Re: [BUG REPORT] jfs: KASAN: slab-use-after-free in diRead() when opening a file in a crafted image
From: 1sh1ro
Date: Mon Oct 12 2026 - 13:14:05 EST
Hi Dave,
a follow-up to my report: I have a reproducer and the root cause.
Root cause
----------
diRead() computes the inode's allocation group via BLKTOAG(), which
dereferences sbi->bmap:
agno = BLKTOAG(agstart, JFS_SBI(ip->i_sb)); /* reads bmap->db_agl2size */
The bmap of a *live, mounted* superblock is freed and reallocated by
jfs_mount_rw(sb, remount=1) -- the path jfs_remount() takes for a
read-only -> read-write remount:
dbUnmount(sbi->ipbmap, 1); /* kfree(bmp); sbi->bmap = NULL; */
dbMount(sbi->ipbmap); /* re-allocate (does I/O) */
A concurrent lookup (open() -> jfs_lookup() -> jfs_iget() -> diRead())
that races this window either reads the just-freed bmap (the KASAN
slab-use-after-free I reported first) or, once sbi->bmap has been
cleared, dereferences NULL. Both faults are the same race at the same
access -- offset 52 is bmap->db_agl2size in both traces.
Reproducer
----------
The attached program repeatedly mounts the crafted image read-only and
remounts it read-write (i.e. the jfs_mount_rw(sb, 1) path) while
hammering lookups on the freshly mounted filesystem. It triggered in
about 19 minutes on one VM and 26 minutes on another (2/2), on 7.2-rc5
with 2 vCPUs:
[ 1142.131821] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI
[ 1142.132552] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
[ 1142.133042] CPU: 1 UID: 0 PID: 30502 Comm: jfs_race9 Tainted: G W 7.2.0-rc5 #1 PREEMPT(full)
[ 1142.134508] RIP: 0010:diRead+0x521/0xc40
[ 1142.140212] Call Trace:
[ 1142.140626] ? __pfx_diRead+0x10/0x10
[ 1142.140927] jfs_iget+0x9b/0x5b0
[ 1142.141229] jfs_lookup+0x27a/0x340
[ 1142.142850] path_openat+0x293c/0x3dd0
[ 1142.143817] do_file_open+0x216/0x470
[ 1142.145352] do_sys_openat2+0xe8/0x210
[ 1142.146270] __x64_sys_openat+0x13f/0x1f0
Immediately before each attempt the log shows the remount transition:
loop0: Can't mount, would change RO state
How to run it
-------------
# in the guest, with the crafted image from my first mail:
base64 -d jfs.zlib.b64 > jfs.zlib
python3 -c "import zlib;open('jfs.img','wb').write(zlib.decompress(open('jfs.zlib','rb').read()))"
losetup /dev/loop0 jfs.img # read-write loop device
gcc -static -O2 -pthread -o jfs_race9 jfs_race9.c
./jfs_race9 3600 /dev/loop0 4 # seconds, loop device, lanes
One detail that matters: jfs's rw->ro remount does not actually take
effect (the mount stays rw), so each iteration needs a *fresh* read-only
mount before the read-write remount. That is also how syzkaller reaches
this path.
The image (zlib, base64) for self-containedness:
eJzs3U1vHVf9B/Df3Cc/9N/W6qLqP0LITctDKc1jCYECbRewYMMCZYsSuW4VkQJKAkqriLjyhgUv
AoTEEiGWrHgBXbBlxwsgUoIE6opBY5+TjCfXuQ6O79g+n4/kzPzmzPieyfc+embuCQAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgvv+9H56tIuLyL9KClYj/i2HEIGKpqVcjYml1Ja8/ioiX
Yqs5XoyI8UJEs/3WP89HvBkRnz4Xce/+7bVm8bk99uO7f/zb7370zA/++ofx6X//6ebwrd3Wu3Xr
1//685397TMAAACUpq7rukof80+kz/eDvjsFAMxFfv2vk7xcrVar1Wr18avb6unutIuI2Ghv07xn
cDgeAI6Yjfis7y7QI/kXbRQRz/TdCeBQq/ruAAfi3v3ba1XKt2q/Hqxut+dzQXbkv1E9uL5jt+ks
3XNM5nX/2oxhvLBLf5bm1IfDJOc/6OZ/ebt9ktY76PznZbf8J9uXPhUn5z/s5t9xfPIfTM2/VDn/
0RPlP5Q/AAAAAAAcYvnv/ys9H/9d2P+u7Mnjjv+uzqkPAAAAAAAAAPC07Xf8vweM/wcAAACHVvNZ
vfGb5x4u2+272Jrll6qIZzvrA4VJF8ss990PAAAAAAAAAAAAACjJaPsc3ktVxDginl1eruu6+Wnr
1k9qv9sfdaXvP5Ss7yd5AADY9ulznWv5q4jFiLiUvutvvLy8XNeLS8v1cr20kN/PThYW66XW59o8
bZYtTPbwhng0qZtfttjarm3W5+VZ7d3f19zWpB7uoWPz0WPgABAR269G97wiHTN1/Xz0/S6Ho8Hj
//jx+Gcv+r6fAgAAAAevruu6Sl/nfSId8x/03SkAYC7y63/3uIBarVar1erjV7fV091pFxGx0d6m
ec9gOH4AOGI24rO+u0CP5F+0UUS81HcngEOt6rsDHIh792+vVSnfqv16kMZ3z+eC7Mh/o9raLm8/
bTpL9xyTed2/NmMYL+zSnxfn1IfDJOc/6OZ/ebt9ktY76PznZbf8m/1c6aE/fcv5D7v5dxyf/AdT
8y9Vzn/0RPkP5Q8AAAAAAIdY/vv/iuO/eZcBAAAAAAAA4Mi5d//2Wr7uNR///9yU9Vz/eTzl/Cv5
FynnP+jk/+XOesPW/N13H+b/z/u3135/8x//n6d7zX8hz1TpnlWle0SVbqkapel+9u5Rm+PhpLml
cTUYjtI5P/X4/bga12I9zuxYd5D+Px62n93R3vR0vKP93I720SPt53e0j9P3DtRLuf1UrMVP41q8
t9XetC3M2P/FGe31jPac/9Djv0g5/1Hrp8l/ObVXnWnj7ieDRx737em023nn6ud/deYA92O8x/U2
Y/hg39qa/Tv5lPu0F1v/J89M4uc31q+funXl5s3rZyNNdiw9F2nylOX8x+nnwfP/K9vt+Xm//Xi9
+8nkifM/LDZjtGv+r7Tmm/19bc5960POf5J+cv7vpfbpj/+jnP/uj//Xe+gPAAAAAAAAAAAAAAAA
PE5d11uXiL4TERfS9T99XZsJAMxXfv2vk7xcrVar1Wr18avb6unebhcR8Zf2Ns17hl9O+2UAwGH2
n4j4e9+doDfyL1j+vr9m+mrfnQHm6sZHH//4yrVr69dv9N0TAAAAAAAAAOB/lcf/XG2N//xqRKx0
1tsx/uu7sbrf8T9HeebBAKNPeaDvXWwOJsNBa7jxl+Px43+fjMeP/z2acXuzxiWezGhfmNG+OKN9
6oUeLTn/l1vjnTf5n+gMv17C+K/dMe9LkPM/2bo/N/l/qbNeO//6t0c5/8GO/E/f/PBnp2989PEb
Vz+88sH6B+s/OX/27JnzFy5cvHjx9PtXr62f2f63xx4frJx/HvvaeaBlyfnnzOVflpz/F1It/7Lk
/L+YavmXJeef3+/Jvyw5//zZR/5lyfm/lmr5lyXn/5VUy78sOf/XUy3/suT8v5pq+Zcl5/9GquVf
lpz/qVTLvyw5/9Opln9Zcv75CJf8y5Lzz2c2yL8sOf9zqZZ/WXL+51Mt/7Lk/N9MtfzLkvP/Wqrl
X5ac/4VUy78sOf+vp1r+Zcn5X0y1/MuS8/9GquVflpz/N1Mt/7Lk/N9KtfzLkvP/VqrlX5ac/7dT
Lf+y5Py/k2r5lyXn/3aq5V+Wh9//b8aMGTN5pu9nJgAAAAAAAAAAAACgax6nE/e9jwAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAD8lx04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
qqqqqqqqqqqqqqqqqqqqqqqqqirswIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYe/eYuSq7zuAn13v2mtzcwKhhhqyNo4xZmHXF3xJ6+IQ
QigkTbmloRds17s2m/iGd90ARbIjkgYpjhpVqcpL2yRCLS9VrCoPaUUjHqpWfSrtQ/pSpaqUB1SR
iESq1FYtW82Z//+/M+Ozc9Z4cGbO+Xwk+Hlnzsz/zJkzs/td8x0AAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
gFYbPjrz5aEsyxr/5P9am2VXN/68enxtftmHf9Z7CAAAAFyu/8v//fZ16YL9y7hRyzZ/f+s/fmdh
YWEh+8yKPxz9+sJCumI8y0ZXZVl+XXTh358cat0meDEbGxpu+Xq4ZPkVJdePlFw/WnL9ypLrV5Vc
P1Zy/UUH4CKrm7+Pye9sU/7Htc1Dmt2QjebXbSq41YtDq4aH4+9yckP5bRZGj2Sz2bFsJptq2765
7VC+/WsbGms9mMW1hlvWWt84Q37ywuG4D0PhGG9qW2vxPqMffSQb/+lPXjj8Z/Nv3VQ0Sw9D2/01
93PLxsZ+fjFc0tzXoWxVOiZxP4db9nN9wXOyom0/h/LbNf7cuZ9vL3M/Vyzu5hXV+ZyPZcP5n9/I
j9NI66/10nFaHy77r9uyLDu3uNud21y0VjacrWm7ZHjx+RlrnpGN+2icSu/PRi7pPN2wjPO0Mac3
tZ+nna+J+PxvCLcbWWIfWp+mH31h5UXP+6Wep1HjUS/1Wuk8B3v9WumXczCeF2/kD/qlwnNwU3j8
L2xe+hwsPHcKzsH0uFvOwY1l5+DwyhX5PqcnYSi/zeI5uK1t+xX5SkP5fHNz93Nwcv74qcm5556/
a/b4oaMzR2dO7Ni2bWrHrl179uyZPDJ7bGaq+e93ebT735psOL0GNoZjF18Dt3ds23qqLnyzd6/D
sS6vw7Ud2/b6dTjS+eCGrswL8uJzuvnaeLxx0MfOD2dLvMby52fr5b8O0+NueR2OtLwOC7+nFLwO
R5bxOmxsc2rr8n5mGWn5p2gf3qvvBWtbzsHOn0c6z8Fe/zzSL+fgWDgv/nXr0t8L1of9fWniUn8e
WXHROZgebnjvaVySft4f25OPovPy5sYVV63MzszNnL772UPz86e3ZWFcEde3nCud5+ualseUXXS+
Dl/y+bp/9taXbi64fG04VmN3Nf41tuRz1dhm593dn6v8u1vx8Wy7dHsWRo9d6eNZ9N28cTxTluxy
PBvbfHHy8n8WT7m05f13dIn335j732mul+7qxRWjI83X74p0dEbb3o/bn6qR/L1rKF/77cnlvR+P
hn+u9PvxDV3ej9d1bNvr9+PRzgcX34+Hyn7bcXk6n8+xcJ4cm+r+ftzYZt32Sz0nR7q+H98W5lA4
/neEpJByUcu5s9R5m9YaGRkNj2skrtB+nu5o2340ZLPGWq9uf3fn6Zbbmve1Ij26RVfqPB3v2LbX
52l6v1rqPB0q++3bu9P5fI6F8+KGHd3P08Y2r++8/PfO1fGPLe+dK8vOwdEVKxv7PJpOwub7/cLq
eA7enR3OTmbHsun82pX5+TSUrzVxz/LOwZXhnyv9Xrmuyzm4pWPbXp+D6fvYUufe0MjFD74HOp/P
sXBevHxP93Owsc39u3v7s+uWcEnapuVn187fry31O6+bOw7Te/k7r8Z+/u3u7r+bbWxzbM+l5szu
x+nOcMlVBcep8/W71GtqOrsyx2ld2M+39ix9nBr709jm63uXeT7tz7Ls7DP35b/vDX+/8pdnvv+d
tr93Kfo7nbPP3Pfja4783aXsPwCD753mWNP8XtfyN1PL+ft/AAAAYCDE3D8cZiL/AwAAQGXE3B//
q/BE/gcAAIDKiLl/JMykJvl/3f1vzb5zNkvN/IUgXp8Ow0PN7WLHdSp8Pb6wqHH5fa/M/Odfn13e
2sNZlv3vQ79buP26h+J+NY2H/bzwsfbLL77h2WWtf/CJxe1a++vfCPcfH89yT4OiCu5UlmWvXffV
fJ3xJ8/n8/WHDubz0XMvvdjY5u29za/j7d+8vrn9H4fy7/4jh9pu/2Y4Dj8Mc+rh4uMRb/ft83es
3/3pxfXi7YY2Xps/7Jefat5v/Jycr73Y3D4e56X2/2++8uq3G9s/+6Hi/T87XLz/r4b7fSXM/76l
uX3rc9D4Ot7uS2H/43rxdnd/63uF+3/hy83tTz3Q3O5gmHH9LeHrTQ+8Ndt6vJ4dOtT2uLKPN7eL
6099//fz6+P9xfvv3P+xA+fbjkfn+fH6PzfvZ7Jj+3h5XCf6q471G/fTen7G9V/9vYNtx7ls/QuP
vnlL434717+zY7tTz2zN11+8v/ZPbPqTL321cL24P/v/4lTb49n/SHgdh/Vffiqcj+H6/7nQvL/O
T1c4+Ej7+0/c/htrz7Y9nujBnzbXv3Dv0XyuGlu95qqrr7n23Acbxy7L3niseX9l6x/905Nt+//N
G5vHI14fO/qd6y8lrn/68xMnTs6dmZ1uOar5Z+d8ork/cX+vC++tnV8fODn/9Mzp8anxqSwbr+5H
6L1r3wrzx81x7lJvv/WJ8Hze/Eevrdn8T1+Jl//L483Lzz/c/L51e9jua+HyteH5u9z1X95wY/76
Hnq9+XVbj70H1m/6jz3L2jA8/s6fC+L5fuoDT+fHoXFd/n0jvq4vc/9/MN28n++G47oQPpl5442L
67VuHz8b4fxjzdf7ZR+/8DYXn9c/D8/3J3/YvP+4X/Hx/iD8HPO9de3vd/H8+O7Z4c77zz/F41x4
P8nONa+PW8Xjff7tGwt3L34OSXbupvzrP0j3c9MlPcylzD03N3ls9sSZZyfnZ+bmJ+eee/7A8ZNn
TswfyD/L88Bny26/+P60Jn9/mp7ZtTPL361ONsd77Ge9/6eeODy9e2rz9MyRQ2eOzD9xaub00cNz
c4dnpuc2HzpyZObzZbefnd63bfveHbu3Txydnd63Z+/eHXsnZk+cbOxGc6dK7Jr63MSJ0wfym8zt
27l32z337JyaOH5yembf7qmpiTNlt8+/N000bv07E6dnjh2anz0+MzE3+/zMvm17d+3aXvppgMdP
HZkbnzx95sTkmbmZ05PNxzI+n1/c+N5Xdnuqae7fmj/PdhpqfhBf9qk7d6XPZ2145QtL3lVzk44P
EH0rfBbNP7zv1J7lfB1z/2iYSU3yPwAAANRBzP0rw0zkfwAAAKiMmPtXhZnI/wAAAFAZMfePhZnU
JP/r/+v/6//r/+v/F6+v/z+Y9P+70/8vof+v/6//r/9PT/Vb/z/m/tVZVsv8DwAAAHUQc/+aMBP5
HwAAACoj5v6rwkzkfwAAAKiMmPuvDjOpSf7X/9f/1//X/9f/L15f/38w6f93p/9fQv9f/1//X/+f
nuq3/n/M/deEmdQk/wMAAEAdxNx/bZiJ/A8AAACVEXP/dWEm8j8AAABURsz9a8NMapL/9f/1//X/
9f/1/4vX1/8fTPr/3fVj/7/1Na//r/8/yPuv/6//z8X6rf8fc//7wkxqkv8BAACgDmLuf3+YifwP
AAAAlRFz//VhJvI/AAAAVEbM/TeEmdQk/+v/6//r/+v/6/8Xr6//P5j0/7vrx/5/K/1//f9B3n/9
/+L+/0im/19n/db/j7n/A2EmNcn/AAAAUAcx998YZiL/AwAAQGXE3P9zYSbyPwAAAFRGzP3rwkxq
kv/1//X/9f/1//X/i9fX/x9M+v/d6f+X0P/X/9f/9///p6f6rf8fc/9NYSY1yf8AAABQBzH33xxm
Iv8DAABAZcTc//NhJvI/AAAAVEbM/evDTGqS//X/9f/1//X/9f+L19f/H0z6/93p/5fQ/9f/1//X
/6en+q3/H3P/LWEmNcn/AAAAUAcx998aZiL/AwAAQGXE3P/BMBP5HwAAACoj5v7xMJOa5H/9f/1/
/X/9f/3/4vX1/weT/n93+v8l9P/1//X/9f/pqX7r/8fcvyHMpCb5HwAAAOog5v6NYSbyPwAAAFRG
zP23hZnI/wAAAFAZMfdvCjOpSf7X/9f/1//X/9f/L15f/38w6f93p/9fQv9f/1//X/+fnuq3/n/M
/R8KM6lJ/gcAAIA6iLl/c5iJ/A8AAACVEXP/7WEm8j8AAABURsz9W8JMapL/9f/1//X/9f/1/4vX
1/8fTPr/3en/l9D/1//X/9f/p6f6rf8fc/8dYSY1yf8AAABQBzH3bw0zkf8BAACgMmLuvzPMRP4H
AACAyoi5fyLMpCb5X/9f/1//X/9f/794ff3/waT/353+fwn9f/1//X/9f3qq3/r/MfffFWZSk/wP
AAAAdRBz/91hJvI/AAAAVEbM/ZNhJvI/AAAAVEbM/VNhJjXJ//r/+v/6//r/+v/F6+v/Dyb9/+70
/0vo/+v/6//r/9NT/db/j7l/W5hJTfI/AAAA1EHM/dvDTOR/AAAAqIyY+3eEmcj/AAAAUBkx9+8M
M6lJ/tf/1//X/9f/1/8vXl//fzDp/3en/19C/1//X/9f/5+e6rf+f8z994SZ1CT/AwAAQB3E3L8r
zET+BwAAgMqIuX93mIn8DwAAAJURc/+eMJOa5H/9f/1//X/9f/3/4vX1/weT/n93+v8l9P/1//X/
9f/pqX7r/8fcvzfMpCb5HwAAAOog5v4Ph5nI/wAAAFAZMff/QpiJ/A8AAACVEXP/L4aZ1CT/6//r
/+v/vwf9/6GRwvND/1//X///vaf/353+fwn9f/1//X/9f3qq3/r/MffvCzOpSf4HAACAOoi5/5fC
TOR/AAAAqIyY++8NM5H/AQAAoDJi7t8fZlKT/K//r/+v/+///6//X7y+/v9g0v/vTv+/hP6//r/+
v/4/PdVv/f+Y+z8SZlKT/A8AAAB1EHP/fWEm8j8AAABURsz9Hw0zkf8BAACgMmLuvz/MpCb5X/9f
/1//X/9f/794ff3/waT/353+fwn9f/1//X/9f3pqVZ/1/2Pu/1iYSU3yPwAAANRBzP0PhJnI/wAA
AFAZMfd/PMxE/gcAAIDKiLn/wTCTmuR//X/9f/1//X/9/+L19f8Hk/5/d/r/JfT/9f/1//X/6al+
+///x9z/y2EmNcn/AAAAUAcx9z8UZiL/AwAAQGXE3P9wmIn8DwAAAJURc/8nwkxqkv/1//X/9f/1
//X/i9fX/x9M+v/d6f+X0P/X/9f/1/+np/qt/x9z/yfDTGqS/wEAAKAOYu7/lTAT+R8AAAAqI+b+
T4WZyP8AAABQGTH3/2qYSU3yv/6//r/+v/6//n/x+vr/g0n/vzv9/xL6//r/+v/6//RUv/X/Y+5/
JMykJvkfAAAA6iDm/kfDTOR/AAAAqIyY+x8LM5H/AQAAoDJi7n88zKQm+V//X/9f/1//X/+/eH39
/8Gk/9+d/n8J/X/9f/1//X96qt/6/zH3PxFmUpP8DwAAAHUQc/+nw0zkfwAAAKiMmPt/LcxE/gcA
AIDKiLn/M2EmNcn/+v/6//r/+v/6/8Xr6/8PJv3/7vT/S+j/6//r/+v/01P91v+Puf/JMJOa5H8A
AACog5j7fz3MRP4HAACAyoi5/zfCTOR/AAAAqIyY+38zzKQm+V//X/9f/1//X/+/eH39/8Gk/9+d
/n8J/X/9f/1//X96qt/6/zH3/1aYSU3yPwAAANRBzP1PhZnI/wAAAFAZMfcfCDOR/wEAAKAyYu4/
GGZSk/yv/6//r/+v/6//X7y+/v9g0v/vTv+/hP6//r/+v/4/PdVv/f+Y+w+FmdQk/wMAAEAdxNz/
22Em8j8AAABURsz9h8NM5H8AAACojJj7p8NMapL/69z/v7dlPyL9f/3//AL9f/1//f+Bpf/fnf5/
Cf1//X/9f/1/eqrf+v8x98+EmdQk/wMAAEAdxNx/JMxE/gcAAIDKiLn/aJiJ/A8AAACVEXP/02Em
Ncn/de7/+///6/9H+v/6/0Xr6/8PJv3/7vT/S+j/6//r/+v/01P91v+PuX82zKQm+R8AAADqIOb+
z4aZyP8AAABQGTH3fy7MRP4HAACAyoi5/1iYSU3yv/6//r/+v/6//n/x+vr/g0n/vzv9/xL6//r/
+v/6//RUv/X/Y+4/HmZSk/wPAAAAdRBz/4kwE/kfAAAAKiPm/pNhJvI/AAAAVEbM/afCTGqS//X/
9f/1//X/9f+L19f/H0z6/93p/5fQ/9f/1//X/6en+q3/H3P/M2EmNcn/AAAAUAcx958OM5H/AQAA
oDJi7p8LM5H/AQAAoDJi7p8PM6lJ/tf/1//X/9f/1/8vXl//fzDp/3en/19C/1//X/9f/5+e6rf+
f8z9Z8JMapL/AQAA/p+9u+bVJTvCMHrlwD/ZbF8zMzMzMzMzMzMz2zPBJFU1yZ5ujdSj2121VlI6
Op+04zd41DBB7v77xC32PwAAALSRu/++cYv9DwAAAG3k7r9f3DJk/+v/9f/6f/2//n/9vv7/mvT/
2/T/O/T/+n/9v/6fQ52t/8/df/+4Zcj+BwAAgAly9z8gbrH/AQAAoI3c/Q+MW+x/AAAAaCN3/4Pi
liH7X/+v/9f/6//1/+v39f/XpP/fpv/fof/X/+v/9f8c6mz9f+7+B8ctQ/Y/AAAATJC7/yFxi/0P
AAAAbeTuvxm32P8AAADQRu7+h8YtQ/a//l//r//X/+v/1+/r/69J/79N/79D/6//1//r/znU2fr/
3P0Pi1uG7H8AAACYIHf/w+MW+x8AAADayN3/iLjF/gcAAIA2cvc/Mm4Zsv/1//p//b/+X/+/fl//
f036/236/x36f/2//l//z6HO1v/n7n9U3DJk/wMAAMAEufsfHbfY/wAAANBG7v7HxC32PwAAALSR
u/+xccuQ/a//1//r//X/+v/1+/r/a9L/b9P/79D/6//1//p/DnW2/j93/+PiliH7HwAAACbI3f/4
uMX+BwAAgDZy9z8hbrH/AQAAoI3c/U+MW4bsf/2//l//r//X/6/f1/9fk/5/m/5/h/5f/6//1/9z
qLP1/7n7nxS3DNn/AAAAMEHu/ifHLfY/AAAAtJG7/ylxi/0PAAAAbeTuf2rcMmT/6//1//p//b/+
f/2+/v+a9P/b9P879P/6f/2//p9Dna3/z93/tLhlyP4HAACACXL3Pz1usf8BAACgjdz9z4hb7H8A
AABoI3f/M+OWIftf/6//1//r//X/6/f1/9ek/9+m/9+h/9f/6//1/xzqbP1/7v5nxS1D9j8AAABM
kLv/2XGL/Q8AAABt5O5/Ttxi/wMAAEAbufufG7cM2f/6f/2//l//r/9fv6//vyb9/zb9/w79v/5f
/6//51Bn6/9z9z8vbhmy/wEAAGCC3P3Pj1vsfwAAAGgjd/8L4hb7HwAAANrI3f/CuGXI/tf/6//1
//p//f/6ff3/Nen/t+n/d+j/9f/6f/0/hzpb/5+7/0Vxy5D9DwAAABPk7n9x3GL/AwAAQBu5+18S
t9j/AAAA0Ebu/pfGLUP2v/5f/6//1//r/9fv6/+vSf+/Tf+/Q/+v/9f/6/851Nn6/9z9L4tbhux/
AAAAmCB3/8vjFvsfAAAA2sjd/4q4xf4HAACANnL3vzJuGbL/9f/6f/2//l//v35f/39N+v9t+v8d
+n/9v/5f/8+hztb/5+5/VdwyZP8DAADABLn7Xx232P8AAADQRu7+18Qt9j8AAAC0kbv/tXHLkP2v
/9f/6//1//r/9fv6/2vS/2/T/+/Q/+v/9f/6fw51tv4/d//r4pYh+x8AAAAmyN3/+rjF/gcAAIA2
cve/IW6x/wEAAKCN3P1vjFuG7H/9v/5f/6//X/b/975x44b+X/9/Qfr/bfr/Hfp//b/+X//Poc7W
/+fuf1PcMmT/AwAAwAS5+98ct9j/AAAA0Ebu/rfELfY/AAAAtJG7/61xy5D9r//X/+v/9f++/79+
X/9/Tfr/bfr/Hfp//b/+X//Poc7W/+fuf1vcMmT/AwAAwAS5+98et9j/AAAA0Ebu/nfELfY/AAAA
tJG7/51xy5D9r//X/+v/9f/6//X7+v9r0v9v0//v0P/r//X/+n8Odbb+P3f/u+KWIfsfAAAAJsjd
/+64xf4HAACANnL3vydusf8BAACgjdz9741bhux//b/+X/+v/9f/r9/X/1+T/n+b/n+H/l//r//X
/3Oos/X/ufvfF7cM2f8AAAAwQe7+98ct9j8AAAC0kbv/A3GL/Q8AAABt5O7/YNwyZP/r//X/+n/9
v/5//b7+/5r0/9v0/zv0//p//b/+n0Odrf/P3f+huGXI/gcAAIAJcvd/OG6x/wEAAKCN3P0fiVvs
fwAAAGgjd/9H45Yh+1//r//X/+v/9f/r9/X/16T/36b/36H/1//r//X/HOqW9f831//P3f+xuGXI
/gcAAIAJcvd/PG6x/wEAAKCN3P2fiFvsfwAAAGgjd/8n45Yh+1//r//X/+v/9f/r9/X/16T/36b/
36H/1//r//X/HOqW9f938Xfu/k/FLUP2PwAAAEyQu//TcYv9DwAAAG3k7v9M3GL/AwAAQBu5+z8b
twzZ//p//b/+X/+v/1+/r/+/Jv3/Nv3/Dv2//l//r//nUGfr/3P3fy5uGbL/AQAAYILc/Z+PW+x/
AAAAaCN3/xfiFvsfAAAA2sjd/8W4Zcj+1//r//X/+n/9//p9/f816f+36f936P/1//p//T+HOlv/
n7v/S3HLkP0PAAAAE+Tu/3LcYv8DAABAG7n7vxK32P8AAADQRu7+r8YtQ/a//l//r//X/+v/1+/r
/69J/79N/79D/6//1//r/znU2fr/3P1fi1uG7H8AAACYIHf/1+MW+x8AAADayN3/jbjF/gcAAIA2
cvd/M24Zsv/1//r/e+n/9f/6/+X7+v9r0v9v0//v0P/r//X/+n8Odbb+P3f/t+KWIfsfAAAAJsjd
/+24xf4HAACANnL3fydusf8BAACgjdz9341bhux//b/+3/f/9f/6//X7+v9r0v9v0//v0P/r//X/
+n8Odbb+P3f/9+KWIfsfAAAAJsjd//24xf4HAACANnL3/yBusf8BAACgjdz9P4xbhux//b/+X/+v
/9f/r9/X/1+T/n+b/n+H/l//r//X/3Oos/X/uft/FLcM2f8AAAAwQe7+H8ct9j8AAAC0kbv/J3GL
/Q8AAABt5O7/adwyZP/r//X/+n/9v/5//b7+/5r0/9v0/zv0//p//b/+n0Odrf/P3f+zuGXI/gcA
AIAJcvf/PG6x/wEAAKCN3P2/iFvsfwAAAGgjd/8v45Yh+1//r//X/+v/9f/r9/X/16T/36b/36H/
1//r//X/HOps/X/u/l/FLUP2PwAAAEyQu//XcYv9DwAAAG3k7v9N3GL/AwAAQBu5+38btwzZ//p/
/b/+X/+v/1+/r/+/Jv3/Nv3/Dv2//l//r//nUGfr/3P3/y5uGbL/AQAAYILc/b+PW+x/AAAAaCN3
/x/iFvsfAAAA2sjd/8e4Zcj+1//r//X/+n/9//p9/f816f+36f936P/1//p//T+HOlv/n7v/T3HL
kP0PAAAAE+Tu/3PcYv8DAABAG7n7/xK32P8AAADQRu7+v8YtQ/a//l//r//X/+v/1+/r/69J/79N
/79D/6//1//r/znU2fr/3P1/i1uG7H8AAACYIHf/3+MW+x8AAADayN3/j7jF/gcAAIA2cvf/M24Z
sv/1//p//b/+X/+/fl//f036/236/x36f/2//l//z6HO1v/n7v9X3DJk/wMAAMAEufv/HbfY/wAA
ANBG7v7/xC32PwAAALSRu/+/ccuQ/a//1//r//X/+v/1+/r/a9L/b9P/79D/6//1//p/DnXP9P93
/uju9v+5+/8XtwzZ/wAAADBB7v7/xy32PwAAALSRu/+2uMX+BwAAgDZy998etwzZ//p//b/+X/+v
/1+/r/+/Jv3/Nv3/Dv2//l//r//nUGf7/n/u/jsCAAD//z28eig=
Reproducer source (jfs_race9.c):
/* jfs diRead UAF 复现 v9：直接 syscall + 并行多路
*
* v7/v8 已经跑通"新 ro 挂载 -> remount rw -> 卸载"的循环（每轮一个 bmap 释放窗口），
* 但 fork+exec /bin/mount 太慢（~115ms/轮）。这里改成直接 mount(2)/umount2()，
* 并把循环复制成 4 路并行，把窗口频率提高两个数量级。
*
* 每路：mount ro(全新 sb) -> 查找线程猛砸(冷 inode -> diRead) ->
* mount(NULL,mp,NULL,MS_REMOUNT,..) (ro->rw -> jfs_mount_rw(sb,1)
* -> dbUnmount/dbMount 释放活 sb 的 bmap)
* -> umount
*
* 用法: jfs_race9 <秒数> <loop设备> [路数]
*/
#define _GNU_SOURCE
#include <dirent.h>
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>
#define MAXP 8
static char DEV[128];
static char MP[MAXP][32];
static int NLANE = 4;
static volatile int stop = 0;
static volatile int lookup_on = 0;
static volatile int cur_lane = 0;
static volatile unsigned long cycles = 0;
static const char *MOPT = "uid=0,gid=0,errors=remount-ro,nodiscard";
/* 一路 = 一个挂载点的 ro->rw 循环 */
static void *th_lane(void *a)
{
int lane = (int)(long)a;
const char *mp = MP[lane];
while (!stop) {
if (mount(DEV, mp, "jfs", MS_RDONLY, MOPT) != 0)
{ umount2(mp, MNT_DETACH); continue; }
cur_lane = lane;
lookup_on = 1;
/* ro -> rw：MS_REMOUNT 且不带 MS_RDONLY */
mount(NULL, mp, NULL, MS_REMOUNT, "");
lookup_on = 0;
umount2(mp, MNT_DETACH);
__sync_fetch_and_add(&cycles, 1);
}
return NULL;
}
static void *th_lookup(void *a)
{
(void)a;
char buf[300];
while (!stop) {
if (!lookup_on) { usleep(20); continue; }
const char *mp = MP[cur_lane];
int dfd = open(mp, O_RDONLY | O_DIRECTORY);
if (dfd >= 0) {
DIR *dd = opendir(mp);
struct dirent *de;
if (dd) {
while ((de = readdir(dd))) {
if (de->d_name[0] == '.') continue;
int fd = openat(dfd, de->d_name, O_RDONLY);
if (fd >= 0) close(fd);
}
closedir(dd);
}
close(dfd);
}
struct stat st;
stat(mp, &st);
}
return NULL;
}
int main(int argc, char **argv)
{
int secs = argc > 1 ? atoi(argv[1]) : 600;
snprintf(DEV, sizeof(DEV), "%s", argc > 2 ? argv[2] : "/dev/loop0");
if (argc > 3) { NLANE = atoi(argv[3]); if (NLANE > MAXP) NLANE = MAXP; if (NLANE < 1) NLANE = 1; }
for (int i = 0; i < MAXP; i++) {
snprintf(MP[i], sizeof(MP[i]), "/tmp/m%d", i);
mkdir(MP[i], 0777);
}
pthread_t tl[MAXP], tk[8];
for (long i = 0; i < NLANE; i++)
pthread_create(&tl[i], NULL, th_lane, (void *)i);
for (int i = 0; i < 8; i++)
pthread_create(&tk[i], NULL, th_lookup, NULL);
fprintf(stderr, "v9 racing %d s, %d lanes on %s\n", secs, NLANE, DEV);
for (int i = 0; i < secs; i++) {
sleep(1);
if (i % 20 == 19)
fprintf(stderr, " %lu cycles\n", cycles);
}
stop = 1;
for (int i = 0; i < NLANE; i++) pthread_join(tl[i], NULL);
for (int i = 0; i < 8; i++) pthread_join(tk[i], NULL);
for (int i = 0; i < MAXP; i++) umount2(MP[i], MNT_DETACH);
fprintf(stderr, "done, %lu cycles total\n", cycles);
return 0;
}
Thanks,
1sh1ro