,%esi
> > > > > 15: 48 89 5c 24 40 mov %rbx,0x40(%rsp)
> > > > > 1a: 48 83 c3 48 add $0x48,%rbx
> > > > > 1e: 48 89 d8 mov %rbx,%rax
> > > > > 21: 48 c1 e8 03 shr $0x3,%rax
> > > > > 25: 48 89 44 24 30 mov %rax,0x30(%rsp)
> > > > > * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
> > > > > 2f: 84 c0 test %al,%al
> > > > > 31: 0f 85 d6 11 00 00 jne 0x120d
> > > > > 37: 44 0f b6 33 movzbl (%rbx),%r14d
> > > > > 3b: 41 ff ce dec %r14d
> > > > > 3e: bf .byte 0xbf
> > > > > 3f: 53 push %rbx
> > > > >
> > > > > ---
> > > > >
> > > > > The root cause of this issue is that in xchk_btree(), where the
> > > > > argument cur can be NULL but the function assume cur is not NULL,
> > > > > leading to a NULL pointer dereference when accessing member
> > > > > (https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L701).
> > > > >
> > > > > We can add a NULL check at the beginning of xchk_btree() to fix this issue:
> > > > > ```
> > > > > --- a/fs/xfs/scrub/btree.c
> > > > > +++ b/fs/xfs/scrub/btree.c
> > > > > @@ -693,6 +693,9 @@ xchk_btree(
> > > > > int level;
> > > > > int error = 0;
> > > > >
> > > > > + if (!cur)
> > > > > + return -EINVAL;
> > > >
> > > > Uh, no, don't just fling EINVAL up to userspace. Line 930 is the cntbt
> > > > revalidation in xrep_revalidate_allocbt. Why is that pointer
> > > > 0xdffffc0000000009? Did we somehow fail to allocate a cntbt cursor in
> > > > xchk_ag_btcur_init? Did that xchk_should_check_xref free it? Did we
> > > > fail to attach the AGF to sc->sa.agf_bp?
> > >
> > > Thanks for the feedback! I dug deeper into the root cause as you
> > > suggested, here is what I found:
> > >
> > > (1) The program executes XFS_IOC_ERROR_INJECTION branch in
> > > xfs_file_ioctl(), causes xfs_btree_check_block() to return
> > > -EFSCORRUPTED, which consequently marks the AG as sick (via
> > > xfs_btree_mark_sick).
> >
> > "marks the AG as sick" ... which structure, specifically? I'm guessing
> > XFS_SICK_AG_CNTBT from context, but it'd be useful to state these things
> > from the data you've collected rather than relying on me to infer what's
> > going on.
> >
> > > (2) Then, the program executes XFS_IOC_SCRUBV_METADATA branch in
> > > xfs_file_ioctl(), the setup function (xchk_setup_ag_allocbt())
> >
> > Which scrub type is it calling, bnobt or cntbt?
> >
> > > attempts to initialize the cursor. However, the sick flag makes kernel
> > > executes xchk_ag_btree_del_cursor_if_sick(), the cursor is freed and
> > > nullified.
> >
> > Are you talking about the ->setup call after we've rebuilt both free
> > space btrees, just prior to step three? When that happens,
> > xchk_ag_btree_del_cursor_if_sick will see the XREP_ALREADY_FIXED flag
> > and mask out sc->sick_mask from mask:
> >
> > /*
> > * If we just repaired some AG metadata, sc->sick_mask will reflect all
> > * the per-AG metadata types that were repaired. Exclude these from
> > * the filesystem health query because we have not yet updated the
> > * health status and we want everything to be scanned.
> > */
> > if ((sc->flags & XREP_ALREADY_FIXED) &&
> > type_to_health_flag[sc->sm->sm_type].group == XHG_AG)
> > mask &= ~sc->sick_mask;
> >
> > > (3) Lastly, the repair_eval function (xrep_revalidate_allocbt()) calls
> > > xchk_allocbt(). Since xchk_allocbt() assumes the cursor is valid, it
> > > passes the NULL pointer to xchk_btree, leading to the null-ptr-deref.
> >
> > Sure, but xrep_allocbt sets sc->sick_mask to XFS_SICK_AG_BNOBT |
> > XFS_SICK_AG so any pre-existing bnobt or cntbt sick state in the
> > xfs_group will be ignored and neither cursor will be deleted when
> > setting up the revalidation.
> >
> > > Based on above analysis, I think sc->sa.cnt_cur being NULL is expected
> > > when the AG is sick. I think the appropriate fix is to check NULL
> > > inside xchk_allocbt():
> > > ```
> > > --- a/fs/xfs/scrub/alloc.c
> > > +++ b/fs/xfs/scrub/alloc.c
> > > @@ -170,6 +170,9 @@ xchk_allocbt(
> > > return -EIO;
> > > }
> > >
> > > + if (!cur)
> > > + return -ENOENT;
> >
> > This is not correct either. We've just rebuilt the bnobt and cntbt for
> > the AG which means that cursors for both btrees should be loaded and
> > ready for revalidation.
> >
> > I think you need to look into xchk_ag_btree_del_cursor_if_sick to figure
> > out exactly what the xfs_group's sick state is, what @mask is, and what
> > sc->sick_mask is, and from that figure out if it's really deleting the
> > cntbt cursor. This is made more difficult because XFS error injection
> > is probabilistic so it could trigger on /any/ btree.
> >
> > --D
> >
> > > +
> > > return xchk_btree(sc, cur, xchk_allocbt_rec, &XFS_RMAP_OINFO_AG, &ca);
> > > }
> > > ```
> > > What do you think? :)
> > >
> > > >
> > > > > /*
> > > > > * Allocate the btree scrub context from the heap, because this
> > > > > * structure can get rather large. Don't let a caller feed us a
> > > > > ```
> > > > >
> > > > > After applying changes above and re-running reproducer, another issues
> > > > > is triggered:
> > > > >
> > > > > ---
> > > > > TITLE: KASAN: slab-use-after-free Read in xchk_btree_check_block_owner
> > > > >
> > > > > XFS (loop6): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > > > XFS (loop6): Ending clean mount
> > > > > ==================================================================
> > > > > BUG: KASAN: slab-use-after-free in
> > > > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > > > Read of size 8 at addr ffff88806af035d8 by task syz.6.59/14096
> > > > >
> > > > > CPU: 1 UID: 0 PID: 14096 Comm: syz.6.59 Not tainted 6.19.0-rc6-dirty
> > > > > #30 PREEMPT(full)
> > > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > > > Call Trace:
> > > > > <TASK>
> > > > > __dump_stack lib/dump_stack.c:94 [inline]
> > > > > dump_stack_lvl+0x10e/0x190 lib/dump_stack.c:120
> > > > > print_address_description mm/kasan/report.c:378 [inline]
> > > > > print_report+0x17e/0x810 mm/kasan/report.c:482
> > > > > kasan_report+0x147/0x180 mm/kasan/report.c:595
> > > > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > RIP: 0033:0x7f71bddb459d
> > > > > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
> > > > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > > > 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> > > > > RSP: 002b:00007f71bed71f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > > > RAX: ffffffffffffffda RBX: 00007f71be045fa0 RCX: 00007f71bddb459d
> > > > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > > > RBP: 00007f71bde52610 R08: 0000000000000000 R09: 0000000000000000
> > > > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > > > > R13: 00007f71be046038 R14: 00007f71be045fa0 R15: 00007f71bed52000
> > > > > </TASK>
> > > > >
> > > > > Allocated by task 14096:
> > > > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > > > unpoison_slab_object mm/kasan/common.c:340 [inline]
> > > > > __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
> > > > > kasan_slab_alloc include/linux/kasan.h:253 [inline]
> > > > > slab_post_alloc_hook mm/slub.c:4953 [inline]
> > > > > slab_alloc_node mm/slub.c:5263 [inline]
> > > > > kmem_cache_alloc_noprof+0x37d/0x710 mm/slub.c:5270
> > > > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > > > xfs_bnobt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:485
> > > > > xchk_ag_btcur_init+0xe0/0x5d0 fs/xfs/scrub/common.c:612
> > > > > xchk_ag_init fs/xfs/scrub/common.c:698 [inline]
> > > > > xchk_setup_ag_btree+0x295/0x310 fs/xfs/scrub/common.c:943
> > > > > xchk_setup_ag_allocbt+0x70/0x190 fs/xfs/scrub/alloc.c:35
> > > > > xfs_scrub_metadata+0xa9e/0x1920 fs/xfs/scrub/scrub.c:709
> > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > >
> > > > > Freed by task 14096:
> > > > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > > > kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
> > > > > poison_slab_object mm/kasan/common.c:253 [inline]
> > > > > __kasan_slab_free+0x58/0x80 mm/kasan/common.c:285
> > > > > kasan_slab_free include/linux/kasan.h:235 [inline]
> > > > > slab_free_hook mm/slub.c:2540 [inline]
> > > > > slab_free mm/slub.c:6670 [inline]
> > > > > kmem_cache_free+0x197/0x620 mm/slub.c:6781
> > > > > xchk_should_check_xref+0xf9/0x420 fs/xfs/scrub/common.c:1351
> > > > > xchk_xref_is_used_space+0x14b/0x210 fs/xfs/scrub/alloc.c:190
> > > > > xchk_btree_check_block_owner+0x2fe/0x600 fs/xfs/scrub/btree.c:395
> > > > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > >
> > > > > The buggy address belongs to the object at ffff88806af035c8
> > > > > which belongs to the cache xfs_bnobt_cur of size 232
> > > > > The buggy address is located 16 bytes inside of
> > > > > freed 232-byte region [ffff88806af035c8, ffff88806af036b0)
> > > > >
> > > > > The buggy address belongs to the physical page:
> > > > > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6af03
> > > > > ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
> > > > > page_type: f5(slab)
> > > > > raw: 04fff00000000000 ffff88801dd96a00 ffffea000094fdc0 0000000000000003
> > > > > raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
> > > > > page dumped because: kasan: bad access detected
> > > > > page_owner tracks the page as allocated
> > > > > page last allocated via order 0, migratetype Unmovable, gfp_mask
> > > > > 0x1052c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOLOCKDEP),
> > > > > pid 13126, tgid 13119 (syz.4.29), ts 58027826746, free_ts 57929202822
> > > > > set_page_owner include/linux/page_owner.h:32 [inline]
> > > > > post_alloc_hook+0x234/0x290 mm/page_alloc.c:1884
> > > > > prep_new_page mm/page_alloc.c:1892 [inline]
> > > > > get_page_from_freelist+0x24e4/0x2580 mm/page_alloc.c:3945
> > > > > __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5240
> > > > > alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
> > > > > alloc_slab_page mm/slub.c:3075 [inline]
> > > > > allocate_slab+0x86/0x3b0 mm/slub.c:3248
> > > > > new_slab mm/slub.c:3302 [inline]
> > > > > ___slab_alloc+0xe70/0x1860 mm/slub.c:4656
> > > > > __slab_alloc+0x65/0x100 mm/slub.c:4779
> > > > > __slab_alloc_node mm/slub.c:4855 [inline]
> > > > > slab_alloc_node mm/slub.c:5251 [inline]
> > > > > kmem_cache_alloc_noprof+0x40f/0x710 mm/slub.c:5270
> > > > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > > > xfs_cntbt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:511
> > > > > xfs_free_ag_extent+0x570/0x1890 fs/xfs/libxfs/xfs_alloc.c:2149
> > > > > __xfs_free_extent+0x2a7/0x460 fs/xfs/libxfs/xfs_alloc.c:4047
> > > > > xfs_extent_free_finish_item+0x299/0x840 fs/xfs/xfs_extfree_item.c:555
> > > > > xfs_defer_finish_one+0x5a6/0xcc0 fs/xfs/libxfs/xfs_defer.c:595
> > > > > xfs_defer_finish_noroll+0x94a/0x1300 fs/xfs/libxfs/xfs_defer.c:707
> > > > > xfs_defer_finish+0x1e/0x270 fs/xfs/libxfs/xfs_defer.c:741
> > > > > xrep_defer_finish+0x16e/0x240 fs/xfs/scrub/repair.c:242
> > > > > page last free pid 785 tgid 785 stack trace:
> > > > > reset_page_owner include/linux/page_owner.h:25 [inline]
> > > > > free_pages_prepare mm/page_alloc.c:1433 [inline]
> > > > > __free_frozen_pages+0xbc4/0xd40 mm/page_alloc.c:2973
> > > > > vfree+0x25a/0x400 mm/vmalloc.c:3466
> > > > > delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3385
> > > > > process_one_work kernel/workqueue.c:3257 [inline]
> > > > > process_scheduled_works+0xa45/0x1670 kernel/workqueue.c:3340
> > > > > worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
> > > > > kthread+0x711/0x8a0 kernel/kthread.c:463
> > > > > ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
> > > > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> > > > >
> > > > > Memory state around the buggy address:
> > > > > ffff88806af03480: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
> > > > > ffff88806af03500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > > > >ffff88806af03580: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
> > > > > ^
> > > > > ffff88806af03600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > > > ffff88806af03680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
> > > > > ==================================================================
> > > > > ---
> > > > >
> > > > > I also analyzed the root cause of this issue. In
> > > > > xchk_btree_check_block_owner(), bs->cur is an alias for
> > > > > bs->sc->sa.bnocur (or rmap_cur,
> > > > > https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L396-L400).
> > > > > The issue occurs when error injection triggers a failure path:
> > > > >
> > > > > 1. xchk_btree_check_block_owner() calls xchk_xref_is_used_space()
> > > > > 2. In xchk_xref_is_used_space(), xfs_alloc_has_records() returns a
> > > > > non-zero error due to error injection
> > > > > 3. Non-zero error causes xchk_should_check_xref() to free curpp (which
> > > > > points to bs->sc->sa.bnocur).
> > > > > 4. Memory pointed to by bs->cur is freed.
> > > > >
> > > > > Control returns to xchk_btree_check_block_owner(), which subsequently
> > > > > accesses bs->cur->bc_ops, triggering the UAF.
> > > > >
> > > > > P.S. this issue can also be triggered independently by syzkaller using
> > > > > our generated specs.
> > > > >
> > > > > To fix this issue, we can cache values of
> > > > > xfs_btree_is_bno(bs->cur->bc_ops) and
> > > > > xfs_btree_is_rmap(bs->cur->bc_ops) at the beginning of the function:
> > > > > ```
> > > > > --- a/fs/xfs/scrub/btree.c
> > > > > +++ b/fs/xfs/scrub/btree.c
> > > > > @@ -371,6 +371,8 @@ xchk_btree_check_block_owner(
> > > > > xfs_agnumber_t agno;
> > > > > xfs_agblock_t agbno;
> > > > > bool init_sa;
> > > > > + bool is_bno;
> > > > > + bool is_rmap;
> > > > > int error = 0;
> > > > >
> > > > > if (!bs->cur)
> > > > > @@ -379,6 +381,9 @@ xchk_btree_check_block_owner(
> > > > > agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
> > > > > agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
> > > > >
> > > > > + is_bno = xfs_btree_is_bno(bs->cur->bc_ops);
> > > > > + is_rmap = xfs_btree_is_rmap(bs->cur->bc_ops);
> > > > > +
> > > > > /*
> > > > > * If the btree being examined is not itself a per-AG btree, initialize
> > > > > * sc->sa so that we can check for the presence of an ownership record
> > > > > @@ -398,11 +403,11 @@ xchk_btree_check_block_owner(
> > > > > * have to nullify it (to shut down further block owner checks) if
> > > > > * self-xref encounters problems.
> > > > > */
> > > > > - if (!bs->sc->sa.bno_cur && xfs_btree_is_bno(bs->cur->bc_ops))
> > > > > + if (!bs->sc->sa.bno_cur && is_bno)
> > > > > bs->cur = NULL;
> > > > >
> > > > > xchk_xref_is_only_owned_by(bs->sc, agbno, 1, bs->oinfo);
> > > > > - if (!bs->sc->sa.rmap_cur && xfs_btree_is_rmap(bs->cur->bc_ops))
> > > > > + if (!bs->sc->sa.rmap_cur && is_rmap)
> > > >
> > > > Indentation problems notwithstanding, that looks like a correct
> > > > resolution to the UAF problem.
> > > >
> > > > > bs->cur = NULL;
> > > > >
> > > > > out_free:
> > > > > ```
> > > > >
> > > > > After applying above changes, reproducer ran for ~35 minutes without
> > > > > triggering any issues.
> > > > >
> > > > > If above solutions are acceptable, we are happy to submit patches :)
> > > > >
> > > > > The kernel console output, kernel config, syzkaller reproducer, and C
> > > > > reproducer are also attached to help with analysis.
> > > > >
> > > > > Please let me know if any further information is required.
> > > > >
> > > > > Best Regards,
> > > > > Jiaming Zhang
> > > >
> > > > Please just link to your dashboard, don't send a 1MB email to dozens
> > > > of people.
> > > >
> > > > --D
> > >
>
> Hi Darrick,
>
> I checked the execution path again and I have to apologize, my
> analysis yesterday was partly incorrect.
>
> I have new findings today that point how the cursor is nullified
> during the revalidation. I detailed below.
>
> In xrep_revalidate_allocbt(), xchk_allocbt() is called twice (first
> for BNOBT, second for CNTBT). The cause of this issue is that the
> first call nullified the cursor required by the second call.
>
> Let's first enter xrep_revalidate_allocbt() via following call chain:
>
> xfs_file_ioctl() ->
> xfs_ioc_scrubv_metadata() ->
> xfs_scrub_metadata() ->
> `sc->ops->repair_eval(sc)` ->
> xrep_revalidate_allocbt()
>
> xchk_allocbt() is called twice in this function. In the first call:
>
> /* Note that sc->sm->sm_type is XFS_SCRUB_TYPE_BNOPT now */
> xchk_allocbt() ->
> xchk_btree() ->
> `bs->scrub_rec(bs, recp)` ->
> xchk_allocbt_rec() ->
> xchk_allocbt_xref() ->
> xchk_allocbt_xref_other()
>
> since sm_type is XFS_SCRUB_TYPE_BNOPT, pur is set to &sc->sa.cnt_cur.
> Kernel called xfs_alloc_get_rec() and returned -EFSCORRUPTED. Call
> chain:
>
> xfs_alloc_get_rec() ->
> xfs_btree_get_rec() ->
> xfs_btree_check_block() ->
> (XFS_IS_CORRUPT || XFS_TEST_ERROR), the former is false and the latter
> is true, return -EFSCORRUPTED. This should be caused by
> ioctl$XFS_IOC_ERROR_INJECTION I guess.
Ah, that's how it happens. The error gets injected during the
revalidation of a bnobt that involved the cntbt btree, so the cntbt
cursor gets deleted.
> Back to xchk_allocbt_xref_other(), after receiving -EFSCORRUPTED from
> xfs_alloc_get_rec(), kernel called xchk_should_check_xref(). In this
> function, *curpp (points to sc->sa.cnt_cur) is nullified.
>
> Back to xrep_revalidate_allocbt(), since sc->sa.cnt_cur has been
> nullified, it then triggered null-ptr-deref via xchk_allocbt() (second
> call) -> xchk_btree().
Yep. So you're right, the revalidation needs to check for
sc->sa.cnt_cur==NULL before calling xchk_allocbt a second time.
> I noticed that at the beginning of xchk_should_check_xref(), it
> checked whether xref should be skipped. Can this issue be fixed if
> kernel skips xref in this case? I'm not sure.
>
> I hope the analysis is helpful. Feel free to contact me if any further
> information is needed.
That was very helpful. Could you please take a look at the proposed
fixes that I'm about to send?
--D
>
> Best Regards,
> Jiaming Zhang
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue
2026-01-22 23:10 ` Darrick J. Wong
@ 2026-01-23 2:08 ` Jiaming Zhang
2026-01-23 7:03 ` Darrick J. Wong
0 siblings, 1 reply; 8+ messages in thread
From: Jiaming Zhang @ 2026-01-23 2:08 UTC (permalink / raw)
To: Darrick J. Wong; +Cc: cem, linux-xfs, linux-kernel, pchelkin, syzkaller
Darrick J. Wong <djwong@kernel.org> 于2026年1月23日周五 07:10写道：
>
> On Thu, Jan 22, 2026 at 07:30:23PM +0800, Jiaming Zhang wrote:
> > Darrick J. Wong <djwong@kernel.org> 于2026年1月22日周四 03:23写道：
> > >
> > > On Wed, Jan 21, 2026 at 06:14:06PM +0800, Jiaming Zhang wrote:
> > > > Darrick J. Wong <djwong@kernel.org> 于2026年1月21日周三 03:17写道：
> > > > >
> > > > > On Tue, Jan 20, 2026 at 06:13:44PM +0800, Jiaming Zhang wrote:
> > > > > > Dear Linux kernel developers and maintainers,
> > > > > >
> > > > > > We are writing to report a general protection fault discovered in the
> > > > > > xfs subsystem with our generated syzkaller specifications. This issue
> > > > > > is reproducible on the latest version of linux (v6.19-rc6, commit
> > > > > > 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7). The KASAN report from
> > > > > > kernel is listed below (formatted by syz-symbolize):
> > > > > >
> > > > > > ---
> > > > > >
> > > > > > loop0: detected capacity change from 0 to 32768
> > > > > > XFS (loop0): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > > > > XFS (loop0): Ending clean mount
> > > > > > XFS (loop0): Injecting error at file fs/xfs/libxfs/xfs_btree.c, line
> > > > > > 309, on filesystem "loop0"
> > > > > > Oops: general protection fault, probably for non-canonical address
> > > > > > 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
> > > > > > KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
> > > > > > CPU: 1 UID: 0 PID: 9920 Comm: repro.out Not tainted 6.19.0-rc6 #24 PREEMPT(full)
> > > > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > > > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > > > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > > > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > > > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > > > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > > > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > > > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > > > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > > > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > > > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > > > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > > > CR2: 0000200000002700 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > > > > PKRU: 55555554
> > > > > > Call Trace:
> > > > > > <TASK>
> > > > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > > > xrep_revalidate_allocbt+0xf3/0x160 fs/xfs/scrub/alloc_repair.c:930
> > > > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > > RIP: 0033:0x45a879
> > > > > > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48
> > > > > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > > > > 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> > > > > > RSP: 002b:00007ffda72db7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > > > > RAX: ffffffffffffffda RBX: 00000000004004b8 RCX: 000000000045a879
> > > > > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > > > > RBP: 00007ffda72db860 R08: 0000000000000004 R09: 0000000000000005
> > > > > > R10: 0000000000000004 R11: 0000000000000246 R12: 000000000040b990
> > > > > > R13: 0000000000000000 R14: 00000000004ca018 R15: 00000000004004b8
> > > > > > </TASK>
> > > > > > Modules linked in:
> > > > > > ---[ end trace 0000000000000000 ]---
> > > > > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > > > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > > > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > > > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > > > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > > > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > > > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > > > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > > > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > > > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > > > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > > > CR2: 00007fbbbc0430c8 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > > > > PKRU: 55555554
> > > > > > ----------------
> > > > > > Code disassembly (best guess):
> > > > > > 0: f2 00 66 43 repnz add %ah,0x43(%rsi)
> > > > > > 4: c7 44 35 0d f3 f3 43 movl $0xc643f3f3,0xd(%rbp,%rsi,1)
> > > > > > b: c6
> > > > > > c: 44 35 0f f3 e8 1c rex.R xor $0x1ce8f30f,%eax
> > > > > > 12: 44 39 fe cmp %r15d,%esi
> > > > > > 15: 48 89 5c 24 40 mov %rbx,0x40(%rsp)
> > > > > > 1a: 48 83 c3 48 add $0x48,%rbx
> > > > > > 1e: 48 89 d8 mov %rbx,%rax
> > > > > > 21: 48 c1 e8 03 shr $0x3,%rax
> > > > > > 25: 48 89 44 24 30 mov %rax,0x30(%rsp)
> > > > > > * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
> > > > > > 2f: 84 c0 test %al,%al
> > > > > > 31: 0f 85 d6 11 00 00 jne 0x120d
> > > > > > 37: 44 0f b6 33 movzbl (%rbx),%r14d
> > > > > > 3b: 41 ff ce dec %r14d
> > > > > > 3e: bf .byte 0xbf
> > > > > > 3f: 53 push %rbx
> > > > > >
> > > > > > ---
> > > > > >
> > > > > > The root cause of this issue is that in xchk_btree(), where the
> > > > > > argument cur can be NULL but the function assume cur is not NULL,
> > > > > > leading to a NULL pointer dereference when accessing member
> > > > > > (https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L701).
> > > > > >
> > > > > > We can add a NULL check at the beginning of xchk_btree() to fix this issue:
> > > > > > ```
> > > > > > --- a/fs/xfs/scrub/btree.c
> > > > > > +++ b/fs/xfs/scrub/btree.c
> > > > > > @@ -693,6 +693,9 @@ xchk_btree(
> > > > > > int level;
> > > > > > int error = 0;
> > > > > >
> > > > > > + if (!cur)
> > > > > > + return -EINVAL;
> > > > >
> > > > > Uh, no, don't just fling EINVAL up to userspace. Line 930 is the cntbt
> > > > > revalidation in xrep_revalidate_allocbt. Why is that pointer
> > > > > 0xdffffc0000000009? Did we somehow fail to allocate a cntbt cursor in
> > > > > xchk_ag_btcur_init? Did that xchk_should_check_xref free it? Did we
> > > > > fail to attach the AGF to sc->sa.agf_bp?
> > > >
> > > > Thanks for the feedback! I dug deeper into the root cause as you
> > > > suggested, here is what I found:
> > > >
> > > > (1) The program executes XFS_IOC_ERROR_INJECTION branch in
> > > > xfs_file_ioctl(), causes xfs_btree_check_block() to return
> > > > -EFSCORRUPTED, which consequently marks the AG as sick (via
> > > > xfs_btree_mark_sick).
> > >
> > > "marks the AG as sick" ... which structure, specifically? I'm guessing
> > > XFS_SICK_AG_CNTBT from context, but it'd be useful to state these things
> > > from the data you've collected rather than relying on me to infer what's
> > > going on.
> > >
> > > > (2) Then, the program executes XFS_IOC_SCRUBV_METADATA branch in
> > > > xfs_file_ioctl(), the setup function (xchk_setup_ag_allocbt())
> > >
> > > Which scrub type is it calling, bnobt or cntbt?
> > >
> > > > attempts to initialize the cursor. However, the sick flag makes kernel
> > > > executes xchk_ag_btree_del_cursor_if_sick(), the cursor is freed and
> > > > nullified.
> > >
> > > Are you talking about the ->setup call after we've rebuilt both free
> > > space btrees, just prior to step three? When that happens,
> > > xchk_ag_btree_del_cursor_if_sick will see the XREP_ALREADY_FIXED flag
> > > and mask out sc->sick_mask from mask:
> > >
> > > /*
> > > * If we just repaired some AG metadata, sc->sick_mask will reflect all
> > > * the per-AG metadata types that were repaired. Exclude these from
> > > * the filesystem health query because we have not yet updated the
> > > * health status and we want everything to be scanned.
> > > */
> > > if ((sc->flags & XREP_ALREADY_FIXED) &&
> > > type_to_health_flag[sc->sm->sm_type].group == XHG_AG)
> > > mask &= ~sc->sick_mask;
> > >
> > > > (3) Lastly, the repair_eval function (xrep_revalidate_allocbt()) calls
> > > > xchk_allocbt(). Since xchk_allocbt() assumes the cursor is valid, it
> > > > passes the NULL pointer to xchk_btree, leading to the null-ptr-deref.
> > >
> > > Sure, but xrep_allocbt sets sc->sick_mask to XFS_SICK_AG_BNOBT |
> > > XFS_SICK_AG so any pre-existing bnobt or cntbt sick state in the
> > > xfs_group will be ignored and neither cursor will be deleted when
> > > setting up the revalidation.
> > >
> > > > Based on above analysis, I think sc->sa.cnt_cur being NULL is expected
> > > > when the AG is sick. I think the appropriate fix is to check NULL
> > > > inside xchk_allocbt():
> > > > ```
> > > > --- a/fs/xfs/scrub/alloc.c
> > > > +++ b/fs/xfs/scrub/alloc.c
> > > > @@ -170,6 +170,9 @@ xchk_allocbt(
> > > > return -EIO;
> > > > }
> > > >
> > > > + if (!cur)
> > > > + return -ENOENT;
> > >
> > > This is not correct either. We've just rebuilt the bnobt and cntbt for
> > > the AG which means that cursors for both btrees should be loaded and
> > > ready for revalidation.
> > >
> > > I think you need to look into xchk_ag_btree_del_cursor_if_sick to figure
> > > out exactly what the xfs_group's sick state is, what @mask is, and what
> > > sc->sick_mask is, and from that figure out if it's really deleting the
> > > cntbt cursor. This is made more difficult because XFS error injection
> > > is probabilistic so it could trigger on /any/ btree.
> > >
> > > --D
> > >
> > > > +
> > > > return xchk_btree(sc, cur, xchk_allocbt_rec, &XFS_RMAP_OINFO_AG, &ca);
> > > > }
> > > > ```
> > > > What do you think? :)
> > > >
> > > > >
> > > > > > /*
> > > > > > * Allocate the btree scrub context from the heap, because this
> > > > > > * structure can get rather large. Don't let a caller feed us a
> > > > > > ```
> > > > > >
> > > > > > After applying changes above and re-running reproducer, another issues
> > > > > > is triggered:
> > > > > >
> > > > > > ---
> > > > > > TITLE: KASAN: slab-use-after-free Read in xchk_btree_check_block_owner
> > > > > >
> > > > > > XFS (loop6): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > > > > XFS (loop6): Ending clean mount
> > > > > > ==================================================================
> > > > > > BUG: KASAN: slab-use-after-free in
> > > > > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > > > > Read of size 8 at addr ffff88806af035d8 by task syz.6.59/14096
> > > > > >
> > > > > > CPU: 1 UID: 0 PID: 14096 Comm: syz.6.59 Not tainted 6.19.0-rc6-dirty
> > > > > > #30 PREEMPT(full)
> > > > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > > > > Call Trace:
> > > > > > <TASK>
> > > > > > __dump_stack lib/dump_stack.c:94 [inline]
> > > > > > dump_stack_lvl+0x10e/0x190 lib/dump_stack.c:120
> > > > > > print_address_description mm/kasan/report.c:378 [inline]
> > > > > > print_report+0x17e/0x810 mm/kasan/report.c:482
> > > > > > kasan_report+0x147/0x180 mm/kasan/report.c:595
> > > > > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > > > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > > RIP: 0033:0x7f71bddb459d
> > > > > > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
> > > > > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > > > > 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> > > > > > RSP: 002b:00007f71bed71f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > > > > RAX: ffffffffffffffda RBX: 00007f71be045fa0 RCX: 00007f71bddb459d
> > > > > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > > > > RBP: 00007f71bde52610 R08: 0000000000000000 R09: 0000000000000000
> > > > > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > > > > > R13: 00007f71be046038 R14: 00007f71be045fa0 R15: 00007f71bed52000
> > > > > > </TASK>
> > > > > >
> > > > > > Allocated by task 14096:
> > > > > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > > > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > > > > unpoison_slab_object mm/kasan/common.c:340 [inline]
> > > > > > __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
> > > > > > kasan_slab_alloc include/linux/kasan.h:253 [inline]
> > > > > > slab_post_alloc_hook mm/slub.c:4953 [inline]
> > > > > > slab_alloc_node mm/slub.c:5263 [inline]
> > > > > > kmem_cache_alloc_noprof+0x37d/0x710 mm/slub.c:5270
> > > > > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > > > > xfs_bnobt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:485
> > > > > > xchk_ag_btcur_init+0xe0/0x5d0 fs/xfs/scrub/common.c:612
> > > > > > xchk_ag_init fs/xfs/scrub/common.c:698 [inline]
> > > > > > xchk_setup_ag_btree+0x295/0x310 fs/xfs/scrub/common.c:943
> > > > > > xchk_setup_ag_allocbt+0x70/0x190 fs/xfs/scrub/alloc.c:35
> > > > > > xfs_scrub_metadata+0xa9e/0x1920 fs/xfs/scrub/scrub.c:709
> > > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > >
> > > > > > Freed by task 14096:
> > > > > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > > > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > > > > kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
> > > > > > poison_slab_object mm/kasan/common.c:253 [inline]
> > > > > > __kasan_slab_free+0x58/0x80 mm/kasan/common.c:285
> > > > > > kasan_slab_free include/linux/kasan.h:235 [inline]
> > > > > > slab_free_hook mm/slub.c:2540 [inline]
> > > > > > slab_free mm/slub.c:6670 [inline]
> > > > > > kmem_cache_free+0x197/0x620 mm/slub.c:6781
> > > > > > xchk_should_check_xref+0xf9/0x420 fs/xfs/scrub/common.c:1351
> > > > > > xchk_xref_is_used_space+0x14b/0x210 fs/xfs/scrub/alloc.c:190
> > > > > > xchk_btree_check_block_owner+0x2fe/0x600 fs/xfs/scrub/btree.c:395
> > > > > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > >
> > > > > > The buggy address belongs to the object at ffff88806af035c8
> > > > > > which belongs to the cache xfs_bnobt_cur of size 232
> > > > > > The buggy address is located 16 bytes inside of
> > > > > > freed 232-byte region [ffff88806af035c8, ffff88806af036b0)
> > > > > >
> > > > > > The buggy address belongs to the physical page:
> > > > > > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6af03
> > > > > > ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
> > > > > > page_type: f5(slab)
> > > > > > raw: 04fff00000000000 ffff88801dd96a00 ffffea000094fdc0 0000000000000003
> > > > > > raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
> > > > > > page dumped because: kasan: bad access detected
> > > > > > page_owner tracks the page as allocated
> > > > > > page last allocated via order 0, migratetype Unmovable, gfp_mask
> > > > > > 0x1052c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOLOCKDEP),
> > > > > > pid 13126, tgid 13119 (syz.4.29), ts 58027826746, free_ts 57929202822
> > > > > > set_page_owner include/linux/page_owner.h:32 [inline]
> > > > > > post_alloc_hook+0x234/0x290 mm/page_alloc.c:1884
> > > > > > prep_new_page mm/page_alloc.c:1892 [inline]
> > > > > > get_page_from_freelist+0x24e4/0x2580 mm/page_alloc.c:3945
> > > > > > __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5240
> > > > > > alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
> > > > > > alloc_slab_page mm/slub.c:3075 [inline]
> > > > > > allocate_slab+0x86/0x3b0 mm/slub.c:3248
> > > > > > new_slab mm/slub.c:3302 [inline]
> > > > > > ___slab_alloc+0xe70/0x1860 mm/slub.c:4656
> > > > > > __slab_alloc+0x65/0x100 mm/slub.c:4779
> > > > > > __slab_alloc_node mm/slub.c:4855 [inline]
> > > > > > slab_alloc_node mm/slub.c:5251 [inline]
> > > > > > kmem_cache_alloc_noprof+0x40f/0x710 mm/slub.c:5270
> > > > > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > > > > xfs_cntbt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:511
> > > > > > xfs_free_ag_extent+0x570/0x1890 fs/xfs/libxfs/xfs_alloc.c:2149
> > > > > > __xfs_free_extent+0x2a7/0x460 fs/xfs/libxfs/xfs_alloc.c:4047
> > > > > > xfs_extent_free_finish_item+0x299/0x840 fs/xfs/xfs_extfree_item.c:555
> > > > > > xfs_defer_finish_one+0x5a6/0xcc0 fs/xfs/libxfs/xfs_defer.c:595
> > > > > > xfs_defer_finish_noroll+0x94a/0x1300 fs/xfs/libxfs/xfs_defer.c:707
> > > > > > xfs_defer_finish+0x1e/0x270 fs/xfs/libxfs/xfs_defer.c:741
> > > > > > xrep_defer_finish+0x16e/0x240 fs/xfs/scrub/repair.c:242
> > > > > > page last free pid 785 tgid 785 stack trace:
> > > > > > reset_page_owner include/linux/page_owner.h:25 [inline]
> > > > > > free_pages_prepare mm/page_alloc.c:1433 [inline]
> > > > > > __free_frozen_pages+0xbc4/0xd40 mm/page_alloc.c:2973
> > > > > > vfree+0x25a/0x400 mm/vmalloc.c:3466
> > > > > > delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3385
> > > > > > process_one_work kernel/workqueue.c:3257 [inline]
> > > > > > process_scheduled_works+0xa45/0x1670 kernel/workqueue.c:3340
> > > > > > worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
> > > > > > kthread+0x711/0x8a0 kernel/kthread.c:463
> > > > > > ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
> > > > > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> > > > > >
> > > > > > Memory state around the buggy address:
> > > > > > ffff88806af03480: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
> > > > > > ffff88806af03500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > > > > >ffff88806af03580: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
> > > > > > ^
> > > > > > ffff88806af03600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > > > > ffff88806af03680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
> > > > > > ==================================================================
> > > > > > ---
> > > > > >
> > > > > > I also analyzed the root cause of this issue. In
> > > > > > xchk_btree_check_block_owner(), bs->cur is an alias for
> > > > > > bs->sc->sa.bnocur (or rmap_cur,
> > > > > > https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L396-L400).
> > > > > > The issue occurs when error injection triggers a failure path:
> > > > > >
> > > > > > 1. xchk_btree_check_block_owner() calls xchk_xref_is_used_space()
> > > > > > 2. In xchk_xref_is_used_space(), xfs_alloc_has_records() returns a
> > > > > > non-zero error due to error injection
> > > > > > 3. Non-zero error causes xchk_should_check_xref() to free curpp (which
> > > > > > points to bs->sc->sa.bnocur).
> > > > > > 4. Memory pointed to by bs->cur is freed.
> > > > > >
> > > > > > Control returns to xchk_btree_check_block_owner(), which subsequently
> > > > > > accesses bs->cur->bc_ops, triggering the UAF.
> > > > > >
> > > > > > P.S. this issue can also be triggered independently by syzkaller using
> > > > > > our generated specs.
> > > > > >
> > > > > > To fix this issue, we can cache values of
> > > > > > xfs_btree_is_bno(bs->cur->bc_ops) and
> > > > > > xfs_btree_is_rmap(bs->cur->bc_ops) at the beginning of the function:
> > > > > > ```
> > > > > > --- a/fs/xfs/scrub/btree.c
> > > > > > +++ b/fs/xfs/scrub/btree.c
> > > > > > @@ -371,6 +371,8 @@ xchk_btree_check_block_owner(
> > > > > > xfs_agnumber_t agno;
> > > > > > xfs_agblock_t agbno;
> > > > > > bool init_sa;
> > > > > > + bool is_bno;
> > > > > > + bool is_rmap;
> > > > > > int error = 0;
> > > > > >
> > > > > > if (!bs->cur)
> > > > > > @@ -379,6 +381,9 @@ xchk_btree_check_block_owner(
> > > > > > agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
> > > > > > agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
> > > > > >
> > > > > > + is_bno = xfs_btree_is_bno(bs->cur->bc_ops);
> > > > > > + is_rmap = xfs_btree_is_rmap(bs->cur->bc_ops);
> > > > > > +
> > > > > > /*
> > > > > > * If the btree being examined is not itself a per-AG btree, initialize
> > > > > > * sc->sa so that we can check for the presence of an ownership record
> > > > > > @@ -398,11 +403,11 @@ xchk_btree_check_block_owner(
> > > > > > * have to nullify it (to shut down further block owner checks) if
> > > > > > * self-xref encounters problems.
> > > > > > */
> > > > > > - if (!bs->sc->sa.bno_cur && xfs_btree_is_bno(bs->cur->bc_ops))
> > > > > > + if (!bs->sc->sa.bno_cur && is_bno)
> > > > > > bs->cur = NULL;
> > > > > >
> > > > > > xchk_xref_is_only_owned_by(bs->sc, agbno, 1, bs->oinfo);
> > > > > > - if (!bs->sc->sa.rmap_cur && xfs_btree_is_rmap(bs->cur->bc_ops))
> > > > > > + if (!bs->sc->sa.rmap_cur && is_rmap)
> > > > >
> > > > > Indentation problems notwithstanding, that looks like a correct
> > > > > resolution to the UAF problem.
> > > > >
> > > > > > bs->cur = NULL;
> > > > > >
> > > > > > out_free:
> > > > > > ```
> > > > > >
> > > > > > After applying above changes, reproducer ran for ~35 minutes without
> > > > > > triggering any issues.
> > > > > >
> > > > > > If above solutions are acceptable, we are happy to submit patches :)
> > > > > >
> > > > > > The kernel console output, kernel config, syzkaller reproducer, and C
> > > > > > reproducer are also attached to help with analysis.
> > > > > >
> > > > > > Please let me know if any further information is required.
> > > > > >
> > > > > > Best Regards,
> > > > > > Jiaming Zhang
> > > > >
> > > > > Please just link to your dashboard, don't send a 1MB email to dozens
> > > > > of people.
> > > > >
> > > > > --D
> > > >
> >
> > Hi Darrick,
> >
> > I checked the execution path again and I have to apologize, my
> > analysis yesterday was partly incorrect.
> >
> > I have new findings today that point how the cursor is nullified
> > during the revalidation. I detailed below.
> >
> > In xrep_revalidate_allocbt(), xchk_allocbt() is called twice (first
> > for BNOBT, second for CNTBT). The cause of this issue is that the
> > first call nullified the cursor required by the second call.
> >
> > Let's first enter xrep_revalidate_allocbt() via following call chain:
> >
> > xfs_file_ioctl() ->
> > xfs_ioc_scrubv_metadata() ->
> > xfs_scrub_metadata() ->
> > `sc->ops->repair_eval(sc)` ->
> > xrep_revalidate_allocbt()
> >
> > xchk_allocbt() is called twice in this function. In the first call:
> >
> > /* Note that sc->sm->sm_type is XFS_SCRUB_TYPE_BNOPT now */
> > xchk_allocbt() ->
> > xchk_btree() ->
> > `bs->scrub_rec(bs, recp)` ->
> > xchk_allocbt_rec() ->
> > xchk_allocbt_xref() ->
> > xchk_allocbt_xref_other()
> >
> > since sm_type is XFS_SCRUB_TYPE_BNOPT, pur is set to &sc->sa.cnt_cur.
> > Kernel called xfs_alloc_get_rec() and returned -EFSCORRUPTED. Call
> > chain:
> >
> > xfs_alloc_get_rec() ->
> > xfs_btree_get_rec() ->
> > xfs_btree_check_block() ->
> > (XFS_IS_CORRUPT || XFS_TEST_ERROR), the former is false and the latter
> > is true, return -EFSCORRUPTED. This should be caused by
> > ioctl$XFS_IOC_ERROR_INJECTION I guess.
>
> Ah, that's how it happens. The error gets injected during the
> revalidation of a bnobt that involved the cntbt btree, so the cntbt
> cursor gets deleted.
>
> > Back to xchk_allocbt_xref_other(), after receiving -EFSCORRUPTED from
> > xfs_alloc_get_rec(), kernel called xchk_should_check_xref(). In this
> > function, *curpp (points to sc->sa.cnt_cur) is nullified.
> >
> > Back to xrep_revalidate_allocbt(), since sc->sa.cnt_cur has been
> > nullified, it then triggered null-ptr-deref via xchk_allocbt() (second
> > call) -> xchk_btree().
>
> Yep. So you're right, the revalidation needs to check for
> sc->sa.cnt_cur==NULL before calling xchk_allocbt a second time.
Sounds good to me. Thanks for your work on XFS :)
>
> > I noticed that at the beginning of xchk_should_check_xref(), it
> > checked whether xref should be skipped. Can this issue be fixed if
> > kernel skips xref in this case? I'm not sure.
> >
> > I hope the analysis is helpful. Feel free to contact me if any further
> > information is needed.
>
> That was very helpful. Could you please take a look at the proposed
> fixes that I'm about to send?
>
> --D
>
> >
> > Best Regards,
> > Jiaming Zhang
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue
2026-01-23 2:08 ` Jiaming Zhang
@ 2026-01-23 7:03 ` Darrick J. Wong
0 siblings, 0 replies; 8+ messages in thread
From: Darrick J. Wong @ 2026-01-23 7:03 UTC (permalink / raw)
To: Jiaming Zhang; +Cc: cem, linux-xfs, linux-kernel, pchelkin, syzkaller
On Fri, Jan 23, 2026 at 10:08:57AM +0800, Jiaming Zhang wrote:
> Darrick J. Wong <djwong@kernel.org> 于2026年1月23日周五 07:10写道：
> >
> > On Thu, Jan 22, 2026 at 07:30:23PM +0800, Jiaming Zhang wrote:
> > > Darrick J. Wong <djwong@kernel.org> 于2026年1月22日周四 03:23写道：
> > > >
> > > > On Wed, Jan 21, 2026 at 06:14:06PM +0800, Jiaming Zhang wrote:
> > > > > Darrick J. Wong <djwong@kernel.org> 于2026年1月21日周三 03:17写道：
> > > > > >
> > > > > > On Tue, Jan 20, 2026 at 06:13:44PM +0800, Jiaming Zhang wrote:
> > > > > > > Dear Linux kernel developers and maintainers,
> > > > > > >
> > > > > > > We are writing to report a general protection fault discovered in the
> > > > > > > xfs subsystem with our generated syzkaller specifications. This issue
> > > > > > > is reproducible on the latest version of linux (v6.19-rc6, commit
> > > > > > > 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7). The KASAN report from
> > > > > > > kernel is listed below (formatted by syz-symbolize):
> > > > > > >
> > > > > > > ---
> > > > > > >
> > > > > > > loop0: detected capacity change from 0 to 32768
> > > > > > > XFS (loop0): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > > > > > XFS (loop0): Ending clean mount
> > > > > > > XFS (loop0): Injecting error at file fs/xfs/libxfs/xfs_btree.c, line
> > > > > > > 309, on filesystem "loop0"
> > > > > > > Oops: general protection fault, probably for non-canonical address
> > > > > > > 0xdffffc0000000009: 0000 [#1] SMP KASAN NOPTI
> > > > > > > KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
> > > > > > > CPU: 1 UID: 0 PID: 9920 Comm: repro.out Not tainted 6.19.0-rc6 #24 PREEMPT(full)
> > > > > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > > > > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > > > > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > > > > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > > > > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > > > > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > > > > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > > > > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > > > > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > > > > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > > > > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > > > > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > > > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > > > > CR2: 0000200000002700 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > > > > > PKRU: 55555554
> > > > > > > Call Trace:
> > > > > > > <TASK>
> > > > > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > > > > xrep_revalidate_allocbt+0xf3/0x160 fs/xfs/scrub/alloc_repair.c:930
> > > > > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > > > RIP: 0033:0x45a879
> > > > > > > Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 31 18 00 00 90 48 89 f8 48
> > > > > > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > > > > > 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> > > > > > > RSP: 002b:00007ffda72db7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > > > > > RAX: ffffffffffffffda RBX: 00000000004004b8 RCX: 000000000045a879
> > > > > > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > > > > > RBP: 00007ffda72db860 R08: 0000000000000004 R09: 0000000000000005
> > > > > > > R10: 0000000000000004 R11: 0000000000000246 R12: 000000000040b990
> > > > > > > R13: 0000000000000000 R14: 00000000004ca018 R15: 00000000004004b8
> > > > > > > </TASK>
> > > > > > > Modules linked in:
> > > > > > > ---[ end trace 0000000000000000 ]---
> > > > > > > RIP: 0010:xchk_btree+0xb9/0x1380 fs/xfs/scrub/btree.c:701
> > > > > > > Code: f2 00 66 43 c7 44 35 0d f3 f3 43 c6 44 35 0f f3 e8 1c 44 39 fe
> > > > > > > 48 89 5c 24 40 48 83 c3 48 48 89 d8 48 c1 e8 03 48 89 44 24 30 <42> 0f
> > > > > > > b6 04 30 84 c0 0f 85 d6 11 00 00 44 0f b6 33 41 ff ce bf 53
> > > > > > > RSP: 0018:ffffc9000854f360 EFLAGS: 00010206
> > > > > > > RAX: 0000000000000009 RBX: 0000000000000048 RCX: ffff888020bebd80
> > > > > > > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888044710e00
> > > > > > > RBP: ffffc9000854f510 R08: ffffc9000854f540 R09: 0000000000000002
> > > > > > > R10: 0000000000000006 R11: 0000000000000000 R12: ffffffff837c5b20
> > > > > > > R13: 1ffff920010a9e88 R14: dffffc0000000000 R15: ffffffff8ba6c880
> > > > > > > FS: 000000001d1543c0(0000) GS:ffff8880ec5e0000(0000) knlGS:0000000000000000
> > > > > > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > > > > > > CR2: 00007fbbbc0430c8 CR3: 00000000229e4000 CR4: 0000000000752ef0
> > > > > > > PKRU: 55555554
> > > > > > > ----------------
> > > > > > > Code disassembly (best guess):
> > > > > > > 0: f2 00 66 43 repnz add %ah,0x43(%rsi)
> > > > > > > 4: c7 44 35 0d f3 f3 43 movl $0xc643f3f3,0xd(%rbp,%rsi,1)
> > > > > > > b: c6
> > > > > > > c: 44 35 0f f3 e8 1c rex.R xor $0x1ce8f30f,%eax
> > > > > > > 12: 44 39 fe cmp %r15d,%esi
> > > > > > > 15: 48 89 5c 24 40 mov %rbx,0x40(%rsp)
> > > > > > > 1a: 48 83 c3 48 add $0x48,%rbx
> > > > > > > 1e: 48 89 d8 mov %rbx,%rax
> > > > > > > 21: 48 c1 e8 03 shr $0x3,%rax
> > > > > > > 25: 48 89 44 24 30 mov %rax,0x30(%rsp)
> > > > > > > * 2a: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax <-- trapping instruction
> > > > > > > 2f: 84 c0 test %al,%al
> > > > > > > 31: 0f 85 d6 11 00 00 jne 0x120d
> > > > > > > 37: 44 0f b6 33 movzbl (%rbx),%r14d
> > > > > > > 3b: 41 ff ce dec %r14d
> > > > > > > 3e: bf .byte 0xbf
> > > > > > > 3f: 53 push %rbx
> > > > > > >
> > > > > > > ---
> > > > > > >
> > > > > > > The root cause of this issue is that in xchk_btree(), where the
> > > > > > > argument cur can be NULL but the function assume cur is not NULL,
> > > > > > > leading to a NULL pointer dereference when accessing member
> > > > > > > (https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L701).
> > > > > > >
> > > > > > > We can add a NULL check at the beginning of xchk_btree() to fix this issue:
> > > > > > > ```
> > > > > > > --- a/fs/xfs/scrub/btree.c
> > > > > > > +++ b/fs/xfs/scrub/btree.c
> > > > > > > @@ -693,6 +693,9 @@ xchk_btree(
> > > > > > > int level;
> > > > > > > int error = 0;
> > > > > > >
> > > > > > > + if (!cur)
> > > > > > > + return -EINVAL;
> > > > > >
> > > > > > Uh, no, don't just fling EINVAL up to userspace. Line 930 is the cntbt
> > > > > > revalidation in xrep_revalidate_allocbt. Why is that pointer
> > > > > > 0xdffffc0000000009? Did we somehow fail to allocate a cntbt cursor in
> > > > > > xchk_ag_btcur_init? Did that xchk_should_check_xref free it? Did we
> > > > > > fail to attach the AGF to sc->sa.agf_bp?
> > > > >
> > > > > Thanks for the feedback! I dug deeper into the root cause as you
> > > > > suggested, here is what I found:
> > > > >
> > > > > (1) The program executes XFS_IOC_ERROR_INJECTION branch in
> > > > > xfs_file_ioctl(), causes xfs_btree_check_block() to return
> > > > > -EFSCORRUPTED, which consequently marks the AG as sick (via
> > > > > xfs_btree_mark_sick).
> > > >
> > > > "marks the AG as sick" ... which structure, specifically? I'm guessing
> > > > XFS_SICK_AG_CNTBT from context, but it'd be useful to state these things
> > > > from the data you've collected rather than relying on me to infer what's
> > > > going on.
> > > >
> > > > > (2) Then, the program executes XFS_IOC_SCRUBV_METADATA branch in
> > > > > xfs_file_ioctl(), the setup function (xchk_setup_ag_allocbt())
> > > >
> > > > Which scrub type is it calling, bnobt or cntbt?
> > > >
> > > > > attempts to initialize the cursor. However, the sick flag makes kernel
> > > > > executes xchk_ag_btree_del_cursor_if_sick(), the cursor is freed and
> > > > > nullified.
> > > >
> > > > Are you talking about the ->setup call after we've rebuilt both free
> > > > space btrees, just prior to step three? When that happens,
> > > > xchk_ag_btree_del_cursor_if_sick will see the XREP_ALREADY_FIXED flag
> > > > and mask out sc->sick_mask from mask:
> > > >
> > > > /*
> > > > * If we just repaired some AG metadata, sc->sick_mask will reflect all
> > > > * the per-AG metadata types that were repaired. Exclude these from
> > > > * the filesystem health query because we have not yet updated the
> > > > * health status and we want everything to be scanned.
> > > > */
> > > > if ((sc->flags & XREP_ALREADY_FIXED) &&
> > > > type_to_health_flag[sc->sm->sm_type].group == XHG_AG)
> > > > mask &= ~sc->sick_mask;
> > > >
> > > > > (3) Lastly, the repair_eval function (xrep_revalidate_allocbt()) calls
> > > > > xchk_allocbt(). Since xchk_allocbt() assumes the cursor is valid, it
> > > > > passes the NULL pointer to xchk_btree, leading to the null-ptr-deref.
> > > >
> > > > Sure, but xrep_allocbt sets sc->sick_mask to XFS_SICK_AG_BNOBT |
> > > > XFS_SICK_AG so any pre-existing bnobt or cntbt sick state in the
> > > > xfs_group will be ignored and neither cursor will be deleted when
> > > > setting up the revalidation.
> > > >
> > > > > Based on above analysis, I think sc->sa.cnt_cur being NULL is expected
> > > > > when the AG is sick. I think the appropriate fix is to check NULL
> > > > > inside xchk_allocbt():
> > > > > ```
> > > > > --- a/fs/xfs/scrub/alloc.c
> > > > > +++ b/fs/xfs/scrub/alloc.c
> > > > > @@ -170,6 +170,9 @@ xchk_allocbt(
> > > > > return -EIO;
> > > > > }
> > > > >
> > > > > + if (!cur)
> > > > > + return -ENOENT;
> > > >
> > > > This is not correct either. We've just rebuilt the bnobt and cntbt for
> > > > the AG which means that cursors for both btrees should be loaded and
> > > > ready for revalidation.
> > > >
> > > > I think you need to look into xchk_ag_btree_del_cursor_if_sick to figure
> > > > out exactly what the xfs_group's sick state is, what @mask is, and what
> > > > sc->sick_mask is, and from that figure out if it's really deleting the
> > > > cntbt cursor. This is made more difficult because XFS error injection
> > > > is probabilistic so it could trigger on /any/ btree.
> > > >
> > > > --D
> > > >
> > > > > +
> > > > > return xchk_btree(sc, cur, xchk_allocbt_rec, &XFS_RMAP_OINFO_AG, &ca);
> > > > > }
> > > > > ```
> > > > > What do you think? :)
> > > > >
> > > > > >
> > > > > > > /*
> > > > > > > * Allocate the btree scrub context from the heap, because this
> > > > > > > * structure can get rather large. Don't let a caller feed us a
> > > > > > > ```
> > > > > > >
> > > > > > > After applying changes above and re-running reproducer, another issues
> > > > > > > is triggered:
> > > > > > >
> > > > > > > ---
> > > > > > > TITLE: KASAN: slab-use-after-free Read in xchk_btree_check_block_owner
> > > > > > >
> > > > > > > XFS (loop6): Mounting V5 Filesystem 9f91832a-3b79-45c3-9d6d-ed0bc7357fe4
> > > > > > > XFS (loop6): Ending clean mount
> > > > > > > ==================================================================
> > > > > > > BUG: KASAN: slab-use-after-free in
> > > > > > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > > > > > Read of size 8 at addr ffff88806af035d8 by task syz.6.59/14096
> > > > > > >
> > > > > > > CPU: 1 UID: 0 PID: 14096 Comm: syz.6.59 Not tainted 6.19.0-rc6-dirty
> > > > > > > #30 PREEMPT(full)
> > > > > > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > > > > > > Call Trace:
> > > > > > > <TASK>
> > > > > > > __dump_stack lib/dump_stack.c:94 [inline]
> > > > > > > dump_stack_lvl+0x10e/0x190 lib/dump_stack.c:120
> > > > > > > print_address_description mm/kasan/report.c:378 [inline]
> > > > > > > print_report+0x17e/0x810 mm/kasan/report.c:482
> > > > > > > kasan_report+0x147/0x180 mm/kasan/report.c:595
> > > > > > > xchk_btree_check_block_owner+0x3a2/0x600 fs/xfs/scrub/btree.c:401
> > > > > > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > > > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > > > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > > > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > > > RIP: 0033:0x7f71bddb459d
> > > > > > > Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48
> > > > > > > 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
> > > > > > > 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> > > > > > > RSP: 002b:00007f71bed71f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> > > > > > > RAX: ffffffffffffffda RBX: 00007f71be045fa0 RCX: 00007f71bddb459d
> > > > > > > RDX: 00002000000000c0 RSI: 00000000c0285840 RDI: 0000000000000005
> > > > > > > RBP: 00007f71bde52610 R08: 0000000000000000 R09: 0000000000000000
> > > > > > > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> > > > > > > R13: 00007f71be046038 R14: 00007f71be045fa0 R15: 00007f71bed52000
> > > > > > > </TASK>
> > > > > > >
> > > > > > > Allocated by task 14096:
> > > > > > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > > > > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > > > > > unpoison_slab_object mm/kasan/common.c:340 [inline]
> > > > > > > __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
> > > > > > > kasan_slab_alloc include/linux/kasan.h:253 [inline]
> > > > > > > slab_post_alloc_hook mm/slub.c:4953 [inline]
> > > > > > > slab_alloc_node mm/slub.c:5263 [inline]
> > > > > > > kmem_cache_alloc_noprof+0x37d/0x710 mm/slub.c:5270
> > > > > > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > > > > > xfs_bnobt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:485
> > > > > > > xchk_ag_btcur_init+0xe0/0x5d0 fs/xfs/scrub/common.c:612
> > > > > > > xchk_ag_init fs/xfs/scrub/common.c:698 [inline]
> > > > > > > xchk_setup_ag_btree+0x295/0x310 fs/xfs/scrub/common.c:943
> > > > > > > xchk_setup_ag_allocbt+0x70/0x190 fs/xfs/scrub/alloc.c:35
> > > > > > > xfs_scrub_metadata+0xa9e/0x1920 fs/xfs/scrub/scrub.c:709
> > > > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > > >
> > > > > > > Freed by task 14096:
> > > > > > > kasan_save_stack mm/kasan/common.c:57 [inline]
> > > > > > > kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
> > > > > > > kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
> > > > > > > poison_slab_object mm/kasan/common.c:253 [inline]
> > > > > > > __kasan_slab_free+0x58/0x80 mm/kasan/common.c:285
> > > > > > > kasan_slab_free include/linux/kasan.h:235 [inline]
> > > > > > > slab_free_hook mm/slub.c:2540 [inline]
> > > > > > > slab_free mm/slub.c:6670 [inline]
> > > > > > > kmem_cache_free+0x197/0x620 mm/slub.c:6781
> > > > > > > xchk_should_check_xref+0xf9/0x420 fs/xfs/scrub/common.c:1351
> > > > > > > xchk_xref_is_used_space+0x14b/0x210 fs/xfs/scrub/alloc.c:190
> > > > > > > xchk_btree_check_block_owner+0x2fe/0x600 fs/xfs/scrub/btree.c:395
> > > > > > > xchk_btree+0x57e/0x1320 fs/xfs/scrub/btree.c:797
> > > > > > > xchk_allocbt+0x112/0x190 fs/xfs/scrub/alloc.c:173
> > > > > > > xrep_revalidate_allocbt+0x69/0x160 fs/xfs/scrub/alloc_repair.c:925
> > > > > > > xfs_scrub_metadata+0xc08/0x1920 fs/xfs/scrub/scrub.c:-1
> > > > > > > xfs_ioc_scrubv_metadata+0x74a/0xaf0 fs/xfs/scrub/scrub.c:981
> > > > > > > xfs_file_ioctl+0x751/0x1560 fs/xfs/xfs_ioctl.c:1266
> > > > > > > vfs_ioctl fs/ioctl.c:51 [inline]
> > > > > > > __do_sys_ioctl fs/ioctl.c:597 [inline]
> > > > > > > __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> > > > > > > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> > > > > > > do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
> > > > > > > entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > > > > > >
> > > > > > > The buggy address belongs to the object at ffff88806af035c8
> > > > > > > which belongs to the cache xfs_bnobt_cur of size 232
> > > > > > > The buggy address is located 16 bytes inside of
> > > > > > > freed 232-byte region [ffff88806af035c8, ffff88806af036b0)
> > > > > > >
> > > > > > > The buggy address belongs to the physical page:
> > > > > > > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6af03
> > > > > > > ksm flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
> > > > > > > page_type: f5(slab)
> > > > > > > raw: 04fff00000000000 ffff88801dd96a00 ffffea000094fdc0 0000000000000003
> > > > > > > raw: 0000000000000000 00000000800d000d 00000000f5000000 0000000000000000
> > > > > > > page dumped because: kasan: bad access detected
> > > > > > > page_owner tracks the page as allocated
> > > > > > > page last allocated via order 0, migratetype Unmovable, gfp_mask
> > > > > > > 0x1052c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOLOCKDEP),
> > > > > > > pid 13126, tgid 13119 (syz.4.29), ts 58027826746, free_ts 57929202822
> > > > > > > set_page_owner include/linux/page_owner.h:32 [inline]
> > > > > > > post_alloc_hook+0x234/0x290 mm/page_alloc.c:1884
> > > > > > > prep_new_page mm/page_alloc.c:1892 [inline]
> > > > > > > get_page_from_freelist+0x24e4/0x2580 mm/page_alloc.c:3945
> > > > > > > __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5240
> > > > > > > alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
> > > > > > > alloc_slab_page mm/slub.c:3075 [inline]
> > > > > > > allocate_slab+0x86/0x3b0 mm/slub.c:3248
> > > > > > > new_slab mm/slub.c:3302 [inline]
> > > > > > > ___slab_alloc+0xe70/0x1860 mm/slub.c:4656
> > > > > > > __slab_alloc+0x65/0x100 mm/slub.c:4779
> > > > > > > __slab_alloc_node mm/slub.c:4855 [inline]
> > > > > > > slab_alloc_node mm/slub.c:5251 [inline]
> > > > > > > kmem_cache_alloc_noprof+0x40f/0x710 mm/slub.c:5270
> > > > > > > xfs_btree_alloc_cursor fs/xfs/libxfs/xfs_btree.h:683 [inline]
> > > > > > > xfs_cntbt_init_cursor+0x64/0x210 fs/xfs/libxfs/xfs_alloc_btree.c:511
> > > > > > > xfs_free_ag_extent+0x570/0x1890 fs/xfs/libxfs/xfs_alloc.c:2149
> > > > > > > __xfs_free_extent+0x2a7/0x460 fs/xfs/libxfs/xfs_alloc.c:4047
> > > > > > > xfs_extent_free_finish_item+0x299/0x840 fs/xfs/xfs_extfree_item.c:555
> > > > > > > xfs_defer_finish_one+0x5a6/0xcc0 fs/xfs/libxfs/xfs_defer.c:595
> > > > > > > xfs_defer_finish_noroll+0x94a/0x1300 fs/xfs/libxfs/xfs_defer.c:707
> > > > > > > xfs_defer_finish+0x1e/0x270 fs/xfs/libxfs/xfs_defer.c:741
> > > > > > > xrep_defer_finish+0x16e/0x240 fs/xfs/scrub/repair.c:242
> > > > > > > page last free pid 785 tgid 785 stack trace:
> > > > > > > reset_page_owner include/linux/page_owner.h:25 [inline]
> > > > > > > free_pages_prepare mm/page_alloc.c:1433 [inline]
> > > > > > > __free_frozen_pages+0xbc4/0xd40 mm/page_alloc.c:2973
> > > > > > > vfree+0x25a/0x400 mm/vmalloc.c:3466
> > > > > > > delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3385
> > > > > > > process_one_work kernel/workqueue.c:3257 [inline]
> > > > > > > process_scheduled_works+0xa45/0x1670 kernel/workqueue.c:3340
> > > > > > > worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
> > > > > > > kthread+0x711/0x8a0 kernel/kthread.c:463
> > > > > > > ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
> > > > > > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
> > > > > > >
> > > > > > > Memory state around the buggy address:
> > > > > > > ffff88806af03480: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
> > > > > > > ffff88806af03500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > > > > > >ffff88806af03580: fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
> > > > > > > ^
> > > > > > > ffff88806af03600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> > > > > > > ffff88806af03680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
> > > > > > > ==================================================================
> > > > > > > ---
> > > > > > >
> > > > > > > I also analyzed the root cause of this issue. In
> > > > > > > xchk_btree_check_block_owner(), bs->cur is an alias for
> > > > > > > bs->sc->sa.bnocur (or rmap_cur,
> > > > > > > https://github.com/torvalds/linux/blob/v6.19-rc6/fs/xfs/scrub/btree.c#L396-L400).
> > > > > > > The issue occurs when error injection triggers a failure path:
> > > > > > >
> > > > > > > 1. xchk_btree_check_block_owner() calls xchk_xref_is_used_space()
> > > > > > > 2. In xchk_xref_is_used_space(), xfs_alloc_has_records() returns a
> > > > > > > non-zero error due to error injection
> > > > > > > 3. Non-zero error causes xchk_should_check_xref() to free curpp (which
> > > > > > > points to bs->sc->sa.bnocur).
> > > > > > > 4. Memory pointed to by bs->cur is freed.
> > > > > > >
> > > > > > > Control returns to xchk_btree_check_block_owner(), which subsequently
> > > > > > > accesses bs->cur->bc_ops, triggering the UAF.
> > > > > > >
> > > > > > > P.S. this issue can also be triggered independently by syzkaller using
> > > > > > > our generated specs.
> > > > > > >
> > > > > > > To fix this issue, we can cache values of
> > > > > > > xfs_btree_is_bno(bs->cur->bc_ops) and
> > > > > > > xfs_btree_is_rmap(bs->cur->bc_ops) at the beginning of the function:
> > > > > > > ```
> > > > > > > --- a/fs/xfs/scrub/btree.c
> > > > > > > +++ b/fs/xfs/scrub/btree.c
> > > > > > > @@ -371,6 +371,8 @@ xchk_btree_check_block_owner(
> > > > > > > xfs_agnumber_t agno;
> > > > > > > xfs_agblock_t agbno;
> > > > > > > bool init_sa;
> > > > > > > + bool is_bno;
> > > > > > > + bool is_rmap;
> > > > > > > int error = 0;
> > > > > > >
> > > > > > > if (!bs->cur)
> > > > > > > @@ -379,6 +381,9 @@ xchk_btree_check_block_owner(
> > > > > > > agno = xfs_daddr_to_agno(bs->cur->bc_mp, daddr);
> > > > > > > agbno = xfs_daddr_to_agbno(bs->cur->bc_mp, daddr);
> > > > > > >
> > > > > > > + is_bno = xfs_btree_is_bno(bs->cur->bc_ops);
> > > > > > > + is_rmap = xfs_btree_is_rmap(bs->cur->bc_ops);
> > > > > > > +
> > > > > > > /*
> > > > > > > * If the btree being examined is not itself a per-AG btree, initialize
> > > > > > > * sc->sa so that we can check for the presence of an ownership record
> > > > > > > @@ -398,11 +403,11 @@ xchk_btree_check_block_owner(
> > > > > > > * have to nullify it (to shut down further block owner checks) if
> > > > > > > * self-xref encounters problems.
> > > > > > > */
> > > > > > > - if (!bs->sc->sa.bno_cur && xfs_btree_is_bno(bs->cur->bc_ops))
> > > > > > > + if (!bs->sc->sa.bno_cur && is_bno)
> > > > > > > bs->cur = NULL;
> > > > > > >
> > > > > > > xchk_xref_is_only_owned_by(bs->sc, agbno, 1, bs->oinfo);
> > > > > > > - if (!bs->sc->sa.rmap_cur && xfs_btree_is_rmap(bs->cur->bc_ops))
> > > > > > > + if (!bs->sc->sa.rmap_cur && is_rmap)
> > > > > >
> > > > > > Indentation problems notwithstanding, that looks like a correct
> > > > > > resolution to the UAF problem.
> > > > > >
> > > > > > > bs->cur = NULL;
> > > > > > >
> > > > > > > out_free:
> > > > > > > ```
> > > > > > >
> > > > > > > After applying above changes, reproducer ran for ~35 minutes without
> > > > > > > triggering any issues.
> > > > > > >
> > > > > > > If above solutions are acceptable, we are happy to submit patches :)
> > > > > > >
> > > > > > > The kernel console output, kernel config, syzkaller reproducer, and C
> > > > > > > reproducer are also attached to help with analysis.
> > > > > > >
> > > > > > > Please let me know if any further information is required.
> > > > > > >
> > > > > > > Best Regards,
> > > > > > > Jiaming Zhang
> > > > > >
> > > > > > Please just link to your dashboard, don't send a 1MB email to dozens
> > > > > > of people.
> > > > > >
> > > > > > --D
> > > > >
> > >
> > > Hi Darrick,
> > >
> > > I checked the execution path again and I have to apologize, my
> > > analysis yesterday was partly incorrect.
> > >
> > > I have new findings today that point how the cursor is nullified
> > > during the revalidation. I detailed below.
> > >
> > > In xrep_revalidate_allocbt(), xchk_allocbt() is called twice (first
> > > for BNOBT, second for CNTBT). The cause of this issue is that the
> > > first call nullified the cursor required by the second call.
> > >
> > > Let's first enter xrep_revalidate_allocbt() via following call chain:
> > >
> > > xfs_file_ioctl() ->
> > > xfs_ioc_scrubv_metadata() ->
> > > xfs_scrub_metadata() ->
> > > `sc->ops->repair_eval(sc)` ->
> > > xrep_revalidate_allocbt()
> > >
> > > xchk_allocbt() is called twice in this function. In the first call:
> > >
> > > /* Note that sc->sm->sm_type is XFS_SCRUB_TYPE_BNOPT now */
> > > xchk_allocbt() ->
> > > xchk_btree() ->
> > > `bs->scrub_rec(bs, recp)` ->
> > > xchk_allocbt_rec() ->
> > > xchk_allocbt_xref() ->
> > > xchk_allocbt_xref_other()
> > >
> > > since sm_type is XFS_SCRUB_TYPE_BNOPT, pur is set to &sc->sa.cnt_cur.
> > > Kernel called xfs_alloc_get_rec() and returned -EFSCORRUPTED. Call
> > > chain:
> > >
> > > xfs_alloc_get_rec() ->
> > > xfs_btree_get_rec() ->
> > > xfs_btree_check_block() ->
> > > (XFS_IS_CORRUPT || XFS_TEST_ERROR), the former is false and the latter
> > > is true, return -EFSCORRUPTED. This should be caused by
> > > ioctl$XFS_IOC_ERROR_INJECTION I guess.
> >
> > Ah, that's how it happens. The error gets injected during the
> > revalidation of a bnobt that involved the cntbt btree, so the cntbt
> > cursor gets deleted.
> >
> > > Back to xchk_allocbt_xref_other(), after receiving -EFSCORRUPTED from
> > > xfs_alloc_get_rec(), kernel called xchk_should_check_xref(). In this
> > > function, *curpp (points to sc->sa.cnt_cur) is nullified.
> > >
> > > Back to xrep_revalidate_allocbt(), since sc->sa.cnt_cur has been
> > > nullified, it then triggered null-ptr-deref via xchk_allocbt() (second
> > > call) -> xchk_btree().
> >
> > Yep. So you're right, the revalidation needs to check for
> > sc->sa.cnt_cur==NULL before calling xchk_allocbt a second time.
>
> Sounds good to me. Thanks for your work on XFS :)
You're welcome! And thank /you/ for being willing to try to fix the
problems you find; I very much appreciate that. :)
--D
>
> >
> > > I noticed that at the beginning of xchk_should_check_xref(), it
> > > checked whether xref should be skipped. Can this issue be fixed if
> > > kernel skips xref in this case? I'm not sure.
> > >
> > > I hope the analysis is helpful. Feel free to contact me if any further
> > > information is needed.
> >
> > That was very helpful. Could you please take a look at the proposed
> > fixes that I'm about to send?
> >
> > --D
> >
> > >
> > > Best Regards,
> > > Jiaming Zhang
>
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-01-23 7:03 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-20 10:13 [Linux Kernel Bugs] general protection fault in xchk_btree and another slab-use-after-free issue Jiaming Zhang
2026-01-20 19:17 ` Darrick J. Wong
2026-01-21 10:14 ` Jiaming Zhang
2026-01-21 19:23 ` Darrick J. Wong
2026-01-22 11:30 ` Jiaming Zhang
2026-01-22 23:10 ` Darrick J. Wong
2026-01-23 2:08 ` Jiaming Zhang
2026-01-23 7:03 ` Darrick J. Wong
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox