From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-137.mail.qq.com (out162-62-57-137.mail.qq.com [162.62.57.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 10F52372EC0; Mon, 12 Oct 2026 17:12:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.137 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791825177; cv=none; b=j7zXKpB9A1C9mEpYYg1zfpM6V3/GUUX3ZHNi/85ku6VoYL6pbKLmWUjGRSmazp1iHxPUqqV+EzD7ToGk/Sh2y1LMEInVJ7BtryV1/nNCSnmrVUPsor1cq6RAhuM+vxj/asbePeICzEXP/mn9nI1lKsgWurP18ZOqFGMMc8wyLCw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791825177; c=relaxed/simple; bh=539Sb1u17axeD8IFrVIjWAm+KNBFe6/yeiD64c/yATk=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version:Content-Type; b=PxnKXKF7MxktgoiY7zB2j4n5Xzzgk4Utor/Kx1CB2fdWowmkTWbcSFVIlpR2qKoNrU5HdGagaBhk1ox0zcI6K2c9Hmc93uVWRjbb10QXkkIVKtN+vEJWVtJpmaFkkCLHj7n9OIQxFGIl1nBHCQK/CSS4isufB4d0gnFAVRkE0uk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=Qmvp1TKl; arc=none smtp.client-ip=162.62.57.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="Qmvp1TKl" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1791825162; bh=ch7FL5YUmOxjD9Xv1dA5oASKagNdVBz1JaiZG7olqkI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Qmvp1TKl7wsNCRsC8KHsrrMHJcMgdjJPCuRskJlBc2LpyGzx5+hQtbSsOHlTH4c/Z JMzdNqYL0q+FqW83lsoJUfpjz9QTSkNyL0Y6y3l3fprJuuFaIzcXCfFxMbgHh9eXHs 20ny3c0e1uluBbgITY66ynDBd0HCqk/5WLUlvBXM= Received: from [172.18.4.77] ([111.31.227.58]) by newxmesmtplogicsvrszc43-0.qq.com (NewEsmtp) with SMTP id 32829C07; Tue, 13 Oct 2026 01:12:40 +0800 X-QQ-mid: xmsmtpt1791825160tmdx8gzg1 Message-ID: X-QQ-XMAILINFO: MllZffuBkEb51o7JIPW1/WocFKr2/CL7J/Lh+eBum8S+4b6+pnMABvTreCU67D QVkNgkpmqwQHTSg3jbhVsXIYGWpkXNdbeglGhN4tQhGQPsQqBvQUqGwqdrI5ZAbiiLybFddN6Vr4 Svps7ZgX0a5Nl4V5o9v1IH3eM6LfoUA0lzSjxc3dFDHjmB+TW2mdzWk23wrkqX4/QxNgnH6VGq9O rk04+/9CaRCHGCMBkogosRYfv7L9BwI+PeZg0lxs8TIFqGTJyFLh3VKtmJv052XphsM0QVH3ET2D ySVu7lNYVgA69uZnDEXyNZo+r/dRZ003V3TxZzS5HDMu7Rgqjj9+HR9xhkCwPYSEi1UQTjTyIgsv kXZLUhv4uY4YLRCgHsX5N9k6lOUaOhZnzxuXPcYO82lzKVPDDm+3L2aeKFojYqPaqSf0L3u5LNUx 6UcAiXjFHG5zHyAYU54WX3NH3bJzC9ypvwXFrR092gObkgLUZxOXNKFLgORQeZtskfZNHJwYXFA1 CLmBY4qbURmu4kqZ40gcBIXiphEScCt4zSIRW30vsHzenJIxRkX2t4dVRPV3ryI4PZ2HKv151IIm cx2cmIdFC6qNaFlIL2SsbUZIXdnxT1SC5vTgqdorVbJ5Pfnyoi0ccTjzsXTsQZBNMzgNqMEPli4a bREuX8HuGCn+kMjWubyMiD0gMQY8dTW/XHR9IAfj+YKhhWZI8iL4xIu7I0S6YXz8d71Vvxztp1m2 fMw3OR72ffWZEui3/LavYD7Sx4C7ZZoZGJkxQbUhSAZZw+0nATKh1bZ8Fl42VVgUDnVRfCxf16ON fjGvkcTKezO+GA8WqzzohLs+/3VXsptSIICR0D+GaEk88SLBuDSw99kS4ilc9450hS9oRpFvBsUt KRC4DHMgR/6vkh7DCUHohQG4GJKssp1ZGxCX2OdZCy8amzDzfyVXgqDOAS6VAtcvH5iBCdMWvLYv GIrXoC8J/BT9aGOAWtf9lGrdOOnWyG64XnAKXz269UUYsjWC1AYTUTkgp4KHQdbQx9TVG5K45Rel JkabvLL12jkNbGsJftZnxdzfkBvmlWM9UPsJYYwCr5WoT3QTmJ X-QQ-XMRINFO: MSVp+SPm3vtSI1QTLgDHQqIV1w2oNKDqfg== From: 1sh1ro To: Dave Kleikamp Cc: jfs-discussion@lists.sourceforge.net, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [BUG REPORT] jfs: KASAN: slab-use-after-free in diRead() when opening a file in a crafted image Date: Tue, 13 Oct 2026 01:12:39 +0800 X-OQ-MSGID: <20261013011239.24104-jfs-diRead-repro@yangguikun19.qq.com> In-Reply-To: <20261012223824.41804-1-jfs-diRead@yangguikun19.qq.com> References: <20261012223824.41804-1-jfs-diRead@yangguikun19.qq.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Hi Dave, a follow-up to my report: I have a reproducer and the root cause. Root cause ---------- diRead() computes the inode's allocation group via BLKTOAG(), which dereferences sbi->bmap: agno = BLKTOAG(agstart, JFS_SBI(ip->i_sb)); /* reads bmap->db_agl2size */ The bmap of a *live, mounted* superblock is freed and reallocated by jfs_mount_rw(sb, remount=1) -- the path jfs_remount() takes for a read-only -> read-write remount: dbUnmount(sbi->ipbmap, 1); /* kfree(bmp); sbi->bmap = NULL; */ dbMount(sbi->ipbmap); /* re-allocate (does I/O) */ A concurrent lookup (open() -> jfs_lookup() -> jfs_iget() -> diRead()) that races this window either reads the just-freed bmap (the KASAN slab-use-after-free I reported first) or, once sbi->bmap has been cleared, dereferences NULL. Both faults are the same race at the same access -- offset 52 is bmap->db_agl2size in both traces. Reproducer ---------- The attached program repeatedly mounts the crafted image read-only and remounts it read-write (i.e. the jfs_mount_rw(sb, 1) path) while hammering lookups on the freshly mounted filesystem. It triggered in about 19 minutes on one VM and 26 minutes on another (2/2), on 7.2-rc5 with 2 vCPUs: [ 1142.131821] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI [ 1142.132552] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 1142.133042] CPU: 1 UID: 0 PID: 30502 Comm: jfs_race9 Tainted: G W 7.2.0-rc5 #1 PREEMPT(full) [ 1142.134508] RIP: 0010:diRead+0x521/0xc40 [ 1142.140212] Call Trace: [ 1142.140626] ? __pfx_diRead+0x10/0x10 [ 1142.140927] jfs_iget+0x9b/0x5b0 [ 1142.141229] jfs_lookup+0x27a/0x340 [ 1142.142850] path_openat+0x293c/0x3dd0 [ 1142.143817] do_file_open+0x216/0x470 [ 1142.145352] do_sys_openat2+0xe8/0x210 [ 1142.146270] __x64_sys_openat+0x13f/0x1f0 Immediately before each attempt the log shows the remount transition: loop0: Can't mount, would change RO state How to run it ------------- # in the guest, with the crafted image from my first mail: base64 -d jfs.zlib.b64 > jfs.zlib python3 -c "import zlib;open('jfs.img','wb').write(zlib.decompress(open('jfs.zlib','rb').read()))" losetup /dev/loop0 jfs.img # read-write loop device gcc -static -O2 -pthread -o jfs_race9 jfs_race9.c ./jfs_race9 3600 /dev/loop0 4 # seconds, loop device, lanes One detail that matters: jfs's rw->ro remount does not actually take effect (the mount stays rw), so each iteration needs a *fresh* read-only mount before the read-write remount. That is also how syzkaller reaches this path. The image (zlib, base64) for self-containedness: eJzs3U1vHVf9B/Df3Cc/9N/W6qLqP0LITctDKc1jCYECbRewYMMCZYsSuW4VkQJKAkqriLjyhgUv AoTEEiGWrHgBXbBlxwsgUoIE6opBY5+TjCfXuQ6O79g+n4/kzPzmzPieyfc+embuCQAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgvv+9H56tIuLyL9KClYj/i2HEIGKpqVcjYml1Ja8/ioiX Yqs5XoyI8UJEs/3WP89HvBkRnz4Xce/+7bVm8bk99uO7f/zb7370zA/++ofx6X//6ebwrd3Wu3Xr 1//685397TMAAACUpq7rukof80+kz/eDvjsFAMxFfv2vk7xcrVar1Wr18avb6unutIuI2Ghv07xn cDgeAI6Yjfis7y7QI/kXbRQRz/TdCeBQq/ruAAfi3v3ba1XKt2q/Hqxut+dzQXbkv1E9uL5jt+ks 3XNM5nX/2oxhvLBLf5bm1IfDJOc/6OZ/ebt9ktY76PznZbf8J9uXPhUn5z/s5t9xfPIfTM2/VDn/ 0RPlP5Q/AAAAAAAcYvnv/ys9H/9d2P+u7Mnjjv+uzqkPAAAAAAAAAPC07Xf8vweM/wcAAACHVvNZ vfGb5x4u2+272Jrll6qIZzvrA4VJF8ss990PAAAAAAAAAAAAACjJaPsc3ktVxDginl1eruu6+Wnr 1k9qv9sfdaXvP5Ss7yd5AADY9ulznWv5q4jFiLiUvutvvLy8XNeLS8v1cr20kN/PThYW66XW59o8 bZYtTPbwhng0qZtfttjarm3W5+VZ7d3f19zWpB7uoWPz0WPgABAR269G97wiHTN1/Xz0/S6Ho8Hj //jx+Gcv+r6fAgAAAAevruu6Sl/nfSId8x/03SkAYC7y63/3uIBarVar1erjV7fV091pFxGx0d6m ec9gOH4AOGI24rO+u0CP5F+0UUS81HcngEOt6rsDHIh792+vVSnfqv16kMZ3z+eC7Mh/o9raLm8/ bTpL9xyTed2/NmMYL+zSnxfn1IfDJOc/6OZ/ebt9ktY76PznZbf8m/1c6aE/fcv5D7v5dxyf/AdT 8y9Vzn/0RPkP5Q8AAAAAAIdY/vv/iuO/eZcBAAAAAAAA4Mi5d//2Wr7uNR///9yU9Vz/eTzl/Cv5 FynnP+jk/+XOesPW/N13H+b/z/u3135/8x//n6d7zX8hz1TpnlWle0SVbqkapel+9u5Rm+PhpLml cTUYjtI5P/X4/bga12I9zuxYd5D+Px62n93R3vR0vKP93I720SPt53e0j9P3DtRLuf1UrMVP41q8 t9XetC3M2P/FGe31jPac/9Djv0g5/1Hrp8l/ObVXnWnj7ieDRx737em023nn6ud/deYA92O8x/U2 Y/hg39qa/Tv5lPu0F1v/J89M4uc31q+funXl5s3rZyNNdiw9F2nylOX8x+nnwfP/K9vt+Xm//Xi9 +8nkifM/LDZjtGv+r7Tmm/19bc5960POf5J+cv7vpfbpj/+jnP/uj//Xe+gPAAAAAAAAAAAAAAAA PE5d11uXiL4TERfS9T99XZsJAMxXfv2vk7xcrVar1Wr18avb6unebhcR8Zf2Ns17hl9O+2UAwGH2 n4j4e9+doDfyL1j+vr9m+mrfnQHm6sZHH//4yrVr69dv9N0TAAAAAAAAAOB/lcf/XG2N//xqRKx0 1tsx/uu7sbrf8T9HeebBAKNPeaDvXWwOJsNBa7jxl+Px43+fjMeP/z2acXuzxiWezGhfmNG+OKN9 6oUeLTn/l1vjnTf5n+gMv17C+K/dMe9LkPM/2bo/N/l/qbNeO//6t0c5/8GO/E/f/PBnp2989PEb Vz+88sH6B+s/OX/27JnzFy5cvHjx9PtXr62f2f63xx4frJx/HvvaeaBlyfnnzOVflpz/F1It/7Lk /L+YavmXJeef3+/Jvyw5//zZR/5lyfm/lmr5lyXn/5VUy78sOf/XUy3/suT8v5pq+Zcl5/9GquVf lpz/qVTLvyw5/9Opln9Zcv75CJf8y5Lzz2c2yL8sOf9zqZZ/WXL+51Mt/7Lk/N9MtfzLkvP/Wqrl X5ac/4VUy78sOf+vp1r+Zcn5X0y1/MuS8/9GquVflpz/N1Mt/7Lk/N9KtfzLkvP/VqrlX5ac/7dT Lf+y5Py/k2r5lyXn/3aq5V+Wh9//b8aMGTN5pu9nJgAAAAAAAAAAAACgax6nE/e9jwAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAD8lx04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqirswIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYe/eYuSq7zuAn13v2mtzcwKhhhqyNo4xZmHXF3xJ6+IQ QigkTbmloRds17s2m/iGd90ARbIjkgYpjhpVqcpL2yRCLS9VrCoPaUUjHqpWfSrtQ/pSpaqUB1SR iESq1FYtW82Z//+/M+Ozc9Z4cGbO+Xwk+Hlnzsz/zJkzs/td8x0AAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA gFYbPjrz5aEsyxr/5P9am2VXN/68enxtftmHf9Z7CAAAAFyu/8v//fZ16YL9y7hRyzZ/f+s/fmdh YWEh+8yKPxz9+sJCumI8y0ZXZVl+XXTh358cat0meDEbGxpu+Xq4ZPkVJdePlFw/WnL9ypLrV5Vc P1Zy/UUH4CKrm7+Pye9sU/7Htc1Dmt2QjebXbSq41YtDq4aH4+9yckP5bRZGj2Sz2bFsJptq2765 7VC+/WsbGms9mMW1hlvWWt84Q37ywuG4D0PhGG9qW2vxPqMffSQb/+lPXjj8Z/Nv3VQ0Sw9D2/01 93PLxsZ+fjFc0tzXoWxVOiZxP4db9nN9wXOyom0/h/LbNf7cuZ9vL3M/Vyzu5hXV+ZyPZcP5n9/I j9NI66/10nFaHy77r9uyLDu3uNud21y0VjacrWm7ZHjx+RlrnpGN+2icSu/PRi7pPN2wjPO0Mac3 tZ+nna+J+PxvCLcbWWIfWp+mH31h5UXP+6Wep1HjUS/1Wuk8B3v9WumXczCeF2/kD/qlwnNwU3j8 L2xe+hwsPHcKzsH0uFvOwY1l5+DwyhX5PqcnYSi/zeI5uK1t+xX5SkP5fHNz93Nwcv74qcm5556/ a/b4oaMzR2dO7Ni2bWrHrl179uyZPDJ7bGaq+e93ebT735psOL0GNoZjF18Dt3ds23qqLnyzd6/D sS6vw7Ud2/b6dTjS+eCGrswL8uJzuvnaeLxx0MfOD2dLvMby52fr5b8O0+NueR2OtLwOC7+nFLwO R5bxOmxsc2rr8n5mGWn5p2gf3qvvBWtbzsHOn0c6z8Fe/zzSL+fgWDgv/nXr0t8L1of9fWniUn8e WXHROZgebnjvaVySft4f25OPovPy5sYVV63MzszNnL772UPz86e3ZWFcEde3nCud5+ualseUXXS+ Dl/y+bp/9taXbi64fG04VmN3Nf41tuRz1dhm593dn6v8u1vx8Wy7dHsWRo9d6eNZ9N28cTxTluxy PBvbfHHy8n8WT7m05f13dIn335j732mul+7qxRWjI83X74p0dEbb3o/bn6qR/L1rKF/77cnlvR+P hn+u9PvxDV3ej9d1bNvr9+PRzgcX34+Hyn7bcXk6n8+xcJ4cm+r+ftzYZt32Sz0nR7q+H98W5lA4 /neEpJByUcu5s9R5m9YaGRkNj2skrtB+nu5o2340ZLPGWq9uf3fn6Zbbmve1Ij26RVfqPB3v2LbX 52l6v1rqPB0q++3bu9P5fI6F8+KGHd3P08Y2r++8/PfO1fGPLe+dK8vOwdEVKxv7PJpOwub7/cLq eA7enR3OTmbHsun82pX5+TSUrzVxz/LOwZXhnyv9Xrmuyzm4pWPbXp+D6fvYUufe0MjFD74HOp/P sXBevHxP93Owsc39u3v7s+uWcEnapuVn187fry31O6+bOw7Te/k7r8Z+/u3u7r+bbWxzbM+l5szu x+nOcMlVBcep8/W71GtqOrsyx2ld2M+39ix9nBr709jm63uXeT7tz7Ls7DP35b/vDX+/8pdnvv+d tr93Kfo7nbPP3Pfja4783aXsPwCD753mWNP8XtfyN1PL+ft/AAAAYCDE3D8cZiL/AwAAQGXE3B// q/BE/gcAAIDKiLl/JMykJvl/3f1vzb5zNkvN/IUgXp8Ow0PN7WLHdSp8Pb6wqHH5fa/M/Odfn13e 2sNZlv3vQ79buP26h+J+NY2H/bzwsfbLL77h2WWtf/CJxe1a++vfCPcfH89yT4OiCu5UlmWvXffV fJ3xJ8/n8/WHDubz0XMvvdjY5u29za/j7d+8vrn9H4fy7/4jh9pu/2Y4Dj8Mc+rh4uMRb/ft83es 3/3pxfXi7YY2Xps/7Jefat5v/Jycr73Y3D4e56X2/2++8uq3G9s/+6Hi/T87XLz/r4b7fSXM/76l uX3rc9D4Ot7uS2H/43rxdnd/63uF+3/hy83tTz3Q3O5gmHH9LeHrTQ+8Ndt6vJ4dOtT2uLKPN7eL 6099//fz6+P9xfvv3P+xA+fbjkfn+fH6PzfvZ7Jj+3h5XCf6q471G/fTen7G9V/9vYNtx7ls/QuP vnlL434717+zY7tTz2zN11+8v/ZPbPqTL321cL24P/v/4lTb49n/SHgdh/Vffiqcj+H6/7nQvL/O T1c4+Ej7+0/c/htrz7Y9nujBnzbXv3Dv0XyuGlu95qqrr7n23Acbxy7L3niseX9l6x/905Nt+//N G5vHI14fO/qd6y8lrn/68xMnTs6dmZ1uOar5Z+d8ork/cX+vC++tnV8fODn/9Mzp8anxqSwbr+5H 6L1r3wrzx81x7lJvv/WJ8Hze/Eevrdn8T1+Jl//L483Lzz/c/L51e9jua+HyteH5u9z1X95wY/76 Hnq9+XVbj70H1m/6jz3L2jA8/s6fC+L5fuoDT+fHoXFd/n0jvq4vc/9/MN28n++G47oQPpl5442L 67VuHz8b4fxjzdf7ZR+/8DYXn9c/D8/3J3/YvP+4X/Hx/iD8HPO9de3vd/H8+O7Z4c77zz/F41x4 P8nONa+PW8Xjff7tGwt3L34OSXbupvzrP0j3c9MlPcylzD03N3ls9sSZZyfnZ+bmJ+eee/7A8ZNn TswfyD/L88Bny26/+P60Jn9/mp7ZtTPL361ONsd77Ge9/6eeODy9e2rz9MyRQ2eOzD9xaub00cNz c4dnpuc2HzpyZObzZbefnd63bfveHbu3Txydnd63Z+/eHXsnZk+cbOxGc6dK7Jr63MSJ0wfym8zt 27l32z337JyaOH5yembf7qmpiTNlt8+/N000bv07E6dnjh2anz0+MzE3+/zMvm17d+3aXvppgMdP HZkbnzx95sTkmbmZ05PNxzI+n1/c+N5Xdnuqae7fmj/PdhpqfhBf9qk7d6XPZ2145QtL3lVzk44P EH0rfBbNP7zv1J7lfB1z/2iYSU3yPwAAANRBzP0rw0zkfwAAAKiMmPtXhZnI/wAAAFAZMfePhZnU JP/r/+v/6//r/+v/F6+v/z+Y9P+70/8vof+v/6//r/9PT/Vb/z/m/tVZVsv8DwAAAHUQc/+aMBP5 HwAAACoj5v6rwkzkfwAAAKiMmPuvDjOpSf7X/9f/1//X/9f/L15f/38w6f93p/9fQv9f/1//X/+f nuq3/n/M/deEmdQk/wMAAEAdxNx/bZiJ/A8AAACVEXP/dWEm8j8AAABURsz9a8NMapL/9f/1//X/ 9f/1/4vX1/8fTPr/3fVj/7/1Na//r/8/yPuv/6//z8X6rf8fc//7wkxqkv8BAACgDmLuf3+YifwP AAAAlRFz//VhJvI/AAAAVEbM/TeEmdQk/+v/6//r/+v/6/8Xr6//P5j0/7vrx/5/K/1//f9B3n/9 /+L+/0im/19n/db/j7n/A2EmNcn/AAAAUAcx998YZiL/AwAAQGXE3P9zYSbyPwAAAFRGzP3rwkxq kv/1//X/9f/1//X/i9fX/x9M+v/d6f+X0P/X/9f/9///p6f6rf8fc/9NYSY1yf8AAABQBzH33xxm Iv8DAABAZcTc//NhJvI/AAAAVEbM/evDTGqS//X/9f/1//X/9f+L19f/H0z6/93p/5fQ/9f/1//X /6en+q3/H3P/LWEmNcn/AAAAUAcx998aZiL/AwAAQGXE3P/BMBP5HwAAACoj5v7xMJOa5H/9f/1/ /X/9f/3/4vX1/weT/n93+v8l9P/1//X/9f/pqX7r/8fcvyHMpCb5HwAAAOog5v6NYSbyPwAAAFRG zP23hZnI/wAAAFAZMfdvCjOpSf7X/9f/1//X/9f/L15f/38w6f93p/9fQv9f/1//X/+fnuq3/n/M /R8KM6lJ/gcAAIA6iLl/c5iJ/A8AAACVEXP/7WEm8j8AAABURsz9W8JMapL/9f/1//X/9f/1/4vX 1/8fTPr/3en/l9D/1//X/9f/p6f6rf8fc/8dYSY1yf8AAABQBzH3bw0zkf8BAACgMmLuvzPMRP4H AACAyoi5fyLMpCb5X/9f/1//X/9f/794ff3/waT/353+fwn9f/1//X/9f3qq3/r/MfffFWZSk/wP AAAAdRBz/91hJvI/AAAAVEbM/ZNhJvI/AAAAVEbM/VNhJjXJ//r/+v/6//r/+v/F6+v/Dyb9/+70 /0vo/+v/6//r/9NT/db/j7l/W5hJTfI/AAAA1EHM/dvDTOR/AAAAqIyY+3eEmcj/AAAAUBkx9+8M M6lJ/tf/1//X/9f/1/8vXl//fzDp/3en/19C/1//X/9f/5+e6rf+f8z994SZ1CT/AwAAQB3E3L8r zET+BwAAgMqIuX93mIn8DwAAAJURc/+eMJOa5H/9f/1//X/9f/3/4vX1/weT/n93+v8l9P/1//X/ 9f/pqX7r/8fcvzfMpCb5HwAAAOog5v4Ph5nI/wAAAFAZMff/QpiJ/A8AAACVEXP/L4aZ1CT/6//r /+v/vwf9/6GRwvND/1//X///vaf/353+fwn9f/1//X/9f3qq3/r/MffvCzOpSf4HAACAOoi5/5fC TOR/AAAAqIyY++8NM5H/AQAAoDJi7t8fZlKT/K//r/+v/+///6//X7y+/v9g0v/vTv+/hP6//r/+ v/4/PdVv/f+Y+z8SZlKT/A8AAAB1EHP/fWEm8j8AAABURsz9Hw0zkf8BAACgMmLuvz/MpCb5X/9f /1//X/9f/794ff3/waT/353+fwn9f/1//X/9f3pqVZ/1/2Pu/1iYSU3yPwAAANRBzP0PhJnI/wAA AFAZMfd/PMxE/gcAAIDKiLn/wTCTmuR//X/9f/1//X/9/+L19f8Hk/5/d/r/JfT/9f/1//X/6al+ +///x9z/y2EmNcn/AAAAUAcx9z8UZiL/AwAAQGXE3P9wmIn8DwAAAJURc/8nwkxqkv/1//X/9f/1 //X/i9fX/x9M+v/d6f+X0P/X/9f/1/+np/qt/x9z/yfDTGqS/wEAAKAOYu7/lTAT+R8AAAAqI+b+ T4WZyP8AAABQGTH3/2qYSU3yv/6//r/+v/6//n/x+vr/g0n/vzv9/xL6//r/+v/6//RUv/X/Y+5/ JMykJvkfAAAA6iDm/kfDTOR/AAAAqIyY+x8LM5H/AQAAoDJi7n88zKQm+V//X/9f/1//X/+/eH39 /8Gk/9+d/n8J/X/9f/1//X96qt/6/zH3PxFmUpP8DwAAAHUQc/+nw0zkfwAAAKiMmPt/LcxE/gcA AIDKiLn/M2EmNcn/+v/6//r/+v/6/8Xr6/8PJv3/7vT/S+j/6//r/+v/01P91v+Puf/JMJOa5H8A AACog5j7fz3MRP4HAACAyoi5/zfCTOR/AAAAqIyY+38zzKQm+V//X/9f/1//X/+/eH39/8Gk/9+d /n8J/X/9f/1//X96qt/6/zH3/1aYSU3yPwAAANRBzP1PhZnI/wAAAFAZMfcfCDOR/wEAAKAyYu4/ GGZSk/yv/6//r/+v/6//X7y+/v9g0v/vTv+/hP6//r/+v/4/PdVv/f+Y+w+FmdQk/wMAAEAdxNz/ 22Em8j8AAABURsz9h8NM5H8AAACojJj7p8NMapL/69z/v7dlPyL9f/3//AL9f/1//f+Bpf/fnf5/ Cf1//X/9f/1/eqrf+v8x98+EmdQk/wMAAEAdxNx/JMxE/gcAAIDKiLn/aJiJ/A8AAACVEXP/02Em Ncn/de7/+///6/9H+v/6/0Xr6/8PJv3/7vT/S+j/6//r/+v/01P91v+PuX82zKQm+R8AAADqIOb+ z4aZyP8AAABQGTH3fy7MRP4HAACAyoi5/1iYSU3yv/6//r/+v/6//n/x+vr/g0n/vzv9/xL6//r/ +v/6//RUv/X/Y+4/HmZSk/wPAAAAdRBz/4kwE/kfAAAAKiPm/pNhJvI/AAAAVEbM/afCTGqS//X/ 9f/1//X/9f+L19f/H0z6/93p/5fQ/9f/1//X/6en+q3/H3P/M2EmNcn/AAAAUAcx958OM5H/AQAA oDJi7p8LM5H/AQAAoDJi7p8PM6lJ/tf/1//X/9f/1/8vXl//fzDp/3en/19C/1//X/9f/5+e6rf+ f8z9Z8JMapL/AQAA/p+9u+bVJTvCMHrlwD/ZbF8zMzMzMzMzMzMz2zPBJFU1yZ5ujdSj2121VlI6 Op+04zd41DBB7v77xC32PwAAALSRu/++cYv9DwAAAG3k7r9f3DJk/+v/9f/6f/2//n/9vv7/mvT/ 2/T/O/T/+n/9v/6fQ52t/8/df/+4Zcj+BwAAgAly9z8gbrH/AQAAoI3c/Q+MW+x/AAAAaCN3/4Pi liH7X/+v/9f/6//1/+v39f/XpP/fpv/fof/X/+v/9f8c6mz9f+7+B8ctQ/Y/AAAATJC7/yFxi/0P AAAAbeTuvxm32P8AAADQRu7+h8YtQ/a//l//r//X/+v/1+/r/69J/79N/79D/6//1//r/znU2fr/ 3P0Pi1uG7H8AAACYIHf/w+MW+x8AAADayN3/iLjF/gcAAIA2cvc/Mm4Zsv/1//p//b/+X/+/fl// f036/236/x36f/2//l//z6HO1v/n7n9U3DJk/wMAAMAEufsfHbfY/wAAANBG7v7HxC32PwAAALSR u/+xccuQ/a//1//r//X/+v/1+/r/a9L/b9P/79D/6//1//p/DnW2/j93/+PiliH7HwAAACbI3f/4 uMX+BwAAgDZy9z8hbrH/AQAAoI3c/U+MW4bsf/2//l//r//X/6/f1/9fk/5/m/5/h/5f/6//1/9z qLP1/7n7nxS3DNn/AAAAMEHu/ifHLfY/AAAAtJG7/ylxi/0PAAAAbeTuf2rcMmT/6//1//p//b/+ f/2+/v+a9P/b9P879P/6f/2//p9Dna3/z93/tLhlyP4HAACACXL3Pz1usf8BAACgjdz9z4hb7H8A AABoI3f/M+OWIftf/6//1//r//X/6/f1/9ek/9+m/9+h/9f/6//1/xzqbP1/7v5nxS1D9j8AAABM kLv/2XGL/Q8AAABt5O5/Ttxi/wMAAEAbufufG7cM2f/6f/2//l//r/9fv6//vyb9/zb9/w79v/5f /6//51Bn6/9z9z8vbhmy/wEAAGCC3P3Pj1vsfwAAAGgjd/8L4hb7HwAAANrI3f/CuGXI/tf/6//1 //p//f/6ff3/Nen/t+n/d+j/9f/6f/0/hzpb/5+7/0Vxy5D9DwAAABPk7n9x3GL/AwAAQBu5+18S t9j/AAAA0Ebu/pfGLUP2v/5f/6//1//r/9fv6/+vSf+/Tf+/Q/+v/9f/6/851Nn6/9z9L4tbhux/ AAAAmCB3/8vjFvsfAAAA2sjd/4q4xf4HAACANnL3vzJuGbL/9f/6f/2//l//v35f/39N+v9t+v8d +n/9v/5f/8+hztb/5+5/VdwyZP8DAADABLn7Xx232P8AAADQRu7+18Qt9j8AAAC0kbv/tXHLkP2v /9f/6//1//r/9fv6/2vS/2/T/+/Q/+v/9f/6fw51tv4/d//r4pYh+x8AAAAmyN3/+rjF/gcAAIA2 cve/IW6x/wEAAKCN3P1vjFuG7H/9v/5f/6//X/b/975x44b+X/9/Qfr/bfr/Hfp//b/+X//Poc7W /+fuf1PcMmT/AwAAwAS5+98ct9j/AAAA0Ebu/rfELfY/AAAAtJG7/61xy5D9r//X/+v/9f++/79+ X/9/Tfr/bfr/Hfp//b/+X//Poc7W/+fuf1vcMmT/AwAAwAS5+98et9j/AAAA0Ebu/nfELfY/AAAA tJG7/51xy5D9r//X/+v/9f/6//X7+v9r0v9v0//v0P/r//X/+n8Odbb+P3f/u+KWIfsfAAAAJsjd /+64xf4HAACANnL3vydusf8BAACgjdz9741bhux//b/+X/+v/9f/r9/X/1+T/n+b/n+H/l//r//X /3Oos/X/ufvfF7cM2f8AAAAwQe7+98ct9j8AAAC0kbv/A3GL/Q8AAABt5O7/YNwyZP/r//X/+n/9 v/5//b7+/5r0/9v0/zv0//p//b/+n0Odrf/P3f+huGXI/gcAAIAJcvd/OG6x/wEAAKCN3P0fiVvs fwAAAGgjd/9H45Yh+1//r//X/+v/9f/r9/X/16T/36b/36H/1//r//X/HOqW9f831//P3f+xuGXI /gcAAIAJcvd/PG6x/wEAAKCN3P2fiFvsfwAAAGgjd/8n45Yh+1//r//X/+v/9f/r9/X/16T/36b/ 36H/1//r//X/HOqW9f938Xfu/k/FLUP2PwAAAEyQu//TcYv9DwAAAG3k7v9M3GL/AwAAQBu5+z8b twzZ//p//b/+X/+v/1+/r/+/Jv3/Nv3/Dv2//l//r//nUGfr/3P3fy5uGbL/AQAAYILc/Z+PW+x/ AAAAaCN3/xfiFvsfAAAA2sjd/8W4Zcj+1//r//X/+n/9//p9/f816f+36f936P/1//p//T+HOlv/ n7v/S3HLkP0PAAAAE+Tu/3LcYv8DAABAG7n7vxK32P8AAADQRu7+r8YtQ/a//l//r//X/+v/1+/r /69J/79N/79D/6//1//r/znU2fr/3P1fi1uG7H8AAACYIHf/1+MW+x8AAADayN3/jbjF/gcAAIA2 cvd/M24Zsv/1//r/e+n/9f/6/+X7+v9r0v9v0//v0P/r//X/+n8Odbb+P3f/t+KWIfsfAAAAJsjd /+24xf4HAACANnL3fydusf8BAACgjdz9341bhux//b/+3/f/9f/6//X7+v9r0v9v0//v0P/r//X/ +n8Odbb+P3f/9+KWIfsfAAAAJsjd//24xf4HAACANnL3/yBusf8BAACgjdz9P4xbhux//b/+X/+v /9f/r9/X/1+T/n+b/n+H/l//r//X/3Oos/X/uft/FLcM2f8AAAAwQe7+H8ct9j8AAAC0kbv/J3GL /Q8AAABt5O7/adwyZP/r//X/+n/9v/5//b7+/5r0/9v0/zv0//p//b/+n0Odrf/P3f+zuGXI/gcA AIAJcvf/PG6x/wEAAKCN3P2/iFvsfwAAAGgjd/8v45Yh+1//r//X/+v/9f/r9/X/16T/36b/36H/ 1//r//X/HOps/X/u/l/FLUP2PwAAAEyQu//XcYv9DwAAAG3k7v9N3GL/AwAAQBu5+38btwzZ//p/ /b/+X/+v/1+/r/+/Jv3/Nv3/Dv2//l//r//nUGfr/3P3/y5uGbL/AQAAYILc/b+PW+x/AAAAaCN3 /x/iFvsfAAAA2sjd/8e4Zcj+1//r//X/+n/9//p9/f816f+36f936P/1//p//T+HOlv/n7v/T3HL kP0PAAAAE+Tu/3PcYv8DAABAG7n7/xK32P8AAADQRu7+v8YtQ/a//l//r//X/+v/1+/r/69J/79N /79D/6//1//r/znU2fr/3P1/i1uG7H8AAACYIHf/3+MW+x8AAADayN3/j7jF/gcAAIA2cvf/M24Z sv/1//p//b/+X/+/fl//f036/236/x36f/2//l//z6HO1v/n7v9X3DJk/wMAAMAEufv/HbfY/wAA ANBG7v7/xC32PwAAALSRu/+/ccuQ/a//1//r//X/+v/1+/r/a9L/b9P/79D/6//1//p/DnXP9P93 /uju9v+5+/8XtwzZ/wAAADBB7v7/xy32PwAAALSRu/+2uMX+BwAAgDZy998etwzZ//p//b/+X/+v /1+/r/+/Jv3/Nv3/Dv2//l//r//nUGf7/n/u/jsCAAD//z28eig= Reproducer source (jfs_race9.c): /* jfs diRead UAF 复现 v9：直接 syscall + 并行多路 * * v7/v8 已经跑通"新 ro 挂载 -> remount rw -> 卸载"的循环（每轮一个 bmap 释放窗口）， * 但 fork+exec /bin/mount 太慢（~115ms/轮）。这里改成直接 mount(2)/umount2()， * 并把循环复制成 4 路并行，把窗口频率提高两个数量级。 * * 每路：mount ro(全新 sb) -> 查找线程猛砸(冷 inode -> diRead) -> * mount(NULL,mp,NULL,MS_REMOUNT,..) (ro->rw -> jfs_mount_rw(sb,1) * -> dbUnmount/dbMount 释放活 sb 的 bmap) * -> umount * * 用法: jfs_race9 <秒数> [路数] */ #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #define MAXP 8 static char DEV[128]; static char MP[MAXP][32]; static int NLANE = 4; static volatile int stop = 0; static volatile int lookup_on = 0; static volatile int cur_lane = 0; static volatile unsigned long cycles = 0; static const char *MOPT = "uid=0,gid=0,errors=remount-ro,nodiscard"; /* 一路 = 一个挂载点的 ro->rw 循环 */ static void *th_lane(void *a) { int lane = (int)(long)a; const char *mp = MP[lane]; while (!stop) { if (mount(DEV, mp, "jfs", MS_RDONLY, MOPT) != 0) { umount2(mp, MNT_DETACH); continue; } cur_lane = lane; lookup_on = 1; /* ro -> rw：MS_REMOUNT 且不带 MS_RDONLY */ mount(NULL, mp, NULL, MS_REMOUNT, ""); lookup_on = 0; umount2(mp, MNT_DETACH); __sync_fetch_and_add(&cycles, 1); } return NULL; } static void *th_lookup(void *a) { (void)a; char buf[300]; while (!stop) { if (!lookup_on) { usleep(20); continue; } const char *mp = MP[cur_lane]; int dfd = open(mp, O_RDONLY | O_DIRECTORY); if (dfd >= 0) { DIR *dd = opendir(mp); struct dirent *de; if (dd) { while ((de = readdir(dd))) { if (de->d_name[0] == '.') continue; int fd = openat(dfd, de->d_name, O_RDONLY); if (fd >= 0) close(fd); } closedir(dd); } close(dfd); } struct stat st; stat(mp, &st); } return NULL; } int main(int argc, char **argv) { int secs = argc > 1 ? atoi(argv[1]) : 600; snprintf(DEV, sizeof(DEV), "%s", argc > 2 ? argv[2] : "/dev/loop0"); if (argc > 3) { NLANE = atoi(argv[3]); if (NLANE > MAXP) NLANE = MAXP; if (NLANE < 1) NLANE = 1; } for (int i = 0; i < MAXP; i++) { snprintf(MP[i], sizeof(MP[i]), "/tmp/m%d", i); mkdir(MP[i], 0777); } pthread_t tl[MAXP], tk[8]; for (long i = 0; i < NLANE; i++) pthread_create(&tl[i], NULL, th_lane, (void *)i); for (int i = 0; i < 8; i++) pthread_create(&tk[i], NULL, th_lookup, NULL); fprintf(stderr, "v9 racing %d s, %d lanes on %s\n", secs, NLANE, DEV); for (int i = 0; i < secs; i++) { sleep(1); if (i % 20 == 19) fprintf(stderr, " %lu cycles\n", cycles); } stop = 1; for (int i = 0; i < NLANE; i++) pthread_join(tl[i], NULL); for (int i = 0; i < 8; i++) pthread_join(tk[i], NULL); for (int i = 0; i < MAXP; i++) umount2(MP[i], MNT_DETACH); fprintf(stderr, "done, %lu cycles total\n", cycles); return 0; } Thanks, 1sh1ro