kernel-module-8188gu-6.6-desktop-6.6.148-1> )lp d321efc9aa79bb655924b271bc13e2d8c6bf4bfe30c30b96b3daa6d970e8a548aca55175d1ea9c9466d46c6e55ea0c7c70206edd9!km*_2ACH>Bi?Yd#+ - Y     9 <@EJpt~(89:G@HDIHXLY\\]^bcdefltuvwXx\y`p|Ckernel-module-8188gu-6.6-desktop6.6.1481Binary module 8188gu for kernel-6.6-desktopBinary module 8188gu for kernel-6.6-desktopjlocalhostCROSAROSAGPLv2System/Kernel and hardwarehttps://www.kernel.orglinuxx86_64Cj#58585073cff3ebde74e5220fb313742bc3b1fb69eb6dcfd427b60ecf7ffd09508rootrootkernel-6.6-desktop-6.6.148-1.src.rpminstallonlypkg(kernel-module)kernel-module-8188gu-6.6-desktopkernel-module-8188gu-6.6-desktop(x86-64)kmod(8188gu)    kernel-6.6-desktop(x86-64)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)6.6.148-13.0.4-14.6.0-14.0-15.2-14.17.0jtw@jgH@jL@jL@jj9j Pj Pj Pj Pi@iD@iii@h/Mikhail Novosyolov BiteDasher BiteDasher 6.6.144-1BiteDasher BiteDasher 6.6.126-8BiteDasher 6.6.126-7Mikhail Novosyolov 6.6.126-6Mikhail Novosyolov 6.6.126-5Mikhail Novosyolov Mikhail Novosyolov Mikhail Novosyolov 6.6.126-3Mikhail Novosyolov 6.6.126-2Mikhail Novosyolov 6.6.126-1Mikhail Novosyolov Mikhail Novosyolov 6.6.106-3Mikhail Novosyolov - [bot] upd: 6.6.145 -> 6.6.148 - Changelog: - accel/ivpu: Reject firmware log with size smaller than header - afs: Annotate struct afs_addr_list with __counted_by - afs: Turn the afs_addr_list address array into an array of structs - ALSA: hda: conexant: Remove mic bias threshold override - ALSA: hda: Fix cached processing coefficient verbs - ALSA: seq: close a re-opened queue timer in the destructor - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: cs35l56: Don't use devres to unregister component - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: tas2781: bound firmware description string parsing - ata: libata-core: Reject an invalid concurrent positioning ranges count - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: use platform_get_irq() - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - binfmt_elf_fdpic: only honour the first PT_INTERP - binfmt_misc: set have_execfd only once the interpreter is opened - Bluetooth: btusb: validate Realtek vendor event length - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: hci_sync: Protect UUID list traversal - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: qca: fix NVM tag length underflow in TLV parser - Bluetooth: RFCOMM: Fix session UAF in set_termios - bonding: fix devconf_all NULL dereference when IPv6 is disabled - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bpf: drop bpf_lsm_getselfattr from hook list - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: free mapping node on duplicate reloc root insert - btrfs: reject free space cache with more entries than pages - can: bcm: add locking when updating filter and timer values - can: bcm: add missing device refcount for CAN filter removal - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: isotp: serialize TX state transitions under so->rx_lock - can: j1939: fix lockless local-destination check - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - comedi: comedi_parport: deal with premature interrupt - coredump: fix pidfs file refcount leak in umh_coredump_setup - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - dm-verity: avoid double increment of &use_bh_wq_enabled - dm-verity: make error counter atomic - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amd/display: set new_stream to NULL after release - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amd/pm: make pp_features read-only when scpm is enabled - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gt: use correct selftest config symbol - drm/i915: Return NULL on error in active_instance - drm/i915/selftests: Fix GT PM sort comparators - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/nouveau: fix reversed error cleanup order in ucopy functions - drm/radeon: fix r100_copy_blit for large BOs - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - drm/vc4: Prevent shader BO mappings from becoming writable - drm/virtio: bound EDID block reads to the response buffer - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - drm/vmwgfx: Validate vmw_surface_metadata::array_size - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - exfat: validate cluster allocation bits of the allocation bitmap - fbcon: Rename struct fbcon_ops to struct fbcon_par - fbcon: Use correct type for vc_resize() return value - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - firewire: net: Fix fragmented datagram reassembly - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - firmware_loader: introduce __free() cleanup hanler - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list - ftrace: Add global mutex to serialize trace_parser access - geneve: require CAP_NET_ADMIN in the device netns for changelink - gpio: mt7621: avoid corruption of shared interrupt trigger state - gpio: tegra: do not call pinctrl for GPIO direction - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - hinic: remove unused ethtool RSS user configuration buffers - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: occ: validate poll response sensor blocks - i2c: davinci: Unregister cpufreq notifier on probe failure - i2c: i801: fix hardware state machine corruption in error path - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - i40e: remove read access to debugfs files - IB/mad: Drop unmatched RMPP responses before reassembly - ice: fix LAG recipe to profile association - ice: use READ_ONCE() to access cached PHC time - ila: reload IPv6 header after pskb_may_pull in checksum adjust - Input: ims-pcu - fix firmware leak in async update - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - Input: ims-pcu - fix logic error in packet reset - intel_th: fix MSC output device reference leak - iomap: correct the range of a partial dirty clear - iommu/amd: Bound the early ACPI HID map - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/vt-d: Disallow SVA if page walk is not coherent - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - ipmi: fix refcount leak in i_ipmi_request() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - ipv6: ndisc: fix NULL deref in accept_untracked_na() - ksmbd: bound DACL dedup walk to copied ACEs - ksmbd: defer destroy_previous_session() until after NTLM authentication - ksmbd: pin conn during async oplock break notification - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate ACE size against SID sub-authorities - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - KVM: Introduce vcpu->wants_to_run - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - KVM: x86/mmu: Fix use-after-free on vendor module reload - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN - libceph: bound get_version reply decode to front len - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: guard missing CRUSH type name lookup - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: Reject monmaps advertising zero monitors - libceph: reject zero bucket types in crush_decode - libceph: remove debugfs files before client teardown - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - LoongArch: Fix oops during single-step debugging - lsm: infrastructure management of the sock security - mac802154: hold an interface reference across the scan worker - mac802154: llsec: reject frames shorter than the authentication tag - mctp: serial: handle zero-length frames to prevent rx buffer overflow - media: airspy: Return queued buffers on start_streaming() failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: cedrus: clean up media device on probe failure - media: cedrus: Fix missing cleanup in error path - media: cedrus: skip invalid H.264 reference list entries - media: cx231xx: fix devres lifetime - media: cx23885: add ioremap return check and cleanup - media: marvell-cam: fix missing pci_disable_device() on remove - media: meson: vdec: Fix memory leak in error path of vdec_open - media: msi2500: Return queued buffers on start_streaming() failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: pci: dm1105: Free allocated workqueue - media: pwc: Drain fill_buf on start_streaming() failure - media: pwc: Return queued buffers on start_streaming() failure - media: radio-si476x: Unregister v4l2_device on probe failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: stm32: dcmi: unregister notifier on probe failure - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: ti: vpe: unwind v4l2 device registration on probe error - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: v4l2-ctrls: validate HEVC active reference counts - media: vb2: use ssize_t for vb2_read/vb2_write - media: vidtv: fix reference leak on failed device registration - media: vimc: fix reference leak on failed device registration - media: vivid: add vivid_update_reduced_fps() - media: vivid: check for vb2_is_busy() when toggling caps - media: vpif_capture: fix OF node reference imbalance - mei: bus: access mei_device under device_lock on cleanup - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - mm: refactor mm_access() to not return NULL - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - mptcp: decrement subflows counter on failed passive join - mptcp: only set DATA_FIN when a mapping is present - mtd: fix double free and WARN_ON in add_mtd_device() error paths - mtd: mtdswap: remove debugfs stats file on teardown - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: rawnand: Add a helper for calculating a page index - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Pause continuous reads at block boundaries - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - net: bridge: vlan: fix vlan range dumps starting with pvid - net: dpaa: fix mode setting - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - net: hip04: fix RX buffer leak on build_skb failure - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: ipa: fix SMEM state handle leaks in SMP2P init - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/iucv: fix use-after-free of a severed iucv_path - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - net: macb: drop in-flight Tx SKBs on close - net: mana: Validate the packet length reported by the NIC - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net/packet: avoid fanout hook re-registration after unregister - net: pcs: xpcs: fix SGMII state reading - net: qrtr: ns: Raise node count limit to 512 - net: qrtr: restrict socket creation to the initial network namespace - net/sched: act_tunnel_key: Defer dst_release to RCU callback - net: slip: serialize receive against buffer reallocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - net: stmmac: reset residual action in L3L4 filters on delete - net/x25: fix use-after-free in x25_kill_by_neigh() - nexthop: initialize extack in nh_res_bucket_migrate() - nfp: Check resource mutex allocation - NFS: Charge unstable writes by request size, not folio size - NFSD: pass nfsd_file to nfsd_iter_read() - nfs: remove dead code for the old swap over NFS implementation - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: fix SQB pointer leak on init failure - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-vf: set TC flower flag on MCAM entry allocation - openvswitch: fix GSO userspace truncation underflow - ovl: use linked upper dentry in copy-up tmpfile - pds_core: check for workqueue allocation failure - pds_core: fix auxiliary device add/del races - pds_core: order completion reads after the ownership check - pds_core: reject component parameter in legacy firmware update - pds_core: yield the CPU while waiting for the adminq to drain - phonet: pep: fix use-after-free in pep_get_sb() - pinctrl: remove pinctrl_gpio_direction_output() - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values - platform/x86/amd/pmc: Don't log during intermediate wakeups - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - powerpc/time: Prepare to stop elapsing in dynticks-idle - powerpc/vtime: Initialize starttime at boot for native accounting - ppp: annotate data races in ppp_generic - ppp: convert to percpu netstats - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - ppp: enable TX scatter-gather - pppoe: reload header pointer after dev_hard_header() - ppp: use IFF_NO_QUEUE in virtual interfaces - proc: Fix broken error paths for namespace links - rbd: Reset positive result codes to zero in object map update path - RDMA/cma: Fix hardware address comparison length in netevent callback - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/irdma: Prevent overflows in memory contiguity checks - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/siw: publish QP after initialization - RDMA/umem: Add helpers for umem dmabuf revoke lock - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add pinned revocable dmabuf import interface - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/umem: Introduce an option to revoke DMABUF umem - RDMA/umem: Move umem dmabuf revoke logic into helper function - rds: drop incoming messages that cross network namespace boundaries - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - RISC-V: KVM: Serialize virtual interrupt pending state updates - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Fix socket notification race - rxrpc: Pull out certain app callback funcs into an ops table - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Use irq-disabling spinlocks between app and I/O thread - sched/vtime: Get rid of generic vtime_task_switch() implementation - sctp: auth: verify auth requirement when auth_chunk is NULL - sctp: don't free the ASCONF's own transport in DEL-IP processing - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - sctp: fix auth_hmacs array size in struct sctp_cookie - sctp: validate stream count in sctp_process_strreset_inreq() - selftest: af_unix: Add Kconfig file. - selftests: af_unix: add USER_NS config - selftests/alsa: Fix memory leak in find_controls error path - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - selftests: openvswitch: add config file - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - seqlock: Allow KASAN to fail optimizing - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: sc16is7xx: implement gpio get_direction() callback - smb/client: handle overlapping allocated ranges in fallocate - smb: client: validate DFS referral PathConsumed - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - tipc: fix infinite loop in __tipc_nl_compat_dumpit - tipc: fix u16 MTU truncation in media and bearer MTU validation - tipc: restrict socket queue dumps in enqueue tracepoints - tls: device: push pending open record on splice EOF - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - udmabuf: Do not create malformed scatterlists - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - USB: serial: ftdi_sio: add support for E+H FXA291 - USB: serial: io_edgeport: cap received transmit credits - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: option: add TDTECH MT5710-CN - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - VDUSE: avoid leaking information to userspace - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - VFS/audit: introduce kern_path_parent() for audit - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - vxlan: mdb: Fix source list corruption on a failed replace - vxlan: require CAP_NET_ADMIN in the device netns for changelink - wan: wanxl: Only reset hardware after BAR mapping - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath6kl: fix OOB access from firmware ADDBA window size - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: cfg80211: cancel sched scan results work on unregister - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: mac80211: recalculate TIM when a station enters power save - wifi: mac80211: tear down new links on vif update error path - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7915: guard HE capability lookups - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mwifiex: bound uAP association event IEs to the event buffer - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: nl80211: validate nested MBSSID IE blobs - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: wilc1000: validate assoc response length before subtracting header - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - x86/boot/compressed: Disable jump tables - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xprtrdma: Clear receive-side ownership pointers on release - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- [bot] upd: 6.6.144 -> 6.6.145 - Changelog: - 6lowpan: fix NHC entry use-after-free on error path - 9p: skip nlink update in cacheless mode to fix WARN_ON - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: IPMI: Fix message kref handling on dead device - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: resource: Amend kernel-doc style - afs: Fix callback service message parsers to pass through -EAGAIN - afs: Fix error code in afs_extract_vl_addrs() - afs: Fix further netns teardown to cancel the preallocation charger - afs: Fix netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix unchecked-length string display in debug statement - afs: Fix vllist leak - afs: use kvfree() to free memory allocated by kvcalloc() - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - ALSA: aoa: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - ALSA: es1938: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: gus: check snd_ctl_new1() return value - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: seq: Clear variable event pointer on read - ALSA: seq: Fix partial userptr event expansion - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: seq: midi: Serialize output teardown with event_input - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: virtio: Add missing 384 kHz PCM rate mapping - ALSA: ymfpci: check snd_ctl_new1() return value - amt: fix size calculation in amt_get_size() - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: advertise the tcp fast open fix is applied - apparmor: check label build before no_new_privs test - apparmor: fix label can not be immediately before a declaration - apparmor: fix potential UAF in aa_replace_profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: put secmark label after secid lookup - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - arm64: dts: qcom: sm8450: Fix ICE reg size - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - arm64: Fix early handling of FEAT_E2H0 not being implemented - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - arm64/mm: convert ptep_clear() to ptep_get_and_clear() - arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) - arm64/mm: convert set_pte_at() to set_ptes(..., 1) - arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() - arm64: Revamp HCR_EL2.E2H RES1 detection - arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 - arm64: sysreg: Correct sign definitions for EIESB and DoubleLock - arm64: tegra: Fix Tegra234 MGBE PTP clock - arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - ARM: imx31: Fix IIM mapping leak in revision check - ARM: imx3: Fix CCM node reference leak - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - ASoC: codecs: aw88261: fix incorrect masks for boost regs - ASoC: codecs: hdac_hdmi: Validate written enum value - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - ata: libata: Fix ata_exec_internal() - ata: pata_pxa: Fix DMA channel leak on probe error - ata: sata_gemini: unwind clocks on IDE pinctrl errors - audit: add audit_log_nf_skb helper function - audit: Fix data races of skb_queue_len() readers on audit_queue - audit: fix potential integer overflow in audit_log_n_hex() - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: dat: fix tie-break for candidate selection - batman-adv: ensure minimal ethernet header on TX - batman-adv: fix VLAN priority offset - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: gw: acquire ethernet header only after skb realloc - batman-adv: retrieve ethhdr after potential skb realloc on RX - batman-adv: tt: avoid request storms during pending request - batman-adv: tt: prevent TVLV OOB check overflow - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - bitops: make BYTES_TO_BITS() treewide-available - bitops: use common function parameter names - block: Avoid mounting the bdev pseudo-filesystem in userspace - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - Bluetooth: btmtk: Fix btmtk.c undefined reference build error - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices. - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown - Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c - Bluetooth: btmtk: remove #ifdef around declarations - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: btrtl: validate firmware patch bounds - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - Bluetooth: hci_sync: annotate data-races around hdev->req_status - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci: validate codec capability element length - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: separate CIS_LINK and BIS_LINK link types - Bluetooth: vhci: validate devcoredump state before side effects - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - bonding: 3ad: fix mux port state on oper down - bonding: add ESP offload features when slaves support - bonding: Correctly support GSO ESP offload - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - bonding: fix type confusion in bond_setup_by_slave() - bonding: fix xfrm offload feature setup on active-backup mode - bonding: prevent potential infinite loop in bond_header_parse() - bonding: use common function to compute the features - bpf: Add missing access_ok call to copy_user_syms - bpf: Allow LPM map access from sleepable BPF programs - bpf, arm64: Reject out-of-range B.cond targets - bpf: Check tail zero of bpf_prog_info - bpf: Consistently use bpf_rcu_lock_held() everywhere - bpf: Disable xfrm_decode_session hook attachment - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - bpf: Fix effective prog array index with BPF_F_PREORDER - bpf: Fix stack slot index in nospec checks - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - bpf,fork: wipe ->bpf_storage before bailouts that access it - bpf, lsm: Add disabled BPF LSM hook list - bpf: Prefer dirty packs for eBPF allocations - bpf: Prefer packs that won't trigger an IBPB flush on allocation - bpf: Reject fragmented frames in devmap - bpf: Restore sysctl new-value from 1 to 0 - bpf: Restrict JIT predictor flush to cBPF - bpf: Run generic devmap egress prog on private skb - bpf: Skip redundant IBPB in pack allocator - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Support for hardening against JIT spraying - bpf: Tighten cgroup storage cookie checks for prog arrays - bpftool: Use libbpf error code for flow dissector query - bpf: Update transport_header when encapsulating UDP tunnel in lwt - bpf: zero-initialize the fib lookup flow struct - bridge: cfm: reject invalid CCM interval at configuration time - bridge: stp: Fix a potential use-after-free when deleting a bridge - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - btrfs: do not trim a device which is not writeable - btrfs: fix false IO failure after falling back to buffered write - btrfs: fix incorrect buffered IO fallback for append direct writes - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - btrfs: zoned: don't account data relocation space-info in statfs free space - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - bus: sunxi-rsb: Always check register address validity - can: bcm: add missing rcu list annotations and operations - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: esd_usb: kill anchored URBs before freeing netdevs - can: isotp: use unconditional synchronize_rcu() in isotp_release() - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - char: tlclk: fix use-after-free in tlclk_cleanup() - cifs: invalidate cfid on unlink/rename/rmdir - cifs: remove all cifs files before kill super - cifs: validate DFS referral string offsets - clk: at91: keep securam node alive while mapping it - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - clk: scmi: Fix clock rate rounding - clk: scpi: Unregister child clock providers on remove - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - configfs: fix lockless traversals of ->s_children - configfs_lookup(): don't leave ->s_dentry dangling on failure - coresight: cti: Fix DT filter signals silently ignored - coresight: etb10: restore atomic_t for shared reading state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Documentation: fix conservative governor freq_step description - cpufreq: Documentation: fix sampling_down_factor range - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - crypto: af_alg - Remove zero-copy support from skcipher and aead - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: ccp - Treat zero-length cert chain as query for blob lengths - crypto: crypto4xx - Remove ahash-related code - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: drbg - Fix the fips_enabled priority boost - crypto: ecc - Fix carry overflow in vli multiplication - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: hisilicon/qm - disable error report before flr - crypto: hisi-trng - Remove crypto_rng interface - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - crypto: pcrypt - restore callback for non-parallel fallback - crypto: qat - fix restarting state leak on allocation failure - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - crypto: qat - validate RSA CRT component lengths - crypto: rng - Free default RNG on module exit - crypto: sun4i-ss - Remove insecure and unused rng_alg - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - stop using crypto_ahash::init - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - cxgb4: Fix decode strings dump for T6 adapters - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - cxl/test: Fix integer overflow in mock LSA bounds checks - cxl/test: Zero out LSA backing memory to avoid leaking to user - dax/kmem: account for partial discontiguous resource upon removal - debugobjects: Plug race against a concurrent OOM disable - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - devlink: Fix parent ref leak in devl_rate_node_create() - dlm: fix add msg handle in send_queue ordered - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: Fix possible use after free - dmaengine: imx-sdma: Refine spba bus searching in probe - dmaengine: qcom: gpi: set DMA_PRIVATE capability - dmaengine: tegra: Fix burst size calculation - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm_early_create: fix freeing used table on dm_resume failure - dm era: fix NULL pointer dereference in metadata_open() - dm era: fix out-of-bounds memory access for non-zero start sector - dm-integrity: don't increment hash_offset twice - dm-ioctl: fix a possible overflow in list_version_get_info - dm-ioctl: report an error if a device has no table - dm-log: fix a bitset_size overflow on 32bit machines - dm-stats: fix dm_jiffies_to_msec64 - dm-stats: fix merge accounting - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - dm-verity: fix a possible NULL pointer dereference - dm-verity: increase sprintf buffer size - Documentation: proc: fix section numbering in table of contents - dpaa2-switch: fix VLAN upper check not rejecting bridge join - drbd: reject data replies with an out-of-range payload size - driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() - driver core: Guard deferred probe timeout extension with delayed_work_pending() - driver core: Use mod_delayed_work to prevent lost deferred probe work - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amd/display: Add missing kdoc for ALLM parameters - drm/amd: Fix set but not used warnings - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/amdgpu: initialize irq.lock spinlock earlier - drm/amdgpu: set sub_block_index for mca ras sub-blocks - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - drm/edid: fix OOB read in drm_parse_tiled_block() - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/msm/dp: fix HPD state status bit shift value - drm/msm/dp: Fix the ISR_* enum values - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - drm/tegra: Fix iommu_map_sgtable() return value check - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - drm/tidss: Drop extra drm_mode_config_reset() call - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - dt-bindings: power: imx93: Add MIPI PHY power domain - EDAC/i10nm: Don't fail probing if ADXL is missing - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - espintcp: use sk_msg_free_partial to fix partial send - evm: terminate and bound the evm_xattrs read buffer - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: bound uniname advance in exfat_find_dir_entry() - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: move free cluster out of exfat_init_ext_entry() - exfat: preserve benign secondary entries during rename and move - exfat: remove unnecessary read entry in __exfat_rename() - exfat: rename argument name for exfat_move_file and exfat_rename_file - ext2: fix ignored return value of generic_write_sync() - ext4: fix kernel BUG in ext4_write_inline_data_end - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - ext4: get rid of ppath in get_ext_path() - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: validate orphan inode entry count - fbcon: fix NULL pointer dereference for a console without vc_data - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: sm501fb: Fix buffer errors in OF binding code - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - firmware: arm_scmi: Read sensor config as 32-bit value - firmware_loader: fix device reference leak in firmware_upload_register() - firmware_loader: Fix recursive lock in device_cache_fw_images() - flow_dissector: check device type before reading ETH_ADDRS - fpga: dfl: add bounds check in dfh_get_param_size() - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - fs: efs: remove unneeded debug prints - fsl/fman: Free init resources on KeyGen failure in fman_init() - fs/ntfs3: add bounds check to run_get_highest_vcn() - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - fs/ntfs3: fsync files by syncing parent inodes - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - fuse: fix device node leak in cuse_process_init_reply() - fuse: re-lock request before returning from fuse_ref_folio() - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - gpio-f7188x: Add support for NCT6126D version B - gpio: htc-egpio: use managed gpiochip registration - gpio: mlxbf3: fail probe if gpiochip registration fails - gpio: mvebu: fail probe if gpiochip registration fails - gpio: sch: use raw_spinlock_t in the irq startup path - gpios: palmas: add .get_direction() op - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - gpu: host1x: Allow entries in BO caches to be freed - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - gpu: host1x: Fix iommu_map_sgtable() return value check - gue: validate REMCSUM private option length - handshake: Require admin permission for DONE command - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: add haptics page defines - HID: appleir: fix UAF on pending key_up_timer in remove() - HID: core: Fix OOB read in hid_get_report for numbered reports - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - HID: playstation: validate num_touch_reports in DualShock 4 reports - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: wacom: stop hardware after post-start probe failures - HID: wiimote: Fix table layout and whitespace errors - hwmon: adm1275: Prevent reading uninitialized stack - hwmon: (asus_atk0110) Check package count before accessing element - hwmon: (it87) Clamp negative values to zero in set_fan() - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - hwmon: (occ) unregister sysfs devices outside occ lock - hwmon: (pmbus) Fix passing events to regulator core - hwmon: (w83627hf) remove VID sysfs files on error and remove - hwmon: (w83793) remove vrm sysfs file on probe failure - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - hwrng: virtio: clamp device-reported used.len at copy_data() - hwspinlock: qcom: avoid uninitialized struct members - i2c: core: fix adapter debugfs creation - i2c: core: fix adapter deregistration race - i2c: core: fix adapter registration race - i2c: core: fix hang on adapter registration failure - i2c: core: fix irq domain leak on adapter registration failure - i2c: core: fix NULL-deref on adapter registration failure - i2c: mediatek: fix WRRD for SoCs without auto_restart option - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mpc: Fix timeout calculations - i2c: stm32f7: truncate clock period instead of rounding it - i3c: master: Prevent reuse of dynamic address on device add failure - i40e: Fix i40e_debug() to use struct i40e_hw argument - ia64: Make acpi_cpufreq_cpu_exit return void - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - IB/mlx4: Fix refcount leak in add_port() error path - IB/mlx5: Don't take the rereg_mr fallback without a new translation - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - IB/mlx5: Properly support implicit ODP rereg_mr - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - ice: fix ice_init_link() error return preventing probe - ieee802154: admin-gate legacy LLSEC dump operations - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - iio: accel: bmc150: clamp the device-reported FIFO frame count - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: event: Fix event FIFO reset race - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: light: al3010: fix incorrect scale for the highest gain range - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: opt3001: fix missing state reset on timeout - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: veml6030: fix channel type when pushing events - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: pressure: mpl115: fix runtime PM leak on read error - iio: tcs3472: power down chip on probe failure - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: goodix - clamp the device-reported contact count - Input: iforce - bound the device-reported force-feedback effect index - Input: ims-pcu - add response length checks - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix use-after-free and double-free in disconnect - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - validate control endpoint type - Input: maplecontrol - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: maplemouse - fix NULL pointer dereference in open() - Input: maplemouse - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: mms114 - reject an oversized device packet size - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - Input: touchwin - reset the packet index on every complete packet - iommu/amd: Fix a stale comment about which legacy mode is user visible - ionic: Fix check in ionic_get_link_ext_stats - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - ipv4: fib: Don't ignore error route in local/main tables. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - ipv4: igmp: remove multicast group from hash table on device destruction - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - ipv6: fix error handling in disable_ipv6 sysctl - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix more places with wrong ipv6 transport offsets - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: pass parsed transport offset to state handlers - ipvs: reload ip header after head reallocation - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - ipvs: use parsed transport offset in TCP state lookup - irqchip/crossbar: Fix parent domain resource leak - irqchip/crossbar: Use correct index in crossbar_domain_free() - irqchip/gic-v3-its: Fix OF node reference leak - irqchip/ts4800: Fix missing chained handler cleanup on remove - isofs: bound Rock Ridge symlink components to the SL record - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - kcm: use WRITE_ONCE() when changing lower socket callbacks - kconfig: fix potential NULL pointer dereference in conf_askvalue - KEYS: Use acquire when reading state in keyring search - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - ksmbd: fix integer overflow in set_file_allocation_info() - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: fix use-after-free in same_client_has_lease() - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - ksmbd: reject undersized DACLs before parsing ACEs - ksmbd: require source read access for duplicate extents - ksmbd: run set info with opener credentials - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: track the connection owning a byte-range lock - ksmbd: use opener credentials for delete-on-close - ksmbd: use opener credentials for FSCTL mutations - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - KVM: arm64: Initialize HCR_EL2.E2H early - KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - leds: uleds: Fix potential buffer overread - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - libbpf: Report error when a negative kprobe offset is specified - lib/test_meminit: use && for bools - llc: fix SAP refcount leak in llc_ui_autobind() - llc: fix SAP refcount leak when creating incoming sockets - lockd: Plug nlm_file leak when nlm_do_fopen() fails - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - LoongArch: Add PIO for early access before ACPI PCI root register - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - mac802154: remove interfaces with RCU list deletion - macsec: don't read an unset MAC header in macsec_encrypt() - macsec: fix promiscuity refcount leak in macsec_dev_open() - mailbox: mtk-adsp: fix UAF during device teardown - md/raid10: reset read_slot when reusing r10bio for discard - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - media: cedrus: Fix failure to clean up hardware on probe failure - media: mtk-jpeg: cancel workqueue on release for supported platforms only - media: nxp: imx8-isi: Convert to platform remove callback returning void - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: qcom: venus: drop extra padding in NV12 raw size calculation - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: relax encoder frame/blur step size on v6 - media: rockchip: rga: fix too small buffer size - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - media: uvcvideo: Avoid partial metadata buffers - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Fix sequence number when no EOF - media: v4l2-common: Add YUV24 format info - memstick: ms_block: reject a card that reports too many blocks - mfd: cros_ec: Delay dev_set_drvdata() until probe success - mfd: cs42l43: Sanity check firmware size - mfd: sm501: Fix reference leak on failed device registration - mfd: tps6586x: Fix OF node refcount - minix: avoid overflow in bitmap block count calculation - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: DEC: Ensure RTC platform device deregistration upon failure - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix gio device memory leak - MIPS: ip22-gio: fix kfree() of static object - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mmc: vub300: defer reset until cmd_mutex is unlocked - mm/damon/core: make charge_addr_from aware of end-address exclusivity - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm: do file ownership checks with the proper mount idmap - mm/fake-numa: fix under-allocation detection in uniform split - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - mm: shrinker: fix NULL pointer dereference in debugfs - mm: shrinker: remove redundant shrinker_rwsem in debugfs operations - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - mm/vmscan: flush deferred TLB before freeing large folios - module: decompress: check return value of module_extend_max_pages() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - mtd: rawnand: fix condition in 'nand_select_target()' - mtd: rawnand: fsl_ifc: return errors for failed page reads - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: pl353: fix probe resource allocation - mtd: slram: remove failed entries from the device list - mtd: spi-nor: Drop duplicate Kconfig dependency - mtd: spi-nor: swp: Improve locking user experience - net/9p: fix infinite loop in p9_client_rpc on fatal signal - net/9p: fix race condition on rdma->state in trans_rdma.c - net: add a common function to compute features for upper devices - net: af_key: initialize alg_key_len for IPComp states - net: atm: reject out-of-range traffic classes in QoS validation - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net, bpf: check master for NULL in xdp_master_redirect() - net: Drop the lock in skb_may_tx_timestamp() - net: dsa: sja1105: round up PTP perout pin duration - net: ena: clean up XDP TX queues when regular TX setup fails - net: enetc: check the number of BDs needed for xdp_frame - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: conntrack: revert ct extension genid infrastructure - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump - netfilter: ebtables: module names must be null-terminated - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: Use vmalloc_array() to improve code - netfilter: ebtables: zero chainstack array - netfilter: ecache: fix inverted time_after() check - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: Fix data race between add and dump in all hash types - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: fix race between dump and ip_set_list resize - netfilter: nf_conncount: callers must hold rcu read lock - netfilter: nf_conncount: fix zone comparison in tuple dedup - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: xt_connmark: reject invalid shift parameters - netfilter: xt_nat: reject unsupported target families - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - net: gianfar: dispose irq mappings on probe failure and device removal - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: lan743x: Initialize eth_syslock spinlock before use - net: liquidio: fix BAR resource leak on PF number failure - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net: marvell: prestera: initialize err in prestera_port_sfp_bind - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5: Check max_macs devlink param value against max capability - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - net/mlx5: Fix L3 tunnel entropy refcount leak - net: mvneta: re-enable percpu interrupt on resume - net: openvswitch: reject oversized nested action attrs - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - net: psample: fix info leak in PSAMPLE_ATTR_DATA - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net/sched: cake: reject overhead values that underflow length - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - net/sched: cls_flow: Dont expose folded kernel pointers - net/sched: hhf: clear heavy-hitter state on reset - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_drr: annotate data-races around cl->deficit - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - net/sched: sch_hfsc: Don't make class passive twice - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - net: sit: require CAP_NET_ADMIN in the device netns for changelink - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net: sparx5: unregister blocking notifier on init failure - net: sungem: fix probe error cleanup - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - net: thunderbolt: Fix frags[] overflow by bounding frame_count - net/tls: Consume empty data records in tls_sw_read_sock() - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - net: wwan: iosm: bound device offsets in the MUX downlink decoder - net: wwan: t7xx: check skb_clone in control TX - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: Don't reset the write verifier on a commit EAGAIN - nfsd: move name lookup out of nfsd4_list_rec_dir() - nfsd: release layout stid on setlease failure - nfsd: reset write verifier on deferred writeback errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - NFSv4/flexfiles: reject zero filehandle version count - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - NFSv4/pnfs: defer return_range callbacks until after inode unlock - nilfs2: fix backing_dev_info reference leak - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - NTB: epf: Make db_valid_mask cover only real doorbell bits - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - nvdimm/btt: Free arenas on btt_init() error paths - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Handle preemption in BTT lane acquisition - nvme-multipath: fix flex array size in struct nvme_ns_head - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - nvmet-auth: validate reply message payload bounds against transfer length - nvmet-rdma: handle inline data with a nonzero offset - nvmet: remove superfluous initialization - nvmet: return DHCHAP status codes from nvmet_setup_auth() - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - nvmet-tcp: Fix potential UAF when ddgst mismatch - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: avoid moving extents to occupied clusters - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: don't BUG_ON an invalid journal dinode - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2: kill osb->system_file_mutex lock - ocfs2: rebase copied fsdlm LVB pointers in locking_state - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: use kzalloc for quota recovery bitmap allocation - octeontx2-af: fix VF bringup affecting PF promiscuous state - octeontx2-af: mcs: Fix unsupported secy stats read - octeontx2-pf: check DMAC extraction support before filtering - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - of: cpu: add check in __of_find_n_match_cpu_property() - OPP: of: Fix potential memory leak in opp_parse_supplies() - orangefs: keep the readdir entry size 64-bit in fill_from_part() - partitions: aix: bound the pp_count scan to the ppe array - PCI: Add kerneldoc for pci_resize_resource() - PCI: altera: Do not dispose parent IRQ mapping - PCI: altera: Fix resource leaks on probe failure - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining - PCI/ASPM: Don't reconfigure ASPM entering low-power state - PCI: Check ROM header and data structure addr before accessing - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - PCI: Fix restoring BARs on BAR resize rollback path - PCI: Free saved list without holding pci_bus_sem - PCI: host-common: Request bus reassignment when not probe-only - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - PCI: Introduce named defines for PCI ROM - PCI: iproc: Restore .map_irq() for the platform bus driver - PCI: loongson: Do not ignore downstream devices on external bridges - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: Move Resizable BAR code to rebar.c - PCI: Prevent resource tree corruption when BAR resize fails - PCI: rcar-host: Remove unused LIST_HEAD(res) - PCI: Skip Resizable BAR restore on read error - perf/core: Detach event groups during remove_on_exec - perf: Fix dangling cgroup pointer in cpuctx backport - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - perf trace beauty fcntl: Fix build with older kernel headers - perf/x86/amd/brs: Fix kernel address leakage - perf/x86/amd/core: Always use the NMI latency mitigation - perf/x86/amd/lbr: Fix kernel address leakage - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - phy: phy-can-transceiver: Check driver match and driver data against NULL - pinctrl: cs42l43: Fix polarity on debounce - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: meson: restore non-sleeping GPIO access - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - platform/x86/amd/pmc: Add delay_suspend module parameter - platform/x86/amd/pmc: Check for intermediate wakeup in function - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - pmdomain: imx: Fix i.MX8MP power notifier - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - PM: sleep: Use complete() in device_pm_sleep_init() - pNFS/filelayout: fix cheking if a layout is striped - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - powerpc/pseries: fix memory leak on krealloc failure in papr_init - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - power: supply: charger-manager: fix refcount leak in is_full_charged() - power: supply: core: fix supplied_from allocations - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - proc: only bump parent nlink when registering directories - proc: protect ptrace_may_access() with exec_update_lock (FD links) - proc: protect ptrace_may_access() with exec_update_lock (part 1) - proc: rename proc_setattr to proc_nochmod_setattr - pwm: imx27: Fix variable truncation in .apply() - qede: fix off-by-one in BD ring consumption on build_skb failure - qede: fix out-of-bounds check for cqe->len_list[] - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - RDMA/hns: Fix warning in poll cq direct mode - RDMA/irdma: Fix OOB read during CQ MR registration - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Remove raw RSS QP restrack tracking - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/srpt: fix integer overflow in immediate data length check - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - remoteproc: qcom: Fix leak when custom dump_segments addition fails - reset: sunxi: fix memory region leak on ioremap failure - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - Revert "PCI/MSI: Unmap MSI-X region on error" - Revert "treewide: Fix probing of devices in DT overlays" - ring-buffer: Fix event length with forced 8-byte alignment - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - riscv: probes: save original sp in rethook trampoline - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - rpmsg: use generic driver_override infrastructure - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: mpfs: fix counter upload completion condition - rtc: msc313: fix NULL deref in shared IRQ handler at probe - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - s390/monwriter: Reject buffer reuse with different data length - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - s390/process: Fix kernel thread function pointer type - s390/zcrypt: Remove the empty file - sched/fair: Fix cpu_util runnable_avg arithmetic - sched/fair: Only update stats for allowed CPUs when looking for dst group - sched: restore timer_slack_ns when resetting RT policy on fork - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: sg: Report request-table problems when any status is set - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Fix hexadecimal CHAP_I handling - scsi: target: Remove tcm_loop target reset handling - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - sctp: fix SCTP_RESET_STREAMS stream list length limit - sctp: hold socket lock when dumping endpoints in sctp_diag - sctp: validate embedded address parameter length - sctp: validate STALE_COOKIE cause length before reading staleness - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - seg6: validate SRH length before reading fixed fields - selftests/bpf: Add simple strscpy() implementation - selftests/bpf: Fix bpf_iter/task_vma test - selftests/bpf: Initialize operation name before use - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: do not manually call headers_install - selftests/hid: ensure CKI can compile our new tests on old kernels - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - selftests/hid: force using our compiled libbpf headers - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - selftests/mm: fix exclusive_cow test fork() handling - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - selinux: check connect-related permissions on TCP Fast Open - selinux: fix incorrect execmem checks on overlayfs - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: fix scoped_seqlock_read kernel-doc - seqlock: Introduce scoped_seqlock_read() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - smb/client: always return a value for FS_IOC_GETFLAGS - smb: client: fix change notify replay double-free - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix double-free in SMB2_open() replay - smb/client: Fix error code in smb2_aead_req_alloc() - smb: client: Fix next buffer leak in receive_encrypted_standard() - smb: client: fix overflow in passthrough ioctl bounds check - smb: client: fix query directory replay double-free - smb: client: fix query_info() replay double-free - smb: client: harden POSIX SID length parsing - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - smb: client: mask server-provided mode to 07777 in modefromsid - smb/client: preserve errors from smb2_set_sparse() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: resolve SWN tcon from live registrations - smb: client: restrict implied bcc[0] exemption to responses without data area - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - smb: client: use unaligned reads in parse_posix_ctxt() - smb: move some duplicate definitions to common/cifsglob.h - smb/server: do not require delete access for non-replacing links - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - sparc: led: avoid trimming a newline from empty writes - spi: dw: fix wrong BAUDR setting after resume - spi: ep93xx: fix double-free of zeropage on DMA setup failure - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure - spi: meson-spifc: fix runtime PM leak on remove - spi: rpc-if: Use correct device for hardware reinitialization on resume - spi: sh-msiof: abort transfers when reset times out - spi: uniphier: Fix completion initialization order before devm_request_irq() - spi: xilinx: use FIFO occupancy register to determine buffer size - staging: media: atomisp: reduce load_primary_binaries() stack usage - staging: most: video: avoid double free on video register failure - staging: nvec: fix use-after-free in nvec_rx_completed() - staging: rtl8723bs: core: move constants to right side in comparison - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: vme_user: bound slave read/write to the kern_buf size - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: fix location monitor leak in tsi148 bridge - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sysfs: clamp show() return value in sysfs_kf_read() - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - team: fix header_ops type confusion with non-Ethernet ports - thermal: hwmon: Fix critical temperature attribute removal - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - time: Fix off-by-one in compat settimeofday() usec validation - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - tipc: fix UAF in tipc_l2_send_msg() - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: reject inverted service ranges from peer bindings - tipc: require net admin for TIPCv2 netlink mutators - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - tools/power/x86/intel-speed-select: Harden daemon pidfile open - tools/testing: add linux/args.h header and fix radix, VMA tests - tools/virtio: check mmap return value in vringh_test - tpm: fix event_size output in tpm1_binary_bios_measurements_show - tpm: Make the TPM character devices non-seekable - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - tracing: Bound synthetic-field strings with seq_buf - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - tracing/osnoise: Call synchronize_rcu() when unregistering - tracing: Prevent out-of-bounds read in glob matching - tracing/probes: Fix double addition of offset for @+FOFFSET - tracing: probes: fix typo in a log message - treewide: Switch/rename to timer_delete[_sync]() - udf: validate free block extents against the partition length - udf: validate sparing table length as an entry count, not a byte count - udf: validate VAT header length against the VAT inode size - udmabuf: fix DMA direction mismatch in release_udmabuf() - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - usb: dwc3: run gadget disconnect from sleepable suspend context - usb: free iso schedules on failed submit - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: gadget: f_fs: initialize reset_work at allocation time - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - usb: gadget: f_printer: take kref only for successful open - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - usb: host: max3421: Reject hub port requests for non-existent ports - USB: idmouse: fix use-after-free on disconnect race - USB: iowarrior: fix use-after-free on disconnect - usb: iowarrior: remove inherent race with minor number - usbip: tools: support SuperSpeedPlus devices - usbip: vudc: fix NULL deref in vep_dequeue() - USB: ldusb: fix use-after-free on disconnect race - USB: legousbtower: fix use-after-free on disconnect race - USB: misc: uss720: unregister parport on probe failure - usb: mtu3: unmap request DMA on queue failure - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: keyspan_pda: fix information leak - USB: serial: option: add Telit Cinterion FE990D50 compositions - usb: sl811-hcd: disable controller wakeup on remove - USB: storage: include US_FL_NO_SAME in quirks mask - usb: typec: anx7411: use devm_pm_runtime_enable() - usb: typec: class: drop PD lookup reference - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - USB: ulpi: fix memory leak on registration failure - USB: usb-storage: ene_ub6250: restore media-ready check - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - userfaultfd: gate must_wait writability check on pte_present() - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - vduse: hold vduse_lock across IDR lookup in open path - vduse: Requeue failed read to send_list head - veth: fix NAPI leak in XDP enable error path - vfio/mlx5: Fix racy bitfields and tighten struct layout - vfio/pci: Fix racy bitfields and tighten struct layout - vfio/pci: Latch disable_idle_d3 per device - vfio/pci: Release the VGA arbiter client on register_device() failure - vfio/pci: Use a private flag to prevent power state change with VFs - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - vhost/net: complete zerocopy ubufs only once - vhost/vdpa: validate virtqueue index in mmap and fault paths - virtio-mmio: fix device release warning on module unload - virtio_net: disable cb when NAPI is busy-polled - virtio-net: fix len check in receive_big() - virtio_net: Support dynamic rss indirection table size - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - watchdog: apple: Add "apple,t8103-wdt" compatible - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: unregister PM notifier on watchdog unregister - wifi: ath9k: fix OOB access from firmware tx status queue ID - wifi: cfg80211: fix grammar in MLO group key error message - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: mac80211: free ack status frame on TX header build failure - wifi: mt76: fix argument to ieee80211_is_first_frag() - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: rt2x00: avoid full teardown before work setup in probe - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - workqueue: drop spurious '*' from print_worker_info() fn declaration - writeback: Avoid contention on wb->list_lock when switching inodes - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - X.509: Fix validation of ASN.1 certificate header - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - x86/bugs: Enable IBPB flush on BPF JIT allocation - x86/mm: Fix check/use ordering in switch_mm_irqs_off() - x86/platform/olpc: xo15: Drop wakeup source on driver removal - xen/gntdev: fix error handling in ioctl - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: use compat translator only for u64 alignment mismatch - xfrm: Use the XFRM_GRO to indicate a GRO call on input - xfrm: validate selector family and prefixlen during match - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfs: dump the recovered xattri log item if corruption happens - xfs: fail recovery on a committed log item with no regions - xfs: fix stupid compiler warning - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: move ->iop_recover to xfs_defer_op_type - xfs: recreate work items when recovering intent items - xfs: resample the data fork mapping after cycling ILOCK - xfs: use null daddr for unset first bad log block - xfs: use xfs_defer_finish_one to finish recovered work items - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Check frwr_wp_create() during connect - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Remove temp allocation of rpcrdma_rep objects - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Use sendctx DMA state for Send signaling - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Remove rudiment CVE patches- [bot] upd: 6.6.126 -> 6.6.144 - Changelog: - 6lowpan: fix off-by-one in multicast context address compression - 6pack: propagage new tty types - 9p: avoid putting oldfid in p9_client_walk() error path - accel/qaic: Add overflow check to remap_pfn_range during mmap - accel/qaic: Handle DBC deactivation if the owner went away - ACPI: AGDI: fix missing newline in error message - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - ACPI: PM: Save NVS memory on Lenovo G70-35 - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix - ACPI: scan: Use acpi_dev_put() in object add error paths - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: x86: cmos_rtc: Clean up address space handler driver - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - af_key: validate families in pfkey_send_migrate() - af_unix: Cache state->msg in unix_stream_read_generic(). - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Give up GC if MSG_PEEK intervened. - af_unix: read UNIX_DIAG_VFS data under unix_state_lock - af_unix: Reject SIOCATMARK on non-stream sockets - af_unix: Set gc_in_progress to true in unix_gc(). - agp/amd64: Fix broken error propagation in agp_amd64_probe() - alarmtimer: Fix argument order in alarm_timer_forward() - ALSA: 6fire: Fix input volume change detection - ALSA: 6fire: fix use-after-free on disconnect - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: i2sbus: fix OF node lifetime handling - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - ALSA: aoa: Use guard() for mutex locks - ALSA: asihpi: avoid write overflow check warning - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: fix stack out-of-bounds read in init_card - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - ALSA: core: Fix potential data race at fasync handling - ALSA: core: Serialize deferred fasync state checks - ALSA: core: Validate compress device numbers without dynamic minors - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: ctxfi: Limit PTP to a single page - ALSA: firewire-lib: fix uninitialized local variable - ALSA: firewire-motu: Protect register DSP event queue positions - ALSA: firewire-tascam: Do not drop unread control events - ALSA: fireworks: bound device-supplied status before string array lookup - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: fix some typos - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: hda: cs35l56: Propagate ASP TX source control errors - ALSA: hda: cs35l56: Put ACPI device after setting companion - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: add quirk for Framework F111:000F - ALSA: hda/realtek: Add quirk for Inspur S14-G1 - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: misc: Use guard() for spin locks - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - ALSA: scarlett2: Add missing sentinel initializer field - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - ALSA: timer: Fix UAF at snd_timer_user_params() - ALSA: ua101: Reject too-short USB descriptors - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - ALSA: usb-audio: Add sanity check for OOB writes at silencing - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Cap the packet size pre-calculations - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Evaluate packsize caps at the right place - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Improve Focusrite sample rate filtering - ALSA: usb-audio: midi2: Restart output URBs on resume - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - ALSA: usb-audio: Update the number of packets properly at receiving - ALSA: usb-audio: Use correct version for UAC3 header validation - ALSA: usb-audio: Use inclusive terms - amd-xgbe: fix link status handling in xgbe_rx_adaptation - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - amd-xgbe: fix sleep while atomic on suspend/resume - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - APEI/GHES: ensure that won't go past CPER allocated record - apparmor: fix aa_label to return state from compount and component match - apparmor: fix differential encoding verification - apparmor: Fix double free of ns_name in aa_replace_profiles() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: fix: limit the number of levels of policy namespaces - apparmor: fix memory leak in verify_header - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix NULL sock in aa_sock_file_perm - apparmor: fix race between freeing data and fs accessing it - apparmor: fix race on rawdata dereference - apparmor: fix rlimit for posix cpu timers - apparmor: fix side-effect bug in match_char() macro usage - apparmor: fix unprivileged local user can do privileged policy management - apparmor: fix use-after-free in rawdata dedup loop - apparmor: make label_match return a consistent value - apparmor: mediate the implicit connect of TCP fast open sendmsg - apparmor: provide separate audit messages for file and policy checks - apparmor: refcount the pdb - apparmor: remove apply_modes_to_perms from label_match - apparmor: replace recursive profile removal with iterative approach - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: validate DFA start states are in bounds in unpack_pdb - arm64: Add support for TSV110 Spectre-BHB mitigation - arm64: cpufeature: Make PMUVer and PerfMon unsigned - arm64: cputype: Add C1-Premium definitions - arm64: cputype: Add C1-Ultra definitions - arm64: cputype: Add NVIDIA Olympus definitions - arm64: Disable branch profiling for all arm64 code - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8-apalis: Fix LEDs name collision - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - arm64: dts: rockchip: Fix rk356x PCIe range mappings - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU - arm64: errata: Mitigate TLBI errata on various Arm CPUs - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - arm64: Fix sampling the "stable" virtual counter in preemptible section - arm64: Force the use of CNTVCT_EL0 in __delay() - arm64: io: Extract user memory type in ioremap_prot() - arm64: io: Rename ioremap_prot() to __ioremap_prot() - arm64: kexec: Remove duplicate allocation for trans_pgd - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - arm64: mm: Batch dsb and isb when populating pgtables - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() - arm64: probes: Handle probes on hinted conditional branch instructions - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - arm64/scs: Fix handling of advance_loc4 - arm64/scs: Fix potential sign extension issue of advance_loc4 - arm64: tegra: smaug: Add usb-role-switch support - arm64: tlb: Allow XZR argument to TLBI ops - arm64: tlb: Flush walk cache when unsharing PMD tables - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI - arm64/xor: fix conflicting attributes for xor_block_template - ARM: 9467/1: mm: Don't use %pK through printk - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: clean up the memset64() C wrapper - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: group is_permission_fault() with is_translation_fault() - ARM: integrator: Fix early initialization - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - ARM: omap2: Fix reference count leaks in omap_control_init() - ARM: socfpga: Fix OF node refcount leak in SMP setup - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - ASoC: amd: yc: Add quirk for HP 200 G2a 16 - ASoC: codecs: ab8500: Fix casting of private data - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - ASoC: codecs: simple-mux: Fix enum control bounds check - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - ASoC: cs42l43: Correct handling of 3-pole jack load detection - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: detect empty DMI strings - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - ASoC: es8328: Add error unwind in resume - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: fix comment typo - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_micfil: Add access property for "VAD Detected" - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: Intel: catpt: Fix the device initialization - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm: move component registration to unmanaged version - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6asm-dai: close stream only when running - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays - ASoC: simple-card-utils: use __free(device_node) for device node - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - ASoC: soc-core: drop delayed_work_pending() check before flush - ASoC: soc-core: flush delayed work before removing DAIs and widgets - ASoC: SOF: compress: return the configured codec from get_params - ASoC: SOF: Don't allow pointer operations on unconfigured streams - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda: Place check before dereference - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: sti: Return errors from regmap_field_alloc() - ASoC: sti: use managed regmap_field allocations - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - atm: fore200e: fix use-after-free in tasklets during device removal - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - atm: lec: fix use-after-free in sock_def_readable() - audit: add fchmodat2() to change attributes class - audit: add missing syscalls to read class - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - audit: fix incorrect inheritable capability in CAPSET records - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - auxdisplay: arm-charlcd: fix release_mem_region() size - auxdisplay: line-display: fix OOB read on zero-length message_store() - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - batman-adv: Avoid double-rtnl_lock ELP metric worker - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: clear current gateway during teardown - batman-adv: dat: handle forward allocation error - batman-adv: dat: prevent false sharing between VLANs - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: fix fragment reassembly length accounting - batman-adv: fix integer overflow on buff_pos - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: hold claim backbone gateways by reference - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: mcast: fix use-after-free in orig_node RCU release - batman-adv: prevent ELP transmission interval underflow - batman-adv: reject new tp_meter sessions during teardown - batman-adv: reject oversized global TT response buffers - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: stop tp_meter sessions during mesh teardown - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: tp_meter: keep unacked list in ascending ordered - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tt: fix negative last_changeset_len - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tt: prevent TVLV entry number overflow - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tt: track roam count per VID - batman-adv: tvlv: abort OGM send on tvlv append failure - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: v: stop OGMv2 on disabled interface - bcache: fix cached_dev.sb_bio use-after-free and crash - bcache: fix uninitialized closure object - binder: don't use %pK through printk - binfmt_misc: restore write access before closing files opened by open_exec() - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - blk-cgroup: fix UAF in __blkcg_rstat_flush() - blk-cgroup: wait for blkcg cleanup before initializing new disk - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - blktrace: fix __this_cpu_read/write in preemptible context - block: add pgmap check to biovec_phys_mergeable - block: relax pgmap check in bio_add_page for compatible zone device pages - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: bnep: reject short frames before parsing - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events - Bluetooth: btmtk: add the function to get the fw name - Bluetooth: btmtk: fix urb->setup_packet leak in error paths - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btmtk: validate WMT event SKB length before struct access - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: btusb: Allow firmware re-download when version matches - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - Bluetooth: hci_conn: fix potential UAF in create_big_sync - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - Bluetooth: hci_ll: Fix firmware leak on error path - Bluetooth: hci_qca: Cleanup on all setup failures - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - Bluetooth: hci_sync: Fix hci_le_create_conn_sync - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - Bluetooth: HIDP: Fix possible UAF - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - Bluetooth: ISO: Fix defer tests being unstable - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU - Bluetooth: MGMT: Fix backward compatibility with userspace - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: MGMT: validate LTK enc_size on load - Bluetooth: MGMT: validate mesh send advertising payload length - Bluetooth: qca: fix ROM version reading on WCN3998 chips - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - Bluetooth: serialize accept_q access - Bluetooth: SMP: derive legacy responder STK authentication from MITM state - Bluetooth: SMP: force responder MITM requirements before building the pairing response - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy - Bluetooth: virtio_bt: clamp rx length before skb_put - Bluetooth: virtio_bt: validate rx pkt_type header length - bnxt_en: Fix NULL pointer dereference - bonding: 3ad: implement proper RCU rules for port->aggregator - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - bonding: add support for per-port LACP actor priority - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - bonding: fix NULL pointer dereference in actor_port_prio setting - bonding: fix use-after-free due to enslave fail after slave array update - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - bonding: only set speed/duplex to unknown, if getting speed failed - bonding: print churn state via netlink - bonding: refuse to enslave CAN devices - bpf: Add CHECKSUM_COMPLETE to bpf test progs - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf, arm64: Fix off-by-one in check_imm signed range check - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - bpf, devmap: Remove unnecessary if check in for loop - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks - bpf: export bpf_link_inc_not_zero. - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf: fix end-of-list detection in cgroup_storage_get_next_key() - bpf: Fix NULL deref in map_kptr_match_type for scalar regs - bpf: Fix OOB in pcpu_init_value - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf: Fix RCU stall in bpf_fd_array_map_clear() - bpf: Fix regsafe() for pointers to packet - bpf: Fix stack-out-of-bounds write in devmap - bpf: Fix stale offload->prog pointer after constant blinding - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN - bpf: Forget ranges when refining tnum after JSET - bpf: Free reuseport cBPF prog after RCU grace period. - bpf: handle fake register spill to stack with BPF_ST_MEM instruction - bpf: preserve constant zero when doing partial register restore - bpf: preserve STACK_ZERO slots on partial reg spills - bpf: reject direct access to nullable PTR_TO_BUF pointers - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - bpf: Reject sleepable kprobe_multi programs at attach time - bpf: Release module BTF IDR before module unload - bpf: Remove mark_precise_scalar_ids() - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - bpf, sockmap: Fix af_unix iter deadlock - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix FIONREAD for sockmap - bpf, sockmap: Fix incorrect copied_seq calculation - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - bpf, sockmap: Take state lock for af_unix iter - bpf: support non-r10 register spill/fill to/from stack in precision tracking - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpftool: Fix truncated netlink dumps - bpf: track aligned STACK_ZERO cases as imprecise spilled registers - bpf: Track equal scalars history on per-instruction level - bpf: use kvfree() for replaced sysctl write buffer - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path - bpf: verifier improvement in 32bit shift sign extension pattern - bridge: br_nd_send: linearize skb before parsing ND options - bridge: br_nd_send: validate ND option lengths - bridge: mcast: Fix a possible use-after-free when removing a bridge port - btrfs: abort transaction on failure to update root in the received subvol ioctl - btrfs: add raid stripe tree definitions - btrfs: add support for inserting raid stripe extents - btrfs: always fallback to buffered write if the inode requires checksum - btrfs: continue trimming remaining devices on failure - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: do not strictly require dirty metadata threshold for metadata writepages - btrfs: don't take device_list_mutex when querying zone info - btrfs: fix block_group_tree dirty_list corruption - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - btrfs: fix double free in create_space_info() error path - btrfs: fix double free in create_space_info_sub_group() error path - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - btrfs: fix leak of kobject name for sub-group space_info - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: fix NULL dereference on root when tracing inode eviction - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix super block offset in error message in btrfs_validate_super() - btrfs: fix the qgroup data free range for inline data extents - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: handle user interrupt properly in btrfs_trim_fs() - btrfs: log new dentries when logging parent dir of a conflicting inode - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - btrfs: move btrfs_crc32c_final into free-space-cache.c - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: qgroup: return correct error when deleting qgroup relation item - btrfs: read raid stripe tree from disk - btrfs: reject root items with drop_progress and zero drop_level - btrfs: remove btrfs_crc32c wrapper - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() - btrfs: replace BUG() with error handling in __btrfs_balance() - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - Buffer overflow in drivers/xen/sys-hypervisor.c - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - bus: fsl-mc: fix use-after-free in driver_override_show() - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions - bus: omap-ocp2scp: Convert to platform remove callback returning void - bus: omap-ocp2scp: fix OF populate on driver rebind - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - cache: enforce cache groups - can: bcm: fix locking for bcm_op runtime updates - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - can: gs_usb: gs_can_open(): always configure bitrates before starting device - can: gw: fix OOB heap access in cgw_csum_crc8_rel() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - can: mcp251x: add error handling for power enable in open and resume - can: mcp251x: fix deadlock in error path of mcp251x_open - can: raw: fix ro->uniq use-after-free in raw_rcv() - can: statistics: add missing atomic access in hot path - can: ucan: fix devres lifetime - can: ucan: Fix infinite loop from zero-length messages - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - cdc-acm: new quirk for EPSON HMD - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - ceph: fix a buffer leak in __ceph_setxattr() - ceph: fix i_nlink underrun during async unlink - ceph: fix memory leaks in ceph_mdsc_build_path() - ceph: only d_add() negative dentries when they are unhashed - ceph: supply snapshot context in ceph_uninline_data() - ceph: supply snapshot context in ceph_zero_partial_object() - cgroup/cpuset: Reset DL migration state on can_attach() failure - cgroup: fix race between task migration and iteration - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - char: tpm: cr50: Remove IRQF_ONESHOT - checkpatch: add support for Assisted-by tag - cifs: abort open_cached_dir if we don't request leases - cifs: change_conf needs to be called for session setup - cifs: Fix busy dentry used after unmounting - cifs: Fix locking usage for tcon fields - cifs: make default value of retrans as zero - cifs: open files should not hold ref on superblock - cifs: some missing initializations on replay - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: imx: imx8-acm: fix flags for acm clocks - clk: mediatek: Fix error handling in runtime PM setup - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: microchip: core: correct return value on *_get_parent() - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: dispcc-sc7180: Add missing MDSS resets - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - clk: qoriq: avoid format string warning - clk: renesas: rzg2l: Fix intin variable size - clk: renesas: rzg2l: Select correct div round macro - clk: rk808: fix OF node reference imbalance - clk: tegra: tegra124-emc: fix device leak on set_rate() - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - clk: visconti: pll: initialize clk_init_data to zero - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clocksource/drivers/sh_tmu: Always leave device running after probe - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clsact: Fix use-after-free in init/destroy rollback asymmetry - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: dt2815: add hardware detection to prevent crash - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - coresight: etm3x: Fix cpulocked warning on cpuhp - counter: Fix refcount leak in counter_alloc() error path - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - cpufreq: conservative: Reset requested_freq on limits change - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - cpuidle: powerpc: avoid double clear when breaking snooze - cpuidle: Skip governor when only one idle state is available - cpuset: Fix missing adaptation for cpuset_is_populated - crypto: af_alg - Cap AEAD AD length to 0x80000000 - crypto: af-alg - fix NULL pointer dereference in scatterwalk - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - crypto: algif_aead - Fix minimum RX size check for decryption - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel - Remove cfb and ofb - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - reject short ahash digests during instance creation - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: caam - fix DMA corruption on long hmac keys - crypto: caam - fix overflow on long hmac keys - crypto: caam - guard HMAC key hex dumps in hash_digest_key - crypto: cavium - fix dma_free_coherent() size - crypto: ccp - Add an S4 restore flow - crypto: ccp - copy IV using skcipher ivsize - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed - crypto: ccp - Factor out ring destroy handling to a helper - crypto: ccp - Move direct access to some PSP registers out of TEE - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: hisilicon/qm - move the barrier before writing to the mailbox register - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable - crypto: hisilicon/trng - modifying the order of header files - crypto: hisilicon/trng - support tfms sharing the device - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function - crypto: hisilicon/zip - remove zlib and gzip - crypto: hisilicon/zip - support deflate algorithm - crypto: jitterentropy - replace long-held spinlock with mutex - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - crypto: nx - fix context leak in nx842_crypto_free_ctx - crypto: nx - Migrate to scomp API - crypto: octeontx - fix dma_free_coherent() size - crypto: pcrypt - Fix handling of MAY_BACKLOG requests - crypto: qat - fix warning on adf_pfvf_pf_proto.c - crypto: qat - remove unused character device and IOCTLs - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - use swab32 macro - crypto: sa2ul - Fix AEAD fallback algorithm names - crypto: scatterwalk - Backport memcpy_sglist() - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - rename first/last to first_desc/last_desc - crypto: testmgr - Hide ENOENT errors - crypto: testmgr - Hide ENOENT errors better - cxl: Fix premature commit_end increment on decoder commit failure - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - dcache: Limit the minimal number of bucket to two - debugfs: check for NULL pointer in debugfs_create_str() - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - device property: Allow secondary lookup in fwnode_get_next_child_node() - device property: Make modifications of fwnode "flags" thread safe - device property: set fwnode->secondary to NULL in fwnode_init() - dev_printk: add new dev_err_probe() helpers - devres: fix missing node debug info in devm_krealloc() - Disable -Wattribute-alias for clang-23 and newer - dlm: prevent NPD when writing a positive value to event_done - dma-buf: Include ioctl.h in UAPI header - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - dmaengine: idxd: Fix crash when the event log is disabled - dmaengine: idxd: Fix freeing the allocated ida too late - dmaengine: idxd: Fix leaking event log memory - dmaengine: idxd: Fix memory leak when a wq is reset - dmaengine: idxd: Fix not releasing workqueue on .release() - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dma-mapping: add missing `inline` for `dma_free_attrs` - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - dm cache: fix concurrent write failure in passthrough mode - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: fix missing return in invalidate_committed's error path - dm cache: fix null-deref with concurrent writes in passthrough mode - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache metadata: fix memory leak on metadata abort retry - dm cache policy smq: check allocation under invalidate lock - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: support shrinking the origin device - dm: clear cloned request bio pointer when last clone bio completes - dm: don't report warning when doing deferred remove - dm: fix a buffer overflow in ioctl processing - dm init: ensure device probing has finished in dm-mod.waitfor= - dm-integrity: fix a typo in the code for write/discard race - dm-integrity: fix recalculation in bitmap mode - dm log: fix out-of-bounds write due to region_count overflow - dm mirror: fix integer overflow in create_dirty_log() - dm mpath: make pg_init_delay_msecs settable - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - dm-thin: fix metadata refcount underflow - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm: use bio_clone_blkg_association - dm-verity: correctly handle dm_bufio_client_create() failure - dm-verity: disable recursive forward error correction - dm-verity-fec: correctly reject too-small FEC devices - dm-verity-fec: correctly reject too-small hash devices - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - docs: fix WARNING document not included in any toctree - Documentation: fix a hugetlbfs reservation statement - Documentation: ioctl-number: Extend "Include File" column width - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - Documentation: trace: Refactor toctree - Documentation: tracing: Add PCI tracepoint documentation - Documentation: tracing: Add ring-buffer mapping - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2-switch: do not clear any interrupts automatically - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - drbd: Balance RCU calls in drbd_adm_dump_devices() - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - drbd: fix null-pointer dereference on local read error - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value - driver core: Don't let a device probe until it's ready - driver core: generalize driver_override in struct device - driver core: platform: use generic driver_override infrastructure - driver core: reject devices with unregistered buses - drivers/base/memory: fix memory block reference leak in poison accounting - drivers/base/memory: set mem->altmap after successful device registration - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - drivers: iio: mpu3050: use dev_err_probe for regulator request - drm: Account property blob allocations to memcg - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - drm/amd/display: Allow DCE link encoder without AUX registers - drm/amd/display: Avoid updating surface with the same surface under MPO - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - drm/amd/display: Do not skip unrelated mode changes in DSC validation - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - drm/amd/display: Fix integer overflow in bios_get_image() - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - drm/amd/display: Remove conditional for shaper 3DLUT power-on - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amd: Drop special case for yellow carp without discovery - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() - drm/amdgpu: Add basic validation for RAS header - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdgpu: Add default case in DVI mode validation - drm/amdgpu: Add HAINAN clock adjustment - drm/amdgpu: add support for HDP IP version 6.1.1 - drm/amdgpu: Adjust usleep_range in fence wait - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - drm/amdgpu: fix spelling typos - drm/amdgpu: Fix use-after-free race in VM acquire - drm/amdgpu: fix zero-size GDS range init on RDNA4 - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu/gmc9.0: add bounds checking for cid - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn3: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu: zero-initialize GART table on allocation - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix debug watchpoints for logical devices - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - drm/amdkfd: fix NULL dereference in get_queue_ids() - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) - drm/amd: Set num IP blocks to 0 if discovery fails - drm/arcpgu: fix device node leak - drm/ast: dp501: Fix initialization of SCU2C - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - drm/bridge: it66121: acquire reset GPIO in probe - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: samsung-dsim: Fix memory leak in error path - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/display/dp_mst: Add protection against 0 vcpi - drm/dp: Add eDP 1.5 bit definition - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup - drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/hyperv: validate resolution_count and fix WIN8 fallback - drm/hyperv: validate VMBus packet size in receive callback - drm/i915/acpi: free _DSM package when no connectors - drm/i915: Constify watermark state checker - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Fix potential overflow of shmem scatterlist length - drm/i915: Fix potential UAF in TTM object purge - drm/i915/gem: Fix phys BO pread/pwrite with offset - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - drm/i915/gt: Check set_default_submission() before deferencing - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/i915/psr: Do not use pipe_src as borders for SU area - drm/i915/psr: Read Intel DPCD workaround register - drm/i915: Simplify watermark state checker calling convention - drm/i915: skip __i915_request_skip() for already signaled requests - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - drm/i915/wm: Verify the correct plane DDB entry - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - drm/ioc32: stop speculation on the drm_compat_ioctl path - drm/komeda: fix integer overflow in AFBC framebuffer size check - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() - drm/msm/a2xx: fix pixel shader start on A225 - drm/msm/a6xx: Fix HLSQ register dumping - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - drm/msm/dpu: fix mismatch between power and frequency - drm/msm/dsi: add the missing parameter description - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - drm/msm/dsi: don't dump registers past the mapped region - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm: Fix dma_free_attrs() buffer size - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/shrinker: Fix can_block() logic - drm/msm/snapshot: fix dumping of the unaligned regions - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/radeon: Add HAINAN clock adjustment - drm/radeon: add missing revision check for CI - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm: Remove plane hsub/vsub alignment requirement for core helpers - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - drm/solomon: Fix page start when updating rectangle in page addressing mode - drm/ssd130x: Replace .page_height field in device info with a constant - drm/ssd130x: Store the HW buffer in the driver-private CRTC state - drm/ssd130x: Use bool for ssd130x_deviceinfo flags - drm/sun4i: backend: fix error pointer dereference - drm/sun4i: Fix resource leaks - drm/sysfb: ofdrm: fix PCI device reference leaks - drm/tegra: dsi: fix device leak on probe - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used - drm/v3d: Reject empty multisync extension to prevent infinite loop - drm/v3d: Set DMA segment size to avoid debug warnings - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: fix krealloc() memory leak - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: platform_get_irq_byname() returns an int - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Release runtime PM reference after binding V3D - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - drm/virtio: Fix driver removal with disabled KMS - drm/virtio: use uninterruptible resv lock for plane updates - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - dt-bindings: connector: add pd-disable dependency - dt-bindings: gpio: fix microchip #interrupt-cells - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - dt-bindings: net: Fix Tegra234 MGBE PTP clock - e1000: check return value of e1000_read_eeprom - e1000/e1000e: Fix leak in DMA error cleanup - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - e1000e: Unroll PTP in probe error handling - EDAC/altera: Remove IRQF_ONESHOT - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/mc: Fix error path ordering in edac_mc_alloc() - efi: Allocate runtime workqueue before ACPI init - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - EFI/CPER: don't dump the entire memory region - EFI/CPER: don't go past the ARM processor CPER record buffer - efi: Fix reservation of unaccepted memory table - erofs: add GFP_NOIO in the bio completion if needed - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - erofs: fix the out-of-bounds nameoff handling for trailing dirents - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() - err.h: use __always_inline on all error pointer helpers - esp: fix skb leak with espintcp and async crypto - eth: bnxt: always recalculate features after XDP clearing, fix null-deref - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - eventfs: Hold eventfs_mutex and SRCU when remount walks events - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - eventpoll: defer struct eventpoll free to RCU grace period - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: Fix integer overflow in ep_loop_check_proc() - eventpoll: kill __ep_remove() - eventpoll: move epi_fget() up - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - exfat: fix potential use-after-free in exfat_find_dir_entry() - exit: prevent preemption of oopsing TASK_DEAD task - exit: Sleep at TASK_IDLE when waiting for application core dump - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - ext4: always allocate blocks only from groups inode can use - ext4: always drain queued discard work in ext4_mb_release() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: avoid infinite loops caused by residual data - ext4: convert bd_bitmap_page to bd_bitmap_folio - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert inline data to extents when truncate exceeds inline size - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - ext4: don't cache extent during splitting extent - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: drop extent cache when splitting extent fails - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - ext4: fix dirtyclusters double decrement on fs shutdown - ext4: fix e4b bitmap inconsistency reports - ext4: fix fsync(2) for nojournal mode - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix journal credit check when setting fscrypt context - ext4: fix memory leak in ext4_ext_shift_extents() - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix stale xarray tags after writeback - ext4: fix the might_sleep() warnings in kvfree() - ext4: fix use-after-free in update_super_work when racing with umount - ext4: get rid of ppath in ext4_convert_unwritten_extents_endio() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in ext4_find_extent() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_split_extent_at() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: mark group add fast-commit ineligible - ext4: mark group extend fast-commit ineligible - ext4: move ext4_percpu_param_init() before ext4_mb_init() - ext4: publish jinode after initialization - ext4: reject mount if bigalloc with s_first_data_block != 0 - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio - ext4: subdivide EXT4_EXT_DATA_VALID1 - ext4: use optimized mballoc scanning regardless of inode format - ext4: validate p_idx bounds in ext4_ext_correct_indexes - extcon: ptn5150: handle pending IRQ events during system resume - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: fix incorrect file address mapping when inline inode is unwritten - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix out-of-bounds access in sysfs attribute read/write - f2fs: fix to add gc count stat in f2fs_gc_range - f2fs: fix to avoid mapping wrong physical block for swapfile - f2fs: fix to avoid memory leak in f2fs_rename() - f2fs: fix to avoid migrating empty section - f2fs: fix to avoid UAF in f2fs_write_end_io() - f2fs: fix to detect potential corrupted nid in free_nid_list - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - f2fs: fix to round down start offset of fallocate for pin file - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - f2fs: fix zoned block device information initialization - f2fs: keep atomic write retry from zeroing original data - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: validate compress cache inode only when enabled - f2fs: zone: fix to avoid inconsistence in between SIT and SSA - fanotify: fix false positive on permission events - fat: avoid parent link count underflow in rmdir - fbcon: Avoid OOB font access if console rotation fails - fbcon: check return value of con2fb_acquire_newinfo() - fbcon: Remove struct fbcon_display.inverse - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - fbdev: fix use-after-free in store_modes() - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: offb: fix PCI device reference leak on probe failure - fbdev: rivafb: fix divide error in nv3_arb() - fbdev: smscufx: properly copy ioctl memory to kernelspace - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - file: add fput() cleanup helper - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_scpi: Fix device_node reference leak in probe path - firmware: dmi: Correct an indexing error in dmi.h - firmware: google: framebuffer: Do not mark framebuffer as busy - firmware: google: framebuffer: Do not unregister platform device - fix it87_wdt early reboot by reporting running timer - flow_dissector: do not dissect PPPoE PFC frames - fork: defer linking file vma until vma is fully initialized - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - fpga: of-fpga-region: Fail if any bridge is missing - fpga: region: fix use-after-free in child_regions_with_firmware() - fs: add for 'init_fs' - fs/adfs: validate nzones in adfs_validate_bblk() - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - fs/nfs: Fix readdir slow-start regression - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs: ntfs3: check return value of indx_find to avoid infinite loop - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - fs/ntfs3: validate rec->used in journal-replay file record check - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - fs: prepare for adding LSM blob to backing_file - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Update the mcount_loc check of skipped entries - fuse: Check for large folio with SPLICE_F_MOVE - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fuse: quiet down complaints in fuse_conn_limit_write - fuse: reject fuse_notify() pagecache ops on directories - fuse: reject oversized dirents in page cache - fuse: re-lock request before replacing page cache folio - futex: Clear stale exiting pointer in futex_lock_pi() retry path - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - genetlink: Use internal flags for multicast groups - gfs2: Add metapath_dibh helper - gfs2: add some missing log locking - gfs2: Call unlock_new_inode before d_instantiate - gfs2: fiemap page fault fix - gfs2: Fix unlikely race in gdlm_put_lock - gfs2: fix use-after-free in gfs2_qd_dealloc - gfs2: Fix use-after-free in iomap inline data write path - gfs2: Improve gfs2_consist_inode() usage - gfs2: prevent NULL pointer dereference during unmount - gfs2: Retries missing in gfs2_{rename,exchange} - gfs2: Validate i_depth for exhash directories - gpio: aspeed-sgpio: Change the macro to support deferred probe - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: acpi: Fix gpio count with string references - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - gpio: mvebu: fix NULL pointer dereference in suspend/resume - gpio: mxc: fix irq_high handling - gpio: mxc: map Both Edge pad wakeup to Rising Edge - gpio: of: clear OF_POPULATED on hog nodes in remove path - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - gpio: sprd: Change sprd_gpio lock to raw_spin_lock - gpio: tegra: fix irq_release_resources calling enable instead of disable - gro: change the BUG_ON() in gro_pull_from_frag0() - gve: defer interrupt enabling until NAPI registration - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - hdlc_ppp: sync per-proto timers before freeing hdlc state - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - hfsplus: fix volume corruption issue for generic/498 - hfsplus: pretend special inodes as regular files - hfsplus: return error when node already exists in hfs_bnode_create - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - HID: alps: fix NULL pointer dereference in alps_raw_event() - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - HID: apple: avoid memory leak in apple_report_fixup() - HID: asus: add xg mobile 2023 external hardware support - HID: asus: avoid memory leak in asus_report_fixup() - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - HID: core: Add printk_ratelimited variants to hid_warn() etc - HID: core: clamp report_size in s32ton() to avoid undefined shift - HID: core: Fix size_t specifier in hid_report_raw_event() - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: hid-pl: handle probe errors - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() - HID: magicmouse: Do not crash on missing msc->input - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - HID: mcp2221: cancel last I2C command on read error - HID: multitouch: add eGalaxTouch EXC3188 support - HID: multitouch: Check to ensure report responses match the request - HID: pass the buffer size to hid_report_raw_event - HID: playstation: Add missing check for input_ff_create_memless - HID: playstation: Clamp num_touch_reports - HID: prodikeys: Check presence of pm->input_ep82 - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - HID: quirks: really enable the intended work around for appledisplay - HID: roccat: fix use-after-free in roccat_report_event - HID: uclogic: Fix regression of input name assignment - HID: usbhid: fix deadlock in hid_post_reset() - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - hisi_acc_vfio_pci: update status after RAS error - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimer: Fix trace oddity - hrtimer: Reduce trace noise in hrtimer_start() - hrtimers: Update the return type of enqueue_hrtimer() - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - hv_sock: fix ARM64 support - hv: utils: handle and propagate errors in kvp_register - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - hwmon: (aht10) Add support for dht20 - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (axi-fan-control) Make use of dev_err_probe() - hwmon: (axi-fan-control) Use device firmware agnostic API - hwmon: axi-fan: don't use driver_override as IRQ name - hwmon: (corsair-psu) Close HID device on probe errors - hwmon: (f71882fg) Add F81968 support - hwmon: (it87) Check the it87_lock() return value - hwmon: (ltc2992) Clamp threshold writes to hardware range - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - hwmon: (occ) Fix division by zero in occ_show_power_1() - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - hwmon: (pmbus/core) Protect regulator operations with mutex - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - hwmon: (pxe1610) Check return value of page-select write in probe - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - i2c: s3c24xx: check the size of the SMBUS message before using it - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: stub: Reject I2C block transfers with invalid length - i2c: tegra: Don't mark devices with pins as IRQ safe - i2c: tegra: Fix NOIRQ suspend/resume - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - i3c: dw: Initialize spinlock to avoid upsetting lockdep - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - i3c: master: Update hot-join flag only on success - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - i3c: Move device name assignment after i3c_bus_init - i40e: Cleanup PTP pins on probe failure - i40e: don't advertise IFF_SUPP_NOFCS - i40e: Fix preempt count leak in napi poll tracepoint - i40e: fix registering XDP RxQ info - i40e: fix src IP mask checks and memcpy argument names in cloud filter - i40e: use xdp.frame_sz as XDP RxQ info frag_size - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: fix VLAN filter lost on add/delete race - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - iavf: stop removing VLAN filters from PF on interface down - iavf: wait for PF confirmation before removing VLAN filters - IB/cache: update gid cache on client reregister event - IB/core: Fix zero dmac race in neighbor resolution - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - ibmveth: Disable GSO for packets with small MSS - ice: fix double-free of tx_buf skb - ice: fix locking in ice_dcb_rebuild() - ice: Fix memory leak in ice_set_ringparam() - ice: fix NULL pointer dereference in ice_reset_all_vfs() - ice: fix retry for AQ command 0x06EE - ice: fix setting promisc mode while adding VID filter - ice: fix VF queue configuration with low MTU values - ice: reintroduce retry mechanism for indirect AQ - ice: Remove jumbo_remove step from TX path - ice: use ice_update_eth_stats() for representor stats - icmp: fix NULL pointer dereference in icmp_tag_validation() - icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns - icmp: move icmp_global.credit and icmp_global.stamp to per netns storage - icmp: prevent possible overflow in icmp_global_allow() - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - igc: fix missing update of skb->tail in igc_xmit_frame() - iio: accel: fix ADXL355 temperature signature value - iio: adc: ad7768-1: fix one-shot mode data acquisition - iio: adc: npcm: Convert to platform remove callback returning void - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: ti-adc161s626: fix buffer read on big-endian - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - iio: buffer: Fix wait_queue not being removed - iio: buffer: hw-consumer: fix use-after-free in error path - iio: chemical: bme680: Fix measurement wait duration calculation - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: common: st_sensors: Fix use of uninitialize device structs - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: ad5686: fix ref bit initialization for single-channel parts - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: dac: ds4424: reject -128 RAW value - iio: dac: max5821: fix return value check in powerdown sync - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: gyro: adis16260: fix division by zero in write_raw - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: gyro: itg3200: Fix unchecked return value in read_raw - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - iio: imu: inv_icm42600: fix odr switch to the same value - iio: imu: inv_icm42600: fix odr switch when turning buffer off - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: light: bh1780: fix PM runtime leak on error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: light: vcnl4035: fix scan buffer on big-endian - iio: magnetometer: Remove IRQF_ONESHOT - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: pressure: mprls0025pa: fix scan_type struct - iio: sca3000: Fix a resource leak in sca3000_probe() - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: temperature: tsys01: fix broken PROM checksum validation - iio: Use IRQF_NO_THREAD - ima: check return value of crypto_shash_final() in boot aggregate - ima: verify the previous kernel's IMA buffer lies in addressable RAM - include: uapi: netfilter_bridge.h: Cover for musl libc - indirect_call_wrapper: do not reevaluate function pointer - inet: add indirect call wrapper for getfrag() calls - inet: frags: add inet_frag_queue_flush() - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: move icmp_global_{credit,stamp} to a separate cache line - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: elan_i2c - validate firmware size before use - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: synaptics-rmi4 - fix a locking bug in an error path - Input: uinput - fix circular locking dependency with ff-core - Input: uinput - take event lock when submitting FF request "event" - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - Input: xpad - add "Nova 2 Lite" from GameSir - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - fix out-of-bounds access for Share button - iomap: allocate s_dio_done_wq for async reads as well - iomap: don't revert iov_iter on partially completed buffered writes - iomap: fix submission side handling of completion side errors - iomap: reject delalloc mappings during writeback - iommu/amd: move wait_on_sem() out of spinlock - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - iommu/amd: Use atomic64_inc_return() in iommu.c - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - iommufd: Fix a race with concurrent allocation and unmap - iommufd: vfio compatibility extension check for noiommu mode - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - iommu/vt-d: Flush cache for PASID table before using it - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - ionic: fix persistent MAC address override on PF - ionic: Rate limit unknown xcvr type messages - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - io_uring/filetable: clamp alloc_hint to the configured alloc range - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix multishot recv missing EOF on wakeup race - io_uring/poll: fix signed comparison in io_poll_get_ownership() - io_uring/sync: validate passed in offset - io_uring/timeout: check unused sqe fields - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ip6_gre: Use cached t->net in ip6erspan_changelink(). - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - ip6_vti: set netns_immutable on the fallback device. - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipc: don't audit capability check in ipc_permissions() - ipc: limit next_id allocation to the valid ID range - ipc/shm: serialize orphan cleanup with shm_nattch updates - ipmi: Add limits to event and receive message requests - ipmi: Check event message buffer response for bad data - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ipmi: ipmb: initialise event handler read bytes - ipmi:si: Return state to normal if message allocation fails - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - ipmi:ssif: Clean up kthread on errors - ipmi:ssif: Fix a shutdown race - ipmi:ssif: NULL thread on error - ipmi:ssif: Remove unnecessary indention - ipv4: account for fraggap on the paged allocation path - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: fib: Annotate access to struct fib_alias.fa_state. - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - ipv4: icmp: fix null-ptr-deref in icmp_build_probe() - ipv4: icmp: validate reply type before using icmp_pointers - ipv4: igmp: annotate data-races around idev->mr_maxdelay - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - ipv6: account for fraggap on the paged allocation path - ipv6: add NULL checks for idev in SRv6 paths - ipv6/addrconf: annotate data-races around devconf fields (II) - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - ipv6: avoid overflows in ip6_datagram_send_ctl() - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: exthdrs: refresh nh after handling HAO option - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - ipv6: Fix a potential NPD in cleanup_prefix_route() - ipv6: fix a race in ip6_sock_set_v6only() - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - ipv6: Fix out-of-bound access in fib6_add_rt2node(). - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - ipv6: fix possible UAF in icmpv6_rcv() - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() - ipv6: mcast: Fix use-after-free when processing MLD queries - ipv6: prevent possible UaF in addrconf_permanent_addr() - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - ipv6: sit: reload inner IPv6 header after GSO offloads - ipv6: use RCU in ip6_xmit() - ipv6: validate extension header length before copying to cmsg - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - ipvs: clear the svc scheduler ptr early on edit - ipvs: fix MTU check for GSO packets in tunnel mode - ipvs: fix NULL deref in ip_vs_add_service error path - ipvs: skip ipv6 extension headers for csum checks - irqchip/ath79-cpu: Remove unused function - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - ixgbevf: add missing negotiate_features op to Hyper-V ops table - ixgbevf: fix link setup issue - ixgbevf: fix use-after-free in VEPA multicast source pruning - jbd2: gracefully abort on checkpointing state corruptions - jfs: Add missing set_freezable() for freezable kthread - jfs: nlink overflow in jfs_rename - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - kbuild: Add objtool to top-level clean target - kbuild: Leave objtool binary around with 'make clean' - kexec: derive purgatory entry from symbol - KEYS: fix overflow in keyctl_pkey_params_get_2() - keys: Pin request_key_auth payload in instantiate paths - kprobes: avoid crash when rmmod/insmod after ftrace killed - kprobes: Remove unneeded goto - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - ksmbd: add durable scavenger timer - ksmbd: add support for supplementary groups - ksmbd: avoid reclaiming expired durable opens by the client - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: Compare MACs in constant time - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - ksmbd: do not expire session on binding failure - ksmbd: Don't log keys in SMB3 signing and encryption key generation - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - ksmbd: fix null pointer dereference in compare_guid_key() - ksmbd: fix OOB write in QUERY_INFO for compound requests - ksmbd: fix out-of-bounds read in smb_check_perm_dacl() - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - ksmbd: fix use-after-free by using call_rcu() for oplock_info - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - ksmbd: fix use-after-free of share_conf in compound request - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops - ksmbd: reject non-VALID session in compound request branch - ksmbd: replace connection list with hash table - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: require minimum ACE size in smb_check_perm_dacl() - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: unset conn->binding on failed binding request - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: use msleep instaed of schedule_timeout_interruptible() - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: validate EaNameLength in smb2_get_ea() - ksmbd: validate inherited ACE SID length - ksmbd: validate owner of durable handle on reconnect - ksmbd: validate response sizes in ipc_validate_msg() - ktest: Avoid undef warning when WARNINGS_FILE is unset - ktest: Fix the month in the name of the failure directory - ktest: Honor empty per-test option overrides - ktest: Run POST_KTEST hooks on failure and cancellation - kunit: config: Enable KUNIT_DEBUGFS by default - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: tool: copy caller args in run_kernel to prevent mutation - KVM: arm64: Discard PC update state on vcpu reset - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: PMU: Preserve AArch32 counter low bits - KVM: arm64: Remove VPIPT I-cache handling - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION - KVM: SVM: Add a helper to look up the max physical ID for AVIC - KVM: SVM: check validity of VMCB controls when returning from SMM - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated - KVM: VMX: Update SVI during runtime APICv activation - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - KVM: x86: Fix KVM_GET_MSRS stack info leak - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - KVM: x86: Fix shadow paging use-after-free due to unexpected role - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs - KVM: x86: Use scratch field in MMIO fragment to hold small write values - KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - l2tp: Drop large packets with UDP encap - landlock: Fix handling of disconnected directories - leds: lgm-sso: Remove duplicate assignments for priv->mmap - leds: qcom-lpg: Check for array overflow when selecting the high resolution - leds: qcom-lpg: Check the return value of regmap_bulk_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: check xbc_init_node() return in override path - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - libbpf: Fix OOB read in btf_dump_get_bitfield_value - libbpf: Fix -Wdiscarded-qualifiers under C23 - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: define and enforce CEPH_MAX_KEY_LEN - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential out-of-bounds access in osdmap_decode() - libceph: Fix slab-out-of-bounds access in auth message processing - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - libceph: prevent potential out-of-bounds reads in process_message_header() - libceph: reject preamble if control segment is empty - libceph: Use u32 for non-negative values in ceph_monmap_decode() - lib/crypto: chacha: Zeroize permuted_state before it leaves scope - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - lib/scatterlist: fix length calculations in extract_kvec_to_sg - lib/scatterlist: fix temp buffer in extract_user_to_sg() - libsubcmd: Fix null intersection case in exclude_cmds() - lib: test_hmm: evict device pages on file close to avoid use-after-free - lib/ts_kmp: fix integer overflow in pattern length calculation - locking: Fix rwlock support in - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - LoongArch: Add spectre boundry for syscall dispatch table - LoongArch: Add WriteCombine shadow mapping in KASAN - LoongArch: Add writecombine support for DMW-based ioremap() - LoongArch: Disable instrumentation for setup_ptwalker() - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - LoongArch: Give more information if kmem access failed - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE - LoongArch: Prefer top-down allocation after arch_mem_init() - LoongArch: Remove unused code to avoid build warning - LoongArch: Rework KASAN initialization for PTW-enabled systems - LoongArch: Show CPU vulnerabilites correctly - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: vDSO: Emit GNU_EH_FRAME correctly - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - loop: fix partition scan race between udev and loop_reread_partitions() - lsm: add backing_file LSM hooks - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - mac802154: llsec: add skb_cow_data() before in-place crypto - macsec: fix replay protection at XPN lower-PN wrap - macvlan: annotate data-races around port->bc_queue_len_used - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - mailbox: add sanity check for channel array - mailbox: Allow controller specific mapping using fwnode - mailbox: bcm-ferxrm-mailbox: Use default primary handler - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: mailbox-test: don't free the reused channel - mailbox: mailbox-test: free channels on probe error - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: sprd: clear delivery flag before handling TX done - mailbox: sprd: mask interrupts that are not handled - mailbox: Use dev_err when there is error - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use of_property_match_string() instead of open-coding - mctp: i2c: fix skb memory leak in receive path - mctp i2c: initialise event handler read bytes - mctp: route: hold key->lock in mctp_flow_prepare_output() - md/bitmap: fix GPF in write_page caused by resize race - md-cluster: fix NULL pointer dereference in process_metadata_update - md/raid10: fix any_working flag handling in raid10_sync_request - md/raid10: fix deadlock with check operation and nowait requests - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - md/raid1: fix data lost for writemostly rdev - md/raid1,raid10: don't ignore IO flags - md/raid5: fix soft lockup in retry_aligned_read() - md/raid5: validate payload size before accessing journal metadata - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - media: amphion: Fix race between m2m job_abort and device_run - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - media: ccs: Accommodate C-PHY into the calculation - media: ccs: Avoid possible division by zero - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: dvb-core: dmxdevfilter must always flush bufs - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - media: dvb-net: fix OOB access in ULE extension header tables - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - media: i2c: imx412: Assert reset GPIO during probe - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix digital gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c: ov08d10: fix image vertical start setting - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Initialize subdev before controls - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex - media: mediatek: encoder: Fix uninitialized scalar variable issue - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: mediatek: vcodec: fix use-after-free in encoder release path - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - media: omap3isp: drop the use count of v4l2 pipeline - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - media: omap3isp: set initial format - media: pci: zoran: fix potential memory leak in zoran_probe() - media: pvrusb2: fix URB leak in pvr2_send_request_ex - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: radio-keene: fix memory leak in error path - media: rc: fix race between unregister and urb/irq callbacks - media: rc: igorplugusb: fix control request setup packet - media: rc: igorplugusb: heed coherency rules - media: rc: streamzap: Error handling in probe - media: rc: ttusbir: fix inverted error logic - media: rc: ttusbir: respect DMA coherency rules - media: rc: xbox_remote: heed DMA restrictions - media: rkisp1: Fix filter mode register configuration - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - media: saa7164: add ioremap return checks and cleanups - media: solo6x10: Check for out of bounds chip_id - media: staging: imx: request mbus_config in csi_start - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - media: uvcvideo: Enable VB2_DMABUF for metadata stream - media: uvcvideo: Fix allocation for small frame sizes - media: v4l2-async: Fix error handling on steps after finding a match - media: venus: vdec: fix error state assignment for zero bytesused - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: verisilicon: AV1: Fix enable cdef computation - media: verisilicon: AV1: Fix tile info buffer size - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Set IDR flag for intra_only frame type - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - media: vidtv: fix nfeeds state corruption on start_streaming failure - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - media: vidtv: fix pass-by-value structs causing MSAN warnings - memfd: deny writeable mappings when implying SEAL_WRITE - memory: mtk-smi: Convert to platform remove callback returning void - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: tegra124-emc: Fix dll_change check - memory: tegra30-emc: Fix dll_change check - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - mfd: core: Add locking around 'mfd_of_node_list' - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - mfd: wm8350-core: Use IRQF_ONESHOT - minix: Add required sanity checking to minix_check_superblock() - MIPS: Always record SEGBITS in cpu_data.vmbits - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - MIPS: Fix the GCC version check for `__multi3' workaround - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - mips: mm: Allocate tlb_vpn array atomically - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - mips: ralink: update CPU clock index - MIPS: rb532: Fix MMIO UART resource registration - MIPS: Work around LLVM bug when gp is used as global register variable - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: possible double-free of cctx->remote_heap - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mmc: block: use single block write in retry - mmc: core: Avoid bitfield RMW for claim/retune flags - mmc: core: Fix host controller programming for fixed driver type - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - mmc: vub300: fix NULL-deref on disconnect - mm/damon/core: disallow time-quota setting zero esz - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: use time_in_range_open() for damos quota window start - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/ops-common: call folio_test_lru() after folio_get() - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() - mm/highmem: fix __kmap_to_page() build error - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - mm/huge_memory: update file PMD counter before folio_put() - mm/hugetlb: avoid false positive lockdep assertion - mm/hugetlb_cma: round up per_node before logging it - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() - mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - mm/kasan: fix double free for kasan pXds - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mm/kfence: fix KASAN hardware tag faults during late enablement - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - mm/mempolicy: fix wrong mmap_read_unlock() in migrate_to_node() - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - mm/page_alloc: clear page->private in free_pages_prepare() - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - mm/tracing: rss_stat: ensure curr is false from kthread context - modpost: Amend ppc64 save/restfpr symnames for -Os build - module: add helper function for reading module_buildid() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - module: Fix kernel panic when a symbol st_shndx is out of bounds - mpls: add missing unregister_netdevice_notifier to mpls_init - mptcp: add-addr: always drop other suboptions - mptcp: allow subflow rcv wnd to shrink - mptcp: cleanup fallback dummy mapping generation - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: do not drop partial packets - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - mptcp: fastclose msk when linger time is 0 - MPTCP: fix lock class name family in pm_nl_create_listen_socket - mptcp: fix missing wakeups in edge scenarios - mptcp: fix receive space timestamp initialization - mptcp: fix retransmission loop when csum is enabled - mptcp: fix rx timestamp corruption on fastopen - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: fix slab-use-after-free in __inet_lookup_established - mptcp: handle first subflow closing consistently - mptcp: introduce the mptcp_init_skb helper - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: fix potential data-race - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: avoid sending RM_ADDR over same subflow - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation - mptcp: pm: in-kernel: always mark signal+subflow endp as used - mptcp: pm: in-kernel: always set ID as avail when rm endp - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: reset rcv wnd on disconnect - mptcp: sockopt: check timestamping ret value - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: sync the msk->sndbuf at accept() time - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use plain bool instead of custom binary enum - mtd: Avoid boot crash in RedBoot partition table parser - mtd: docg3: Convert to platform remove callback returning void - mtd: docg3: fix use-after-free in docg3_release() - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - mtd: physmap_of_gemini: Fix disabled pinctrl state check - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - mtd: rawnand: pl353: Fix software ECC support - mtd: rawnand: pl353: make sure optimal timings are applied - mtd: rawnand: serialize lock/unlock against other NAND operations - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: spinand: Fix kernel doc - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - mtd: spi-nor: sst: Fix SST write failure - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - myri10ge: avoid uninitialized variable use - neighbour: add RCU protection to neigh_tables[] - neigh: let neigh_xmit take skb ownership - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - net: add proper RCU protection to /proc/net/ptype - net: Add skb_dstref_steal and skb_dstref_restore - net: add support for segmenting TCP fraglist GSO packets - net: af_key: zero aligned sockaddr tail in PF_KEY exports - net: ag71xx: check error for platform_get_irq - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - net: annotate data-races around sk->sk_{data_ready,write_space} - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: fix leaking free_bds - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - net: bcmgenet: fix racing timeout handler - net: bcmgenet: increase WoL poll timeout - net: bcmgenet: Initialize u64 stats seq counter - net: bcmgenet: keep RBUF EEE/PM disabled - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: switch to use 64bit statistics - net: bonding: add broadcast_neighbor option for 802.3ad - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - net: bonding: fix NULL deref in bond_debug_rlb_hash_show - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - net: bonding: fix use-after-free in bond_xmit_broadcast() - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: bridge: Flush multicast groups when snooping is disabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net: bridge: use a stable FDB dst snapshot in RCU readers - net: caif: clear client service pointer on teardown - netconsole: avoid out-of-bounds access on empty string in trim_newline() - netconsole: propagate device name truncation in dev_name_store() - net: consume xmit errors of GSO frames - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - netdevsim: zero initialize struct iphdr in dummy sk_buff - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: dsa: microchip: Fix error path in PTP IRQ setup - net: dsa: mt7530: fix FDB entries not aging out with short timeout - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: properly keep track of conduit reference - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - net: enetc: fix the output issue of 'ethtool --show-ring' - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - net: ethernet: xscale: Check for PTP support properly - net: fec: fix pinctrl default state restore order on resume - net: fec: fix the PTP periodic output sysfs interface - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: bpf: defer hook memory release until rcu readers are done - netfilter: bridge: make ebt_snat ARP rewrite writable - netfilter: conntrack: add missing netlink policy validations - netfilter: conntrack_irc: fix possible out-of-bounds read - netfilter: conntrack: remove sprintf usage - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - netfilter: ctnetlink: ensure safe access to master conntrack - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() - netfilter: ctnetlink: ignore explicit helper on new expectations - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: ctnetlink: use netlink policy range checks - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: flowtable: strictly check for maximum number of actions - netfilter: ip6t_eui64: reject invalid MAC header for all packets - netfilter: ip6t_hbh: reject oversized option lists - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() - netfilter: ipset: drop logically empty buckets in mtype_del - netfilter: ipset: stop hash:* range iteration at end - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: nf_conncount: fix tracking of connections from localhost - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - netfilter: nf_conntrack_expect: honor expectation helper field - netfilter: nf_conntrack_expect: skip expectations in other netns via proc - netfilter: nf_conntrack_expect: store netns and zone in expectation - netfilter: nf_conntrack_expect: use expect->helper - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case - netfilter: nf_conntrack_helper: pass helper to expect cleanup - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp - netfilter: nf_conntrack_sip: get helper before allocating expectation - netfilter: nf_log: validate MAC header was set before dumping it - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_log: account for netlink header size - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: nf_tables: always walk all pending catchall elements - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - netfilter: nf_tables: reject immediate NF_QUEUE verdict - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: nf_tables: reset table validation state on abort - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_ct: add seqadj extension for natted connections - netfilter: nft_ct: bail out on template ct in get eval - netfilter: nft_ct: drop pending enqueued packets on removal - netfilter: nft_ct: fix missing expect put in obj eval - netfilter: nft_ct: fix use-after-free in timeout object destroy - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: nft_inner: Fix IPv6 inner_thoff desync - netfilter: nft_osf: restrict it to ipv4 - netfilter: nft_set_hash: fix get operation on big endian - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_tunnel: fix use-after-free on object destroy - netfilter: reject zero shift in nft_bitwise - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: skip recording stale or retransmitted INIT - netfilter: synproxy: add mutex to guard hook reference counting - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: x_tables: ensure names are nul-terminated - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: xtables: restrict several matches to inet family - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - netfilter: x_tables: unregister the templates first - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - netfilter: xt_multiport: validate range encoding in checkentry - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - netfilter: xt_policy: fix strict mode inbound policy matching - netfilter: xt_socket: enable defrag after all other checks - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: xt_time: use unsigned int for monthday bit shift - net: fix fanout UAF in packet_release() via NETDEV_UP race - net: Fix icmp host relookup triggering ip_rt_bug - net: fix segmentation of forwarding fraglist GRO - netfs: fix error handling in netfs_extract_user_iter() - netfs: Fix overrun check in netfs_extract_user_iter() - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net: ftgmac100: fix ring allocation unwind on open failure - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - net: gro: don't merge zcopy skbs - net: gso: fix tcp fraglist segmentation after pull from frag_list - net: guard timestamp cmsgs to real error queue skbs - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix double free issue for tx spare buffer - net: hsr: defer node table free until after RCU readers - net: hsr: fix potential OOB access in supervision frame handling - net: hsr: fix VLAN add unwind on slave errors - net: ifb: report ethtool stats over num_tx_queues - net: intel: fix PCI device ID conflict between i40e and ipw2200 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: fix event ring index not programmed for IPA v5.0+ - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - net: ipv4: stop checking crypto_ahash_alignmask - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: ipv6: flowlabel: defer exclusive option free until RCU teardown - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak - net: ipv6: stop checking crypto_ahash_alignmask - net/iucv: fix locking in .getsockopt - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - netlabel: validate unlabeled address and mask attribute lengths - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: lan966x: avoid unregistering netdev on register failure - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - net: libwx: fix VF illegal register access - net: macb: fix clk handling on PCI glue driver removal - net: macb: Fix tx/rx malfunction after phy link down and up - net: macb: fix uninitialized rx_fs_lock - net: macb: fix use-after-free access to PTP clock - net: macb: Introduce gem_init_rx_ring() - net: macb: Move devm_{free,request}_irq() out of spin lock area - net: macb: properly unregister fixed rate clocks - net: macb: queue tie-off or disable during WOL suspend - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume - net: macb: Shuffle the tx ring before enabling tx - net: macb: Use dev_consume_skb_any() to free TX SKBs - net: macb: use the current queue number for stats - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: mana: fix use-after-free in add_adev() error path - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown - net: mana: Ring doorbell at 4 CQ wraparounds - net: mana: validate rx_req_idx to prevent out-of-bounds array access - net: mctp: ensure our nlmsg responses are initialised - net: mctp: fix don't require received header reserved bits to be zero - net: mctp i2c: check length before marking flow active - net: mctp-i2c: fix duplicate reception of old data - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - net/mlx5: Avoid "No data available" when FW version queries fail - net/mlx5: Do not restore destination-less TC rules - net/mlx5: DR, Fix circular locking dependency in dump - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5e: Fix features not applied during netdev registration - net/mlx5e: Fix race condition during IPSec ESN update - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Prevent concurrent access to IPSec ASO context - net/mlx5: Fix deadlock between devlink lock and esw->wq - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: Fix multiport device check over light SFs - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/mlx5: IFC updates for disabled host PF - net/mlx5: lag: Check for LAG device before creating debugfs - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net/mlx5: Query to see if host PF is disabled - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - net/mlx5: Update the list of the PCI supported devices - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mv643xx: fix OF node refcount - net: mvpp2: Add metadata support for xdp mode - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - net: mvpp2: limit XDP frame size to the RX buffer - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: sync RX data at the hardware packet offset - net: ncsi: fix skb leak in error paths - net: netconsole: move newline trimming to function - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - net: nfc: nci: Fix parameter validation for packet data - net: nfc: nci: Fix zero-length proprietary notifications - netns-ipv4: reorganize netns_ipv4 fast path variables - net: openvswitch: Avoid releasing netdev before teardown completes - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - net: phonet: free phonet_device after RCU grace period - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: phy: clean the sfp upstream if phy probing fails - net: phy: dp83869: fix setting CLK_O_SEL field. - net: phy: DP83TC811: add reading of abilities - net: phy: move at803x PHY driver to dedicated directory - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: qrtr: ns: Fix use-after-free in driver remove() - net: qrtr: ns: Free the node during ctrl_cmd_bye() - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: qrtr: ns: Limit the total number of nodes - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - net: rds: clear i_sends on setup unwind - net/rds: Clear reconnect pending bit - net/rds: Fix circular locking dependency in rds_tcp_tune - net: rds: fix MR cleanup on copy error - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - net/rds: handle zerocopy send cleanup before the message is queued - net/rds: No shortcut out of RDS_CONN_ERROR - net/rds: Optimize rds_ib_laddr_check - net/rds: rds_sendmsg should not discard payload_len - net/rds: reset op_nents when zerocopy page pin fails - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: zero per-item info buffer before handing it to visitors - net: remove WARN_ON_ONCE when accessing forward path array - net: rfkill: prevent unlimited numbers of rfkill events from being created - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: sched: act_csum: validate nested VLAN headers - net/sched: act_ct: Only release RCU read lock after ct_ft - net/sched: act_gate: snapshot parameters with RCU on replace - net/sched: act_ife: Fix metalist update behavior - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - net/sched: cls_flower: revert unintended changes - net/sched: cls_flow: fix NULL pointer dereference on shared blocks - net/sched: cls_fw: fix NULL dereference of "old" filters before change() - net/sched: cls_fw: fix NULL pointer dereference on shared blocks - net/sched: ets: fix divide by zero in the offload path - net/sched: fix pedit partial COW leading to page cache corruption - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix probability gaps in 4-state loss model - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: validate slot configuration - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/sched: sch_netem: fix out-of-bounds access in packet corruption - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: taprio: fix NULL pointer dereference in class dump - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - net/sched: teql: Fix double-free in teql_master_xmit - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - net: sfp: improve Huawei MA5671a fixup - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net: skb: fix cross-cache free of KFENCE-allocated skb head - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - net: skbuff: fix pskb_carve leaking zcopy pages - net: skbuff: preserve shared-frag marker during coalescing - net: skbuff: propagate shared-frag marker through frag-transfer helpers - net: skmsg: preserve sg.copy across SG transforms - net/smc: avoid early lgr access in smc_clc_wait_msg - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - net/smc: Do not re-initialize smc hashtables - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - net: sparx5/lan969x: fix PTP clock max_adj value - net: stmmac: avoid shadowing global buf_sz - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz - net: stmmac: Fix error handling in VLAN add and delete paths - net: stmmac: fix integer underflow in chain mode - net: stmmac: Fix PTP ref clock for Tegra234 - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: remove support for lpi_intr_o - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: strparser: fix skb_head leak in strp_abort_strp() - net: sunhme: Fix sbus regression - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers - net: tcp: accept old ack during closing - net/tcp-md5: Fix MAC comparison to be constant-time - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net: tls: fix strparser anchor skb leak on offload RX setup failure - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption - net: tls: prevent chain-after-chain in plain text SG - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - net: txgbe: fix firmware version check - net: txgbe: fix RTNL assertion warning when remove module - net: txgbe: leave space for null terminators on property_entry - net: usb: aqc111: Do not perform PM inside suspend callback - net: usb: catc: enable basic endpoint checking - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - net: usb: kalmia: validate USB endpoints - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode - net: usb: kaweth: validate USB endpoints - net: usb: lan78xx: fix silent drop of packets with checksum errors - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: pegasus: enable basic endpoint checking - net: usb: pegasus: validate USB endpoints - net: usb: r8152: add TRENDnet TUC-ET2G - net: usb: r8152: fix transmit queue timeout - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: sr9700: remove code to drive nonexistent multicast filter - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - nexthop: fix IPv6 route referencing IPv4 nexthop - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - nfc: hci: fix out-of-bounds read in HCP header parsing - nfc: hci: shdlc: Stop timers and work before freeing context - nfc: llcp: add missing return after LLCP_CLOSED checks - nfc: llcp: Fix use-after-free in llcp_sock_release() - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: complete pending data exchange on device close - nfc: nci: fix circular locking dependency in nci_close_device - nfc: nci: free skb on nci_transceive early error paths - NFC: nxp-nci: allow GPIOs to sleep - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems - nfc: nxp-nci: remove interrupt trigger type - nfc: pn533: allocate rx skb before consuming bytes - NFC: pn533: bound the UART receive buffer - nfc: pn533: properly drop the usb interface reference on disconnect - nfc: rawsock: cancel tx_work before socket teardown - nfc: s3fwrn5: allocate rx skb before consuming bytes - NFC: trf7970a: Ignore antenna noise when checking for RF field - nfnetlink_osf: validate individual option lengths in fingerprints - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - nfsd: check get_user() return when reading princhashlen - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - nfsd: fix posix_acl leak on SETACL decode failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - NFSD: Fix SECINFO_NO_NAME decode error cleanup - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd - nfsd: never defer requests during idmap lookup - NFS: Fix a deadlock involving nfs_release_folio() - nfs: pass explicit offset/count to trace events - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - NTB: ntb_transport: Fix too small buffer for debugfs_name - ntfs3: add buffer boundary checks to run_unpack() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ntfs: ->d_compare() must not block - nvdimm/bus: Fix potential use after free in asynchronous initialization - nvdimm: virtio_pmem: serialize flush requests - nvme-apple: drop invalid put of admin queue reference count - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme: fix admin queue leak on controller reset - nvme: fix memory allocation in nvme_pr_read_keys() - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nvmem: imx: assign nvmem_cell_info::raw_len - nvmem: layouts: onie-tlv: fix hang on unknown types - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - nvme-pci: cap queue creation to used queues - nvme-pci: ensure we're polling a polled queue - nvme-pci: fix missed admin queue sq doorbell write - nvme-pci: Fix race bug in nvme_poll_irqdisable() - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - nvme: reject invalid pr_read_keys() num_keys values - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free - nvmet-tcp: fix race between ICReq handling and queue teardown - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - objtool: Fix Clang jump table detection - objtool: Handle Clang RSP musical chairs - objtool: Remove max symbol name length limitation - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2: fix listxattr handling when the buffer is full - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: fix possible deadlock between unlink and dio_end_io_write - ocfs2: fix reflink preserve cleanup issue - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: reject oversized group bitmap descriptors - ocfs2: split transactions in dio completion to avoid credit exhaustion - ocfs2: validate bg_bits during freefrag scan - ocfs2: validate group add input before caching - ocfs2: validate inline data i_size during inode read - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: disable per ring interrupts - octeon_ep: ensure dbell BADDR updation - octeon_ep: Relocate counter updates before NAPI - octeon_ep: restructured interrupt handlers - octeon_ep: set backpressure watermark for RX queues - octeon_ep: support Octeon CN10K devices - octeon_ep: support to fetch firmware info - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: CGX: fix bitmap leaks - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: Fix default entries mcam entry action - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - octeontx2-af: Fix PF driver crash with kexec kernel booting - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - octeontx2-af: replace deprecated strncpy with strscpy - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - octeontx2-pf: avoid double free of pool->stack on AQ init failure - octeontx2-pf: Unregister devlink on probe failure - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - of: unittest: fix use-after-free in testdrv_probe() - openrisc: define arch-specific version of nop() - openvswitch: cap upcall PID array size and pre-size vport replies - openvswitch: defer tunnel netdev_put to RCU release - openvswitch: validate MPLS set/set_masked payload length - openvswitch: vport: fix self-deadlock on release of tunnel ports - ovl: Fix uninit-value in ovl_fill_real - padata: Fix pd UAF once and for all - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove comment for reorder_work - padata: Remove cpu online check from cpu add and removal - params: Replace __modinit with __init_or_module - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - parisc: Fix IRQ leak in LASI driver - parisc: Flush correct cache in cacheflush() syscall - parisc: Increase initial mapping to 64 MB with KALLSYMS - parisc: kernel: replace kfree() with put_device() in create_tree_node() - parisc: _llseek syscall is only available for 32-bit userspace - parisc: Prevent interrupts during reboot - parport: Fix race between port and client registration - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI/AER: Clear only error bits in PCIe Device Status - PCI/AER: Stop ruling out unbound devices as error source - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - PCI: Do not attempt to set ExtTag for VFs - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Enable AtomicOps only if Root Port supports them - PCI: endpoint: Avoid creating sub-groups asynchronously - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup - PCI: endpoint: Remove unused field in struct pci_epf_group - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - PCI: Fix pci_slot_lock () device locking - PCI: Fix pci_slot_trylock() error handling - PCI: hv: Set default NUMA node to 0 for devices without affinity info - PCI: Initialize RCB from pci_configure_device() - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - PCI: Mark ASM1164 SATA controller to avoid bus reset - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI/MSI: Unmap MSI-X region on error - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - PCI/portdrv: Fix potential resource leak - PCI: Supply bridge device, not secondary bus, to read window details - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Fix polling delay for L2 state - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Use DWC IP core version - PCI: Update BAR # and window messages - PCI: Use resource names in PCI log messages - PCI: Use resource_set_range() that correctly sets ->end - PCMCIA: Fix garbled log messages for KERN_CONT - pcnet32: stop holding device spin lock during napi_complete_done - pds_core: add an error code check in pdsc_dl_info_get - pds_core: ensure null-termination for firmware version strings - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - perf/arm-cmn: Reject unsupported hardware configurations - perf/arm-cmn: Support CMN-600AE - perf: arm_spe: Properly set hw.state on failures - perf branch: Avoid incrementing NULL - perf callchain: Fix srcline printing with inlines - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf: Extract a few helpers - perf: Fix dangling cgroup pointer in cpuctx - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - perf lock: Fix option value type in parse_max_stack - perf: Make sure to use pmu_ctx->pmu for groups - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf unwind-libdw: Fix invalid reference counts - perf util: Kill die() prototype, dead for a long time - perf/x86/intel/uncore: Skip discovery table for offline dies - phonet: Pass ifindex to fill_addr(). - phonet: Pass net and ifindex to phonet_address_notify(). - phonet/pep: disable BH around forwarded sk_receive_skb() - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - phy: tegra: xusb: Fix per-pad high-speed termination calibration - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - pidfd: refuse access to tasks that have started exiting harder - pinctrl: abx500: Fix type of 'argument' variable - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - pinctrl: mediatek: common: Fix probe failure for devices without EINT - pinctrl: pinctrl-pic32: Fix resource leak - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - ping: annotate data-races in ping_lookup() - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - platform/chrome: cros_ec_lightbar: Fix response size initialization - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - platform/surface: surfacepro3_button: Drop wakeup source on remove - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro - platform/x86/amd/pmc: Add support for Van Gogh SoC - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - platform/x86: classmate-laptop: Add missing NULL pointer checks - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: hp-bioscfg: Support allocations of larger data - platform/x86: hp-wmi: Ignore backlight and FnLock events - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery - platform/x86: ISST: Correct locked bit width - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - platform/x86: panasonic-laptop: Fix sysfs group leak in error path - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - pmdomain: bcm: bcm2835-power: Fix broken reset status read - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - pmdomain: core: Fix detach procedure for virtual devices in genpd - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - PM: hibernate: Don't ignore return from set_memory_ro() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: runtime: Fix a race condition related to device removal - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - pNFS: Fix a deadlock when returning a delegation during open() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - pNFS: Fix use-after-free in pnfs_update_layout() - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - powerpc64/bpf: do not increment tailcall count when prog is NULL - powerpc: 83xx: km83xx: Fix keymile vendor prefix - powerpc/crash: fix backup region offset update to elfcorehdr - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - powerpc/warp: Fix error handling in pika_dtm_thread - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: ab8500: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: axp288_charger: Do not cancel work before initializing it - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: max17042: avoid overflow when determining health - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - pppoe: drop PFC frames - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - printk: add print_hex_dump_devel() - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - pstore: ram_core: fix incorrect success return when vmap() fails - pstore/ram: fix buffer overflow in persistent_ram_save_old() - pstore/ram: fix resource leak when ioremap() fails - ptp: vclock: Switch from RCU to SRCU - ptrace: Convert ptrace_attach() to use lock guards - ptrace: slightly saner 'get_dumpable()' logic - pwm: imx-tpm: Count the number of enabled channels in probe - qed: fix double free in qed_cxt_tables_alloc() - quota: fix livelock between quotactl and freeze_super - quota: Fix race of dquot_scan_active() with quota deactivation - r8152: fix incorrect register write to USB_UPHY_XTAL - r8152: handle the return value of usb_reset_device() - randomize_kstack: Maintain kstack_offset per task - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - rbd: fix null-ptr-deref when device_add_disk() fails - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: s/boost_kthread_mutex/kthread_mutex - RDMA/bnxt_re: zero shared page before exposing to userspace - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - RDMA/core: Fix a couple of obvious typos in comments - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - RDMA/core: Prefer NLA_NUL_STRING - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - RDMA/efa: Fix typo in efa_alloc_mr() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - RDMA/hns: Fix WQ_MEM_RECLAIM warning - RDMA/hns: Notify ULP of remaining soft-WCs during reset - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Fix double free related to rereg_user_mr - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - RDMA/irdma: Initialize free_qp completion before using it - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - RDMA/mana_ib: Disable RX steering on RSS QP destroy - RDMA/mana: Validate rx_hash_key_len - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - RDMA: Move DMA block iterator logic into dedicated files - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/rtrs-clt: For conn rejection use actual err number - RDMA/rtrs: Fix use-after-free in path file creation cleanup - RDMA/rtrs: server: remove dead code - RDMA/rtrs-srv: fix SG mapping - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - RDMA/siw: Fix potential NULL pointer dereference in header processing - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - RDMA/srp: bound SRP_RSP sense copy by the received length - RDMA/umad: Reject negative data_len in ib_umad_write - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/umem: fix kernel-doc warnings - RDMA/umem: Fix truncation for block sizes >= 4G - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - rds: ib: reject FRMR registration before IB connection is established - rds: mark snapshot pages dirty in rds_info_getsockopt() - regmap: Synchronize cache for the page selector - regset: use kvzalloc() for regset_get_alloc() - regulator: act8945a: fix OF node reference imbalance - regulator: bd9571mwv: fix OF node reference imbalance - regulator: core: fix locking in regulator_resolve_supply() error path - regulator: core: move supply check earlier in set_machine_constraints() - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - regulator: pca9450: Correct interrupt type - regulator: pca9450: Make IRQ optional - regulator: rk808: fix OF node reference imbalance - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - remoteproc: imx_rproc: Fix invalid loaded resource table detection - remoteproc: mediatek: Break lock dependency to `prepare_lock` - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - remoteproc: xlnx: Only access buffer information if IPI is buffered - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - resource: Add resource set range and size helpers - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "ALSA: usb: Increase volume range that triggers a warning" - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - Revert "crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx" - Revert "crypto: nx - fix context leak in nx842_crypto_free_ctx" - Revert "crypto: nx - Migrate to scomp API" - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" - Revert "ice: fix double-free of tx_buf skb" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "mfd: da9052-spi: Change read-mask to write-mask" - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - Revert "mptcp: add needs_id for netlink appending addr" - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - Revert "perf unwind-libdw: Fix invalid reference counts" - Revert "ptp: add testptp mask test" - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" - Revert "tcpm: allow looking for role_sw device in the main node" - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - Revert "wireguard: device: enable threaded NAPI" - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - Revert "x86/vdso: Fix output operand size of RDPID" - Revert "xattr: switch to CLASS(fd)" - ring-buffer: Fix reporting of missed events in iterator - ring-buffer: Remove ring_buffer_read_prepare_sync() - riscv: kgdb: fix several debug register assignment bugs - riscv: Sanitize syscall table indexing under speculation - rnbd-srv: Zero the rsp buffer before using it - romfs: check sb_set_blocksize() return value - rpmsg: char: Fix use-after-free on probe error path - rpmsg: core: fix race in driver_override_show() and use core helper - rseq: Clarify rseq registration rseq_size bound check comment - rtc: abx80x: Disable alarm feature if no interrupt attached - rtc: interface: Alarm race handling should not discard preceding error - rtc: ntxec: fix OF node reference imbalance - rtc: zynqmp: correct frequency value - rtmutex: Use waiter::task instead of current in remove_waiter() - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - rust: kunit: fix warning when !CONFIG_PRINTK - rust: pin-init: add references to previously initialized fields - rust: pin-init: internal: init: document load-bearing fact of field accessors - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix anonymous key handling - rxrpc: Fix call removal to use RCU safe deletion - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - rxrpc: Fix data-race warning and potential load/store tearing - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: Fix key quota calculation for multitoken keys - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix memory leaks in rxkad_verify_response() - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - rxrpc: Fix potential UAF after skb_unshare() failure - rxrpc: Fix recvmsg() unconditional requeue - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix the ACK parser to extract the SACK table for parsing - rxrpc: only handle RESPONSE during service challenge - rxrpc: Only put the call ref if one was acquired - rxrpc: reject undecryptable rxkad response tickets - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - s390/cio: make sch->lock spinlock pointer a member - s390/cio: use generic driver_override infrastructure - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - s390/debug: Reject zero-length input before trimming a newline - s390/debug: Reject zero-length input in debug_input_flush_fn() - s390/entry: Scrub r12 register on kernel entry - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - s390/pci: Handle futile config accesses of disabled devices directly - s390/perf: Disable register readout on sampling events - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/syscalls: Add spectre boundary for syscall dispatch table - s390/xor: Fix xor_xc_2() inline assembly constraints - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - sched/fair: Fix pelt clock sync when entering idle - sched: idle: Consolidate the handling of two special cases - sched: idle: Make skipping governor callbacks more consistent - sched/rt: Skip currently executing CPU in rto_next_cpu() - sched: Use u64 for bandwidth ratio calculations - scripts/dtc: Remove unused dts_version in dtc-lexer.l - scripts: generate_rust_analyzer.py: avoid FD leak - scripts: generate_rust_analyzer.py: define scripts - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Have mcount rela sort use direct values - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused macro defines - scripts/sorttable: Remove unused write functions - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Zero out weak functions in mcount_loc table - scsi: buslogic: Reduce stack usage - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - scsi: csiostor: Fix dereference of null pointer rn - scsi: efct: Use IRQF_ONESHOT and default primary handler - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec - scsi: hisi_sas: Fix NULL pointer exception during user_scan() - scsi: hisi_sas: Use macro instead of magic number - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - scsi: isci: Fix use-after-free in device removal path - scsi: lpfc: Properly set WC for DPP mapping - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: qla2xxx: Fix bsg_done() causing double free - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - scsi: ses: Fix devices attaching to different hosts - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - scsi: target: core: Fix integer overflow in UNMAP bounds check - scsi: target: Fix recursive locking in __configfs_open_file() - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: tcm_loop: Drain commands in target_reset handler - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix use-after free in init error and remove paths - scsi: ufs: core: Flush exception handling work when RPM level is zero - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - scsi: ufs: host: mediatek: Require CONFIG_PM - sctp: diag: reject stale associations in dump_one path - sctp: discard stale INIT after handshake completion - sctp: fix missing encap_port propagation for GSO fragments - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - sctp: fix race between sctp_wait_for_connect and peeloff - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - sctp: purge outqueue on stale COOKIE-ECHO handling - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - sctp: stream: fully roll back denied add-stream state - security/keys: fix missed RCU read section on lookup - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - seg6: separate dst_cache for input and output paths in seg6 lwtunnel - selftest/arm64: Fix sve2p1_sigill() to hwcap test - selftest: memcg: skip memcg_sock test if address family not supported - selftests/bpf: add stack access precision test - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: veristat: fix printing order in output_stats() - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests/memfd: delete unused declarations - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - selftests/mm: skip migration tests if NUMA is unavailable - selftests: mptcp: add a check for 'add_addr_accepted' - selftests: mptcp: add test for extra_subflows underflow on userspace PM - selftests: mptcp: drop nanoseconds width specifier - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: join: check RM_ADDR not sent over same subflow - selftests: mptcp: more stable simult_flows tests - selftests/mqueue: Fix incorrectly named file - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - selftests/powerpc: Re-order *FLAGS to follow lib.mk - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selinux: don't reserve xattr slot when we won't fill it - selinux: fix overlayfs mmap() and mprotect() access checks - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - serdev: make serdev_bus_type const - serdev: Provide a bustype shutdown function - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_dw: handle clock enable errors in runtime_resume - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: 8250: Fix TX deadlock when using DMA - serial: 8250_pci: add support for the AX99100 - serial: altera_jtaguart: handle uart_add_one_port() failures - serial: caif: fix use-after-free in caif_serial ldisc_close() - serial: caif: hold tty->link reference in ldisc_open and ser_release - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: imx: change SERIAL_IMX_CONSOLE to bool - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: samsung_tty: Use port lock wrappers - serial: sh-sci: fix memory region release in error path - serial: SH_SCI: improve "DMA support" prompt - serial: uartlite: fix PM runtime usage count underflow on probe - serial: zs: Convert to use a platform device - serial: zs: Fix bootconsole handover lockup - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: zs: Switch to using channel reset - sfc: fix error code in efx_devlink_info_running_versions() - sh: platform_early: remove pdev->driver_override check - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: fix OF node refcount - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - smb: client: add proper locking around ses->iface_last_update - smb: client: Compare MACs in constant time - smb: client: correctly handle ErrorContextData as a flexible array - smb: client: correct value for smbd_max_fragmented_recv_size - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - smb: client: fix atomic open with O_DIRECT & O_SYNC - smb: client: fix broken multichannel with krb5+signing - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb: client: fix cifs_pick_channel when channels are equally loaded - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - smb: client: fix krb5 mount with username option - smb: client: fix off-by-8 bounds check in check_wsl_eas() - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path - smb: client: fix OOB reads parsing symlink error response - smb/client: fix out-of-bounds read in smb2_compound_op() - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix possible infinite loop and oob read in symlink_data() - smb: client: fix potential UAF and double free in smb2_open_file() - smb: client: prevent races in ->query_interfaces() - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - smb: client: reject userspace cifs.spnego descriptions - smb: client: require a full NFS mode SID before reading mode bits - smb: client: require net admin for CIFS SWN netlink - smb: client: Use FullSessionKey for AES-256 encryption key derivation - smb: client: use kzalloc to zero-initialize security descriptor buffer - smb: client: validate dacloffset before building DACL pointers - smb: client: validate the whole DACL before rewriting it in cifsacl - smb: common: change the data type of num_aces to le16 - smb: move some duplicate definitions to common/smbacl.h - smb: server: fix active_num_conn leak on transport allocation failure - smb/server: Fix another refcount leak in smb2_open() - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix use-after-free in smb2_open() - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - soc: fsl: qbman: fix race condition in qman_destroy_fq - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - soc: qcom: llcc: fix v1 SB syndrome register offset - soc: qcom: ocmem: make the core clock optional - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: smem: handle ENOMEM error during probe - soc/tegra: cbb: Set ERD on resume for err interrupt - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - soc: ti: k3-socinfo: Fix regmap leak on probe failure - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - sound: ua101: fix division by zero at probe - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - soundwire: cadence: Clear message complete before signaling waiting thread - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - spi: at91-usart: fix controller deregistration - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: cadence: fix controller deregistration - spi: cadence: fix unclocked access on unbind - spi: coldfire-qspi: fix controller deregistration - spi: dln2: fix controller deregistration - spi: fix resource leaks on device setup failure - spi: fix statistics allocation - spi: fix use-after-free on controller registration failure - spi: fsl-espi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: fsl-qspi: Use reinit_completion() for repeated operations - spi: geni-qcom: Check DMA interrupts early in ISR - spi-geni-qcom: initialize mode related registers to 0 - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - spi: img-spfi: fix controller deregistration - spi: imx: fix runtime pm leak on probe deferral - spi: imx: fix use-after-free on unbind - spi: intel-pci: Add support for Nova Lake mobile SPI flash - spi: lantiq-ssc: fix controller deregistration - spi: meson-spicc: Fix double-put in remove path - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - spi: mpc52xx: fix use-after-free on unbind - spi: mtk-nor: fix controller deregistration - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - spi: omap2-mcspi: fix controller deregistration - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: qup: fix controller deregistration - spi: qup: fix error pointer deref after DMA setup failure - spi: rockchip: fix controller deregistration - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - spi: rspi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: s3c64xx: fix NULL-deref on driver unbind - spi: sh-hspi: fix controller deregistration - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - spi: spidev: fix lock inversion between spi_lock and buf_lock - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: spi-ti-qspi: switch to use modern name - spi: sprd: fix controller deregistration - spi: sprd: fix error pointer deref after DMA setup failure - spi: stm32: fix Overrun issue at < 8bpw - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - spi: tegra114: fix controller deregistration - spi: tegra20-sflash: fix controller deregistration - spi: ti-qspi: fix controller deregistration - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: tools: Add include folder to .gitignore - spi: topcliff-pch: fix use-after-free on unbind - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - spi: zynqmp-gqspi: fix controller deregistration - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - Squashfs: check metadata block offset is within range - staging: greybus: lights: avoid NULL deref - staging: media: atomisp: Disallow all private IOCTLs - staging: rtl8723bs: fix memory leak on failure path - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - staging: rtl8723bs: fix null dereference in find_network - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() - staging: sm750fb: fix division by zero in ps_to_hz() - staging: vme_user: fix root device leak on init failure - string: add mem_is_zero() helper to check if memory area is all zeros - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - sunrpc: fix cache_request leak in cache_release - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Remove queue-shortening warnings - sysctl: fix uninitialized variable in proc_do_large_bitmap - sysfs: don't remove existing directory on update failure - tap: free page on error paths in tap_get_user_xdp() - taskstats: set version in TGID exit notifications - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: call sk_data_ready() after listener migration - tcp: defer regular ACK while processing socket backlog - tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. - tcp: Fix imbalanced icsk_accept_queue count. - tcp: optimize inet_use_bhash2_on_bind() - tcp: Rearrange tests in inet_csk_bind_conflict(). - tcp: restrict SO_ATTACH_FILTER to priv users - tcp: Set pingpong threshold via sysctl - tcp: tcp_tx_timestamp() must look at the rtx queue - tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. - tee: optee: prevent use-after-free when the client exits before the supplicant - test_kprobes: clear kprobes between test runs - tg3: Fix race for querying speed/duplex - tg3: replace placeholder MAC address with device property - thermal: core: Fix thermal zone device registration error path - thermal: core: Fix thermal zone governor cleanup issues - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - thermal: int340x: Fix sysfs group leak on DLVR registration failure - thunderbolt: Bound root directory content to block size - thunderbolt: Clamp XDomain response data copy to allocation size - thunderbolt: Fix property read in nhi_wake_supported() - thunderbolt: Limit XDomain response copy to actual frame size - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - thunderbolt: Reject zero-length property entries in validator - thunderbolt: Validate XDomain request packet size before type cast - time: Fix off-by-one in settimeofday() usec validation - time/jiffies: Mark jiffies_64_to_clock_t() notrace - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG - tipc: fix divide-by-zero in tipc_sk_filter_connect() - tipc: fix double-free in tipc_buf_append() - tipc: fix duplicate publication key in tipc_service_insert_publ() - tipc: fix RCU dereference race in tipc_aead_users_dec() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - tls: Preserve sk_err across recvmsg() when data has been copied - tls: Purge async_hold in tls_decrypt_async_wait() - tools/accounting: handle truncated taskstats netlink messages - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - tools: Fix bitfield dependency failure - tools/power cpupower: Reset errno before strtoull() - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - tools/rv: Fix cleanup after failed trace setup - tpm: avoid -Wunused-but-set-variable - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - tpm: tpm_tis: add error logging for data transfer - tpm: tpm_tis: stop transmit if retries are exhausted - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() - tracing: Add NULL pointer check to trigger_data_free() - tracing: Add recursion protection in kernel stack trace recording - tracing: Avoid NULL return from hist_field_name() on truncation - tracing: branch: Fix inverted check on stat tracer registration - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - tracing: Fix checking of freed trace_event_file for hist files - tracing: Fix false sharing in hwlat get_sample() - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Fix syscall events activation by ensuring refcount hits zero - tracing: Fix to set write permission to per-cpu buffer_size_kb - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - tracing/probe: reject non-closed empty immediate strings - tracing/probes: Limit size of event probe to 3K - tracing/probes: Point the error offset correctly for eprobe argument error - tracing: Properly process error handling in event_hist_trigger_parse() - tracing: Rebuild full_name on each hist_field_name() call - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Switch trace_osnoise.c code over to use guard() and __free() - tracing: Wake up poll waiters for hist files when removing an event - tty: hvc_iucv: fix off-by-one in number of supported devices - tty: serial: pch_uart: add check for dma_alloc_coherent() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - tun: free page on build_skb failure in tun_xdp_one() - tun: free page on short-frame rejection in tun_xdp_one() - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - ublk: Validate SQE128 flag before accessing the cmd - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - udf: fix partition descriptor append bookkeeping - udf: reject descriptors with oversized CRC length - udp: clear skb->dev before running a sockmap verdict - udp: Fix wildcard bind conflict check when using hash2 - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n - um: drivers: call kernel_strrchr() explicitly in cow_user.c - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - unshare: fix unshare_fs() handling - USB: add QUIRK_NO_BOS for video capture several devices - usb: bdc: fix sleep during atomic - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() - usb: cdns3: fix role switching during resume - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue - usb: cdns3: gadget: fix request skipping after clearing halt - usb: cdns3: gadget: fix state inconsistency on gadget init failure - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: remove redundant if branch - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: core: convert ci_role_switch to local variable - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: class: cdc-wdm: fix reordering issue in read code path - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: core: Fix SuperSpeed root hub wMaxPacketSize - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - USB: core: Limit the length of unkillable synchronous timeouts - usb: core: new quirk to handle devices with zero configurations - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - usb: dwc2: fix resume failure if dr_mode is host - usb: dwc2: Fix use after free in debug code - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: dwc3: gadget: Move vbus draw to workqueue context - usb: dwc3: Move GUID programming after PHY initialization - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: ehci-brcm: fix sleep during atomic - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - usb: gadget: f_ncm: Fix net_device lifecycle with device_move - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: net2280: Fix double free in probe error path - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: image: mdc800: kill download URB on timeout - usbip: validate number_of_packets in usbip_pack_ret_submit() - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: mdc800: handle signal and read racing - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - USB: omap_udc: DMA: Don't enable burst 4 mode - usb: port: add delay after usb_hub_set_port_power() - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - USB: serial: belkin_sa: validate interrupt status length - USB: serial: cypress_m8: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: digi_acceleport: fix memory corruption with small endpoints - USB: serial: f81232: fix incomplete serial port generation - USB: serial: io_edgeport: add support for Blackbox IC135A - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - USB: serial: io_ti: fix heap overflow in get_manuf_info() - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: kl5kusb105: fix bulk-out buffer overflow - USB: serial: mct_u232: fix memory corruption with small endpoint - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: option: add MeiG Smart SRM825WN - USB: serial: option: add MeiG SRM813Q - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: option: add Telit Cinterion FN990A MBIM composition - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: serial: option: add Telit FN920C04 RNDIS compositions - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: storage: Add quirks for PNY Elite Portable SSD - usb: storage: Expand range of matched versions for VL817 quirks entry - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: tcpm: reset internal port states on soft reset AMS - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - usb: typec: ucsi: Check if power role change actually happened before handling - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: Don't update power_supply on power role change if not connected - usb: typec: ucsi: Move unregister out of atomic section - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - usb: typec: ucsi: validate connector number in ucsi_connector_change() - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: ulpi: fix double free in ulpi_register_interface() error path - usb: ulpi: fix memory leak on ulpi_register() error paths - USB: usbcore: Introduce usb_bulk_msg_killable() - usb: usblp: fix heap leak in IEEE 1284 device ID via short response - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts - usb: xhci: Fix memory leak in xhci_disable_slot() - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - usb: xhci: Prevent interrupt storm on host controller error (HCE) - usb: yurex: fix race in probe - userfaultfd: allow registration of ranges below mmap_min_addr - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - vfio: Create vfio_fs_type with inode per device - vfio/pci: Insert full vma on mmap'd MMIO fault - vfio/pci: Use unmap_mapping_range() - vhost: fix caching attributes of MMIO regions by setting them explicitly - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - virtiofs: fix UAF on submount umount - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false - virt: vbox: uapi: Mark inner unions in packed structs as packed - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - vrf: Fix a potential NPD when removing a port from a VRF - vsock: fix buffer size clamping order - vsock: keep poll shutdown state consistent - vsock/virtio: fix accept queue count leak on transport mismatch - vsock/virtio: fix length and offset in tap skb for split packets - vsock/virtio: reset connection on receiving queue overflow - vsock/vmci: fix sk_ack_backlog leak on failed handshake - vsock/vmci: fix UAF when peer resets connection during handshake - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - vxlan: validate ND option lengths in vxlan_na_create - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - watchdog: imx7ulp_wdt: handle the nowayout option - watchdog: starfive-wdt: Fix PM reference leak in probe error path - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - wifi: ath11k: clear shared SRNG pointer state on restart - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - wifi: ath11k: fix warning when unbinding - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: skip status ring entry processing - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath5k: do not access array OOB - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: brcmfmac: Fix error pointer dereference - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: brcmfmac: validate bsscfg indices in IF events - wifi: brcmsmac: Fix dma_free_coherent() size - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - wifi: cfg80211: wext: fix IGTK key ID off-by-one - wifi: cw1200: Fix locking in error paths - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - wifi: iwlwifi: mvm: check the validity of noa_len - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: libertas: fix use-after-free in lbs_free_adapter() - wifi: libertas: fix WARNING in usb_tx_block - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: mac80211: fix NULL deref in mesh_matches_local() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. - wifi: mac80211: remove station if connection prep fails - wifi: mac80211: set default WMM parameters on all links - wifi: mt76: connac: introduce helper for mt7925 chipset - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7921: fix a potential clc buffer length underflow - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - wifi: nl80211: reject oversized EMA RNR lists - wifi: radiotap: reject radiotap with unknown bits - wifi: rsi: fix kthread lifetime race between self-exit and external-stop - wifi: rt2x00usb: fix devres lifetime - wifi: rtl8xxxu: fix potential use of uninitialized value - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: check for PCI upstream bridge existence - wifi: rtw88: fix device leak on probe failure - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw89: pci: restore LDO setting after device resume - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - wifi: wl1251: validate packet IDs before indexing tx_frames - wifi: wlcore: Fix a locking bug - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom - wireguard: send: append trailer after expanding head - workqueue: Factor out assign_rescuer_work() - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - workqueue: Only assign rescuer work when really needed - workqueue: Process rescuer work items one-by-one using a cursor - X.509: Fix out-of-bounds access when parsing extensions - x86/apic: Disable x2apic on resume if the kernel expects so - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - x86/CPU: Fix FPDSS on Zen1 - x86/efi: defer freeing of boot services memory - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/hyperv: Fix error pointer dereference - x86/kexec: add a sanity check on previous kernel's ima kexec buffer - x86/kexec: Copy ACPI root pointer address from config table - x86/kexec: Disable KCOV instrumentation after load_segments() - x86/platform/uv: Handle deconfigured sockets - x86/sev: Allow IBPB-on-Entry feature for SNP guests - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - x86: shadow stacks: proper error handling for mmap lock - x86/shstk: Prevent deadlock during shstk sigreturn - x86/uprobes: Fix XOL allocation failure for 32-bit tasks - x86/xen: Fix xen_e820_swap_entry_with_ram() - x86/xen: make some functions static - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - xattr: switch to CLASS(fd) - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - xenbus: Use .freeze/.thaw to handle xenbus devices - xen-netback: reject zero-queue configuration from guest - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: fix double free via VMA splitting - xen/privcmd: restrict usage in unprivileged domU - xen/virtio: Don't use grant-dma-ops when running as Dom0 - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - xfrm: ah: account for ESN high bits in async callbacks - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - xfrm: call xdo_dev_state_delete during state update - xfrm: Check for underflow in xfrm_state_mtu - xfrm: clear trailing padding in build_polexpire() - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: esp: avoid in-place decrypt on shared skb frags - xfrm: espintcp: do not reuse an in-progress partial send - xfrm: esp: restore combined single-frag length gate - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path - xfrm: Fix the usage of skb->sk - xfrm: input: hold netns during deferred transport reinjection - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - xfrm: provide message size for XFRM_MSG_MAPPING - xfrm: route MIGRATE notifications to caller's netns - xfrm: skip templates check for packet offload tunnel mode - xfrm_user: fix info leak in build_mapping() - xfrm_user: fix info leak in build_report() - xfrm: Wait for RCU readers during policy netns exit - xfs: avoid dereferencing log items after push callbacks - xfs: delete attr leaf freemap entries when empty - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix a resource leak in xfs_alloc_buftarg() - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: fix integer overflow in bmap intent sort comparator - xfs: fix remote xattr valuelblk check - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: fix undersized l_iclog_roundoff values - xfs: mark data structures corrupt on EIO and ENODATA - xfs: save ailp before dropping the AIL lock in push callbacks - xfs: stop reclaim before pushing AIL during unmount - xhci: tegra: Fix ghost USB device on dual-role port unplug - xprtrdma: Decrement re_receiving on the early exit paths - xsk: Fix fragment node deletion to prevent buffer leak - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: Fix zero-copy AF_XDP fragment drop - xsk: Get rid of xdp_buff_xsk::xskb_list_node - xsk: introduce helper to determine rxq->frag_size - xsk: respect tailroom for ZC setups - xsk: s/free_list_node/list_node/ - xsk: tighten UMEM headroom validation to account for tailroom and min frame - xsk: validate MTU against usable frame size on bind - zonefs: handle integer overflow in zonefs_fname_to_fno - zram: do not forget to endio for partial discard requests - zram: fix use-after-free in zram_bvec_write_partial() - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Fix CIFSwitch vulnerability- FIX GPO Frag vulnerability- Fix PinTheft- Fix memory leak in AFS code- Fix CVE-2026-46300, CVE-2026-46333, CVE-2025-54518- Remove dead, not used patches- Fix Dirtyfrag- Fix CVE-2026-31431 (Copyfail)- Fix regression with touchpad on notebook Positron Proxima 15 and probably others (bz#19950) - https://bugzilla.rosa.ru/show_bug.cgi?id=19950- [bot] upd: 6.6.106 -> 6.6.126 - Changelog: - 6pack: drop redundant locking and refcounting - 9p: fix cache/debug options printing in v9fs_show_options - 9p: fix /sys/fs/9p/caches overwriting itself - 9p: sysfs_init: don't hardcode error to ENOMEM - accel/habanalabs/gaudi2: fix BMON disable configuration - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() - ACPI: battery: Add synchronization between interface updates - ACPI: battery: allocate driver data through devm_ APIs - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - acpi: Break out nesting for hmat_parse_locality() - ACPI: button: Call input_free_device() on failing input device registration - ACPICA: Allow to skip Global Lock initialization - ACPICA: Avoid walking the Namespace if start_node is NULL - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - ACPICA: Fix largest possible resource descriptor index - ACPICA: Update dsmethod.c to get rid of unused variable warning - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - ACPI: CPPC: Check _CPC validity for only the online CPUs - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Perform fast check switch only for online CPUs - ACPI: debug: fix signedness issues in read/write helpers - acpi, hmat: calculate abstract distance with HMAT - acpi/hmat: Fix lockdep warning for hmem_register_resource() - acpi, hmat: refactor hmat_register_target_initiators() - ACPI: HMAT: Remove register of memory node for generic target - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Add setting of generic port system locality attributes - acpi: numa: Create enum for memory_target access coordinates indexing - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 - ACPI: processor: idle: Fix memory leak when register cpuidle device failed - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Fix buffer properties extraction for subnodes - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() - ACPI: property: Return present device nodes only on fwnode interface - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - acpi,srat: Fix incorrect device handle check for Generic Initiator - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() - afs: Fix potential null pointer dereference in afs_put_server - af_unix: Initialise scc_index in unix_add_edge(). - allow finish_no_open(file, ERR_PTR(-E...)) - alpha: don't reference obsolete termio struct for TC* constants - ALSA: ac97bus: Use guard() for mutex locks - ALSA: ac97: fix a double free in snd_ac97_controller_register() - ALSA: ctxfi: Fix potential OOB access in audio mixer handling - ALSA: dice: fix buffer overflow in detect_stream_formats() - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - ALSA: firewire-motu: add bounds check in put_user loop for DSP events - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. - ALSA: lx_core: use int type to store negative error codes - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer - ALSA: scarlett2: Fix buffer overflow in config retrieval - ALSA: serial-generic: remove shared static buffer - ALSA: uapi: Fix typo in asound.h comment - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: add mono main switch to Presonus S1824c - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: fix control pipe direction - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: fix uac2 clock source at terminal parser - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() - ALSA: usb-audio: Kill timer properly at removal - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Update for native DSD support quirks - ALSA: usb: Increase volume range that triggers a warning - ALSA: usb-mixer: us16x08: validate meter packet indices - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path - ALSA: wavefront: Clear substream pointers on close - ALSA: wavefront: Fix integer overflow in sample size validation - ALSA: wavefront: Use guard() for spin locks - ALSA: wavefront: Use standard print API - amba: tegra-ahb: Fix device leak on SMMU enable - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - amd-xgbe: avoid misleading per-packet error log - amd-xgbe: Avoid spurious link down messages during interface toggle - amd-xgbe: reset retries and mode on RX adapt failures - arc: Fix __fls() const-foldability via __builtin_clzl() - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - arm64: cputype: Add Neoverse-V3AE definitions - arm64: dts: add off-on-delay-us for usdhc2 regulator - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl - arm64: dts: imx8mp: Correct thermal sensor index - arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 - arm64: dts: imx8mp-venice-gw702x: remove off-board uart - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: qcom: msm8916: Add missing MDSS reset - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A - arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A - arm64: dts: rockchip: remove dangerous max-link-speed from helios64 - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU - arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - arm64: kprobes: call set_memory_rox() for kprobe page - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - arm64: mte: Do not flag the zero page as PG_mte_tagged - arm64: Set __nocfi on swsusp_arch_resume() - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() - ARM: 9468/1: fix memset64() on big-endian - ARM: at91: pm: fix MCKx restore routine - ARM: at91: pm: save and restore ACR during PLL disable/enable - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - ARM: dts: imx51-zii-rdu1: Fix audmux node names - ARM: dts: imx6q-ba16: fix RTC interrupt level - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: renesas: gose: Remove superfluous port property - ARM: dts: renesas: porter: Fix CAN pin group - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - ARM: tegra: transformer-20: add missing magnetometer interrupt - ARM: tegra: transformer-20: fix audio-codec interrupt - arp: do not assume dev_hard_header() does not change skb->head - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - ASoC: ak4458: Disable regulator when error happens - ASoC: ak5558: Disable regulator when error happens - ASoC: amd: acp: Adjust pdm gain value - ASoC: amd: fix memory leak in acp3x pdm dma ops - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 - ASoC: amd: yc: Fix microphone on ASUS M6500RE - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: codecs: wsa881x: Drop unused version readout - ASoC: codecs: wsa881x: fix unnecessary initialisation - ASoC: codecs: wsa883x: fix unnecessary initialisation - ASoC: codecs: wsa884x: fix codec initialisation - ASoC: cs4271: Fix regulator leak on probe failure - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe - ASoC: fsl: imx-card: Do not force slot width to sample width - ASoC: fsl_sai: Add missing registers to cache default - ASoC: fsl_sai: fix bit order for DSD format - ASoC: fsl_xcvr: clear the channel status control memory - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping - ASoC: Intel: catpt: Fix error path in hw_params() - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - ASoC: qcom: audioreach: fix potential null pointer dereference - ASoC: qcom: q6adm: the the copp device only during last instance - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed - ASoC: qcom: q6asm-dai: perform correct state check before closing - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - ASoC: qdsp6: q6asm: do not sleep while atomic - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - ASoC: stm32: sai: fix clk prepare imbalance on probe failure - ASoC: stm32: sai: fix device leak on probe - ASoC: stm32: sai: fix OF node leak on probe - ASoC: stm32: sai: manage context in set_sysclk callback - ASoC: tas2781: fix getting the wrong device number - ASoC: tlv320adcx140: fix null pointer - ASoC: tlv320adcx140: fix word length - ASoC: tlv320adcx140: Propagate error codes during probe - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - ASoC: wm8940: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8974: Correct PLL rate rounding - ata: libata: Add cpr_log to ata_dev_print_features() early return - ata: libata: Call ata_dev_config_lpm() for ATAPI devices - ata: libata-core: Introduce ata_dev_config_lpm() - ata: libata: Print features also for ATAPI devices - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() - ata: libata-scsi: Fix system suspend for a security locked drive - atm: Fix dma_free_coherent() size - atm/fore200e: Fix possible data race in fore200e_open() - audit: record fanotify event regardless of presence of rules - backlight: led-bl: Add devlink to supplier LEDs - backlight: lp855x: Fix lp855x.h kernel-doc warnings - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - bcma: don't register devices disabled in OF - be2net: fix data race in be_get_new_eqd - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - be2net: pass wrb_params in case of OS2BMC - bfs: Reconstruct file type when loading from disk - binder: fix BR_FROZEN_REPLY error log - binderfs: fix ida_alloc_max() upper bound - binder: remove "invalid inc weak" check - bits: add comments and newlines to #if, #else and #endif directives - bits: introduce fixed-type GENMASK_U*() - blk-cgroup: fix possible deadlock while configuring policy - blk-crypto: fix missing blktrace bio split events - blk-mq: Abort suspend when wakeup events are pending - blk-mq: add helper for checking if one CPU is mapped to specified hctx - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx - blk-mq: don't schedule block kworker on isolated CPUs - blk-mq: setup queue ->tag_set before initializing hctx - blk-mq: skip CPU offline notify on unmapped hctx - block,bfq: fix aux stat accumulation destination - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - block: fix race between set_blocksize and read paths - block: make REQ_OP_ZONE_OPEN a write operation - block: rate-limit capacity change info log - block: rnbd-clt: Fix leaked ID in init_dev() - block: rnbd-clt: Fix signedness bug in init_dev() - block: use int to store blk_stack_limits() return value - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: bcsp: receive data only if registered - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - Bluetooth: btrtl: Avoid loading the config file on security chips - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - Bluetooth: btusb: revert use of devm_kzalloc in btusb - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync - Bluetooth: hci_event: validate skb length for unknown CC opcode - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work - Bluetooth: ISO: don't leak skb in ISO_CONT RX - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: ISO: Fix possible UAF on iso_conn_free - Bluetooth: L2CAP: export l2cap_chan_hold for modules - Bluetooth: MGMT: cancel mesh send timer when hdev removed - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() - Bluetooth: rfcomm: fix modem control handling - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - bnxt_en: correct offset handling for IPv6 destination address - bnxt_en: Fix a possible memory leak in bnxt_ptp_init - bnxt_en: Fix potential data corruption with HW GRO/LRO - bonding: annotate data-races around slave->last_rx - bonding: check xdp prog when set bond mode - bonding: don't set oif to bond dev when getting NS target destination - bonding: limit BOND_MODE_8023AD to Ethernet devices - bonding: provide a net pointer to __skb_flow_dissect() - bonding: return detailed error when loading native XDP fails - bonding: set random address only when slaves already exist - bpf: account for current allocated stack depth in widen_imprecise_scalars() - bpf: Add bpf_prog_run_data_pointers() - bpf, arm64: Do not audit capability check in do_jit() - bpf: Avoid RCU context warning when unpinning htab with internal structs - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Clear pfmemalloc flag when freeing all fragments - bpf: Do not audit capability check in do_jit() - bpf: Do not let BPF test infra emit invalid GSO types to stack - bpf: Do not limit bpf_cgroup_from_id to current's namespace - bpf: Don't use %pK through printk - bpf: Enforce expected_attach_type for tailcall compatibility - bpf: Explicitly check accesses to bpf_sock_addr - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - bpf: Fix invalid prog->stats access when update_effective_progs fails - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - bpf: Free special fields when update [lru_,]percpu_hash maps - bpf: Handle return value of ftrace_set_filter_ip in register_fentry - bpf: Improve program stats run-time calculation - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Reject bpf_timer for PREEMPT_RT - bpf: Reject negative offsets for ALU ops - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - bpf/selftests: test_select_reuseport_kern: Remove unused header - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Sync pending IRQ work before freeing ring buffer - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - bridge: mcast: Fix use-after-free during router port configuration - bridge: Redirect to backup port when port is administratively down - broadcom: b44: prevent uninitialized value usage - btrfs: always detect conflicting inodes when logging inode refs - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - btrfs: do not assert we found block group item when creating free space tree - btrfs: do not skip logging new dentries when logging a new name - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: don't log conflicting inode if it's a dir moved in the current transaction - btrfs: don't rewrite ret from inode_permission - btrfs: ensure no dirty metadata is written back for an fs with errors - btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() - btrfs: factor out init_space_info() from create_space_info() - btrfs: fix a potential path leak in print_data_reloc_error() - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type - btrfs: fix incorrect readahead expansion length - btrfs: fix invalid extref key setup when replaying dentry - btrfs: fix leaf leak in an error path in btrfs_del_items() - btrfs: fix memory leak of fs_devices in degraded seed device path - btrfs: fix memory leaks in create_space_info() error paths - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() - btrfs: fix reservation leak in some error paths when inserting inline extent - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - btrfs: introduce btrfs_space_info sub-group - btrfs: mark dirty extent range for out of bound prealloc extents - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() - btrfs: ref-verify: handle damaged extent root tree - btrfs: scrub: always update btrfs_scrub_progress::last_physical - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: send: check for inline extents in range_is_hole_in_parent() - btrfs: store fs_info in space_info - btrfs: tree-checker: fix the incorrect inode ref size check - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: use readahead_expand() on compressed extents - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - bus: fsl-mc: Check return value of platform_get_resource() - bus: mhi: ep: Fix chained transfer handling in read path - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - cachestat: do not flush stats in recency check - caif: fix integer underflow in cffrml_receive() - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak - can: etas_es58x: allow partial RX URB allocation to succeed - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - can: gs_usb: gs_can_open(): fix error handling - can: gs_usb: gs_make_candev(): populate net_device->dev_port - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: gs_usb: increase max interface to U8_MAX - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - can: j1939: make j1939_session_activate() fail if device is no longer registered - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: netlink: can_changelink(): allow disabling of automatic restart - can: peak_usb: fix shift-out-of-bounds issue - can: rcar_canfd: Fix CAN-FD mode as default - can: rcar_canfd: Fix controller mode setting - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - can: sja1000: fix max irq loop handling - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - ceph: add checking of wait_for_completion_killable() return value - ceph: fix crash in process_v2_sparse_read() for encrypted directories - ceph: refactor wake_up_bit() pattern of calling - cgroup: split cgroup_destroy_wq into 3 workqueues - char: applicom: fix NULL pointer dereference in ac_ioctl - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - char: misc: restrict the dynamic range to exclude reserved minors - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - cifs: client: fix memory leak in smb3_fs_context_parse_param - cifs: Fix memory and information leak in smb3_reconfigure() - cifs: fix memory leak in smb3_fs_context_parse_param error path - cifs: fix pagecache leak when do writepages - cifs: Fix TCP_Server_Info::credits to be signed - cifs: fix typo in enable_gcm_256 module parameter - cifs: Fix uncached read into ITER_KVEC iterator - cifs: parse_dfs_referrals: prevent oob on malformed input - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points - cifs: stop writeback extension when change of size is detected - clk: at91: clk-master: Add check for divide by 3 - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: peripheral: fix return value - clk: keystone: fix compile testing - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: qcom: camcc-sm6350: Fix PLL config of PLL2 - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback - clk: renesas: cpg-mssr: Read back reset registers to assure values latched - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register - clk: renesas: r9a06g032: Fix memory leak in error path - clk: renesas: rzg2l: Remove critical area - clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable() - clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R() - clk: renesas: Use str_on_off() helper - clk: samsung: exynos-clkout: Assign .num before accessing .hws - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - clk: tegra: do not overallocate memory for bpmp clocks - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clocksource/drivers/clps711x: Fix resource leaks in error paths - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - cnic: Fix use-after-free bugs in cnic_delete_task - comedi: c6xdigio: Fix invalid PNP driver unregistration - comedi: check device's attached status in compat ioctls - comedi: dmm32at: serialize use of paged registers - comedi: fix divide-by-zero in comedi_buf_munge() - comedi: Fix getting range information for subdevices 16 to 255 - comedi: multiq3: sanitize config options in multiq3_attach() - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - compiler_types.h: add "auto" as a macro for "__auto_type" - compiler_types: Move unused static inline functions warning to W=2 - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - coresight: etm4x: Add context synchronization before enabling trace - coresight-etm4x: Conditionally access register TRCEXTINSELR - coresight: etm4x: Correct polling IDLE bit - coresight: etm4x: Extract the trace unit controlling - coresight: etm4x: Support atclk - coresight: Only register perf symlink for sinks with alloc_buffer - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - coresight: trbe: Return NULL pointer for allocation failures - counter: 104-quad-8: Fix incorrect return value in IRQ handler - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist - cpufreq: Initialize cpufreq-based invariance before subsys - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() - cpufreq/longhaul: handle NULL policy in longhaul_exit - cpufreq: nforce2: fix reference count leak in nforce2 - cpufreq: s5pv210: fix refcount leak - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() - cpufreq: tegra186: Initialize all cores to max frequencies - cpufreq: tegra186: Set target frequency for all cpus in policy - cpuidle: Fail cpuidle device registration if there is one already - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: teo: Drop misguided target residency check - cpuidle: menu: Use residency threshold in polling state override decisions - cpuidle: qcom-spm: fix device and OF node leaks at probe - cpuset: Treat cpusets in attaching as populated - cramfs: Verify inode mode when loading from disk - crash: fix crashkernel resource shrink - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx - crypto: af_alg - Set merge to zero early in af_alg_sendmsg - crypto: af_alg - zero initialize memory allocated via sock_kmalloc - crypto: aspeed-acry - Convert to platform remove callback returning void - crypto: aspeed - Fix dma_unmap_sg() direction - crypto: aspeed - fix double free caused by devm - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - crypto: atmel - Fix dma_unmap_sg() direction - crypto: authenc - Correctly pass EINPROGRESS back up to the caller - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: caam - Add check for kcalloc() in test_len() - crypto: caam - double the entropy delay interval for retry - crypto: ccree - Correctly handle return of sg_nents_for_len - crypto: essiv - Check ssize for decryption and in-place encryption - crypto: hisilicon/qm - check whether the input function and PF are on the same device - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value - crypto: hisilicon/qm - restore original qos values - crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs - crypto: hisilicon - re-enable address prefetch after device resuming - crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations - crypto: keembay - Add missing check after sg_nents_for_len() - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - crypto: rng - Ensure set_ent is always present - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - crypto: sha256 - fix crash at kexec - crypto: starfive - Correctly handle return of sg_nents_for_len - crypto: sun8i-ce - remove channel timeout field - crypto: virtio - Add spinlock protection with virtqueue notification - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req - csky: fix csky_cmpxchg_fixup not working - dax: skip read lock assertion for read-only filesystems - devcoredump: Fix circular locking dependency with devcd->mutex. - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Disable SLUB_TINY for build testing - dlm: check for defined force value in dlm_lockspace_release - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - dmaengine: apple-admac: Add "apple,t8103-admac" compatible - dmaengine: at_hdmac: fix device leak on of_dma_xlate() - dmaengine: bcm-sba-raid: fix device leak on probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - dmaengine: dw: dmamux: fix OF node leak on route allocation failure - dmaengine: dw-edma: Set status for callback_result - dmaengine: idxd: fix device leaks on compat bind and unbind - dmaengine: idxd: Fix double free in idxd_setup_wqs() - dmaengine: idxd: Fix refcount underflow on module unload - dmaengine: idxd: Remove improper idxd_free - dmaengine: lpc18xx-dmamux: fix device leak on route allocation - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: omap-dma: fix dma_pool resource leak in error paths - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() - dmaengine: sh: setup_xref error handling - dmaengine: stm32: dmamux: fix device leak on route allocation - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure - dmaengine: tegra-adma: Fix use-after-free - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - dmaengine: ti: k3-udma: fix device leak on udma lookup - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing - dmaengine: xilinx: xdma: Fix regmap max_register - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - dma/pool: distinguish between missing and exhausted atomic pools - dma/pool: eliminate alloc_pages warning in atomic_pool_expand - dm-bufio: align write boundary on physical block size - dm-ebs: Mark full buffer dirty even on partial write - dm: fix NULL pointer dereference in __dm_suspend() - dm: fix queue start/stop imbalance under suspend/load/resume races - dm-integrity: limit MAX_TAG_SIZE to 255 - dm log-writes: Add missing set_freezable() for freezable kthread - dm-raid: fix possible NULL dereference with undefined raid type - dm-snapshot: fix 'scheduling while atomic' on real-time kernels - dm-verity: fix unreliable memory allocation - doc: fix seg6_flowlabel path - docs: networking: can: change bcm_msg_head frames member to support flexible array - Documentation: process: Also mention Sasha Levin as stable tree maintainer - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - dpaa2-switch: add bounds check for if_id in IRQ handler - dpaa2-switch: fix buffer pool seeding for control traffic - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero - driver core: enforce device_lock for driver_match_device() - driver core/PM: Set power.no_callbacks along with power.no_pm - drivers/base/node: fix double free in register_one_node() - drivers/base/node: handle error properly in register_one_node() - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() - drivers/perf: hisi: Relax the event ID check in the framework - drivers/usb/dwc3: fix PCI parent check - drm/amd: add more cyan skillfish PCI ids - drm/amd: Avoid evicting resources at S5 - drm/amd: Check whether secure display TA loaded successfully - drm/amd: Clean up kfd node on surprise disconnect - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Bump the HDMI clock to 340MHz - drm/amd/display: Check dce_hwseq before dereferencing it - drm/amd/display: Check NULL before accessing - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Enable mst when it's detected but yet to be initialized - drm/amd/display: ensure committing streams is seamless - drm/amd/display: Fix black screen with HDMI outputs - drm/amd/display: Fix DP no audio issue - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() - drm/amd/display: Fix null pointer deref in dcn20_resource.c - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: Increase DPCD read retries - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Remove redundant semicolons - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() - drm/amd/display: use udelay rather than fsleep - drm/amd: Fix suspend failure with secure display TA - drm/amdgpu: Add additional DCE6 SCL registers - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/amdgpu: csa unmap use uninterruptible lock - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amdgpu: fix a memory leak in fence cleanup when unloading - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - drm/amdgpu: Fix function header names in amdgpu_connectors.c - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amdgpu: Forward VMID reservation errors - drm/amdgpu/gfx10: fix wptr reset in KGQ init - drm/amdgpu/gfx11: fix wptr reset in KGQ init - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amdgpu: Power up UVD 3 for FW validation (v2) - drm/amdgpu: reject gang submissions under SRIOV - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/amdgpu/soc21: fix xclk for APUs - drm/amdgpu: use atomic functions with memory barriers for vm fault info - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - drm/amdkfd: Don't use sw fault filter if retry cam enabled - drm/amdkfd: fix a memory leak in device_queue_manager_init() - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - drm/amdkfd: fix vram allocation failure for a special case - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amd/pm: Don't clear SI SMC table when setting power limit - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) - drm/amd/powerplay: Fix CIK shutdown temperature - drm/ast: Use msleep instead of mdelay for edid read - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - drm/bridge: it6505: select REGMAP_I2C - drm/bridge: lt9211: Drop check for last nibble of version register - drm/etnaviv: fix flush sequence logic - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/gma500: Fix null dereference in hdmi teardown - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - drm/i915/backlight: Return immediately when scale() finds invalid parameters - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - drm/i915/guc: Skip communication warning on reset in progress - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/imx/tve: fix probe device leak - drm/mediatek: Disable AFBC support on Mediatek DRM driver - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() - drm/mediatek: Fix device use-after-free on unbind - drm/mediatek: fix potential OF node use-after-free - drm/mediatek: Fix probe memory leak - drm/mediatek: Fix probe resource leaks - drm/mgag200: Fix big-endian support - drm/mgag200: fix mgag200_bmc_stop_scanout() - drm/msm/a2xx: stop over-complaining about the legacy firmware - drm/msm/a6xx: fix bogus hwcg register updates - drm/msm/a6xx: Fix GMU firmware parser - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - drm/msm/dpu: Add missing NULL pointer check for pingpong interface - drm/msm/dpu: fix incorrect type for ret - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - drm/msm: make sure to not queue up recovery more than once - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/nouveau: restrict the flush page to a 32-bit address - drm/panel: novatek-nt35560: Fix invalid return value - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel - drm/panel: sony-td4353-jdi: Enable prepare_prev_first - drm/panel: visionox-rm69299: Don't clear all mode flags - drm/pl111: Fix error handling in pl111_amba_probe - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] - drm/rcar-du: dsi: Fix 1/2/3 lane support - drm/rockchip: vop2: use correct destination rectangle height check - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - drm/sched: Fix race in drm_sched_entity_select_rq() - drm: sti: fix device leaks at component probe - drm/sysfb: Do not dereference NULL pointer in plane reset - drm/tegra: Add call to put_pid() - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/tidss: Use the crtc_* timings when programming the HW - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - drm/ttm: Avoid NULL pointer deref for evicted BOs - drm/vgem-fence: Fix potential deadlock on release - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() - drm/vmwgfx: Fix a null-ptr access in the cursor snooper - drm/vmwgfx: Fix copy-paste typo in validation - drm/vmwgfx: Fix Use-after-free in validation - drm/vmwgfx: Use kref in vmw_bo_dirty - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml - dt-bindings: PCI: amlogic: Fix the register name of the DBI region - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO - dt-bindings: power: qcom,rpmpd: Add SM7150 - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner - dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions - dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215 - dt-bindings: power: rpmpd: Update part number to X1E80100 - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - e1000: fix OOB in e1000_tbi_should_accept() - EDAC/altera: Delete an inappropriate dma_free_coherent() call - EDAC/altera: Handle OCRAM ECC enable after warm reset - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller - EDAC/i3200: Fix a resource leak in i3200_probe1() - EDAC/mc_sysfs: Increase legacy channel support to 16 - EDAC/x38: Fix a resource leak in x38_probe1() - efi/cper: Add a new helper function to print bitmasks - efi/cper: Adjust infopfx size to accept an extra space - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs - efi/cper: Fix cper_bits_to_str buffer handling and return value - efi/libstub: Fix page table access in 5-level to 4-level paging transition - efivarfs: fix error propagation in efivar_entry_get() - epoll: Remove ep_scan_ready_list() in comments - espintcp: fix skb leaks - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - ethernet: Extend device_get_mac_address() to use NVMEM - ethernet: rvu-af: Remove slash from the driver name - ethtool: Avoid overflowing userspace buffer on stats query - eventpoll: Replace rwlock with spinlock - exec: Fix incorrect type for ret - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - exfat: fix remount failure in different process environments - exfat: limit log print for IO error - Expand the type of nfs_fattr->valid - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() - ext4: align max orphan file size with e2fsprogs limit - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() - ext4: clear i_state_flags when alloc inode - ext4: correctly handle queries for metadata mappings - ext4: correct the checking of quota files before moving extents - ext4: detect invalid INLINE_DATA + EXTENTS flag combination - ext4: filesystems without casefold feature cannot be mounted with siphash - ext4: fix an off-by-one issue during moving extents - ext4: fix checks for orphan inodes - ext4: fix error message when rejecting the default hash - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - ext4: fix incorrect group number assertion in mb_check_buddy - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() - ext4: fix string copying in parse_apply_sb_mount_options() - ext4: free orphan info with kvfree - ext4: guard against EA inode refcount underflow in xattr update - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - ext4: increase IO priority of fastcommit - ext4: introduce ITAIL helper - ext4: refresh inline data size before write operations - ext4: remove unused return value of __mb_check_buddy - ext4: validate ea_ino and size in check_xattrs - ext4: verify orphan file size is not too big - ext4: wait for ongoing I/O to complete before freeing blocks - ext4: xattr: fix null pointer deref in ext4_raw_inode() - extcon: adc-jack: Cleanup wakeup source only if it was enabled - extcon: adc-jack: Fix wakeup source leaks on device unbind - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: drop inode from the donation list when the last file is closed - f2fs: ensure node page reads complete before f2fs_put_super() finishes - f2fs: fix age extent cache insertion skip on counter overflow - f2fs: fix condition in __allow_reserved_blocks() - f2fs: fix infinite loop in __insert_extent_tree() - f2fs: fix return value of f2fs_recover_fsync_data() - f2fs: fix to avoid overflow while left shift operation - f2fs: fix to avoid potential deadlock - f2fs: fix to avoid updating compression context during writeback - f2fs: fix to avoid updating zero-sized extent in extent cache - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() - f2fs: fix to propagate error from f2fs_enable_checkpoint() - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - f2fs: fix wrong block mapping for multi-devices - f2fs: fix zero-sized extent for precache extents - f2fs: invalidate dentry cache on failed whiteout creation - f2fs: keep POSIX_FADV_NOREUSE ranges - f2fs: remove unused GC_FAILURE_PIN - f2fs: use f2fs_err_ratelimited() to avoid redundant logs - f2fs: use global inline_xattr_slab instead of per-sb slab cache - fbcon: fix integer overflow in fbcon_do_set_font - fbcon: Fix OOB access in font allocation - fbcon: Set fb_display[i]->mode to NULL when the mode is released - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds - fbdev: atyfb: Check if pll_ops->init_pll failed - fbdev: bitblit: bound-check glyph index in bit_putcs* - fbdev: Fix logic error in "offb" name match - fbdev: gbefb: fix to use physical address instead of dma address - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() - fbdev: tcx.c fix mem_map to correct smem_start offset - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - filelock: add FL_RECLAIM to show_fl_flags() macro - filemap: cap PTE range to be created to allowed zero fill in folio_map_range() - firewire: core: fix overlooked update of subsystem ABI version - firewire: nosy: Fix dma_free_coherent() size - firmware: arm_scmi: Account for failed debug initialization - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - firmware: arm_scmi: Fix unused notifier-block in unregister - firmware: firmware: meson-sm: fix compile-test default - firmware: imx: scu-irq: fix OF node leak in - firmware: imx: scu-irq: Init workqueue before request mbox channel - firmware: imx: scu-irq: Set mu_resource_id before get handle - firmware: meson_sm: fix device leak at probe - firmware: stratix10-svc: Add mutex in stratix10 memory management - firmware: stratix10-svc: fix bug in saving controller data - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc - Fix memory leak in posix_clock_open() - fjes: Add missing iounmap in fjes_hw_init() - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - flex_proportions: make fprop_new_period() hardirq safe - floppy: fix for PAGE_SIZE != 4KB - fou: Don't allow 0 for FOU_ATTR_IPPROTO. - fs/9p: Don't open remote file with APPEND mode when writeback cache is used - fs: Add 'initramfs_options' to set initramfs mount options - fs: always return zero on success from replace_fd() - fscontext: do not consume log entries when returning -EMSGSIZE - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - fs/nfs/io: make nfs_start_io_*() killable - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() - fs/nls: Fix utf16 to utf8 conversion - fs/notify: call exportfs_encode_fid with s_umount - fsnotify: do not generate ACCESS/MODIFY events on child for special files - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fs: ntfs3: Fix integer overflow in run_unpack() - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - fs/ntfs3: Initialize allocated memory before use - fs/ntfs3: out1 also needs to put mi - fs/ntfs3: Prevent memory leaks in add sub record - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs/ntfs3: Support timestamps prior to epoch - fs/proc: fix uaf in proc_readdir_de() - fs: quota: create dedicated workqueue for quota_release_work - fs: udf: fix OOB read in lengthAllocDescs handling - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() - ftrace: Fix BPF fexit with livepatch - ftrace: Fix softlockup in ftrace_module_enable - ftrace/samples: Fix function size computation - fuse: allocate ff->release_args only if release is needed - fuse: Always flush the page cache before FOPEN_DIRECT_IO write - fuse: check if copy_file_range() returns larger than requested size - fuse: fix livelock in synchronous file put from fuseblk workers - fuse: fix readahead reclaim deadlock - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write - fuse: prevent overflow in copy_file_range return value - fuse: zero initialize inode private data - futex: Don't leak robust_list pointer on exec race - futex: Prevent use-after-free during requeue-PI - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - gcov: add support for GCC 15 - genalloc.h: fix htmldocs warning - genirq/irq_sim: Initialize work context pointers properly - gfs2: fix freeze error handling - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - gfs2: fix remote evict for read-only filesystems - gfs2: Fix use of bio_chain - gpio: 104-idio-16: Define maximum valid register address offset - gpio: idio-16: Define fixed direction of the GPIO lines - gpiolib: acpi: Add quirk for Dell Precision 7780 - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler - gpiolib: Extend software-node support to support secondary software-nodes - gpio: ljca: Fix duplicated IRQ mapping - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - gpio: omap: do not register driver in probe() - gpio: pca953x: Add support for level-triggered interrupts - gpio: pca953x: fix wrong error probe return value - gpio: pca953x: handle short interrupt pulses on PCAL devices - gpio: pca953x: mask interrupts in irq shutdown - gpio: pca953x: Utilise dev_err_probe() where it makes sense - gpio: pca953x: Utilise temporary variable for struct device - gpio: pci-idio-16: Define maximum valid register address offset - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - gpio: rockchip: mark the GPIO controller as sleeping - gpio: rockchip: Stop calling pinctrl for set_direction - gpio: update Intel LJCA USB GPIO driver - gpio: wcd934x: mark the GPIO controller as sleeping - gpu: host1x: Fix race in syncpt alloc/free - gue: Fix skb memleak with inner IP protocol 0. - gve: Correct ethtool rx_dropped calculation - gve: Fix stats report corruption on queue count change - hfs: clear offset and space out of valid records in b-tree node - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - hfs: make proper initalization of struct hfs_find_data - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() - hfsplus: fix volume corruption issue for generic/070 - hfsplus: fix volume corruption issue for generic/073 - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfsplus: Verify inode mode when loading from disk - hfs: validate record offset in hfsplus_bmap_alloc - HID: amd_sfh: Stop sensor before starting - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) - HID: asus: add support for missing PX series fn keys - HID: asus: add Z13 folio to generic group for multitouch to work - HID: core: Harden s32ton() against conversion to 0 bits - HID: elecom: Add support for ELECOM M-XT3URBK (018F) - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - HID: hid-input: Extend Elan ignore battery quirk to USB - HID: hid-input: only ignore 0 battery events for digitizers - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen - HID: intel-ish-hid: Reset enum_devices_done before enumeration - HID: intel-ish-hid: Update ishtp bus match to support device ID table - HID: logitech-dj: Remove duplicate error logging - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL - HID: multitouch: fix name of Stylus input devices - HID: multitouch: fix sticky fingers - HID: playstation: Center initial joystick axes to prevent spurious events - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 - HID: quirks: work around VID/PID conflict for appledisplay - HID: uclogic: Fix potential memory leak in error path - HID: usbhid: paper over wrong bNumDescriptor field - hrtimer: Fix softirq base check in update_needs_ipi() - hrtimer: Remove unused function - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimers: Unconditionally update target CPU base after offline timer migration - hsr: Fix supervision frame sending on HSRv0 - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (ibmpex) fix use-after-free in high/low store - hwmon: (k10temp) Add device ID for Strix Halo - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models - hwmon: (max16065) Use local variable to avoid TOCTOU - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - hwmon: (occ) Mark occ_init_attribute() as __printf - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - hwmon: (sht3x) Fix error handling - hwmon: sy7636a: add alias - hwmon: sy7636a: Fix regulator_enable resource leak on error path - hwmon: (tmp401) fix overflow caused by default conversion rate value - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - hwrng: nomadik - add ARM_AMBA dependency - hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_* - i2c: amd-mp2: fix reference leak in MP2 PCI device - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Add quirk for Intel Xe - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware - i2c: designware: Fix clock issue when PM is disabled - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA - i3c: fix refcount inconsistency in i3c_master_register - i3c: master: Inherit DMA masks and parameters from parent device - i3c: master: svc: Prevent incomplete IBI transaction - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - i40e: add mask to apply valid bits for itr_idx - i40e: add max boundary check for VF filters - i40e: add validation for ring_len param - i40e: fix idx validation in config queues msg - i40e: fix idx validation in i40e_validate_queue_map - i40e: fix input validation logic for action_meta - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path - i40e: fix scheduling in set_rx_mode - i40e: fix validation of VF state in get resources - i40e: improve VF MAC filters accounting - i40e: increase max descriptors for XL710 - i40e: remove redundant memory barrier when cleaning Tx descs - iavf: fix off-by-one issues in iavf_config_rss_reg() - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - IB/sa: Fix sa_local_svc_timeout_ms read race - ice: Avoid detrimental cleanup for bond during interface stop - ice: Don't use %pK through printk or tracepoints - ice: initialize ring_stats->syncp - ice: stop counting UDP csum mismatch as rx_errors - idr: fix idr_alloc() returning an ID out of range - igb: fix link test skipping when interface is admin down - igc: fix race condition in TX timestamp read for register 0 - iio: accel: bmc150: Fix irq assumption regression - iio: accel: fix ADXL355 startup race condition - iio: accel: iis328dq: fix gain values - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: adc: ad7280a: handle spi_setup() errors in probe() - iio: adc: ad9467: fix ad9434 vref mask - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver - iio: adc: exynos_adc: fix OF populate on driver rebind - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: rtq6056: Correct the sign bit index - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains - iio: chemical: scd4x: fix reported channel endianness - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: core: add missing mutex_destroy in iio_dev_release() - iio: core: add separate lockdep class for info_exist_lock - iio: dac: ad5360: use int type to store negative error codes - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - iio: frequency: adf4350: Fix prescaler usage. - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - iio: imu: inv_icm42600: Simplify pm_runtime setup - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: xilinx-ams: Unmask interrupts after updating alarms - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - ima: Handle error code returned by ima_filter_rule_match() - ima: limit the number of ToMToU integrity violations - inet: Avoid ehash lookup race in inet_ehash_insert() - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - inet: ping: Fix icmp out counting - init: handle bootloader identifier in kernel parameters - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - Input: atmel_mxt_ts - allow reset GPIO to sleep - Input: cros_ec_keyb - fix an invalid memory access - Input: goodix - add support for ACPI ID GDIX1003 - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: imx_sc_key - fix memory corruption on unload - Input: iqs7222 - avoid enabling unused interrupts - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak - intel_th: fix device leak on output open() - intel_th: Fix error handling in intel_th_output_open - interconnect: debugfs: Fix incorrect error handling for NULL path - interconnect: debugfs: initialize src_node and dst_node to empty strings - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS - iomap: account for unaligned end offsets when truncating read range - iomap: adjust read range correctly for non-block-aligned positions - iomap: always run error completions in user context - iomap: factor out a iomap_dio_done helper - iommu/amd: Fix pci_segment memleak in alloc_pci_segment() - iommu/amd/pgtbl: Fix possible race while increase page table level - iommu/amd: Skip enabling command/event buffers for kdump - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/apple-dart: fix device leak on of_xlate() - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal - iommu: disable SVA when CONFIG_X86 is set - iommu/exynos: fix device leak on of_xlate() - iommufd: Don't overflow during division for dirty tracking - iommufd: Make vfio_compat's unmap succeed if the range is already empty - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED - iommu/ipmmu-vmsa: fix device leak on of_xlate() - iommu/mediatek: fix device leak on of_xlate() - iommu/mediatek: fix use-after-free on probe deferral - iommu/mediatek-v1: fix device leak on probe_device() - iommu/mediatek-v1: fix device leaks on probe() - iommu/omap: fix device leaks on probe_device() - iommu/qcom: fix device leak on of_xlate() - iommu/sun50i: fix device leak on of_xlate() - iommu/tegra: fix device leak on probe_device() - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - iommu/vt-d: PRS isn't usable if PDS isn't supported - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - io_uring: backport io_should_terminate_tw() - io_uring: correct __must_hold annotation in io_install_fixed_file - io_uring: fix filename leak in __io_openat_prep() - io_uring: include dying ring in task_work "should cancel" state - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - io_uring: move local task_work in exit cancel loop - io_uring/poll: correctly handle io_poll_add() return value on update - ip6_gre: make ip6gre_header() robust - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - ipmi: Fix handling of messages with provided receive message pointer - ipmi: Fix __scan_channels() failing to rescan channels - ipmi: Fix the race between __scan_channels() and deliver_response() - ipmi: Rework user message limit handling - ipv4: Fix reference count leak when using error routes with nexthop objects - ipv4: ip_gre: make ipgre_header() robust - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe - ipv6: add exception routes to GC list in rt6_insert_exception - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - ipv6: annotate data-race in ndisc_router_discovery() - ipv6: avoid possible NULL deref in modify_prefix_route() - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - ipv6: clear RA flags when adding a static route - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF - ipv6: Fix use-after-free in inet6_addr_del(). - ipv6: np->rxpmtu race annotation - ipv6: use the right ifindex when replying to icmpv6 from localhost - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() - ipvlan: Make the addrs_lock be per port - ipvs: Defer ip_vs_ftp unregister during netns cleanup - ipvs: fix ipv4 null-ptr-deref in route error path - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - irqchip/gic-v3-its: Avoid truncating memory addresses - irqchip/imx-mu-msi: Fix section mismatch - irqchip/irq-bcm7038-l1: Fix section mismatch - irqchip/irq-bcm7120-l2: Fix section mismatch - irqchip/irq-brcmstb-l2: Fix section mismatch - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() - irqchip/qcom-irq-combiner: Fix section mismatch - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - irqchip/sifive-plic: Respect mask state when setting affinity - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() - ixgbevf: Add support for Intel(R) E610 device - ixgbevf: fix getting link speed data for E610 devices - ixgbevf: fix mailbox API compatibility by negotiating supported features - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted - jbd2: ensure that all ongoing I/O complete before freeing blocks - jbd2: fix the inconsistency between checksum and data in memory for journal sb - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key - jbd2: use a weaker annotation in journal handling - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - kallsyms: Fix wrong "big" kernel symbol type read from procfs - kasan: fix GCC mem-intrinsic prefix with sw tags - kasan: refactor pcpu kasan vmalloc unpoison - kbuild: uapi: Strip comments before size type check - kbuild: Use objtree for module signing key path - kconfig: fix static linking of nconf - kconfig/mconf: Initialize the default locale at startup - kconfig/nconf: Initialize the default locale at startup - kernel.h: Move ARRAY_SIZE() to a separate header - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths - kernfs: Fix UAF in polling when open file is released - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - KEYS: trusted_tpm1: Compare HMAC values in constant time - KEYS: X.509: Fix Basic Constraints CA flag parsing - kmsan: fix out-of-bounds access to shadow memory - ksmbd: add max ip connections parameter - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - ksmbd: close accepted socket when per-IP limit rejects connection - ksmbd: fix buffer validation by including null terminator size in EA length - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - ksmbd: Fix memory leak in get_file_all_info() - ksmbd: fix null pointer dereference in alloc_preauth_hash() - ksmbd: Fix race condition in RPC handle list access - ksmbd: fix recursive locking in RPC handle list access - ksmbd: Fix refcount leak when invalid session is found on session lookup - ksmbd: fix use-after-free in ksmbd_session_rpc_open - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - ksmbd: fix use-after-free in session logoff - ksmbd: ipc: fix use-after-free in ipc_msg_send_request - ksmbd: skip lock-range check on equal size to avoid size==0 underflow - ksmbd: smbd: fix dma_unmap_sg() nents - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: transport_ipc: validate payload size before reading handle - ksmbd: use sock_create_kern interface to create kernel socket - ksmbd: vfs: fix race on m_flags in vfs_cache - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - ktest.pl: Fix uninitialized var in config-bisect.pl - kunit: kasan_test: disable fortify string checker on kasan_strings() test - KVM: arm64: Check the untrusted offset in FF-A memory share - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - KVM: Don't clobber irqfd routing type when deassigning irqfd - KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() - KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits - KVM: nSVM: Fix and simplify LBR virtualization handling with nested - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 - KVM: SVM: Fix redundant updates of LBR MSR intercepts - KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN - KVM: SVM: Set synthesized TSA CPUID flags - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 - l2tp: avoid one data-race in l2tp_tunnel_del_work() - lan966x: Fix sleeping in atomic context - leds: flash: leds-qcom-flash: Update torch current clamp setting - leds: led-class: Only Add LED to leds_list when it is fully ready - leds: leds-lp50xx: Allow LED 0 to be added to module bank - leds: leds-lp50xx: Enable chip before any communication - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs - leds: netxbig: Fix GPIO descriptor leak in error paths - leds: spi-byte: Use devm_led_classdev_register_ext() - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - libbpf: Fix reuse of DEVMAP - libceph: fix invalid accesses to ceph_connection_v1_info - libceph: fix potential use-after-free in have_mon_and_osd_map() - libceph: make calc_target() set t->paused, not just clear it - libceph: make decode_pool() more resilient against corrupted osdmaps - libceph: make free_choose_arg_map() resilient to partial allocation - libceph: prevent potential out-of-bounds reads in handle_auth_done() - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - libceph: reset sparse-read state in osd_fault() - libceph: return the handler error from mon_handle_auth_done() - lib/crypto: aes: Fix missing MMU protection for AES S-box - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit - lib/genalloc: fix device leak in of_gen_pool_get() - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map - libperf event: Ensure tracing data is multiple of 8 sized - lib/vsprintf: Check pointer before dereferencing in time_and_date() - livepatch: Match old_sympos 0 and 1 in klp_find_func() - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - lockd: fix vfs_test_lock() calls - locking/spinlock/debug: Fix data-race in do_raw_write_lock - LoongArch: Add machine_kexec_mask_interrupts() implementation - LoongArch: Add more instruction opcodes and emit_* helpers - LoongArch: Add new PCI ID for pci_fixup_vgadev() - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Automatically disable kaslr if boot from kexec_file - LoongArch: BPF: Sign extend kfunc call arguments - LoongArch: BPF: Zero-extend bpf_tail_call() index - LoongArch: Check the return value when creating kobj - LoongArch: Correct the calculation logic of thread_count - LoongArch: Don't panic if no valid cache info for PCI - LoongArch: Enable exception fixup for specific ADE subcode - LoongArch: Fix build errors for CONFIG_RANDSTRUCT - LoongArch: Fix PMU counter allocation for mixed-type event groups - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Mask all interrupts during kexec/kdump - LoongArch: Refactor register restoration in ftrace_common_return - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED - LoongArch: Update help info of ARCH_STRICT_ALIGN - LoongArch: Use correct accessor to read FWPC/MWPC - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - LoongArch: Use __pmd()/__pte() for swap entry conversions - LoongArch: Use UAPI types in ptrace UAPI header - LoongArch: Use unsigned long for _end and _text - loop: Avoid updating block size under exclusive owner - m68k: bitops: Fix find_*_bit() signatures - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse - macvlan: fix error recovery in macvlan_common_newlink() - macvlan: fix possible UAF in macvlan_forward_source() - mailbox: mailbox-test: Fix debugfs_create_dir error checking - mailbox: pcc: don't zero error register - mailbox: pcc: Refactor error handling in irq handler into separate function - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - maple_tree: fix tracepoint string pointers - md/raid5: fix IO hang when array is broken with IO inflight - media: adv7180: Add missing lock in suspend callback - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Only validate format in querystd - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() - media: amphion: Add a frame flush mode for decoder - media: amphion: Cancel message work before releasing the VPU core - media: amphion: Delete v4l2_fh synchronously in .release() - media: amphion: Make some vpu_v4l2 functions static - media: amphion: Remove vpu_vb_is_codecconfig - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove - media: cec: Fix debugfs leak on bus_register() failure - media: cx18: Add missing check after DMA map - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - media: fix uninitialized symbol warnings - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe - media: i2c: imx214: Fix link frequency validation - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - media: i2c: mt9v111: fix incorrect type for ret - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - media: imon: make send_packet() more robust - media: lirc: Fix error handling in lirc_register() - media: mc: Clear minor number before put device - media: mc: Fix MUST_CONNECT handling for pads with no links - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() - media: mediatek: vcodec: Use spinlock for context list protection lock - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: ov08x40: Fix the horizontal flip control - media: pci: ivtv: Add missing check after DMA map - media: pci: ivtv: Don't create fake v4l2_fh - media: pvrusb2: Fix incorrect variable used in trace message - media: rc: fix races with imon_disconnect() - media: rc: st_rc: Fix reset control resource leak - media: redrat3: use int type to store negative error codes - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - media: samsung: exynos4-is: fix potential ABBA deadlock on init - media: st-delta: avoid excessive stack usage - media: TDA1997x: Remove redundant cancel_delayed_work in probe - media: tuner: xc5000: Fix use-after-free in xc5000_release - media: tunner: xc5000: Refactor firmware load - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID - media: uvcvideo: Use heuristic to find stream entity - media: v4l2-mem2mem: Fix outdated documentation - media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: verisilicon: Fix CPU stalls on G2 bus error - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index - media: verisilicon: Store chroma and motion vectors offset - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path - media: vidtv: initialize local pointers upon transfer of memory ownership - media: vpif_capture: fix section mismatch - media: vpif_display: fix section mismatch - media: zoran: Remove zoran_fh structure - mei: me: add nova lake point S DID - mei: me: add wildcat lake P DID - mei: trace: treat reg parameter as string - memcg: fix data-race KCSAN bug in rstats - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - memory tiering: add abstract distance calculation algorithms management - memory tiers: use default_dram_perf_ref_source in log message - memstick: Add timeout to prevent indefinite waiting - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup - mfd: da9055: Fix missing regmap_del_irq_chip() in error path - mfd: da9063: Split chip variant reading in two bus transactions - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: madera: Work around false-positive -Wininitialized warning - mfd: max77620: Fix potential IRQ chip conflict when probing two devices - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path - mfd: rz-mtu3: Fix MTU5 NFCR register offset - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - migrate: correct lock ordering for hugetlb file folios - minixfs: Verify inode mode when loading from disk - minmax: add a few more MIN_T/MAX_T users - minmax: avoid overly complicated constant expressions in VM code - minmax: don't use max() in situations that want a C constant expression - minmax: fix up min3() and max3() too - minmax.h: add whitespace around operators and after commas - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: update some comments - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax: improve macro expansion and type checking - minmax: make generic MIN() and MAX() macros available everywhere - minmax: simplify and clarify min_t()/max_t() implementation - minmax: simplify min()/max()/clamp() implementation - MIPS: Fix a reference leak bug in ip22_check_gio() - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add missing properties to cpu node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - misc: fastrpc: Add missing dev_err newlines - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - misc: fastrpc: Fix fastrpc_map_lookup operation - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Skip reference for DMA handles - misc: genwqe: Fix incorrect cmd field being reported in error - mISDN: annotate data-race around dev->work - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats - mlxsw: spectrum_router: Fix neighbour use-after-free - mlxsw: spectrum_router: Fix possible neighbour reference count leak - mm: add folio_expected_ref_count() for reference count calculation - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() - mm/balloon_compaction: we cannot have isolated pages in the balloon list - mmc: core: SPI mode remove cmd7 - mmc: host: renesas_sdhi: Fix the actual clock - mmc: mvsdio: Fix dma_unmap_sg() nents value - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function - mmc: sdhci-cadence: add Mobileye eyeQ support - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode - mm/damon/core: set quota->charged_from to jiffies at first charge window - mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure - mm/damon/sysfs: fix use-after-free in state_show() - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() - mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() - mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() - mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out() - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm: fix arithmetic for bdi min_ratio - mm: fix arithmetic for max_prop_frac when setting max_ratio - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: check ref_count instead of lru before migration - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - mm: hugetlb: avoid soft lockup when mprotect to large memory area - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/hugetlb: fix folio is still mapped when deleted - mm: introduce and use {pgd,p4d}_populate_kernel() - mm, kfence: describe @slab parameter in __kfence_obj_info() - mm/kfence: randomize the freelist on initialization - mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios - mm/khugepaged: fix the address passed to notifier on testing young - mm: kmsan: fix poisoning of high-order non-compound pages - mm/ksm: fix exec/fork inheritance support for prctl - mm/ksm: fix flag-dropping behavior in ksm_madvise - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - mm: memcg: add per-memcg zswap writeback stat - mm: memcg: add THP swap out info for anonymous reclaim - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: make stats flushing threshold per-memcg - mm: memcg: move vmstats structs definition above flushing code - mm: memcg: optimize parent iteration in memcg_rstat_updated() - mm: memcg: restore subtree stats flushing - mm/memory: do not populate page table entries beyond i_size - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory - mm/memory-tier: fix abstract distance calculation overflow - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/mempool: replace kmap_atomic() with kmap_local_page() - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() - mm: migrate_device: use more folio in migrate_device_finalize() - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - mm/page_alloc: prevent pcp corruption with SMP=n - mm, percpu: do not consider sleepable allocations atomic - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/secretmem: fix use-after-free race in fault handler - mm: simplify folio_expected_ref_count() - mm/truncate: unmap large folio on split failure - mm: workingset: move the stats flush into workingset_test_recent() - most: usb: fix double free on late probe failure - most: usb: Fix use-after-free in hdm_disconnect - most: usb: hdm_probe: Fix calling put_device() before device initialization - mptcp: avoid deadlock on fallback while reinjecting - mptcp: avoid dup SUB_CLOSED events after disconnect - mptcp: avoid unneeded subflow-level drops - mptcp: clear scheduled subflows on retransmit - mptcp: decouple mptcp fastclose from tcp close - mptcp: Disallow MPTCP subflows from sockmap - mptcp: do not fallback when OoO is present - mptcp: drop bogus optimization in __mptcp_check_push() - mptcp: ensure context reset on disconnect() - mptcp: fallback earlier on simult connection - mptcp: fix ack generation for fallback msk - mptcp: fix a race in mptcp_pm_del_add_timer() - mptcp: fix duplicate reset on fastclose - mptcp: fix MSG_PEEK stream corruption - mptcp: fix premature close in case of fallback - mptcp: Fix proto fallback detection with BPF - mptcp: fix race condition in mptcp_schedule_work() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). - mptcp: only reset subflow errors when propagated - mptcp: pm: ignore unknown endpoint flags - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR - mptcp: pm: in-kernel: usable client side with C-flag - mptcp: pm: nl: announce deny-join-id0 flag - mptcp: propagate shutdown to subflows when possible - mptcp: restore window probe - mptcp: schedule rtx timer only after pushing data - mptcp: set remote_deny_join_id0 on SYN recv - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - mptcp: tfo: record 'deny join id0' info - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() - mtdchar: fix integer overflow in read/write ioctls - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds - mtd: nand: raw: atmel: Fix comment in timings preparation - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: relax ECC parameter validation check - mtd: onenand: Pass correct pointer to IRQ handler - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - mtd: rawnand: fsmc: Default to autodetect buswidth - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - mtd: rawnand: stm32_fmc2: fix ECC overwrite - nbd: defer config put in recv_work - nbd: defer config unlock in nbd_genl_connect - nbd: restrict sockets to TCP and UDP - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() - net/9p: fix double req put in p9_fd_cancelled - net: Add locking to protect skb->dev access in ip_output - net: add skb_header_pointer_careful() helper - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - net: allow small head cache usage with large MAX_SKB_FRAGS values - net: Allow to use SMP threads for backlog NAPI. - net: aquantia: Add missing descriptor cache invalidation on ATL2 - net: atlantic: fix fragment overflow handling in RX path - net: bcmasp: fix early exit leak with fixed phy - net: bonding: fix possible peer notify event loss or dup issue - net: bridge: annotate data-races around fdb->{updated,used} - net: bridge: Bounce invalid boolopts - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct - net: bridge: fix MST static key usage - net: bridge: fix static key check - net: bridge: fix use-after-free due to MST port state bypass - net: bridge: Install FDB for bridge MAC on VLAN 0 - net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry - net: call cond_resched() less often in __release_sock() - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts - net/cls_cgroup: Fix task_get_classid() during qdisc run - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates - netdevsim: add Makefile for selftests - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - net: dlink: handle copy_thresh allocation failure - net: dlink: handle dma_map_single() failure properly - net: don't touch dev->stats in BPF redirect paths - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: dsa: b53: skip multicast entries for fdb_dump() - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: fix off-by-one in maximum bridge ID determination - net: dsa: hellcreek: fix missing error handling in LED registration - net: dsa: improve shutdown sequence - net: dsa: lantiq_gswip: do also enable or disable cpu port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: microchip: common: Fix checks on irq_find_mapping() - net: dsa: microchip: Fix reserved multicast address table programming - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: lan937x: Fix RGMII delay tuning - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: do not transmit redirected XDP frames when the link is down - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - net: enetc: fix the deadlock of enetc_mdio_lock - net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - net: fec: cancel perout_timer when PEROUT is disabled - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not register PPS event for PEROUT - net: fec: do not update PEROUT if it is enabled - net: fec: ERR007885 Workaround for XDP TX path - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan - netfilter: ipset: Remove unused htable_bits in macro ahash_region - netfilter: nf_conncount: fix leaked ct in error paths - netfilter: nf_conncount: rework API to use sk_buff directly - netfilter: nf_conncount: update last_gc only when GC has been performed - netfilter: nf_reject: don't reply to icmp error messages - netfilter: nf_tables: allow loads only when register is initialized - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - netfilter: nf_tables: fix memory leak in nf_tables_newrule() - netfilter: nf_tables: missing objects with no memcg accounting - netfilter: nf_tables: pass context structure to nft_parse_register_load - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: remove redundant chain validation on register store - netfilter: nft_connlimit: update the count if add was skipped - netfilter: nft_objref: validate objref and objrefmap expressions - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation - netfilter: nft_synproxy: avoid possible data-race on update operation - netfilter: replace -EEXIST with -EBUSY - net: fix memory leak in skb_segment_list for GRO packets - net: fix NULL pointer dereference in l3mdev_l3_rcv - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - net: gro: fix outer network offset - net/handshake: duplicate handshake cancellations leak socket - net/handshake: Fix memory leak in tls_handshake_accept() - net/handshake: restore destructor on submit failure - net: hns3: add VLAN id validation before using - net: hns3: fix data race in hns3_fetch_stats - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - net: hns3: return error code when function fails - net: hns3: using the num_tqps in the vf driver to apply for resources - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx - net: hsr: Add support for MC filtering at the slave device - net: hsr: Add VLAN CTAG filter support - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() - net: hv_netvsc: reject RSS hash key programming without RX indirection table - net: intel: fm10k: Fix parameter idx set but not used - net/ip6_tunnel: Prevent perpetual tunnel growth - net: ipv6: fix field-spanning memcpy warning in AH output - net/ipv6: Remove expired routes with a separated list of routes. - net: lan743x: Allocate rings outside ZONE_DMA - net: lan966x: Fix the initialization of taprio - net: libwx: fix device bus LAN ID - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup - net: liquidio: fix overflow in octeon_init_instr_queue() - net: liquidio: Initialize netdev pointer before queue setup - net: macb: avoid dealing with endianness in macb_set_hwaddr() - net: macb: fix unregister_netdev call order in macb_remove() - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure - net: mdio: aspeed: add dummy read to avoid read-after-write issue - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - net: mdio: fix resource leak in mdiobus_register_device() - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - net/mlx5: Clean up only new IRQ glue on request_irq() failure - net/mlx5: Drain firmware reset in shutdown callback - net/mlx5e: Account for netdev stats in ndo_get_stats64 - net/mlx5e: Consider aggregated port speed during rate configuration - net/mlx5e: Don't print error message due to invalid module - net/mlx5e: Don't query FEC statistics when FEC is disabled - net/mlx5e: Fix maxrate wraparound in threshold between units - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Fix validation logic in rate limiting - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Harden uplink netdev access against device unbind - net/mlx5e: Report rx_discards_phy via rx_dropped - net/mlx5e: Restore destroying state bit after profile cleanup - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload - net/mlx5e: TC, delete flows only for existing peers - net/mlx5e: Use extack in get module eeprom by page callback - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() - net/mlx5: fw reset, add reset timeout work - net/mlx5: fw reset, clear reset requested on drain_fw_reset - net/mlx5: fw_tracer, Handle escaped percent properly - net/mlx5: fw_tracer, Validate format string parameters - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Serialize firmware reset with devlink - net/mlx5: Skip HotPlug check on sync reset using hot reset - net/mlx5: Stop polling for command response if interface goes down - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: mscc: ocelot: Fix crash when adding interface under a lag - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - net: netpoll: ensure skb_pool list is always initialized - net: netpoll: fix incorrect refcount handling causing incorrect cleanup - net: netpoll: flush skb pool during cleanup - net: netpoll: Individualize the skb pool - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write - net: nfc: nci: Add parameter validation for packet data - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy - net: openvswitch: fix data race in ovs_vport_get_upcall_stats - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - net: phy: adin1100: Fix software power-down ready condition - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY - net: phy: clear link parameters on admin link down - net: phy: dp83867: Disable EEE support as not implemented - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - net: phy: fix phy_uses_state_machine() - net: phy: marvell: Fix 88e1510 downshift counter errata - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - netpoll: remove netpoll_srcu - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() - net: ravb: Enforce descriptor type ordering - net: ravb: Ensure memory write completes before ringing TX doorbell - net: Remove conditional threaded-NAPI wakeup based on task state. - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - netrom: fix double-free in nr_route_frame() - netrom: Fix memory leak in nr_sendmsg() - net: rose: fix invalid array index in rose_kill_by_device() - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - net/sched: act_ife: avoid possible NULL deref - net/sched: act_ife: convert comma to semicolon - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net/sched: cls_u32: use skb_header_pointer_careful() - net/sched: Enforce that teql can only be used as root qdisc - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change - net/sched: ets: Remove drr class from the active list if it changes to strict - net_sched: limit try_bulk_dequeue_skb() batches - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop - net/sched: sch_qfq: do not free existing class in qfq_change_class() - net/sched: sch_qfq: Fix null-deref in agg_dequeue - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module - net: sh_eth: Disable WoL if system can not suspend - net/smc: fix mismatch between CLC header and proposal - net: sock: fix hardened usercopy panic in sock_recv_errqueue - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - net: stmmac: Correctly handle Rx checksum offload errors - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - net: stmmac: Fix accessing freed irq affinity_hint - net: stmmac: fix rx limit check in stmmac_rx_zc() - net: stmmac: fix the crash issue for zero copy XDP_TX action - net: stmmac: make sure that ptp_rate is not 0 before configuring EST - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: tls: Cancel RX async resync request on rcd_delta overflow - net: tls: wait for async completion on last message - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - net: update netdev_lock_{type,name} - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - net: usb: asix_devices: Check return value of usbnet_get_endpoints - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock - net: usb: asix: validate PHY address before use - net: usb: dm9601: remove broken SR9700 support - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: pegasus: fix memory leak in update_eth_regs_async() - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast - net: usb: rtl8150: Fix frame padding - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - net: usb: sr9700: fix incorrect command used to write single register - net: usb: sr9700: support devices with virtual driver CD - net: vlan: sync VLAN features with lower device - net: When removing nexthops, don't call synchronize_net if it is not necessary - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() - net: wwan: t7xx: fix potential skb->frags overflow in RX path - nexthop: Forbid FDB status change while nexthop is in a group - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). - nfc: nci: Fix race between rfkill and nci_unregister_device(). - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() - nfp: fix RSS hash key size when RSS is not supported - NFS4: Fix state renewals missing after boot - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags - NFS: Avoid changing nlink when file removes and attribute updates race - NFS: check if suid/sgid was cleared after a write as needed - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno - NFSD/blocklayout: Fix minlength check in proc_layoutget - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap - nfsd: convert to new timestamp accessors - nfsd: decouple the xprtsec policy check from check_nfsd_access() - NFSD: Define a proc_layoutcommit for the FlexFiles layout type - nfsd: don't ignore the return code of svc_proc_register() - nfsd: Drop the client reference in client_states_open() - nfsd: Fix a regression in nfsd_setattr() - NFSD: Fix crash in nfsd4_read_release() - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - NFSD: Fix last write offset handling in layoutcommit - nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr() - NFSD: Fix permission check for read access to executable-only files - NFSD: fix race between nfsd registration and exports_proc - NFSD: free copynotify stateid in nfs4_free_ol_stateid() - nfsd: Mark variable __maybe_unused to avoid W=1 build break - NFSD: Minor cleanup in layoutcommit processing - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: NFSv4 file creation neglects setting ACL - nfsd: provide locking for v4_end_grace - NFSD: Remove NFSERR_EAGAIN - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - NFSD: Rework encoding and decoding of nfsd4_deviceid - nfsd: set security label during create operations - NFSD: use correct reservation type in nfsd4_scsi_fence_client - NFS: enable nconnect for RDMA - NFS: Fix inheritance of the block sizes when automounting - NFS: Fix up the automount fs_context to use the correct cred - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() - NFS: Initialise verifiers for visible dentries in readdir and lookup - NFS: Serialise O_DIRECT i/o and truncate() - NFS: sysfs: fix leak when nfs_client kobject add fails - NFS: trace: show TIMEDOUT instead of 0x6e - NFSv4.1: fix backchannel max_resp_sz verification check - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Don't clear capabilities that won't be reset - NFSv4: ensure the open stateid seqid doesn't go backwards - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4: handle ERR_GRACE on delegation recalls - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - nilfs2: Fix potential block overflow that cause system hang - nios2: ensure that memblock.current_limit is set when setting pfn limits - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot - NTB: epf: Allow arbitrary BAR mapping - ntfs3: Fix uninit buffer allocated by __getname() - ntfs3: fix uninit memory after failed mi_read in mi_format_new - ntfs3: init run lock for extend inode - ntfs3: pretend $Extend records as regular files - ntfs: Do not overwrite uptodate pages - ntfs: set dummy blocksize to read boot_block when mounting - null_blk: fix kmemleak by releasing references to fault configfs items - null_blk: Fix the description of the cache_size module argument - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - nvme-auth: use kvfree() for memory allocated with kvcalloc() - nvme-fc: don't hold rport lock when putting ctrl - nvme-fc: release admin tagset if init fails - nvme-fc: rename free_ctrl callback to match name pattern - nvme-fc: use lock accessing port_state and rport state - nvme: fix admin request_queue lifetime - nvme: fix PCIe subsystem reset controller state transition - nvme-multipath: fix lockdep WARN due to partition scan work - nvme-multipath: Skip nr_active increments in RETRY disposition - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - nvme-pci: disable secondary temp for Wodposit WPBSNM8 - nvme-pci: do not directly handle subsys reset fallout - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-fc: avoid scheduling association deletion twice - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - nvmet-tcp: remove boilerplate code - nvme: Use non zero KATO for persistent discovery connections - objtool: Fix standalone --hacks=jump_label - objtool: Fix weak symbol detection - ocfs2: clear extent cache after moving/defragmenting extents - ocfs2: fix double free in user_cluster_connect() - ocfs2: fix kernel BUG in ocfs2_find_victim_chain - ocfs2: fix memory leak in ocfs2_merge_rec_left() - ocfs2: fix recursive semaphore deadlock in fiemap call - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() - octeon_ep: Fix memory leak in octep_device_setup() - octeontx2-af: Fix error handling - octeontx2: cn10k: fix RX flowid TCAM mask handling - octeontx2: Fix otx2_dma_map_page() error return code - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - of: fix reference count leak in of_alias_scan() - of: platform: Use default match table for /firmware - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - once: fix race by moving DO_ONCE to separate section - openat2: don't trigger automounts with RESOLVE_NO_XDEV - orangefs: fix xattr related buffer overflow... - padata: Reset next CPU when reorder sequence wraps around - page_pool: always add GFP_NOWARN for ATOMIC allocations - page_pool: Clamp pool size to max 16K pages - page_pool: Fix use-after-free in page_pool_recycle_in_ring - parisc: Do not reprogram affinitiy on ASP chip - parisc: don't reference obsolete termio struct for TC* constants - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace - parisc: Remove spurious if statement from raw_copy_from_user() - PCI: Add PCI_VDEVICE_SUB helper macro - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/AER: Support errors introduced by PCIe r6.0 - PCI: brcmstb: Fix disabling L0s capability - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - PCI: Disable MSI on RDC PCI to PCIe bridges - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - PCI: j721e: Fix programming sequence of "strap" settings - PCI: keystone: Exit ks_pcie_probe() for invalid mode - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths - PCI/PM: Skip resuming to D0 if device is disconnected - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI/sysfs: Ensure devices are powered for config reads - PCI/sysfs: Ensure devices are powered for config reads (part 2) - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - perf arm-spe: Extend branch operations - perf arm_spe: Fix memset subclass in operation - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() - perf arm-spe: Rename the common data source encoding - perf evsel: Avoid container_of on a NULL leader - perf evsel: Ensure the fallback message is always written to - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf lock contention: Load kernel map before lookup - perf maps: Add maps__load_first() - perf python: split Clang options when invoking Popen - perf record: skip synthesize event when open evsel failed - perf: sched: Fix perf crash with new is_user_task() helper - perf session: Fix handling when buffer exceeds 2 GiB - perf: Skip user unwind if the task is a kernel thread - perf subcmd: avoid crash in exclude_cmds when excludes is empty - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf test stat: Avoid hybrid assumption when virtualized - perf tools: Add fallback for exclude_guest - perf tools: Fix split kallsyms DSO counting - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - perf util: Fix compression checks returning -1 as bool - perf/x86/amd: Check event before enable to avoid GPF - perf/x86/intel: Correct large PEBS flag check - perf/x86/intel: Do not enable BTS for guests - phy: broadcom: bcm63xx-usbh: fix section mismatches - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - phy: cdns-dphy: Store hs_clk_rate and return it - phy: drop probe registration printks - phy: freescale: imx8m-pcie: assert phy reset during power on - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it - phy: mscc: Fix PTP for VSC8574 and VSC8572 - phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path - phy: phy-snps-eusb2: refactor constructs names - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() - phy: rockchip: inno-usb2: fix communication disruption in gadget mode - phy: rockchip: inno-usb2: fix disconnection in gadget mode - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: stm32-usphyc: Fix off by one in probe() - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 - phy: tegra: xusb: fix device and OF node leak at probe - phy: ti: omap-usb2: fix device leak at unbind - phy: ti-pipe3: fix device leak at unbind - phy: Use device_get_match_data() - pid: Add a judgment for ns null in pid_nr_ns - pinctrl: check the return value of pinmux_ops::get_function_name() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - pinctrl: keembay: release allocated memory in detach path - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver - pinctrl: meson-gxl: add missing i2c_d pinmux - pinctrl: meson: mark the GPIO controller as sleeping - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping - pinctrl: qcom: msm: Fix deadlock in pinmux configuration - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins - pinctrl: renesas: Use int type to store negative error codes - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: samsung: Drop unused S3C24xx driver data - pinctrl: single: fix bias pull up/down handling in pin_config_set - pinctrl: single: Fix incorrect type for error return variable - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling - pinctrl: stm32: fix hwspinlock resource leak in probe function - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver - platform/x86: acer-wmi: Ignore backlight event - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led - platform/x86: hp-bioscfg: Fix automatic module loading - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names - platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing - platform/x86: hp-bioscfg: Skip empty attribute names - platform/x86: huawei-wmi: add keys for HONOR models - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic - platform/x86: intel: chtwc_int33fe: don't dereference swnode args - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks - platform/x86: intel: punit_ipc: fix memory corruption - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - platform/x86: intel_telemetry: Fix PSS event register mask - platform/x86: intel_telemetry: Fix swapped arrays in PSS output - platform/x86: msi-laptop: add missing sysfs_remove_group() - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup - pmdomain: imx: Fix reference count leak in imx_gpc_probe() - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state - pmdomain: samsung: plug potential memleak during probe - pmdomain: Use device_get_match_data() - PM: runtime: Add new devm functions - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - PM: sleep: core: Clear power.must_resume in noirq suspend error path - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - posix-clock: introduce posix_clock_context concept - posix-clock: Store file pointer in struct posix_clock_context - powercap: fix race condition in register_control_type() - powercap: fix sscanf() error return value handling - powerpc/32: Fix unpaired stwcx. on interrupt exit - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format - powerpc/64s/radix/kfence: map __kfence_pool at page granularity - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - powerpc/addnote: Fix overflow on 32-bit builds - powerpc/eeh: Use result of error_detected() in uevent - powerpc/kexec: Enable SMT before waking offline CPUs - powerpc, mm: Fix mprotect on book3s 32-bit - powerpc/powernv/pci: Fix underflow and leak issue - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION - powerpc/pseries/msi: Fix potential underflow and leak issue - power: supply: apm_power: only unset own apm_get_power_status - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery - power: supply: bq27xxx: restrict no-battery detection to bq27000 - power: supply: cw2015: Check devm_delayed_work_autocancel() return code - power: supply: cw2015: Fix a alignment coding style issue - power: supply: max77976_charger: fix constant current reporting - power: supply: qcom_battmgr: add OOI chemistry - power: supply: qcom_battmgr: handle charging state change notifications - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() - power: supply: sbs-charger: Support multiple devices - power: supply: wm831x: Check wm831x_set_bits() return value - pps: fix warning in pps_register_cdev when register device fail - proc: fix type confusion in pde_set_flags() - ps3disk: use memcpy_{from,to}_bvec index - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. - ptp: add testptp mask test - ptp: Limit time setting of PTP clocks - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() - pwm: bcm2835: Make sure the channel is enabled after pwm_request() - pwm: berlin: Fix wrong register in suspend/resume - pwm: stm32: Always program polarity - pwm: tiehrpwm: Fix corner case in clock divisor calculation - qed: Don't collect too many protection override GRC elements - quota: remove unneeded return value of register_quota_format - r8152: add error handling in rtl8152_driver_init - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - r8169: fix RTL8117 Wake-on-Lan in DASH mode - r8169: set EEE speed down ratio to 1 - rbd: check for EOD after exclusive lock is ensured to be held - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - RDMA/bnxt_re: fix dma_free_coherent() pointer - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() - RDMA/bnxt_re: Fix the inline size for GenP7 devices - RDMA/bnxt_re: Fix to use correct page size for PDE table - RDMA/cm: Fix leaking the multicast GID table reference - RDMA/cm: Rate limit destroy CM ID timeout error message - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() - RDMA/core: Resolve MAC of next-hop device without ARP support - RDMA/efa: Remove possible negative shift - RDMA/hns: Fix the modification of max_send_sge - RDMA/hns: Fix wrong WQE data when QP wraps around - RDMA/irdma: Add support to re-register a memory region - RDMA/irdma: avoid invalid read in irdma_net_event - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY - RDMA/irdma: Fix data race in irdma_free_pble - RDMA/irdma: Fix data race in irdma_sc_ccq_arm - RDMA/irdma: Fix SD index calculation - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/mlx5: Fix vport loopback forcing for MPV device - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation - RDMA/rtrs: server: Fix error handling in get_or_create_srv - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure - RDMA/rxe: Fix race in do_task() when draining - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests - RDMA/rxe: Remove the direct link to net_device - RDMA/siw: Always report immediate post SQ errors - rds: Fix endianness annotation for RDS_MPATH_HASH - rds: ib: Increment i_fastreg_wrs before bailing out - regmap: Fix race condition in hwspinlock irqsave routine - regmap: maple: free entry on mas_store_gfp() failure - regmap: Remove superfluous check for !config in __regmap_init() - regmap: slimbus: fix bus_context pointer in regmap init calls - regulator: core: disable supply if enabling main regulator fails - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex - regulator: fixed: fix GPIO descriptor leak on register failure - regulator: scmi: Use int type to store negative error codes - regulator: sy7636a: fix lifecycle of power good gpio - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - remoteproc: qcom: q6v5: Avoid handling handover twice - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - reset: fix BIT macro reference - resource: introduce is_type_match() helper and use it - resource: replace open coded resource_intersection() - resource: Reuse for_each_resource() macro - Revert "cpuidle: menu: Avoid discarding useful information" - Revert "driver core: enforce device_lock for driver_match_device()" - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - Revert "gfs2: Fix use of bio_chain" - Revert "iommu/amd: Skip enabling command/event buffers for kdump" - Revert "ipmi: fix msg stack when IPMI is disconnected" - Revert "loop: Avoid updating block size under exclusive owner" - Revert "mtd: rawnand: marvell: fix layouts" - Revert "net: Allow to use SMP threads for backlog NAPI." - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - Revert "net: Remove conditional threaded-NAPI wakeup based on task state." - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Revert "nfc/nci: Add the inconsistency check between the input data length and count" - Revert "nfs: clear SB_RDONLY before getting superblock" - Revert "nfs: ignore SB_RDONLY when mounting nfs" - Revert "nfs: ignore SB_RDONLY when remounting nfs" - Revert "perf dso: Add missed dso__put to dso__load_kcore" - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - Revert "SUNRPC: Don't allow waiting for exiting tasks" - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - Revert "xfrm: destroy xfrm_state synchronously on net exit path" - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - riscv: bpf: Fix uninitialized symbol 'retval_off' - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - riscv: clocksource: Fix stimecmp update hazard on RV32 - riscv: compat: fix COMPAT_UTS_MACHINE definition - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - RISC-V: Don't print details of CPUs disabled in DT - riscv: Improve exception and system call latency - riscv: kprobes: Fix probe address validation - RISC-V: KVM: Fix guest page fault within HLV* instructions - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - RISC-V: Remove unnecessary include from compat.h - riscv: Replace function-like macro by static inline function - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: stacktrace: fix backtracing through exceptions - riscv: uprobes: Add missing fence.i after building the XOL buffer - rocker: fix memory leak in rocker_world_port_post_fini() - rpmsg: glink: fix rpmsg device leak - rseq: Protect event mask against membarrier IPI - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: gamecube: Check the return value of ioremap() - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - rtc: interface: Fix long-standing race when setting alarm - rtc: optee: fix memory leak on driver removal - rtc: pcf2127: clear minute/second interrupt - rtc: pcf2127: fix SPI command byte for PCF2131 backport - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - rtc: rx8025: fix incorrect register reference - rtc: x1205: Fix Xicor X1205 vendor prefix - rtnetlink: Allow deleting FDB entries in user namespace - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target - s390/ap: Don't leak debug feature files if AP instructions are not available - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/cio: Update purge function to unregister the unused subchannels - s390/cpum_cf: Deny all sampling events by counter PMU - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - s390/ctcm: Fix double-kfree - s390/dasd: Fix gendisk parent after copy pair swap - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - s390/ipl: Clear SBP flag when bootprog is set - s390/mm: Fix __ptep_rdp() inline assembly - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump - s390/pci: Restore IRQ unconditionally for the zPCI device - s390/pci: Use pci_uevent_ers() in PCI recovery - s390/smp: Fix fallback CPU detection - samples/ftrace: Adjust LoongArch register restore order in direct calls - samples: work around glibc redefining some of our defines wrong - sched/balancing: Rename newidle_balance() => sched_balance_newidle() - sched/deadline: Fix race in push_dl_task() - sched/deadline: only set free_cpus for online runqueues - sched/fair: Fix pelt lost idle time detection - sched/fair: Forfeit vruntime on yield - sched/fair: Proportional newidle balance - sched/fair: Revert max_newidle_lb_cost bump - sched/fair: Small cleanup to sched_balance_newidle() - sched/fair: Small cleanup to update_newidle_cost() - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - sched: Remove never used code in mm_cid_get() - sched/rt: Fix race in push_rt_task - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep - scs: fix a wrong parameter in __scs_magic - scsi: aic94xx: fix use-after-free in device removal path - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() - scsi: core: Fix a regression triggered by scsi_host_busy() - scsi: core: Fix error handler encryption support - scsi: core: Wake up the error handler when final completions race against each other - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: mpi3mr: Fix controller init failure on fault during queue creation - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - scsi: myrs: Fix dma_alloc_coherent() error check - scsi: pm8001: Use int instead of u32 to store error codes - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod - scsi: pm80xx: Fix race condition caused by static variables - scsi: qla2xxx: Allow recovery for tape devices - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: edif: Fix dma_free_coherent() size - scsi: qla2xxx: edif: Fix incorrect sign of error code - scsi: qla2xxx: Fix improper freeing of purex item - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Query FW again before proceeding with login - scsi: qla2xxx: Sanitize payload size to prevent member overflow - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp - scsi: qla2xxx: Validate sp before freeing associated memory - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - scsi: sg: Do not sleep in atomic context - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls - scsi: smartpqi: Fix device resources accessed after device removal - scsi: stex: Fix reboot_notifier leak in probe error path - scsi: storvsc: Process unsupported MODE_SENSE_10 - scsi: target: Do not write NUL characters into ASCII configfs output - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - scsi: target: Reset t_task_cdb pointer in error case - scsi: target: target_core_configfs: Add length check to avoid buffer overflow - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error - scsi: ufs: core: Disable timestamp functionality if not supported - scsi: ufs: core: Fix EH failure after W-LUN resume error - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() - sctp: avoid NULL dereference when chunk data buffer is missing - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). - sctp: Fix MAC comparison to be constant-time - sctp: Hold RCU read lock while iterating over address list - sctp: Hold sock lock while iterating over address list - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: Prevent TOCTOU out-of-bounds write - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - selftest/ptp: update ptp selftest to exercise the gettimex options - selftests: arg_parsing: Ensure data is flushed to disk before reading. - selftests: arm64: Check fread return value in exec_target - selftests: bonding: add delay before each xvlan_over_bond connectivity check - selftests: bonding: add ipvlan over bond testing - selftests: bonding: add missing build configs - selftests: bonding: Add more missing config options - selftests/bpf: Check for timeout in perf_link test - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - selftests/bpf: Fix failure paths in send_signal test - selftests/bpf: Improve reliability of test_perf_branches_no_hw() - selftests/bpf: make arg_parsing.c more robust to crashes - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - selftests: Disable dad for ipv6 in fcnal-test.sh - selftests: drv-net: fix RPS mask handling for high CPU numbers - selftests: fib_nexthops: Fix creation of non-FDB nexthops - selftests/ftrace: traceonoff_triggers: strip off names - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: check no dup close events after error - selftests: mptcp: check subflow errors in close events - selftests: mptcp: connect: catch IO errors on listen side - selftests: mptcp: connect: fix fallback note due to OoO - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: disable add_addr retrans in endpoint_tests - selftests: mptcp: join: endpoints: longer transfer - selftests: mptcp: join: fix local endp not being tracked - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: properly kill background tasks - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: join: validate C-flag + def limit - selftests: mptcp: pm: ensure unknown flags are ignored - selftests: mptcp: sockopt: fix error messages - selftests: mptcp: userspace pm: validate deny-join-id0 flag - selftests: net: amt: wait longer for connection before sending packets - selftests/net: convert fib-onlink-tests.sh to run it in unique namespace - selftests/net: convert sctp_vrf.sh to run it in unique namespace - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - selftests: netdevsim: set test timeout to 10 minutes - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests: net: fib-onlink-tests: Convert to use namespaces by default - selftests: net: fix "buffer overflow detected" for tap.c - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - selftests: net: fix server bind failure in sctp_vrf.sh - selftests: net: local_termination: Wait for interfaces to come up - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - selftests: net: replace sleeps in fcnal-test with waits - selftests: net: use BASH for bareudp testing - selftests/net: use destination options instead of hop-by-hop - selftests/nolibc: fix EXPECT_NZ macro - selftests: openvswitch: Fix escape chars in regexp. - selftests: Replace sleep with slowwait - selftests: traceroute: Use require_command() - selftests/tracing: Run sample events to clear page cache events - selftests/user_events: fix type cast for write_index packed member in perf_test - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - serial: 8250_dw: handle reset control deassert error - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_pci: Fix broken RS485 for F81504/508/512 - serial: add support of CPCI cards - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - serial: max310x: Add error checking in probe() - serial: sc16is7xx: fix bug in flow control levels init - serial: sc16is7xx: refactor EFR lock - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - serial: sc16is7xx: remove useless enable of enhanced features - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready - serial: stm32: allow selecting console when the driver is module - sfc: fix potential memory leak in efx_mae_process_mport() - shmem: fix tmpfs reconfiguration (remount) when noswap is set - slimbus: core: fix device reference leak on report present - slimbus: core: fix runtime PM imbalance on report present - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - smack: fix bug: unprivileged task can create labels - smb: client: fix cifs_pick_channel when channel needs reconnect - smb: client: fix crypto buffers in non-linear memory - smb: client: fix incomplete backport in cfids_invalidation_worker() - smb: client: fix memory leak in cifs_construct_tcon() - smb/client: fix memory leak in smb2_open_file() - smb: client: fix missing timestamp updates after utime(2) - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value - smb/client: fix NT_STATUS_NO_DATA_DETECTED value - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value - smb: client: fix potential cfid UAF in smb2_query_info_compound - smb: client: fix potential UAF in smb2_close_cached_fid() - smb: client: Fix refcount leak for cifs_sb_tlink - smb: client: fix refcount leak in smb2_set_path_attr - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path - smb: client: fix wrong index reference in smb2_compound_op() - smb: client: introduce close_cached_dir_locked() - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - smb: client: transport: avoid reconnects triggered by pending task work - smb: client: validate change notify buffer before copy - smb: fix invalid username check in smb3_fs_context_parse_param() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: don't use delayed_work for post_recv_credits_work - smb: server: fix IRD/ORD negotiation with the client - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - smb/server: fix possible memory leak in smb2_read() - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix refcount leak in parse_durable_handle_context() - smb/server: fix refcount leak in smb2_open() - smb/server: fix return value of smb2_ioctl() - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - smc91x: fix broken irq-context in PREEMPT_RT - smp: Fix up and expand the smp_call_function_many() kerneldoc - smsc911x: add second read of EEPROM mac when possible corruption seen - soc: amlogic: canvas: fix device leak on lookup - soc: aspeed: socinfo: Add AST27xx silicon IDs - soc: qcom: ocmem: fix device leak on lookup - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: qcom: smem: fix hwspinlock resource leak in probe error paths - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - sparc64: fix hugetlb for sun4u - sparc64: fix prototypes of reads[bwl]() - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix error handling in scan_one_device() - sparc/module: Add R_SPARC_UA64 relocation handling - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: cadence-quadspi: Fix clock disable on probe failure path - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - spi: cadence-quadspi: Implement refcount to handle unbind during busy - spi: fsl-cpm: Check length parity before switching to 16 bit mode - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - spi: imx: keep dma request disabled before dma transfer setup - spi: loopback-test: Don't use %pK through printk - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: rpc-if: Add resume support for RZ/G3E - spi: spi-mem: Add a new controller capability - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-nxp-fspi: add extra delay after dll locked - spi: spi-sprd-adi: Fix double free in probe error path - spi: sprd-adi: switch to use spi_alloc_host() - spi: sprd: adi: Use devm_register_restart_handler() - spi: tegra114: Preserve SPI mode bits in def_command1_reg - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - spi: tegra210-quad: Fix timeout handling - spi: tegra210-quad: Move curr_xfer read inside spinlock - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer - spi: tegra: Fix a memory leak in tegra_slink_probe() - spi: Try to get ACPI GPIO IRQ earlier - spi: xilinx: increase number of retries before declaring stall - Squashfs: add additional inode sanity checking - Squashfs: fix uninit-value in squashfs_get_parent - Squashfs: reject negative file sizes in squashfs_read_inode() - staging: axis-fifo: fix maximum TX packet length check - staging: axis-fifo: fix TX handling on copy_from_user() failure - staging: axis-fifo: flush RX FIFO on read errors - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() - staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0 - staging: most: remove broken i2c driver - staging: rtl8712: Remove driver using deprecated API wext - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing - strparser: Fix signed/unsigned mismatch bug - SUNRPC: call xs_sock_process_cmsg for all cmsg - sunrpc: fix null pointer dereference on zero-length checksum - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - svcrdma: bound check rq_pages index in inline path - svcrdma: return 0 on success from svc_rdma_copy_inline_range - task_work: Fix NMI race condition - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - tcp: fix __tcp_close() to only send RST when required - tcp: fix tcp_tso_should_defer() vs large RTT - tcpm: allow looking for role_sw device in the main node - tcpm: switch check for role_sw device with fw_node - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - team: fix check for port enabled in team_queue_override_port_prio_changed() - team: Move team device type change at the end of team_port_add - tee: allow a driver to allocate a tee_device without a pool - testptp: Add option to open PHC in readonly mode - textsearch: describe @list member in ts_ops search - tg3: prevent use of uninitialized remote_adv and local_adv variables - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - thunderbolt: Add support for Intel Wildcat Lake - thunderbolt: Use is_pciehp instead of is_hotplug_bridge - timers: Fix NULL function pointer race in timer_shutdown_sync() - tipc: Fix use-after-free in tipc_mon_reinit_self(). - tipc: use kfree_sensitive() for session key material - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx - tls: always set record_type in tls_process_cmsg - tls: don't rely on tx_work during send() - tls: make sure to abort the stream if headers are bogus - tls: trim encrypted message to match the plaintext on short splice - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). - tls: wait for async encrypt in case of error during latter iterations of sendmsg - tls: wait for pending async decryptions if tls_strp_msg_hold fails - tools bitmap: Add missing asm-generic/bitsperlong.h include - tools build: Align warning options with perf - tools/cpupower: fix error return value in cpupower_write_sysfs() - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - tools: lib: thermal: don't preserve owner in install - tools: lib: thermal: use pkg-config to locate libnl3 - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/testing/nvdimm: Use per-DIMM device handle - tools: ynl: Specify --no-line-number in ynl-regen.sh. - tpm: Cap the number of PCR banks - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - tracefs: fix a leak in eventfs_create_events_dir() - tracing: Do not register unsupported perf events - tracing: dynevent: Add a missing lockdown check on dynevent - tracing: Fix crash on synthetic stacktrace field usage - tracing: Fix fixed array of synthetic event - tracing: Fix ftrace event field alignments - tracing: Fix memory leaks in create_field_var() - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference - tracing: Fix tracing_marker may trigger page fault during preempt_disable - tracing: Silence warning when chunk allocation fails in trace_pid_write - tracing/tools: Fix incorrcet short option in usage text for --threads - tty: fix tty_port_tty_*hangup() kernel-doc - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - tty: introduce and use tty_port_tty_vhangup() helper - tty: n_gsm: Don't block input queue by waiting MSC - tunnels: reset the GSO metadata before reusing the skb - uacce: ensure safe queue release with state management - uacce: fix cdev handling in the cleanup path - uacce: fix isolate sysfs check condition - uacce: implement mremap in uacce_vm_ops to return -EPERM - ublk: complete command synchronously on error - ublk: fix deadlock when reading partition table - ublk: make sure io cmd handled in submitter task context - ublk: prevent invalid access with DEBUG - udp_tunnel: use netdev_warn() instead of netdev_WARN() - uio_hv_generic: Let userspace take care of interrupt mask - uio_hv_generic: Set event for all channels on the device - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe - um: Fix help message for ssl-non-raw - um: virtio_uml: Fix use-after-free after put_device in probe - Unbreak 'make tools/*' for user-space targets - uprobe: Do not emulate/sstep original instruction when ip is changed - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - usb: cdns3: Fix double resource release in cdns3_pci_probe - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget - usb: chaoskey: fix locking for O_NONBLOCK - usb: core: Add 0x prefix to quirks debug output - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor - usb/core/quirks: Add Huawei ME906S to wakeup quirk - usb: dwc2: disable platform lowlevel hw resources during shutdown - usb: dwc2: fix hang during shutdown if set as peripheral - usb: dwc2: fix hang during suspend if set as peripheral - usb: dwc3: Check for USB4 IP_NAME - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: keep susphy enabled during exit to avoid controller faults - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: dwc3: pci: Sort out the Intel device IDs - USB: Fix descriptor count when handling invalid MBIM extended descriptor - usb: gadget: configfs: Correctly set use_os_string at bind - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - usb: gadget: f_hid: Fix zero length packet transfer - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: lpc32xx_udc: fix clock imbalance in error path - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - usb: gadget: Store endpoint pointer in usb_request - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - usbip: Fix locking bug in RT-enabled kernels - USB: lpc32xx_udc: Fix error handling in probe - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - usbnet: Fix using smp_processor_id() in preemptible code warnings - usbnet: limit max_mtu based on device's hard_mtu - usbnet: Prevents free active kevent - usb: ohci-nxp: fix device leak on probe failure - usb: ohci-nxp: Use helper function devm_clk_get_enabled() - USB: OHCI/UHCI: Add soft dependencies on ehci_platform - usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal - usb: phy: Initialize struct usb_phy list_head - usb: phy: isp1301: fix non-OF device reference imbalance - usb: phy: twl6030: Fix incorrect type for ret - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - usb: raw-gadget: do not limit transfer length - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() - usb: renesas_usbhs: Fix synchronous external abort on unbind - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - USB: serial: ftdi_sio: match on interface number for jtag - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC - USB: serial: option: add Foxconn T99W760 - USB: serial: option: add Quectel RG255C - USB: serial: option: add SIMCom 8230C compositions - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: option: add Telit Cinterion FE910C04 new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Telit LE910 MBIM composition - USB: serial: option: add UNISOC UIS7720 - USB: serial: option: move Telit 0x10c7 composition in the right place - usb: storage: Fix memory leak in USB bulk transport - USB: storage: Remove subclass and protocol overrides from Novatek quirk - usb: storage: sddr55: Reject out-of-bound new_pba - usb: typec: tipd: Clear interrupts first - usb: typec: ucsi: Handle incorrect num_connectors capability - usb: typec: ucsi: psy: Set max current to zero when disconnected - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer - usb: udc: Add trace event for usb_gadget_set_state - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. - usb: vhci-hcd: Prevent suspending virtually attached devices - usb: xhci: Apply the link chain quirk on NEC isoc endpoints - usb: xhci: limit run_graceperiod for only usb 3.0 devices - usb: xhci: move link chain bit quirk checks into one helper function. - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - vdpa/pds: use %pe for ERR_PTR() in event handler registration - veth: fix data race in veth_get_ethtool_stats - vfio/pds: replace bitmap_free with vfree - vfio: return -ENOTTY for unsupported device feature - vfs: Don't leak disconnected dentries on umount - vhost: Take a reference on the task in struct vhost_task. - vhost: vringh: Fix copy_to_iter return value check - vhost: vringh: Modify the return value check - vhost/vsock: improve RCU read sections around vhost_vsock_get() - via_wdt: fix critical boot hang due to unnamed resource allocation - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - virtio_console: fix order of fields cols and rows - virtio: fix typo in virtio_device_ready() comment - virtio: fix virtqueue_set_affinity() docs - virtio: fix whitespace in virtio_config_ops - virtio-net: fix incorrect flags recording in big mode - virtio-net: fix received length check in big packets - virtio_vdpa: fix misleading return in void function - vmxnet3: unregister xdp rxq info in the reset path - vsock: fix lock inversion in vsock_assign_transport() - vsock: Ignore signal/timeout on connect() if already established - vsock/test: add a final full barrier after run all tests - vsock/test: fix seqpacket message bounds test - vsock/test: verify socket options after setting them - vsock/virtio: cap TX credit to local buffer size - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - w1: fix redundant counter decrement in w1_attach_slave_device() - w1: therm: Fix off-by-one buffer overflow in alarms_store - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - watchdog: starfive: Fix resource leak in probe error path - watchdog: wdat_wdt: Fix ACPI table leak in probe function - wifi: ath10k: avoid unnecessary wait for service ready message - wifi: ath10k: Fix connection after GTK rekeying - wifi: ath10k: fix dma_free_coherent() pointer - wifi: ath10k: Fix memory leak on unsupported WMI command - wifi: ath11k: Add missing platform IDs for quirk table - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode - wifi: ath11k: fix peer HE MCS assignment - wifi: ath11k: fix RCU stall while reaping monitor destination ring - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - wifi: ath12k: fix dma_free_coherent() pointer - wifi: ath12k: free skb during idr cleanup callback - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - wifi: avoid kernel-infoleak from struct iw_point - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - wifi: cfg80211: Fix bitrate calculation overflow for HE rates - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() - wifi: ieee80211: correct FILS status codes - wifi: mac80211: collect station statistics earlier when disconnect - wifi: mac80211: correctly check if CSA is active - wifi: mac80211: Discard Beacon frames to non-broadcast address - wifi: mac80211: do not use old MBSSID elements - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice - wifi: mac80211: fix CMAC functions not handling errors - wifi: mac80211: Fix HE capabilities element check - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - wifi: mac80211: increase scan_ies_len for S1G - wifi: mac80211: move TDLS work to wiphy work - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined - wifi: mac80211: reject address change while connecting - wifi: mac80211: remove RX_DROP_UNUSABLE - wifi: mac80211: skip rate verification for not captured PSDUs - wifi: mt76: Fix DTS power-limits on little endian systems - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() - wifi: mwifiex: send world regulatory domain to driver - wifi: rsi: Fix memory corruption due to not set vif driver data size - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - wifi: rtw88: sdio: use indirect IO for device registers before power-on - wifi: rtw89: avoid circular locking dependency in ser_state_run() - wifi: virt_wifi: Fix page fault on connect - wifi: wilc1000: avoid buffer overflow in WID string configuration - wifi: wlcore: ensure skb headroom before skb_push - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 - x86/boot: Fix page table access in 5-level to 4-level paging transition - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - x86: disable image size check for test builds - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - x86/fpu: Ensure XFD state on signal delivery - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers - x86/kfence: avoid writing L1TF-vulnerable PTEs - x86/kfence: fix booting on 32bit non-PAE systems - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - x86: make page fault handling disable interrupts properly - x86/microcode/AMD: Add more known models to entry sign checking - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - x86/microcode/AMD: Limit Entrysign signature checking to known generations - x86/microcode/AMD: Select which microcode patch to load - x86/microcode: Fix Entrysign revision check for Zen1/Naples - x86/ptrace: Always inline trivial accessors - x86/resctrl: Add missing resctrl initialization for Hygon - x86/resctrl: Fix memory bandwidth counter width for Hygon - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - x86/umip: Check that the instruction opcode is at least two bytes - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) - x86/vdso: Fix output operand size of RDPID - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - x86/xen: Fix sparse warning in enlighten_pv.c - x86/xen: Move Xen upcall handler - xen/events: Cleanup find_virq() return codes - xen/events: Return -EEXIST for bound VIRQs - xen/events: Update virq_to_irq on migration - xen/manage: Fix suspend error path - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - xfrm: Determine inner GSO type from packet inner protocol - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - xfrm: flush all states in xfrm_state_fini - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: state: fix out-of-bounds read during lookup - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfs: always warn about deprecated mount options - xfs: fix a memory leak in xfs_buf_item_init() - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - xfs: use deferred intent items for reaping crosslinked blocks - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: decouple endpoint allocation from initialization - xhci: dbc: enable back DbC in resume if it was enabled before suspend - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: poll at different rate depending on data transfer activity - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - xhci: dbgtty: fix device unregister - xhci: dbgtty: fix device unregister: fixup - xhci: fix memory leak regression when freeing xhci vdev devices depth first - xsk: Fix race condition in AF_XDP generic RX path - xtensa: simdisk: add input size check in proc_write_simdisk - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Patch from Hans to fix SYNA3602 touchpads- Update initrd size (kb#456)6.6.148-1.module.8188gu6.6.148-16.6.148-15.2.228188gu.ko/lib/modules/6.6.148-desktop-1rosa2021-x86_64/kernel/net/wireless/-O2 -fomit-frame-pointer -gdwarf-4 -Wstrict-aliasing=2 -pipe -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -fPIC -fstack-protector-strong --param=ssp-buffer-size=4 -m64 -mtune=generichttps://rosa.rucpioxz6Tx86_64-rosa-linux-gnuELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=5f6a31f06b7bc41a2e4b7e4f041070342ff375bf, not strippedPooorosa2021https://bugzilla.rosa.rubasesystem-minimalfilesystemsetup@@@utf-86a9eaf83d96ec58b67c249adee3cde2552b8e48a4c0952e39c02c1e377c023a8e75c735ef065a4f41581daafa73d7a7d47c1b8200b47de28023a51339f6b56fe?7zXZ 'Ȅ! ] crv(vX0bRb(Nvb9h+lK|Un6*N]ܻ-]} 1PA*َ/w-Du @bW(D] kj)2г`Mkjsb}<WsJtz?iꫡ&}a>J$GWA1,;zt` }v/4*n .lHaaJo>ҙTIP(y)L*LƞcrKy=^ (֤0괹m4xem{)1Kll&̮D19sAPqvYR'Ð([vzKGHNGkW`LzES\>4h<^Ï`^SI|t }Sm1(K@T!9aQX% g$S'á/?bPRN"@"~ Hhf^,bYy ^(P*?&/lbIROZEbȎO\'wM/ߠ*gԜ+4>Όy<І%rDqd?yqB/[IˣMI-@wK}+3RY6_ r}5Yp#3[Kn9;+ͫKP_i~]ߑWfA|'Z!q9wA8?z*ڔ ?N(i)I+rԅפNN }S؋.u 1>xL]OzI*Ɠ#j͗;qPݼu cZ̸=Eq3g{ V&$gX\zvb|0ɦNK.w!v yv>;Lj ҹpn{]ՋL--CZcqUMKii;2$\[66oUHyPS1Wklwś'W{椋u=_B{lJWȃX.+%2h3$l$|KilVA-|摯I.xL]jZFVi`–w57 FDF'DXo%0eȖ=<J"-&ˡ*m~@\S]K;o];adUBU+xËmϯZ2jׁt=|н3$lGAmC Bn>~YBxT Vs,rdsAц6z p3FeP|R}xS}5ƖG@v5~BBjmV'~o uN.%l}Z^0LԲRe?z1βM]ɐU5?d0WpO(_Yhqh?>B\o2\^q5F=w tɬ1ag%(L2F>A~aNڭ@fv #)bUl B(J?u{PWѻLVUtwojmB\GUB8czuD1wx@G'GдM$y27Z@h'}tM- \i4#&Z#*$s 3DU_E ҾBٖRA} 䊗 qnU+yiQ0Hǭsu^4ɾ/2 ᭞:kw e;pGw@QdJA 按̳6ַ9k9p؞lӾ0C"[ #ȗ|jx3&׌߯*kg:FF~S$mml.{e7SE`G5LXӓ`dTPPr2v F6(P*faj(V}mfoQaiGݝ4J~YR3QQSj=f|9i/6bӅS#2*W}gsZEVE+7zv8΃**EJ߳~'2_a"T b#+ErPeSyU:y%rƲ?}4?B]1|_dƴAwL)F#IޡMV LpEΐKR WD s>惉H^a⸦T ͅT'Q֫Md?s` g駒fJbc},B9v&+D&_xWk! 5۬?Ty}cwz q%ѶkS|ʟ\Ҳ9]yDWT#%4ԺRp'a+m~ܹ9U.ȍ$cUდ!#˕8"6wai"~8@pȗj.$#4-c+~$$-9U%W>](4$&Y{'%Ո Πw"Wr=f uVE~2C76׿2囦=~ 7/_z)Ł5+0QmHdPsL E}֜t*땉>#|sQVwy Iar gB)&2ʈQCqjbFZݶYT@-j*?҃jtCHҽݧELtp5ڿO.ސ>>{vQ ׎V 9/NGDҞ^y]u0Z5mm*ݩ>|.fk"_"x'c}5E(x ;РmE-:)brXY& $bA輇`ʔ.&[08ӽ0\o&QB(jeP=IK|ee_w9?QG~ ʌ‘vۻ^^A*̶cD\*GWJrdުtEw-heL܅B0Ÿ~7|%d; \(۾|. ѫy4ӧpr2DBW4&ӎ Ʋd)vVտx,_\S=JW";EWD=  @dU*05 (xca/P?/[E2H uڵ[@X.I0]]FX"#䋇ez|Wdq` ~7NFbĘ1-Yxv?+,}mz?d7Uhȴ'?;bLh1e|?LH@9, m9 f@ J`` 8K<Z?zh\XQP|<,#V6U`͸zdgq IddLq@9w]3$dήBf=?9SiUң,ӧ{\d9NG:fbJշD9"CpCQXmGyh!2b?cp~_ܛUЀ`_px;}U^#p澡^$ݘr,bsl8_!|!,5\+Wj2rpBR4KmwT u[r*d&bHƎaGzHZs,kDf] }h:]kYve*5;/ FVyfnu\jtRfϣuVt=ZY%6h[d5%@!+01|HLӂeGD No{ l`Ҳbu8!za*a@xxx\҅A|/ׯtlaNSN&R -۟)d X&3D /^p7lK\";gAS Psᛏ 7EX 2Jb9/s-hw׷6R)(5E#=E1q\%KM _s]t;MZ%]3SF 1޿CkwjXΚ]UPͮd-e C7)mT|[^YGo띄l‰ipXC[pWSIb( l4b~)ZUvȻӃa#:Q| ilt9'p ^H'/oErW24*Q\Hp&N;H fD E%ʡ^>e\QqisjPfbNZ`vւj!SP8l,ڨ C쥕`]>45I:i*]RneȆwusyN $XQ ;crġwŜ( X^(vr]Op^OI`L{N {;FIh"OQ}CVgXfIño竘 aчO's4[5lpVm+rG]t%ގM Kc5s$y4<[;'hhj ,ӱ]q&6. AleRfq@X8OmlzaŃ:"ǨL6n4WUBy~:M٪ŚE//W\k lN0ز `bż#ve{Q9ڸv֨Lգb5\klP57&-'E fhQt,ox]:xHQapTb?KjHN TVɶD~8k-R=jFz!p)6Y~s9LB|\f{JqE1.>z-<%";ȷd_Դ9Sc3>.>MU%{OZ{ =p"m Zy ɤzUT=a ɀQ&kW;HA> WFDBAiWya:W-{*쎔jh9I6jl^RYUtFg2YP{x$t?XhXJ|d?W,!t36]̓xפ@i~U1MuLXr,"KRF<^ul츽lfzlaS`2%ҿos+@ۘCk?ӄ9%YܐĢe`;yE*j>Q#U䀹܃Vn7="jM^%W<4.؈0|>E~hpPBl+]ې6KT{q4 !;]A }bY=`trIY*φ_)љ>TZ z i*HWc<IDN4*XIRk)

z-z +S)mY VOx+;zwtzU?T'Voc`6|s Q>̙B~kɴr"{*qe L΀YʈII}0[:?P,me"Mhbk`'f_|5q{,7O1 L˨Ni#&€fmBy*euj/x$NȻdIΔ&ZiiJ D&?gi;8 hy b24R}xʲIf'6o*jxfOpB-cLڨ7^6_{s$'9ASff ٌ.z~}R^#1LG; zeå,\;@(u '×¢3Ä;[ZcXA^ `XbY-@A= Fv@`ZXK00'c-#m* 'M+q.-/9LNI6-Q拴,WfA4XzNXrWZ:jy1}ҙZG&G=(ham0_=q=;,^gj~B"4T3Uvx,5\E=F͑6yy,"R7JfTGeM,75i4FZhrT;;='6 ]T3?a1db(iJ>i)&^!/ +L]gφrr䯑[m@"u"gGǘz$w'CCdOՂr" ٠A/OpCOf<(t;=:r|mѺ|N ";91)N18f% cNXj^N.3=2XeD?!T\khƘ]ғZ!,:I#;|<翪U'"3&yBEq>`2($Q~ۿ/I_Twv浨Nv:G0d1Q+sp8 BW< 3Ӓ\>@\RZ0x6u.?yyƓq塘:>T+3/ !t51ˤg,k݉YHV@yѸ3 V=~àAYHȬԈPRB-AF"`D}EוZr[ -ybB1^߷N= &a"N|V.[ !> k v1*u:ĭMLWCu7$jŘjPܜ)>2-WPDP44I123 St&_lC ＃iݬ J ` o~Se ֜ei;(7؃'U Բ3kŀf4'^G?\tL)+Sʹ?c]+|Z%Cpew`6?ŸBa?R$}X?' ƸwFiI/ cs}0K/y|zeXCF`j\ɡ=J]re X[pDMQ3&b:wI8ƾ*mVCi4آ(\fբ| qa)z 1ad$Z'gr4co,6{3{qh`TiIfU/9g[v)rОIbT9-0v)WT(X~fvyj' o]HG|x8>,spF+8RAK4sŝr++sP̱}w푫*tbd"\G9] )FeC{•wpȳ[ )dk.im- RMBdg3"}6eA񻎌H#TT5@]uU*jlS]Ԡ|s~CSdH4/D!7l Ҽ9(x'yoϒ \C(wQ7UqK ɿ, pCR֛R?/"g6:c\tAxF0oQKy{KU&MJ5+`<:wk(T^,C r*'e8QUG ږ +8׸*]LHǒM8?208 0fD mvë[ő"yUɼ{sv,Ҫ\צ ?e%VWP{bcMY:wcǓBYC".*vCtZKǣ zE|z *nFF"vTq h6+z# Ki[.YiT+<ՖPw#xI01-S|E0 KAMESǜ VT Ӽ* ݆_9"iB5d OCC3i['+3f4:@Rw֖@T*((<}ؗj ,kHa,/\^#B Q0%Rc+/sR0׿)j]n+DsXˎJ#*@Jcv͜&'kf_2`tO"u=tpb!vI}Icܾ:jI]+w".j3~Fm6cATC{r̶BFR#X(rm3|'*:ZuTcJ'!/0ed)A#t 5^ pgr _JR2 p{!&[uooʯ/>tC+ŤaLxAlޔ5ĔG>Wjs%?tu?/{%e4tvMcxvë́v4@+d„l9*1mw(-ܿS8mj%?wRI&)iWAIfzq|h ;;ғ?M6OQͷҕ=veթQ<WçHyrt%$^Ԯg#s]7mx#TgF.8s&1ߪy~ gRb| 8^.Mx&nƧE%2^dZ|lz6Ϋ; 5Jc+a)n 6}甝 cy" hEsSحvc#yo~.Q}kEX S 'FEC;FW㎣`<5tLs2LdeV,%A$Lw,d)al}9%Դ& F6@{kp{EP4X,ChQw_F@5\Ju>89?Jԇ.t^j:R.h.ąoEhJ\Ճ=Teze=zevv`JI酧W۹)_ovڼ/,}I:+aˡPċ>p8)GVU u @$.#=B9;+ܷJ7{u5SLK[{m N(HEy6k.z0 yH45’?Zӟ_ݾq8;Gm rQBѕPPb9QehK3w|ݢ8Awą-t=h H1Kor 'z}I{]!@-2l~qحʊP*8ZX =f܋>wlK-~r ,O$G4fD5,.9:&ilOܸsea-QsXRۻ͠>KVń!W&QVl$4ގ@Whʺ] .d JT,QTD"B0SoZ*'{T@232B\/3ǬjFCY9dC`|\`I>鉰i_O<\j9v1Vp ("ﴇx:}5۩^)LI!aC2~:}f"IlCBc%Б >7'`)[amJ*X={7@w{{!.o*K~J8S<-6AϏ2jd~_O=>l7wS2C/ph5.bվq@N|(kE]?-]%M#m`zqKSb(HȂ$?OGz7;4|o;< 0*?6y[f%ѮAa&9l\8vk(JHd$NHK6Q<'HfFQ?[6͐Mo8z`۫3f6u#c{hٟ׎o2NpӴXg=-&(^" hu p|gmQ\>6" 5Qߠft',ۓ=^B9$z~m<:I49 m9(&BI"92b`N{^L0o&ms9l1VLSmmƑs<p[fr4r 7mgԘVy{6toIk#ޝޛU˂wK ;% Wsi,ٚտ }h%6ҟ8fg("X(_goϜ+/MH> f+_p,k}Qp;7GR hVE]68dGfQI0Q8f5#BqKS, VMX} t$NZܓw66c4koPm8<n}$;ONa<lP5n AQiQ E>װýjNoW#gk# BB1R8fG y>wJnByMivf[ C Ff~E2Z.Ž-U$h>CHˍt1L pbH5fԔm5"WPn]/ 0qBZ;Aunr)ӆ I=ᾨ$> (?j: 9re=: Tw](6 cogRvV/6-{\*Uo6~ IE+NTnƚQWMB^u'hL0Yioxq= y@K^8%w-74 l\\y&;~AbґNrq 1q|f5t"^zZ躷i*lSRd俗!Gx``r#qy:JOj-씂NiŦt4 g , xiws[ |*?m H:X-^wqN@[EsދEϲOؕxl\IZ̄|n@<@n::Wmd琲D6G3&Gm/1gΠ|OXi8 :J,?YCkѻ=Rʊ]Z MYКq=${syJ ruU9l\dau`kmrcIsJn-Up[n)9 }1XHly[F 1P֪]vo{OlP`HsLg=3` W чgYrL'YAiӑr.&0L ql/)ot”´oE-]i2:L)]Ϝ%sj!LqHժ9}FkkIecdii*R JMz-:θﻌ栛Ҧx6ەa0q;{9قš,*7*Ww./#rm`aO4O=Q؃%͉bM*KA KGS0/+ s& 4ТE.ca(^#3 GʫTפr5cD6 ǿU~I9c{ {>jl{: ՗0jK6pX ӳٴTfزȒi1qaJef \? qe{["!o]2vvי*͡wKɭ +#Y9z׾X~YAo qWH-Y#$+ल {Q#Ć$lvȬ+m9hJo1YR-d+;ض;Y}zp^ 4`LYS_u_-vCjG0VC9VN>/Vsw*ľ.G*#l9hP 2dRjsQ#'Sp1Ȧwz#s:ZL.Jbkr 4B|j_3;;kjfzJh+~A<1d?euns0 L U9XB&5_-+՘kU*VJ0|#ca)8*%'r_4ٕ$LGQIɈeH IE: A q>.RRTN g4Av]d kvl @o2<әwvfqA^Q7HTk8klѓMif[M=Lqx)T`'plUA-ĵ%a5b/x( @R)fӴF.Zô Nb1Lq@/EMh#0e_DUr>RPՋ+|Smޙ*)]@)pTWm(pv:JLL`?ko,F3zMye7 wL8DʉrI NSГEb -tt<%}|׎F0UM Y`BZ ǮǀH*LUMtw8qu /'ˏdNDUo|RDVc+q§;DMtb On?6ބf*>T~~ fKUMy;<#S"0[ǔἚ#c?oVZM%X4@bkH$we.֑jRnMpæ ;)/M.{TqXRu˲diFR[KSL>fEɑA:tN 9*A9hu`N{[`>,&TUԉZU\Vet/Ok~xTh'*fj;M"Ӫb6[ 3>Oҕ}I)vԴ7Wٝ\*HĦxY`ǪH@ɢ) G ۸n5W2%w:)_|9@ ؊.G LdyJ# Oc3e~vJ.cvSlOxSv|lԉ!;]92N(;:"A8k*[.?Awv;$3ºgvƽԫDb `!Ф GdriO{FKG7v(g5T mdW6yۓkk[k ,gjen##/إHyNjKqP#13\vw{ (BKҸQ$}7=3 Gϱ`7~)P9UciGIgmo`N(Rԇ*ꊉb1F[̋R㗈i#4!hȵq'iELjV#T8*3Ayfm  h&CRTZ9K6xeO(Ռ!A2.LS2rNb't9fvE,[J\lB񡉽h xpcc9A6Kč^7HnIQK3<[/;Xo,f)'* Üo^qI|bFfRګ8Εc7BQ]1O|.tΊFSk94xV=`JեNs HG~I53 pxoYT O@@mJ2׊ w@^7"^<_O̦O01r9 AGkt&6l2qWe$P ~[|#(: E fy88U530ӗxXb8fֿ~ġ;:&IrcYm;Tp{{+ ov`:G߲tDZm-XC"*^lpdIo1Hhz`kCYq?=D[Z~B~g?h!b篼ɃNA"Ѡ]+%^C.T:z񪈫;+`ZG $a\o"=RN5hc* FSw$6yvMC'(JnyS58T/5[+~Z^)\/yu<g6/ʙ}gPWa`(&5r%6liŪ2xvzSpY#Lus``"QD Mz?C *X!ҪHShL[V}xݶl+/+p 2b. MDzQȼ9՛z{Z fmK|9ZK"ؗrfh,J+QOۏGY"RY+/VDF;'n0'L\ jpܿ*^_nPIRKPi=Y8!QaB]v=l6RQZ3yt3sHT%bbN"xpM\Wa.^پ mۦ\:|u)@ $ZLa/ɋVβBJ@O운SMS?dk+3xNDzۣ> ~b0xZvK&3nT(bG.})g8'7 `OK,HC"$MQՔxhj28:^yS 2$گy8YD4p*e29{C :oqHv}pcGDvZwI[Jx[߰!Җ;%3p<4`?_("zk`:cN&G]n$@$:czwbad&P@6k 7v֏m>AM{%7.F~>kR0QzegD?r8bL4W w 1S)~^fǍ_ \saUE N!O*ſS=+ Q4HgRz#4vU V `P'33-}*6Y0U pR fr!,t%i; MVT*@+66푪״=4)!`ЅעVPw.o.ߝ{,GoJ I&D޹& aFRNA`jN}͍jY/P 9)MzJ&IB=x9u2.K me&T#J0Ogа;]M%t22R'Y+PBqY<9Y F;i Fø-bxZ)cK61$Vɺz\h}Q.^<%Tl-v-BGؐ'މ7 v_NJhЗ^}(8A˶Ç'bqE׏8 4ˀaG)a?<MD7 Z"6 ,:[=isy"*_ht~⇊b'5 Szwmֈ_I M*#aƷ*QyTkxQcЄqXDh 4+˱Ac]#/?[=6غ19@c>Ua_Oz\3!Z廞B,e| `[2?-RK#S hɣ%&2 +?o eL3]cmh p x~H|}.ࣂ/ߣyڸ0ZaJ-9& 6 8̦[<x Â-z<RExWo:6GԵc,8fMtPVZrdm$B-v0Z<};L\zAjWJ=HDoR}6Yt~SH;fD[xZ{g48)Z*S$܅A&0cғl|,x-;n }(n/IcbϏZuLG7LiޓmZ3,zDWj! s f[m}0=;+vNԽpRf! PiU ܡ:jԵm~ڀ~:S -5*9:KXؘhKm.G!,Bn{hc)O]G}J;] Xw+SwsT{P@9p)'ڙj=-u"3Bl{NɵB#[ X3u4UYRf||[^S_S̻ҟSL'o{ykOpEz/Wۄ[-}aZb>W%[~ C-x;"<{ Kj#Eׯcb`c*kPe]DaA^N_)SnխE-9.3>dL\اQ-}l s_I, ȅy\EA-sY0OBy.&!$'E!qKF~q-\1Imߊjb9<Ϊ۝s-UKӼ6PLxљF oV(!l)\LC',W .X^v;`ʾ߃4)c>wݞҿ}v>TY^aɈ[-nZ.ZO1nT5ݰ0ˉ#2­smǐπb Ȱ@^}$;8CE`-rsiU1OklؔOYay:eŁa֚Aw@A%MJ!\=D1*+ti$_G3P ω+_hа7CST؎F\N?fZF5# TS= !@gdz6h^ϊ|-Koj6.,*%:u7x{k;hXR:k"Dvg %uRc1-jz* 5UՃ U"ɕ~NɑITKl_0#xEķSۣ>\9{(ɥ0-/capB=Ua]%8򈂘aB+ח\y*CSܔL蕟[2lXԪ(h-;8octur 1=_@aG<]EGvf}Z)eKYw㴉x#=禤aMЃ4ǵEUՆ1\y& (oA//dIf0$QrUۘfR~$Yv6dvxOk D5XYi9f}"7$ڠ ܕ<9]&ػ̖]`FY\B>NQ#YfFޢsyw*eJk?~MG5t[*ݗ3nUY88MĖ-KB8l5>gSXς9 ܄3 YZi:(ke ^Y,+ r:ߜL6R@grsSA+2ȫ_F_U`/{Y 2.3ՠlsi(*ħOj\+ݍ ^1P0z[Y#;xg-mCbN/vC>>?f@'ƞ$x..ʳ^XG% P,Z-$#ވhuz3M2[|˪hV ݒ"k5^Mh w$ʦ-9=*]ȮTOFS 6=;zpEf"swK ΂^E15_7M !}Ö],q#ÞwCR8L9n4`݇ m#qq&6=q#rzw2o/ZM57')(& êUºQ} ȕOkY[KL_bZLxl*OSS8'gӵ)"۬*7>8gd$bWS CrjqpwT2HoO^p oa̧\$6rM+S5x խø nUQWzձ43`1A7HG{2n-XAAT10-Z^X'7{i1#t .g>dZC?*ħXG>g+Gsޢ@fF^sHϪXԾڕ+ʯӟU/+}W -`\+Jpi!"E8b5QzM5&D6#4rMȷ=?mB!$ *B=s֘:e濫kM0Yt1ǃYi;ѐt&so󘅜{@+OШuҲNGW]. >d&2J+m uZI4v!9SKCEFG(!/Y)I,FsH`P/mq["r 'H 6Ǩ@겳X|aUd=Fn#\Cx,3-Z)G|xӣH&=A ;}N !ھL$ @Gʌ"li"Vأchd`"Leh8ƕL܀GLTE;UZ Qb wz),ckJ Cs Y~;dqDd1 v iA!lz2uv|?rQ a};WKG_,J!ӽME 5͑," ikuº4:r#@{ {HT=e8̈X\"Ⱦڿ$0̪؋ 䏿JTI>՘ǘ}_HhtU_Z03,:*Vf(`_@zU3{QJ'xlTpǀS`q^\~l/g*~Y gog2vze a_5."2%C  tk}*+`.cϟY rB9Uj%&Rk &y1iŨډfOې$r*1H: yE&2_u⯭Րq] ڪ@Z/PWq/g3vB) F.|]WvDX1#" yZ%xX[@-v=Og ;yYka9^ZO vX#d 4SyЍz7?b)4z\HlWuB֥~,"SQm2"eokM!癀2r0Y; a:"~z;z&#.c-E Z ďUx s 5ͥcg9k(Eqr2E+ XU"m1 O ž'"l,YGwž9)5Sa F "VZ /EٽIwVn#H1E2"֚<5be 4h*MWUfp=^{,sZ3cn?bw'laҀq[\ $֪lۛ4Ϲs=ZSf~tȪm 9 cAz5Pd @-9NkiC~n4Nb[Cߢ`Vs#!xgr0/4!MƁGU d[ 뮐 z[rO+`O O4cO%scVgyoy-m8V ? ^`D2)^/Rxi yD2w?)=Zi%;(G#Bʚdoҗ4jnmww翍Ūۈ^ǙAV0bKE7ǹI TӊI{S[) ++y32LC<HQ%&-{z^bD3s6?21J|ʕ05mSR۰,ib M@?y7~ǫ@Fb=_pRsE) nRz`}&BE^u:7b~v/N-賚&ʣh S֍idJJ=T!K:C Miڭel%K-V|?3Fʁu&D}t`H^aJoSrէ_ LkbA{22*Ƽ?(TEY;Q^$z7S[559w5?!p0GOguZEcjHu('::$ȻW3 +SK&,DxL.}6R'.C$=D珸4(D%&Vֳ1{Qed%F9>8ZveKWm? ťyw0W(LI'K9XFCr^;nF,x+n@)CX3ONS_ۏ3Aԙ^SA|GVk2vsV-9Spp!Lʪ:,덛\ľAQ7^'{\P_ q!㟘taH Q x$dbd; TAZ"iA& Wy=\^KMsz'#Ү9$Hdfo "9"=ve,e ao &.3a'6p>nl}r6sPᲷJ4ܥR:]{тj =[sX2n]GdˢِR<gNs 1Ao| 12jG6o.ppTQEmalQ4Ah'_0-m܀m/IZc>~of;>(jPao{ȔL*4_afjFVEk[OIp e#%sVYJ1nj .tr 4Ǭ2bYpw_࿭h@%1H,,NtKWA1Z%~s﷘K/A4g=0Pg`KekoD j  wsg c nk P2> lD;u1-}2E>׺]D*7+Ѝ:zc#KSU ׾9} ,!.4 U)e&ѵ ʢBu4!R@91II(ZZCMBGRV<{uh~MOv%ggQ'{"&/'gRvKy<39Ej2z~a9|[!ѣ IE_/V2 ՛ir4, сzlR!JCNA2W RAŽDbLc Ʈq5/e2yfˑ@Z0O:0J;2qhD[X#F@!56c 4O34BT\iµwΣaq=Gh%\QWVhjRہݻZóCu]"J`Uo;G#ݦZv\bkDwbӪ&Zs)nƱ3uʀ*'W!xuܪ1Az@mXD{n>\б{gL!B1K&[\;7Р,h~RttgT!%}:~OT;#/p:tR_k|*V0uHE uFGDiysQg>f`Y{'ɚ&fw z2e ~>xDuq*{Ғ 3A:V_1PBt[ʼn%z1q$@D0jޅSfW+\ ]vrtzVjှj *Ƃ,k'',O{{^PTm/h\ kKhsf_Da-Kou]TahƉ֦NxjNIa:= ئƲk PU tAM쮅Ov8qATH+ mHϰЭoO~a.e-N [wo%`kkAdq#O3OE;I5_8άjPo {a<\F2j9m~OY?K/۶C­OHh$d0ߜ(Ҩ/= *^Ν@hBH^`U}k!I aEC_G, !YxX@ŗҭ8FhXAL1N%v^G'#{}%>r,2o{1c{$ѕRFCRˤLwhkf,|F)Hg!LXw}{PF暫lMI1ig/lMr! LOT˸m,΢E}<^J<e1'gy|:e:H\[2VSɪ)N^rG2.|[W%!0^܉qӤɬpwŸc~ FVK-xnRaZ]5*x=lcQ䦹;USi{0\}U#dXh#a¥vB~ד .ig+bࡁRu=NSRE abF_^=0M==JJ,_euԝ&c,oWw UbĂ 'MWXAy}s/<Ȕ?sW9 :T +L60(Y9]/#gz9MhƧdHJHbSy7PIRmjۅ/MxLB{_7BM~ǽak}Nآtgyf4/ڌ@@i;Of%7bo<oȎdi\) \ruO=kh*m>$(jz,GYP7C|-/.\bI -anȾ1r˖Q)NSm=m=Fu :;йkUPT\C[ݗD߰6յB2.pɷ"Wmb~̀B2҂;OӁЀo= Xy4vFIG8'"E;d-QӥQ7}Z88Z g>꫺5m%z%Bs v~΋sE4 \[#a5fItC5Hl^Qx;{0tq“W yHis:ӅrYH%Wy&rwrN/_ZS9h&O'f֡46~N"tQ@^zYvFyEM_bTeޗr{TXζhvcROJlYdFV4r%~@Xg}Q+ړ\Kmb$ G klrS|bno 1POA*va{nCےgD{5\Pz 6RkTLi@ hS?$OX)):Mxޫ_1=6^>6uccA-}8|9*=.Ok)VLz#c! 3L-N[(&yrk],fWyzsce_C{q(\S@"^T(|S%:ʹpiئ^ntDZEsNf{\6Q,UR21P|{rp7%]O NDzw=M}=b N(쓒EH)ԺN2Nxס_h{rtBP R0G\2=R6qi@Iu|myIve̚-/%*|{_gkL - GO"GY{^).'3{Py*F^|@q^N  )-z$.k·@s.}dVxkv[zN3PugWt4 s>oCdγ;.1D6~'74[;ctg,P<1_CUH7<&1v7}262]eycґq?4]bbÄvTɊA(W9=]e?ay;esGqt_()*dN` +q}"gKCs c9Us3o56jw9<]:魛 SѪ Pռ+!FZ{;J@*hc'u%` xDQmL1g4>ɥM?IF߇ڃr+.]#BhylX}9m0Uv4j5gxy Slv~XY\ M%_0T*7z ᎚^p|rENZ%6SRH u._Om&JY]We=ڌ!˪TS|`!pQNNOD,3R 9e[-eiGE2&͸,0D/B󤬽/mUO2grNAjb^"=6d* cUz\gQLwB|35#ߋ@IH{С.ik!l3)Oū(52 $F*\`< P{39>J:uEE4SaOy'sIL"u>.()- =5w^]Fg0In_@H:幥]*˾pzJF阹-[%W'>#ܼ_Ҹ/xkA34i_E*t2[Tw[*áDqķ.m\2 Ŗeg-;\V(Z5$Hњ2B3C{t?C8̗MIdEcb2uT*SeV`MT[^)ي}il v8U5~ d)Uo@ #!׮V> cG#Kz!\Yt&'tw@ywcYWZxKhpPדk18 b!(43rWmm82cq*ꮀ(KJ`wݣϒ=Q'Co}@I,\a|Z_:/.`[]Nohddі].U=2ѵ`(N7XabxR\Z4 =D&$OkLEeZb䃌#R娲=MCq7P|5>ЦhX {Ìzo/W핿xl^!f?.\{]J|E5nS zȒ ̌n%r"B5JMHI,ַ][7M X/aroΜL6M|7S>Ddf1p_J7 `,3TcIZ &A$`[]=걗s3. <ʬ3I9 2]tc#d8 sWkD*VŞ;ކﳍ>oNCr3\{6 _ۑ Y_ew[6J #1Ԝ '$ߢJe펎[ޮPɅq J5tХc%/R:V Ե-{~w}ΰem?.\% 8>QM 5LGX&Ŏ O@hNV]7QȐc>I/KT%;8S LsxB[y} n2B4.hh5pcz4b'-Nht![7اJ xd{+ݼ tޠ1ŵwoq7Om-y\/+5P{kjBkq!Hs>FB:y\ B&aH`%G+wVכ!~0pLRqф+ JaMVm܄؈7D荥yMBEc#(qn5X\a\#Ϫx›ŌZZt8ZT"JV$IX`Һ]4O0ܹg[fP j@hN=%޾:*O=T+ІYU$}4362@L7JUqeg-m0kqCŞlqw[J.EjMdJTTn޸6i4Tљjv1ړi.y=}SBsH;)~׽Ԟأ=Fviq:s˯%ҬfU9:۸y1HS[\ jPtx}!aBsi/cccSzQ( B.:Z4ґMsǐ#V{Mk9H b%zS5Gi a԰:5'©=@H>D{׹6+8twݟ t'˲BrH /N6,2)m\/|^Js+ѡ:Tg,YZhywD^'=oIV"",,EO;QLm1 '%CWRS,>|T[+\ӴJ~Nk8 Vۼ/H3 !~S[dހGZWiUoq`4Mz/_{vvm\\+@  pM+ej*o'[֓Q?\),ڕE }eډD1UJD>#H萱Z[yO{kG9sfQD?=GL14}F;L ᩔE@'o 1PF!RZg8ScV_BM/{6ż*C9#:cy*sxz!)P_4;|Oq6OjjRQx8&had0n:FhNJkvO81{L䪬_tvzh ҦΐsWFxPO(m}h/V+$V:oDՔ['=|j sf^\̐x7&^LEёBA1?Hz.Ɩ{Z)aE"EfYMzK}j( 2s ?\s9%,) ']W g&l+ޢ0I4ب x {`X%(1rmb.vSS J~FpH"XC ?;(8]y2VAFH> 1"PWuCm7Q/}^?-lw,cḠXOsڄն!!8#*^@L 8>Fu,Nc4#a'q' kvS66=du5_9q@xzoy`eW=qu`*ͷjD!&Kaq j#.cQN'fMHT85G(5fj8` gF^) !OY_9SvVHaZ)Mgh,~seg*o)Obx'*xeGb+u#-XTEE)q@yR3M=0"U/rV!$2'CDꙨYa6QvTezBnTvn;Ky12j3( 16 '_E= J&R{'c&wmSkq !M#:}NH{i#DQ՜0JʝG)SJ `8n凞jݑѝc²*Eؕ *]jw4C#PuSi0k'>a@5n8]`#D$Yµ$p ٗ'4#ҷٞq N/O(PT6@><7\A4ܖ1&Eh>IW7zpYE='먍Copp]?.u}8 e^$r%VzχS \wT~ُϹA`v/+W)C/5/G"cX9amv]b9Y)4!k۱v't%y.rj'RO+3K k܂ϠglnAew;kαVT}!OXX LeZ6Ga۬4Q]>_xv晙zy0S9`Tݴ5 ,Kڷv /J*(Z4!V,)Γ|3L"+?ZZozOJI/~DՈi RҜbc%z|\ wH6[Sӣa>x(.Y2D>SN3^W-Y/ձ9G-SNWxaJUja-oPuVXDfo B s ը9uFRԊAޣF8p_ /߁ıZU:` 6fv?'C8He4 h˽Mv`Du+V4s?گPt׈ijIdu}`OPi`8Jgѱhxy~TWu8 7t ӎ PvVk"pzO#r>˵B{o! +)sfkAWtFgbItɉJdD׈~NR)9HuLl5[$;WҐcy }۩-C[|~0|{yHN m&\iqW(I>˹E8eD3m^x^+1pC+_OجK.e TO=ӊz&&)cTq_ S|C^ %B6Oh%}f W|;QVø76[h;H4(@H5[nVZqvg!;WBvYS9B`ʊg[\e3'dOҘ-[kh "[DL %1حSy1O؅xW~^L-g G>%lBs(gAnߧclt |8AH#ڵw3dȉ#3ȩI4q[j1R^S%AQx3/Cq"%C2adR$QrML6&MP\}LgCF0^sp)6BO?81Us4-46uօdo%G@fnO`yuG_DȀs}<”$Ǩmunjb{6DAhuu𔹆38O!vXNS;+34D\ޕ!ڄLj*1yo: ^Hk/ZH6}@[Z إ͜BCGIdֽ{n"p^w|yS_l nN]\x_έ_ذ!CP>"Pvi8qP2˜ZD >[ . H_xf`0uN&m- D9d߁苯!}:`se,|-lQІ}eeFr?}:P!_.hJ|mREVMp[D 9Dm&,O)d{PwTYP]ć٩ Hwh!=S Q!g\PSu;rLC}gP " ˾gYxΌ?AOsUs >Vӄқ nhB$#|Hv qnq#쑯/u ~̬@22iQPn[]j}4dVZ؞"WϯuGt2z Ziґ t1ިIsz;Xi豶q5hE  ;|L +JX#p.KIFp-$>a"Mq;(D+{N2O2ЗxGRSOPsnssK> <:j%0riT$\} m{^Gv _`#=fݴ^6j{'{Q= qgh7+s\F8\ 0yS vD3}86q+Ԓ4|Cȝ^[{6RlT1jڋ!4tB%eS +[&Tn>\^!)Jlݍ8G/An)B }sZf4gƳ |Y:{c35e#3Pj6Soϊ(բ1T{qE.߄a933th? ]޵2̺ʶNoƸ >z.@d/uVpvQ`>;nq>%_E쌖Xo-DRAո#[@MPUOTK\Ks q ӋםJ󚶜"X%@ťZmq1;=p9#?gE#V=T<ɆK;́˨JOX!4@媯{!qC 6xݱxnJwc4 L6>ks{LQdUqd BiJUPy0Vhyͦg5ٱ1reV2z*X /nZkU3 6IZ1nfr?*t@ZͩEȦZQ`FDwt^c*u3":mJ z\V YJŦQv 0J\돍TZha-$/7@yS A:mk(պ !cejk<kX̋A8Das 9Q·+U?` .IJ'_PG7H{ᭊOBsQٺ(Lh5*Ѐ>1[W%+_3lW.aA`hDgרsDgGxBص >W#M anLv8@ruU_h/Ѽ:^]ybc[`mO#wW?v/ٴ@LNJPf4-E:;u^Ux!lis9ӤAs0-TEGSWf : c^1]͚xcajRk !X*XQBz⪱]Iz|?􈄍XeYe ޗ-d F{,nِ\inCZVI8,_WaVBEXc*U]+=\nԪ/O®W;nխ˃~93Bc?ѫ/L;%n_!LAz;e~ iķ> ĭ;dD{.K QRV q~ߥ|Fp~&up ʭ &u 3Eɳ=R`vdߞziSc¬SN2 W%d*+(1GnCdQ+~UM/K,D>V8]%;-:ՐT#N/ HS> xF♃&f ^,2 ߺ+k#>|A=C!]Tq֪&'O `lĤAEפ;WWx3&r@g$\b2>sa1!P`Y=WĻqZAcU9M^[8'z*ǛʵY]3p yd'}ܱZz@\G0JP™5>S'|M">g{"fWsp+}*8&  X,[gO^yيu5]\XaJn״v}O+s كǴZF `қ/"B_ i^5}tE` Y 6zMUn2 dFNC1l}#]VUfl<7)vbNl{fKϥj%'ض/WN2"9L bQM :hTt)dz9!~}nje70HŔ۹'d cBZQ/z-SKgl\ a>"*Pg(IWrwjr= \xT.βCpW$eXUO뵱ZC׼|{yY M \)ŏzUjHN4D=(<{ACy7lD fF| odf[N<5<6U]AUa^pÔٹ,g 9/ TC? 1pLUHQ2zyɈSQt8zцVVpKe?qhl rBl钗|{<3Zٲ\$-M3؋׼ÍT`Bk/WS. SJiad$GՀɹNf; ?Zެx_VqwǛhi륯b>>F6CĚc5ҍj_æ:pjdET=_zq䎸hI 6ULKKQ&go2UcZ~2 \em;a-Eɚs-;rRU.:"A+LaD*c;AW2 q& 0 Ǽ(F;'j wp6;} l}đ,r@мM1>6= n+W* 5ƯkrEEF7%`jWl֛|- ZP@RVQySSU. ˱,e:rg 茾/Mub=6;TUM*7h9Yt)#'qE>L\1 mA<; | PZQpuh4xE tNdz5 b?̆6&<2+2:HY6,K\LCԔZ)o= AdehU~jH>!-裣W;}H.S@e(vB녚[d#H. , 6έ]LFonYp ?s …ղFiV{ UL˕fS=f"vJ2&(&[#B)xl'ؽrG^hoHBn3P_!P@ :Pr{ۗqo=}sM֊MvtF>;G ̂_d:1|%{lËv= ]RQL\l`||0_A}QsIxMtz흕贀ёNC*+9a%FbIJeF;ZIG?b'a y>304p U3!M"&¥1=9Uq|@4,jʡDt5rQVhrp@lD17is)칦wf*hacw|2gel,Z䅎H& 3f5K#iaRO:rdUǎ]BjR9R޷YgʏD+a\hʖW5) %cZ 'IF\NBYXY@a#Y[V}OGzo[t\>m=?6-!m}K.PhoR3dt0B/zEB)׹'>ܶ Qt%8ܘ[.ݵ_t:Q2+-Y}%d}U=+v(|>5k1U3/2ψ$_1)=1jcp5yMf@<5nbjt䈤@O ;lt k"q+M?Ŀb?Uh6Y6s혁 _@rjc<؇s=kU?rTfΧdIeJ-)kԾ8[^Bp"k~,c㭖GU|KOOhqΔdvYBr^ UpB/ˆh(B4az PBH# \ `!'EL q hQ]/*rX8#8[:D~#cϖ DUL!*Өe簴t" *Y=d})[FBltOAPc&o,:ZȢmGZ ui+":kl#n~k>mtEj|0u%lbu}A`v EX8 n -5U wFW{*‚ڈN'~ClMC ez%-tڰ+{SgҐ]R©&Ex>ImO x&~-ĭ*zUVCϒȌƂ2ܼ W@KԨ{MHC o +|8ڰGv\%R{ [ڿS^&98 u@Tt/%q% ;`Akf[.{Olfy>Q4):Sٮ2aP>k*ޑUOn3#f e`>Tkyӧ'" ΒEkʦ#L濠l/q?"4XeƿUuՀ4@v@ Eu{/I*W(I(h )5bKW_>|?1@/2O`DNKVDw1׷ |FsF` 6T2ّnB{^dCMyG8W~{NK7.@Pm8AC׿؉ 9ՙ?vEWQ^Fp^=h5<>@[nwٱAě KT`:|q+{=ёm 7Hi?F^1kAhEA5ٛOhYT&l.InbË́<6bv=/D9BҐ6_ԾlW!`.r(IygF7eN⣢wdLҪ䐭z-RlGN9U&亥Rt~RPፚkP{" ʜ祉_i24jT, y;d*ne F؎7&KϽھ.@' 1޿\EX?DoX5+QO_({t_gYڷp³]k2XTmA'E߀K|UI(Y -k (X{rIXׂob"kFN6R$8㔶1^4UTյ4bQ`/u:Hz՜h\Ɲx J"! Sr7DEbƊP7ﱾ;:5lFJMߞ/2ɬBUy.˚.+\(ĵ6[KLAcr914ĩ%B>p$}li6+1MTTJGԎW!ClI^T(YquGbK C=*0a6)0D{[`}dI Şmu{#\q3X_bFxGO Wjs 'L%MJo" ja\Rʧ*%O"-dN‡Wh,4ܢ'קr&\dO?{y)IzL_wM\dYMG %ȧbE6NC@ǀ0&CuG1uym!3OJ):?}VM͚p.KqxFcsg4dYCK)Nxf0+g=pɋ#r*F|<(cFm=`{MnhF;@'f]BXOn% h3lO;8ccĜ/)A~X>72\JXF*:(FAK%oa7'u丆<0[yc 4ЖEҚ4D>=.Rs~, Q "H;Ԓǐ v[遊Kn_AډQ(R?%YT%> 'BQ+]EOI-DЕ>1zN(ln -Cp5ژ}[rY \ꇑ۳} ȁ,(kb=\`-/JG%fɑ7Xri(;$gLT[,`چPtQ1e^W=Fko:O7˖R|i{$dMb:Sb0@Ǝ)nA_vdt5Tм̋ 9)>u񓂌U845Qd{F|;=z.saZZyB*tx*e1*-dIFPO{hLf6>dO96F{T_υڗ2Qd=RJs㍼7ǃel&9cv4ř-:n9e^xՠb @,UѬDha2vr!C;̲ ]--AO)>|Je"{BF%H+J\abTq܅=956+G(~HC,2nmXFpQ,*MsM.>Ni+Rx,.5)SLjPj7@+FCkܢ;/xt*ci$Y!JGmE7RZj)5 U1R5FKCHF ,뎌Uf m3teh[p5M3?=ˎRZ.qł2բA݃DG]h}/b}s*(U"q9ã')kpS~dCd69s`4/pEh_A>i9¦o"F*qs?F?S,+;a&);rmtשD1Aགྷ4+kxYŨ\,s7噽Q.u p3wCtRM㓓"Rz,=\*=@;q0>!PW-1k4c2>rOJe1=4Xu \]$'p_җx=kbhg-_IEUҬUORv&I5Z `5N9o>QVH2~-Íb;ԧ?9z$#Fج~'0ﵴ(Kkx{ӀaoIC%=6,>a aCw}6lWv5WI_3~[RF"%Wia^ڥepu'w-ոDLҷW&ڄl 4!5B4e,[xYU]k3u"&6QFUfBCr7?HRa[5 muFNZ$]yh>k&)lGB\gٝ4Kȵ񘈖#COjh{c[FF@he楰jc. i m\d_xeԌh=f3 ^$~%4a(9 n"Ӈ.ͦ8P(b-ȘGM)5Ҧh6wB 2P;˅~^ t-m1"KZwjEB4c w%!c.ywnٯ* PS]?V+Hѐ7MIuY p4ʜtr!bsRyەHhQgšd=G39,cS#Ғ-F!h_JSc70'8-^CG< w ٿI'j/45?^~7TLrQ p5׿+E>kԗ[*%oF 53,'+pd:Y;A~B0HSbˇ ث]Jy,ٙ܉Mf+өy3YX,<8L|g?hMN@RcL qSNdy gk%yttt46xBY$Q?W5 %9;Vu%Z^ ődE4z 5A".TG5&24}GWH'a_ڕ6y)Y*2kk .2+7x``7޽DƭRWEjǐ[P ¦eC溋s!v&v*j+“SR=74WtY`iܾq b 'U<ɌAD;&y8 񙧵/=D3xծljwmI{0L&Xd~XSgcn髸F 2p j"t0CIkf#tq뻤n "WЅy S(h1{uMw!CW3)V'(v1S!e;;/((}QZ(@x8"ڒ7=FHL7Aj]/t#Do1SEᆾ%/ӘQe`k"Ƅm=')#? .ڔ0kBjgѺM\ |cdGԈ깳n( ]yK,;I:'Ba15ML9:[XjKՃ]؞^S|A3/*YH@c 98g`<^`ep<)nN.E@ 1AC1 W`~/JM.|B]W\OY%MC,+_?zV^y!G d!L^z ZmoQN!)^w≥Jb2Ur([3[Op㊝A4-=i;t0zr51A4$ɴX[HA A:RK#Zgk EuK$=;Jaa:`ăzgaSSkx1t_0{%fbUZSj7`IBMT;7DY1ep%)P2:/s_S5 g^ $9 ᒇP~Q?5/NQ|=$;.g҂C,x2n)vEsY/tRط қ$a!Un\D7/ ỰW ҟǣW)#K;2Qһ Bƭ=q  HW&mH2q zswԭ8T'6\1W RR}lCHtJ`/3 G\?Ҽ2oR ?j lxdN~0=VE!04C!Nc°js !cқbg7Ō1R:_12jGaЃ"ӴIZ9v\"&VsQȰ[,C]!.Ne?vmKOo^"qmqLVf^lh2jOW i^ԙT0щ5:@[nQpݮ"Av-+'S`d>e_gj.&=< "tfBFhr6q |uE7J h6EV.e rB _ʐڲ]N&l/@p1|D%;kWg`dnZl,D#^<A ϐhI2ś yI:𺵚8.6VrpDߠ>gX&XS1UQa ' N(ZL|;*[T/@AҘhbudQ#{l/ KpL4ʴADG5e&F7in!Ȏ M+Ҍd Ip7$?_ȌLkA)2Sj9&=_2ߛkF\nP?ӮP}s]w§z 7!+)tlX vp(V@mUkFU."lbHc0r4hvcj*CXD3CXstF2=E(n@Ǯ`9z (r NV!~U5tPH o j.5%ƒ|㉔z<W=z 26a M6N'ky373Yv$e^.gc{c̜磲x µb+9O=G+"Y;;0ǭ'mwPHCc1AB9ji5HRQ(m4@oDၼk\oDRQO"- ~4aQ wFΥR|FT%^Iɡy@2k˫ C%O-z$eM,zR+| #x~5 ԰$mNkl~&S}!iCW+baўœC!v{GSq199%4j, 2dyASo~.\h5c)xW-S/X+ʋ%R}TPa_.ck] e1y}'WA#̘LE55mm7ņnȡ=&Ƒ/C` yW{ql_6: ڦQ.-5e7x,F$팓\?"32xA3i0wLJ*̞"; @>BBFG+U\EQ߹r8GH,s ?w^be8"M#/?ZG<uB>FOa8D$CԖ-E{ԈvNbȍbaZ#hu:gSiBJ9s*\jrԔ}X8`K׻}ٌKtsUwDUG$RP+tSs 2YW"Ǹ^Z.!XRyٍ[?44rO<_THCwA+-tȕU}N}Lc2eE^+:U!@\@-fѡh`ѳTSz mAGOVu V1YjX_jK e\-eAEO8rs0P2!#iw d#w\ sq+;JKgJ{^]9AL9T ! .w1esż,3e[M6v\=jw2TٮlEdgqD6E;V,#R3mY1:^_BmHv/iۧNF,JFO4z )r̷D`XI9 cn "gT fU8DŽ{lA*~ycgGggA&P61A-樰#9,[xN;ǚ3Vյd %SvcvLَ^{Obf{>uV>W)@ j/Z#IX4xOpECk)ЅG;aŗY35;=G K>UX4&/5g][#r7W"eO9z^gOa[6f$`5);\&>HV55"łؗXE}WH[RyZ%?=.w\yeI6,V \~L 2lU8 ; ̚Z;SH1ETVp0c|c[HP-ao`lm>>2^-1bjYШ/ꂻ3$,'^frHȝa߸58:%,X+iñ,+)rkaFՅad2;҈Gd]vO.@xJq(-?Ż/ 8#xp;b"Ӻ[Lh<ΜV,5dHiF'.R.]O%Z XKH}I7 /ۼADDQ yF˘ %?{GrjWF5 k Tr b{ ʑEQ/H#Pn[ʠCHuLS WM _$7PI:lɎ1pFpXNJ V7uIl3+&_?_ި A\-.# iSk"250f0"$4Kw=xBe@`)Jva֟mFQA5 _3>#xW 3k :d ߄'W/7ۙJ+CYb5Po#[ȊŇ`% qjn{sNN3&gW-v7z>ϰr ǟC>C@(njj_]LA,>םk1bO,t25ؠŬd9Kݢü8`ˬ2ӽ Cm rqsD$:rA?^\ {RM CZ6[۩Y6T̋a|):zyl:[t4MCws| LZqw ϩJ@g9 OƴvЃSm-`Balq[ C_߅<zju_@VdU͏x;dEVz$㕜ё M{F27 0VFZB}5؇[*> $f[>9V8i,%1byS5sy暨7X Sk:ZNΉ/}V  /%"c (#A gKGy5P]vs!dT"Dg`.%OȿZR0}{ -Ae[ſihQ6sb%&ݧ9wo4ŏ#N P;Cmw%_<1(SKCu94z V$a0,8V?,*[XloHîm+wHȕ-Q?+< I~dU %ƛ/KT=}HaGdqTtqX&w_KQMFy=;'DĻ T?5pP5\'x'_lG=Sb&P?6lmg~+ΐ%DDd_zdpO~ S ' 'E 6bvm3; vN$IqsWn܅MF鑊Z0mitO~ 4Б̀1PoW!$&IWH:VY@\oeߐ５)ܛC1p#,= tG̱'v*%ܙ,mrk"4r܃K0 D$)~&눔?mL+`q[I[hBG7?&*b~f]%ikc>b@x6}j%ˑwK_"ђQ rZsem vcV.BYhba'uk?; O޳~9*X?ZmȂ @t{s-h ~0@>F.:9埋<|"ЏW#*B'n7`-FL~ z>6w =S Jkbq+f|zJ^û* mipjLzx;O_]ůo͸HcͧV"emĞ'"~%WV[ŎfRu 2枥"}A*`dR۫ODW Ja˸ Vn$R_L ƦZ%%hE0!Ι˚kn}1471WAPW{#f0tng=YqR^&GJgعUMymDQ4`,N~B]zqMvcWmPSJN;wgcJE2#Y^s` 7#PpH~^m@:(-t/!6scֻȾ;_9@>9n Y^ 7~g<cޝwoԬT:qb|PZi;̌6bi k l7ExeBcMxu|k.dpdt E0=;99{=|lj<^>vٴ! mTr_Syg(a9{K{e(2ulidK7z~B=Om=2\l#SB&׌0 gLj0Gg\d9k_]M(I!};r+`մ(U!YY %;CcF2Oؠp^9 yi!m McDEyrR_d,Ak8Jx3n]7}#h ܫց~xvC3g9EO:7+ ]*;">sz(q:|cZm.׮COj͕}Ȅط0@={]7.qi^kH :a}&H[c>uO1*S&N]}v4Zg^qjvj3f 3`3ə& ۮ{B zI9' Q=?iL?1@I&rM[_]~U%VMD.%`aUbEF-O5Dȴt2MR6At!nELa%' EQNW Rb !OO`umz8H>S p#ؗܥ_nϑqzvQbCidW9W'Ā/8/ٰH6@ycssc2-~wIB^/@X0-oRq;q~Z7A3L]y^22&Ͳ0RlySQ|p"b?L++ 4x2̱7۠o*v,uNdijf4Jh_/MF(CF1l|&@m9IqG^Q-Uc1qWbS*.'2X)=nW4P|lʻv$1Ҏ߇Q&Ft6fj)#)۠߷:IʋFqn>DIt]Q'96;Wt\^'S/J4'遇'L3HV'FELT ]էV.A0H4r1{* f>>_|?~}'+| h7jLor_DeJ{*UbLJt@h/;n_-lAfO1uӏhy_#r.'{])!aZbPTk\bE T\pN!;qrfl n/B 0q8KE[8U:vq=d7iXɞWF|6];XP) >ǷKAxΑ9|k$f};e-%(vc \Q=aH[eS:PA5K%ALyPJ]On)'e@G4k)ăJZ9;ómerh4\?yP\@YlVH3D_SY>/f `iR8WϨ˹OyZb ̒&k-M"u+vUS.YTJM3z?~+L;iIH]T r#2Yգ-]}^Y":嫼o }m`nHg"7ru$3 ':~EX9@xPI`ЯtTw˓//|#LvjP%ɭA+Z=Ddl4ϸZÞ{}X,L=!eozK2<>{$uA#ke ɕס@6%2!΍xUҟί0' 7c} EU7WiZ~ftٚ AH#ܼWNAƣ [NM8?ek+`w[I⼟A^pAnS."ꢴeKoKS9ˁzѰc6 g% #oY e@?>)؆#9Y ,vָHt^!9;O,]?RD!ɩ}QqwW6+ ()A j9|ꖍqR 6"b{YGp])mdw;"7IUci#9ګ@Jk,з6~yeg-Yԫz=Et:%L jGOn Pej~!'[ ÁL3z@.kC{ DVo+ &0Z]k05%/ ތvjld&slFtU̹.,F#oi?˝W(#I%7'ln$:I|i/FKO>;Rch]|[M)R) -M7x0{Nc#h<NpBT%8z0Pjٰ6`MIߒIgRo"V.jɿ0B'Ĩ{בOtzD܌i(ܜPKc2c~pCl}0Dkb. %!& W?%shlGJ|gJ] R&.{h1TH~WJ<$i$ y&[ gFx{'+DNF1k!PW]k8Ul3x!#Y jh}UIgwj:Lד=o(xTU`zbIWUyQfG4_bۆSU2QA%'n"X_ ֵIHm` 7(wf%7g̎.3Ř[=-l4H$GzxDӕ_e| @Ր)Ca->ǕL+Ir锎Kxg 1$,%3Y?#J  O?- r{: ýH{K>%nXJ?u~n>^HJo 0ݜ,kbZ+ŇI*d7C.ڝ |FőZ6WwpT"iEwU%n8@*@W|rQ$(e- kZ$`6Cljg0wхXPsRgƗXex fudX=sk`i`J|q=zc}̓@8,+"0b@AS2Ou#tfقjmVC Uz3rBF3MaD<(dxWJ& fƄY91v]`VwE%GNv5Sd'~_t_`^Ɛ1 %!o.m/xm7q\*"xʞ3**'D G em!<P.Hn6@BVKF4Pity8&b0\ҝ/K#RA}PJ y ya2`,eGI;莆TkK){,b )] lPRe)7"S,ar3L':cn6R4d%0neU4R`%ɸnw`NPtM4shjMFb, d黷fx1K(eնI;  _hD~`fpdJMD{JS)va{i*9QD*aNA߭ M8mx,:+g1ǰJdKjے: "&8*Z>0r~ W#}Ii7n}Z;/r*q4Crך '=c1) {f>5M ;?5 P9dm, @WgRON6.¨ c  ,j>#o=_{ֻ'݈k+=\h]WS Ȣt>O.jʯъzdG!hSgߑҤUQKNCکPљgqƒA@Ac…]GM6(|$}X ys.KG7)DH1^E#f8zz*Z1 %i?iʲ5KY}'u$r8\nw wY;ҝ貢K}o0~vYE:Lp7s3{.4Fᆩ)ֹ)<ѣGT?M&8=Vu/X0X)ltt#iOԄ >*Ai}dZ?^ 9x܆T%^^ʪJ'yNtk%BWJ4J2fT1೓ }1["|K}7gwl: Eբ9S@h|ʲxy|$BoWs3t6G4^ͬ ,jx_q9\4db,]OF@p}C &0tCp %&Ն+w-* /A0Nc*f _\]Bw1{#'r][35~Q,1$>YKmXB P9UUi5-*e{mR $#Ȋ}8`.Eɩ2-^/(Kʃ#)Vk'ZVVŋڋBZfhtj`y1M'_oHEF9)`)ޕ ۰p# ʩq6=g57)A& 88fw'<] AޤEmkKJp qW!}~se~BHu9ҎRAQ8 A~mwdoyخMFQiV{ԥދXex*_FY;C/."sR{xEPBBK0\pG&:&.#J[OQSY|un4F?$yI?,8n-~&'MNs1Ks^'7 ШJCLwN]~`N8urBޭI'PG1tmr,叠+:#Um`ȅEf (.,2g45ڀLu\}?PNN@qb yAN߱Yiǩ2w6R\o={XgBg~ \6H c1$RhkYb➭h;mU%-f3&Phج|J![81* UKLO$ `#1w$/4PmP'e#|`Fa02𳳁Q->(Aja;pP#2Wz`$? T|e5tQWD\;n*g| {.i=ħWW;,fn(.K. 7 a7.f[7:%ӂT~Grޯط&<ۍ>4,2T´WM% 7B{xxG#T3Mzq:m:x*:{ydB5M%44?.5JM]wN܋)֟Z͡Ia~yn}Jcݙ20fFVpLl g"f# D_͟cZs~4FrF{ 0R `;&^O/^VUBP֔Ο勒_s{f b-i0yz[g 3ފ<'";]aG7wHxL*Ve zb&`R>Xw0:9Ɔ^t5ZT:PmdY8hɸ^bw!N2o7M^W$=Pfؿ$jIBd֊8]T#SPI׷>lu\g䣢C3'!r99=ao7>iB#pzN8{,3O`;8<4ma3`NDI,p2j";Yp_sѦ|ZPhHɧ&/>cn[jO)xv9ž<&_Ħ9Ę2LT6cw=8LbAA2@Y-$xS*dRde^_[^=Ա&SŚŝVsDSãux+3hgK/^%g '!ÿzQ_TBA?,t["dddC+:`nVY*tUE": +kmv3RElI&|ohmL=:Re{x숰Cg :+WS†]\v8da`˛5.F'g-g6Zo'T a4d5%*m@uuIP <)w|KƳFL cX={Z|*uG au>&-I͑Acraqc fHn T2&p$N8Mtm#s^sG;:{s(OG$@mshJm;(|ywt04LMnkRQ.LpC;ߥDhcыe>Wi\3M)(bsm0aV&.J2Ɔ1iR2M-QZ%qƨTU71jG\oL,GVR'<{-3Smu{{,} nHKuf{Kzk`1QP5HS lc'Kj[獻Qd^2r~? d9^,O9]nb%R igOK,)hߎo{W3,,'u5٘7bkC6D7P9n}0OBBjP/Mr)Q9JWO EbDQ\CDTusAt!1ux7Xo`9^Ӟ},5sF&Kl`r=ޱ,٨i>?wVLW7F|MrNV+t3LwʠdeA#br >V>`':(0$N3gcQ(J eaHJ<~ #*{mĆYp|=j/=ȏE=ۖ]5;UV%y^ߙ7Dh*jNf Q։ 핲j:DNTj?$Mq~,lԑpUwxPO<7|f#|QsyN]HJ]tɺ݉Kq3R,P A##AFG ,k9R$>b Z7m2zE&uWk[&]+њ -,í4#A0ΆShF͗FQ[Ec%{+_7G@YZFُwnjZt"k+X6:kS:WJ_mM*B}g[DF)`2y/Ɯ-6rh!f`CP-n3wV>2+בQKj~QR&7|9txӵr_㈥>PE|Fw@]Fᙥ'+JȅFⲮbR(;2nQ RlA`x6WcȢc-%V٧D<ܙ]Oivk?T4.>rk! z_ڿgPՓU঍{#"j<Nqo~/6? qPJ w1Lǫ #h! sN̝JE1Z˭vf?cIhc-3\*tsM2?~+ؓF>۽i8|N/zs[23拍r lFgwK)-(*XܡNe|31DU4i+DRt+4bux "1~ΰkx D 8͍(^z 3=oE|q/^`e-HwpJ3݃rXEҦP]5reߐ5 QX.((,k(̬DT'H,#v>R`={goZNV_C:oS8`b"Yjx|v`K_irO~,p{{y1nLujdЀ~𒌽=TOqZ @ypQGsggItvB<.=bLMo#A"]%YYݎ &^/]v5&G Zoh$E}j&95?oGŸ&r?8\;k=7NdobEU|١=k,WG۴wN&48Qse O$'(&Lғ%{ys-H/Gv_}@ISS)n[_zF葡< j+֚0fYF_'DUV$n,Bp\*`m Vđ+h==J~j93G~pgk M (~PKpA TC5z V{ppn_ɂ[Ga$sPNB<Xw2[Mt, ^CTCMH!-c6ipW?AaWVT( : ԏ?9;Gv)4 x+- pDzw)G-,RLɌH| r]619e]nc':{5%8c\bfӗh?5=g-ha lqpG9| d|o ;ؖlb-c/zuû0A5dՃD%!sy)vT[)4Ҩ~tId(;_6Gmlў!AZi&#MgADWk{)ji_\eH׺lRVߦim( O#YߐRWqGLx=~of/8Z|{V8@l"wCW XD׼7$AQ81S՟p|jy&#DUw6CO YOhJJ5 &E輐7&eLHW'`̙KjGyZ r*C?\`tqdyAtA\.˜ `A#-iUP FP{CO5ĭD<Βs+ߪ }@< j}|蝩'T2MWc5 t *U=37In+iM[QE8FvN?;ɎĽ¥e>Hg<2#z|$I`י>i2'j#QmpA(Jx>U|mGJhE{2seI1JFs )^!lLKszh J6%C7\o{47*P5nC @Mx~oNF9fV{eWm oRaǨ˫ *HRPGMq_SMx%R y>ppx]+*f;8LFIk95KSW~&!E;mzWgTfjJ50S]M(k^i!l1V'fS3='̥Nn 4m4Z>T}0$D[&M*(fq%͆̚v`YHZYAC@g ?Ƣ[ &}w_¯1Q#Du0ē ! (sKueؘW]`_VGd{I?y&Hkh ~I{H 5uj5v-Qc=0-󓳋d0j-%cޙ-}!Mj>h-z%WK@C|JM7_jC(.q+_LV<΢/x\mhDp_F?:-A|7fr9If2SoZ%E>QHTh^ O%_k)^KPwzbfԉ˺v8䞐=3ʲFC~X$ kg^!'DgV >^$$}jkStȦd2' Y WV\>0ƕ#=H͹zD{%tYaM 2C} fxPiSgt}7,ɠ@$0+e&L@|%T2YFDʶP XܢIcocmc J҆i˚y.2Α"? 6\ Cg6"7jGaٞϚ>B{hVgTnsaRd7PL5R/<׼Ȍ̖Dh󝿞K+3Lxƈ6te!GluLTHU6̿[k#3^l*͂+H*3D";Uv5aX7;Yj!Q_^Q {-4,lP2x=ms9? 5쬻=}f` I*yQַTcsqGdׇi#v-lW(XnbV? OXў?~s硧RޫZ'W` Z=3< ;Y"ިB zf_-΢8CKF"tP ?Xy+sd T7/ L 0f\4xc$)C{Gݷj6e秙AI U,Q[ OopPA@\}b *+Nk0q b7uĜKrAYi6w5kNQb6ۨĿ%u):YӇ9\(qtR`)xr\ݲy>V&xKpl;C9+aP;4o-wgc@w@=emp%Rq*e C ܻhwL:-ŷh}-F"\O*cTNVcYK3 HKd,EyhZSco*-۝.̎J7_~ ZgzTPcslR =a ,9D)@JxGfڮJ9{ JcOz|0߿V>t=zc988!YDuuQ![V`D/+id܉)IvJZA̟|<{Rc2mKZy2~mнK#^,0Le6:& /Y-T1O') 9 ;$tԄч_WY[o Yآ=',96:́8p65d78)u1eat ;3(a͡FD< 7R, ƣC{G)GQ{Gz6:e~2nqH4"`,pE6}>גLmT,O,>6¨($z\LPS.Cq7RԞ|ݶfApsN<ฟ :i5)ԛPpCN@vx~H^,- hPL7 s i^"6Q߲i$FSn','zYtjM COWKb" ,—[]чC4F_26DdCGw=$r ,I΅]~Rܠ +ZI5}gds*jgMHC,Up = HQ(*owYd54~>hDj|?l%&yw g,8W^nLKedt9^ I,BIPy`J0U2+)Ee5:UySyjR-_{ Sc YY3yYd8nLimS^Q#8cX4;7bTĹ-+2m\TC/}ϻHVKҏ `qA9=๧NV8h;gO`x:t#fÏHWoҘNXKg]5Isx1"8 z {UZ)1SV"_M^dAgȗq5+J{ 12Kp@l%y+XKpڸq(Ȏq؃68}oB[vҰHJ4s7 5$ )ouw[y2)yEO)C:w`mrKt|T"A  u2ޜ8HϑBHՅ0ɱzϟd#TbוqswqI~a`p'TazLٚtalv!O35'm<%A8M`jp$ikD.E!= $PV@Q/.Ԣh`oGCyy: &A ;ͦh>z!sll7"EmCQ'\xp)U Z,ĝS(9ÖK]@ Fu1Gzٗ&II~$Q9w y*rϞbD$q٩!  ˪ ]׀99BaF0֮`EG 2qv A. NJ_a{c;i:% a1ǼpvG1VUVTs9|WZeߓwQx I&O9`,oF ܯ(yj_(4.n [ݦlV ǭ:*HQqTP^IQd|:m3PC%kf΄}EjNJ6)X]偓<s.B'L,=x\o1,|G&Z')пBԼOJWȿ|DUǐDQR &#2>v/ 1 X:j t65q9D b»UDbD Z<cW} D{ɥ,#`_ZמozZb0V8%aT8ԧ&x1.?"_Qi W%Hd:Qةokh|'#jԭMޞ8yQ RsJ:`%FV<]Hnd7xɌH=8́-06<gz̺WKX +QEm\'5YM<‡> 8w:tinB~~} IC*|I2 7gr5촏);lc?k<"G5‹f >΍1"g/SB2AJ;Cò(JͶl7Z3Uj+iqy0gq3J\݁NSw`B5 ;u0Վ|QzFq,̠9Nyt]2,qHk߆ˈ!LUi%$Bjg_s*sj`MR>E `QA %UrVǢׇ@$` ŀVxSK.i* 2e!H4)b4@露j@c 7DZmj5>6@ږ[v/<-~JFo.F= (!pr0\#P,aKkkd`% '_ږ0;n҃}S ]b:QaO/3b{w,հpMO\82xx}k-*EЫ͡ y-,h 4+7u<CViBhs>>'Ϸe6o(eaCᑂ$j}DR E `!P}|"kw FKS慫:*(axŀI7Zn: m{ix?cC}VgW jD FB'Śac*]ò6Q 382䍂]ͅrJoR3u oB>{Ɲt٤`A.|fLPLPV Mk"%., <*5Eh'~&1^%k175_rwrPB^;7-&3W^?0(fzK0Kٺ<5vZٖ`)B $PbY&*s&I;{.YPVuWz$]ˍv]tH5c$("z8>nj\^uQ^QNf7o ?D Ck8J)=tYtD=)Ls 'OLދo|G!g9-:eI8^]r2W~}+tۈw8~oQE"YH/1̓1G3Lѵf-_=- t~Ep1+&kttݓK~Ř1I5C Y]0C'Sָ ǎ*]4 A",Y+HlmեޣSDzkAt{LXc´|O N)L))wֻu_לuqVApb'jACl%dmmf5=wN-i55)o1(Oh`q臓)+|jGeƿ&P ak]!@"t*2@\Ԣ_,}ZM13Ekwb9 j?~85^j4-n| d/B]$@pʮ^bܗ8h7B4>vw$ /'V1e}k_inUih'\Z Bɇ^m/}DᾍyA/V`)ʧ'"4c;YےI _O RNYu= :TB ZS 4/%P>Vy[G z ZԵOו'UVj;7~<8d\^ֻ4le\4c~ 3O w+7(TzF+^؜ 0^b)84LFV5#wv*(:7q,BQ3WMICg:ToUr vMULDMN=cx;KBOh_{voQ^2bfwJfeWx HiCVBJP![[NL8]magT2;йs(-x{YL-0ocs 7o4gk0;#Tm3{'PҲ\S_k Av=-e?J𦣄'aV P?hk0mDs\~osiQa3:VCҡ@V26GɈ Lҥx4x$,-+>*.R1U ,>zIc7]/H]Ar_:V].hAk}v1\A=Nۆ!W- 0;"Ѫh"V>/ة6$ԲL nr,*q89}E)QqJ_36ۏ6Hw،9^|Wp(>g##?F}NQ@GGˌ!w}U$ ɥ⨌Dz#H;}*QPnu)4tY3͋e tSۉ库zL8^#yIa^E<J\B^xTŴ㐏VVKB_ѰF5ٗ=6W!pqǯŜA3n`\vzNڔc 'BR &TrK [O>! V|ȢdǐxJG'oc$n*3ZOt h}ƒʶi|\ɧ @"i/Ùw Emwo]42\ ǥ ➮|DžuMKwt9svtMp?xv,,]Jp4-U 9"DCnwdj18ԕ~PVr[My/1sˈ{bd[, ;dDyvV6f@WDI-j]OT1Ax59'ՔH졿Qrdv TSv "s[M‡۽y\ٓ1 j~VXԡ`" '~j^TS5:486z#/ח /?<=Y5k[?}L[X|M2t1j50/ib8fxMm>¢rPUJ Oqa_}y5SU(إjkm&ƢywTC!y΋54l^`?y܎>J>uL8F?KAEj@ ~DE:ל+<'bS 歕5<=3@jPWJq'ȊO*=j=W5=uʞ2RYkl*P1d Z܍B3;c.oF"{/\k9Ȧ{RT3r}CT)Gu]-Ӑ<-R <nJP}hYv'+P]?$ 'dbi\g[q4ʂ36/@ (bK@_~+B*@hYU]>1b8%"qO"gQ3U b5@t#GǴ1_5b;PG*wv^w9f1~r260ջư oq]<| `;Au=ȃN> 7?Fd^q O dljC!W7b]_(aGkw)Cm5w2-a|VO~N @X`XuvpXk)l+:b0PE+ӷB:?:>-AeZ΢]e{ uKWWzu2!p_M5o|>t1=J 9-l[FcF ">겛P MU& ZSمO `r6ؖh4Ufٝ$'NR/?!` U>kW_>` jg~hsO)Z /CR(<׏jӿ*4fVH!AD:5U pJH\녪4gOOud飉E)x/vz&"o(l-$g}f1eLWkx|Q)3';ymscw lC^TN0l`-)mك d(uFEeCǮ 3'׌b*:MCu -[fꪥ։J(GxIR_˗ގ.fcB_Κ˝Q Z/V;(KS|‚.IAxR#+k ckZT@ywބA脩C5 QRB)"$Xz!ͬCjamLszj0FϜy=055//o3/BXgeogR:`ǵP4C{+pS/e.z,i FۺWjS?Bn}'RpyCRc1 vm yy]4=\)Fպ^f2/#MS! ?Ő!Ηi*@ 73S=U zz~tsɗ teOfš0K:M e.6f~Z ㈚cT^.~$S1DIS1NO9E!v){cNa'xWpG_Gs|<|#_[!҃ӻS6͢^bdS5}%}Ș$PoyF*v'#6?ۤ0΍a?F-NB_ rfI;d /[K1b*,߬,'0i>i +Kiy 8 M IJap%[9bH* ̪xGC1ùxQ9DcܠwO\NhvOH*@m9 Ο \1(h@j}CkJYHp.96գ~+lӔ+L.tD)~#p'e0j*%BuYN7<S&(LW[+#Ay꿣x1qK1w#$LY#0(" l194GWPhjշ I98e_FD2Ԏ40TR,jP18clm ,֌Q'љ+HdDEIR*eUƙ F>OWwS(hrQ>-&muQ-g paӧ=@楑76ys}C0-tFȍ>C*ḋw^)g%S~ԓ ?/ݲ}7nEV_2LZY".9`YEurU*T4|@ l䄄 >Ȁ8@d10ck>Y@3?I-( lq7:E-;!PS(}$0mGgAi^M fM7Q7u!@t<I0[ܦ˹v+Hqs"qAε; sy%d5]J*OcQ>"+(@+(H!Gd*3){3ѲF"ŭX8e9f [7mmWwݻV|.qպ~Ȑ}dZ4ϞxhCo4b "C?,)QB)ᘼqB+Ϫ{H2r"WÙq3޲ׯ:]G ͉ȉT4zl2?$Ju4< W4LKP OJ}|3IQ}9J0Ӏy>r9GLd­dn#Rxw v9zFM ފ&bR9Xuj:7gD'?(q*1;ڗxapwzƭya(Gc^Ӣ#z̆*ѹv,*}S&TwSRϒ7+uajCM]j {7T :Dwiƨ @ksXP pbGDi:UwҙB*c*b>#bj;tv\2ٺI p/y[bHiN(3Ȩ`x~ D1Y(w|av;&bvlcM$7Еo^s%x}ۣp5"f~>*oMM:f7/ ݒNLEdSg ű<ێvL.!/=$S֞ySj3'DJۅzxQhEzުæ7X&C}*^ # 8F:]0H#zƒ)H@bIʼݢg͋+qqXSQu,=Oa1ԟLG4ydfv`=Xre3|*ĤI-H /~ȼ8a:cr6#{eޘtu#&<e黕&eV*<=#S 9eUlqsH5Z07ft37j$({$Ly KɽF ͒|4zL qlLn:Kou绻NԁCzEWId4{OYt EXKљ [+C_Aؑ5*ey`Us+L]s76ZV[`?Z83'ng7EA.?5:}XN+܁FCA7v~%8x ;=(t0yRaa "o{XϽ*dV}[N=qj4%k{&/H*,TA+tHgőF q(N$)DKAwV C+no7 i$.4|: A+p78ҷ7XqFԴd}GUpvmnmaFw%3#;)[-O}xͱ-5&Na5p%8o#eʔJnTb4zTeH.guD>YW3cc bTHuB av%& Q 3i2@[#vB7CU%b091g ./JE0HCu|ZώpbJg^N>ov~5] c}Ꙭ׬rm^#1 'yHv㑥ac!4JσR$Y !8߸ w5diЁfb Gsڎc#Ɩ45tx91RgƯCUY$皠wCh.4ss±*oEL<#kx9h"(ݏ*g9f1}7T`6_BOD) = Y4AQ(ɫ"(¤#?`JΦZtFY_7H9VC^0.m\ߝq=LM /zwN\d5zu6 |0ISG }kXG,`39i:z:]\d~@U|%H֏C='a#!K]6B"޲V8 pX:N՘Ϊi4y|JtESɐP h`rtLh K4]3݄kck/ʋ6BKn|X K/\,$=j0^zaL pt_Bar @uAߢ'ۘgaӎ,hlØЋl],dpup`!;#siLErpScyRqCzKK>o}H3mfOb$4 %;faaL{lX͏::;A凌F9ؑYH_:)lRNPoyGH\.ޗ>BI%ֲr|,LGڊ+[JᡟdpI܉dhǫ3=0WkhuD,YM _g=:{bDk?)%"ĵZ| 0YcK5ÄmPèYJ2,Vj9lm WzJ,oQŤrݫl4rV i )|݄F4k_/ATul˺X;L䫕5Ƴ{SP[iR\173>MQp(M}{W OzӆŮ# ʀNWwuQԄq;MVޓʹlCԑE 4 d~!zY > :﯈yݵ\ .D!`[k$V.^r!|*ldtnvאdޓ++XYV8oqQ[DAQk X(@oׯ`[TΙV6Cə g52sbm Y5‵HD/9F4sMUu[!|4+KOq <)D[ N.:1醳JIUV x>Ȁ:iC"<vƘJ<\wĂuf؎h3+rZ?ݴds"Ǽ Kz_߯ú(MYyZ^L ?Y"1޳(d nI2rt\^ @ 4CCa+Otm( ày4]~1~W2oBO2_ 'Rr~O?\]/\U9y<<`so?K5WV~XͥN"- Mҡk%Ŵ;@?iMrwIAJ&!-EFJTO@o?A!JU}֤mm=]Dz .eGuDSG2n;"9?f"NkXM< ᶾF]HUdOw2Wl w5@u9iؗ 0]d0ƩJ4z)A`PA"Z .>q'v +>vuk`?-E(7HReoS\ľ 5eey%d>=)2h,,i0T}_j} czA(o1̕C_)bFW_{<7AP,KqWŲ˅TT| 5N/\#rɘc^y!nVnZ6[ԲZ/ҁ%~+8]AGm>dt6w+ 1T8I?Wõ,< 2mիr67_W{ -N-Xs ,@@ ;ҵE Z?Qyb<3R }t qi G=&;|v;_w.JVm힒bfiLTp: M|xP~h'tuJ+]vt;Ak/xj$',l2sVBVz 7QatFuz mtʊYVCKgpE\`)AL[*%*詣{,>=ZK/t@9{qH(z$eG*~@ z#11w;QVaY/bX^;=1po◬s2Vt#Cw*j_k4./ ӳ[;F|]0XWڞzE1Ru[VZ:ٷ]ėPQאk?hZu uԝ)"H2Z<|E-]o7b1'Cra"w*֒.% V ok(\nraCqZ 1yߡγ/k%yorN]א#W4ә9'iZ_PЫ[cK -L)].qb VV"gjEȋ@p f]Mlov\QF]Pn!LJN^C*qJj$gK LSr\b$!q(tk c&^rBpt`XWd X`5p? TvSb/|][~a}yY fi|ƌ״WBb> d!̌tKz]Z ?t]̇* k lԆ;BJ7,lPNc9,>%27?5E,&va4D7D* &9}_r:lzS| yWc'Vgh 69YKL)z wVFp%/LB6ȸ>Y`;l3?,b(S K_,kcJ`Q~'"*L?E5bx3$7~-UT/|ZH$9Y֥,"Yw b5dΎxNNRy;/i&C>|AJ[^] _mki0M>ϰ.N lX+#"#ɃfNEOz9p&MPGV{\!Ύ']D]%/?\Q(DKyk{ЄRa'R}IЇa‰2+vňln7lz܊d)P!F yvYO!DܑÒ/׈G>|=E O(lCTm8@hxhɾH#YƩ _N@r-%~ju ڃ4^qR7}>;"v, ڋ?h{pBJ@DJ'Xc]%_֦HND̄\rRh`N4xI"!Z ,Dz6ZUpE1_$6/ΓƌDY-}}<ˍŨDَlQJM<M: TU#YJ'JZC#~6Υ,"hgt|&L@|AG lukVVP=ܚ{As|MJy'%Yx.xS1͠u]z`41kvG$:q$>KM((=KMfp cI^B&5f*TSʞI5՟ϟY/=]A'7,x4fduq)N0SmT@ZWA0 'R~ ɋt}oVM.D0(j Ҙmv$RG.>\zNbw7G~|lRިsKG,-g S?Go4wF|n(j0^iLGa4b)U/7_I{ًB {S6UbU,g|+c?LxDiN&dD={vpmdKݐ,NʚW,xV5ɂ0U #)#GhFݸK7.8 c#dİ8{:eAyF^o#(0<ҽWV9U߮dVMzKmy3%/xMJ?w-A1kkayJ-{$xI0>'FEE>f Ew"联.K4 KJ"t՗hah22 Np\?#:L\Hi]ދ.E/#ˋ1Qh]3a/Sj0Cpj- }ޛ\["=bVzxb~[IBPS1oU^Y? Щ_ {,hW>1ͯ*lxc3̤kfeZK/|d~g[}F>pBPc ik.xH'v\T'q^ݼyHȇ65_e4S& I8ܞщ D7>^$,L׋lx@S@B.E L^B*e@&K`9N@jbs/s5y .I# /5aef|ukq{"Mh$\TCj4@NgJeeYM3~(12!#bq(b9JHBBH$;mI>!Ġz4-ZtIVci`as%w|kHB H)PO)S9,pwK&Yz(||gD7dpy.$WSYUSmLWy Qw$:qE 0P PlB xn4ePQBqU@:CѣLbt  * !V  nbf?X _ML _kX&*=b(K4Y8!ZL``mU޳lH^X@9qtapY۸^|d|Q7\G5KB "x~XzmLZAyY˟dfhH֗<՛  ɆLWˇ2F3q0}("cyz$G1t9;0xq9E*?J#ql=&^YjnqiLb7B6E_.lB1Jr^zJYLS4Dz=LѪNs(}f)9j\({a|I01 "߇*|d[Y=s|%rb߈'w\ŖaB^bi}K|4*Q%{@Yr|Gd`jaPjlco0äx4T8Tg#P lCIּEsbP1t0"`S٪_ّRI!rL6f ӢLgfL8ЙcUk)(;Ngr\˩~"L)}/sI3.0Y}DO^ pse8:Qd` H sԒh?(T赛o :k~>809ɖ:vs,{)+!{"bcRE{3¼T(ItYt0,}rp,֫^C" kU[:<ƾqτނ5LNk~wTw~\hyCݫ|ӻ Wg\/ }gl\&Չiha؃[|byErz]BFwrmtJvH³N ijHc ̘N WYYgU8&)϶+Db^ Əs;`hT &O3VYfc۷g[Jvۃm$-bK:8 #F3 EOdDe%e"%w A3Ю8Iɤ_dQ%p)㴀xNq6W\p9^1^D2VqHի7a0NY&ц1(XQI?/HY**JvqƒȑsT~Y~h\֚i$uo "% gJv5غD:M#'-0/kc_h^6],k)oݭPwb&45&K!SK,QFqm T]ܳA(YR:*}coN4of2*}4E5Q_R]%Cj 4jLR[Txe3 qu<^rPIkA[`hM:}-}Ɛ\KW5`5'3U|&I2J 5_T-Moqt pubX?jw7Xcr"(K ʴ j =>7U-r " %X[y%\&VF9!r6JIͫ9+8Pr?g\xrLZ7厰F(fH>(Bh ijc+Wx^GK {hgdݢf)٣_fo&2qm=Emf{Gi>6|2l'q5].`ץV$0x*mӋ[&2Fheř_,H$Wu^ Lk0M& oPB1<TYЄmz|p~0pDcO5,"zNR*grv>װlT40C9J`1T\ĹsS^lytM$`D~ CU0q#llc\4'Z#\?.yi ^wݪ_'ry i-ōngst`H8>X7Cȝ4zXqt1BGK)TI6hJє6uIeeǑMj(ŌpfXV_JPk~ꚛe#jh%H@ յWV'c0*\qw'‟͟XTτC}#Ref ygPWgFS, pS:@,hR1 :+XypjsKkȄG,T1Qfeʟ,wʈPkir]"(ŧ, 3X6d ű-'K'_Dn]Fb[8Μo}Q~zO>i8L F_瑌x 8dJI)ԜP9)f,D= %:dž:m.w+9N?k/# 7H(uZ"#%X͞/-];G?|7w/]JJ+Q ݕ͙zYtk@\=gCZ=-*XI V|,."!Sq@z]GLx/C$f-/"VPa<_*I:״)'n6ˑ6l(l~lSgsj0u-,Z֊%JjJ/k5#K\FߚD'|\_;oVA+T ͉'jĞG4D!IxyyK݆tǸ@?8yFyyAo$JYn-m y'Ww]/Nu4LY!=忘 EB^,А IrQ DNCk mu4Q_|BTG~&N}}EJF0M琻A=H WZc6\4|dafeN2YG b^Б(6a꿯L$!5vQAJ]IJW'5G1rY=>Ёm5a 6@F{(09\)t$>Q0uAVwڇJqe3D}٩vdq 1'&G8ya1{VOT6?uk2 V,n~~`"W$nlx>oi yʩsNNKD(ٲ*Pv%&Le:᎙}$vz֑J!w-V{'sYm8Ę> 5ϥXpZ2)0۔(ƥgVE]t^XOI⇰~yvZPi[p!BVgMü|[Hr( ө_q8^GO,0-s6b* [WabޥQIUJѤc4 vRI*+^itK6槒4J 1LAr4)Pt,5$lE)o0`#2ڶ7bF&g;WI" t!^cy8AZ?#硧z}=?V>rsa:&N;X[> E/OIGe6R"tyCp`Y!D[בrmwz]ôe ;@{ 4ġp 8~jbrE\N5FI,KQBlQVE }5FBm>tO35eR8ۀY4$^2rDjpX&JZJ4}>҈bZܔL(kuIkn*!iA,9h|sGJlO=8i72m%w1T}q;{YZ?,OKQG+~v i?:Gi;r{>E :9}TG q/ C aN}ݤ* ,zWF]fU^G]dMEb؞,`r=hf.*UPSL}B)6(kޫۿ<3#~S?ج?FΖ'ĄgOYk8H$˰BB"oҨs(D02ړU{Tw <sGm*H*@lDd>:I|z-IS[ueRpHԎ\} ce6.ߨ~lq%2&H2@\\_S<V޵ǧ2,m2A92 *^"+!=N.tŚav| A#%ʓiˤ'[Ro .Dg>+;~k[ 3˱%c2Wݯq9KL7qxDi&}ڼI0N,ś:=wfT ~:K, %.o<sjdf`@-~ͭpOEp$ I Rgj6d+!sX3<{K4 0ct:{QNռ4k*Bk/LzmO[r*Lq%^OT.-gQ<_ӰOtQs ۮb8lvъU+kh  =9ݤbԇa@]dAP9=c%ţ se6EjԲ+5\#Gj%ВhI)3jAfa;m@6v\m#-/ M_ *&{7r_p/Rrh|M? Q[GtD@x<ίiƿ-T]` "ґx(PW4& ߒ gS)9^VJDICMr aO8|C8'eHI9`o(x:dLW̫6 @",u"6ߖcRAOM 4O2r Y낇_ԑ25HĄo(_.W >8^tFnXݓ MCkwczz4P!vѼ)nӨMysIJk'Z4Uަh?"iބד! )cNc,φ)zSHiY@BFS+ZG 7_3*wh@ƍN$2xki. a!FC}A3>Cv-+k'Ze +1#BA# ƻaQ@;~uWV1Ԯlz{i uqy^6ޮE%_N׷*\;4[Ɠhޡ9Yi{bߚ15 m? 6 u r 3T”WmTs[!飓۪Î۞ 2sCd|3iiz`}r9pHMN9[U̓ ^52tsH<葤Şm"L/f[FiFuTgTN6QdF wu-Z2FپYg<䷌NǜSdVNJwύuPΛ'#lɉn/a%]&<B_DoZ|@nجG6Nx㛭;i13'˕#6JgGѣS{*-?~,Q30{ՕVq*e&|94R66vוk+qTDޣΆ+ te=wjj3j[#d/ɽGuEdI`ݭ>о-1I*orjBb͟d0 ѥ5cw2C};)Ei`pћ$45T8]o:0^T x!%A<{ ?L*Mx;fn~Wt&^ii~*ϫYaa#'W֬R-8t"QƊBS --X ^nf&ڱG,=?_e}LNQx @Æ3:ojnV'KZuJPڌ29HцƊ*/TUf>"S5L`kTfC{ժymZ>0:xK;'&'"e [$zFAgφIiγnZYx , J)$U^_E1.pK*fĺVgpRϫ 'Z@.`"{ B:kVltW<ϡdзtVmZ=S{ A/ϲ8\w,APЏI~ q\ aiꚙR f#_ȳ9:a <9E<FQp;hea™Wn20m}P Nv^1R (/dJj_zxU\4)b2)My~|b,ΦQU#TPq@&@~x{ I)u*>Fy%QdjGDs$ruSe~ <k'x |/}O(Ʌ-e`ʄ]6ql 4G 5W4>j$c~I͝@P^ +w9cgLGtRk $)m\tE.[O9;iF >{Z]rbܗx~Eiz)jڇZ:̱Sӯif9{$%5҄/ˀDLڣJɻ}NX@@pC?ГPlD*Xlqk5{^Qj(&DB)O@*W,G1Rq_̲VOcT5.aqK[dpإ Z`_xHExF7=J!,c _/6%¶|#EAȀ":c{6;_VS7*cnlطi4*&2@E,pWiB$W]f/:O [ϻ7mE(ζ}[̸}ffqK!YnkϠmd:.X𛴓scN%ؽ FvՃ.[%:UQZαzp>%ټ<MK2+3 "7R!\*c˔D¨⫒!etiӗ*S0aFVK#sC \syCa;rIy Ƥ048m5AڻM:Ց8PZ1 %f:S tj~2q6D/=`_ |[ N/Elk}"> Yұlłjaw&U?˔;a@.T68fuK3sc{;FDm]K+ C$d9 q>{De3F?r1h|sݸF>.{=ݡ8{*a=<95$*C T5u#׺:h*ӟ6ʤt7,_=r`aN%6Kɉ9[rg|t_SIͣ/\е2qb̯93YH_Zq1ئw!U1N\` Y!Pw :OA,S6f:Wyemȉ+1ED]x>e-W=^Ӈ*_}6GI`R穄BZ^LP$o!ydX䑈~ȯ2pd5//; ײ0?mfFvXr |1HׄoS@'<;/gl$@͟3]a28[ 3y&XW$VOeMP"!h8qKv G,;[g\Zmt2̼?d!†qQjZT<2wܶ2hZ]julI=f"EQQmmKHaHt s,Q_YDMtz$$z3gncF#A r-x-=,byNBOJoRbi(WɏLM/xcTwb@so;ҍopQ}cC 1?bEؤ*{m^ F21Y$hj3@ٕzӇfbe]h0Y={RH.$EFkjяr)? CCGq M|gdX w1RO<[]ZYJ,e8n*?\8y{Ѳ(I\޸8jmaws[^ݦ~}v_`ء,DT2UmI\bہSJ4>R^qw6~#D@)YL⇦~_& 3j ̀ZeE*DMw 3PMbG-oݵMwm2ulyJdۻP&<"GoJsO];OCܐY8Ⱦ^6Mb XSVg_zԆM|oD=ʾ~`Yr3İ^d3~ш3Ж'~L@{(8\ P2Dn۰JE(wx_4>f;*9J4k'sikK:`ho+!XFZmB FPP<TQ/Z-N,)޼>2R8.:_f\["k ϶s~g̴ѴY˅n؟[HC'qTY"K[gI-7t>(̘֛uݍ:G_/( WwLЄhqPu%p+wc>o7 &C>KM27?mf2~1-m F2ն46H?Bmx 8ovң'rvkp+kUT y%r^sbG<+O}h0H#9:HaöW<.r :'2r ,S!eJEgxqI,Xjԉ'_x|)A]*7/Cuu ':bxw-8JJl4b"+0mn!uN꒫=- 7HA6J4.M!1Ρ2UIeHWZ js&K/)oqԸsEo%g+qTWBɗ&qʄѧTeh( !5/a1Z6{Xj()ͅgKhzhۚ`=F$b5ezq.@Ytβi-=F@_M+nmF(LQߍ<}w9>|$ݒ?Pkv-.]CZ' | ޺tXvj'{&׆ria;_ZM QYZhQ&8UBTK`?G2cmJOxtzԆ?5/qR8ߖ BJD4&&Y]lBqb9s3#@ɽKr_[IrrT 859XyP8י^}#X|SI_bIz<z0B~ߙ@WwH܋=xHi|ߠp{O}qq6&,pFMUνja<@'cwF@nதGջVBqϩ6)T#|rnx*T*0LBy?m vpy1p]UW%@hb *9X{C;M>:wHE/)>HmRg@m蒰kX~\{o~O|~2id T[-.,UQC=<*Av^f˱!_ٿ(4ThQլPr3Rr ֧ľ`=X)J(3^{z4RD:U'΄|?EV^vnܤC%/k?jQ^FC7L vmZ5 5Iw0h?əڵ:׬eї6=HW*ͮМOlGGRw_{:5IMH 8".\ "'%wu {!zi2!Ct1y;K'kvzVѥו(T)SP2}ʸ'yW56 ^ v`LzoXCн.-c%u̖C#,ϙq0c`[ @=! tQ[b! )}`jJQk <x+n:~E#H1%lӒǚQI3,'J$$HOu -~NYZ ,%rS oVHG~[HA*غ:0j̖ϓE"2m *6SS35b?Qw]m(4yi0[R^1SۮCtn7\yɯ\%&'IVdTa)vW÷d &Nb>NϾzUA]"noAutee4{S"1IN_Nr+䨕XY3PU;EK*y=/}_76{AAOu]'j u֡|\ d=6et`A(}4Y4"SM= *Ϋ}yS)]/5OD< t޽nhFO͑Z~ܔ 0p`$*^m qulCDT&>n8m iBN&JAAW>nsձZ0FL{, hҪ96 t5E->JIʑ70y)Hrvl[h8:I(sk) 4]):47@$ k&[);F?HQɧ8r7X*uܗJ K28,&*$75T<'!-A'T֧5bh<сf;6GR'!%(q/aD Z f_*36JYe9{˫6B,'nr}մQm8[?]rHMaan|5ߋ?fuNT;e .,A_ǨU,TxS~C-O5\Sp^lA[[mØxWL"9l'TRr6 V06/([(GC2ŕ@)`X1Ϣ૊o=_΋yx]e . CJ"2 d@X:>nM@)|2)~]{(0Tx8*$"T1k[ L+{Hrp EbO0=OOĿ ׷dŃHv p +}噟_?,!/wudXe+Eөp]o;zg>C vRꐃ /$`Q>~*Dax6A[b59om2aW >A<gf}~.Nnw9 3mjaC5VMhH,'߾FPҶ<<(N=~Ի8KXǨʴsP3+Iq(J+]]~uE|>PsR? 8lYMG o-o\ єxLBܺQN|ZX/b`APQs@"bOG8ĂA p`/H3#!>zYPbȌIMډէnJS]֚~U{fίxa L ž;)Բqhcx{[!!LĘ0 F֎{(wkA-i _JQb\p~IQ#?r@*AMsSWq84( JCC?8ZeuUDR֌>[ ,(3"JI>sLe|P*KqrJO{=#:5#d^Paf86fWj]J );rB HoW,*"kn많n+;!?zj7{y O!rE8lsgR{Fۯ3x,0, /j$?KzIdoN^8榄0~+EO#v"شH\&(a6 愷{@77 0ry Þ[,8ow l~XaPa |~w'9 $SDvB8)n^ۢc> jjќXhm2"[7KH?ˍa*DÂH`D37t9qFOӋإ Qِ:;GUyPy / 1@1N.ΌHFV=9vy&2P5r +,Et1^@[֒fo?Rة٥Η#1VE"ZS>2 Y']Yӓ=hX5g+!^|C6ĖobQVcY0Mr) R IrTe\v6n@1ד Q;zl6/|Iga sهESQȜ 吂,ݗu~z@לI8(}{kǙ1`ʗg:|8ģPHdErSVtRqG!޼9by~_O˵EMd4$`}< m&ME LoĐI)站9I!\u7XkoCyndD hT5䧌eGGfCcD#e7r.^~:54OѾ+p *<=lS@ӓhK|@Ы3ʺh3#(F|h֡&јM-*)ƞU1VOyMM،Sg'cY[" -3d\DWZsmI(0=]F_;lE-6J"!rSN;'s~FRܨ0L`BWQ^~* ㎱HNB|e&~ ]1C>^h8"@r{G("U_Uv ^ei+ϣ,6|'pQ6- DQ匪2lq䄈*1q8._qQTx[Ip?m/%^;k=R]?IR=\:J 6\ 8{MM8׮xPcJY:đ1<)ׂkQW ,7ϚSejȺ&;:&3 7zB\6ބ>>9:/jzr~܊Ղ h՗sDs9]"gF6哀adeEٵohG¦Dd},_Rr#s{S&JU6AMa^t`I7緩y?>Ҭb9dqPt3=Am I:muİ,؜@0T}+ sy6~Ak>EG Ł9כ-=ʳ\z0a^U;GFK!r$Sz}lSe&'|lT޳uzjDnKSS-M4@ %|,m,;'VLwB'MtRo%>D7Iwx n8_qVȮ wwIث̔o~W(amv l< ]|HE -wgob[%b|iדDמ93TV;Iϱ8nֵV|`&:(w([cUh mq9v\ A C Jk6ǟ@}&753g"£+q]ۜJ&h_ϑm3YASSt og|Cb!ċW`JY)a+>2|, sP4G{>i[0$x$jИƭ٢8<ΝGTn*`d;Oa0@vγ-7(r1.+{qI>>V*q@ fdAZi牉0Bvre0߀rU x5'1C@Ys(Jkr.WK,"@Ί1¾9gkza4h6 EH,Z>e7- ^eB^ W+Vn`k:~o"rcjD lủ)+ͅC|ryzvSq :=^I.EG▉yHT&.2!WEp"b dz"N+m\K8Sn7vEl6UѤ=Kn`1F]&e3d[2K(F,9GSQ~N,l q"pdfBx鶬.bRNEF"hXVy7mR7p=>:8m6$^p}Kv <PyIRX9Ȥei܌&=˽ʙHg=#((^Z ڿ"T(jkIF3'o>+>to^{6[C9Jg! q#ՠ U+=A*[KQ8\ (2eKg!?]DpRL+yr+ ZʃԢI@ owZ7,,fNEq*M1gۘZ ՜qZGt83IP{倳LU;c!NbIz]udElMSӀQcaݕft)>;(3k iOi'MhׁHXnK𜄔*@.Old垬g>mQ_2%]Wж,;:uJ uߢVDsAKc[u+jO1ػi;T+]8^{ic񊜯n^ I])@6NNY%2SX}W'bvcN8]kR5uS3..>J$^BHrJC„6Ɏ_f!_'<% Q!FqӾ⼘/4\A'f'A]Ų!XFeK#κ(vAUEC.DAPXoI=`a]ÏhYʹqJnTRرx8!Ln3Ϲ 1e1]9!@ܪ4^ ϒ!* R\>ԍ0quH%5j~NS57*Tc!daH<8101$nXPa[dE?.FuQLC4gy[C&{nKsB/Fl篻{w"0+>$%[-u׻Ot_/ w/N*oj!yg(2HJ**5$O/?bQ(g*7i$ xLEa할M ])QUxO*5%2 D6wR\oNjh* ?a"L#مvփ>Bi~ 3*Һ@Xa$( /%a"k-='%@ b 8\yIuoE-Sm򫼠V r *wD jjpsC0ŷ8HyK1 ?3[~r͠<^amldoZ ËK?N.`oH{?:[KF=Գ'RQ%0D7_h܅T^{nzq ]ӜpG2p,F&3s7hUq B bLlZ3RH}98حX.:Flww'=V_SpWҡ@Ġ?tjG؃#_351=X;>Xa-ae{#1P"I G0)2d;~-ގ!+1ǪC6 <5/4OLS`tG/~5j,蹆pNKHH?_f6K 2<$- qqw&Ѷ{)}7 n~qN%5z n+o R+7Go!cԱY,m+X j.=6Kħ_o M9(<{NYdZ2=`}6w$Fs˯bpH e0L֦Rfw㒌^>Q뀦B9v?lZ)%pf⿺5E#,4:v_R1B "B>i3[Ba m`:!霫vճ:nY S%Xu*goP:hx=R׮H"^N[A'mX}ӨF8l{pJt'<\6dUSμahC/@I-l=M_LL'ZoLPiƁht]#ͻət& ê-\g_~YdrM.Y8X o-CEh)yEh mBлBR-5QBl [3 DYCEk{p:%[9B\x!2? `uE-8  gVؑR9L+"x[0usB@aKf ,pѮ.:Z!?pî&C" ;p'% qD4o~#ؼ~4͢$="3k%K)훜e rHy3;w '9 q\nrTGǚ=1a#M c\~qD\ี:<ނJYG;m\<"ѕś~@?4ѐɘ|V〺W=/[ʸ1 U{M(vd[1ɰIw 7g _2^!8Blu c$[852D970,X\<*;עT'vQ6I! -gVX!w3X`0=Ҝ3f\L/OM# JGo؜f Xrm|HN\w~ۊb#d}fVO;d?(uHM u7mKBZqWJsHlq1lD>*$!O\ U '󪴐DF̛ ^)rmW}}P &\LAFmE02-=鄂2F 87H3MwATKoRo8M"V@ ,~4G'`ēZ*m$Qe堀Fu !c gO_Yߔ *K EYL0Z(+!)q&kBN4UE |9XJM4QPLVgj9!WsOu 2*1/c,R-c^ıڳst|x%)Ǭ*O=Q|VFfr,1iY^#Cj\#0G:/w7̟WGH／,Lt&Ā4 $z&$o'S\s9טI)~(!6מx0 5$%5Ì!TU IE}0tB N{v_,ؗ[@mt~$}_YAAzb {^ H~BQ,snMLܸm9T %|LE ߠerFjs5jnƜ95'|x]?~m$LŤs¾SJ D/4.&<kڌW* U̩GpωH#^*K =̒TMxA\Xn"tsq~w -}ؾtV1' ;,/'k!6't +PQ.nW-Nq*R8?&l^mDku& jkC.{['Fl0xƝX[Y uk$Ms%L x2ߡw C(qSr<;CdU4kR“XnhO$tWc5%i쯈~NŤݡq[S PcHX4GyN`=sz~P ;h4GXVn1,6p\i"qFژ *FѮPዿyse?NXI}@rF%UpmuEG.rAw*wIIo6GzFD|KLgۑMxZ{H1: z Ia0Ck\t{&Ks942yWJE|ӵ"c)2a0%Ce1|`M؈J.0$gԯ?BW\LdĪLI&eɊ)_<&j4saS9\iyz6f 7Ȟ':KV*ػYTyíJ{sqU\ň, h'čeWDzT*gJ7 KYф/[P'[ }j}YK?Rj[?ls8τ<ͶE!@@rP73 _G`q մbUr>WS(8?^nJ^&+M05Mۤb*)cUk "* '2I{62`># ajJ{5윶׾].Gbw'ƴ%z3v7S@kuˎ'9Yi/fi5uin8^$g`p>#N(E`x[ ŚmM6Y9>TSgKU8k[sS;o'ln?}0K`P 6g;if?*󪿏_-9To2II[QN_=cV:aNi4K ߼qpRntoNLJh8P:R0 {+3$h":9sZjݵmes| j_J@6G#@Ɵ4^%5joQGپb4PUjcNz!&| .c&pŽ@ג_[34=8ڏ6%ǀO]UvC~7g5ի1vemcEuv9DbX\-`eAs L9&8xfq'>/gπi#lZwKq@1fNK'ǪG 9XU%h<1!3;>:@2r0R90 ΙŜp}x=Y] fy.R# %{Aj~x%'٬jI"/1:{3k9j*DZyU_;~NM{EN(%|:Oz9/\1I~ŧp?4ixBY2nAX3=뿑:M>I`vH v71*n0Sوm}6C>T̆W{Bk F0dS^ݒAԮwTw+"45e*M|i^֢CZ2:- \R}w߾j^NK =D6L5|U 2]_XGԱ MCk'~.Wsއ4U.l]M/8]tڧ"5m=8ɠ)w@J- 7!+BD6c=7 7?^8To8=NŏQГ)L]m#۩@2Nbkb~! "@)~<[ *PE!zjt@-!^ی4M$Ql(Yh$70Qą3ExJӘOb*V$~H*B H@j)"NrL#v3Faz*妫WQɜF + ƩL[Z9(ĒR+ȱ_u(5jd)%yhFqw;X~g12pd)әf^; e֥b"4pPA.?s e%w0ol5-IH5ZN9Q̓с6Hz#qlR}wv =dS=•_ҩ.pjB{CBxd>eY#Cli, g8X5ȁX85оU7OՆxEu@vIw~6 }"+Ѓɤ}ژc%` TWB"rL䗠ec m-ᐧ<ހB}ڌ(4멼( ^=e'[I_F (VIU~F=UrCʐ&Z-EglSb*c=u"/'gKذݛ$D,|*mb*asR֞qһג)9\]O (lXΒ%k1,x"'׉Zn T4;L舊% b×_EM֔ˉw7ctxP;/z XXÇIx߽* eth`;P۵|XʭʡM8pnۤ6kTұUPqOE-+wxŪ*C zּ.xiw3.'z7,طVqqjW7Ayxqx!._ \@IX"\c >j$IS'l*G 1z/E u0@vW'ǿIcjf[A"b8971OA+:êf_=dݕaqE _H[GYO1~g ~4M.^#Ej[*$EpAI^ډf |Y,qKI JD&Ev1"X'xZ? WYwN_u;[iҦ4"#HBFQϫsdQU F%Ӯp0 BD6R=AFQNbJzbm|sP[r:}t3ȘCɕmǦ9R|IČt֢&^ȁJSIMo.VLK(V7/yc@ӣ4A3n)!dz.}4&!`&:mp%BU&jy`͝˹bG B]QR.'ے[|"7) FN[YP斳7%\r̷:=0$^Khܫa;rV,1'}t͛E18\^W&U|Fkp-kYM,&~)-IցEdy4uOU7*" ϔ|i`_ۖZ5GS K[vw7:Goo +}(/::E ,ЉAs (Vl$x<&#tHXpI9=rp |`B,@=Չz/$e$BPT_)+EAIbF8S?ty"a ZT$Y504o4jwB*-(<ːE@2"93j.+#QĈMOrb5H?5+.Ҭ"uR; m.^<.;IXt{+7v;kr)Aϸ N/XcSJP-gXv+"d ގjʾ'oBW|M/BB=KXZ(d!"ϡq+ %ݳKh+NUHJ+p<\<'Äb|G_ *F PoQsԉa7=mv_oR~#8>8䲦 &k6-M"ׯK-5Գ: l}cgb% Lsu48xT=N]>ctwhkJTK'I~\ \Av^LW">8Ӂ8iS<~jz53= ֍UQ/,E$S?w7{}>UdĜg {?2K'3bM, ((ؤ ba H|3, f0uy?#-%W,3*1K⚩Ex#|2m^?GQ)-浝 f=evK+Ecت Y4PVj,St}UNdT+wO#/  ,m> ^3+JmjmRKŊPyԩq}!@c(iP䎥7՞aG\d(W›16MUFp77[>p̃CͩɁ8s]A;'ko9L1X/[DMne37Y/GѠq@'F|Iw37H UEdC|lc73dOM: QNݮ %؈w9FgLHqs'#pyOO 7y) %~.8/ǨG(~BHzj'w1~#N?J;rwj͠U i’FS`?i[pbTF\-.K*7 bG*_!0J|=i g"=pD80;#rTw7&:6Ed{ng /C.ʤtoi;;΀-$3 k9U5KvaqSsRdO{BgЉ )CӹFr+ԚL S2#N pYchzlR;sS؟52i4 pICH/V{a,[mm N_$eҞG,T] S˼8EVﮪe׶Wi ljhu_ՀfH**0r'܍]RP׏|$ ̻FnUx>7KIK^uYe )4c2m34wa謭"NΥ_ .5K$&(MIEA1Z=x(6SƷǹQ,Ѣp*X٘{uS} vfV ui0>83RųGOVPgه@*,n+M}O(->N~*n2d7\Kmpi!6hyA\ %yO` 8cfPTΙ(#\-ae}d VpZ(jj2Q⳰$Vc;ƃDI~*Wրїvc h 17Ce/jdDPW!ql 5㶺 ӯWIUԸ!XzG+f(NV(;>\#,i1Ni,t9M7v+5js$jq8}Y!rKܘ MVgtr)n-˺).+)=p}SFu{D$K Y y:1Ȩ,50p{WیFW~:D+*ekIPi{`|3jBoف&Yk~}/,ä7XL&%`\ Ņuy4R)mQח YCq7]W{H`}W[NsN9sQ=aNM ߱yooZ+`FǍ[n^@۲ g%y9U&xϔlb%>YHc佫(ȓ?UP噇?L EWw\%ޡʴ=mV$ퟜ:e- O~5PT~a{xtB?2PJKFD1_Z>i=3+LZT"v:Jk 0b-]t_\Q셮݁8(>]}pwաv] b5$| 9K-ؖ W{%E}[D5) f۠| xDޏ6!eY,n*'Y24K?9xʼn]ryِGdȸAw7_VEr1m%MoBM__Zi[`퇁7JW Fe2LF`c _t殇| mLȾ_G'=Ab^{/I}G g!s랡v|28ډa3P,ϩc#@;^n*>N%[r\*xwA;Ԗ oXTOY.% H?hP)k|u7YkH1RmbH!UBOKU%*eC.aۈnf@ڄQrU"΄ʶ|).[^&8v̥Sϵ+gZaP J2L8gh;kĜއ誣o-ϼvKǺȓ}p{ׂaYȚK'h\ NUcx.=}QݦRC^⟏`>,6/Z/X&<},lեیIl}="`!S@h3ULh/8+Ew_kbΠ ɋ"NFu_܌~?u_3GTF}Y9C@7ho4 Bo˗!7X TK~35We1L 1p ZYq2^wR\{ ptY(|v:$ ߉R "d;4im|~叠6wV%(CֹV{*ǎ ᘕz|i)]+% o((a?ul#2*5Zs_oOIS aZiImH/daf6Txbf᜽۟<nXSDC_bIUb 6k!ae/j]z[qڋ>lAY}}4i$r|>` N%W;ɉ 6t@HYC=-biz|ͧM<>n|kR*c6}\-`!|ޛiem#4ӟ|ZO? r+f9?l䋁,693i)X{v~RW*.p?YW+$|Dbܝ[ % Cq]A1߅(7ۄ3 t0Mo4_&5.ӧ%(M.#hx >J?wN:<+vYaZqLC]-D o{Mz"b;|یǕGbTUuj($K3bhTxS_=үjx;)3_l>o`W|PD99eвb}旮aYGq~5X:G,(P&9GoP*S)pJYO^WjlfFw F vulWT+VԸV< 䜻>^j_](]`(vk ~%'w":88O܍il;K{ .\la4(wT:F_;u{ K^*j~)& |C5߹aDyfኴrrALWxgѰ\{!+ʽ=65 oi5Iĕn<qH9IޚBJ%ȍNe/3v B@ߛձ-^(Դb!<CEj҅b A iis'=I G-,%gUoRL@35.{EYNv 8me _E}#bj4r<魾f:(uH6حjZY=d(8iףia"NR;_;sr `aՎm$:^4tay'jbJuDS2Jm{%25VusOw2RȎ1q"<'JNm K-aY+4G11?m:#3JZ]?4KذX%)A3 DlͪJjW,G̝WNŗaܹ^L$[=82XpMQ$?$@! s ;/a/10Ys3 #ėj5<ѮY֥@} VLϨ*7vqg2}Ȯm8 ̟҇ @ *MyWxd4A,H#䃬`\/кA Lq' I؅:"m`2y Mlwl-Hj^F˜w?jDT"pȕd\L6 i`be'Mn/|R.}f .\ @AK|7ɾ-3EsR=d/d8S.iCS7nMY2__#ɚMc@3ĉ깵A 8iq;̱! |3dƥ&-p:zU;^ʽ,̃tfR)~ 8ˉTX߽:rgѯ@2$] V5jN6>c:,¡]Syzf& EXJ[663C( S}>TUZLKFөNgSQT#)$+k2չ_g$-^@'%nxa-!ZV#$a,az b0okf5gH/SH 3gV )#E|fo{3LQp-.6Ai6׼8"P`m\i;!2m TxZdPtM=v d]@v*at9Vdhu,yB:FH1Uh$p.SWHG TFv|oպRàPe>NQ-.l o 2/7ݣm)IWS) =~ys< O]G~cI\bT$KX4$zkP_t,nJI D]2) Q$@ pĚ7S2&O^j2 -|:U9V`M$ejă !=` %{*ؾMmbA]jba4Unm}f'lXޔLM]U(* iL=w\x/WE/ kwQ5669 A:\DIh7dQBdܫQ\8Y_=?=s lHԷ]x@x,Tu$1 U֎;]*5 W2fߢj$dbS0+k(SK`Ժ(toxQcqw6Gf%Xǁ0ɺD-ӡ2BŖ*evîBP cR/SKFŐp=j]Q-"DƄO ,F]NNϚkt,|T H]0^6Q2 GxnP0#+z 5?Q_pX vC)s7Žl_B@V7i œrv1@*eI uC0ŵ¥EۂѢg~i>lt핥~{"40" df OxnM-"2B%SgNN"qjf5Vkn*+^g۝W?{1p[o\B 8/?=ͻ(;@ ][w(=H%V|J6c "L'_}wx:E z;bĘ]Lc:v{%ygeQ8f/<2GAm<+if _D_6+D5(J$#4Y>rAM}Qglβ\4jhNGDn%ԋ6σWcCZ kݘ+ONM! $a`\T) a[F rM%tJjG u -ۍYߢ h!9zELjø0 w(/>x\3qr:(~-.@Bd-y#ͅLIRͯb܆oSJӪyS8̦ǕaԄ<&}uk[dV!!0֜;cM/p&?r*B=c 0P3 wZpNUBc_`s': rb_i 4ʦ~R"`䣯ZW )8DmvBW#25HcL8p~N%&4&Z1Ll~۶F!Jv$ s& kgI~q_)Mx.j*JG09uok^XJaxbhFxon]J3FZAAU7rVLmsZɘT}Ijw4v}-q!Ndw vўd#Hh ў Ha,@&ݐ+ə$j:ҢIӶ5P5Z1"eVf?5Z`KʥoTP f0[' \Xm h•=Rpaw+3eCHNBNukRnX8V<¾+5ڳG .p+!NݺLբ\5J!26?%[816мx;x6~v.꘺ V<ڞy1ڥi'jוBC|9mpè&D,5&j"FUĶAbޖŭy$Njm'eWk-a7*JH*(HM ^璉<-_kN05BJ<)3&^ 2q?5 iL;K.$4sF#`>*%q5Dk9vJWll'}»&nnBsPax "%GU~$mur1 쐽{`Ӈ9F#hҨ.٣O|DdZ1;~g-_ ٘G${d&-g䫇W V0l o`>SRoPԆ?&)^oRtūPJ[akѧeY&)6c c @ c>;Wf4A5g\~ZyI]lS/ QsJLXX6v&m = [˜`bGANPfF9Gj>kRUp.VeѢoRaR`4;$(%.o GB5xADj*3<@t};`!άfP P\TgUB'&-Itfrd~GΘ]T۶>P?=0CApY2IQŭٻ@NFX:i̲u7RB{lDE$Z 49G!ʽBQwA!F;Ce4oʑCL}I.V/m/<[]s&8"@Cw;Dt&zd$DP]4ϲe K6ZuG_0mz]`qpݑ(9Fй8ёd6\|+۶^vHzƌ}M(+d/;ai D UzK]w{MD} Ӂ6zJ5VK LL aA:`23%RWnI( ;N`*\5S A:E{@7^R I1Ǚ9l1d_ĪRk 7c?P7:tYp DYG"P蹱<FO?E| KXol#%^=m ژ$ivKO'xoqWYlmV?lm6үQԐSoft2ߡ4aLCtai /#ۚÎ{/jlf:x &F ݴ\(CV{ AW\NEPrHI`t:eU5?k^[olZ[)a(uFJ'o/t1ٺlad$nD/emm4 XE霩0p=7$!t*>0\&J 9b$~R"άِO*m+~]?A\ߎNLHG:4Q>ѢH / EM|ʏ ^]'C̲SZ LtF7vj9lRW z;e?=hOܼ#^D p+B!Nβlj7>gժIlrҔg?Qז 7Sqэ3#.JԇmWeQM 1W9$~%J2eyɵl1zP#ޕw.BgQka 'ۧ;qB˵ER7;C1D6l3n2q5, +tG bD\V#6s7- R5_+&NY1"uii_u`AnRMQK,  >GpZTO:]  M+Ծ5dY)9(Tx3/kס 'S jWN6`$Տ֎FQ92A_:ΰS lyq b$LEn>wLݺVFcnB=4fX+<ʽPѤ+hmVʗ)O`> ȐmO ۣ؜ `&Ă嚫zi í%ƑDUhЯa{`ܲT&X ݋'Ot 4b-lB+sx+-ּJuh0?X}+1(Q7"Ԑ $(dq6cyʙCwM14SLըXOe(У=^7D7c2Ho;JA3FM~6Mޖ|tvRENSٰ~ɯ6"hkvb;vF)ħPO3gbT5SE08FN&JVkNB$bc]e?N^]9"!)QL<&xJlLhߌiO@$`T(DSm*@2)єiΤHb엽Yp}샤VnFϡ QpXDŽAkL=q>-Jup Uˁ6<` q V,arL!:@SA`@,SNK~ y$| {#:uۼW-x$ dO(܍BQ;utΣ1p`SEFʜX:JZ f襤@BȨsLsCߦZ;.[w-1cׅ^!2BPlqi6N9>>^Ե()#ͦs: C6jݗw q8!\! c&hFL9~K0ދt DjLXb-#FSM]>d` t}Tc  e~wJ(xYNK>_f\1UL1"T <'%/lo6ifp~t4ަ4UWH]&fՁytC4A@[0Z6#gJR@ ]!?%e(xV )kaګ# /!:fƑ փ5QyݴNu2@pͮBD񥰀}<)tk#s,t ]ITbPU =comRV)X0][w+|G'1JElR\|V#IΖo"*l'|s`#O<zGUp}T0\uPGa#s[ԨXM}4!XJFp lY8bBf2cxs@Qq7"@6]jNU fԈĨ:8`Q3n3X Q.Ɨל~MaMu+]'¿ߘk}yĭ[O'#$k|$A[dń! Q< TƦ3'Ol …+UN-ā,d߷ZWE;UA1mXʗ,mwM‘_X"@2ͿZ);-à/oطK/;LIA< ~}ZE 1a5)U:!o'ӾYtbIFg+SQ;:yc{ n79]E>tJ3Yh_Whz{~jUY.跩pq )«U=l.t*D ; 2w3HMg F]\)x( |Xy֤7)-Er㧈z9.x]D~BVӦb!ܵTe[tw4=)߃ED%¶ 'n/!x&r T0~fxE|K܍<][Cܴ2QZU2=i HlMn۰~.I0Fס 8%#<|K{<$v=ywHcż"` zl^J.), DzbN0sPf<B39C(I(<^m:q:xwImsKCvj& ɣ1uO5ICޤZ(g'?W3rl7OOy؍gdB(,_{; j x5.,2r{ aOhX\R^sv%hFNz;h'4ҿ6)jM䘔]=#B1g/IM4pM@XX]ѷ͓ 8Iud,*ZLuGd9H Dz~ O MJ.n6?>|484]ps\d MQACw}%)TGC1mO FUsxERϿ_gGG 3$̜b~ 2uy 5/ԪjDLAfXLP,bVT(b}N1`Ц4OfiүaxBr~EMP!g_K7q_#p3ڥ]-duȫcf,bk}$M@QNTyPa`Zt&Sf/8*=sf1o>1_ ab 8Q7!rFj3u}'\99l@4<%>JL'EpQ0/~tϴćI7 E^wϏs`B54~a$Re#ExJrXE3g!^"G5IJ:3;<aVDgbS!`X4@I5EQuʜ{@E'a%l4'?!FАxs+f$]%}Ơ@LgI 3t&7Y0%"Np1vad89PtU1Nkfѝ2aZc'-Ob8y۠ś:OK*&v{V]9=rCzrͪ> ^1+~sQ'ܸs.hc ɰeBW;> p(mvs.rlE꧓Z(J#[g[+8CcJslb Z}ZVrV@'%t/$|=椘Ү~R2&G ksЃDYn'o8 Kq&@ZG eO0V^!?8Ǘgdցڞ4zh] NX#4buh{.=j*'/2W4gBj&Oh.-^OR]`]"F[h9n,'ثhWv0Yr Cؠ ]f0\-p)jLCÊ8eW**ߪ)ϒ7 ^ 9 B O,i՛RW^%}fGºDQaJ!]zWօx\KI?4 >~^x1*YAoϏTg!b)ukGx3:|rѷQP5ޞm_:2/1UYZn-o6I"OA"/cBZjr8#2:w֢)NP}1}/jEb؈uGaBF`sޑ^2б9/BmN"+vn͘M+T'+|!JԤTrI)%Xt@?YdJC,,2ӷTFcmQ@Y ࡳ!E[ G`~>YfآlB٩ȾdJ9{k">$g F JNXzO|{#sWPfV/0ёC9[)C M!Q5j4qWH' |Vp5 .J:ii+J[=CujZLr=aF]TBA%B'ZN "p6\X +>`0ww|tW(PC vB K2/j}z00[~].Cta>sw%^];QR\`AN^fx( E`aGr P(h=sN4;ΖVC\ C;6As!pOwxo]G1r+~fqޕg8ls_p`rX;J,ڹ|13oN5,7GrlL룶 q(d S7£XZE_c62׭dQtNujc:k- d'9CPqdk:-.@*q+Rp^bd4$6pe*wÚU~H+I_\4&9' 2BOF"}1瘈pue gSJinSˮw{]12|& \Ddb&8KTHׇH?n=񼰸i#v`H)*KƗE֩7mE2i(ͅXhg>D+(M4 Ar엢@'ocR&k=il#seɇxYǵ UqM|QÒRi_uF;FPX6>.T2 +n7I s uB T5/VgX$U2; qd#ϋUY,ߪ?αҭ`6o'V!^ğ9CΜ?R׃TL8giP<`j&蕭V7,E I٥k$KY8LSJE&߫ JoN'´4`j˪[|cㆿ./[Չx >~͕;RDnTA5s9;\&N{ʙV!]!TN5oj2Uu'S'-*ᢏa嶸\WwPP@ YǍd;7ӺM ;UmW?f&#ڱ.`4봑5~fcjEͳ6Iso٬w ͍s82VTUmU0j I϶aiZqr2~Gͳ}`C-?[6!t9W?Д*<K!ʺxIe:!BPiSkB~=)e Bj4̊Ubz2n3{YSߗYqh4At3sXX$>1}-T 5x]} 8fv&01mɭ^L;j@A!j [mtP_o/6xދ wLjB[6`92b 7 +ZI:j6&mЅeIu r{Ys}C >Oi~2H7[/(`KAڶ`wQW"Y7кù[)gx6-.n43"8s6e¾ȷ,j"0TWʚ[fֵd+TC@,O?DP]EwWlYMh'CCA¼Of2na r¤9LJ0DQ7fmnga}L])IxLS]5xxwXBd-c3EOa,s`D4eL?y,B? d+|fw@4^s GYJuoi)|D =Wi]?olD7c,ꎰqdOR--&w-],a5E(Tт֌@ABYG"O5p^;>: Z_Sg)j#eyy} 8wrdg7;X=EdUI}p,U2qxh9qɭE(nda;Cr*vbCCM< }u }|AlIA5j#պ:Զ w&T1~,6pȳo?zu؜-a$ =]M}C*oxC],|X{ESAjxB7/x,a3 ! ;8R/ Zz93✸^6ٰβtRcm jtM\6\㢏$!LH3C0w߶؈P!!K׷fp1Eu;DP$; p]oD2e`4vrYRs/؟aMQ !KfO] *DQCǑA*{)GP-s^6@{bdr39pKCwL"lx+ qu!P{JMsl ?td'AɮxrZ'=#–{Fo3}}\eeX="E1^//bUna!gɫ h)@#[ǕY[! sn=`=dA6blO@Wԍ!W43[S~("]c:]uI%b/ hz,I:]>sb~RʀKJZ~͠a2l~-KNQ=:CԹ $ M!¼Z 4һ$# ?;s&nS OrIgգݙ47ʳn$\[Dh}}]5x?^yY3>ѷT{AUf$M; x7bg70%OvN<<9%I,>&ZmkRY9uz D'LY> "ReCI4V1c#|),MxAT R3 l_a'0Yn(R2@(Y<@QZZkO2e.CX5mW^"ɉfg) sVaff LӲ.::9͐%h1nt5pUQtWhn .89_5TL4kݲj]N1kFʾIAm38:5%`e>b_WO,rK[?wv$-G Q6!L|igTbP,ѳFgmD/˕x \^e*oc.a&@ԳƨX9pR F{ώf|go) Ou Zz{% # }Jr]{FDeuZ eLCMƼPyd_vev[AtRl5x{dc(~"7o?[}o*/.Iw^X)3B~,̹uH!3/T?+v42ch)C/]J.]mQWZiECz=ѐ3x5eSgpb찝K5W8"ӆD;hf0x#By kV6(1Z_pQ˹y\uWp8SޒihJt3L$R/IJvrXx 9 :ͩ h"Z!AOQZ͒THY=&!=т@ou6zԩքWg,I@ !)s{hU\ P u04#>ZL`~pD¸UQ3=j2.g$_0/z?DO(e'!ռ^wduAK@2>ccZCۧw3F(tͮeKBk:-^E&(9)-JTԿ^52{KClà>=4^#27IJ{#AXQU#')-2;9o@ N"s&'\ڳ#N"oݷ5$:KPxh}[ZAT>+aEÉϤNr׬PY34r-g&BtC(^!6dglh_췭ach6x MO'1DN7aّw_ ^ J-?t{X%VlSC+FS!cziE-_ ]u꿱mWHe^T DojUqp4z " !:D ȭ'H(V#4EEncq†VxKPx  `"ax4~8H5tq=o)ea[0yc̆FN`Gb]ӒE$'P%D>囼h[iމ eGB",2ň+W|&H {/| M^wЕ#Hqނc =d&䤠,2A) S00eua"SPF#@܅Ut oǜS_{bfpm)Y]bYh4 C>y{uBϨ|I‘@@mΠÓvR''V1$|VEdՄqaBG$J\(͕;Kt 4bz!cK. O&Zqޒt\ \rf;3w!' {'l[KZӦej2,/za+4Jat(Lu/’r)Ku 2Eh }x\ ۙ#NŽ$ S}9M_71$O-JK5f [[tF=6BERƅ[>}/ X.I 4U?]m,;A=*y1$A[BYL A yߐ0el3+uɇ;\#kJq#<~N@q$Sߌž E ͝~,>J_(>=EavqwPik;/֡WՀA%&hFŽmF[\%N}9l[IdЛ/_y*;G;.zb8.)}0:Jʈ;i$sAq]@"މxozA}>#  &$WNQ)n%_͔^,,`i_^,6/JYe _LjNip)Fj[;r>>QTNvQHg3dsN,$\ ;^ZhaeE'QE(t3,O%^ UY)8+6+``B_ $ 0.ov;(AP?󶟉aa%BTIa}]9F"̽⮤De8IZ+-hXjC!97eܤl˜ROds*u(ޚ Եry(cKxi Tsޝ\SK홄eرX!x)SU]o%˾oG֠ԎjWxzh0Zs}]/c^h{7yʨ ^9b".Cq#YOWOfx=UMYCrİC40l NI-~|EC&NfA#w>;*XV7-Lp[nA\͒|WʻfB8\/k&YF}+&>؍ $J$5^(ƹ%)%كOBbKKN1|I{e̖*Jq}JoB`bE4|xm|.7ބ:` ovh؍"`O%lm/9@;a]0A jWnޗI@8=A㠎AΡ<-u<̅G[DZjWH擺"p8NVs f竢U;@Tl8,&^ypG?!kUrk8`}C'4iTD#)\뻣ZVS]l*@:F-&JHq@\\-B9jkìj'9ą$AP A_EDxA9wz6N/[O[7L+vڒCx` t°S@<(5(,7^:eDBKh;@߻H)Ӄ->(rO [mo t7Mp0j$\6{uiZոT{P~A]DyΪu$B‰n|=\w<:0ÃFªݢsK!oJ`lm\ 3ZX10 GJAᷪe )Fن 0I-e~S0v";Nkߘ}f>;b}0]W]µÄFhn+ .ЧgAEWC25FF'L n9Ůh%iE y\P LS##r_,Жn:/ۧOm:X"Oc׷(EIF~:" ~V:CMNUYgy㒿Н} *7cWw{b)Erx~<(Q61FD$3V\+eh/.*.<s Y%ߺ<kKgs2لf}`d@2, Ok+hyq7қ̐^љ(iGLxۻ[ .5jXEqfmoM>qHat_BUnx^}xX_.z aBtFz҉7}8ū .\@xn8I3Bh.%9md!:ʖePI_\I2oL T/Oy͡J ݹ/9akh1EW=y4xVdx _v7N67R,)ߢ>j\/n@|4`}U8}jK4>?lQn!{s=xsK)I};ż>&GQUŤBN 垷7dik9qBu).4fe<ΛK\]6@o`X-DM${%s+%\w-/LSUv(ԖK]V2F';~P9(頪`P L'ikףi%Cp뾝`:F)c׊= >}ݚZ՟ǁ!>?>#BN7ZEo Lvj3SnTMTLSdxUxս>Jף_&&xAlD=Y_kaKBg\WzZ7Bq4UKY|RJ $:ۭS _Dqf p R9aҊo:px78;`أBfN bʱ)`Jf+@rfZ=XgʀEK#H?kx,O`rWV:,2ocoC[3LTÏGI0qy3d-[u3Y?G Mju{Q-3$mZ^(9/&Kt>ĕH*!/l 7̽BNxwMM'(M!ֻ]aRlQMl( X6M/]XQދ[&ǹĦ@LuGH% 2uSJEhKt>O$ J(tX `W.<;bz yrOv(N<rtӆAt[|-7T&"q>~$QJ Q͋㜩o#΁MƚCd%.REK۫*i_€R~ ;|K)q=WPB4aJ"ɵ !q4Yx0&*A󚫄J^f./_HA)!IvGUun.0¶PEnM@ߚJCHRdtt#vzjd \<zx.!zWURo8kE6>ѶV=IOa0QA#[Fj):~/*D BSmb{IU@/;pSj[-#&{n>~m C$[=|aey5Jwr2={c5tb^ga:GI(4&rNs#JG?(c6Dszk\3ča bf7&4̰s7lsEUoF$n2٠nO fωW [9w*p= vnDo`#DXRύiRPcaf H1ҳ6<3D: rTs(dгdlq6qvo?Wi9Bg9e2=sMjշoch! \uuEx1úϬ(ˀ̭ӢGm{JyE5nC0(&i%Y99*ifޡѻ)<'ta>mMols?w'ꑷVg b,f0щi{PׅWI֑@HU*\Va?s*!@,j&o^Sʣ 6$]ӹg]<7 {Q>#(zӋߖ,>&#G2oi,+OSeӷ9}͒Z;vd=J#M'9p .m 0t olFX;'h[PĢ:!:38Ôn\-'dQ=Ņ~wڿ5"-QևϹe*`hxcʞjN:D>{MU\E&.P,m#ww6Yɦbai@P~S ߆$ȐU!`}<2%Qn\tLtiSSr, -^ C>w q;lKWgآj8׀F'޲S $ ,)( nJ,ɟHhh|JO;\^il{iKEa[u]Gq ^&PtLU)UK[R^|%fM2U3srf GY˅llOkKs^xB>0H0yEyOIUsBIĚU!$>w%d#yÁ`oĻzphU2$bpߩ.>0+&1x{ '`_a*d&=ჟ˰I y C|Vn9]kt nm:X,kopnwPw U?{z?f"Z %fEu=oJ>; 1_9dύA>a,"ùMT7D0mDcLM%-Oj߾-mÇnʽ;`yorKbЗ@3_i\-mՠ%ZT^rFr$c؛!%O3 uiPoτoX4RDj>>ngXx j Y ϛ .pz W}̋T8EpC=i!2[D\eLn,jy}jN1+ FȯcI!&w2-]LOGKDn詓8=ѭ_OL: v:lbmk[˝7=wP>U(G31%֮o Ee4n&?H^ _qFa\Y3\#|JYT?up9IxvAC3yj۩1LP:! uq52 ̼t4e-<T.@Ss-^wlh1EZW73' .>(ME2E:> z")aBw,en.,A9ćrQRJb g S,H*c&r-qcX뾛ƅyrNȻrJyD @?J)8 P 7O9)vc~)6nq jX /oKd<<#:pQe6v&Қ6+:h]\1W~Y: A PLer oVU*D]̮|u%8ԗ0Pā;׶䥧d ) 5k I#uO|4Ps]ċ^pt˲g.\HDcjBNLHɺ.XH'}R_qhGVƵ ,x  !!Bja!ZXs9*Bz7sF໨(SK|c^t taY#ܕPM=Y0рaQ 'EY(/3#ll뮆}ե ( a75&9_2_C3b %a_76m^c z%[MFe1/s]7^=~ 4AP 3G[ 8,wvh0fe f8zmʁL1@ԯm:J4)uZҾ7q`7ADaIOYӏ#ucocQ,J6MO3-Qm,*9ޠ7o44!>SFvß_v ,S KtD{B@Zk)_ &J)!@<jNek^ w5\iAKB`]+ӱ$g n)Cji0n)t> dɖYN(hJ̀LJ E 6P_zI+تaUFo,7>yI{ޥ{iͳG ZuzAkKÕ펠n,yLhOsO&^ŠLse*[ B=~IKS1 nҦZ(nt%˓X-{=ݘЊ}̬Cy} 2~E՛/wib^6OWy̘q<6/@qnRlT-΢noxuC|!6I9g4%?uMWnϱne[q4MeV|i_A%.&9\-*olSkϥg6K83-l=Њ.GɎr-q2BK C[5H@aɯ?39F@:Tb.?[3̏fAh:.#Mf 1֕=UpGzǨ}AŢaٷw.~sʋ՘bǴ03Ak7fms ?pm_;}zͽ¬cLo0C¤= r@6+oa%Dl\GA{lNB jj#%zk㰦οHcri[< jϧ;l/O&BCU@t>)b\vo(@)VϜA›vClaiRG|Wŀg[z[#ng }CѰQ [ѝ ۂ(Kdr zrFD{xjgE-~jx`*RءEsBg %~?悏ՁqlMSY![3Q ~j/ *2>C#;uB]5flAǤ$(9[ B<7 ~T%/J2qȱ_{Dž-[~bgFj@x+”O30(@.:¥̂Vըd~\; "ks}RZN^~ij@F0XE{%zTDzsk=ۦV-웲\1)4 PfA ޙol_Tقkd^AwU{Z˽lfSN#2Rur@s$*򟩉L&,s+ @TnGyX[A=Y)h;6Q@?gbv0}AQ NvAw5IxƏ5J"Ab`MVg1 ;[>ugNx.qF3;s::K/m* 8d|W0aBǶhՃ+ZkVqTV`~|nǶ(Y/ l#jKoOjKN֢!zx8 =믩Ž%B%+ڀ)Z5pw{n ?,x"5 ,n#w N9|xuQ_Ҫ.i-lckS6Y]OF TCH%PIIxeZ)Tm.KvciH԰"nY߃(Lć*H D(Cʉ]%'(=8TA$АM1l[ <@io]\~g+˔"0mUo šl2KbHzkh凥(s:, GHY-jbytN? IIx\D vmu ґ6@@ {p`|:&%hPiIoBMrCRᐢ7U-hN>Y!TkB-{XЩOZbH|2Co6u_ˠZjN{L҆Jd_[D"Lq.Ŭuͨ -!.v@*=i ܖ)w .d1qX-8@u?V+E5e0=F^SVv͔[_Q,$V ]R_aM]T?Y0A,x⛄Gei* $7ʡ j䉊☧ZJ ?9 =0 BSdXW4- Vcn5N5t*:ʲ6WyA,G{(}Q 3ATXmqbڌ x|_ JDtZ\İ~Lj.`8ec#~M]K\8/!Y8:O-ޑS4Z$ NM ϻue!¦vN0+m#[ [Ur ʅOK˲.78 {KtYtnT6 mP%ϵ!,2" !렭 Vk1W]!n4Qd.d (F0.FU+w|ѺĴ8 ,]`Ap^cq۩̍^UQ$ױqT;ʁNB\~]zqATUBO.AǤFW<*jN&) cy\ڸ*=0/GF1EV=Vu{$ށ)?+[m7<޹ WoeD|Yțg2*1uK h i!+u׃ON$ \b"X!/NnixyIZ?ESkKpM,7]1d_ݟv_ra~VqUY'^Xlu@\xȕk從=Δȸ,W 4 4D;2U$G06}m^T\REЯnH0R.RFgWOSW`|+mCmg"Q6rb[ iԿL/<=RVaU[us>X3JYo4.EFl!X$*7;ww:4T^&2P [`2 ^#\/l!,Pou&|*3ɛy޷sȻ`Ubh厡? VR\(^ G"|Qʘ/3-3РH3M;rwFP.c _~*4,[va`CXɉڙ$bxQk`ǁXth?\6Mn8ᔗ:ҙs{>7nMr^[dԱɻ,6(1D;C@eI{]7E@e⋖FX>*R jRB:WoZ%>b =@k1κ}':uU# MjB>' f+̸VS[՟L0r7ɽ3A~Q0-q!r7ӊ{ E0RWIINC qfz^Xb}r) a%rP >MpDtgle@ XX\.] 6KAQ|AςfQp`sǜ'|1bj'iDj-{!•yS^RSh<;AWYk vqB)K\Hp<zfQ_&BEIh5tbd[?UR#,@c9~Cl Q5К!zVvia/(M؁&"-*n 2 3x1< x``"xd~:}|߾ԱA&5-UI>(Qryn5N[/#5rR1^io~7ШT #ˠYF9jQ>țԽgE7)Ebo:M;Qޒkj⢋M%05oCۻu2_&yVk]2haGG\df$Nك~]ƃu H [Jp9j| c*%bXEj6ޙOd.q1eRH~ IrC&e D–D?:Y 'SVl^﹄2wj1bm?/BjXm50k)Mx4yaaXQ?chh=Zk֌v4 x wݿR0%.#Rʧ]q;~=DF4Xƣxxs|T[ mdjzQUƇw%-(V-2}AqhXJ3YzڋXNy:*BOUfG$LsL 4w\ZiEn-u3cRɳݮXF68P:Z4ܵWqZ᎐БSwd{6!T_/l v|̓!AU r_W"Qd vǑ"19sQ0WRΟWZEэmj4VݕQTڇ>ݾ89;YY4fau=}m, "# $Sy1o,r䘲pVe&Ao5#ıFa=HI+#9o{ Rz A'ȣ: #}QC3?+D^٭T܆#xVG+Lcl=M.N{+]}> ,zB~K+$t"-L"Qwe3-qs!p!Mdޅtр | ~~c`uzu(]'#>>ܴۋQvG޸H~з>8>.Z) ƣ|,OS5vo ߓ%ubϱLtkQ\hd`w8udHĦ{ҙHk >ǺyV(@۸rZX-'*6v.<=Yn:, (CA&Dұ,e6y6b#x2]-!JvkR{P^ǬޖX}_r$!AoP~ٵ$q@_2nIRٺLJtXPHA?CvK5hczȦ\mb37 _|Ϩ=rtKײoM̽]'[.w#QAr/~bHа^L4*; tרg6j(p ݞSU()z)F-L2xf8d#5$*1PVRjOc#@ulf_̞fk&Е+PijvvIuch#qi!*>D&@O1VFP$K`HpK=E8m3H;K¿bhDkX,)”e[[Ӿ צ6;rNL>iܜo>bBpS1))ưdOixvGӥv\yR +WJ`A򯛔 ۅudֿ0j*QEc]gB;Gh #Ic7}6*R~/KBRp}a峎O/Y,M ^.B2 IDK@|bU~5f8D`.߆t '!ێ;Hňbiڑ*tݑYY!#uqkNb|@6r[ٕ7Nco3)fƥ̛*pkpU8.e+8];YBS6G˽r fc5} woz&d"34#% -Vl?\Yo 1v9>+ O% w3yti n0{#ǐ? ѩ{H4 :U[}<ӵ/V {ffkk|Wˇ/_cR<*\oaFfbr b]T %)TF/_gɩ4K bL&RK0ig+uSủϹX0.^?bRX⼸ (;^ȝjBPTOuBO7E<|ݸ ?;VTČ+gPYZ=]wH' >#R4Ƶ%zddk | OT?z8w=2ۭH#VIn8%T Vevi8yr?-V#ptգ ӵYJ#:u=R6c"Hn8Vq^1}wPMgGd׼xՔg0K|@# 7frO/iH ] Gn!q}j?d4u>jFL77Uv3@:Œ]Јsj/u Ov&1d*Aցd [$KWNwy<Vb>? TZ^RyhDڀb $mOlcD~ kNTzG :>KE `_1VgA={)LHdJ?:x8f܆Z9R^LMf֤.iaK JK!3d:ޒB*W/( lv2)QH7O.U(p 7G;CGnP0g㺧Jv0SŽ .6x6xiҎp[SU*ߥ:s qIo$̈́N\ -3Mls",3  Wz2_ԆWɁs N[R$BhVCe @Ц(_H*hF/@(t<{i:XoB܏!9C==!AASvc# |}T ~FB+@[(G`bgx`z|B}jtU% nCp1grA))~R:b<1!\N5vy=ql@^jx-aAnmlIa 0 PDz;KDb㫽6[ r&B"zd/1kʆȧ뚍߇wqJ]k=]Z*&l\;mx`H&vr6%Ŏ 74}NǗQW(22&4/9d2QVITL rs\^]stݿPh89Ɂ⟫:d.,q^2c`KCx.W!aז6[Wcj&_Ω⓽DY6_УMr/ XIzhche{W|rbh@ʈߣhA|H hKW-nL+ص݀"oW)KI5zδt+:$ܯG~ew18＞`:Jܑj5a&Nd,bSZoωegg*0H%ݥ|Ib c 査Ùa%MKPьjvq诮DD*6v+?*{ܽzӧ_n@~Pgng)׆Όd0# y^@`}Dւ>l-/ċnqs+*a!n>HG!XYmъn b0D`A9] yBUix\ZHL%|񼌬 ", ȃ\$ GVM? ss-l/j/BkZѸ%De5荱-`Z )ꀜ{&rI;?ȗT[iz#`E(ZJ:򣃯oة2-4'U] ~ejcJyw1L:]ߴ0t#e2B@ˊqנEt'!#!>VwG+cAM2.Fӥ9qPr#~T+^1:ن$ƱfԿO7r¼5>c;RDIzY™}VFHd++ߜԠ{.hjxD>jSĸWbֶ ## E?W<Es5UGώoY-Gl4kOvބl5!.t{ i5T0[ܼm-xG#;+T?$yW }@.&L|Bieg9U.5D<&‰شvz616gL.28ڈ H>iHR( ΢c]{5i7l(D6GmW7wiA+::ss_Bxԁ )̝4띸+ O>_?dO5щg(WضQL* a+(e=I9Ho0}sѦpf%AnHE+OH|\M9xq wѓgC H@߀[ ^q<>7ID_5 2L+`AuJ.'=Q4ɧ_Ug)S =tP R3a]pbiwXrX{Sb!z{hRAE F:+l:eQAfh^v؇キgL;&9N0dپk+uQw<%cvt~|M7U>F]6$MHD$1 4Xw.:|xW?n'/qzU/4'.UXe0D J^ݹݥ͕P:N]e_0-CTE&i8Pk '3iu]\9ٯSKq5Hp9G K&mïi ShE+a0vZq)n 79VWB l*b}iU EDd GڠY `!nkT+I0Õ%~{OR2MNޢDž:4w )\&oZYPJ%历8eOdB\|̢ۧtÖ4gk8f_ⴽ}R$4y/)Ei0͒Rdcɵ?/j7F{۹XͮkõsHlIRGk-P>. Noy>{,[nyV>[g񥹣I)W0&p" %cAEsgupz s}K[ 9Uʱ)B$(̮J"ba8*m̧jr`׭6,|qYE9f6ǕHN~E;2|r~ oEꪽ9|:{a#q:~(;=(sz?'@h\/;<ꮑyKQ&+38{^o!ԗ|Dfkityǿ!#hbn~ 'y]@iJ߆'=ty*`Fp& 6g!$ҡ?.fo;rzgEsV#nS%U~x58h@ 1WfY{oVۯWxΫD:q |t/Lr_ـ \SQ#&H]ɇT_ sgZzlh̚5 &ƌ<# ҟ^Kd7;/#? $2Ɋ@ ?W|V"֜iG){9B[VqֱTӍFo{ !&M{)'EFgVfG$=XGm47}_A )u #h.|WPkV63r$-E7iO1ȃrڛC%$4>ţn+)HV3΢hinl+S)r{.t3;,ܫeЦ%(H4,@ B~fEh?Y2VYjyliQv\j"6ZӪ61 Иx"~>#H{Ѣ"*Q]q:R-%"J^#nW x .@$ k5ɗym\= g5 zLƈ_ʪFڱ6Trk0бz^C!avȋT}

)AP-tzIf(Ft$~ie(B 5:kN݈#+in^9~s[]p3<)}=:߰ !˜zKrhJlJy QNb(ג۶G mL)م$?ICzӓ}$M$B4~d C.К2 uImXHW{2&*?5mY̜!}<0O8}=]2!wޅ@N|D5;xd!/±Cjd[ΌeLsTgd -S@Iv}1=Ԛު&23wG,O OđfHgD39x+ӍLC-^h MĞqAq>C6}_"=2Tpa}7TwAȟ{tb:0R+V^+߰{v^募Il|)[0)(y\/4޽eʻ&0O[1j"3K1g=F-3jD!NWV=Wt~g ) ɀTmuJpà*tAevJ}M&/%w p%./ʦdJJngvP~Y &I^<$V@CϹ:ŔO_=fbdEFr|;{<lc(WGA}؛%RὔDrTm"(0;˜\(DcCGC/!L|BKyI}egv}!޾OSGżJs ȾnvΨd"jߛK!Ya"; eVe?=ߨ!o=I]R<)0xhth.AH8{SiR$/,A G"Ϭ1RotwS|?xQHYOTZc7]= Rν f Oa刮x>E ܚ#m_R2޵N}5y;PGEuBםP~q23_Mϴ&W1fkjԯxxd 쪄LK+WeϘ8M%}e1M\3K0mYZ@f %KP_:4]}u8'Hp0:fJJLTf&Yq55{]pRP,UL[I:O.q .SxҎ;Wa|r3GJD-[mqw`eaQG {0#4wzq04YPLu?{TƖeqn`Y*ɯ3c7̰n0mPpXXS4`h*~xd« ÙU$uZ76S9`Vi6aQz/Iu=v\ޯ\O%8uq15ZRP_cd7oUcG36/ٛIZ'J Gh"Bt`4,;:I\Cx̜H|%2kߓYc7&cڏ`ITgU|%Q(q8: 7᫤2?.L$HSbC s j7; HUy>@gve6qٲVk)m+e\ U|4-Fc*=]HeL w Z_[ffDwXt莍t͔osDE@YH34?<ɴ_~E4:r$"-+= x@iKYPn6qHᚗI]y{vp&a-No"xJ]V4ܳZ#zg;i]ܼ+%>soҏ/+,lښף~EsIz`YUt%mqe|"+.׾dŗI !uE>|hzoh|*,m)Ѥ˲N)K>*ͤ fC ([S$fthwRUeUj_a'U׸YI;^q' ٥ =gθT_J]\Dq7O5GL8DrENwV""̌eME!()C# %-0U:0Im\1&ɜcnٰ e08t,pn8":hE4`e~|4trv馫b}AÈ,8e<ܛ~>yWca#_1Ldb?'G'oa}gE%\XaىU (=Y7%d:1N@,!x$BaUzWWvQ[;5s ˢgAPS' *zߔ ʜB OUI*\2Σ63x8ND L|坳B}snƗTqXv`sq]:a&x}NPjjhzՓF%Y6|CT-XZ)įa*|k7NJ<ڑv}!BGEUTe,@)"+:~`] UIj~˸1qJHkDEaSV{aMC$>Bs3x{Z-/F`ؠ7ƧJ^F٨N0TYG+K Wd2ci=PwۀؤLB'xT I‘'teqQL&fn]uZp!EsqڄeE+a(|UZ ,Wg %y-:g%_]:װJ3ǰp[۝24. @kk6XgzuS:2OfC p֧.>2q{b\x_ſ1 {^'|?cZlmk-JO>^eKg"CwT,2 r)˂O"T-[_z1@ H֖*JIHd j; >װܠEdZ,:w 6;Iߦw ,Sw֢ƅAgRaʘ.tlK1{!ʴ<XpL}2WWv.{xپH[yb(h/¹PV.O?]w{ C̪]9N}Bzk"`\] i`ҕR^uٚ_#ij7XR\ m67Oݤeȝi M? ԪBW"W Ϝe^r^<Ѕ=5|F]IyLB)}elX&t|6MG,*'65M7^k;hGy6:1WW?B PnUɿv%r:I%F7J(.Pw,0C?j Yx"46#;x0h2hݮOV?`#\1;8іN7>o+:b@qJG*f \ܥ'̫J\}PfY9"إpD_B"()t5]}{%/[`5>60ŵ#bv dip>N;)No@TTL0$ R (K 'Q RA4sF/JB$?+Pf[lo4gV0pjhQ!H2/QQS0uɿqy R2)jpn\5HXZ!kIpf^=B@ Д0lݴh9c듎!Q68E-l)W>=W H;HQۘkޗt/ԭÍv17tmp[e*b&)uKW@58[;,d5bo?|s<f` v(mO܆(A=Fn:BH W 5.0lUd[ļw6T4$ݸ]vTƨ́8IRAtӨJ VsiZ08l:ܕ@s{jOD<}cA)mqSj_n44M2h%ɼ@ZkdbVOdb&M2]'x ]'BNDO,!TDʉmzgb]^pօE#.=jW `whPޠ0N[+tk͍[@-dbݑGsN0uq7ԥ'\`.Sx*EOVP *k3 dAPv>V7"",Ws G00_)؀sxhf%O4= }s، kc4yr_t~/R\PM:yˀ7seg,nら4*}yZ9O8QJ(9*_}z7Ul><\F'lb*R7- BQ!C(fCWB]R7-uPRXId !簐 a&O=Cl#SIC"C:?nFaG͹^8mp)k3}|{um{uBh{HWRo(NPHP(w7|sitPRsy XPX}+F&C1q 3N ʼYK]D~'P$S7W a8C\jl"h.D͸Pj~ب0h݊ߍ=9!'jТS=" US:׹;VYpOYTB&*mjAwjڨ4f- ?>>Mgd(İg@4hU ^4j@ !uZ)d71Tg S*d]?;\B 1W$7N¯Vdv2مu=>gO:sIEVDTol2C9m/Qj,{E͈4ż,tI+kCɪI4 yC%p ;m6o Tx? jt T3|F~Mxp ba/imQ2 ߓ |x>)1m6=߶Jz6+g9d2Pga:ܷ4;//`۰ SaP"Uf|~ P~j.}n&|* ?|oS(b<\fdMG7et7B\)[Y1JpÞ)`+SJ}G-VQ# š*V4ij(PK9& .wl3"Vr2z}C?c&{4r4ȟ^6ǻȓ@h+{m8pwyRȾFCkLb.p) (iqNx=_i%^tG|.[uх׆cH|#]"&7X#mmr8HbKخ-F_ Rw,xx9Y׫!rWV%o&iI bH]Ӣ6#hLR"aQK#\e|*FYICj6x}Ni`3.tmImǬY1XT \2X;)N#W~^2^x]OϠtp4^T/8 ˷ioMz}ہuvsjUȔgO2jQPe ٮ^|׃KeL,*ZLL$ 9hpSܹ7ӥnC+p':{"02w}IX,%Pza~.-XA:@2IL]3V]]}5 !H JX 8ߛEJzN>? Ԏ@ߴ>mwm+N7U5 C yL7WQ3|t'NA*SI3'䘹P}1tcIe.e:(ʙ\ սr`ڇM5Wfqj8Z%!pKD3ŀI}߀geV,E`wDPfAu>)ݙwG07\ظ/ɍ2c)& fZƯkv09ԧ#aK SxgYd H iRk< WW;f ,< "vw$y].e=C'l+yMS۾jBi>wWYTvT]"n.2|y_tSw>ɄBt82=~ IK#*\nuA{aop:w>2s"n yV )}t 4fCQ#Bq,BŬ6Ínr޻K0,3ET7^F=;cRo 2~L猲Z[p!Yd0m+}V>2+y gDʶ"/"Rڽv}?c=~۷qP"Rj 6G uL諓#|WL+z0c=9$;"vPz].+Gr^JB|7Na0V@|,9U?'`5 5'& 8- +{>[IzuCu].O3SDRoL}SKӟ Gī\=UyifvVEܼr)[8qc`_(YЗ&-}%cP|ϠMQә㜀'G%Rj|̰.uv#_QQ91~StIOPh"Sl1U7|ԪEaװP܅x(WQ!Ihd_9Z rlvE-klaR,ogB-(2h8͏(:e ޖnǟۺ+^ۈU>k-2 {})6XFԸdq&N~DAM{#w/\ܙRSwPsNe5N~s ovpYCmak0DtLYZHԘeW]8 A[1j\]+R俓l"ޑ , IqsG u*'7"#5[1Ĺ'jT;qc+n.˾]9 T)H(Np?Rҁc7/v&BWX8 GOPqVV`DZ+`JܩvSEw\~ټ 9ݑtTT(^7fu)CJ m6S.`;i&\}.ޗ=} g)CU!eƁu|/' t"&p6 [mHTUcB%Rr+Ʀ'yOߪi?F/ۭ_ /.ƾԓg}^bU1/; ߎ2;,)fr)!h7o_탓4zc9:2\+'Kjqchœ 4̦ƦXf%#;J9*@)ee`ԍr,LxTb򡳘bH|>Y! u&*k"Ϧ)Pz;2k>=(zorM8=hщ'<[w 18,>ƙ;N2tBO-l'}2+c-YY-P~uꅝJ8Al~d kT$k:r=]%XOUOW[/OD,2Ώ!y*CsYJ8d vWK^a֒ap*Y aĄ2oD@w+}՗̥{D}{ dávT=FO!Oa@e NM%b=k1ݮrB4:3*[ȪY@A=)7{;ᗽKX5>N3v| uZ n+k"KAE^)׉X p/#TN"v[u) l?pӯ哩^ hJ3F{pq119QX0FIDtX7^ͻDU ̱[iFbr/h^dbVX?{ӿc(X2o9l cawmbM'0;GIr^SB[08,*8ho遞e[TQG]J h09|-n^A88̓%^+DR="v9Rrv +m?Jŧ"^woˁܺ7rB5jpvD$ĝd3Bj.b) cIqk*(#۱>,eoP,k٩d4{%ZuE >H/H hJ+2"mj#͡ڝjXH4ZCHף&:ҋdW 1it uBLug|$}A2bRPuR$\sD(*H+ӯ7r.]BVO|P6RiS+,[af#$#yl4Ff^Pj6:Q}  KQ^]d7O ?FO9F 7 f.h?VlIRerʢ(H]FvQ ڄλaa$Ƨ\ < Dg[>Sl5Y cv9{@ &4{`#ȍ95uuB} բAaBhSY{/Qf݈ߪM>dOAęr2IpOE"? R 6MUQAadwW 2IdPTA5qnx'!hwImܠ&kPȦޖg T{woc8%샯Xvx^ r/]#$:K/ `6ΐ] yZNSvzdMKqNn@ԬVU.NTZVP7xR8m[b 7zυGRnJߺzyc+1?՗OdS9Yol©j,I薜C@EBYdI-vrh 'hk~eHR#Fv:{Y*!'G$_ۢ/ԚͭI5u3gv $7G!vg7ZJ+"6;/FEy0օ_  u\*Y 'U ]r[CINVv:L P\H mmyL %QM\ŷ>{B{0TW̍OoA6 ,{LCw.@RZu(S\I{DX#3[:peVÜG&5¯ ''c"23kҭԉ }7eGLW32gQqhL焺]g*oy#kh8Z"Br&ҢE!0;zPsδ 0z͕ާ$v:`)w;,T)M`[bM(,, q~Ul&P+jD:'Zs,Q_^"32 ϝ'8_ߞ w߹Ri&fՋ}lԖ1N1n .P&)Y ueņhXn N.o3EbNAt6Dm)(?|gE涾Fscc4]Dw:Er޻\r.)GȽR4JE'FEwsr$;{02gX=I%P߄$Yrbv cwaTaudb! XC{Hp`bN:ʒVé }{S ~wgȬ^#W_aF3 * 1]]Nc PeV1A!sLBffK8w5Ji왧\ѩxFHT GT@#C@+VcK֮yYT 97kZPy.dˤfn"_uiJ]:y7đ˷ {uP8bJv0s6}X,g Q a$2qa<ѝ<$S#nv?=iE-p_Z/U<i]_[Or#[{GAH9q I c^\M#*vn*zט 5AN3s:c/lD^ =Gr5 ̺.&s^W(4+civInI\J Fpu5į&ì$5¡J:24&xȄx >L-ēA Se ,]%hd Z˜쭥T4_׻>(rUaRlptЙmډ."}SA,w+\t܉癞Ý9]ȫ0sZR'gV,V&G/ Ō31m_O>ƥROx|.Oɨep7P7MǨʙI|YDI~Kt[^M Iך`zT6@1RSj1i5Ѥ:K(F=+]x/E8R`U/{5?5) zDK%?ot7.W3;YI2@ky0Aq}\#)m} #]*& ln9x\ /.`]ԍ.<]L-uMYzEJ`'0<$}r6|6cΪǁPhdYފzBj)L:+l~7'X3U&FZhݗ-Ĩ-'؂o7ϢQ_Zh_B iȆ_(mkT9'EӃDSy#uwjiIheP)grSa f64%ni*%w$9ܝ%GkbB[l(" yuч$Uݪxm~x$wTk*JJ.쪲u6q2O8>G&} DcSq7;9=gd/PqoF7;oͤKaH fkP#T`h換f<&Jxp7< `Yիȷ>8U WFΪW1:ΛVu ?+iPf9Fއtay6@࠺}aS }9(R8Nyga[,Xj+?$P{ժ V2%yh+9mlCɦ[չV4 }o֐xD8.KFC{ۊ $Fv7V0= 摣)w(S@1jC.y~WC=tڬy-&*hcu*gxZ,z R~ܫ2 ̶Uq4{j1"/Gyq6Ep<\p+'c CjtTayXuf{ﴜ#*γ<纷FɌcǗ&8A!ŏhgj6|ʉq֘U+]OaOL3FA{<ȫ1 q+g_jM% w:SSa=UsYm$_]Kr(lneymE4v0}cEW kL1"Y 2c9cLT5o,h7ZUX x}zQ~:x;.*!d &n#nvEY=9amg%"&"28CP&uKENr v? 6C}"%-uؕw 4hkI5}pFjxr<op"9p5Mg $Bq3i3DRE@@*|xyFXW 7IՌƘH2 w-ׯG~e-|s-vr[VIPex{`qsY$D>k weJqG{, /$쓴"#ɧ5QkSF|e?\]H5 ӏWU5 5JAm$eM!hJuUQ=(z0K ymcXx l0ӹL(`;Qf2Hl~/9=^ AcY:p LB;'P# zv>q/1Gcb4⋑euS3Ⱔ@WZ‰ HuɃ=VL37THZ^zlY7dkto?W`MSfffQ_L_񗒣x{8!n8U尴*i=_J]1.]-IT r}l*46Xp$ :k^{H(0A~qv]B#;PKDrfV]d 90J2c0aq_8A~1 O Y4.LIj/Bp`f$AJЙ$rSZ+)yW‘ % ^S 66d϶4FC)gei Yw0Y,x@k+^p藮!,PhqxM#nxr@u|@~y7%qYCPɜ2/׈ gzKoYϤ:`o|-S]oΝFK~ ~& ],&TbH⛵{DiG<&{ֽ~&g\K$ߑ8hWu&3P>…Np6A].!S:ǵ[%j` TsXrki˘؁gA/f,J{x=$'{:VIPZ[ʯIw9jRIWmriTd߰@0G~ܥipx5زR.]D(QÎ 79gxEMzuYVg|h ̬57#Rs@#vLn4 ˋA3뾣P?.Xk&,./+EZ`(+KHedW]+0$K{@ vٛ$sEŊnm#@9X?u O$Th>6H [mPoMޙH (Xj_n&wXJ@ӄAz0SxF^kF ROA zƠ_Ę%[q;gK9^`=\X}88mȁ񓋯iC"]")ϻ~o(CrbGJnt}Q?$Jy/6)3_vo ߭a_^~^V/Y/t rsJhr]_.%}ܓ'y0}"թ_kZH:,<`^Z |Efë򄒜[%@85t12DBAՠ~G K:~}醆͌a &N[1#mb0̼mY"fe5|{2rv%e {|d8(8bG[7#9J`4K\^ɋK.Ojl :ѹ @|+tHXS+S5JMr' i*bs%ֹ'E·rz881y&]]D "\<#}>Nzj }UϞln->}CX.Z;"E._ #w('y8$Pbډ s03w]eZU` %|KKanڳ=OF2`5lo T'.w F QFI฿qշ,ZXgOn\pA'5/ ѕZ?!4RBLQN[%lZ ig$Awl!( }Y؏12]W 0+:BތQ7 Ж-HRk ~j(1ᅭ#11a SYXGRlrZ53y͏~r_?a4Zw<})Y rx/)ŰIC K Iׁap 8[8"B@RIx[4ݟWo &_W`6eHjAm4n=#WMo3&U NҌe <£eY}u$Z^މB˴MpUoJeWoWBU&ܳǻT8xJH7(?3VbV3H$N8IlbN@̏J šPkձ3<4j3yQ_[ Ų/0EU|#U3?fjj;)}SR 1?֬6!A}gsxLqs{Ef3oRQD*t@1w;vh[ף&S?aҘn]-cV/Tw|t櫅PC'$.$}rlUSaȔ1a&č2Cۃ^-[p:iC!}~`-շ89r 'DL`?R"BsS+%Q~iY;aV!PPCi\mc`+⪬ ;qnyJh8fN(FI!j\FLCdDz0<}_yUP74h+Q+ViʻƒH_x'mЇx&2d4M.LyTÀH,\NVxp*z͐Xߧi]37p+ĞN;h|/ZMckn,M sDVx=iLwUy(Rru |FdH` :cx ǽ"ѯ ̟j\L|L=npr^rGA#̍v6k o&)$oM*HI J4Y0mmLg Ls]t|o6 p?- µX*;$83[p-o~|JJ(pXz ^;X:'nOJ/]2  ;VrFH/恡[9e[?:i Ș}k»D(B ulE>y'شB$tf=(\U\m*9驙b=쇌cX]c/ɠnX=0O,a,0ɇ$uvL>OCᬹEAC[U߃h5dkr9ʸІ>Z3#.~CapB?GF 0YJ6Q!.qK3k` T D7bdI5t ӹÎ# +1ZKkM.$Bs D,cip fQVh6 KH~m DWf؂C4[!w|ŭv/EԨ,A4L70s y $[/gfwHw=V}VAޫoRyL5;-~50]c@9W9 2Ubno֙dAZa3G Ⱦ|ʍ?(,ӷ tG%@"E NF WL@SBT.b>F|#4RuG1ƈfJcs4Ioq0>?g$1n4lNEve_A+GJLNie+G~J!rwt0*sDr85V?$h "z ugrA;8A ڬH’]Gyb֯SQ׿ *ί=KP.S'us'%+?PVZ$Bź5xlpdo3[Pud|Miѓ9o`<}H*7pw2Aގ"̟T:Q3x]4_uD^#u>Qv?n+Nm~}/TSЃx*iw*###kD'̙&~?}W0*$/ElV5Hռt xR~^<~_cFBƈĠv v́Gw嵆C}S1Qm\$BbH 0*.klR뙯JU )H8wtF1h~[OԔ ך#= $cm$v`ި l ){><y /bUñynJ] O䲉_]O6V5Jեx+),'v'8IK bfb'O*oh> T> 2/&31 v)̪&6B-pRPG^'bl7nk.?u?0Ś!xj9e;zt`9&oI&$kB%m9.CG݉&A3s(tK2k$38_}:ނ7ӓdk=>'TU#J[|,HŽ 8a4̦^iαUagAdRyXlU)n\ecmazb |Wd)89- y %-MHt'E#E]@**Rv/4ںb8WC)`V<ڥA.a/'ǟ=z^.ae΂d$Vl!)n9㽧@Wȧz`\\z@^MbO'2L}G˱ҚQsH[o1F@6wFB %"+CGV&P2s$@acXώv`DLAՖB+e  ֪ۂ[/,\B/1uhK<\f&|>*F&1BE_! 6fb~2h00ӨfOJ`[x="±3xa9/~q}C#M4Fi8<>n^}4pR+z:IC&K¯r򄦊a~!} M$/WQÿ0wtD|-T^Z~nP$3W jӑ@8t3Wwz$+7EWneЏ& YET #%Cޠ0C02\I\j Y{&,1?t$xO >73e*_.0bʹϣ;;&;^8EwOO&ӧ^۞SZM/'mC@Fo>hcFkRꕩn iL]uB0 :<7ui+)f3vۄ>\HYz+=sۇuA!`33ҝlnߴiOPDRmzi]50.1@~G(A1!VwH64kǻWc{@crW0}@m>H{FZ=񠺏fk! sKjk{/?vG~/R{S^ajgIOY޼Ȕ;l,F4w+0lY! +iݝѾuO hh $7URJ|J#OD"-;T.+w 9^h$"j^,!K 2͈w 5~oXWӏ~e}/b"7%Nnx 0z߀xn%fi84nhd_B@K0Q%~rM;Jrc(zvkYwe fUǀO>'#< z=m v;TFltӗѣxtm wa@biŻe&IQcR_Jk)hWy/0B{).})ϥ6A.;@+fШ&"B4V7Uد& lgF$Ip(Z%>1Zt͸نdpX5}W ]fq=MZ%V6le/ڊ@s [_ZJK$wD38ύ5&Tl a3kY|IlW m6#z(KH9_9Y.0J/KIWyz l61^6" =:Haʽy,@:-K-rlϔJTc)J:˽Hb_qfsk cիJ_VPM>Η8;^m܋W,qM=-ޞ~ H iLJ_̖ \'ƕ{Ap^.S0~BN1}huҎO+v%Oc\vc3:X1lpW<čkײMyjJlk Y4^/ p%DStTyA vS@kyo_[6B2W MJ-$5N~c`o`uarH"@t=6=GN| ` Τp'%q\/0I0QdGIJef,8u ,h`GbiȈRdNYE2/G!1:&1#@컎=ڜh5Gl7+eSϡɊɏrXZ$SH!AjRr.o;©}9L/䟚ڱVt#{{Mh-+T澠26[@d4]vPBmOu9>mV/~>7:S˞:#O=x8BB!^Z޲H_.Ѳͦp8lktNZcFQ䈁'>x+Jo«Ҝ+׊BISs8CFFeFő(m[p(Wk}G{yB(GNӣ܆Q$A#qWѴ:}ݤHBIRZN8uR!AzASӻdzZWFj lpG ȹ×5"+[' AtF\G9Mrnq,$Qg"gcD\ ]1-n ̒kws3vC4y#,/ 7Di&zEƙR?SI"l^cࠤDŽ_NC\SJ+~?>Wc,yh|I@Q\T$1y`]SFK#0&e,A?/?s*&bFpZy% ;m9o^!4Lh 3E3A `0D0 \1יkNf!c݂=ȅ! +=:(2k[޹E :a#ۿBff-E+0Q#R !wpMyDwERC9[bcyQң 8Ղ!wȧ#v\S(&5*KRwϫt,Xnh2CTh׎ݧ#6#݅ p"DG?.%_ /8∲:B˹"/V Z]5ڈZ+)$/mPJF,ap9oHZ f j/ҥ>&ϋ\+0^OM;\8r;?8(kigD 2sE JkW9&67] q."ßb?$?>S<:Gv ~+}:+Tv(Zڳ$we\i8'.q .7Omy>z:In<{e>>%[k-*d{~?l??UZ"Z΍AG tѼ m{L,(jG`]^̜lluK3h]%h.I4 0%+JF+߫#ޘY)CGC.d:+84o} M`:2r3 (F [W:{^~2RǂoD IDu]7 #KKU-ƦLO|6f= k| D{z96pVpY3u?yb@M2jdSiM/"6Z05ԠƤlR%`Ϳ0S|Ms)nGA];6f:43(x!`̾KNimxkF#QqR2 nKxб_}25) #?[l:/q=!A%<ͽ8;!< oI~?$GkӜ.u5јJD1JRȚz jE>@з2Y;~Fc{ ᓝ9"5!B~wﴢ'UU84s,zr,ohro?N| ,krs+K*=-A}3MIzhFReN}!fցZm_rX LUjo78? jE7hEih@ z#?)b9H91N%x#'(${W<PI8wlVj\$(7"=v"/DޕrJ&ମQu%+Q!9&v`tq4(4q6 l.F/RPya t^|(/unaKB^\l^ٲxWGn‚.NߠֲJXz;l\p?LQ ._M )2$5jd7؏P}-@xR!Ƃ H*1✺RHl޵ a%xVoVQMf۪˒5:YW ~kė:#wV|($'sp"$޷p[= [OrHqH0+sb}qs(Mb-&*R~؝$ u ܁΍-K t3*߫$%ԾX֟2CŽ@(]ae޷' =;OѠ V_qOm2n6B:͌X_xeK誦۝,eMAXoyg;v|C P#U 8Ү?,^='.fwӴWנ(kUqem;}~#)b;KEA%GbaJ]x #h2G5swo\lq,F\?m##~s$ ѓ vñ1>"ĸ0u_2኿z ia. w>N{-j_s  l36BNϞ¾J+Kǹ],x gK/{ۍ`ճa]j@dȴo*]s~Om_!{4 R~:^+[O ܼ2M/yijޟI-?3( Ђݸ#E;4óx4)/#?),'xs/%Ax)Y %8DrU|Ű56Yk Š'SZhK7 VLCO2ˑ`04qM?+Iz <e๡m؞p)Κzoln,['|{+N{jwatI/1OTy PbݚLĖ=ڧ }O:/δ:bva(1}W;4Q;֥ri)kAvs 4[ X6,' Y_>vQ{>_O 'kjԘ%~X mj=+frf>ԭż*ΆNB+6Q1B l/roe L!"F(sx1;S%9ӺBX lLa/i?7E``Ub~F2c_cʿW "*5&/ IsTة_IM{TVD0!(hKTn< ۫J 3@.fvLLLcA\5 :W-GvI/,꼶1 D& Nx~)?.MnHO8أX݉܅}"5&G̃Ip든hʆ-=yuZYہ98hHML2Z9D?{~ЪPr]D 3vk?xcg2!4Z=u1A#y ~ưU蘝죖hMH[%n Bdy2^Vv -2-Z'>T 9`T^I^{+`Kb+z!՝j #M#$G}נ)<AoWЮlNsm{x9Zb \H۩$Eޯ%vPW)P8pUB:FpzG3@ >Qui?ZP-=k<0lxX|ز%IR'U ,kYmO Р̿lOֆ7_t&?:&AL|s,LOAM~fj_5)}Ue\8}=CFf!kY.Q[n>chذu2kxV%7$xӖv* E|Bg!^RT$Z ]VtJ\`WzCM<,taʩ6g2S 0ZĨ݈$fX8?oZZ(#k1q<_IjoU+_ԵyZH|v#$]% B\}[FdzQ^x!rr_ %lǙ yt2y,:t{C! qYiwE;:={quh^B.b^OxFHOw2LJzvp~\F%%&FȔZx}836:6CJf"TK؜@r⓫Pjlr;C>F6ǶWb5"Ìd*o|,ap[o6!fAu&.g Q(#SqFMK%`οX_7<̠&1qsL0>rǰV>i Km[WsMu i2EEɃYԨm8/ 3AJM 71ĥA-6"&3Z= 9 4"g "_y5®HjSYI$8!dث :J.+HTZN 4$/S@ߗZG (>÷*24YF0U܊4rt[lϻdMYl^mev5.gbɫcj:u17PӢ2ff^,~+SgH(#Jc-f;]-@_A@:n)\} owf^c6(h60MmW񕾹zyB8: QVb4m{S񽞿/yi8btSF|MH vevCWg'4ڳC3Jk`cj`ep$|{2VI. B}H( ):v ױS JP@?Y :i` %@w73؋E2  PTpsf;ZjwhB>/k=M+tF`Xi첣0דҸ FϷ9 gѥ(^e0dZdimhtiK׏w6*AH7ߥ;(hyOl$Pm⌡GKKg6Bri.ˬ=6i>f[Xudp Y7 DZDm}آ)آ\,_iZT(oxB/h75FPE:[tLNRֱucZEN:}ʟ=AKt?O p'js2mxTHAn᪗L&u51- '(#/& in%$k ((wM܄|RWSլPcqbӽ9Qw@6ԙIg*7Q|I-B9 ;f몍nV8RY&v:]N%i?!j\;W5Mq~sn{ܝ:>CKpx4δTD#5lNН֔ߤ75K*#ª8n(ܑ6n%>@*5NL[hSFJ)6bnh$"Y6IMq3w ^* s 0nSL[č2]5n/$ݑ`BJCT#7ketVKRC_[ 8ц 2vp|b0` 5HD"IݵdYZ3xO`외}D؜%h\p8S"_/GK^>icFL፰ uSGmaFҨ?6DMwZ8w@tl]lf\-XrAw57RǺ(Ds@Sgy&e.IU_Gڥs6|3y #F+7 aGYzkv䙿XmHC!\`ы3>j`-gC s{#CfSs(|ui{xGw}\/ MmSE#/T&^5)2FR#o5KI!#;֯c8؈LM ~cWyE֕'6Iz-HIz7se6:3E<1&^Oا)#g8IK PRڝTi#yDr4!?3%̢x^#٨jpid&u !̑[ 9`38`x*-.c.Ą˒N0CQ4SF>EwiU ѣAcO-f|oV%|8Uw%+4Q\pnNpl~t0@F[L!kQ}]Rь lYVH cͳ?U7GމY(BW:y48e~C(m&(3Xe3EgdAFt;{ a]bX %-t@. _3jx W#6Pi ՛*kw83 \gN@OdZ'MCLF` ɮa[U@| kFփUI+ԫ [jYo)w\/6W=<5ڒ=zwa>ڇ'9.[[i\IFeP6|Qc ʱn4_ui0dzȡ'.(/45369FM׌sO?' 3`|V7$ >;gWEdx{qR AVȘEx)1ɹAz Z_1|:dg'qC|Ӫp/p]4MEiPiM7Ibuɥ+-/|xrә<i'ȟ UIs =>M{ _ʊwv6+t"Q K+yOF0~l M e7 oubG#H1-·rT?re8CU4C*@;YHT.d{$`Ӟn2ށ–GY4A;?[)t{pB Je31M'{PTMIp.='N5Nn>(㓖^gKzyxpmcAi<O)=yRJ?dfR5YmH[^_RwW1/%g.^ ǵ)tG{M\}23O8J${e! E2^84WXOgSVB7̾^ݮ>AM=axQ[O&NZ(AIU$0Syºt": ls"8_?%ޏK)|F<@Z'jr¿I <2`|bh'5/ ne8Jl-_^kT,NOȍ[XuA'V:ػ8]AXBG7j oZ-3o9ш0<% *ߌFf1w+'VwCc (dϐ?AdȰJ'$Ow /VxUǡ4κ,arm_ HQ3"s )B5DԮ"!u fb[$,/J3f#*$-X noZbM/ Kv"a"JP2!yχ•DIaleɂ­Qޖ }O=w_t[xһ(=PBr3ފ4#ttkr 4Q+\0Nlۆt}j&5fCo)yX{f5@g&-ur TK{~ƶ5|%omo*Us%kCUJv<||HOvAV~lPnW`=5%7hh& I~Az4sMxqa&PѠJ"&XB O%lT+5% =;aY5cPgW Q1aMNy<ÑS N('8};g: Xa$/bȝ >&1.&;YsiFW:X#|L-D0C@Պm}Gݨ[UAEe|ZQ,G76l"\7#]T_n*D&}`?0ϯc3p,$ӗ AdqNrآBfn!>)g'=yc܈OrXyK"۹}~QJ>oӬKcv_pN`"CAyS^GKlnaB|IwH ǐ8Q8Ά8u<禫B rxlT,[x 8S{eSji1"slڇ:WAk>SK[% (yPL͆!ɞ>@4ՀcTR*)N;Q@yA, uΣuL 0r]껚)) -Bː UgKjV"E81 ЧY&GVÓj+"[XbXc6aƠuB%.Ey; iNY֦"3o?gP|d _W-(۰3"I\9V7Gs4ZF ,mgm[2ſ -gi'e,OL!BGAK-$Ts\BJ=-&bG2fd9-$ZV~pheJsDMua2ODrl=~E"r@^Sne. lDO^[});jҒ2 ݴ wu"X-];R~)ny"{]=E #5#R`.)4"B#{#X1>n$S5{/N 4!ed yKb=_n8d8=xŃj4 de\Ⱥ?׶c4(?^FTL#8H4賨2+Y${:a !i(HDOsCMiޕ 8iƺV{(@i/W0%]>oqx!c֗V Vf;>D)["(`l֗NdK$.zCO>8ӓtދ\ٶrToj}cWlr !%sV@K 6 ȓ[@g#\eCXo=j ?w%H̼ Z$I!,)W^z)?ܙw>T<3.Sjc>=+ 6V2➉4ǐ `9 M>N$m^\LXR0\|ҴKߔJ ~Uk#)mamo_g?/9 ]x@}+E^7FoVG[eѫ jIPT*ӾSoVZJXRH<`Cgg #n$OϑN!s5LTZͶʿsQ\ޟj==99<=2,uvY>6)|xeE'N䰄2X"cp.vDz+X8륲å5ƾRzYc۴>Շr VB fکm͎ğM5sj7/tb ӷxq'N^D}P@ܫ},~Ӈ"Kn9:G_n!~9 ƻ̬jE͜qcmnĄܾ )iϵ@⥵sv fWAairғ&qpG1 بcst [9RM͜p I1Yh>2Oe(&@{_+8vE܆{2s ]-ҵ[eZFYp`WVGUEp%YS4?>]xq3Cd 6=HobylJc0;-Ti[_|9wӴEvlHVC9H{w<{;##)Qw: q `VEh~´LI*eY0$}=U޳^F].i;k;łzaਸY2.ՙkh k{Gp>DpO1P ?c{^y0@<6q[5HS&\{})޷7ԒQFYX$kGmAf"{xZ-J);eQ X<龸n:rJg}LAzg)o/+z, c!Ss=nI݂ df@톼r/z95t8ݯR6rtNC} /2rv":=7 @).G9"ȢH0]`ҜtsHFvz. 1Afr̮t%|wy#z܍h+zs!0l}7:g%L^u;B*}#r~U,W/:bȳٗrA-潤 ~*}v^9RgT愹,WN:r`n [؊nʃ/oz>,<J8}l8%#A}n )紐{E:Wkշo:C lK6 {5՚]}I]3q _&չZN OF$7vGMJύ=5mTcvroV }+֫:~հDjtŏ!@ͬAKݣ򸵆e.՛{<ڮZA̔eP+_{ZQv`S 3>7'q ۿ;1#yM7bhg)i8j4kldo}]9v }Rڨ@ڙх6gX%"%Z|!!x+(ti3/i=P3nPoQPh2;[/C\h@wnx=m؎[@ SStEKx~q23U+mM`d|JCT?e6W;v"u7ZE"~ogd#tdBSw`xl1K@{3Uqߓk8q܅?VZ`IL^f+{t1?0 6-^k_lxg# 61h.o &W`µ%JtbhfГ ,SY(Q hYp>k - pN1mr';H/oӂi`!m 06gfg.^OF8`VȗŀM5nP(D%,Wceez.?+m u4֭/k51t MZ;\Ê߳'J \DDS?^wqNН| RO4d Rw9r`88@E!}vc |UO@Oc;MƎvdD93:-PgJ#v t/%dG]JjN(_}'Q'6Cv3?Nxc47ZFzսI 趒ÄFl=#쬟 `@PWp5}u*Q}_)"Ćjt(Hlm;2g(@wIXÐlV67]Qb/][%]6eF,/zv`2g9QQi <S gPYDm}o#'(D؜H ~Ѯ4tP-ym& ` Θ[V͌ K+;F; Pj?{EM'TV⻭ekqc mRZ=2BҶ5MQzQ+EGPY.v XRZjmͪր@CLaK:D +ɕ P\&5F m-Vui?r\ƛx1ebJ@kEqI%Ǧm- >+_cdaV˕8RD>G欃^ivl VŊȥI[5r˞l DN^E&)ё rnKr}̸.mi /Kvt[g' ^\g>0vVm=lpHnуQvoa(!=ۉzCB۰*'z賦A4 چ7%e>ǀ:M;JYKB, ʍs l V_ף*obZ O(#BIP $I yA?71ܵ?*}})V!,$rȯx\=-di>37Hh@}<ƆTRr@mLC;X䥀Aizd5řzfwUywFF%ןLl;kDS]ӈ~He1u`w{sf|b J;gG{fٳ2C~5s_&~~5?)?Cڪ (o`',$%#t+[%,+Hg⢫h\u<%bPfVI oV"=a_l| iY|ʥ2*BV:::piu (FY@='ԥ݈Sy{W*H( C $pO3*͎=&1y8qu&>ZκaUznI3u*o H^c 8,j[ývP6'zH>"ͥG@J@Ex.yB$;CIoCζ`ynݸd9J j;4( 7ʍV31QXHU)r]Z9ae9ɘK?E+QIN=DHpN* |?f[@f @z%+G!^?"1dn܌!0,n6_{8tܓ%Wΐ#V5i]vI$+,j_2~IMNܩ\Okj^lI4B-IXǵzܮecͱWx4XPeY_;k䱛d5J)*٫e՞>ֵrg{D'N*tAR[f \^c)~ 4$#+`vz@SmCL忞>k~>?Vt)5nKYOMddUvS@dō (I}I?0gH+$@}Rs۞++1džظʃ$ܨ $M`7&w:tf i3(׋D, [hHlheRJ+r"jce<s}爺fx~m:eL٬'BMQYj9pYhg4iXK\LU7{lM3-5%MB?00ۇ2F'6urbmy Γ[\@R|g8ZaDt 3_g@KeZO o}J\ȄTJ ZBۨXMFmՃ`!GJZR9G;^:SgH𧴩-♋{i=rd*<͉J=*@ /W ֳn Vsｄ^U-\eP*pmp&FLG~YnN T>_HI=#r@ڒ?Q 8 ^a{A↹vx{b8Fg 2˹YvC6NfaΪ.b $wYFnr O)1/TCC94궑BʠIyXun+0|kٯy+kBNc+JL K1H0q1'P]J.Մ1hCb١G;>sYpJyٮzU~q?"7fʽi4,܂f>py9p:7HP0zqЫONW)9';VЉ}5L .DpSc{&͐l0ə63ǿUʗf=&@4P1t1+di):;$^!U2ߎdoɾ~dl ki`_ڬG3wk9ՃP%P¼>'בә@tEt B3)A!YmxJ//~:@Wb)k($L10A]RTQ`|;<:ќZZ+l:LFHOl\'1#%w=[tUG쭝m[*-3:c|NKڷ1f|Glb&l\A[= |ÉĘAĘ: | 8I@(&v"6W;4$x$C"dž3.܎?|}`8b7m+,pRoz;ؒEK?(?E gB~c[QdhVEꗏ9F7Tl!dB6ڍI=?3k YHQwm,{}bBoߩ'za9 ,o]I~Y{_.bH& +^].#==p|R])S0⤧l탩{[[E㩾x8t EY{Z:/7!Ȫ[eNa›ǥ'+~od"}jٕ?x; C׺@"G S mpYV4(r@7c~n Z_Ŕ<.5խC1l}}%bzA48Ӱw\ܯ  OQ$a+Oیע?\>ۄŖ1n| lg+><{S]/5KHj\7@ uyVrN5=N'bjB[g) 6*7؟ fi,,X5Dv(yc|pyno@IY5sJWSG]тK)b;<͊N%I, c^nFܻ$! ͂I+fYP;r$wl3`kOLK6|]v q' [d~fH֛4Sō#6 Ӟ#d m? $W0I7KnE!ܾ_QC/R8uZ;=ͳxflHkI+,^qDC!W$TZE'99`;*N`Jwn`KϦ*!C` * nCWj70c?er{;ζ; =ѫS$Fq~qA |l&|A8`iUnRlmɀ*TTBPkQ&j{;"]@bJ"l|<H30AXV5S\gi]Q^~vlUYpٞɢ؊JMGP|Z yYݖkMpD6?;)5EQGWֺި\3䁩iQ {$ Bjz(g{!X)pp2Y1Mui3 %sڰh.,.e:]|SdW8"xDqP/Y:Z}_Hvȩ]/—Hv3Ml"༏=\%p<z^j^5&.^yB:dTy.U\`$ j29JxF ;EzZhBTFV0#_omE?3"̳+s/90Nt隐R`zR)}X7GS׈taFS-˧ꕧiߤdY|s]*OP\3iJ@dlYK8c^%:myuosbHͬB:Bj--"Zȝ$K&c Bm &>7El]1(7RcɯY#r KW:&I!/U-,>LO "ru 䝜Ķ -PEIgCyfyKЦ rbhPdABF5#Lq, %'C _su&;R nB+z0r*L"Sh[y59,Y1 Ȍ ?6 b#Z1Ǹe`' 9M5p\_Tzo[KYt]*ޝVNY oQ][ s PlݴԢpĚĄesnmoI|x&>BЋ;qQ-?Y@@SW#eC J?t>3 L#=%-T\*sBl^<-jٌVg;IG΢|tpJÖO` 28sǑ~CZ\^*E&VTiidPF{]|Eߚs"A*; jV-"@O^4Mq2%C&sElf. }R7韮%PU2!_el5=FMC~l̪Jp"Ϗ6X> ZuNwٱM5s^aR@uh,wXC ˊx.*$nh/$cB# hA5,jeu甥Lxha3GZw?z@̑+p4},XeZ[T:;(% Ǩz"XQk)n䕫na(&:¬/ԍ*"N VI. ĺ(y?ՕߞY(E2][I}DigeBj37ztX:0@,ƴL|P%-;}JЈrÚ?^T]wzgis֝%phZAAx \xeibhs;|w*:BcwBpTUKؙj6np@sFdgQU/SvA.|bCнj诘" Q}[qu{F7e'u9s~Mx#Ir{QDft] _"" `Swdllj r68}ZKZKl&Udw'eE\[u(J4ցq`34>q.@2%e??gm !7L^ժy%<(&IgVԆBcPŔn- N5:d &P3םs{hLW]8o&ΌClو4dy-QAVS;U94OĖMj;vT^S<ƠuxZ>D.rg:'aPd_#goBCzW*%ޗ6獓8ڪ+74-ruGt OL<ֻ$*'D,.r h1 T#!p -m(ؠ8MTC[SV.KDSVQS/ NvO*cQ P$o`dxQLnejv@|Vh Dе;m.ȎY|(2S:!z"D;v*v&]cjP6͆P@o.\.JnKxXDpi v˛R\V!R¡e/׃^yϏΙ6]I.D=:7z4"AZa=sEX=?ͿnOo醶2bzx7lhp'٦vt&xyckCPFga(x[+(PjE;d߰OM(_4Ua)YJ>? r˩Z͝b+cypbO"m ^8vHT1QJ^ !.r+ǜӧQh)7I< k;BPM+HM3CT=LX| O*%F&{Cݕh5Yt 7Ǘ=E,ۨoC37`?U -[tj;F)T^ 9|}HUxDy(bF9m =s /1=Ie%#7#U]6JawS)O1):DOD|&6I^5ep܈|IW\`#1|1Xc 'jIB|!_ #H<S#M^2T[}6mZؒTF.:r&s1ƶWxj!؉à(A6b[O~ryx<KeҳwR3ǯli C D!*BZ-)@@b*rVe0+g@d3LsIC<@}NT1:85@v@,(깗p>?mghUS>n"9H1@n}+Mk'x׻Xp0 u{-lgXlR {NKH؞εClӕLӖZyԧaפe8yE}3f+4Y j/q[ kLQwNV:KMh|-rK/ӭ(]+5:A]#3N#ng"1* ~9$SgbUj/uCu_"XeI;b9& ذu[6B#Ԍ&)`.7OQ7Ρ#u`oZ"*EJNH%ܩb>ku!?ւ4!@5r7*jp714g~N`)ƅUsUdimX TNhuG;ON/r?,Vo)i5Fr(Mn_]==)1h ٽwy dx=a6ع(E:] xcs(/dYjoTc\8urLo+K|ta(K`FbJE.`PŮC/1;"P>I'z`1mX @m&㦺CW o`/ W_Ղ:,c4L7&5M:GVb~5Bzgr&X;dR ڈى `FF>~ [*{4xv1 6  JRa#+v0,Oc)k]ڃbC3]Tp[w|#sJ40Ɠ*&OF`er -)LtO&*r~?Toz@(Z63b2 qH^%-tp tæeUKL+ ·˼+<^,ki aW5N=njh(wD.A|ҎNX"7Gn! 56hhb_:ir5ưgA1ԇZݹMqwxR2o3BN\t. ;=,.VK ->UgђT}Lj_haZܖQg4z#{to-/|C!USP*BSC{Ң!<0yP-L8?{ԳQtJ\kGgU~%M<_MQ$ę>骠3/cy7!(U&6+dל7s],N +w[PX~TH\t$;(TMXI_Ea l_̼Ȥw>sS{2@k#`MdvL5 #ߚ7&]gcoݎfrb5c wTdFrZ>\mWgWܽ%iM,f%t v1۹5=,inG6L sZ"j,MEg)Z=;i@wUY-D$bLWl]_ Lm q/B)%s۬ivȦΘ!ÑcR،,,v(1ǁ|&!Ri6ѡ{"6۽}܎^cqŬ׈yX`\n׽a!m'hbw( =^9X$0'1qm>uw|)вQ/WN&i]qQ"eZ-0+έt,l 6yvLr7;?́:𝒺W~<"Z[A@NlM3KDleJ8}+/F[DS 70f_.npU [f&s/u*MLkF٨ EF(}(_R X6ޏ!<3XЙ܌0.<'#@ ^zEҒHcu}&3uڄ)v`f Sݹ^b҉`T^}`e<ɲӱuffWt Lىk<ft&;{{^n&{mr/#6c/jnYfI>-XK!<}wmIfv1vK9`uH#dEm#^3K4OXY\s7్Qv8y"Hgycߋ_EBnaqZ.[tS?UߥI2[5z 8/u nrBcz\5NCgV$C±$ iq6wME놇ě* U15OtOlvYPh va_nAaˤ@6,XBO@M}nU3qJ;{mPw lXJ q!YyFxCڬY"k);)<5yQT7KN+=W$z.U0}*Z $f?r;НV$Q җ;$I8d7e_Y9g'%.wg\o$_ȧGmw@X\2KqR}~~v 6u9m7L>{Ω;' v["tĚ{Fm_~PԨUdowU9/p\IKik+:4î^J/v$̓f)L~֏_fs7@-,'ugC=,5eyeB/I5No|V8. 9="UeMuITdadl9U-р+ ϒ׷mr=7.&Ќ9 EhRYnV\](42Rj0v?x-c,,Ǵ`Zi4QB|%CAYdE&f2wd2Hq(F/G4#n 2rF !i)UaGoxSAJl"M mHſT:Z]`ʪ*QL)t.  ؝R ɳ ^ZgRʪV " 0nb5.~gp̼؞m0U:+.j.[B|'^0F"[^tΣuJ)ϵ/hk:U?;`t eZ5בrK$;j/ֳ+ԙQkSXA=sg+ұ$źD}H@ώ׍w~?J_[W2>ĞF}><+.#2nm apN="Cl -aWyy[=|l GIppO0$^VsS1??]K/H2?$Jě*N8T iboˏi| "f],./X~ 6]wz 4w&{҅1W$ 3AѤL$:C`c潫8 E~MQ ]0/Ng\=SH"eGZCn"AE|I+&4 -% }F]ag)n$i4qwt*OjZ/k &%<2<؛='qyGE9Mm3gH㤈.@`dΠN\2 j l* 'kug*?$4#wʣnI*{$yΌY:JRJWjWFǭUHb>!|S(wk6JClw>y²Z}2:L-B%nkgjgfL0Il味S|7X`}`,7K@&^,b81)LJݓ+ :PF|E=QЮ]M$FX: 3o >)^լZ8Y-z nqh1VGIAP ,d8j䛅y 9%%j+e'1ϲX޼Y0E H:RH2|Ҡs_hg,jNVʠmÏ $#BCK,B +/ x#0f#8OXIfr^ƻUT5גY' m;^ۗ&ex9K7ϕ>kهvhwGzt V8:VօCxʴQ醐a L!?赽c8-F((D?E]*uV&nݐ&jkaQwݦ}mD ]Df~?1ڧJL6c8W<[7<ۏY{ 4 Ef= QY 6Ps>ݷLguܗpdc$"TzzHZ֮U'8d.Z=QgK+'?|jK|=BIdhmа͎n~V+%c;!-'^ iNw4I:nAfU9&O$I1`KءB_jȲ"*xL=A`Kez`yXE xE3 Cz"Gԫ-?Sҏ'FfpOWU8{}  #g̘i N"*I6=4Yk2@i3|>29/EgӣzK% !rp~j)Aa;;[闩&GjF%g#\Wu'YR5QQ(O(z~VZڰ;遼FS<.fs)/(6<|!B+Eҿ܄ S!^"yRb{}3&6O鼞OQmBIo$x4R}-@s҈2QwNKj<{2')_qm ~!v]=%PO6%kmѲ&i |(,[r{:3?-퉰jd*GSIԳ O@znK,X&eae)Qp} $Tǎ|07%rv$n[Si]qL2HPѭGrax5rBs?kyE =Q Yk2}Xk] I`a:Ӯeeatp, "64s}-I`P*/u*<,V;et5-)oOS/@'Ot9HVt(,_B#=P2@xREɹjھf[V{NڴOx~_e 7k*K< ;Qt4s!:"?FaZ";4~M *K/ȁsI0}t?HZ[8C`G #!'-ORg-wؘ R{X̻{cp)]1c*=×obUچk-(w '"t#o!t0\%_Y(%_!VR*t?lȆ1$օN%<?LW6o>H8äNQ\PLAxT{.X~V參k4Ԝ/O|ck^,HT"is{6xpbA/.X׭- ~e+H]e:ve#r342V 7AdЅ-TCoXbIk9gH&vB`(>tps~E8$$3ȅ.yj.c!8@:M-dŠJPU_-Q0i!y_dδ*weY6N!_i@!m0Zgl-lچR2mVxK F\BeO@"usX~FOxR%/zW8avn a/8qs:Ax!ڷz+ZFdy'Z8X# 2a{Єs6Q ?W||$Cߣ_G^ZC }ƒ56,ű3SUl@}89_VAn\'=`/S57FBTsp9.:G T>!M:=8yex'WQi&O 0o>ΚwCpm~D uF]g KFF1{4JE2o}C8u"kjl#tcŠyjMmcG[N:N0Œo0 t+撌 ~88Kve<.Ah.c*U4'Hi9{ZeףPz´=#Z.x0mp΄sXz6~ηwxsК@<Я .ԴNeQc{FMs'3_r9-"ln.V廠[$f R$ o3 &1 kl-# y>4h:ᓂYFnolwziŻ;wc&. 3`+ZS'DH 7*ݎ﮶Ĕx/sGU\Y={5H#іh!vKmA,ŸaZߊ/DE *hc !kG\I?j]|+[zr_ \H^(-B7S~xv1ԫa:h`ۏ4>[6QpYO$ql&OGޱĠ]gYh"`-ZC!aNIu5Z0 Ahd$ݺD"'*`Iq7 {,(0_fkUhp 4J*-XSLdP2c?EܐK6y [,ől*oB3޲ R聅RqA0^:a`lZ3UZu69zzS( #ʼީjNzaCY J!UiP ׫Kـ+w(XcPmD& q<-=D6N,.5:E0[aPv^Cs3dFK. /"ėhVCˤFI]vܰpCщ 눃'd fikd3Kq njҔՃ2Mg% ,\fi%A: ȸE)cG͛7ھYoSL\ B3{` ry\z+;TcmdX԰ǩ}o}N⊢!E; ur+lFiMr~Yٕ̳YWVƂWVMG.>28vkÜ 8(y ^S%= /+Z=Z qf% ( u+b,Fx^zD!'g6D+Bᆋk \m$jpM[%{$zϮf4U_ s?޿Iׇ4q޴ /ޙ~ =w5rg5|kERT+bt항18ha9sj] gz@w‰ݫ]zwS#j@Jh[akPLJn:dV}*ÌH -y! z^Fx `{C_` `gV+рѭR/}kt dYMd0gZ@@Uəl2D 0=c70~y W|GX7n`6( N.G%[Zb ܦlx<~`:` 40͐qN#A4loo#0y z֫U&5XQ~-/4®tZ1&@ۚ5\3# q@\N,pvgf .- 4f*P0Z߲A+g!G;d^}Qʻ?Љ(N䂢&Ňxl> @'7JT SŘ8| hHb '-:nRa(h;,1[Mvobt:IQRd6eyEJ.d-OC2zP +2-u>emZ}Gێ9֑4wfF\@Ҩ$څcfrĪ{ 5~77.|yڽ&Ll({An7G1<ƾ@~. ">J0I܃La 3 ˣ#s5+He# Y2` f>wdOZ 7ַh :tasӣ_ 0ǿ'w+:9G{) U~]+SB_Q#6A{u=\haMBBaGԄ ^+-^;=,\ABIF4&=o:` xpqTyVH82q' B&˃H{ n-7Rp1)Ιe_ Q?ܗ .kH`Rbɭh7g$k|%Z=fm!>s LG*5 >&`c] g g#|mTL`Qҵ.5?]Wpy3gۦʝ+#sa'gc8۲/f)= s\*K2G:ըgXpm.VJ!rC#pո %8TRJz $hBZ6~@ZN xBK|9}C9X-R-KL-ݡbZP3+t UGXUxI^Tbv^%n]pD^*RܜplҘ )9AI\gE[tO쀄b۴/Ů3cvc7c?,rlp4oGAn1ZY,М^-*LnrB(% ^iȂ< XztTj^=N2'NVA |,j`ɜZOg2l^)q:@ō.67iiJ̠.y`5x F%> zs\UFݚFIȿNF_Ղ|Vhi|uZ!?>lGyMNi+t[RDOl:}l9;5ۗ΢ʩ&PaN2$%j7j- tDNc'ԊDY}=H,ltS| ߺmь`m7)[c{?>Ԇx֍qTeDe.ŔD>_d~ta=@lqOPr^c0K`9.6V{& qy3/ו;(J v,rk i4{UGu!v~qȳg`4C@/Pvtx>O']tB}y+O v~imhņY6N6 "G.͊qq£Xr}_D'=37Toe="^r\Wca'o]ahp%dɯնĚM3,7wJUrCߪDW0SPeo0NU۶@ſ$'kCYycc 2 (g_O펑=N?8N:1gӇRS(y n@)pBkC5[*!uOad4"TP&1RGRZPd}3 L?(sZ4LiDf0IgoUb ?Yё;zڠo5ۚތ0;2Lh?:s`P>G-Y$*ckLB?SOk^ld1RipކH;GPVȣ$D/}LX_Y,Of?ߗ8,iBl,FlRs}*TzDQqv"昱$n^{yg3);r!vO"k" 2nǠSzʛH~0b.ȏYE}Ϝp36]V;Wײ)Ɏ0a$ènMS'Ay4jykv e\{wCzg$EuNT} S4mm *Guh!`(/(գ7[Nڷ^U,}g9l%_~l& W>=AI`e)9]k5 r<0R ƪʅYjU=}3yA2 ,# Q$N ސPWB|ա,.[hxIg1ʹƑQ.; ‚#4+@yݷXx8+=R4")|s;5W̠֩)" [O >F#5AWL'%zr3Yu7ն ?_uV qx |%[ O1ܘ!).j&@|BhDϠMXB`|EsN]aQu/tXĬX#t:¯>j <;)' H)н`iY&& ]0}俚@TX#~{}+U8fjl3\7;$DEo*ĿwʍtѫϽGyϬIN`%e.:K!ux{oFEhm =%=ZIrw~'I)UeFGyەP2]qӧfO锚˴39_*Rh|- -Q4؇CC+5UqU='AHzݒ)ìR:>Ōrs_j߰*uW6[Y}+5?ҫokTELt^O2-$Du 2NWwܙ3pk%{{̬9[g"ͧ>߻*JjEۈ:/[T[#v}^ '>rn[G͗̍_-9r!]7ZY^qLmS $N`︼6dLXn\( ^?6إ:5OhVFt NI@F]~[5fAYR'@k2CƊun 0>%QQ}6Nyal#TmSa^ONL4Æi޵ψB($=ii'sC9ipD_(*Mr3<oEC^M񄚇̿Y Ex5ouMۏJ.,im~_C_tq=뱮rV1 |tKHON cL\)r2XH p*u$H 5z*a9U{:mPa=j#:Hu!-Upfucnzč-8G;TC/KAߖ >GAPUH3=$m66s?гO3?D3QIe̓3 "&]jN5xO1GBUm ,W32yά}!;PCmk4jqW1y% E@zQ.98@]·*o|̨Anx? (X|M-xKVSfP~p@vMCcČj_S|rO y 7uuj$j<"T/7sBؗ 7vgZrd]z#[Ɉr0 mhN&rmIŸo686bP3V? xћveV0NW2d0씙қ\v|܉M*fN%b:s|w\ݎʜ,YӨ&pBaApy;ū2yar[d 5w."vB2cȀ!?;q0y:#K# U[ %rHY悁.`D;x.Yaj曺_7P\b>`&>qc!j_)hRl$\>`:P!yY $ɅcG۠0p#LDAܶ]봆ࢍZ\Vu Qu#7c&SހGu} J[Tԗû<}8"Qpz6rķ:وR!{<ŊV k~dn}ʁAR{s4$b~y*7ڡƱɳN:7s+ wٖ,BAG& ;(lp~ :lQSv1t?PhYP|>ѸpBgsS~O\*PaB{ @ X6hNd/ 7);2ur쫧4?Լ2#l |w;VުH*##E^,ߵr@]Up+y]{Jfyϫ}i/MN"}ՂJЯd)]1*ns[Q\r(`Fh%BR)RL|4!cǩQ6A1&K ^$lr PHjM{WUFU_c&Ka78$+M.BP}L S1PO!½Ws1?v5`7W]?O>5Xd}U=]V %e[@J HN).W{7UB 17,i֔ƣ# 煓̦=G3VfvB] >7\ Efjdl7|%f|%Q_~ >gy@ܘV V+y4~FQXZܓrΩ|-J$˨;#`v% % >l2poH, IlK;t X.qorh_6o[@ǯX%8؂bze9Ҋi ^7Sԃ_)Ba%? ڝIljʣe " Pf~UW57+P*m(W.tWꞐiD[1V!n8lNaG%,"4j4Tj?}e'ǭDbGNrɬ ?5ݣ"nZ+Vg O]F+<~xP0*I&NԃvSa,Ě@[ ؃ve]okL jDobӏŸѝm~z0S|t,| K!J_Ab ]x(5imPLpɄO6$9F ?u R=c oeEGs-sr]אbQ4*#l@$ >F< n9k;r*]̅@ =-r+oӽ$7@ %n Y-jɴ 5U߶ ).hBҲpӖoϠA jeB/m8a/ʼsVs2qS :uCYQYX\V9P/U5 i}J< w'eܒN]#1oصadhmq,{ ͭ!V>nB-s2*,x5X.ag I'vk6Sms7;$qJ235H_~+FwdԪ;N[{  p |,/YfOǚ j}6@-k~V\+1WYUqR퐭yP:֒h@/&:U^ˍn0J2\j;LǃGy_bm*suSRe> ]ӻf]8$In{E7(|n2Ð@ت(pJ^g᧶uzf֌\ݔ^Vr6^c{whMz/؁IA3"$uZxP$!诡fi)V9+2XjDEX!p?sZ[t qQG#F瘟p 7/"klݑ+b}Z 6vE`F~jGv 䘫VzL"UxN+\μdpfݽ5E疷psH^[.AeOܢeci_Dw1a/` rXgEG*@c<{HrW]>%b5~T2 #4}t{vPx&d SKC*qhcK?W,b Ѯ]{"#wmVډ_.l͐ ZЈY("AòD(˙#%K߄5jwv3/V=֑)8V~ΗM^YG]x+d/Ts;0+H%Vާ1vdǟʣӍQH{ӈjwC퓇#K܀tU]1nNOR(n 2+ Jl daN,#[M: *Y25cLi6n9e |5Ѯmֱ+LU~~@aw | SgPW4ZK9[!͝ )skyXBC<7p2V`#ܔi݋]ARSz '?EFYšR-Gk#r3,9 i}.еadҩ{r.:0#t 2f :֗H*vs r*Qw)V[LjASpW;UݡGGȤ S"SM]0!>t]^:b^:1&;:!̆|jo*AnoMNmhKђb޳`+Zђ`lK/^/9B${B>*?: BP1SY)%g.G+Y_P]NF8АR,+F u@ҫO[!yQOȮYt=-@QK!*fKD1c+R Ua'GtvJ˔kNcڹ6MwV7 VZ%YUhuradހm,!=@Y|%gJk_渄}k$4* < JCewbٍ!'S+H,8jzs +~7i2 ˔K4~V}!Rpx3|.ޗ+ LK.3t0t4 "zvm.O m+M.c^c"I.BktAS#C5;UB5<7K%}:~PZ(3/o4 }L0TcL!HsTSRZC%Ʉվ^ur$:7՟^^+d9E|slL"U׎5o <`Wƾun/{7[L5!*b;O5"zS`^tzV, 钵cm[fK!U?z@&۷.S}R8t{XyIvp4 {#i*DܓQuFk.LM*Η(wZ`ش{  ]^UD=VxؒM-G/Q67Ά\ʷlm芦ʧV0F_SJWF%?™ Pz(6i [B0n}f_{hhax:FweK1S-lBpea=gnK`HJ^$K{7v7'Y/Y/پE [9`&)TUx± 7&mx_.B/TUvJB0ׯCH!DW/urò6x{c,tǤv|TJRPfF Ky6֗ =<7 oםJl4\K3oi|;nf_͆'&)?{۟`, Nޒ\ PCC X0`Z.08s n螑[\O7+"O: C#Ϩ}k!4 +'س? "/ƒqoԻ"dI=v{RX;f"ӥ@F:,O-AD+@" aY^]EiI^]`u$m0_69~8۞ugŅUAWm6U"呯tB^aD_h6FI:}VҌVohSHFCqw3n'^ݵFTsv_,xz9CeQG2>/״p̊$+H<* x( R5f",Rق'co($As|𪡞YjqK, -xHAi4uk,Gxcy6t ;ՓiB啡@̧<)mǹݷ4H7#_v`t rAph 2D`&Y7d^{^E+Ӵ#h WcmxLJ1sѿO>=q^[ffY'b8; j~(L58n󰝺LGy1z)),n𧸠 T 0 A,ټ&i%4nSҎ DO/࣪gاC*z 3}rN7ĐGx&}:۩$efqq{Yn6}JM&EY>pDRFT '1;bhM6IhQ3 hR g쎌DD*IV>N?'\>,Qtuy8Bvb%+*yd E7B40jRʩ5=!Oߜ2qi9a4 ŕvbf%u%94h9ʾR hF S~Qu"ˣ(@-CG=fK`&Ħ2u&is/Z=0qC-i8yCی5Yxztb.O4axE"c9>hx’%,Յ\_Kq%ώgslb]YQ z^yya)PΣi4L]':,[jvӂw{R?.Y'cZ^u0 $J O{KA>!S\P46=x@rAh)a 0e=IhnO1:Ͳ&.|ߢf\f/Y?T1u)4`WJ pD7 06^xNk{\լCk-Dk],3EvSfS,'e ʢF1$HSfĈ R=hz|WXmtsn; wpZ$Yѐds 53/+xɶ_ڊ6}5F?3=#'[ w7ۿYv{=gYFad3۽JԑU%#s.+(F.BV)L'ǓDY'1_АV/ e3I,Dx&E QtI9'+ჀTV`dxϡ'\d!Qft{W8b9 PZ$UAݚAePϫG7CJ(8xM(LE; h3/XQ# 1ܬ?tϖ;lLP'S%N}Y ˞9I =c/ sHU%b@C_u*͐w {8$ž5CZ4˵2Cœ; k wv9#ZmZVk:$¶?轺vͿ/Sr%RSq-F#X+斠S!ylf@?i(EUm@o6 ؠ^Q2DpPhk5ɏ24k20Dțq_&s/IEVQXJ5=+>ZZyRy34+k=* X ׆Diʜ![:AMX:ν$%r N^=e@dg7bO6XX Tj pZ~^}.k+aDp[LڅB.GDtj顕&tpIH*$Hæ6y-Aa= dIv%6_.-&7Gk_Z L@4W)I?~T;q*YO99T1T1IBK4sl=!1ߖ;NڐhY\##$_9 9p#vlǼ *xio {[%ͷVWo-8Y꩹ L=wm9je*fD3â!(|T=;C6E""-~s5NrMt:7n;/ 3Faڏ& ŴB )xUx;ā%2BŗjQߟ|< \ T~/&1wM.HN*4ZIHˣxv0-`dʅ9I3V뉉_+ g^p)q,nGoa`]3+0V}Z dpyjyC"-[ !e/="Mrs-R:N0>f,#4LTه8:tKbKcU^.W (gX2z81c` .W ڐ{i: 1cdK(]cdOl}ؽ`Rk߾z91BOy%b-:Y*5RѪAKo"Ҷ{ڣl wՍP'q!P<)%JlĻH̻!W] %&JEU׎ydv'JƠ"p̚gBBFY~+G 6>W`X~-=[7gtt1J!Bm_t!g$x!G]ʁ'8e2]wĶww],eW[/ewlW".O˺c~GLAv$9 LQ\K!?WVZf 2yt,^r"*=E(Q* B @@dxC-{QuRFĤ5ǟy3lur8J]ZfCnG%2$Z VHEr)4|"ƅ0VQsgU&);a0Uc|L#&bOɐ),-LW c%HѹgG W+9R]93"sex"Nw RJ\Yڸ'= vJV2kXnv6 TW9^2ZrB.BLPXb܅5 !cZ.dNd I5I!Hi3Y~6WR(CVI6тёǼu_-{scwffS9;BuX3O5JUNg/a=pˆ}'4ݼ vERֶ x|wӅPaoO'N@9D?͌sy!F,Rm?wQk@6}\p3 q噧L0+quKfɅTv/.Q߱i{ ()Z=6r7#G6$j`sUY4I]¬;aSp3{_K2tdv5''H;.Y IsA~K5fxU?f䕢?~CcS?l܏L61TʹyI6|bp>] s=?jβ25-DP`yRҝl S҅ K좇 |PC)-0* 4p^?>yxf !?QTٵ=s dRⷕl.og^"jHy"0ү@, Ӈƻ8$UhS3I~ԃJ8\nN=*WE)>Qyķl'vA1@\1}`_^Ok( @jSRsG7:=0'~Daٖr:éRXH;6$5e@<+*׷[^"U БR;(fs@;t&izy؎՛{ҧ5WZkbD5r<|r@C@J 4[]l 6/%{K],=? _ׯJ~$(Г=+7bDu?vrH] oLؘ͡Ɵ=?Dee0.̚a=z>$έ Kfzi2X3xV ]DWqŊ蝊O D6+v fݹgtlz<ó{-˕Tm6.* ;>3.ak'm@o0R|m\OŔ}ވu6`Wq !*%tna@ Cw MS [M9$V&޼Qs"ژZq^4JҊ>ТK*lvVVՙn&ӌ eh)4|p(̥(T%G;24M>FTMQ"s߄&8U,8يG y_a鼖!WA;JBے\|l -6ϒ=x^GkZߊ_s 6%ޔ`E[7x祚 ,d%m2>zkmnu3mpy#V OP2M $ыߤk!P<{S59*ޟS>{V uLsxwB".in?U5AysU~D&I ZGմbŴz`~qUQPj VC i y]~5 _ڱj"bIUNuwft+hcV&|hoauGV%A%Ĩ0 ^~!:#gr{3)`_I6z-ze(2` :<)Q "ȉщJ(&HtVEB,j휆g pƾĀdJ0&H2Jo'n w{w|( pMec2uSv='!IQkV9ُp($xzvV>7۞8H dNo+ K[G}jx$l`v:LT xUH 3/Z7{ .O›mhx\Կ`Ye;fyK mʶ^rmtFO=lM22*37_A-~V>⼰hMd񘼻;&3h4ѽtUaj7mfJƤ7_%;5Gnaޢq%v [U2}x},)eRѲv\L?:F匃=dG_de#ŵ@ W3a&zM rziOp0"%ܱ QOd%V5 Zp˿CV%Gfw06ln8t~)}ę[8'Ezasf]Ga+KRn}14cvD(~^`/Fo*`CIR)Ksy~.܇D4! ^rTzt&3tn-8Ods> ޾4G[Ku3"h_`z6j~LM')OV`,$BxBHp,X#>dR{j}%J8…I8zzXB18a`Cw_Do=> ؈1cW#_7{tS{SY N LST;1~H ݗ [%RU+-bzQ{Hb]XSuL#**#wsc ds#Kl8b "-QGR1|wZ:3ȩ5BtYGfS )tb!wbg=E^CGXˀՆp985x"A_ud= 8p[<ǒkJ%ݳE5ן ,$) }@kϙ ~rv'73R̟&7N*AE tvo>w/pKܼ8֒Kf ?+G]e˃4, O7bSm#Fs~7"dC.Sg\KPyFrfOP.rh,c%k\ʰ/˃@ҝ\Gbӿ*Ei9hqs;t9Ai֗FB0iEtR7j,}_Yy N"i@9WhܰvlO6"&:/'ŽjvcHkc;JXL#8~AMp  fZA_Ϣ/fcsbIu9odj6g?鿸E؈C񼝺)L<xbf*N !q[Tw'eZMvўfo.U9^LAJ=+#n qu@h@bzy?gByUwmRITՄ9Hȥggz,ԶC؂# ,1;k/`Yltm c 8hP h2x1{*S> FA rT:r|gH:!Sb7f_M?~F^vP =b/+c\{\gR 4=E/vG$) Wjl,R)JEb/.Sɽ=J$F1R59d.pS˰6. -}akSR]PW[>MP@@/(@+# E}n&&#}ΝRg Qн§l'L1zt.Fj~#fkW2u~ 9J`[r8~mrռjm;&xV#Tz2&3|Y`X@)dZKms"PλxL+y7Gc a i(&Hʄ0CNUҨl^.%{Lx]qB'W,tҚo),~5  l)`nܠ)ʊaN T;FfDY\3*C#P"t" zrO-.e@oh 5rAX*֛#k֑T(%e&gŦS‚Om`7Sk.4yRIILHBUo;Yڥ!HM)C kdw;z[L|c&*5/Q[veܻyI AJ?{i Bgc'{y?ˌX33Y>Kw[\-!Ua8\d 自Rmlz/lX-+M}W+BbQϑ\CҫXIȊU)Mj^0=ͱo)\j 87c΍/Cwoe^$rg"-9y KX@A?g9dN*#ǣ ]Z.awE8l}Z24@(Jq״ܢ0!4/{?!,Gg_0nOe@G"<` ƪ 3- ߾EnDem{FI {UILY=ccE:\SzMD]Y4%bd;%;1 żDX;n6qvIlNᴉ!: g`3ƾ0<(@&"8 S %f+F3SzJ/w Pm>-v[+ mݴGt3 :?)Qlۣ|{5jXgc} RoE.rO"j?K{\ln-#k:g(1uW[o0I ^Z!Z󖄝,k*(uD;LKct18Eү38pT Sc|aC[嗭f&#&DH~ )7]5t͵F*GTC\b&cL+G ^OO/$Sႉ|#6tcJ *dä-Ŕl|zeg2=# -=at4{jN,mjt1f!.>X \kv~:feU5pYD*DJ;e(dx! koղצcM*m/lIf.EژxFob+aQ:W 8+Mc2J}^u8Jqd|Ҭ@[Ke_lxozͼ/kkvr_chZ͏tq7"Ikh ndgK Q։;UμCY\4V۸r`n5KҾ$ɅYvId:5h[,) ` #GWJ`pF % *#f6AuFeb Q _! ;zh G! _X錝%'cGE~H^ ytWE3!F}pR+^n?M{}9Ҡثr-7/o<(ލ.mBǢў@"xRJkF{R] dDH?8y'UgRē\+:fkgmE0l r軥 %}kfVO4^•7;jP&WdӍ3{/Gv f6;h"}fk檪R)Dᮁbm.`J飫vDvV)."/o-;jg2;vR`Nv詠/OWK;^2㖅V'ΟX95zy"CRk-4vB*\:=f񾡢 [ыts wAfjMAxߜ6;+6XI8;ۋ9 Fp!_E|JVU!՛`Cb ,'1fй6H**Zw;_wL#Pn7ھ!G1(?Dr%'koe9gT!(a,6c>ɖkT=`WUJo>%_\cq CO pPP)#Y+? {s]kxm^G"&h؏7Hgڷ\vNUr1Yu^L{E(FO =z)oq?>Y \hgFa S;)_ݴ}tH7Ձ]rK~1bR\UJ +=)40ٖ,F_-~< }.y pHV zɮyېei}NجC*i$I!%e'ց4 _jp> ݼM/-ύENX)`bgaq*=aOh!@@O&鞳u tg2G OkGc5h C/dhwHzvqW]#}~I,>1r+A"Eo7WK7c;67~aܲp_X X(z _Cd(-j2 \`/71@&FRҝdxi/<׏2Y5,˜S7>x<8(˗<۽\@Q } TND3owm8GIRXh o݅:@[XFI9Cv@`N8D 5WmGy&d%A&^{ԔY\_h9,aCSgVjΒK;X6fHmV,jJRpgΛ(M|{ oD=^MQfuɬ1=ۘRlK[žD!pBuzժ\`~=EpOHG Gj39`8of3z\[e&؃oݾWhDhY跑BM@b~Q7m\&wӷ;dKv fKAٷ\۴g$fGa-{bp@&.b U}UNO<=΅Z*Xv/ xCÞĤYFR ;En[7υ)uE< [ޝΧ7..)Ir|Q[$r3_Nf~{F#<?d`\۴{XCmsOC™{'䋦I2 |(k+2%w!c2x EP|-xH' %rK_zGGڼtyDV17“אߢacQJdr1r(,'ia/>rn!&5t}ٛ / jRgTn.# s&,\ nCN>P*Wl2uŅ ab56c0A]m,!](^ 52mfZKF-m|{cDy\ұ(0-"0x6izvhTgKzCEͯjDYw!w'Y[Pʷ=L&M`z簎M~b**ly젞咖|Fr.k$8#k%Dލ>1]h:}4h`w"}Y\w s?7). #?R%eIs$ipB*9 4<~oaOZ*#-_VuZ59#XE2@'[;TM$X:gTzv@ ۄ݈Evo)<HqqJV6<(ߠ0}TP}bnl7_(f(a&82 ;hٖvbsO z^GЅ>x}_͉i#Zu??R9Z'֢yx|a1 R^iB%-)W|+d'ޱK>sijXəP?vSx{Jv[8z^FPg/?wXs_'D{ݍP).9FƝ2)y+[b ˂%8?q2bΚOϾ8H~vgdms {HQ)ponVKF[ھ&@؞^dﾼ)A|\^NES4ړ0䛺T/зuX3=&9^҅"@\a8]߈BXBwu!̼;.DLJivK>/.p*_({%&+D?!Ȫ߯w9[0&Ӊ1!u2XP*k1(. >bw?:fLW,zߎ:Z*.^0Q.kbGjY :0_qX@DlYLeQ"6-bQa"%XC4La?!3aη V*i*?.S$9b$YP`9lB'r{Qk'33Ll5sy8omaKZe 5( $hMO\W͞ۊ_ \ 'ZgXqeu]KV]<.-MYŘ&\!vO*#vvs;LV!MoI{| YbQƗs<NoM S>)!!i/j0LAmxiqg81Sui!`f8zYGAl5(Dwj$T[.k'ԒlEY'/" D GtkG`$! -$|dlKd,?*iwGK(FNUK%^héVRx.a%E@ȹ?{'c5728++w^&| MDcCMo:r!tBHno A~1(6&eYʎU1~R?*AN}R:N}]fSFDK7@j<y Z:Cܟ~H%T3 E\bLRشCqr;H+wfT nxt: gGX&JO69c$()P&/(TE0.9t-iLXrf}:LqAX 9 '(JWSV)o9bp|D/`nyp.Yc2R^[UL"p*H -~rfUQMEFK :EG'F"A5Q|_z3.NGč wywAcbpiOtUĻraw|sKOhxWǺ4")AzY'Q`#ь4޾zi bE< Ǚr^껯@YzqFJ)g>SKR0!F&#o\zFKü{b:Tw{-/|SKԀ@HMs Qt57ݐ%*VOfgZ_؞o*WƅTjʖ‚߆80$8UmU* .p 2-0Ψ4^YL;l>:KG/4Jw2%LPVY7goS8wv&W}Y|FU&M99Umleb !|^:s$~7ɒ|>!af̉Jvoj^yuQ_MU8S9/!YRQpc &I9{E5Ns Y!-L?l!cmRaQ313Գ*+v^q`ʽ0q;Pfwn&PbY?9T{A-DeCΜ+XGM͒D>wYF@N!(+V>c7-ㄟޙIWz 7vmJPK֩~sRz~ɜ P߯?j!QaѼN5UM z7oh ͥȊJ!տ M~=Kz)-: >Z#hZ)CP\ÇqpfcyjSK/I鯽xo=0hmA­jdl8qxR*9F?Klbgp08%t=HF@FFGbm<2 BRXZjsڜӛck {L]^e#%sRӓg)eg.ߖ2uէ&4$a %*MQ y|߃p>m>Ymi8DW'ΨQy@Oe?lIghR(izmҏ6&4P*gUwI~ƭ@E6U,?ό >n}~l;qj-vXSfSoH lX0P^k]w2jC:LwgnzH^ ѭuT?fxNmSyq6oJAҌ>?uNH_u%_y0{k1z #2~.xa1AmLz8\UC9ˢma"z<5@wa/5,klq9]DVkR(ΊxE:6fo򝏬rC|XV_"uZowi։h8ϯNR3jkҙ aj+C GYKƖY$@]& P Z/BB]ָqIi[\Ax ڻ3FZ:3϶=rOC>F$ zݡ)-wrdΌ\͕듅E)4 4Fd,(Pk5B >c[nuF?!oJBhӎ tZ֭FEOaU B|[Q6.ڞ[:zX O {s[d WP,0BXB_?<ِEZ:xg DŗCK4M)+%:\8{"S;iY/ PJQnlXg O~WT#=@L 1"@hmvMiqˣGpwUi7VOT7E-oSl[5UÂtG$d7Fp>E1+ ^E/(7ߵiVd l޶ ۙ#րc!vUb6 |RWv1 ~w n]&ݷ_?w@.#%fUxN]ׯ uدrWs:$;AUIv7so{'%Ci oRE8 | qrL:SZ,կG spLUj39RT,YV@/+r\|쓭 XMRI*F*(/7$u[en ~f`,#zpFH`~+)i6.h`Z28!#c{`>LL]%>zL6Ӽ*<Ȳ&O5Zq*΢drAĻ UUf^ dMGyL}dv %bힱ}rwH58}dJ'Wʂcs?>TIƈb! c&=-0: g?Ҩ%Dcl)DDhxn[ zZ|WQΕ$1ZӕΉ񒍪}=-D *<ǿRέwd&QHgc4ͺWC#kHWQQ)Hs55HL i+ǝ ]7xF~zՐAkM&<̓ Y;2X@lj5a2?O#q|' TMG%NL|'q'j,}/qhy?ԇZSQ $/IS)g5 ;BsLsXC>Ǿ6)^YK:zܩ S&;5یjb OlJWkqq-nqB4!qF}~]TM([Tj8dbo ز,ik` \9[ˆz_uac+=cha${&"Z"ℤnɛԁd ??Jad{ӛT59nJqU̔/pQc8&gq xſN׸ 1C:5B!2y!a!zi0i1T<]$zj/,+='2ktL>|?pJjWƭ-xT[mfM7Ot}vP8s` V~%\I1#3h=dI9|Зf72Oʠ~{Eo#N/_<F(CV`E`;xٺe (Tv-?Xt`biD^|s>pRS;+8R$N6 uVӜ\fЊ)ZD 6s]w45:҇*B/g8)+VRا?QLhq|gIb|?[xj8;fJ=[WTp&cS*+哓^ZMYgBHBb&n)[!3Bv-/D6`b vO>h}iEY54!QCa<~ 7OC\Df%2 $qw0آ`!q.kAaG0)JWNuwm,wURd2Nk7>&|po݊ k7{G@- =5bWFۜc3sY{%8}[GtA XB X3Z[u?.{8r&fj^ ӄ]>-ДK7<`E5 /3'+(vPBᎂ E &]A4G- գF%o[cz.#jٟ \&==VI-TX.J-tſOƜ|kߨA/{S络!eO"m[Yj]ְZ F]|9nOsq~'{ %:$Q؊m[T%ܔ<(`*̈Y&)Rdwy zEBc1ݫJi3cIPr"QT1][2vko? P9FU>mҰ9|\Y+ yk G' ф'̞ZOX44OC$Y|=qܖšV&n;KcCz45Ǎ hm s$' tvB4B4 ӟXay)RtӘٷ\,tJ.MѺZ|veğHo2Z񼳄O08UuRunoqn]VfdZ=v )uH]OuE'C|0{wdm:[~)I%[gCH4AZ [A^.jn NL#`_.rY)*6JEs; Pno C$ wNnZ@Ѧǘ˼E6}xU5s)´j2s;-jM%֤\vqsi 3I%q߽va_)aI;5nIȳ!0 0abC{: A\njKu+ gBE'ZyUL1) H1 qz*0> tp>UJ 7l:#X 7 Wd#v?2yt^g~R /p!ͭ@s'GٓY,Uq1?WHKW";H_X@TDg}&.aOV*6 ཪѴU-PSK邠 4ƋmcGL}qU+ϾB!{Bh@,:ȇO a&\{ ggQFFrou~U6vfkW%"~;;cP9YR+ \q.K,;.o;U}WՒj2Ov=1^p(O>vBޠL~YVJ 3ͺ@9d%$G;y8]Er$){H/$Ley^vݘL<:AS5ozc!2L O$}׹a  ٴT[` .@ L Z$U`8j A-<ҧYG -3lGްhôK? @$p^S`c91M @ lln6`,?5q8,7u@*KW_ȴ+w %iJ)EJEzѴoO%VSO],o^hY<;G ))X4i΋0XPQ\@Vb6/.)$;2QtBl`gK*AOO7يV6v-^E!8iS@3Z D;}/P[5wbacո&٪][kR{^ʵ865wMbtٽ1|Y{@b~BNǕ- |jeq kWjf*PQ2B C_y? 8,$BJed(I+IT8edIjHY1nĐ)c"tNu] .PԹZIx!>sf[e&$s>ﮆ`̱F9G=qiLah]):hճcJD5\< Kyu/Nk>IK\_6Jj79?Y Z_G6xb^\~wTntYW\ƍ $?)Dƀ5|i kCq.uh<ӍF[45|#׮@4Y&MAzlkDTVG^z_ED. Sٱ vKp%D&vfd"#r3ev{k{WtIyf#“Z)VppL~hO`i\8HW3&Ɂ4љ.SSuobV%mAʂ3cӈGS]g-,.gz_6.#稃O6c|pHG :&:ȯ0JryN]?S"u#Hq9] f/G 0ҴO7@Pe@aEZ@C 7;*VX&.'1cETz?m8%C^C.g4~z %ʟw[8@55ue빀oΒ}@te+Gi*.̯7 @fŮAC5`>͜o'L *O@$ul(EulE(_"Sr3Hk27-5!SQ]큌A!\ TOGi)ܨ.yk rn"*y=]+}~p}&28P8N@ʆ,UYt|xnj590xZ;t}SrQC8z\*;׊`[abCAL8B#5%d`+|3q8 9iMZ_]`y=7[?\c53~&Z˔?|d2(,2'(tjP`YpnY(ք&HΙ|%4ك~OC1ZCCcUr(<*]۱-Nx0I c :jINQ1Pׅ5,Y*R:XkliV;'BI2U8Pyj55"=hE3m1[hY9`c*R5ziyÜKoGi=ִkPY\$>u%[˲ݒߔiʓH9^b}ӑ~$[_^ca)3g*fm2#δ~+K ^e3L&X-0r:cWJ?sp*d ]TT\yI{Ԫ@óѽ˗<(S+ $cNirH l,+]S=%Y%).&o2{WLo٥61k,`Mv9 A76K^ =\e5>=K^βs))./Sl;- -c ?x.b^єyg^NXwA?zB杅SwSi|4ԋ%AUWxS~!i0(g;|:_ӹ7[&DG"wOAQcP~'G!9%4)cij0 ts2X_(AJgq'k[wy5hණ(2T&VI֞dh{RP1a6ҩ%LRWH!eG3u?<3PTջ9 B NaU<>/T@P/mzxfѼ2f;Hi!]<:,6m[P#PȺ/@ qg{-Vo,EExzGx(ͣ^!5Œ~* wΆzvxw{R`;M$;9U3b"7酜Gx)\͈oX]3deÉMN{˒ :Sn[57pK;nĩmgu GL ZN&IDMQn?Mqjk}>=)*8S/]^hE\olE3;x}Zo* ~.ѱsfNz GfUFL;i!I4 ^x*! Rsy3^y "Sr-hⓅ IB Mk?YI ,S Rd)5: a +Q{&}nK57-H}chqk@5sh{\B s CGă]oy P\"h-74/s c͏$jꃍB hS1>wj\L_'GwXÁ0(l.ϴTviH2$ aA`5cJJۮFƂؗl|xtpRtEY0XBy Mt(z`.~^ |'np)*([]CI3WƄpNTa)bR ^j Hgy_kfТ`nK[覻YmC89GA !3= nXBZx2ܝj/&^ 媎=PLhЇ U\)HC+䄟y"t14v/ڑdDH`6uL̳"ʾΨ0Qk4oxп,t1!SrwA]n@w(syYݷL,A;%M0hvz.{hgs1>!Q`X!h35RNq#fLþĚ%-dId2ޕHzjvH뫶]hMC^=iW\E(׷/,c,܆;R~Naĥ+ۂ=C %Jsd-2'PºZV_70%ԗKf8IU}hYn@w ytE^ jF]_2.(O⹣s ,_K+ܡQ,|f,+̐dbIlv,QO'N0P0~J[ۻD[e2akOW@ïzD"zҏZG_t $ @lѥUCMX n7naVUA _At1ul/ R;fI]OK為X>y>d/Mxcmg8_q'$=:+$"^ xDoqF dF^CS*iFa;[ZfKmH1J9('h%CK֙H\l T}gʻ d=ϋ Mج4ͭS25^>^Rlu7M$F@OC[A *1q}eu&hb)`ܬwCGЩG瀹t_XtkT2YzTJ~6AfT|nu48pxeԐ}-u)8  WJnT,jK7-;&bTvw8_8AAiSM2.Z<JyG+jChsbj,7j@/޴t(_+^uAؿ[~؏Ȃi,*j W K!X?p{y = aiϩVEsPR"V]0^bY*f~ ߕoY#ax}2,ѶD6!wfP8Fѥ&h:+?r2䵴 C͐#+[BF\*TZ_M@;xXt.;*C(U)='ͥLu(n72X/5 2lrQ2s͔-K1]5iTrt=@{AMu^u7]eyV! P P2yK;F)t~\wN9^*E@*Gj3=F V̄ΧuwDoj9!y3ir=tHEw^ѧ> ?b/pql5(3®J `C.ݲU,ZɕǮHb=JrTC@` 4(]u# }.:3W ,z1v,iDs{|[mcJ$Ը(Y20q|Eڶ ,[9_g[MBP*c2,J[HXt~Y-.3Ws'OA dm,N0\Ic~Ӆ#g.=>HLR 2t".=F \nӆQXlh gp?@/xn@|K$j+\rY;z gB-ӧ;{ELUҀ&3 I[BW|_T'C\|Ÿڿ n0k˄bLs tlBxAՑN16 j(O0l}K'z tz5A'aAs6p!ڂ\ǬI"J1sڲlˣh`9]eLrC_:6:ZB$ν 騜Pܕ\Kؖ빊ˠQzE%8d_L@Z<3CFͯ\fLLԑY~IwEaN}9YoI$xتн¦% &{|5H_tV8?um!5 H?sZba;_V VuY_p6}|_s'*Tlx8kj`2seJ!'dAɖy3}.|jyyHL?r?ˡ||?EחE(kOb[ _(C +$ٸ([q{Y+h"_BQ EyM3JZEs0( D|6{ ~`0eֳYY2jY)s7 (/MT%q+{hE4/Ij@cod'x 5ՌxOB׆޹0]% A GL)D>PP+{ agC [?ƒB,>\8xuʈ%_5?xeQ%$^Ujk{ne#紛dx L9>zIB%5~'Aԯ6IVrE?uEG܉*]n##v2hX WF[mdUG/SƙwdLTfz)xSW(8Y< ,K"x'0}ِqXЌϑ4nиǵ)HIvakA`'{aIud mųi=V-|Uxv]nDDI(".dh >A۬)#) XXVɤLie644aCl2 $[e=A xg44̞7E|9)zK?(,k|r+J`{(">>JSp[D ir`<{:o+!jS!n0\Ht7_BA^Ki!j40(GnVt#J1j'讁4joupF8lÓ?~Qtˡ.5N9bb}rdJ-]Uky)d95&,_9:W"_?^6:bKY}$5x+|4*Q5d`ɡzleӋrDJzwF=ariA'octbAU26j? -`vx3%SiH/ż whM(-7ݞN6*L-rw8S#)/^^&GD}|gHzqLbEЍ~ 9J}zD)iVC/%ij nJIm0/?V59oA}|C }n$xzY+g_EAZy/Y\ d&fu*;zi2AL:cS7EbNqo5r/1vǿ*\:9''Ź<,{e2kw %yiA.)_Yi,^q0bI/!SDW5\K \NS|أͺDcDe#}Jx3jmڐDNU#9,o/|yW={*/ * pK+iqJj=av:]L:;jςWFJn{Gt'U>u,* $D$!_,"kcu$`+U@*s8.p}_SURKr66x4ם/83XAsf{tXSWQ?ASzsK6~G!q܅\9b jWX1#}DOo!F6&_"gI)C\\prͲo7:X9z]bKʛQ/c 0%esQy?q[\B_&ڳH(G\xS1dV*p~Ӯ6xw. FkIUcWͫM|2 )JH Q NBbjX͏9"/kX3K|Y}&hCm5k .o'Si]Hk>AeRH[r`dZQ6:S1'PLϠ% 7 .i!@2ƙ܀gl}tMAvK}Sg==#'Ԅ\ _i:+yXatmwC:+9!Օ?+v]<Z; CnSxWo,>(%5l}E5)QG>uKnBO*q_P]lcz("J,1|4V_]D8@$G^sNtI0ae"e?/#] vZ9gt2-U{"{vRY`9}^|\ ?KEz3=tz*fH۟ȕCcr$6$Kن#%ڔ=y@*vJds ZX qKw?4T#a)Hhb sP8˯7j~ طg"iAw[lkrd+ͥr bwkеn_ uޠ.@e[?,[&Ln RNTcYxĬ#^a.b{gA }f 98Vf亶iHk}n 7_w NqeR4e ۘ2lyiȀb 览Eeijw/YL0Q>.Ǐ&[d׌Õ;&{TAB\wbG?WCLJ-Gg*.ɲEj4FX->,iКcyZHŪ;B5BMT!gG#-=ĤEఌI SjqSpyK"Ś^nw$OB4,8ZIn+ _fWWڕˠf"mlwa  ‡b1eS~Dq1|1~w|{Uɐ `H- 08YPUlJ"<5W9MO"u9%N)eRYKrRTW.R d\p2+]=Toi>4(G@d@t k[1PmH;v U>rcƭSR{ 2`ACC5!j159wAS!zQpXw-*Vu5Cps+U?Z̦!lo<}s(m99w9i rL4iG( Eo5ʥHӒQm{ Ew{Q~ώH?V/BR((ޭosr ȑWH '@C,>=Qxbx$淰~WM@p7YLP 8`?)<gaɄb6} L1GMtu[ ߣAgAAiqKl7 "r+bV#V4|f&Xi6ÄiF4K ~Z_= 'Q:4BZƵu]M@ova0$[C6u,`(ɠL*W^-( >Dq2pHuMUuCeS7Q8 v:C~~ltW 1ڎ` 1FŎ3U\Ty(5KU9X c@t.mc;?(~)M *jEQJEgԿv]޸ >S?֎FY~0)J'm90bkp8AE?\=:7P ]HnYp9294Ls]sYZn)N7IhrbRtCͭY#j=l8ٸR$:I∭ʓ‡pN89XDĠ{qp)'s&U?eU\ o]b62gʵ*ގlhun=R8,z:9&~a],bi\~[jά{(|UE[PFs6o$ۛ%úsUah׿3H%P ! %~A9Ķ8cGBn+=>1/\7 ^8.Nk2pw`|vj` ݠϩ K9 >AХL tqya gW.weqFMKOG'?߯ %V&?N/?> (41,A}#]F! RuAF?9xrީy03Rm'42Gl%2yRi)-࣪8WI(Lŋb(SArk?Igl}:zWglESRerVxn5;TYsDџ&y>b0tF}CGc*%^ˍHbtᇂe_ʤ秽8;0Éd[s0J_ *,"Y릐B?/j4oqj#'j:\hD4£ї `bŻ[6Nu-Zj{vB0i|Z={qVY0b7iJa~]Cŗ9ʌiQUmu$lqq7tAYf<-Av=*݅ C@.y~9V߿ k8e L$a!MOBxE. 2G+bbk+7~Ꟈ+e zq6K),v PxzWM:bS-!$;2`̾0+>KFþn1:!Ȫ*vMkiBdLEխlAL="H&&Gl1}*'ԛч%>7WUlG-!YRkAmd}^vV abiӯ5\?y\TCk2cա519F-IFlyUd/&7Lc>SH 2-ЊSr2xL3δX JNru]#L;h2mLS7V ZA{&DO?@teJ=ƈ3"[!eF{#CUdYeULu'F!*5'N@@Tpk. ͵x(:(Xu<@:}GW*d'wiB9}j*nA#ij|H.8SZݵ$HS~hJusA:r@ĩTHhD1_y z$P-1[4>o D2hcM5ru/W;ȉ~ӟ/>߻#`axi+EL]"F0z0N߆(~j Rn%OAa2r@[^"-?ֽwG0sgtuܪ<Y ê *fu, 4[L8(b?:2T[;l Ap~?te-ԜūWpfU+]> ƗAmv `B <;?-{qs<{o*`9P/roM> ` }nj ٗձ4寽 8҆1OZܠ"Tx_-".bYleLD58> C3LozCߛINw GD6$P/]UvK\AÀ''W{dys!|Ք5 m5^ȓǦe na"z zc +D?)%ń,ue(9oݞO/vv}Or{DئlIv?XIQKM:\aZߓfOhyGŞrK׬tKm3S 1k%xE) 0Z3[/j8M_j KP}j|ԥt 2)Γdơ}lq&djtnKy)cxH[tnr%֘̇(l[(~)"a/8QgUAͦnKO&ւd 膝k)Z׻-I}kl{6>6oeDDD%EjԈ9%m-v\4L7~%҆FCe* [>uk%pq-"Vuפ-3D `3>DžsCa#y$QP *2xvx-5PsxOE})zq_Bmaw2Ծdgr]!Y3ëg}|8?ɜ&'1XV%X旴g{=*1uMϪx)}막Naa,QU`vz8Vbgu4MbSJ L*UrE8ӀK|6>X;;j4s%Yo>UZEėzK0MCSl<HkN&;j죞ir@vhܞnؚU~G)5?*sĮ4[טVԑ٬cL/xD߷{Ce~0l{:AI&/j4$4ZfQєwϣ 緈{Љ/_Eq^QI^E=' N9{'VCpw,m(F6)&#.T@%-^ڙ—-,zwpNa!VItZOz>W4>S9d}4HC>A@v^Mh`_Tǜ No$Ny@/ 3qq8ʯBU>vѴjCU^+ -"rgmĎ,d7d gCۗmuX }9#RI7oxDk嘆YNEqC:A62)bnѾthIT0dMJ]MӐ|JjGܴowT LbU1}@dy$.}u:׮f"|P]N[AxVPɰݠeAD^!&Vah)/ov\bso +'PS=Yn1 7?*Fy߳tzEcP`$$vDt^pnӭPFץeý;)i0%?CK#4zj%U2sj ItZޘ$oUsc%EUމxUV)HykǥiCZLNk]JyYtS|WqfB#[oՃ 9kf{ '!SEqS~mҬk-ijG]6=%Vͺ?fYx߯*=o!5z+Xf[9{<A8E.,t_tLDs]5D4M c =읧O,<_iS bqA$ik 7)Gz!]gu>jfcl("Kȃb= pZV_J$m?#?H;`iĖoO sL o v"><Ϗ >6 $ayAX7rB.!LFK xVa4LnƝ"$cvRiK:LMρBo!+!p}•?,B) p&Fũ&мhCq&Fҕ1ٷ"U;1-xsF[&\5cETیڞE f ag09dPr"i)$DF_8e1HhZ"k/8ہ`ȑͭɯ7J(]Ov+ IXzTuE{]P';{ x FAroPFj4dC!E%9fAo!M6t fY,ׇ? 0rDye U):d<*V J VBj-u5II$`'v횯68=^ O-3 ҟTL. 1wVʺ zk I%7c8Q`@^<]I9j$~w2A"ғ7(GCVÀ lb9hZ ae<0!Ҳ VT7ꩊEdjVOej\Q"OpѭL-dWolFݖ[ -m|`p(Rzq7Ӄ0Z* -M~b=NA}v 4MX&X`R7|吩g4V(70[:>R9<nM@~>/W>к?{ﴑ 7@XE5nb$8.J0N~SATb^-a+>lҒ0#_o$Lˇ{q^Vw>~B8k%"5(^0Yݘh{q2lݰK)!;R6:v;1 U0 Q9wWC9UN x(>ԇ [MINl5"LjɻH$14J_]C/ ٝ<d;-G,&dom#'.3Kl88ޫYE5*$Me5m[[hMҀݪo55gύwZ&`T)>gLSAQ,G$#z:2uDܙrbøQ&0hV%38U1Q /PA)\5ᇛ̚4!iZG^C%:u8S'Ǵi.09޳x q| Mv ط5ēV0遄aɒ%C_J$כOyf?ӡbe;äm0wڻؓ߳ZNSϏl|A1D'%"`ڛ!.߹zk<#3?iP_ -E3%Thu;&(]5ms~{4sf~j{x9 \ ,Q .[zLTR۷'m\^37;`yVzL*quc—S, OH~W2!Ɲ6'y"`]h^ D&f'ZtǎFL?"ިN:$XPtEON~,m;VM 6X* yV һ`C[4Ꟛo cZf8N>$3)Ib B^A4AU3HG>s_,7q(%6<9,UܻIٺ%8zq} `-6c%_8 t5W ;T[]K!)pX6{ iPSS󖑛BuVsMFs %E{Qs RV$s2xUyWsI~l|;9!!?%ovJ:y9g*gqΥa~˅1aXa`WoD `w)Z? DNg +KIeݱ) Quoi.aEzVW I#5%RfiW-E+$A լ,6$o mjQn],fm_==jA,O:b¶Vo3}sgG/[eSA] _!YN+:mݲR̵^B}/JjuoFb?*l4j:%B>hs)c^ =9^^}geeVZ("¦gO>pЬb-=ۺPqbA]V)UHٵqle(紙F 3\ȝ_8V @ ] =3V;ZӍڃP8[b͜i\%k-&S1`nį~Oe wILu(( "e'+ج["cFwi>X1# `)D `[&٠Nد"t"R*ΰ&m ~ި;'2R|lZݝĚ-/X(lK4@ h` ."8ۈeF1|nrB\ԖCGAā+toVq#yuxX&OT-A¿؟`rщs_@LV"XeU+odn#=E˴ā kGj5HqV5w%@n"C ,YG)6拸<Վ@tfonh{=<(;8>|'PkgI{hѝ:Cuz }B ΧM!}_Bg3(|֖i) ᤛ̛uGY|AsPFfKs&-$]> ?-uh);A#޴A[)]%9ƮHtS=p6B~'n P@OO J1 T}teU]0 dB&lR]"i0lFGZN&:DݼLD͉Wo]R%|69j=E]cЏ~44^D.\:l(P~JxrgZPL/+Ezcs4H  Z:lt6xp+ip'b,h)+ôZ!T50_Vl*5ؤ8(6ȷ!bARS%#V ["hhT45G\%^:<T& ϸO *jIMU(3@ FoL]6#|HqǶ(ɋ % ¿78l]meǾ/DxK2# A:CQ3Χ̌$#P`#0x<ٴ 3a\6#d\dDZH0Պ±SY7)4Nj[R\*vP~O]٩\bQ w/617 NBցz|-PJCHU8{-`Av= 2Ab}C}.Y-ŦC4]PbvZ8-{үc@uoVWĈf\ YVxM en5y+>QTjԁ.jYxԂ x<@`b!ߞG3a^ R{( k)Pymaq%{/#k wTƄ-i]?+)vJEy@n"߭lqgW1>P%.aGS?EdPSx"|MqqgaPKRQ`JyɤX*l%8͵ _bcFk/9EG0 [==6ӫ0L3|b a`+"ݔ~Nר@&IwiGbip^A7]X4㿣, % rf@-ʱSƹ(4&2^+݌XpU *}p4Fgx"9ce)#LX;Fb|.OiiP䰓YG~f_͛E@%9,,hq9.x*[lc!({6[dQrQ #ԟcc==T-CF/@aBoC-U'}3?)]:H)D,QDMy~I vʆKވ#j.pY@1U4s |QE/WNe]r3ް&?& "BPʳNy+Aͪ+W9J)!ɀ'M S%N2 Ɠ^MPA+ooeZ+7 sR=1vJP~ Ee]E՝8aAoyԮ~tIL*F#@Q>&3rӖU%h ׀T \` s09OL 2Q+Cwl]xZ@ZJ]!nBgA|XMȐ.>HG6Yvj&_9b/ͪnH6W8zkbri,g )\ͻ %3ы@aJzfau08 afu6dž y`O^fLjUgu\F󣄠 )=& EO *2W][<)7ݗslӎ@=ODh $%U W. "^0пF]ltҪ`7];\W0h\ )W Ue pKwmW2Ep:k Ricj}{'EGLנFSqڀ"<2^\~j2ſU-INZ=;ώ+աVmJz{H_?1Ef}aƱꏚNI;fϚVM`, ~3$i.q}rdzko(0okY0knWPA=;1Dhu#tlK%K)&3TS)/"o3Z M\5B6q۾U a۪09"k*!KK~7(F~4.*ft{/S :yq{pv#T}Pϥ_c"F%(&kT  7LD$p,z=\?%$9w=2ݷ?_"&sdDWSqq|{?Z>k3#V}B)&jƌ`}aǃ2q'l9@؍a5+ Bమ:CZ׉H%&]d!JyLuPES-G* &otk,5.Rc~ωqć1 %e9{]H?Ny IE vW̩;"%7v|q9vԽ0<)4zfHs&kBfͿE*?LZV kT9GEEJ˚E-U*WҔ17zM$8(g˶" C.4@$4 Gh'HkI8d]d$½ (}Y5BKޞ.-^ץO!^ #DKlgpa$|Ng`Iq ԃ/glUit8ĸ=(^v~ Z%Mv&aD>y8_P~!v)DJBc2&":( SlP#ʄIN20JϡaS%趃j- \*,3e/iqXِc+a76BϐVZUj@Cz['h>W_:r-y \oPb-.%u~%VD;:mtrq"5-֎̾ SW+ݕNwE @ieGX x*?yL1AđԚ<7(* "FƓ- |uYg7.> jFѪ o608Y0$l5nW/߫(њɐh ?rK!2 ηÀje!2%pѨ/ 6q'KjF,fT<A cirGf "t eC.CkSIQ/O"޽nӐY8~,ꦹߪI9 tZanrIĐtxWddXUkBv/ӽ[ qw-b@6 -WXik)by[Zi iaW 󕞋 7!2— )ͨCSz3AlL84T_ ;ټQsVA |G4g#n/!9!L} T)]$n)^q!W0K;gٷ^h`_~kn6T{s4U4gb޹ytR_xg]5Hó͝X5kbQ#t8x5%3F}~}(*zdqw 4M] 㪾l7 QՈXxk[L=a훇C&sz\|aCJ2Q%dLj #C}iSQbvV`96Y^;Ћv62g\)hu [KI|i}7n3BRZ N'C؄[V U?ݹ=UL .i z"py:]M.)t2K]2B[c4WHH{$ew?SɻM웴,vEI$U̠ ͭCVwclK#؊nJ<6<ɐ(Z< 0Ek %@Fnظ̛ڦaڡj %&G3cgsLJW:3ws/G[suYRr|mxHџ}x߃Tys0y:jאa0.h=c>e%%2~XOd&핦!3ijV[rpGh[ z8?N?dlB=M"?skMp*"'E:[i*X\xi9D@N>e + ~B:W\z^ ߧMr,v|2YE.E@I`F-axAK!=yc[yZ@Ґ u>9z ;7.oIb&QR5E  洖Q4@RaܱKڐ#EE J?&1vj—g-5~fŤu<+? :kLK?":A,yrS&PDžLˉ ZT4"֜ynC*jC7$#Ҁm ]Y~)14t;/; }a_R*+|*D+3F *Q㻖"\y J|/{Q5i9 H}CO/|M_ znN C1ے9xU~Zh=ǵ )ɴ\Af|7~WmBWZn/>~>(7C,%a11M2Ttc:stxC1G4_mMmSPsMĶ%SnIU;ATӆ9uxjȿ_ _|{ƸKC%z ПD-=<ȷr ܑL?w"r %;뫜5VjQV娔t9ʗI?KkuU4KmVp52{9ѳJ~C)R20~<й̌}MÍ? ~P#u knޏfE2sn ^dHf(9')l$iVRABJ<8p=R}ҴAp_8Į.0IwKV~ ZEE=>"tGB6YzצӎG|yJVFAnHz(|9Cb`:Q=9{ָĦDtIv1{ Dv+ʂ%O;oTGU"=@ԍ/isT6aw^p䄌Њz7֞ۡ췮xGu1-u;`_a[l@ an>GW|!rf$Pԙn@1}W41r4Xm 1&S͸$Gl mes}eST#"Yt9Ir K㍝lS[;jE[Ƅ&H$3E@t~WLoNؒV.ަ Q9)VZ-|M{4p)jڲ45@#`!>h+! x%nHq; ig uԶ=GO/شI;霅ytM}$R?=$?!o$}{[0-fFhՖwNm(!`o*Ѭp:RnNkI8;@F!xg5liG:NkPEؖ &anCy+C] ~7t yf`h7yE= L &?ݑm O3qo,K ڶcDKZvE^*?X _$]1"\ѭ>xLt}RdCvDkh`S@&)0Mcdo>E F!tuZRJWh CX=]Dw2jmB&vK:5cNw22[N9]Ku BOPR4l4Zf\ :#88tۍ|0M O"Y@D'ы5څ1Bbr׸)3@`2p Vd惆Β5x]ӒbJCɑJpdzTtZ9w;Ծ@X 2k~mhSD<ˍ5;M E؞` 5\fTmzkz]_2pwlorY#N"Σ8큇ݕjٳ 5tq{ V3lXq %{ݚB7v 9'ٴJk0vE oz!Ѻ1糑𐓨s3SlD̿r?+6oiO!7Нti -&g@w,bN%P9S-JU!Tf7#yp27Z@<@:4u 4)i-2Ҙl[4ԊdSᶫΒЋbUog,۽^cig eS"#;wD"wz moܫp^w^䬛5#JBL \Kn|!wiϭ3I ٗʡ -it&>g vm9n٘Gr/=`+U (A _GWu–l+5*kSu4]Gwn8׿\e AVb\6N+`_8f:єcD*υ/y;Մ^ձ'y2*fڪ僠t0ؤ6x5ڞ>#@Լ[nlsL X'j DZ€ܱP sJr'4EZ#&2 =] .^Ku%{on=#%* \`|؁F (V-%5El͊75ISh;t,G#Ӧ=OO4s5WW슕v+ɢ- j3 d/U*GBH+ /Qy o, Fq]HzRB4/#vt?nn`s~Ynmz䜗7bw!ǫM ʇzsXǷzJ<0lw#,}Y*JJ2Ǣ-t9:;)(-_,:!!{v3֜cF} Z'oNkϡFц¹&sóPׇ;u:|TJ Jќ2by q;rVVdBŌr ;" O m\l)ߖ\vQT?x+˅{3jXbVAAYbLCY+ e!jï-X"3ĖXzӗ-;LEr~oHF%hgYreL?ЏT>M;:07]Ngq=$`OVpfسҹY[5\'|j.]Gg}lDBIp j.9ͣs}Emm^wolj99"L_Y:xzvbscuAޔ(ҴNdQXC -֚)ȴ3=/A>(<فi{M\ X>ekX)(){@No|*nOU*ci62a!A8e^~Nm,6wWFiol r5oOOx 'ߊwPX5[wO{ wHa6$k}84€n=`v-OH " _>#e ;%"pUw≐I}WL 52RwU,KaF'yAT܊:[gپۄnE(mC_ᙗN%.oz(8G,A4J.hrXۅ^c1+4j".AWRf{1}GV]+no9$v(,돯%!B2H zE@4WgUx.8 35IE!*^k}6 57jmS*@;όA?l!L5n-u 0GLY#wޢؒh`Jc(D p2z #XrCF]ML"kX y27>jDXnŇW:f jO{tՈ,0uR|3ޯ:jHW~OyT ,.<ײZ*t6h[FfM2kPM+C=|'PHX-\! ~4"OO?Ǚ8g:R<܈ ^+Px~ M>C_ߺ!]$ܼ>F~"6Uᡆ.nA> <$؏]cLvCJ9ϫ*$5({=gFkB{\Sδ܏;j%uV7ٜuoP%X-/O2WXa]ЭݩMS3&wu3UB_4 NF9p!h-x_`KwHm&3l96eκA:>gB =x:mv L蕠*qO`#Q3Rj0qj(~@ ue[r"1V2ϾNJUv27\F𼤋 HRgL qvL?Z'q:3ʑ!K G/mŔpENVmodvtE<)M?p_fކY~?([WDKU\!nK9$zR݅shYwRC߰1OA<ޯي ϘHhteaC& لj8P8Q0Lyn^yzY늦flhЗy'Cq]W 拸wb[+߼Ģ,#(YjgY-"MYe7)Q.*~h>)Ƀ",s8)ޮ۟"Rh"r;*J2GE7-a8=gb3L>\H0{閑}$=*k!Rba"c7)ҜVH(o2Ta <~')&⨱TN Iľ,NF4^N2.>A5`Gؿ*-6C P+c doz*PnuџIGd屆ܑ}]O5f&QRx^a"c-fYbîu$2L38e> Ԇ`NW3?X#jϻEΉ5þ(S_$b~ Fn5R@n; f_!6!>9M!c\ꉊ!R!N#vOF#tߩԋqT4y/v6bBp^@;ɳǚn1瑢xa4oYM\E#xLJ+t9R8n˶na2 @T QٞƎh 3_ ha*o_-wS0'n0y;[M4H0J]>/p}s_F;& ?vmw +4~|Ely4>)MUa$<۳[+IbypZ 5d0o$R` ^pPT,eH[$}"g$?$FbLq03*l}K *:aR]\"\Hw[v+zG;,LTt0kjykfcK]kÀql0nKk7IJ ͒S="$4\svW扗#Cz/841yh`Vv /i,]µǘ*M:SJHꬩCxmjPzPwy908mNִnH?RnKb-ƹĜE5x$WԲ;G;4Y#7 /A% V8$g> [<br b/gG9{:olD*J_sĩ iJbC6SeAs}p\X`YVt)⫣wts,FL⛮)w'F M KlriVwU l?7-?2f2aہex& j]_%{oԟ/9"S<-m=6|Gv>Bp ;qk$t$©; d_&iwoȦŐ{(~hJGts|DE!)Z ';,cmA擯hlNzwӶ;0 n23%ˊe0TKyss4h`-ax Xzm319"[Kp W nA$ ˡ ࠞhP5/ű;ӁBg#j t=u,BLVy歆zDoFHr)W۫gï \1E|;D1b+/?}V4_)T>sSEHKg[vr˰A$")#LE% Mi+4݌`GcjVN /YugзC겺Pr-I*"wIn9m"8jl4Ae_T5DħpN~+qjNl!GdJp]X9 5cx+4|ݤ3ޢ)p1uCSAI7yۡ%?bd8~>G5@b`Dz5 MW1\sz" V gBQvQK7a>sIJBB(5'Tvp9Ů1H)rK4=q3^49@a^ei9𝓋b*~NIzveF@5_bmsD`LjHw]Sؚ|O쌂mV.:>ƟLMVEig>S s޾pdRFoTx#{nh gj!x>07'm뭵{RVHV+ 'HzCbhH<!85@ԍ%EsڟX#8`%E#F_r[}!-{\^J~ny2iP!9e*yvi0>_ Fh>$YHT}xNPB¨›c_1Ģ/%Ē >3J* nF9xÉ9Y2=>Sr ,O,*#uM`\oޏtZ--4AAeI4-̉Bv >g6Oa;G/gic3Frlyg:?fPC'F&?ERP%9۱{6`_|k&g2%`J8vڄw`!N Fp33`]'H\QJ)x:/G\(o׊[H(eCT61r:`.O`eץ<9*).ۖfBdwu7P8:3=Ι }έ Z ԛOY,7öѢmq*Vq6V[]^9㟻~wYS+[p_ nkkdQ>1=n"G.UP`j#G( ,ɲLNe7'V@ygI .ӹr{\zq!&vA7k{6wj[aªB&bg+g&RKPDE)\zPAFfE6_{Bw]gl;UgHk:Sqi8gop%Ƃ¶bpAы\~NQa d*Jw}HxB폺d1n֔@BAEt,:zı{$o5?_wE2vqG*x Xj•9tF 26[ݞ}zr|QQվnB+Mć+I?p咪fzc20 Gbؽ,S&q;D:輌d~^ \YrK+N8J i45p_yl}Xҩ(J$ sQK¥  !k`K<[C_AwVyqz^%?0]>˧1jNgW蟒y$^Rdj@u]/Rqfjjp{Tm?};vc݊'oYXC~5WIWTh=LS]}t  T3d<]]S0k}UnmzJU0zSByE3!TƼrd3mI|~N 6đH;❶Knۦ0uxˏ[(K]t&=M*(˛MH+h:S'+וc,ɤT4BQN(ݫڡ> ȻUQbCaq#EA S }D fKhtjRuV Ȉ6S>A[9"˩*6_Zdt_f}o~6 2-?AQ Pg.4Q`L5t*.!RwD^J5p NÎdY9r]u[YflS3wLJţQ XP n~km] o]Y0R\:zp=3Ny6Klx]I.9l"'Φ>lrZ*2>;(w9sxKƴ9CRؒ)nՊOIcO ^f.'azIo mzZqH8LZjS~JmQ{:_G̎CZPX`q}DG*oN#֭dAU^k,c%zD06Rx2OR/iTX-DoG\C{j0(^ 2u#B+c>% DWr/9S{ei{sϱ!d;E c/Jjqi,}e$>TM:FrͱlA37NmPرl1 i>):y|-nGC~b~P ?LߜL5Q Sd˒"jrn94g~f G42e]tv}ǫAZAZ>s}^aaۖv,>JF0P[Kp o ~B%HSD fԃqfq zSxV';Kk Oٜ%ufIen h[! 7MKe)B.&pY4_nq>/DS?!#>̽T1ԏ@)ẵl_.[o&Уeq˴JvvM@uY[#/KJNdHYٟ:G.҉>5w bV PJqREx\}K廌reʶ7rC e%C%줇"re;qpV%Qʰ5La" *ODV܁f=~n]Ex"S!?&K Wd&'b: 6EϨ"5< ܋o xxXHAu;- >2m]sg㋾n=CV@Uˣ 0:\pKWl6~:J' 02$Y9`rL{չ' [Oӈl?^/͍:cp4sRr-k7$>(1mzA`ܼ³rRBTb4GYlqe@ܼ!c($aљRYK@mUy"Ml]%8y,LةR= 2''NDj!AڙF[ۺ~]%*ٸQhJ&fzyQl-yy(#J9FʸF[!/=":Ѫ2E[(T"9Ҡ87LZ% s!jhdo翇BSVo'$=XN7v^=qSnp j<ӒտG/[<"?$ u7G&2u)%v~(li_2 +NA aomU1ߍ`oPAA{qq@q.jFٗVA &*17Ejx4zUA. kacw3J==H[I7xmOCbp*vP*0e`qg_ĬCd kb(bBF)XSlOA0լT)aU` L6jDUtěIw?iF䧢}Ȅ$z^Ԇۇ $B )"rlW կiZ,?B L~6%e,}$IqX9c.CX},,/aB*w0 xƮyIm>Eb{9`6܏9~w }W.\]> 1z+_}ᖡ^? S{jAN)KJI~+GJ@4,uWWߝE Wpe4V=^_g1x_l.|̜Q386eӿGUk,Tdh|MaD֗*<ЀC"@Y7b%1h0pϟr¨/ F]6̳y)>+UdE s׵$X?)jkNk%{jTvPϦNZOŒ31Sy91`vy{ҩ{8"IUv$3{ &/N[ qʡ?' VFZ?zp#haO|C㽺~5b{j໯*ϝͼ$=,ZA~GtfMWW RHK0K5_93S6=%C;zn(XZ\Lc~bz#=c%kD[EakZ:3}~X&]z"w7N|z%g}s?DoGHhu}5L|N9Lw#u}șX'^aTxG;hw*@EAxJy!yfbV! F,c5PlVyf;Ҿk>֬+Nw$3zhZA$ugo+@j)ٞ/Q %_vU <.J;,34wWn% ?'jrX`Hw,%XF@Oa:W)) X8}bVg p.LG ї $)\/h5!3N.tV0&ї5'PR=Q}G :R,K+G ?^i$5i Xp:ЗJ6;Ճ9iȁ@DMZ?m2m,?Sh ѻp9p ck>3I]ps)25e87ӥn(1A~˃DGDGv=PuS"Q6d`Pԉc5 =0K[V_߶!"8j~py)eOT=,rKFIH%dʱz< <0ZNl%00rm9)rj٘FA|iP'5-E-Qq%sL"SkĘ/8YY1dOH|<2Ʌp'j;ciTw % w<§?kdKtaX]y &%!"Λd׃8vyDiEWT jOXizjܙIߨgfeG[bCY1=btN~Sę/8[1}z{㿽nύɃl:bМ6$}lk0D2`:RnG!{@~<[O{">zO#D_Xݿ/sW\#̆ϱ/SY9 5!N;7ɽ40ClO^:7 [/uD]Ho9c,_<{[5$lÎ(7UBq+L*9Cu @x e͢.L Cd.a2/y *6.O}[&o+F@EFm)q龒">+ mB>h^dP}B7&Sʂ%g-o2q'ʿMR`%H]C4-:l.8|u_xQo6kvfČ|'];By%g%pDr Ko@,4?ÕD(k7e陕;$3Nx%_쬇9 Po3 PZm-3^%r^LI-c80 }n]'#إ [  ْY:=SmX,5V>V Bt.XMTy l-? "hw=uq"p5^DKмAi|R|K/rXC!-@#|$u1 {$l7iI4wqCUvO[Eo__I{?lwD  C6tnJhG 19!pr(e,P@RE:Hr 2>xuCxvQs/߽9̒oQHbv b{Mc&b`6BNJc'\:a-B"v]+?CGnaؒx퍉w3;JO05qkm*z+RC=uJ~|T*9zVwnAc[*HZ$p a"TNDFzr_ScD{m8Ev fƓ~Y|IZ:Бx&nB/v3anPM2I CK:\T+bfݞ{KPv%-O޳9w0ُO=rQpfE7oEU,a}0] bZm>@`Ȗ3$ßGԛ'8,<ޝ7 78n܎RmzL5Tk8$>dmx&ڭ "Yj [isaB"2newαl&Wh r:;ʾF ƀB 9!U~Tuqld[oin!d%zAƷx9c; V7*ZU߶[j, 4-,= L ZNJDMWր}?wď {-2eY>Ä&0jaA.?I[QWwn@jֱ1a15;h̷}U#ڊAT<wXu@R`/HL?X7@Cf5lCVFiTQ+}uy;1 |B4ā"KEx~&In~b0b/NMwԟO/ĸK hxR+bqE 5Ft;?觲 Bٽ-Go p$8r;0ϩNQj'~ފ&A= JX[{G{ bd4[5B^޸FZjT mZT%e-"j.q_@$9,&5Y_a8,K~VByb6 sNjT0Xk'T셾R "Q;RU⬘E.6,X`ͿHH,g& e dq< T2~e06G,hXwB,0Eè/=<.‹ҦS9umzѡY`3FJǒ V =Ӻ̨_nE|gΞ2d׫,o & /׼ !^0,:WθY-ɧbgVV(&+e333,nS}֚<5R8C7stX^WjD M)kM鹸PXc@^OYԶxIs-=,/jRU7Lˊ/|*hzOx4xB]>ϥ"SȉbP3H՞o?_SaCǸ_:ߚr wc9Q7) NJ@ԹeMlsΝvΤeLc| m!gtsgZ<ƤXQ;.\;C]:$?%Q,10byU/wј3bigOcBU½>+K:;w!G/vv+dhǹo*@xYYiQxF6$iУl2(<4ܧ{t5?(3`_)HY-jBehq8}*W%Kv4/Q6 oPOW jQ8$RE# DQݝ_, X+ofr7̉$NV:&KmJb0{e=jԵ!+`_͖7~8ivK>ZdߺcY 7H [? Chl_8x:nbD\^Դ|ҪjNv( HXͨwUwbNKvb'K Kh0Т,R}^gxF%~_ª}?Vǿfuʑ2c--bqC Г7Zlpܼcq,Fg v"x2'AR6[3(8.*5./Cqr68fB-ݿGxnQ_@7QA8Y˫_6Or0ZǺ{ډ) q[P{ dFCgj8:* [oGچ^)l>I_@aLX(魺xc~IDvq s*tCG(8]fKt@W1hC~l4N- };}yCh%Q(䜗:nh^,$t癊/~Q̼ʶLz mH5,y`od[ [\Of.tp@<\7R0G8lb['x$;G41{K]RlHiwj9FeKPq Lg%4]NqM(!ewA"`=OD$F%?S# x}ހX7CVv&ۃpäθ`#0m`bƧ_L2wzfUTY$uvU,yÈj)9r^gMN#stK.: Y 4FXsq>Z~*%DjUqt`|Jm=WxmNauBOOb̰/]R_Ҳm%7۝@L\+Fu_E军jѷ7 Zm7GSivS Vlզ-ZW@s& H[3*HASAEhڧ/a>f'^<Ī |^e^4eN {0kb1jp肬{)"D2Pɳ@㡳/nb@0B P HUH3֎OQ8]ce X H,5$0!9c!PdlX)ɛKĩF[8"pO'|l_ ʕ TVN*b>:5{_fa6{ m&o 7kOj,jz#"Mn'!XlTu#Rk3mX*%|WhZ5p|vB<АrZB{È_RX]i=՜j4X6Z EK*fu /@$'!R9Dlꪽb Mn򨇏~^z^1WRF0.6]:X2h@88|MO+\nwN1pǞrg]~@v/yvv-+>nlW[1%wOi8:B_\"&Uגb.ΌIF-r ['҉iYQ NȞi֑QPi"P5=iqf&bӭa 3E X+鳏@3Uӂg!vW7uRMf,t}W>dxb9Vfv}*Axّ+8ns:dxg8;1B{QWl"(=V {:]Xk|J {lW *Ziq<ٲ=c;̰E3bUwk=7:mx6f9Q_G{# rJ;>;v h­HS+-u3JwMx&sf+WðKcD9w9|O~pGL6ʓ k<yaQ.Gt;G~,.vc0x ֱ¦lgA)t^ub.g48*g=eIU>UB6iN܌di"+x SU^{gt0lg y6Ӝ`R4eH~a vk)|Eݑm-H)3^d[|ʹ GH D_? 4̐|*)㘙4 OK.0ZZsUyfE([;n[8}M % 0 JR!7,7_}{6]^_Oo3'A|20)z^zd7Lλ{tbn_Rm&,. rS xuG*բTF##< Xh|0vx4& ~NR%'Mc{!%Sy橯srpsKZMxo™FU) UkG9U/4jO?oZYh %:_w+p034p0xv)ȑ'_,a*]B@gr9^s" ؛D<)9an'7Zķ>q'@%Qݱk81c܉d:1+pp{^JeָOfHM:{fm*5⠦}D{eNb2Oi&Lz577ie_ &x7k?g@IQIoU` WYˁø=suJ8Rz#?aL+n Є=@Qq;Ա^sᛊ>2^c4ml`g4IJ=Ovt}ynYHT )$:0_r#! |޳: 4Ud>A/Vp]yo$09(& W9kF>mTٽZ 1LFhkԪ1Ջ,885ʃHڻWiR0,v =K|?>.v5eR_y44㊌Vӕ}H+Ȃz[|›h (X Cf1FJ=;4h.ggV(fA:ZH6>;I%X&^L:pY5oKOO鯈V ^NT`O>a32,?%@=idp} 픧j/IQ;Dz!vsGhy`FPD)!P(igS1&ƭ_ڐ0 7;"R\/ AzQo@e3j:57)!1~;CS}*1Cn񳲗 dF{Fn3辌5Hk`pH085I$Ofs߆\ʇMl4KB'$MDCAqq؜w^;ΎZ7+BrT̾<~GT-A#=lvcQYge"[߅_yFgd: 2 T bM.y+B6L΄0tZ[)Rʀpv&Mwd%v9 {؄ w9FQMCcn.ɐ^qL8oMew;6a͛%,ѐJc'8glPytm:qpo', v`l !U~DpYg/nz@FI^PkEm })[Sd:F <9kX_D4'UZ@KTeŹNQ?ޏ_gm׀nI>'t JEyPzMWdS_~4SG4zySq*W{:y6 uVaFهɂ,~ ( vw(.r >' qmx˂+ydaI%mW~8%;<岤QL>x$=i8Y폁[? 2m{2~,QΎ1S)U6}Sq8hHگLK*cw0W.tA0?k S‹ugܟ4[hp|n!rVUmA5T;8 CEu88:W}!8I ~)]فU%M`Y&Co wi F"ѰPfUw1t( 4`vdQ,K{{#`Fj;*q5LUSⓁGfB ֶ\\DY-|Xej$Vɿ/R>zG+ӳ -Z3FK>pjh= tSd4kӎb R#Ym*z'| p5$[o˶NEo9ٵNLz`mPfX`wLBb)N=u-4ֳdkYAj5}LP'KG w[B/N=(U@%hp!"Q-V%z:eݿ~/]a&9 Y4=}xMFu̦%FNz\P }W Y>VƟfUH_{詜QC۰1Lr@AG,fz%h*?I.LN5>~9:MӨrA-U'9[NHh<6 zd:K6ׯDCop<]dGBSd5\,5oh+bGqW%1*0AX6q Zd9NێtV+߫Lˆ|Äs*!B _m݌eZLzA ЪOT ՉNy/圯ܜLnVG̻ޛ|pqXg(e&);J8 P󦢦8@.BuP$ɴ%0"ep};իJ@i\d嚠X_㟜-ߵmb7ZxXIC*8{ci-/"/䁸F pDNX֊zհy3.aK)Nfg&{ -19O:wKC 5\\abji74J!jtT6B,8m*)bO L$e"wt ϱHksHJؘiNj*;1zǰίTlI\Wuۣ%-o$JR6A&$W'wMr.̈!;y.eFf[1RW|^&kطQo ߘC{fʠf$]IJj3՞ߑaϻ Us y=m?xMUN%a\C*(ĕ}VN{woD4LOre7 YIp ]Ĭ^RT&Oe J}T@ouEħHuzmtD^SUJHirF̓Slp郓746BUzz<_ӱ<{?t' \7 7#"1OU3q,m@B[Ԩr2Kdžd"P`Hi}=*W>{^?m0Vn<>b p;eeҗt qe+l-y%E@]h"|4@XJY q9P?y=vSp`g8 pfMt.>Gi[<'RDݴӥ%,"R\"cM1B $Q65nqGݞwLQ[yjmF^-z$uϷdرa]#FF0S/ g/j6C/pL`[!h'eD2oN4h֝[QPf!#wO +/Ҏໞ9S#H:1mG/MN._N`#w²Yns^M^LLt~!b/a?y_2nE7gݱq~t #Ux<s;pr$"-$eȍ`nlK?asCS`7b j9$T}񄯺@} PN*^H`*A[\[efZ ù\G qQC LBjXWB<+"9%L 1PxlOc5E ֲnSꫂ+W!?oǍM؇1Se,Q>|]w_F >C=cQ"4$Bd01V@mصDaTGW#s.YhDSK _CF s>"2Js/sFFT͢7b?-I#U.b|P>JSL9{9) 9o=wI%yHut(K@&d C(ځNM'xᲕf5@.;2d[! q pw/k usV:;*Ru_WoCsH!eRߕ}8^73[84LMr6VDѭB``-ã^\mF+x$$10Y2O8ӸS6 x8q&--E"6:T%U[׳<`;Wce0RTrK64 Fƾܝd%\P^BBIa` 6w#(x: govGNB>43N{ %-,F3˞[C+a~]gHGN̄},ٝiy7}*`:&ÔF=$J{+piD j9eG͋H^#kyw*yH8Y fiG^ MߵH/(oG#ؖVu\6IgRgC MXxMH4f8531~5#VSR!X bCX]i9 tR]xN;}N sbpSIa, ^fTI g4(p3Ѣ;F_ 3/ԅ_.nM/))<14Lc#ӖU_+U7^hHlHe5˜sdĶ2Pc[^krf^s}]"1ŰF]ɷkVx>~dʣG#KNZD.!usAOG׹BT͸le=ML˾{kk١ i$ƆO95=]BVe!4u*?+|r$eAC( xT3 `\ *yR m]͹ִ.;9Z]c۞p>$I" uW %}# 6el]nYCz43^ݽ_y}-<&2z-=`O*¢4+^ø*x :R)F}?DN]fYa2q 9H,&vBghP)O78^6f<;c6$ǂ%:+)iꞾh~1A!F` EuǍ5`0yf^d 6b^1&ޜu}%َ_ ^|E)Y͑ L T?ijv) o| {_,8-h g?^c#>08 ,8>O*LrٍfUTZ m4 ZQc*WsBNdHv`!+Vwؠ7JjaJ%WtyB&Qa!?b38ȭFRGgiKo+¥hs&yqpM.| K`3E!1cԇ Z2jd>bTy> Qڳ[:({76ف?6^Oh>1-;*{~ma1cE=Ǎ:!ڍ'I3Nr2x,L`ZQ:uyHضs1tYe9KpToAHg^`YOsq {4UhL 83kVC ZZ"dS^}`F~̊FfU 9%c9?w: { dY"HfQofF=,R klպx@Ȧ*zl& ύO yf1jU[J-< B k5Ust8k}LD֤i{U=CƏG!v0uSxe_+hO*T2|V^4DVS$sզ =8U㥄gw`J) _汝Z"3䘻d˪iqcgZs_*L,]ʏqANѕ6,@-X@" ۤ} T(ԁKc oԐPZ.%Bܗ>DrCj&倫̇CMq㰵ehb>\0L"gPnbѻ[!)4^Wf R#dJJQkV4rb.AHڟR6U V ؖWchF)k"-ѡW|E[D3 K12u_R!N3< ě)F׽S/FgoDOrK rԙ G`ҵIʧ!|h_/XFJ5*C9-hpl ӿe@$\WPw/eGMGm꓍2}^)_&#T3dW}1oأʵ7uRnϑubDWDiD0#'*JiA@RZUtx%IX3kv-5K؉ _rK0NȎlɄyKVv j ,Y}D 0e|#ܴk`;HbȀ~.T_Zix$ .KN] 5&Qs("B@#L9y䌔!$z*(ldlxV/3WbM+\/4մ1ᮌkާRgadLlL//:1e%iJ٬o[klY3M|+= ͽ)1R\(&N$Y̺b܎vw1# & _w~sۤ9 ^ 2{5㈩t˦u5a࿤ [4®R/(U8P^{vL]1x o {b (Zړ8qw@,'ΊF`>|1wv@S=:ݮ?~OhPI TYA>婥~.C}(zi6K UAlX&]_=,rcڥ v(G>߱W4XѶMtAw~ɐ~Զ‡ƍ>b'970ʇx;^>WbOqH(6kS i\PjEpVsʨξr zC7$@Wc`ʬp$W8aR-w$&LDD hq̳z\Kz̉eFN[\1KΝ՛wMֱPߌ4i,3KdXWӒWY xC˻Y>$HCf`Q4O?xJ.`fbϓp[ {,W\ʪ/>.djwUt$bK{ ^OcNBHYP=Y[E(r1qLWχLF"y2<;!8aX.3OHPdf09>I yXuh F-Ȗ~ 댹 GAbK /J(3?$3HrwC`,_3TѶN1R;/[^k#bv{$C "T- cw0B~4J@% hs.X]ʆˏ2Gn⫱QhI^2i #y3,*З4:: W;"CU:8jN2CQql#-("hPr4ɣ'9~㓷yE 㥋a`qg7q=;1 Dv=fhz:֣WnӝWkjڳ|(S!ƲF JЊ|uU *dl>36o3&A-XQf)zMNϰ>h\6MG"uU {Bmwuj.6INn0 77LVSs:"H;abA%ER>R,73fAGGɿ=c0[Ǹ^t y֖Qk7z.9Ã픶?P4@i6 +P@t$-RU=R^ܞA$x!Sm"! {/#{Hxk95ƫPL`R;3L˂$6(w\,*-p} cn+" xC^~ovpc~;6J\y4%"e2H6au09w8ײ;3Em~"Mpk^s qJ*hN?{mNbI$Dx슚not(&Ϭ؜D,b?Ao(D s?౅Igጦ}5K dI#J8ant0i߀ǕoҲ}uW *$& c>8ATIzN=#+-Fhc9C#lv'q{zrIAc u <0UHmu+5P%H Kz9Y;|D 4j|.,aُ O M!iSbw'h[5tuՊӅh9q_c "tH@{4рi'T8qȣGj먮ݪݮxUfy4݅Z̼n%!_[䄧ZA d~C@vj'ep& w ]$d,cm!`g}syOQ)cMIZ$2X%鋃cjSֵef>"_[q]yfˁШ; \V T.|X%V&ľՑFǩ)IwP"-~eq% oۃ3izִbP3Ҫ|Y<3mVLcc*6u⼒GECU&]=TȩOzVWv*CdўX5v"\˚luei*#BM[=%h.̮"NRGERxfnϠ+yoX]BqlO ;|@q%| yi9|\m b!۸ǐ Q hHz3:M!" (VKVwؿ Ia׳LK`ɘ9<♰_ %@(SC6e:U> U (IϽo anYt'ލ=7*< }?"BţbU d (BeIPS\t./WHhFD̳$mZ/hȍibh7vXC\aYd8׃5hrZ*m;[Fȶ 6,N۠WGe Ic׸AOڞtxhiπNTlgqȢ$WOXr待f'x</0H#Pp+; l0 ~ thڈy{DTiSč[lǿ|m +P+ks`R[-_uWc:aـH~@ q@w&a%kX~4HyZ;+ Zacq xh~>rH%W4Io <|3onhň8: q%d]iҼx4ǎ0|!Fl^Tw%.` W G输CyV0(P1PgJQTVkd3V ^:1=%w%7OHL '6NFNkM7`Őh}Ħ/6aߡ?Z#F WBȆ6/ȴW9gt> ėmz9ih&d #b+z{(,kHbL%nLTM2(A-?FҧprЁ *:Wѳb!GLݹ^xjopkb3u%t/]QG$d/J,`.o-X<|^"u_8v7Ne]FT`Arr ZQ k- * uAO0P +}O@"bA2aNʃVEqJ?\>5#<C`P5#z [rΗɏiH^ز8wm85Kǃut|os#s}]+5ͺkfSyk1PAZbeģZ&LQS4lEDKIt'*"6'ҧO&}Ͽ"#A~.s uGax+U:GoCX Y:ܹ_ᖚiKe]%y:y^~P'Z΀\#+]T 4]⑕C~?@ A-! jHz%E0BcJݏf $IP=}9xegM7џ̔QdH? tx^F\uVfdy3 +!BGP-rp-6vz Y1-;';/>JNK+ԬJ~4 Pj_{rqM) s28.Kwg[EJIan&QLYDNǽ3=Ҩ8awCNĘ£,ĸl} v8LjSO4XJE?[+0b#xIĜk^LUNT 4J"rV-.VTʍ-ԅ FQiGG0 H T+<am* X(JRjȻ翂(/B8:^a`-s{?^zHi/X"V{uJ.+mV_uƧWf5 l@wғ9G|Zk&QG}[Pc9ؿ j9 DHzb_S.#!dS(SNf?VR+CP$Q KYH. (|s H ApCg aC*f+t| G =N x yHOA(fpT@=pA+\aZћFe3H,)t3*29?gvi|`Ҭ r%=p= 7f,kZԚ?VL}xp J |0߾[&Ŕ-7A$WzRո#MhUu Q!;˾ X>tp:\7pej-^b*D1Bȷ#d.--h4TmlZ6CFG&42%dY+ $|$x)97UXP 0W/F1%5L/1`l(1޷P&bG60E -̞9kKQaw?Ba!׉oXOb۞W'j_i$(:VSHV`Y4VL䷤0`g CxIځu/c dn A:3Զh|o$Ĩ#5P+b.(0&?[,~0'1KIZ,Zќ5%,с'TWw 'P)}D'ow- AZ <E>)<4t]˰z-7(9<3m|I__]:ugp^F/ Ʉߢe~Q8λEsJ]@M(>'djڋ;| wW/b <=fۅ:ϓ~)hTi&:~s߃r3B\D1wcHe$}<3yKho!WZB"N29Yo(%H/^C=,ՆpGN \ތ"ćQZͫe`gB:`R.)Xq<%e@#MAYiٴD]H&)Is'vH4mz?0ekExe5 1k<nɉ#>͈\5mw(h֍oaBʕw@?E,+ vUaFjwB@%>tSAKAV.{@e^[". ^ i_X.O,W矵 \_Yˏ'PG2f/#n{<:V2:RJ7dH)]: Tn.SP^QUq%J[nT'=T50"fF },W#ń}I&1`&D.]d@ZQN\w c3Qu%~B`E,繾"!K-6.ZN*o걮Jٟ87gmxjA! L yV6o'N23գ#Ġ?tG⥘/5YDWn1HBXbd+)!ӧ<Yw~QǞ?6H=TڑcGX7nKn"}@t4Aʛ%^6, _'TVRe؞r ŨHU?O)r @رuPQ,j(x|d!8[)*A46fbZ!9~^+{tfW{'UQ_re@rfi'! {x7z7ǎvj;=iM-ɥcn4DƢ6mGx5sVc?XNn!,Tp8vLZٴCV+VL]P֎;XZŌLJrw=an BrܘIP-8Th,/Ϲ(~æ T::|s Y:rlNh21 rsA?:20rKHUn\D, 0/#G3!n7I`M "#w0vcrhiYi{i+@bk0V^H #1' eCw t.7k3.6ʓGFȇvaKRLbu+q3 fsې"E !62;I$Wt },6|SֶTFeM[~\bj<3} s}++Lou'~z,(*FI-Gbp @[,kf4OtW'[ 6c:zVK]FCtdEJ5^*Q;YF"[T,DUm>D'[>+7U^sJ=^ XV^t.4j1NP6`(94ٲUYnȯd 9b|CHkCL^$+SJ<6} gdD&:,Tkqk-j3iKՍ!߭=Wx}8ehp.4- K#zÌͬ "V$.*V/w36rhi}@ hyBZ4/Ńg^zg Dr~l$e<+6 <l HNW5J'n6ƑD焢T0sڈdi!*R]Fيfa0B|cjвW+o~dSJ*T\",PC̯!qF^<+/@]KV v8/xyD+ 7Q="f^EPጃ.p.s1V{ۈ͋7 evNQx7tSG:ݿ ÙpJO%o< >`#aZXM`Z !Mv<7HV3R`]t^cR 5)MVdWŤs8_*)`NI zq:b:C?SͶz%ÙF`_ A/'(lD]YQ2)t6l/BPn$9q ïჼwXb,$%n_XMK:|L4 8ap C!lK wOu7P{V ' k/{QeLn"ӊ f7ar4x/&r#lMjEL}9K'Zϔ5P4Vȝd֛Tn (銮nw xFl ވķ~g_PYq&|k\KOsA=? Ԕɪ "M3[(X~=mc?G%TLs 6ٗ 5u `44׫ ˺X ZIp46I]S_5c0*Ύ,& AeLa+\w^$&RG0V[*g_`s1zчm]'C1p{C袥C?Z~:J7sF)#  ]3Wt{38։oh\TFJ1qӹH0, RO'&Ƹ ,Hs%o0GC潨Y!/Id#`_sqKӡ3z_-o\#cR>F&5G(_43A*M qcXO 7Zip*`W $Z.fWnqInx[Z\ᆲ8r"yFgy  fl 147wNqgǖ!#cW˃鲁VTv!O}'f. ?̆Bə[9zu؊e^ڂ3Ùw#m Q P"r=Ϊze8բ6? H p ?ެ6sm-=bV-аCzB@s`tiр59:wtCCHXޯT Rrk=e#,N),\oNgXv58 8q' .퐑M4?zqf,|j@g37f4ʍNBef.Fw#f1Ի~5o]O>pD GxP>{Aa=* cmZ&rP N_,ZX Abl]O˲ׅN^FAɘ"C8ͶypeZ)Zt[[ 8kkΚ^N?Jӗ,HNa$L0s60v%LTv85@ɒ(ݨ)¾yXB !T=wUTO%BBwyRWKZpPF/l ="2%ùH?b0# 8k]!NRUJ6ً6:;i+C+˩ UlR tA'y!]ڟ#SZ߷ , ^9$LYSH,3h$Ol PTeY 9Ttdsŋ]}% KK;bH#RA%!MŠ-1; }qp7,tot# l1]n?.tXoy&ƨ\F3jM$?[߯ tg N>EJ)L>)i f|7.#Uvs~[ ߩge)>#}B'uOlɬbr,|GFKr ;7x)tGe+j _}˜ٍR^ECB ֧E LGeD9'o!TԾ a2/gA9,?%VcV/Xv?Yȵ0M`C2a ;Ѹ6+F#0+s.D u֦nmP?3e4!דuF-x m7ѣ jىY}].y'j,j]W[u<DPF\>ђ"':IM 3KkTVC0Јד;c0xt.xC#R0gr`سo9)S0Isa=О|7R>S*-y#9*jQԔm ['< :hٰ/N[#;𚳼9 Y ]8_5SԖHQ@mNɭVy 4yadOx`LWwFDyPR"HbsW1r19 }([z`ŪڞtmUH)e6AnF>4h2J,*᜞$>ZtzJMU,ڃбWΊ$$ޑ6DEBE|To .-|KΜ*2bpwiLQ#ihaVbp5!K=q[(`wy|V2QVխ/fugyc(HIb%*~_⦹P=w:̳MTSV&W S8*KM^&BH_ ?Dz^sG;thcUw{e갼'2)782@vi=q+ TbT6m;]NxA%`Y:y.m$bR;/ 30g#޺ٿeO0[mSy8W=w%CeY.3<ЭEYB|ΦQ#!dmy&\'J`byY\;E\G ]~d%CӽD}/ ,fl'Cͯ JFFQy!R"3#G{k|vKJ!Y`R戎)0ro *`\2N- ]ؓM-BJxX3&'~:"?AdA"|?9_/ ݔ`vqZ"ݪM$s)BПg(+Jpmw./r9KY ;G]F_u.+r3bQ$&+'gL}x: |B5P{(쬢oat@ >>}\*IKa)Avspmy5<&0t'e>C7Sxk;!ɼZ&gQ#A^W]76 #Y rm[S]6r?;<_kS.,w|vHr=mx.Vh{n';TzgMpNvZa%1J1Wo֯fgr?/gZxx߁=^V5i漎~@vaxS$H*qeihu_I. &2I%J%>LRVH)$^jFr4@7U׽*Goz;dH_gϐ/<ً t1 aЉY_(_`5)3fke#g$E(PGܴ'U]"$kmҢ,CLͰar)">DۋG4/فo5Q̙Z:h o jbw eq.oZZh0Dc &'<_Q=] i &G k6\81&ڄN8]a%8wI Q Ćv:!ᨏՈ-4#nz[wL4>Ǯ<_"v)NM8핸QC+?vP<h4u7ܲqGtv?,^_;WVKuс'IMd[^wQD|d4ZDhܼ5,|1B*`kn34r?%,x`>s̛@{VLYG< 3ɜ kQQ[GN5FyzZǢc!T #A N{k_(HI@93Ŝժ+QFf\ʄda}ǹ;ⳏaA 헨&S| _ϋz$.w{)M5C?{ܸz"C XVjdf1kֲa7oѓ@{:w!E"(H B;m{8|RRѫ{mDb]qe/&KoXҀyٵ>l#<ܹ)=j,ayRS&8S`C!|! !Pɩ~T<U}\)`1[ˤ[j܉"׍q(>cwX*Q|WEto\ ALB4CG(A/3d$f6s HFC:)f TĎW=H׉ ixE>r1)aK{3hxjWbrw~(_MgkOUKwf3R>k.1 WgL>QsDR k""xJT.] LjފcsV)(]ly,a/$@R%)4d{ZSYPu2lX7KeOq0-r)wBJ:REf\xGUƬds74qHF\#6_N=4`֩onX<r}H; `+4~U5l;ekZ.d{Î:‘M 5`/ / "!LRtMU%*ĈM_ځB*\}>Ö~tL]\v~P:% C {ֶ .XwˢMq &opBS55q&Vpw1wU&w@CE?[wRN?ϭYmrNP(AiĠq}*M0>T&a.W:oǽir7N;M9F =#9^4=mh6sf&٥;6 tE/ r%2ќͤɾ{q;V۾AF?J)<at̷7fm"Jї}zƌj6xKqvJ%n9.kRLԕ/ c=Y:v H},Y-(EЩ$LgYZ q퟼ݟ W0 "S }[a62ɋ/K+.&K%PNLdrT:PXǵ2XM޸Ja: \gdq=L1SjEɆR$3 0?Ryu֝hAF[sRx5tUJiL ƻ.격3eEWڮrq*-%XMFM7sqVs s)A9@%fbh h)u |-F?14 C +Vzp3cGLg5 :/Ng,TݹNZhkP$9X֎՗u2zzD5}Dȇ ݣi'Bte{[%v-6!ӗs fw-\oMb 3'~^Ḫ9b {]|Uv-JhWD%RU+!rUAmlJ4BoJ?]Lgy h+Z؁'"D XU:9>F7mOe?tEr ￓK9Au[&׏hjd<$tΒJEuxzSOA;9!y I ͭ5uD>&5&U m˄CLMt!"{$}ͯJ\v1ɞώE6b94/LP]WVHRth\x3B';'*wC0Adrv_N5*Zim@@8pײAD.!zg*VX]\>bE+,Z J%"CnG6VNE}ng2 ⟡?kУtuohbU+4 %"*m *h_Dk"Ny2(2eu֠SR?b,nnyzeR9ϭfڰesrb`od†ߥf-!sW eAZ=17R|119Kh<سGkM So{+-+Myȣ|ng11EX>H zȣ~R~^m*(xӧ!؟x0V/4mECo.eLN|>X BQ{>R_t de_GO@5wG4|Ʒ !;5k/ ,^dK#zIB;mα=Ahٌ۟p_͹?P' a.oQj.\ÈٗgF#f}ܤrmnp#-IĻr{j,L5(2g&IFĬ嶖fP7'}X\": %61Լ!]Ӱlmjwuҁz ^XɼAl#]9qMJ1Z;}8%vOhF* zJ 0K2]˷x؎9ؔXoM{}<5XI0АjI4ETM89 >8L*Z=(h#zF (pA9 +$0g|ic앓m4E-LkE4_3 ׼5u=nrqn# s% %~T(}&>B|BJBvf~|9/+F"W )o%(02$lQ!t$*fQ_q=rx#=6Z2H<tDãٱDgkaKq76 d}z"u˷G" QL!C#"Oxff #}a"r|Uhf  G6l2JDGp!\h *N_ZOil>FzIU,Bu{ '+^C5lWĝʥ|2R.YFtaM{[&~߱0BþJ޵Vb=y%CYgǜ0g~^cJxД(-vĘ 3>TU領.dng ҷtK(Hx&4! {x>ac I4w7Mc0D5 ii fVL W.JĜ]x"wSY\Nów_ F@"x\Ǜ4q99*xs7>ˀCTҋ]7naaa (Ell;u[IUD%)Ylb\BY8UMŪ zv- <@J2u n9qwdaqid诵LWKT5 DvtX+˛_ׇy I/Gg-5l,AI!5ASڂ9twP=r7T0L ctORIi#1.zw2gk)hs&ӮiqH 9{<,@L؉TNM/+(fK*Α>*}]A%;S~t3^LE3ODٕ/Mf>윺c p/;0^Vܶ<3N 5_C K1ב%-# k],B)AaU(o.5ݝK.R@A4|A;[#2RjMa  M*H^;tBe[qG ,o8p/{z0m2rp^A9yx`SChB:B紦U 6Y I`tƮ#0Rw+cYm,A'T%pI5to{5)q(,}^}؉Ҽ(u/Bt(<.r*|yZ WK 1$ GJQFg6e  @]E,LI$*9UAB-)W#Ƅ8#soe_5/fQF)ooլ{Cx*Βz(gIzzVA̝pNvnX3Eyø@qN,3b 'EG(ڌ q3`zi 2ܯsu^ owano<[qd)7_c0Sڛ"+0݊2t!S){wԥ~%6 j K9szNW*{8ju+4;h`)pw{u:{"!WN&V"WStg =8'f_!.p%֌D8:}Q4J#3AItb=l PD䙍?Wo 0B geј€;fߍoJG!-gV˧^3!vˈ^B`B5l2'>+ۜr*KB6T%4')Mhc¶TT?WHc4EpƠύYu&=TM.^ WVA[=gpM9UND˶H!#(V$q^7ޒhs;dY̑uW\3weI)57p@5SfRT1U.Tv #ZUض4*"5"5,$?@6ndUXQz?@Mν$fuN=A EuT`+GȶC2TP{3Hx9EsMa~ΝAϘ_z&(WͲR3,V.:c㼆7pxEj#4.EZsڬ2x푏SWv Snf}+oLo.(ҏ.Erӿ_>?Qm,4&aQ`v7F3alʏ*7r*.+WpUcr['T%hGB (\eJ= -$p)G^5RИ74X -~ 'l$',qnS([Q/Zg,? ɁN àY|Q"'(Ĺ۔ATP>|ԙ}Zg%]K9m)P\e{3],}*rזajD].d5;U\pe,Уu()#_@VM+.}Kc sMLc)U\ɠ #ٛs*(1Xىؿ!:J&MjXNm/|=]ûўRZNK %?t# LJ/7ټvWGYپqV4r9Z:Vܕ ƛ~גE(ɯFY9G6Gפ-6Go*LT t)~L?:f{+`/%,I-jG_J(8eZ"6[HCr!r?8m@e{ ) .H\HPP>S]o̦4={rCS<ʖMhSӖ!d 3FVӎ+>J=ºh=VKMv @ 6"^ϰ+ҽ=7`)\[IgfX64oV:OYݧe|!xgiIߢzij-ʥ-띶F[?*PUGol>P*бG 2؊[tdJoSHC,@U}3kC蟇L$0lZ#Kvf,o$S#}=mTጛ|;U/"v Lr$ 8Xև3؛|;1*i,#^  0}=Lb4> |;3<㢷!=s[y]֗O\tד*Lf&p85K!&T=6ܽh@T_!_!@)]!{mXjۭ}!k!ʬ⒬ICƤ-Oks𒫯Sgɨ) Yy9"ɵ ɤe`[a:T CS0JޖҶ)48N<><` 0>&q .fXDdqVzEꐍPWJ4G9 7^L8PjO0$!Tݲ;Ioee-UP=m,Fi WŪ$WE N Yi[ޔWjnTsy͸]Ν ve,VA 폂a9FP nw| 0 G%*짍3˸3fp:=HE9s֒:g;`1 [m5O5r 0jŪSgBۼ+ys~,FuvdAА8Zh,6nڀK.'vF({,a;vv]HQh>njѱ5ƭv<'xVO)Rde`HYC.eBBӒA;G.!5\ɁZy2/ĶF;g0+ j'8g0̝`qG *ht-I ^lAI{X) e9vs(Ɂ;6WYcI^\P%<*WeN$y?KzH$WSPJ6`8*i; FP+s=5q)(0cNm_ul{9"6xAQ?)*g¼WW#IU(֟x@&/9(?\:jG͑$=ViꬷM~Q> ;|ؒ8oaa}YZDC!s5@Y "i'q"\vp} &nj9|+<0t TnOQJ8xTMEP:W i* 4^5#T7j(.$H ~zp=uy:/}Q5p|}.&1}<U0D> gxDr.hVqG_0J-ۋ6MQЈt}01HF %|3tk}NqH17ϋ CRrٻ%>gc$wrc]udC)y712QH'qď'zBWUPIK lPuɪ9/>M8rO)--pBf lM $WEj^Fݟ;ˁQESϠ]ߋ3 ȥ$'hl+ 1_J#M,8>Tpu*%5 yjk3#D@>c$f9ׇ5rh9_\ǶQ>ۭѠnusZ` --Dt[L8F?_E3AMM;h.9 &I6)c]2`LK":zal)3 U} Aݺt99%= &4A)O?kA܈U:D?W? w@i;ܔ7s~? k uvLO%¬D85rnװ0˨(CF` LjxOe4%jrq!JV߹/ xacIQjSM03n# GBs .oRt$]wյp:+Fy{_fwh܇D$ P ++d7l/Vނ $wjT,ʯ:`$hF\)k)HD3F_ T@'"/A3*^[ǒs壢 vKgpR>KuާZ hAim %Q)c*.Wؔpa텗 :!; ふ&j>֯e5o+p1A.@i#M'4ҙGI6֝dg1{8;c\ht;J;\ s򹋣/mI?Ŗ'y:vH+c841|O"hl2^&?L{#J!`vY$ڇ}E\b(2==qvls?_q/%oqrq0ܨU^*Psb⦜W̺ƌRSgMf˖P4]bH0f_U?nFÞƔagosN?5 or|@zȃcV]G+p]crSo}2"DcǮKTWjRD`nd(XpVAEn K$"R<^ILe,V\vQu$HEv&AYj(<=Sv r[.*7gV65 -!к gaE'CBmX \L墇¨x6G@\{ 4Ipk=Vӵn^pPHG@J[]'Hsa&V*#sDShU V5›rNѹ̞㜸Mg L%| ZGЛ5xXT % 'ű$]JXy~98S԰}Р۩jHh!3 &[H H%tl~[tiRMĖ0{4|!S/UXs'k[#{?jX $!Pkbh۷P#%pL'{h .w]8`wW?nI@Xrg)%`Q=GB2vp8*Q++>*'5™"2oG}*\0beGʫfC%;atUؑ"$mÁG\aiP~=Jy6%0 "#Kae<^eDbl# 5I\D%w5̹ڳvI/+ed~%b KR3Bl<3`*ҍOpȃfHDWI}9Gs ٵe6kVͯ]&78HI/S10QHYVNP+I/ݐ w!5LGلKlx;edJJ,,c.v4Ȅ:5kFF'ix.(!AӑD)Y҂v9lVdkOc~B"+N5O5y}{Zk[h"(cSDW66Pᯯd$l`80؊vG-d"ٝIPF+>pPBE($: pA3%5 #~L Ł%&;pɴ{ԉ8<{eΆT)5l#M>94xl"񈑆 e籠#:ʪtLDZ.4l rs=$*sT%:ϩy- U ̝J`swRYyzyap`]ju^ cw S'*,$%!lR8\PrK@c}U_6ͬ 1v!1v(]9rT\[,+%03H0͗` Md!ќEϢQ]pgLx"FJmے],Es1 k YїZuʷUؾo>rIr/ƚ#}cENMu[p54Ν>z O.8攉PbHz"#̯˲[4yX? XLR>=al6n1.s/?m$zU)O>c{z:SC@b!Gww 3m=hB4-Ɩhy~t4UMؓۉ9eK)z3z*y dR g:[7D-_{J1?VglbYdj@9FkMg1SWTQes/٭9Ρs=6ۇkԂ2ZX]eL<8~F]HCS,ڲy)Be%zAx9D2V,8 g/>@練>:7cZX/ߟˍ RboNiI{gx)]D3d"bSZ?  9* 7P;|KIc-q;3m b,Йr,=fEE0N?~G,-vf<,*GN5{.!mOPo[Q.Tc^i>_xГ&,,=B!!B%lp&˻zVqϽw<‡!5#!aC F{᭘0A_Dk̆bUqnKc\U3vTan[{7ՕLT`1k JC B)?!99QTi1qk‹PGza'& 'd~.q=QYZ m (D?OOy @ k9Kxml9=;(ߗ qPY>\+W`c.0VmM5+$G}mų/\QڠtCxԻLWkF' 6&hBl'#A|[}hQ<>v  N{ o=a6m(^=lF4 Ѧp?L-Y+J J6_X*i` !ͼ[ |w#{,cYphv%ìN'#Y:?Fxx nKX#nSݸh`S豟qZj}N-`C#~eΛ;M(CZpc7X/1/Q @xxgTE` Ff>j3I"+*ٲ ^9Yc<սs*|?B{Q@R\a0Jov ,;g5MO9r ƱƐN#Θ&:u4S;p7jM1'.e,XSP4!ԥ"@Z"QtYsen|{B_ ۟B>u3ˋh?i.=˚\`o@pYlTK|']9ڛ9#AB@[W[tΜڵCTse_τbUd7>\ъ೘1!1}Bp ֐(/ȿ1t I{Ư{z-^l;_$س,a }@yEZ(һml1ivt /wZf/! CQ )7/m^EJrhUېmE)$P<0nJޭ5Q@(d:Var (&{t;Y0!Dt Z)-ZʍN#ȑ*#tɼscQ6(U\G^,vR׫D"Dp`0`{}H76)Du׿ux(w;|)7m.G߂<5(3Q_5ˆ=Q46C ߕꈣՖQ12×W4I[7R6|pFyHGr RҏtU3ݛ5[Џ="JuP]UD7ܹ*?QM|C5rO[S) /$LZbƔ44AyONU|-Y9yFlƣZ <;p \Dۗא ) \yAm#p*estGKxCŲCSJSDlH9̿x|iSMŷӰr3AL;kWt]8]pDpGX/ d*^^3r}mkp]kQ@q^']ȣ͎/, =WjYwյ:g8ɳ2;&}[^vcft%EUT@-@OYfu65TMMB ωD()>XW%1SRolLmSk*:4^e(6ZphKu8 mI}vUec O 1y}xH`qPHc槭~ xz2gB5ytܠV4elw*;w c>Dp[ؑ 4KjҜ3lf^ϰ2(Pլ-pNo{LЖxHA-WG:sd\Tي:Qܸ[?]fTFz$%ԁ/Wn>/zaduvs- :S{??ѧӤ;s.b݁-i=6%<޳pln>t3IK$E * d'@υB,GMϰ2||)} ,3[B,7I~X鱏*=N dIv*p:Q2q}14(r,]LI,0si9_v 7r22-Y x.{Zߒl?)C`?L߅꾊i~hA13:&*3`>s[NԒ1 6X!\Cpқ9,x`C;` .@Oy?^՛LzNV]R@%pbdWM(j4$xWswvSɔ r/9gDsWInNp]1;4S9~0z@鿃z=NZB k1d`Jd;ހ /]j,"cxV+튍t%6s+ i8h,!~K ¿s$_`izVJ)ߊfzsPUlLg_DuNa ^^A$CO:_#QxA)Ps$_pEw+JAj@>U45•ǣJ"NhAB8YbQgdMz8~rmIW? ś8r+[-̦k}eEf"ߡҽĮr̺C6DR(-$C+hAݑͤ^Ho\x ]5Uh^j>S:2+\?%[|*BbR2_LkqţWd"+q:6X&7]ʆĂV{w_)(W{){ڬXtʟ'̶CSr*.8MeHN{E:YpV \,`piRx&È./,#ٜ[, G az Okmd(SJC5å~d?B#4DŽYI-ҳT*^:Jë_"#1WNwi2G4^qdZ@ ?( t %4 qY>dvVňWU]J'y{KZ\ FôҏźckGq?= O1-\|BNRhr{AYƔ.J EQiNԈ](Y,RJZ߼(Tz&A3*-z$I4̷R%>(?#}]F\Ude횲=b^|{Pn5gMCy$-m}pe.!r2c+}9^W~ֺAEf.mVKVQ3q2 QBl%0grXfmc0:d.63?j+Gg,!^DD,7ynq־'bo:38G\G9W2lfʄdST-~m `""%Էa} H;t:Щrғ/*WʢdlONæ5$Oasg_':gJPσJ2&A3Lh))cQ&"hI[p2Et܁c"ݣIUS5+T6L5HtWHDl*Yn5C~#mɥ$W3%|육%m'W)x`kE/V*9!J"}ڳi4:-2%xyEzc of E= KVF6&b댤[qlSc%Stӯ\O:c 9w*:Z4lxRDy^c.m0v_[Ab}\W|cF6gQ9 7HF>ƬSI: azTebhvY핚秴xP^g/坼wv"vIa UI9/A)0L* ٲfl Vbb.bWʼR:2@gGDwWv`tL'<7;bֶ@afŻ+-]_t  w^΋96}-C-g\ 1/ ~ѻ=J-nJQ/;a)xWOxjPRrXa=}! [qnuW3B[,D~Q)Kv*js|=/~"b#ӺU5C,XA%+ ǘ ZR6bkO{_Ii}k:x }LYS̛,y]{頺/s@Ұ rМ@7>Ml羅r:GqE900x0h=*e 0QIiP@ˣʾ3ƖU . Dc\G, )EߜJ0ԝ>kL13 s}X J^;Eq 3qоWО*,@×M <Limi)ȴv< h{4dHH js}]4_1N/[9\m?04dzXLq!Y;%7uZaVxK{OyQ5@B8?\[ 5u4Yͥ*j]ccmfa ?8a!8&fx7[ Q]qSa 0X|XBוo?- w+b*jm 6!;\i=C,KvM UB$!Ms&af Y!(M!pi}w1+ U=qy"\8X~$ZLU2jqB-6K #NÑ RO;,r=h/~[drqB`YCbI&T2L"wPZa`s|M& $F-eh0z[1]2xƆcDЇQͱ]֖˘e)H9s9 d3 29‰TL8д[r_Ur.Ծ>` p rL0ƹ.fT(GL\N5bM@ >{W *-:$7=(n1"|~>$tR;g2%-NjʳI wxِQ͛΢tډB+]s/ B z FkC-) 8PnX5md#aSR,h-j|g;q >Ѽs@a.@zP/6sF% AKx0jƗ_k8Hq<{o5oÝ|Ty6l8#mhq:ڟmfQ+CbԦ\et͂ȑi+}4O ysio2qI(l8um QOF25x+av}9*#8%=e0xΜ%$'h3K2Ҥ)}c&0z .T`Nk6- oFΤi*uy`T&wkLR*.Y8epgfӢ~O iff-AXd;$O[%LW{_-,N+ɫs@9!' U2gp*V*pqa~WQ5Y&3Y89%wD,!9?~Z-U^1yUi ]t:44Kea #׬"KzكiؘHOYn)&:Y  (stK֡8}L|Fc$1E,?wa˜7 =sH8fwȾI4}q }Έ;.?Iy=V3ffq,ɀ(zvJu':4+L "Qc%zO7 #]mR yY*/12EJ(RȿԪ(ڮd;?p niK:0,dGxf/:k} (ʮwE_9m/A\SRCtk}43Й}")fruk!X9̟C"HX3z)xg< -s詹hZD*fM(  {*d7 <6!9t r_sKyT+&@b0P` cز@|jRʔbԲ9Iձ}ōAPܹׅAxj%|,=d3ezz[.8Zmb*ɰP簊YNm 8PZį$0CsyN2P&+$^>җ@9LCta/U.<,W[ǫ2|+]RLu^|YToU?S?=ⶹ76noq[fƴD35+ pu-[OUTWz4w>BrNdàjH;׊uO' 9B$|1$>kѫ8$b*)ע8~Iʹ{F'E(sхe_mH=srxs0_#tKӟoOdmL DUd1Cb*F+SQto4EU^/ipWv⩷zAkjX/|,S~Cb,|5*{N~ E@-QU$V.ƷePMzeKcu_3 'gDdO(K)-6lǁLUz6[DUJ0 Y;jhh !(p/VH ќt)s~03i:Mheu'ELoN&Ft;c7#]0\֑T|}(ӜbޜǸxLnvAR'-k$pG_a$|Yx)5ZUj *}N oUՈXNޟ'TvP.AnLdTJM>%1Έl~vԟ|P7ͼ([rOsٚ-i&5Z7g&R܋)陎>y,0 Sϑܡ0H0ֳf|`I G#<=ʭh"R<ǘyBB`߄:3a 2Ka?| Jk(I`ibmcq?7wWuFQAz%ysVv{{+&RøM|a& EKy :;BcD禟k+M{ w Iu,ҍ+Jxa,Tڬj1Ɉږ~Nz^YJְ or8|A2j0sW[3sKC=NzL:ĵ9ĖrҴphvׄ$ܠUxP+2NVh5UYn|kرG[[˂O;]h+!pQ 7a!5gT}\ḶՇr^g}yӲBLR=uD<@)p Mn)VRf־kRT^.iBh-<0ehp7kc48J^䘌DtK٦!λQf/I>‰ %eQ]C 7NQ>22}k !Xv{_Mc瑇 ԏOe 95;dמ1CVD4M^ĂWT^ETߑGYCF sֺ̥"?1EnJDk.K 7s Vx|&Y%w?Exsd*eдg>qzx Yb߅Klk~#%mǼ+-q:|@[xSB`$t0VcP}z;!9H'z tE7E *+[4{бإf—';Ao^|5L~ݯOvUJc5{nbQ4+'9*Iuv[/5$ZIoڸ‚JIS!xXX(#РÌl1_&@f@?88C@J{K_x.jM"Hj[#L c(^4o)o\(N@hVڏYV%ıZd{2j>ol0NnC%i5$5M!Xϸ`Alac婝sFֺp~%/_ "ah,a|>!W]Fp.r$Yw-4MѩƂ34'$1k!ZCP/g=1඙h~J>j9׊n{+0OXwS_u.Pgiݽ869fbP/SaWzyDJ(aI:j{?YfO0-AW73&_a?6kC_b-̗9&]ӥ86u1G^/ ʘ{3#fgfh+gb'ǨQ8irrXP nK@,;¸"$S6uܹbIH3xA>\]]ob85:E^5~{MQCA oӡ{G55W,|wF r$Y])9V'A8R$F҈:<Hطktzu/k=(LuTnj탭ɷ}%ݍ* r&[i;|J7 PZG^j'9CE?|,C(6"hnTV(?{Tmm류wM*+$:7Νf%H5G%ȭWQPsÎrs`|W+[WI qc$M-gedH#LC`Hdx;:'D餠{650n$IP-ð_ ǩ{\׫ r:щ&rҨ=>XK\`J*_y`ۉꑪ/*h\,{{Zhݶ&,᫖[>j]j NI̕@o_ά==Ul#4:K?C,.r]̌ͮxh=0'؎:7-iJYp$Ptާ&#Z$N 7|1"=5fVȶL!+,`/Nv6Ȃ*X dJ =i+ ZV̯]Lf.: |@4WA'7,I}JjwdtƷ^yܾ9 LO34ICi$F.Q]ơE~>#B,+8 -cV؀/l}ܖBP$11GiP iёy[d& 2C˜ VIe[ޠ4s ¼I', ,W6NP5ؚ2jHM[/DV"Vz9tj \$ ]*,XY,~ܔ!#qXw(c!~g[hP lq\s|Gy4P4IR>]`C&~@Eoc35[ 7$ݾ˖ dncdÐd% %_IǡS-X)LWoEIt\9ꙠCR,֮:tH?Jvn=ZG66:{>\%gQwr}c~L?i hFn hi2$"քfps+T? _O#xّІ1"軝1oPhd@L(:B2,!K(mz7yZc`H9$*AUOJF/f{/=$=}фM7PN[a.*,m 41!yS EY|E`i%-WW[vFQXFA/cXFM6yrqP/$ +7clrPLjG)5*}5,^A` xUIiI#ˁ}?XN"*C.Tgt7'VP]\7w/ad$~0F|AX=4`YbL>-QaQ:q%{oaV̓ R)sauĜ_y!b->FWIvm`YF5Ҥ>wֆ7MsͱAWglTMMw^^ދӏ lnE,c5AFwVcbpf+ayj+rIS26`{tdH l5Ew<;eruGuaFu<= Ȣtb` +vb515Hʼn-i"?iDBYTy B$ iSTvSptG^T9Z-U{$׶3ފQ RuQ}dׯB`[(!Lf: k3 "ےT._qnPYLr]f,_Z; <*CON]z6񖑰?ƖU[Ѹ:cg"a)rQZG=hSW |@gS/zZz@O'|Ar9{(det&Hzc 5Cp~Oӳ`Q1C=nڙ:$ri#@UuOx_J`wߛ^թ\΅C47kޡ\l>bdz,S)i`T6V'Ͱb!B:p#2ooץ/&{-N0 $M:t| s祏%ڤYCCcۂM':uE) Bǜt_(Dtz!KկS-; T*ytӗAmNu/6+SP5ګ+hp?(sζ׫?#[K$#⋺?ʊQ@Mc:_˿Qs6C[%EMC6}8huK$cO/żL!IB8#QD`K8@#b#K`~(vݸ;`uA=s #!]b-I('5m$TW i@0 $){V>%ĂWvY]&բ!,k\-a> s;ӁrN16N͞(FZ nECGhYXQQ}ݾ?Lg^)½яX+@6={𕨲$ 9e0Jl Q9vnзEh-xpqAkOT:S5יwLƥgJjJ]q9Q=v^I_V}Մ5rn  ^ C(9wګ|R% q@Q7O>HTg]+Q}L5( \Ǩ`)HPPZˈ$G,r'AkgWUO1x(S\8WP$Iv`` P5 3sPB౦m8u]+Mz3[K4EԴb宴?%VpMǒ ]nTժƨ#k&cy\:5F(Vm}$BZ;f?MW7  ~:7ZD*qc`x2}$ 0 s[TM_v2"=GWn(> 0+8ĨjMI]` ˱Ox:ï\ CuX?uny8:mG;$<Ͼd6~3O7r ;Y2,yX0ˣi*޻6x6.%OYl1r,C!u%2c9k {ަa;4wBw)Vpp,ydtbgz9hg.]{3C2Hd+/\6^;NwS?^M}yvB$DMA-٢Zmn_aZhofc)QF\UuDq*=Ehr=9V= nar)VDCD8rq,\suQ.[r u^%I8gxtpXQ kr B&7vKa +=G&<$َ˱4̟"NhpAѭfàIxǖﲒY .ѡU_8w8Hh9';y c{>0e.>{ U` E過 eu]h،"H|ʩs@"ؒcGzBPpT&Pѓ,q3b0J+\Ԑ"^5)ĽPAHOm<m:`g P#Gp\kܝN[2=~O TT贩F:w <}-l4* p4H3L g\z +yH EpG@6NȢ%;G8~k8Q7A%kGd%&`jS:|G\ANY֩Tq8&YRi\-Ri@hr4Ĕ?HP*\Kc6]%HHñ608XCNW4ƸD»SGI32DѭOtQ^pGH g0뙌nEPZGj& SޚfT0,0N藕~Q6`@/>G?29$=ɘŎYWEkSƦtb6zofSiٳk+5ŬvJL}; )k4iX5j SoȠ]D:5cdR9mЬ2kEMPhѨ.yRlYcZa@(lSB~IٓC`XbvCU3W5|7e;^BHzG`Cn&y6B!{dYQa .N|/̄8% -v)qCYr;YbufDT$8& 2}C4j0'5ڳM#ZGXN-0#*lN 71W4d1\;>Q.&8m0>"-ޜ=(l'iڏRɺ%* q]B(ky䑽C.i 917AROݞHt+0_D@L[-`'kZt݆Y\#DeEgpIV> cD? gvjN_#mcvٜG,,0JFzj@ < wkZ$"TڿvS /AO~61C_vX~|׽ g]|.;{7GĚ9 lP  ȄOnL̃-=45άwtXǪ7d7]T(b k7W\([&?d4EV=>aN]u5Fԑh3q+NqkJw=GŽ]!ӀL`bnqx؝6\ uyPG /p%X汤 C%ʖ\\&ؼp͇rz7yft*Y!1\ h̒|H y,BwЦqo9 gHi~~mOxbf @;\>'^2&_ddpjTWֺuI,4mcAAW8U)}(mGWK) :q7,K90xwY"Ҝq(&]Q3Dz3Y8Ig<' y IVkߣ3DŽ6aYpĹV/C Da1`:Kl GS}˛v E~vٽy]E/Zn^{p2I:v^EZ$󺶵ȧ)=mPbRc^Gh w;* 1U'5w}Ygp5|!JX-D<*WC5Gݞ ֮BlJ Kk~vYj3QY~S0{!% @GwQ኉mUTeH TAxY>1]ܱ|ɑ#B<[T#bcuéJ.S"odcXABjZY`~@?) ($jF%G4a7|MPGnʴ.^Iz!@"pvcLZv_ SENEC}">%@H*Z ĎxD3d)x?Hm,_rŸ7ITgƦmeX v[遊(4p)i.;P"eh gqg5g!l_~(_-0ROj vtďQFKH솰JK9թir=+Ȧfdop@(Ӎ{XNGXNu`3qDXncpQ5x//V]wj6ѱU╯'dR,BǏ$ y֏BEE aJՎm%g%ܳ)n M-(̉qk]2'B4k*J)o1%% Q#*?ɥkyd13dVsMI*MCVOH};IɃE+DW#%HX۪p !x䫪cAT0p!i<|=7.4v ͈ nt҄"t" M~(YLRnu(A"e+zI*VvɐʻÔȚYvл,O[ V5ı_^7ij١c 5`,^2*j|r!ⱄd~mlhz)ɆI[}I|I9)#[V ,`Qu qN~4cK&HX=d䟥,C8t:4+w੦[  oQu<`a=+G}Nf-]xH=[{QFeMn9Dz4 CE~.kT67.l@ ,R<#Pt Bb909P_yd 3b"/75ڍvR({1Ub܊S%3+P-ȸ4*R -RԏQD8C„{tA&.R y͓r9>@0稲"W,W-G3,<224u?NK~b+X߾,\e~Kukf9gyNd:~3Dc\~.|P:uO-n]ICԁ%]E"ǁyԩ95MoX&h6N4e5|-3. IbE®υdqך"Z-KxoGb^lcrJZQ6H#j /ErCLCcl5vLAɐ]k*Op?9{NwKU`wMC#3Kx;yG耻UE4vDƜ91‹/R7̋z͚3l0BSȧn`.OqN䴃n-`Y\}3& Ι*GNA@p Ȗ'5:9^})`nKf׋U}5 I ";@n3\>'ȊX=a3 j!-4>#^=![If6V%@fG6|mZdEtř!zY`b s%x!+*kTW"y{4(A6$78>ׂrC$ (sGpdӇ͇c}l`R_ϢQ{Vk.9`t!WB, RErYPJX~oVbgo6F*|gcH2(o^X{t:Oig`tjaHQu&zNlmnXJY(>/|. -&2 eg2_z3H y#Y^];H]sOaꈱGE6Z2>ߌ9wyNYż ,X (hIPUHTLPF5޺(+צC &`WRv0s j@L,2M| MT0цqXe봵ƐZcNRX,dwy2{Q<#zBjuc g5C"e҉@H^fўIS汞n|O9ٸp|iM OhǸpcr@et_Z!=){ .2sJ_gv[8.QlI/BË,kvgs͎Èk_QalqYt7v( PZ;7|R^۩~<Κ UYmVeAo-.Viurݪ1 T V']oi­; N=ghTj:ߍ~w!zXR@>ޏoӶ]2o,͘ FWu>o,'HgARk}.m P?%YvvEb; S MDEi1Bց` Q@ir`&YmqߙnJJv^daU^eɁG(/ *kv;g4,,Alpw>NBILu̩< smNr?ZS^oz4&ZzhoapQ^thtIe5T~ZR^ȫJjm ΜR\&9b^+LIoe$xI8|*T~% ^7+`UjRz-{9V>nB< |2V;[^j>zP or/ʂg ?ѦQ1&ϹBɀ,G@V1[CMSZ'J-X;#M6Â~Lػ燙T9P~,qӥQKZzLq]V3j_fM64qqy>h8#{2ὲ rN<=a$ 顈k#@CXj_lMr8xk 'a6C+xqTRfBZMRDBXEӟ ыGcx-JaɶE3ҖL.Tdrk([=#]Vs""6BP ƻKT0O^e?isp RzǓsu47M^;X6Zb iG)հLǼǣw?/]<5B~`A8domsv҂Q%kCO_=:6E@:% $Тog&mdC̀~@ g?f6G*xU6ċ= ڒKU52Xv"vlw:d }ix̄LZeS)z *1yFfغ ׌4d*>_= Z^܋Ridm0cB9,_du1.~2i̵}tە?rm(՗:WVSd`!Ѱ<7H $:dXsо4ED忦`*ʞ7Vw%w^Hy6lcLΥ?Pf7YF"F#Cy6{i}&跡2*dٽLؿɰA:=jTbtNwd FH> \}a_|r)aFYkm:X,{CG7!?7<<sMuTF{Sfm*q's\ !)GwzYkrPaqZZͷ' jen[>GU_I PFDZ|X`r޼ O㭻MH% R\r2vPh8cIo2u?d~1s6L/|THxmi] UAB\s!!BgQlDOnq~N-edVsZ pފh?(% 7VQۇnZP,am%+e:>I՟q웃3Q!e1.!+%W%ɂǏ5BE;Rx%Y ǂLih a&}P=?3?FKzpDo2:\)"C` < nL#ץL y Eq:+l1FP`eR1CNC֖X`U:Gػ$s 'eE:_gR :d*$SqlE^\> 7]IkI"eL i] rӈMa)fSO+yAG甭)5wC3{L4\s) uG`>DnD[}k!1a~`F}Pg(Yi*,8U 58:W0 7kzx ͚EguCn"/VoevXbsG>fž Dž-R {fVq|fmoh7s^+pAGT+Z}xΔw}3Sg.0ϑCII԰V3f8k!6ұjͮ",.u.HjlRCHt~w⃲br~;9C19(1Ǭpͧڌ5 T}{ɚlD$J;bBfXeO [9Y Ɵ\&  5sx(9ybZ?[?::9>-OZv}nt/نpKyf{i+UCsRtSQw^Tgq?b0>Ghfy:L<)r/~wpNMw:,rJS`vI*ՖDNGdCm$ql9nEЦ'pǣWdL˺t)݂pt(sӄfS%Tk(^1&<|y YAYaEunTPT_0Q{9UjEq rO0gdϧGjj2A92xG^Nİ)7MF Raiq:mG Oۋ|.Yu35 -Khζ -j_1 rsGB5Rp쿄"˭0(,E-a'Vӻ=', 9>9B3|(JD2ЬÀ+R'[ "Y)7Į5Bզ)+Nj=̓p7c+T9u+D.fh3h-=7:ʬs /LIc?.i?:?f2MGk;9,.i=:v 60[>i)0`$zӫz<7!{@Hdhׂ.))|dg®=M#2+DNYeFQKSRsQ PnU!F!6|Z;7+3 ! 5`Ͼ_6${&FUTj447}I5,sQa3˲} /SPoMufBm;ȏR!A{\I= "54 -݅0GT>D`>*υlH4 &2Ģ"gW<ՙj**O=5*]Y\Ɖw˃8#AQM:C2_YyR}Әpqa{ 3qeˊ_`.c0j+@( k7FamH0 k9(=jWBswte`<3R`APyvPpqL8B 5&xц-ܺߠF zw8K~..jܨ61 CO>A̕zSPZq$t7z@?^ZJQk"a1ڔbC0Vtb yJ cv` 6Zu$,~GJV_f5[[Y7 +E@X g6+k yL-9(ə** m9l]aH ?O,BjS6k'; 0vMUjn+ZHwi;87N!–mIӴ0Z]؃cmMd\;:RY;w|`DMh_-lbwyxzi5*_f6OҾ^ 22"\aQ' Đhd:nIGHKL :0C\n]Ԓ˹y0bDݕׄoMLDjqDG"q0Lv4TͿ^aQb՘exaf3kH81t X| uan=񛀢ņpUS;ߞUJ>%`O2 2MŐqL鯙pi>~utM)`V;;M2 ɗy]-R u9$/3ih)MYRE|ZUd<>sp|Wd>-բj'JxЩY=3ٽʸ6%=\;Ѱ@Pf;6sJjO 2(z8&*_l ^5~,ԷY1 HqhQd?佊g_˗=r4:{Vqdi@.|=P"[1GK)e9x+?䊎E׎4'SpNqSe兼JǠx7 HPvJ/_~.D58 %DԎ8t(qJ ۉWhH*!Rr?vyU UEq8*RpGShŬR(P P=z o4`H3;Ecn:7E,*KF ضsHt_̳=:ɸ luI0 G{)a煅@s~|LV@rSY_Y>փjT(BPŻVm߶N` j!/=BBTUXU;!żM;iz'iFL7َf55+Yo颽FBBx_'1># ΂!cڵ!{Ef+̕Ƙ? dGXcK 1􂉑YAk*szg3r m kx7Hn-\X <ؽncW4?H ÁL /祖}.aOfxo}?{?:">xo q/btnw91݊y{|(H'@otA\sM#JbD`zlE,.H| S}uOK=K}FH]}t( Ede? dwp,cMz? X%ϥ=S#+n^ͪ)z60 !dnA /:x+zf RT=ɸ6No]Ԇx 'AT/ŒhƅqU4$ c=[zfU;qҹ,x/rxBݼP+}`)po,d[l1:؅d Jj(F}rH}x~GMRgIN"2w/$銩Ӗ?Ը>&U )T"rPo9$9+5 (.qcǺ%<ઙ((ps:mQqQS,Fr JIR E[ImxAG9.0Ash|hVVxЃKkǹbוkAc$Ug.듣_a~ yҍ+běz[|R 3{Ǧ>Ȑ\e2Ko@,W9hӈ (Ʌl1!miy7FE&/%|Uлm_]%,ye-a|XF[c//^R3eH}F4_ξ5wg*͡Rɮκ:ߗm]ÑДp\Bݪ54z|`8cR8&d2Yz>QY"T- R/d'COaoA,4hsEkR5' U ~~*/it5+ V5K\\ٮI]&\zQtJibó3,D,ZA@VdU"7̌9-$o+Gf؊*j,DET1(q̖IW 6?+2O Ȁx @ߎYԛF(:g:CsuV^s[ \UL{ذ? @}/,a;,Ct֦Ωj`XEͦN_pF X?G*>KT{ڸ:u'*hNl<.ۜ:Pg9iibxC7itJE;(nOe3F7Ch3Ɂpc}j'ҁum´{{=ti.tjT!.qkZ8$l !ĩ'2Zޑua!eybq&U9!Esx:p%(+L&+qkSFzTr*E2pF.U"57~qkh* LQZ\ՌO/}1 O4 e8d]T™\޵B9Q گkÔjfΚ6[1:O<g#igv4LBT1]ɲś?ɭduTӪ A;ׁU:))8m\|qw99tTWbs'5hԕ"%vXz?OeKj}A̦2IE1=іV̚chFVnspMEL$];& O%ty#cĄ ^>"5x sJeJ"& ^4 {DVA)}П,dB8ّ-ҋEW U~5r i|OY maR0##`DfyytiѴG_wA_Y g2e.>,ݳ^qܸriaOE[Ni:[k}.W\mlak:;U9>~[s;7 |"2ԩ>|KP-jTۜh0ik`VFߦU欀;NOsܰ*[:Ag )7KWV$Kȭ*& ^UiܣRZAvZ+F.MώAiw00XHO1>CHx9e*'7mnKԏRkc NdU*f(~I0M_$vlP0ZP[91ʫVԔs/s >0\y4c|qzQF*Ux&zcd%4Acqcq0Cg 7giUP\qi2P2im^{iJMӝ|X)R"hk)/S+7%VʩbMEOrI*xbh1~@4F<ЁPDͺE[Z7^eaooKRֽ"nz^mu5& &jWyϭ7oY60c0|LOt}"8106M5=GQ Q{}c~Ovu XAh'VRPF8Ys=#2HƤ\mt}׭M@xV_zl{V;r[_&YE^sܚBқ@3kZ`ޛ縼"G]ͪHro'DQG8CB?a0}v@n''L2h%p"HSJ V%[+sʬN 8F@3j^? Yנ(Gc'ML4oqD~ rFE8Vf CUB|čQJژB:mfFgML ֐0{na:i6ðk{trٯ)3p0X,Wfꑠ"YVKdsǷR?76> rH m:ڿL*4 1"'TH4:G%HaZ#;,iꎠˀ_ @#I$ZUkNfy[;ʝCO*!y%U9T= ] 7@hFg*gZ ~ɭydfzV&kR5] AŠ'(N. 9 `yFvfl]Ցep ;@Sfj*&Q_4L_U1iLφ*(lDb~SRbVZʻkk@|*5|ʠjhuaZOn)T҄Y\`tn:3w6輺ٯMoz3`c ƕى*Y~哝ͥN5,}g`ҷHMC;?xS>_ 긚ċvQr&U"sW[㬔-X؎1v@ 3S; t\`[<^6&Aݨu޵荱x$tdxis]^zXh[Gb53YifuTlɪ ?%r5KZۘ,M3Sa`x`éun:tDO/dm8fχ%@[GC$m!R%0kd3}e Z5)f%RE|5J]'b* ~3R_J~ug{$R0+ tKxH?_hG>*{PeEzs[>,$Xх-*R58?$pt| ǨkQ6 VIq|`T氲y_UŠkd+cC,:J ZޠCRQPl)BQa~!܁5񵡂!{a ܣ [KLs"q~}GSiUOe°jep4ld+v:pH/Aϡf"^6BVɑz38L-!6>ocg=1'>:ԺvPǙ759xlPU7jJxSlKgpR&G[WvK"=L ]1'4_@= ?j3\=heI NF7QՍy/AFid,iFLh~{˫٫+BZ.v&ؿ.s?麕:F1Yܚ``]9-q44ScnTmmRf=0f>2k"b@O:noU MPi/Y e {^H C\Dr vF@s"p[X@Ɗkqg+>w28U){ឭ:ZzG(ς~UH ;` /oK&/V"T F|dj+ʅe"ga|V윝ytAFV.27&թab- NSAvsVy+UؖaLK3ժIaq+n>81:ߝDEl4ʡXv![y- m.D6̿#)~vQd=D{S\@AD)pНq.jv;7),f[GV:[A cw4bLrJ`E0.q'[>7A&VwMGD'&Z,cvOKW~m8Q[[qX90>d P ˜PO1ڨDWY!~۵+1e&{%d7.TɕJ;h7>.]Q=*/|Um+i$'%>v)T=s>)~} Z>tT[qSxP 3סF^3eY9!/ ?? hMC+Egr SUdgH^R:<"wR_y6zL3dֹW i!LDƉLR|m(L~g$6U\Z_sW<_3:C6UhFXUf0ւGڳEPa~q<Hygc˶M Id|'s*~Gb{ p'cɴLٔ0߰Gi=yŊ3N.4uQmj瘞wh۷vewT,J3Aː3Y!wH[(,=p'oDV vJ&~YRL ի%y{X1.O1KBOL53I s Q "2s-fC%1b$f?K(ӓ{Sou=,nÒV]2nF`V fc[ZZk=G<]#mT¾CJ9~&]|DqKߺOެ=pL'psMt\'$biiݲw]Zy6Z<8aze67v^9KfpwrSY5蛹ə;\a ,E`PZ2W;ZV($%Pq pH}l'J#WW5oۉoɏs?{s}|prd:U#zʧI yv1Ex(tVaM!fy6x#`UKkTqa6LCF<Μ@2ܠդ#GM=:ŦMG>JZ*_qW\J3/˩)4jrt2c7[# 1E>@aEYޥ|`}f^GK%g&ի3X!j%Oc>:%1")PIg[UטojHoN䮋Xfsפp;/fZfKø|Uy *DUv\҆n[I1B8DK/6)5(^]63'!Q#lnGOв,"Ϫs4; 럣4-AQ`C4x5@XLv[JiQ$ Ċ*əHL1 dF־?xUs531co+hr'ML94"e4a xAa9۶O^: u%<~fs q3*0&'#=:\m/2tt≥ͦeM^CܿR-Kv\s4a` C787B% @i9t#0V;Qb1=Ν3u{iJM;|nQauF3i_Zp."kʢ~S`HI"%<տ JdtqWN$* DŽ0g2(7.` mGb6^Z1 EfPޮlXR+V3i雡YQݦOJ&g>|.fX,| Wt[X=B~^t ydܗ }1o7F닯-#Gm0Xhuiݱg !{~[PH,">)_pšӂ\:Yd' Uu Qr]˯ϙHд1 g/RY&xfʢb?WAFT,+af020kx?nklv,{&ˡzԤO)Q]20M:>G%nJ3Ό?bXT1 P5 JzO)pY($jOasQ# _@ժ$}{[jIDR s. I%(:E9ߘoC%$#j$.y| w񸐙ɐߴ@.n_OΙKInEPajMԉ=z3^Jq&2VM'8k)%8Nr3h7/NrW. miG6+V}qXJ޼\Boتqe2mImݶ=yӃ|zXߤ78}Z-pQ`)o4'aY8.X0 nϡB=[Gl9|M4Hn4jB!Ӫcpצ-F0#3C6ǩ%>L+jAL8D'"֬eoŬ.3&m vœz 8cy##d#pF&4\IreOTga0gK$lB!E:k|'2Y0.&4;i\E jʄB>DzP- ǠG_l?Δ1C^>!CI4QiXpHbR'ݶXLXpm9E:}ʺF44 {_aÆ)ٍ+%F.CLbk(v(k`C i#HT^-T!NNz`B|w xE6h|]d[T݅Xst!2cN 5\d631*ȱه%y/Wtfbr٫T "Ӓ0gPкZuqI!YР7#'ICH+Aseq*(װa_9{DT%'['M^.ڝÞlhLe—($rcݳt+vu9Qs#*EqˠromT5| ÿ́zu4 É` :#P-`SLeҩn-ba yR*0h){0*^̹_;_BTJi  8#,r-tB3HL.]WrIo$> bf'>1~6hPaPRnruPQh!#F:Z8NUc* MgkwҕwHǩϒ8UL}$M*U4ͧGZչ1>w|idݎ.*0vB ǀ5.:^M [gXl8Ay,8~ `&9eA:K]n,mu2)Sfe:jF[SpqN>o4f<4܍ȰϭAuLri=>1p($5j Pcq SVvno N|nڊ|HzT [_c'!Nd>Ҳyl,BD }"7{w4ǣ6- wϸR5 *DS|! 4xr|6caPwà@lvJ_!MXn5e$ l*)<#B;AfGC!g(xY}0pUc4C(SVqUC-6+@p^nJN0w'G5ݛ SZ72,0ƒìo?LRm*$I;@+7NրA6&_QSVD(u5v{is8p"a `xMPX[ʮF %߁+`OMg΅LU5nG@RH8*utJ7 VL*ލH5tts% C ?V߭ڥΙoH/Z`a s/ِPUd ; *u"FSe/Um PW +l7!4`QW% MvEsOKa^ױ?ًj ,tg;tAqٲA3̚_&Cs6+)}_759 7d;1-F+띗3B)=zZYQNjEY1R.VF\PNʎEFĠlB6FZsvnŒE 11':b3a$ɿjt&3W DkW5Gղ!-lN쓙U=lP2<~ku#LdQcbBƻgDv1lw*눿UE\2d Ʊ˨*d"kYB;tXV. vy{h)8Ԙ%l:(.]][_A ]CCfsp5,HeMlU}W-YabZ˯ơ.U1\(8Gc8@O=< _]>pQ=2wl_|06hfF~\=Az~)ɫٟb!{KwoȔxsյ|baGzVX(L]zhl(B oݎ)Vd;luF z[V+J/ ph>CN ~NgR9LP+KY#s3U6ጼhoApl]Okz$Vkm$²F{ y~P G5%/L x2'I^֠*o"сHIAC"n8Z4Ι~ ;,Qp'[;믿dU,ɎV¸DrJ6jis_TA|Jnf1TL`M_z͌~3F?gQE1 F(e=.Tq(OɡMS5FӨ;ѹ-86~ev쁞ŮTh/YacLVH [vKLKzE|qWdkTvZ(|LL]K C\wnwcZo}V0ȭ"@A뇍' [U[R5 (mO4Á\Eѐk).B(hNExG`vOGހ!@ O𱆹&`}'6-coĉ3[K@=%,YkVlHu Vบq1qO {5`LfNrJ~0]*c|xqZ+s @Ȼ3&(wv@:ty@<.cHqv~ЦőILz}h]X译(E W~yZS|D`ԚldgktHO|X!4(c*Of8YBFf]ti8J;gF:%3gkw.Eb/jw5M.|DU R>ZtMBwQqs%T tx9>Y?eʕ)B:͟xdu!J7 : :s>@q"u!.)TfKXPc΍B~=_FU֞ xR՘jBZI_IMƦO NJΙ${ [J]LlW[AY P5!xt󑏋#X$Q^z?ASp~9,.wm|})cnU,΍a8wz8FSw<K±1t%)]i:RlP[囔͎|Zq!θk& @kIeAr9l87urAOdĜb/nD媁O4z2 pXbI >?~q^Y{F43OŨd&sa*NCx>Ǵo6k2@hSB(9|~ -5ZrrtnagvxY SW-թ޸wSpg$Q|J. SRkU9տ1A L&z@9Nؤ_}:CN ͤ PĚLSRQ wSG:{8-Wk($p*\[(չdW}L1#e+ŜR5SV?NBxk.ZjvD;Վʏ^s2YU2 ,P 5V*q+' !1f| wSz֭13 F!8URsZocXwc68GK,Q%Sxh{mCZyf.3[bzRR߭ @T$~q1 (R(ÌZd1d` #=1ͲjuEwW(\:Ayˍlx;58PsmӐD{on u!'s7ɶm)jjӉM'2J5zٛ~:+ÑZ7jCqM>twn, E>pZ)iܣx?A" =/@kFUImC>k@7l 5NjNGͣ|#un?@;o 9"X>zb[`UKd|{'()e5idxb Pﳄn8uD+a5pH t-$O }FZy,V^&,K,Xۇ; >3i/5:KiFJ,oqWIÎ@o/mЍ8t>Ld֗>7:i79Ib?@t?zom MOz?fmɣqxerزU̖;Pm ;,\t%>ڠçhs'F&zw$?=x ꖿ@e8}(C(ds}~1 g!  C1νg8o$:x?mBBP<沑CgQ}-aRAل`r,_24F]UTHe3sI 2ui/U3}0ܼ4:ԧVpi4Aɦ(ZyME!7aFÐWx»B*M*gZ&]ȱHvQz SBQS.k 7g܋$|S*-oIEL+3i&}ߣ11~e q"{ CG77*]lhO;V1&4gȨ/!-'VK?gxCz ҍ7%&r83 9ۢT?s"98r!8TvIQp󳑅uf4u cadɌ5z&e4VZ-"75EO#cplzb FsUDiu}#5 éK+yB"<8O\q)98Y {{g7h]c߇'_oV>y}+V 5x* kc8dEIm`qN(6܎6n &]-oo|,D'B{7`YElGSJqz0\6-& džVcvlhhPMԡ -Gçp̲駠QMCVHn1T3K)Q\]-rH6GCG-+8W͢l;*i՜@\^Z1Bs UR͢]3f/C3XF,^ B}TC펳T%rKS:Eu"_RxiN5ׅ.m[*!l;_f8 ܫ8WB ߘ F//EĬrBb6__6p S/ƭqOFO9#m;2-TNPBk@uގB'Y6X ]vApcdd \PYSB2g9;8uoq}HtAޘ7R; =moR6ZD WM]O#p}}|ڡ5cPŶ\Zp*6bNV R#18bDrAS (]V;]]B/ņ-օ˵GKp˝~}<Ⱥz v=qQ9-m a;D 6bKugBf/:|~IHoTʙ4 _6I wP$O'hUs]QuaڅZw$@ZJha!c,RbΥՈ~oSiE ́D0q1\x HM9?R/J1$jPQCto_>zľ,>R k?wm BAu~A3/ܯbp"@{n_-JeNw2 #m??4kM(LcD~&o~杲=3!UMio{#GKPQNl"Cp?hÿ~\In&&S*g/9$9}glD"RTh*{rj Yߴa#\&emaz =O2[4dwlG.E+7IⰞ.rc!t<(M 3/HLc0~nYi1@bd=zM:i 36v>n&hD Ur؛Ƕ#KjMap*HeGȤp (L2M?bPn3S([O8Ι?d܍6=zC^@j>^Υ2=bw(@CDXw f[GD@ .(OmYnCݳX>]N[{(Ku*pwfE4v)͈fTꓦJB{\̩˶Y.`?x*nQzo5ikw=%<|$/jC 􄪤5^ l`-VB;I S]Jz}}xˣ?-C.Ӟ-GIb3".7M˥-іw1NJ"r .\ϭpLAAv 엡W92+H2kũ"A*qB.*k)BC7x!Q՛JoL*t 8C;,ptIsbB_ z3iwʨz<Iz+7Y[/iAvaQT{sJ/\*L/ m<]%dl%cLT}1uH3[ uY q%<x, q }u*ȰTID; g{$dB֗O2pK6g/oļ4|Z>n657~,i Nrp'-YaN'*K nJ?w=$hy]io2#-}OݐgļAˆv fc66f_O4[,F rUpph>Е-\\7BnWEre8\b6cGwt3zX BV}$a$Œp!J.;lMXQE)+?W9Jcr(/*rYxOw}A5y/Zds _q OF#}>j^Vjvԋ+b%v Gi a&D_萊]&!/=UzBSDwU[!n ?v[z`0GûmrFv*ݎk(".{"ObS@%'׷]aP rKrxp&xVq>%W,Y/&AYV"M]^BY7R&WhWAXıB[;dՊ{790΂z#) Sscz pE,왈mg3@B'SI&)HV +r܃LîW]gU.jr {$>a n~Rj`|9w@Tk ^joVT )6 i98o}ٕyڢ6@n6/wot?tl(QVpU[lx4e̓t{CvY #{+j)TOqM7 $ƉZ3fwUÎ_Uʹ00ًqf p¼sRᾒ9Ax^lHfpĝBIPEwES˞Xh00y;V p)>LZWw_;&*LG#5?Qȍ.sԩ7 cp7킄*67yU˪wʌc{aF'0l𺶱r0֞`]ҝss ʳҮÕ/&i-h Yny  9Yt\e"HZa3ǔEM\w_=gmM%)y2yԡ ) çGm0dz| -A6@JƳ!Z|X%O$L PaH ӽ{chxDc<fj2'i#b\z iL~}T](pn@o~5 '>N"0ķJ|ƞd>Mt} t*Qg  H3n^=KŞzX.rMr5鉻s7\piO1\!իȑOh?,7`'>*]#Z tKzL(6Hϸ~װgAs9=3 YҦĥ:.qt>s5i`~3ɉְf>dSEg!As1)3 FҮF“ubi--vx8_mL6b\s6<\,<)y]\rD+SEloCYTƎ` &$`IlSe’i%!vN BxkZeq'*>ꇙ u2M/ &;[{2qwbu;?)~h٬clL^ۖ Xo{Ȑ'g#;`¶ـAP]9z@1%.+oFjLc/L-yə&C֌% eZ&Dg}D htOlhs\ @y WGtvځtGF#9$*=QW\Ce?m%;?'0pa»cv.cy"'qV,biwjxxR~Xk=k^G0rZPkQ? ,ZX\z 7uJ 9 CS=FzV}3VϕVn_ u/dL7UZ9ZyWy H[ T'g`G.V䠺ŹkR.ne+ꛫT7|܂ e匄QmݖS8FLOV 栣+ J}V@= r!( K\Kߍa$OdJ`XK!HiOKdV@n9"[P&0ԡHBEv:]Ou ymX+eQ?aGQ8۵Oo* Z*x9Df 7)R(`O%]kޢZZ7S i!Il֩sǢijSf sڗ͟g%|h~U5:[pmY*f6$t07 QRjƾ9s3we%R€|K#dWJ(P I!)'-sQ'm]æ1R2Xl'Q:}Aq0sbC,Ԅ (%zvÅ ?s1^!Ubqӛ;g\8vEdVߩZGsqU`5$cdG_Ua2ch0~-TU HΠ"`o{+WKwheЇRd_pPLrV!;̻zv*WaW7b 2ط SoxqQ\վd,}O>j,ցdrss¢7,܁DM?*2o Dž.rf Kr9(>tqi㟙1tL5A?fNjy?3jrKFVex!-FGgB;hP;cџMwvbfCZiޟVf]5 k{NOlMIџa!Ɍx^L7l5 u +fmhӬe$p,j/T5e WunXAspl>$U jLp2b-SIχ#U dr "]P} GXݘK-%x<:G#Μ#B}N7M mb|q{aDISGnlՌyjTrfКXN>1TqWJC=k V~Ԓ>\!le C o]:$e(Ъ7ǘ[2N7(jRCK܎Pj wXjD{9Xn=EEO'hWV}$ldz ;xO|> nIiZoA h# M|vP8) Г"gWfp[|5dUQ_΍뮞9e_ə.>S_oZQѐ-:A`Q(OgQlfҚ #Ɩ6 Fv:Ah4 nte]~: LoWWɺm'қ&iok8ԠTEg؞pCzu۪|\|qV|E]-ꦗYfT#̫2HY];YpFg,w Jf`[,' *7rLi }p 3򂆢<ê߫p0A1z8֢eөpΖ.vSQZ}gt:tQN=W̚UPV16.E;:AАo^ߡoG- w9k<.6 ~18ut&])o Wc ))3!*13ȓɍ։F1lK)<0{?~ &!B Y{5ӜYDeEʦn"N\n :tdݽh3X;,߿%./iRi>7l ;zF{Ak3] ?Ac9meaU>{lźzoKЯs+XNU2P木@#9.4a7(izA )kmv[ׁgF. z GJ"ʥ'H~wEGx"H!_%u͂NS Fs!]XƶrB+u$%O@bs_w%XȈ)s%!ITq"zjbdWwQ"XCӁO~uo2˾]u2iGO'3TjvYÔr4-@jR% |c@GM+cmfKY E{-t qmt0\,ٲ@#N:[)w2-eh!/gڠYm<0z^wjlNZT^o}ro,_l*=ZAeM?(w"R-/ѽ񮉞J7GaSvkGwQ}Jj#.U4zͦ_1EehB]2"D qlUQ_|b'"zHqafE.-_: v]KndNjg Nة8I'oyypvjOzDeBdfJ9^b(ދѸʖ@6iI#ж }oLuUa/[۟Fٖ r\J!SUc Srt2&)P̢[ƽT9܂j܁JB5R)ɒ*q`[Da1RKDž LDE6R| rzz^C_v6PkÉIZu5hAq摹keB'}5PX,}Y_# j떞%LWm&Tr O˝+.=]REj_iVhM.uCZN:Ԭ+ KKJWdߊsNܕR/Fr.XHT)=˨Dڒ.8wdI!yvtҥ:p{tqF++syfg/,==ժq dK&pC3K?o\ń,*4{[ƹsxJL*:ȴ}r˷^+,┌:-hqп%F#,[ۚ`iZbvj;L#Ǚc.жD0łNɆu,h ] hMm0!%9ǶAw3h_[.bc,)ld<@>b Iׂ2 ̫RWGؖèWp&_1p@~J=sX.$# 8H3@ >F#8ᝳe\)PSe=t/"ԀxPa:rjM@庂6eǫQaSˊ\Z)ǿC0$/Hf:KG)liCn}=:=mr!oaOe֊uQo =P)<1*ht}eCp-ͺ2ji 4p{")9xf!3L/.9GKYN|#%|hXC"H|' ǧ2uTS5rtCs7굚8gԌ/ݛ2JOV1^uO^`c:A\K|pq7}P OϰJ[a4;s|& >Rх}p͍e5< yCZ bO+#Z6*MeSN]ש&}-:.6.t5D2e~iP} A@@z} w%T?-֤$ǵt6V[#ok!跪F8;.>^'Sm #泒C!wD'Fo&kb8qk]@:YRzDS6Ye@& AY'nn^,4'#W2ӈÊ@-3R+`05qh0>=^vD }+(t? `7!t-s I f:@Ȼ#.Zt'5iHx-Փp6r# gHXD*Ia >k c.&LqͿRᐷ͟:̶򊯣_ZB27|0ԃB(K+&ZVuG h=dE$ dN:X:[_Ѳ mAsH0=rzScқ@=4dJ jZClp-{] n_nz&ܜ-}eO4<3^z * Kk53i2 vɈsRDI_7k:OX0c]U:O + JG211CN}8wVr2QIq YL5CJf_(A]Tw] P9mzT, ]ܬbz}g8ޫ*L[-]ްb$F7OJԘX"p@OŘszO+6\lcPtbܔaVmC)N%s+,UiD@Ea׽Ft:K"v GI%%Ш(ahMP$LD9K7?S/&'M&lfϠr[ٙ{5VC*hQYf0U] e 3eoYc[vh"؉;q>Jcs/[$+m!/D>s% $f`1II *q I DG35R8 _VQ%g4=ٛTBQ1_,Mڢ^r栖+Kp j tS<8w 0Re(),Z!L__aƀ{- #CYb#UG'S̩k W TлC8*o1A6Axxs `HPHpC^+{(W5 (,".Xpo)< yx?m`J5-pK+o6: jcȾ]7V>wS?b[y^hMRanEd4gST)΀"L[]|-Xp=@6/ڕu]7_*/pRQysOs m#x`oѸ ~D9:G9) \_t2CG_vFD0JSv ASPd?hDTibؖt*b@HmhUTh`L/z[2 R_Q}׷ V]`3@ZRxTyA& /Pl*`T/{Q s1;4NUX",sM4ofĔaD灎Tt࿯>JM oKMu:ȰW'龃ov}ČL` (-iZvN>֓0cC՗B 8a`ȋpҎψc뿺vCY`Ņ[$7b -5`=],|p`} qkU[ݴH#QC$TO ϡr3P\HUAU M+vtH ]! JEo;Q֙ce)aěBfL,u躉,]dg,L^ K6n `<9 2c!R%>)Ycor`b& t؋d-qRJh{|=uв6E Qmao֫ W>Gmg*,S9˴pW{?ݤ`iFQ2T/$Δh#j▢-Ӳ~_Rv4鷷^~ Mī=n] zbjfrznilȣ"~Jw[e^kTnZ3\7@kh\~g(V%,5S^y$ 2*jI)Rf:*sOCrSJ^ej&f$뜎Q%7@z.:t^Zsuy$RcJ}Mĭ7d>|$N!G@{):jgb*ֺ&'a'g) lvJ/vFәJ`f4cXlkp_QvFMtFG=k #uњ5>K${mLhDdMm%4j;̆>=!" NkվuaLϰ=0@f97.(nƵ“Kr{l*UJY_"!%xѻI;HѩIoɡE8tfX\(9|z>oPj \;I+l)B FuX7) (m~T.>x^Mi|"S&!xZ`y$ Vb{f,_a"+=7n^e/n@|߾UgYa4ebeNJ ]SZٷMFLAݲ*M'ߕ x҂.n&WZP@k)P!Y8P.\|/TԴ0}͍A Jˢ(l"UUc.8!n=Zҭ؂̩IpR)3 w)?WP%L7NGz$kVGfj؝u_"4$7V1r@I]`pQ#)u 1b W3K(e%N ^ݮO;[e½ YK`g;'gW]7AIz(|RmkOٻK_4ᡘ~&[TnS9]AmUeq+hQ ]oYiY ]:;IzI)_pOc1*}[OIsK |X>t9c!ɨ|%/ӳտ |~Ds+}HYR {+C_!^X;$Z.967#0Y>Iz>TF,؅@C[a+'$%I/SkjWgzEmZ|}UWp XgLU, zRx wE۹r./-Bgtɼ{w$|F}z feMe*#)V\Xٱyehw!S2,k BҾm* r:wCтu=<|"oԋb1Ru? 4h1RC!V 7h / vo&YdVRXH(8Y=G7s(9N5g4CU"ܟ=ãg&i|})M' >)v7ՎciH=1QDFZW"E᩾kF Qwsit :ҎRU$VtRQŇ,V}QDTm= >m [4FDP +y= l-CqaĽھ7!hn0͢ (+2K[jf|A`sw ,;XŐj] 1<59jFͽ^/Cv-xOlUDIET7HSt2|t_<E? %.6hW,LN;D}In9B:!^c'~p`BM< Is)bβK󖼚hqYXZA|4xW 8#\FBǿ/̮6e]ӷO,$/1(ÎT[2k)Syep=81.$gJO_xR0-G׋:DIIېo5,o5̝J %YkJD}y$ sʑ2 m7㻦j U U"3QZ|S.$B*MS;ͭNΦl}>Q*kU`Vr6o11;bT}CQw0k(2s D-$xG9.+3z*DVa8W` tfUmHzѸDFQ>|/CC`W ĸO0#vɬ.O 66~ZVjbQ(X1Mlc23Қb#0ٺ@/ wJ€Һ#cIٻ"1Uicsyfn njo ?4r hdd12u6uy^kd0SgSrhZka g߰ 7 `WޜRÄ;|^x+L}- o'[_NMgGmpPr/i<xaa|{|-@\oK}zzj* Y6`2M!Tx8C9a̋΃6)+7Àp,DmJZ%{COym;|>|/#[~2^?W= ץ"');KeYUg05Q;~R=!i6\QyFEke I/X}{iNZEh9A TA`'g_'?-Lo]'ۥݕ}!NTsS!;iܔ%k}_YŨZ蚹ƏP)=vQdeX{8O6sU>Kݫ&>`ҙqh*^[{KF/c'NuD?M;øz>*OΓ@(JVeٸH7r ":xKOdWFH;s>u?RƫM/ G qן3 SћNur=G-&.  VwL1w#:c\PtWTػz:F%"c0̃}xTzؖ_aVY|yƯD{hگ v p8YWȩ1VkU4Z1??+xND`gY4&*;q{U]S -YfI}}q8ŜWC绾'%CQujjDI*{^\YN`j.8]lzqx1< IvEdV]58%#2<1KSd#>+ H3H uN;y0ueܐ۾cgwp8ާXk dt|( 2rHI5~tqpJlK轨fe#W#A\uIy~ OK_ ol*pi4Z'\6(3w>9dߕ0]rX(gF͞, !z8:?}+L]\5P=pQG0W LqC,Qۈ5uIL~U.]-JKVWە׀QErRc|H qxO|\g.} Kլx묑`4*6i{+a|>- a4\V\ICrOel/g6H#rlqΛp$'?50~ɯ5/c= [bHkGz2=[-mN@a)lЖJ&}jB 3V++D<gLl}œ+T|'KtOgK<#B lsL4Sٷ`J5F~od9nusvg_ЏL#L6\Xp8LFؓz+tWcS6Q;cBKkk ZD>"xnp{{!Q LK!+.ys @XeӅupKkz ?hwE&Bבqβ֕9fyB&$8/4y\ã훫fS{ c;)os+!ƍ^ ?w~h˅5J8%Ĕ@Ppsu =2[bhZlf8C>u&>z&:nayjݓW +5`l#cMsع  =Y2 ғCƜ$.g,%޶TbzpL5zP,۾Oh^T7h;gBjK ~RtEp \JY7)O7*\h<7 a]0h.+kRټNZv\k֘KBZDNTGvxI)U 4zGBrW[5xP8by]M;=^" ʆRMLgE^5վH!'5KUJd,qI7YQ[vۭe6DQn1|t`{K;tOk=Ⱦ &h70Ǐ\ձa52c !g×h h'"$G(MII'Ow;SW8i.Xx`+\a3p\\}t!^3~sX\mậ4bQ F ]IB"59:bq>a*g> uQ 5GOv&=8v[ko2A>U0qU q74S }RQ=D _Bd'ZFAK3Z>8s,՛1b^dG !7T[S7+K^7 tz9ppmsȳ*at F>2!lp ^OH >*7DHt]~6V6ދRSVuot]cd,ۙzu՞PǸ kk*Ǡ6v tڏ`\mfW^ЍSC7vhSz}es(l˴:oݛJWF}x22?O'=?9T1I2prM6_Zr֢ͅⴗLy?w1SY5KSg/d q}ȫ΅kGC˞I"$]0pzC='h¬*:W`y*F"G a‰S ~IϖTW{ £fapKW&}g\ ܹzDY7e98Jc{ܒׄx/Pr ~'c:1YNa%a ;`{t;J~TbJ^duDS*Z>^\`IbGi3!cB%Cttd" ;&+Lyw5J 'H3d$ش^j!ol΅s?YZP/  ᡊݴeJȥ *Zdo!y`Q%'UBRN}RV;ý4ۭ㳛|qĴViYpٹr}-I|]%Y%VܣTjeވEc8 eB?^Y,]z,ӆX.耺մ2䩐wPū+񆐁/ 'Q{ДM`dcmZFvn4rh nq7M[_arͷP9뇢WP]/FFJ?`s/= y?*৞,o3Mq &z1(z1'񝵻(*HʲRNlܙ!`(U>&&PfANV.`E` \jed1N]ĵo| /s*v:r'Lw*G!sS 'LZ;?J(KC*){}/NQ+rLȯ-6R/t83Ko 7zO %Lã nx̌&_$"(ĞBiz3-tDF0_M =?L D$oVx֧¶g, a+T=}<꣦Cزtae᥌zqY3*tq!ׂhɡi;n"(I Wy WkȾts6~P){zʚK5;`m=4hg#Yjƒ6TAi2xXTB\,)\`3&̓$bCjYc ԙ#ۖx»4._%sV[ʱj ۰^p!ՂBK!<ͦyҝϞw\V*٥p!r(24bʌT]7y*#Tۊ:K8Nqx1PP. "PQ֧̦+G.oq)2Kwl8@1v8Vu0C ;ĸ+P4t3HWky\Db,xݞ>#ek 6nWw)*E 'uL0rnљu4`7i[{G [fG&5} P|B[}vΡ{e{|c@UQOzgXΧ?Ț%d/F2!InӿxU* Rxrwgy8e$VR/ 챹oUyPCPz+tFFczcD"h C_U- bGvve*j<|~P:[;|9\5zUnXCv`8WB[$.;&Xӳ:y=!" ^@`d.{*X*ys _wz T cH`gHpѹЛ| uB Պ~õL Bu4҄Ȧ.|uG湍6ťosUmtJ\~ NSC%xo V(^3LtQ kdܰ6J1`#ω= 2yၷMDݓޕZE"&L7 s99@пp%U*LiM [/*SIUfEK%e\`$~7J!J˔T[psFgv^qw:}*=&Z=ص|4)bN"3]Ѧ;܈UTGBEO_ l_z?o7F]5ogTfWn>28%mmY;[Ş!1 Y9ZΑ594ܒq01:]0Ɛ=j{ =DI>}þ}۴᢫tgOB%jA;6$$Tzj35U˞Onې6BShB(1ݚ_~+jH؊G\&+ﳑ$)nj'aZm Yу6Jf^бdzlmynˀnj0U,E]j|#L:=|^LK"y͓CÍT#0*&Pk~ 9T|sjm8&q^[oaY-9.!1' ڱqҸyTʘ)V~U*Qul=IߚwPb&wMJԋ=QN>+Q/YRԸYvI:ު֖#Tjsd+m2gբV }׹r mK ,^F;ePsRf>BeR,Tx DB&ƫQg"@/%"9 rكcO զ!c̓;;׏2Hb:MN[~@P;)w)58^qypFrW;WQQUHyw7C֚\&~q5ZݠJofnQ8LvJGaXv4(9%z7^2_+x<}9m-Ͱwr:b%fU|Q1_РwälH2`!#[!M7` ZHr}z/)‰ ` ̿x0`pD$-7!aQ"z"m8@=nv u@\\EXduˊ7y|!>hfxޗ@:|Ū:'_ք0Ni|MJZU{XjaAK +qPc|~4t6}ڥXvX.lyʃٟ5= 5gs ^Ћ<IJk8>(?uQ"197Khd֎4:B$BL!].ww2 'ȣj_M(7eSo#v=2;#H.M-aӵcBvRe~9Qw6VE6bä@"#8sn`S𔋬]! Юz F3m1VW %[C66VϫZ> Фo{}SWz6(8s_xЈo[/3/) q s)n0S,+=|H=нQ}л34*T_N?C U̘ѡOLi%] oæV{ (ure?5QrD0\(~skgU!Zl 4тhܶґNăEky6!W)U?vzUgHkPP{ma͊ʠݡH(3jG!fPE Br$N7nlxy]@<$.'l8i];h(oPjƝYR$=5PҊ~[2F4_Qg\iY*B49lc)vȵ7r29靇 14.B}>G.9zed[]Sf[ 3I$ܥ]~٧ n{q#e$em.s4D0"!E"!ۆ'={ ?R0:R)6[`Jtk%tSN[.FPQ}by<˴mhUp)ƁY_T? ́'8kmq6{p ,9PdtT7P9~ܠTNG˒hzXTo[lDmhu[<[%[UUA-ip2"nR[UHbp; g/]C'%(mdΟ|D$Vv.4 ΃O<Ƶ_+QVLM;t_鴢y9|h{);(|SFCogH&+{J&'M3ǂ6");TӲ!bjkzТ| /3 77 jێl)BCsu]9{1UW_JԴ˚Dɿy Uc*D L.:P!0 M]Ƌ#} J_l a/V Äl^ŽGq9dnb8YĎ+d5050,Y̸i97x p %\(Lc.0!FI|CMg}ӹ֩"魞/jBv|fc8!dX֓})49W$2V-XUR<=E[%Gɵ8DO纴a}[eDi@rBC( 8ٸD:;'oKn|6>-L̽a =RCÍk08%Y4T-YU*Z3^aK\.H"V)YiRҘ^% Lt'8Z;JG{XO "S'͵Kˁ 5k未h?x'zf [~ڻew=`L7 )#>p1<8Td?TcDUY 8\_d68 N\ج.zGQ׋tֽf+'.O<3鿤qN+ 3EOSF@$:q\qooJGm1&6ɂsTeYW_fc?VLO)U$2B&l33 N}>e}(fbhQ+L3oq)/|Ӯ`B'~3$!H]O~{LP:`}[1ǷN, ^i!ۼl@*q߃CVOF 5DX%QwADԈoWk꯴: ȧ/o?i[aPHRψezƪ?'ߤ Z:aYWT>SR}iaZQ?Ḧ́ Ч/^[@ǂx6D0|4PLwb/%R4~=Ǿ8G6 ˃?^~3qG v0lyM?5΅ 0MQCHU7-AIE\ICw 5fj+֨RF6Nُa^sr> A xud:dfN6 \ƁSɖ ?|hW7OKS>(sDֲĪ~8\'`:C gi`ƞ}^ħ4Y{\){FI[Uo lp1q岲Вth/M9KpФ(&s@&5[m':DQ7lefNw.|NtS6pIooL2#R'`?cUǑ|,5ݤhsdGR2[6_M%ggtf1XklHOyB[nvLhe4/.W]zr_Ⱦˣ[dxe ._#iw풖0V"Lv^4|=ŚFMn;O_MF~r>EҜ+wyȒZë/:$-P׫)gP鈦c6S.E^񂲰#GN [<ŖIs! Λ͔C m;/*Ҧ {+y[A1#7)C0r:~&W=l;ҚkdW.ѱH[3Ftnj1{T\%cxf^U)Ɋ,Eoz gd !S[*가]>T`Z HK$0 ij cn <+&1ͽ.@4P\ᄋ˔ b=B/غ4pQ6XMf\ckz_Gn(FbccZHX^ }#7n$LUMDC 9pdU2hA&!qb[ÍBk~Z,&)P㣦b7tƁVlCvs6~>h[izdRkvvx\5Tsm)zZJd_({NgcjO3$ˆʭ%wo+Nٯ6{h\q=g! QxX=>يI0 e4v{VG+F!hw؁zI[x' R־!Pu^ψƍ҅~Fgӳ4Nm9Tj^vgh@:g5 U{֚;gS/|ۿ=J9h)ԸUz*I ԭdSUZ7t KhLYm>͚a'kԷOXj2,7:d5X}V//vn3p#qn%H*>Қ4uy/2 I5t.lz;e JLL{mGyVxRbޣ!=jR*_D{6a=b%۩5+Jr:Mb, uw=}Y>Ժ->$f91yDλ@d=}K֏A?boy I|%ʀl  [^\:PSRTu;)^ڮFwB&PyT]/ߝ6J BÒ7_a<'pyn; c:P p} F]J#|)|jAu&:ƗQ']MW'X4yMnBTMx( 9|W+y<1.'v'̤#cW(_Ʈw DZm95cʊ{lC0VIMZi9go ϗ+][Bp U2cvJ}RńA.f+ Mշ| ܀»b߾a n\A7+i.:54ʽ6?ֶEm~=eK?pwaRj* XT3ܐIgcUIQ>hU*D?yj9h72/c%Q8ňj;x:|6}4,5}:y2zAan4K(&Zr/iU_ǽ7*K+F- +0@Jߴ'uBS6qw}]Img 9T,K۲$:9~X)mcI+ J훪b|#VKߘtE82E6(rw͜/$}Sf0yjKZ 'YU1ddxG$9bKMi ca2N|C?F!'H(#>*^X쓴@5g&ȬP@du2ӧ!zys^rkNTG~.XZ͍eV zk*u \OkA;\f_*Bex&N@=>-s)@|&tlD DP)Dtzc!L䋆`΀4=:HIxBGތ0`s\TJG/ܫxnyUEЄ:bګOj 2M&nfىX]HP"T. _\;Ge_1rkS؊( [Q akofnB+Z6@.V:Ό(2ᦇqn\f¨th|;b"ޫH{z ʀD^<^* ‚B韷T!y~E?j&< 6CVT UE\)DS9XOfjr]i3<>N0Ncɡ6r'QHu)^kJ1Bd2wR<0S+хEETVǀ&',F'䞾b=6D$#'CE$dX1Â%KWJZ] 13}+$|4HkG kAY!Go%eA(?"hY>2J4+|8d*.B'-Y0t2<5=ͬY]E?{K̡rr|к[E}Pg-Sb8zcfsyEӤCk`KDRf_'T*Yyxa4rNR))-A+_kt3=r(0 ޙ 6>"y.*%?N-U'(8?Y[7^݀:f, |vLg䱔 ;5FaGW#z2x)5 y(_2 ӗce}kxvd~\:0:(G$ha2οDΏ"aY/`硳.@E:r&<۫pe R9HF?sz>6145p3✴>>? ek~rU3O7a`%"IӚ'듿&6.{ ժKa ؤeRiR,̀9$?t ShϥB,O/ܱ+vw# : gnuD9g1:7(q펛0I9GUCJc $aAXy݊ `[j_rs̃G02I _YX{xy~M ?e)!M| -t%n|6Vs!ytVCt̪'n fzMP=u` BIq+xGh9`P;\6G jdSi!Uj?ΞxHA壬Nx jक Vw@1XƭrHmpV?'c%QݶϞ`R1N3=g@Cn$v&A  :çiPx*?F}&<3C=!1NI#l l!]mKt$漋hi`yBPĪ-eG ?J1 Tq#Cn f\D=j^] +^n oȔګ*ގ}-!,s0#,@ WFZcv57Atל5]\)(Y0Ng l ;0KD%!f 8bΒTyr6`x)hrznlg?nԆ~ GT힠z{s;-57wD`?zz.|$ەUɨtܐOa{ H* T[b  `4qb 'Eνxe j7i_Z"'rTNõfD>>{ !vU7s-X'7Qv(Wgw_;?Iĺj5,IY]rK8<2fp{q_.:f&7ՠ +'%[%(81R-0y<<1t&Q&wkhdS'. `d0HCw+4f~2e*Q7%Yi(r(|%4PD7k%Ϲw&?S~܇k^D pyN}".ȮBP%nJO,ٳg͡Lpbڿw+k]Z,]olÅ(qxt,6ԧ%FR\ 8`߰0as|Y]Xf &6QǍm}~]oKӮNj - ;C{ JOϟGJ2g0'sH0SZz+u؛FoOĬ6b;> :um s߄J(Ui[z"B;ʌ,N԰Z_9zwOpqۘc BE/̮dOH'ެ>&Ս'\rru<2eBMLM\@~=4s i9wobFtcPa#64ٔ^OMëMl)Io6s[k5R)Pܷ<w'EvȗC-5+X׵էG?|[98-m)pY50 K޼p^MaA;f!m:0e_@bsmH{!N!`l fpu&[ du(v V I1F+.~?f`2xt6̡]ө\ǁIc[.$JBn6PAk[l dش`9@>G,3V# @v9;ihKޭ\yKc= shA28qIop(];DF;Z8hF&1LXc㏙ 74d&)3耉zPجlg2QM"ͼ?IS]Z 6r|#KחxE3u\!ibRW,͚Pk hv&K;v;g'(puu/^6f0c+x RE~nE'Je$|sWR6 IwJOBE/BR߽.y.Zc~iUf<'!kA+kzN+'Ĩ"DúKDh?DTxb@aDg]a%_Kzƒd%eʜpnRw j3:=['ԻS\65ሀ:a]T>DF0wVЕk]YϭyZi!zaAS8^zX\҅|[lsNM4- 1AY\gKÒP?z!m(}.5TԪ `)R(ZGߎMc7 3SL+~=$=U\'x1\B+ϟJq&(7ǮJ g;Q:8Jkz~?2t4(%ֿސ#;ʊ§Ts (o2ęD8좆Bl#\cA#ϋ[L`7hS!e]y#ۜ7I IhEdu4ka7FB|?\%^mo;eV']c+nTq ZܹOwJ2؁'κή9\^}0=*i(h8(4xl,`7uL?88 cPn>C/a^zV/Y>`eЬ2\P\I2a4%!m,^r8u}#з>%?o~OW[{\GԲa {uJu³pܝDiIccP$ǔ2Tx 27 Qr6V DMLg5WX{ݿ/&OmJƶ ]ܰ~4x~$D:6i']IN55;}͖1K:B|dEkxdצ 7N8IgQ2k ܏ ipTkIl${yQP\Z8tyҢݿ MA$RPf,&i5tX /Gdf!!z5 O^?TL٫?/;r"fƻDv:=":uokGLEoS"Mk_$)|uH_Ѿ}Tqw ^ވlܻ9_[fOlЀzغ :Y~*t]De#"8#iN旧.?g:Dr}|-}6حSz@ӇPR_1S4NiWntId. mEt>qؚ`j:$ ; 'jd"߳Yyh!7bda+3%/3~${76[a'˱mԉyPS|CQkiICWۄL2GAYZpJg9_rJ+4Lj(oKu.f6q5p4x`5f" A<.@րzg0 Ek.+f͂pHϫ)egRi[8URGXl9ܧ o ~z5[t\ &"J^I3[eڣfy9Jw^*#y<ő9B(!j-B"6srȱNoWhdMG5`cꍗtUJ# 4@ 9FYPSBna0NI}F!؎WGm6?]OSۤ6왝myJxLJc1% tԈZ;{D$ep1&gI[Ejֳ+!껈9#c>c,#"/R"j< =]BTs1졇ʶus2WߗC/~UKŗi>ɕ٥ wfZwqH*/~? _՚9*s.A+[*9 ?A wHzs[G*.T,Hv!Z 8YRC ;e̶iM6uCiW@Q ]m y}j.}CAEܰI&*4Ej V_o+| BOc rj]ʺG0S@Xi\a dXRjZ9=Ą {Yzds#z 2{r 9dҎ o ȣ[Pߓ  4lM.*,+ QS*uH^#i,&A)چrfnsgE"%gkOzw`#n,&_f}hN*9vj#$L2ƚ^k(K = }ʻN4dI ВӉNTyݷوV&0?c.6&=bji[ec40(umT|vQR02_JoMsvr3xRxܝe#3ڂ9_]_O³Zʹ*FQ^Z՜FxzmӜ!<(A?#_LF8xV~ +aL4YΕ=ތ冎%i (lɌAFP[% d4$L!h,|*%5*J[u*ǘ~_(rCRu[5͜-Yl|pL]?Y)ͽx.0]a7xdabJdY+⥐Nj:1oJw+'w)XPOStF҂.7:vBOωp9j_W8qc 7oiɳ~(͓Tcכbm-nmjOZ1Jh*nz_޿]^h~&h\f@Q)H(% (\ r>UdL/]BkW`8#߫.6>ot}a\wIs~[g-#.@)v b߈(Ȟ><[8:z (<oܸ`ZzZ"mzS'zYJ6X:co!" 1zRVYvcP 2p@VD$#jZx lotM)H-1TsqtU:Rd\W ,,D [C$o16N#DlzZvPOi>w3˒0]Tʣj'gq?8* KЫ=ZX<_@kR{a3PS.C2ɢ½4mI';QcZ; x9Saɴ_,؆sъ֤tc]Ay5t1HB Mg&߻-vK1oXBuQwD?`Sy$?ښL{2//AefICȏ@FOf}?8]jEm -MhI/vr_"D:WFڴ7]G IishD2\LOڣ^ukMg-c禴¬-o1 Zj(<;j3[ڙK  *03&U9g}Ӱ xqA.¾萿}D`ވSQ9ge{Ýj/?= 18N-@zM@Y ^{=5OA y*M8 @OjRh2LV2cfNSVZܒ9^. qJ%RTD*#Jˋ~<7ꁔ91-tGJr* Hsم=5WzgRG Ǻ8IvFγVg@27_!; !VOW1KI_/v΄%2?0qGv=o/%X6,8)@ه4f@?7sO8ٍMu+k $3i/.5#wxML!t!#17w-g976g 8tXUC' ;b$]jZ(mːkslW{I:pIU\Ʈ7rο'9p0uVBH+%yMe^; n{k6ֈD1N:%C=f>e~{{mm|;9T=PJd0Wn<$_4jwyD;30H+ MݐDzln̎GD6*.U?e&Q+NK+M÷ IQǘ&)Q%vlSY_iS v]A~q˔^w42gj;Ц͙\nۋE=:,osmoR?`pEtPB8t\'c%LQ)"DD^syONt(f!V@zs򦮕P2&0acIX41hŨ)gTj72ntH9V'`2N;)O ']J#uU7> tlwDLc$+ZNRV(!7]=a_6KsyM9v-}2[0Sl%g64*C_VB_.M\_dk?h_ң&5+в@t㢎,LEuu@ߩktH$oǥߛ[CF[x:O.N'IJZ RMP-3HlwsU3 F\CWw.ŭ[ͼ2Ɉ>PA٪gɃ7WmcJx4x舎6+U#Zs> .b t:oҸm"q; ~J`,[q8S%`}9׆'R/dz⍐^ ^OǼ}Eh *^Ht$C`ng Z6MI# CZV{.yJf Lȥ%=q|?2fo3 JYYA}bH#* @&l :0+q@).04ʡTOyKC  cΩ3:oymۡW e ߍsh<*t `z[> WȞ:"F jR4i66@-5,k(͏+#3GsJ˿+mN}5%A  M9M8z#ggM D:V<$r-s$)^8^j@#Xec).*cJ8@U*kĺCLjx;"} `tLQb+Zb7L?\xPzkQz 00]: :J"[2{eɅT] K],Fj55_GUp/רc;A0,}֛O`wJ4uA1Aḛ {W4n+tV*)7N/.|iWqXVƵ5pA/^'P^AVOZ& SC.J%:b* $E`?65PdІA&{܋3^vZFم~/A\%|dׄ+- Ϊ@O,YSIOҾ{rB%PT/* `NҊL&cTk54ٹuΰj~ [ݟg m V꿽?*hYk  YRyxs'$Y41*2 5V>$O!?S/p F72q׹0rnmOnva^_ǐs f<ڤiw.\9Ji踊e L|:ǼO5¥^#KݎP+ y#" XP l  IUa> }Ts~I}R2ڬ\j-N{_x\(杈]&k ĕɜKW݄dN`Gm?1 nASw/BMozؚy"V:P]4tySiE}@QSMJ:^@hrQ+1?(bwh,Йoj=| 7hE^@'n"t4Vf?"kh=aDO`_Ȫ8%gs23u9?/3(%͡3sLlurbSӸ  M_4TkM\++7VŖ~EZȵ\B ^ .cڂ<f5NfHCk;FvBnMn>J}!4a3hv2;J .jD)% 9fDZI=5\T36PpY'aW0Fbe3J(~/Im0S"6t_Owjr$\=A ֚FUgF7#v&4&R4-ɯMȤW|k\!(2?!!"˟.KB-pj7L*Х&k(36;vƅf/'JA=xEX 0i٤QnN|eL%V s l<o.F'lfXK9(ŐƷ>KZR:PZsY>@&EA8 5VA!B0g:]O &>f椛tUU6<~gAGD ai?] ݉c1J!k%[P|4_<ɎhwНveF C1gOogU\u7su?!l)Ձ$Z~ᾼ& qE&I.^pNw}\[JcD 4sGӹ( <4 mj I0q0aJ gc|}@iw?XXF)S5Z>gc<٪>'?η< JPzrBG\i/gX&Ih`x(zN|lp&LAsUK 9|Lt#/5wAtnNN<-A0hz*C?m{4&O>DA;|)7nNvOT9F=ήs!bvTاps ==؏Ԣy&S I3JAAiD70c\b8H\h(Ge,%?&Cѩ6/jh)0ԎǑ>&AI8P)NNmIuNWu_)tz0F)UNeY΢8hkeb>iZCxP yzw`j"K? 54mRN>m=U׭1SxsOPRU:LiM@62I=LZlCU&i'"s\C`Oy){!j`jD؝@zAj8$'1JPg:TAdUH<ɿVaIwazgy?Qa1adOkAW^{!PnJaGݻ(yeugd<G9#a6mЙ{a=1gklXHh6=g6Fh1JIUZ2bz,QI&3!T|gT!g{743KZώTCXDX=u@ӟEIPI qC`c!Oe$)]C.#3v1{b n[tv^Q O'`T_c[B$Лy*U8F'aWOλs6 ueJXk[J2 d㱣~E__;J*%FV .w"/$6 1Q3 5G!/X"ࢮs/馭OIC=St;ӹ=V ЂՉi]q ~%pϋg@G ώ삲EE\ qC"y0ν犟4}ƼׄiP' /pR "j#=6oÉ&e96+?ԂO_MF3×3-j4#A_PJvrfӟ`p6 T,4QPzO7 PT~9p|M((9T m),-?Kʊg\0&8.Vr2&B5* 㟫00,N!oPXWhPg+Gw2@BY|\"a!4~`|٨жho+EPAem8F7X9dL*CuQV]F!o y>R7l҃wVBO~̕ɨ桼/Tc.]O}m_Rt-W;᝚%w@d݆DBNnVmcF$pzTG؛ ˳;B"ʶ-|c/OJv3xggވTj*%1̌Tn͕9%?_Њ[:!ALM?lfI' }y 70Gilʝ~I8MfgE`'Mpg"0xixz)8RcnuEu7b@(; uy-G,N뿭yIWB3]b ӎe fm6ue{59l EHfFUJ|.nowFsD(3KTaS;f/Dg餆UaWr{~)41hT*dy˻Ħt{܈c[WvRu!!ezdRPk !ã,UY z)'+"Y^KFW&;=zN88d;pUw );tg6[G'dE~rRgyW5H87ӥ1Fv(t:!Ȗ_5G^sz##ASBuJzn4[b5= =IhVUl8k$0Wq29Kȹ6uHЦ"̄C^/Up"w*v̘X,@ gmA 8޶66(@l1â~Z|3FSU!?{4+H5 /vAKNm'zz(X aƯLRfa֠M:*mTq'Ų6ֻzg—[΃<ܹ_["_:}5U ʂT T( bӆFЃ7Ώ 4XLK.&_A5̊E,R.VT%|2.x?pgpOaºW yrDN]-{{ H1k +k{Jm?k)Y}L.h_€+gѲn5[♐DW- ƤtܵC+aGVl\ŊR,jÜQ)&ܛ= %T#\M'k"K"~I kqhO92dBN^V 3{ND첑!‰l7z~o%qdd`Udl,ݖ7G/AX0P}+1ʷ(>/pjZK0+U5xwi<Uq7`%)Ojvp+;?xnʄjs!qd)*ZJEͮjEZ3[: %n I\ufz^. jk*㰇}hzogc_LjT֔gwIHh!EE< A92g1TeYPLs*g";_1n|ؖmu[h燭$>~d(0NZe}qt1%pAbYÓ(-3*#_ēpӈ>1⪞.1R@r9u~xnhO/eRr: MU}n̿us,>'T%MYwq-{O44ʩQ^CQ2j#0|C u_!'{[j92/4$|p{3JhXQ˜jZ(94q"@9h:+b|W]!Ty# 1%֏-56rQq9LK`BvD1Lt' E I*4r?Cfy{Eq>\5x:aX~#}AI8\ rYt8Ƅ+txr@Ʀd;ϳR-:֝C4ZnErrJM2c#CoՈ<0ǣiF̛ǃx(arH|͚)pVۈ_,rM;pS>.h[ '~$t5`eŸ-?Ƭ+WsX9lFvxEV #n2@y0cǠ&07 *oL j:FVXm[ŞӰ3{ǽ:#v _Co*9k)3zqT'uHH-S2 /' HSF(g8zC ĨP̫ӣ&VSEזWIy%%_~9>Qjӓ,{wIw5

qUdMG}dט}k(9HlezW!WA^0*2it4|Zt؝8 Sx_@lP:܉ŇT\'$}`ؐ#% Vof}'ϯhr4샃>HiaqF{+Sl򜱥oJcrgBv9$F t:iVtK@/#{v-v7@Bc ެoDT"c ʹdFXc 5ޫ;ҒDTk2P(\+O'-!ީ3QRaɢSr8,>z;N>cl.K_F>9= ~!PzSK$Sޘ6Iԁ>^^e[s!, Tٺ]jG1>p̞7@: sV?9ᾉAٵkUPzEŌU`VgXux@c;{`9EsB /Hw'z^0Hx=ѯIavg)@Mw橇ȶK3R=dQm%>dִS9jW搠Tvp= ,221 n123a'Yݨca7,x#"ggSP/*0vD@wU$dYh&6^H/_smqR 8[NiN Ȫa6O~- WphX`3=CT)xZ:%zK=o߄=_ hP Kv?ת#:mHVPp1J*8O}:GD/6$L/>w }f*]iǮeEZ;A[b g}=r_qw-Aq7h@bBt?a0_kiN (4lcŧV0ަz۟_̬PHy_@j cM ;p}O~馫<:{%vHS)Ǧm`ŗJu]u)C>lKhn44yHME#\o`bllIt'ΌQ< >s¸|RyQ r8+?GVǰ9  A}~rިb^@bG[!J=u *_a4GmFb;Pύ'saf' !Y2xzdփidR(f%CF'5a'*iB-,!Ŀ زevXBlvę΄D\:]T1m@rfܩg`qe  |˓Q ʁ=c 4ZăȾ?4Mp˷l*z@Q!r 0bٛ?QRhz{F ?/" hRFjhi3iTTYQ_Oyiv̌`:xOɸ|q,lCIs7k1{E(lPw,NrX+U_l\%L'zDKM4zFI"7骜H*xjbkxLC/A髤J]28)8(3۳{?ug菓n(]b&$Xʼ.JHM5?}fb'b X )#DıyC [`ޡh5Q_6p0S3:ʔu*2`@6 aWAh1MVkm,8U|LO&4FR3GbAI3OQ`1;VD~Li$M%@?2Ҕ!nrJza'e?i@~{uX̓wGS gNlRf6݂l^b`Ȝ-z:?嫷/0/pU&SKwn[U(t x؛_pԵY;"gk܏p8i4 Q?6(+̌ikaz <|p:$JZ4Gcr1l NpoI\gEnHuc*׾3 ^Q;VOVR{*9^doQb]qPiDf wqt h:K~ B2<{[&㜈a?<-.~΁:\&,~2߆; Gݑ:smcDIo(e-[ )4RZ:ip-rdtLpLZs~t phDBwYd͵l'%U.!mi*{z4w 4;=)-(?S:E*!, -׈L4O SaHNm,1<'^vM -8fJCYgNQ^㌌ ­ܫ[ sKz5ū99k/|S~/IV Ii?7}M%D z5l@Dc%񼙙D+pS X]ہm> GƲyA" vؓbf&Z$ugOIfx2@YaHVt>B4!Ȩy39]Bg"#J` ̺OrjY{,H4]~N%K@Q Qiws"*t'Zu%7{y Kŵfi&=E o;5K9Rcc/IT;}Yt߭Y6N!z1 ?Uoh6l#&DžWB~܁tWx/fl9h0m ::_b=3R[~:jVaX'ҹ[yP8Bl 4CQ Ct IE橅f5y>#3RW=8ڄծ%n)aha f00\晬 Jɑ7%{ hR&Q޽d-Ыэ`*vέ|,ڃ31XG)Rk_R$:{](P0B+l39eU^xhFP>RӿCZIHB^3pgٯ~'r%gLZ : ;ddL#/N lևJ{#sX8Oi鐓X-]) Z6V?QYz юE4Q<ŭ}Uk-oMP7Ñ,OБyk΃6&a\Qr㵞t3F$3;ˌdb`@@ts0"jkJ VA}*sKK+t#:`-XWadLS:z%wf2!ޑ.[o>ׅȋnڢ"he8\LG0(>y HjHѮD.d~o54Ts -cח <gsm@vDnt}2gC:{&oc;B[ K ,j&gmruO+}Pr/76m:arnHP6Rӎ 'nߩe7P6t/iZ<ޔ=k%4OcIyhNWTh O_eIbv]t)br2:T_8+ 14>6 XxL6GjP빳;S1/ISV:HO̽%})7'\s&P|(R`yc|UhD5phn9.7ӠE}Wڇ$c:A)g\[V`.)~|y &ut#~ a|n3HSffGv]<Dsg-} ^ؤW^~ rM.ۯ&ӊ֙ w[v,)*2:YòRcpʍ=foo=LGe.Ӗ{ uuPͲqH`-(vy T[]职d)Krqyڥ- re<ا4+~Ev3 H6( QYn&>аg3 tYβђ? *[N=܈ӌ5q~͢Ta};[_jOK>e^Fҍ>^jD(/[̠9=pfн|sӯ T trZtь&O>0BHZzS)YgF75QS^݌4FLEŴ7KWPJ+"ҴW帯5f$†ݺ=6sm0<5H#+¿(=6Hh@ 1\s%jy zx2H?ywLZ%xBby%Xi\83?^E])C/k@~^`'U>¯`{hmab_0x(uGQ{qS8w(`wj-Fmk!;l7kܗCާ=؇nxfj(ҽlt>IS2@z = Qe|ɻNFc]t呥R'dx %Άc>,19|ٔR*$yW(ʋVT`НyF&Wl7=]/>>n󍬺-_bE2$V!ݣIAX0L͞~$N $6|eHLko#<-M'ͧ:N"019mt;X :eTk(ݯtfO aJL5bM]'w  y%. L~6UdF+ 6i cI㋎"uNN IÏfJOq7w u' DA3m"aރADܥk^̭%߿]$6|R|ϙ -y߉yaZoPr放kk;Vh=}_pC?_s &$M 4C_&ުI[-5NViKOںhj "A"ˏC5RUB}O+}9,l3yN䘦ٝAW>[O:,N:j> JȜ cS?oʔR2:fE ;N>⯬xe訒3%O5w]SvˆQ+:₮WMu;d"oB+NI5uk$FQ%ZI(1Q.=brR#٘cQœR R:)Ұq_{#&'Cf}kWpޡ (=W5 d@ɥF^v1qsmC(2Cf76"AAcn G_+Ɖ-C~T2W!HccZqw>b ߧ#ȄzΌx9=i&{nv_L@ڲ=/͐pb1ۀB)h/dyzs}]"麋ScU AO kMPq7삤NO=ɯ8=cÍO;#1J88ˠY׊s1k y m~ͫ?siy9?o+.s1i0?˰f6_wCĨzNj)~1^A-p!C~k~5kXC8+m=iݎ%V(K{A&fgPhj.J\I0,QJRkUC-<U+1DK}4a:m #w! g$t&wףO?}& S^@-Gq9z(觮rnөnmEب36s4&3j6NoFJ9̇tO}\_9ze*..Nkꭑ,VePv;J PCj5EN (Ǘ;6}^Jٺ'3C;9Kp(yv-RNBmw[.[L]bJBumH>7`Jyt(鵦J%7GF,+TI/)ƛh ܳ;ϋMj/_j61J6m[RVs9JMBe\"'/I# P,ͼ-rfq}a^{(1Q' nJП`{6YEr5u!rg{?."O%6av ؈b ȁ+Ĩ*j뜌{57܌Xyq(1$pxV-ޓEI,5yb,dz(}oeȶذ"{ zV\ Vg5th-!s ntWQb9|‘OѬ*b8L,ˮ}Ң0uJdE fUAXx@K(`=9c:|]3Q.e8> h WyyJ9_fe3ύ<|Ixy5 t7[}NTљQdp]\npӗ K f% w bՊC]ϷR$L*\UxM|s"mz\F_޻Fk\eg%٧ e G6@<Ś!.Xee;G#j3Ѫxkud3 AR3F PwlUf^'5u$oJ|Uz᙮ ȸk1Y,._W'_.r6Dj Cl-C>@6G6P+J.6[;ځ۬O[@M1j9hN-VѦˣDv,P\O LR iP!6}~kp'NF Oz|^ Q[}{ֲWx=´ro̚å*F?=.ҒS/k|=L0Õ|x"g{/ c0|}/vvFa2{`D* ]+U 6!)X=`LUS^(n}ZzU婯=j*,DV ]X 8˘~Ib2\)qk$ cѧ+ߺT=jm_ il˄Bih2b, 5] mz0򶏔~[Ez)ԚO᠆VF:GTe|t9O}/Fs-/8Qwa<Ʌ{;djkʊ=uTٹ{ \Tb&k8á fIJD<3OU6{+#UZ5CADrQcfC)o# OnHzWTmXC̅Ft-66|:V4i娮Xs}^SiD1ڣ´ \h g厉wI^tOc:(屼1UEpųH oϧk<4Nmo^MY!sE٫}Qɗ GnBw%"=m-~|yo=' 'ou^.D^&)+_I"JL1g\)*s'ɎaN mdc HrNѳbP)RLu#7a~~3lid*핰Xdp(AkG2B\x"+P@NGLK<.0iQWbcq-qV3M \ɠ‘<Ja}Oxǻ X(sYo깴Vr>aP!u׈tQ ]wn|%u~pQK{`QT(ysȌ.EX\G]/"rڭɝ^s;_ %6/Ky}MBJWhT]2)>@UI/eؠLcHN`Qɼ` ^j{Gq!>-cWC_Ԩ>v?8WoEޗIC%2gr=Ai9;f;EcYfיKmS/2)<1oLX.QCbf6PC^Z;ˑ)^I^nkR<]Hf +u D5 @:( W^P/!jSQ6vڭ';ђV8'D(çʕ$3\NFeKiCV;>B$j{{r`0 iKc7fVkbclS`eN뗒d k~RneA`ϭtg,g&i!̮&6`L_E>g[\ gb.09y?1`}ٔG-Lo$ *1AaѾC|XH5YKIv-%}K6iγ!n,gcw*26'bõ4hGkfxT}[os ˊ lfC^>TlZF~M ٫U5maG\-4%6Sڂ:~"Dձ"XT;9 z\vKr0p]]{I w8?'<&<\25֦^a.9kac)V>'"%Vn..1m0<{I^@[˭@%B %gVE/Ӵ eQܐrikT^aC7i9~ZJru:*=pɂdxd4ZB0f(ߙ05$s[@~Sn+x|zYFƥP: #uPq$y InF4\'&ѕqdt17> ( do.ۄ)P E!C̯K7IPg?}Ҧp/mᝠ+j{ ezscNEG٢ RLxlg&FtIf/D 4gxu)?L~(Nu4܆% v{m@{ΌCIY2 m9,MEtWM`f`}Q:m?4ud@g`&% f{)ZQWr5Ughz*_lo TB8i Z$;FOՠ=Wcx<i]Zfo#ˍnBi?œG 3꾘6Pbl4r]xdb6ϟڍ7kҹWQ,x&b`c^7׻>V]8K rdr]fH5Z2'~ ٜz#QKm kG9B^uHiL#3/QxD|9CRB9PPVAA^o6},) w:mً!4M6Dٕ5<VFU6R0\۟FV޲שgPWkOWtE|e͟0FX-vxy0J/[(@jbnO7Zo\7nIH'$ٍ1g*GwGN蒁{I!M?P$Q$UD<<0s p9P q@}hSTTZy5A8>7Z^W-#]{ :.?@<;s;<|bpVL{*NiO a2{]x=Nըv}s]侀Z)R_ 0ȽJ@8W$C~gSC[,mQ9o%̠PpvK)ދK~#%ɂ %`7 _*1û![KWi6ݬw0ͧdgy5D)swR-`B^>x@vSS*^FsXX-lCtI.KdmQ:%{pN ZX6ԝ9`ɫ5+k=n!3cRuLg5B=ynfXsW0ʺpoTlc)D֣7xZjEHe}|/HCpwz?/zk@6@7i!z5 JP{@ѧŗJ*6XvWlm#n%|<ïDzzgOUp@],o\b%GUyn^#|0Gu v|2~rB&wA)>>\g %VaTvaQBˢB|9X e4D ["D1.W0$ED*ط5le#bL146"/G;edgPHT[ Pߒtob{b_Cy@\DWi:bwX]/O0cjbJ}IӚyBUR]Frv86DrP}q/=b:޶dY$xM=h`;(82_68F@yQPqBM ֕Fc[ynaF rFQ~=l`z#Pؾ2>mp/4a#]Yϳ!E: [ KI>yHB!JULpc__wWԠq:(!"%(QY,*V͂eƹZpU*ޖItk+Ҙ^9Jp82>.gi~xr=6MsnIBQc`#,\1L<~ǰ0ʥJXLz#ܤj3Hb;ޮrq>$nǾF)䰛J 3}Mn5ʍ6#D<4Mx#|`B nM۪i;C+'%Rr|aKI=2e_+-iG!n s7][mvoAHOkm4't)>/:Sв@nS# Ѫ{QPNZ$(f,@؃oox#7R#e lZE@T,Az2S#i X/Kz8{qR:Ed#غ`2Sdwݾs!@?Ri0XSi'fAHvzASEDՎ3 8Y}UַP"nH0Yhȩ'%E&G)Ijjw˦^_;]ᏔVXq8hF dC;Hcu޴k#ǩ彪Gxnj 0ֽr3TIEEY|?rc|M7Y8R>OAt'GF86_+Ȝ$1oyfep\NA4tp^ҲFth 2n,YD ,fuC@ fWV5uhvXXmzA4 =` c`_9-f#AqX.(;Шsa@D5ܕ7)+j:(hJyjjz~a *fG4/ g)EG +zM| OK2VP(ևnK`Xs_.,ŲAj'KC᪸r >|O6Ql͘]V/QGuЮ շ^>D@ӝ댴E@/i>Drbs^oj<2:סzPGU¯ӡe@j):vU^k3bvwZ~f joeD"S>"+ȢW'rHVw/<+myJ&v`HZѵNk6xa&0B[ff@I!/y"cV@&Ek~LƯl>֏4Xy[L ]s'\ΥSs~$vOEW*+])tG tv44_l=Ɂ6,eD-S""MȎݩF ZF,ռIvW^toVPέC%eT$tcd&WѮFŇz;V/>Fù{ lTb(ڽg@kq9<ӟD2~sawDY4$vtX- /xܝG}ž(3uS(|,%4nãkD}u |Jӱs ^٤d%ut !;kWv"5K5c5:E"lGi%5Aج@:Aڹ̔#M0o!t.Sqc .\#xȣqi㘾Ti7JuUjł^Y]ڔV+0&n&8㋣=d1.K4.F>i$gh>6dFe6s޾dp`$! )5clu0B3wq;u9 ~], *d |:9 T;ڼ3[cx+ bʨ-F䁲zp2#uTG]L{ʓHd>tiMOpZ8^SX1/{ %jqv#"(/BXX(ve"~jVz_88 TEwbD&>E4Baq\v7Wv;I$pRkr9aЀɗf09<ډ&nw T8I,ŁeZ& tvn捑2\fq6"NYhp娙AM=-Iq5H1Js20utGxm䁯Ұ꟧!v!67,|8B)E;Q~ |[qiYGI[7?DiHr%kA=}$üyz j j,Sqؿȃtdp`%8>_5<%\~*4NB\Ib^ HSe4`[qQa2X Ƀ#b(LC1I''>00 l=Y9j1_Yι$>_J5ݿ{+ˢ䡪W7,UpD^쉥Olp9U=YBt=W~L](z&h?Cd8ZJY ,s>~%YT2wЫa",JЛy}>c>ؾ t־e4 QswbO<6XV8,FDҾs}I]8t: J&K626hυ zX fnLne(?޺m;KHt?!DOZ.m&PFLa]_^r1κ.B`(s+V$& tIYNqX-:;[ <}M#fttuP~zC7 .ˤ&!d@ԩ5)g9 zr+Ԑ<㩉BGdR;J^ dF/"Idq(۠s'N4lfA-T#w\*PM3&u|9ѿa(bTb7/3$ Nc> R?` t+}`g8wYDsX}7=q5 4bʁR܂lbT'+'IioH9n]:3SZK* 1%?"y¯ %actlrd2'_XT(?`׾sm bn3.]LƇ%'֔{Wýq'n|/9=QD蠁3ȶ,冩|hЗ)Gsb;}B|ȆkH h; 3e- H#b0C8ZkF|{HF24/&3SJ+(X%K\o+G;-y.?m6tj6-xk`jt{c,h~p{`T\5' /| ɽ@EW(uMJ-1 vPJ97b㟛T4]z@Қ@f(j^Ag.,I3iJ!D#uF9OD$ r%ρ>UihlKΦ"}֪U4]h#NA{ Bt]QJZ  NLJ'z#"WWbT| 9+yzNc?vuȚpA} 8&ٺ'RŘ_N[j-lX#8PXR@r JM=ƩWк8{>(sŶ,]-P.ߛdc"E>iOF n0Sz`ϳ1Q0 YN\oAת|K?90ЭLxi]QfF&AYNrf2\'>mN*+{ר.TwO> & uۼS>ѱ'`ZW(6$1|T4]7C.KzjݭCݝrp$$PHP7y(ݯgvC3 ~ό*XU<9=k3Oۙh](~7|S %GV z*>?u&#Z^ҜVnPn "GhvV$ O,^S3M.o3+,0tk9G8>iƓYaf7#jB9r%@5NM5$^ -1fYMDW癡o+֥6e4>hŘ6*UXV4|a?C}=w|۩ѓ*|JcE8\3TO[\1ȗ{kC,rXg 1YpU8L56Њ{ Caȳ+yyBG+κeNOI BDI,^rɥZXU5kOZ*3yM*eb$ި^`Eiw&f x!Z݇So^ӹl@[ 4t`ӂ7Hp—Ttl5ϒ|ݴe-gKڙ~`QeepKM:F- 7:ET]̯;+rKC>ZVXܣ>w [_mh牵Pv-^vY vZŏS^2(.v7Mq'I!V-.hȌj 2,mвoxjf~1^OPv׭Pur08^5)Եt͚i h9t-eµ;z4TpK$NG,FfSK;g6<줺/4l_x0MCKnLWT3HETT"X.} (4<7F*UFyhbQ1[06o/%)yv/o l=u'$[23Ljݹ_bX#I޾=.QȠR.k7=%fU|sӤ, zHxT̪Pswo.u]쎱"GU$@7 Kn܆ZRu+J)fd10IkF|vqx(x`P5❯Z 1_nU.`5YZ?wwwώN-+[-:X׈¥-&v\ :C䅵v?k[P#AӠlؾ'eb<՘h @d 2́uWL{#ȕ`kչҹ{:`&+?]œw[BQ\R{n!om{TQ7jatZW_eӿa1]J̾HykQ_v!3Y1q#?ޥTJmy:j,N U0Ӄo㷷͒ueG.ӔwvFV"` < u">p9)6r-;Sv?Y;5\T"ޭ:E/zz}p2 " apCGQ,i.TF!d: Ojok锤drx;̑ެ8~te4XqXPQp 6l+*z c,䎡_W?Ӱ+? #ls>X}` V/ߎ M @X9p4g`2+Lx[G\(N2?= e!W/RؽR<-9 Hlb9\wL(@ & {oj"@~I}7ٝI&| Nĺ(ibNI(,_o c`,Ta]L(&e_(8LH.M/  UrP]nC-nkǿn?Ίhʕ*{ב)o\~ cuB_bVGN^w+\ a[ݢ=\JgPkO{ig>֓|V%mӚj) Ɉn_MxZ`2>&2p7 F{66  Ž Fui ,PGC_v[UʩtB";gٯ)ܤ .t`ґ Ӣ/1-GdԡFE!-@_S4,۴ ==aуct^ pCA@BV/$ZG;" 3_D ])+OΔWVQ`w Kڻi{(; %/#v'c.e !+ 13ܾ$CE,P0D,g݁8f~Y.QBk̷QRp"Dp؀,?"u|n VO-.<05sɻV!W#{o[S6J\"fx}J#~eKNcb >qE3b!#ա,W' m$9B 8v ɸ_c,dJ_#k̙,#Kڲh#TecFJJ} 6k,Hc-smlޭZ5whZ)k5-G qt"Ǔ_qFaxYvSANp~]U.A.3.?maEf&hngӤ<Z3ߧQ6r0*CR/v #SfCucﷅgX>qrW%j X=0094A#ts+]spYԳ$.CIҗx<qf5 Ӵ4:Zqx ͭ;`mX7.R OQL ":|D8ix>nCtD]\XT{0^%`Z+@t5aKLPszE=)D]3"r6v"2lN=&;`ݩ\hep).@ 26}ВP@CUp(Tڋg㰬29T[~ؐ9j T1n 3脍*Obpe5ɅYJO*ڃ(c_u|L Z+Vl+nLOz u8GO!04g)`CIOOlV%WU}HL)M7jy&D"sZ\[a[ZYQ%p j36|Z\pksCRs7Snp199hmWJRK:T,6YT2-4^u6^o04%+٭~k!'`GކsѫTW NcÓ ' t'![Gw (=Y#0eQa⣼uqk5/.mo $fvLMT@H舱ڋ&6`u诔V+\2 u;YRx*ZL.js8O׎$' M=dS0-)n_d XNʵfI[U*U׸QjJQWUN~%M.œe*7xgOU;Rl$SP-{gh58!^7}A5Ҽ7ʆ-JB,g-BerUߝgYzC@b;8RcnheC僇G7ӣ^R.kf˯-_@c]ÙN=X Ab _H0Ov w!i4M5K68Fy \Td]1?_ع =bS} xEId.C9'Ur+PH"jGfC,imlq4Ӯ}=ksA[?!Gd:A[>j0}JQ7  -S=Kp@x)aGM'=yI/a]!M(]i? |V0~Hezg*s!aR‰'1 vdf#vJC\W&ԏi(rq)\q- &֪ŞMuUE&#+i%cV at(7Wāg!.:_BKx] s k!@-1-l`-{ygKP3\x텵b^&X:m9 YR5]nLDe*$FIRW/'+?"N{J<;'icJ#[SK"'%S)Q @7Gh{P2rFN; ;OJ(<@QhG ݪ9>¾/ADO /Z|CT;0P:,͝"k`~ U EB 4B=C;gXc/r<;8ǔ:?Fωpع3qGLd*JgI^1JZ{X! qHΰtq 5a i&BK6z#ڽ/ȉ>"T)ҋ)]s8ǣe&Gj\sHcbt j 3>RhpWy@!RZ9?r C47,}F'(Q\GԓF:+ 7I4+dIswDZa Nߙp+qI Mr &a4h~#Si_/5Ddi q|e"֢_ٰ0$K&kil"G4y 6d[uL;AV c$ ߛ3c hei:]XN^dĦhAGC uV}ϚzA8g˻cz!9ͷqS3Vӧco]kT l(DzJ_> ϔkO~ZxagEʉ zؾ2v]ttVt3[uݾ:u& X Ƚ3,R~^W(&GXJ +_"+5XAL-3Md=0PPӏ=Mpr`b́ Tvx%DZǟ -Oz7JjR &rqo?Xs(gX~ 2 ګ(щH<S [ԕ#r?UZ㛃%b8*#q5>!tCIKqa~%S*UZNbH?/դTM"[3&FqݮLnmK\Vd6 @<\\f]BxRåPAk ϛQL.C=sX{o9^Gg~ CJ $`[\;5u;ztHϰGRה,hF3Ŗc+_ !2)r:ɔj-:jqc4 HY Coau%6]7< @hLtj&m˚ԕXngԶqӟRIFP\=s yjpPUR2+#>;8sЩ6^}R~ MD*z G3r}d ,G'P%z- L`6O/ PdwWY:U:`K)fn|QU0a&4t4FJHdbGpe>?9적jPHray!aZDCQ~Ax4s7ҸШ?&Lx;ixHu- ,GڑN;(Di: wёǞ&ӻN3(|#D u }q ǒ7Θ@ gugFŽ"tR_fdi0~c3-Zk]}fYM Lz@ШiOrl>ms ֮ҒKFt'YVk$ q`Mṳ0coO98ʂRWbXF9@ :>!7@oKyD PIs WѸ]}m@Y !r[_m5l%4O wp k^q/FTl=7TzvT#ŭqk \,D35N2#2LXE;"2Yz*h6fF V0L%-ˬ{&7^G1-̓e2 2K%gss܇eɭGX#q *fl5 q_=}S;_jy{'@^@F8/g)՜Xqz59\7YK 3Ҷ?t14A%;e)|n@jnuaJ22\.{~\yW 4@ yq?[Z[dznv/f>:Υ޲v ªӷf݃2I{{ 0~P.^ }9`%VxJ5\'C'ҙ|hod~rBLqcK࿜fh? ,Ϙ'q f:.jX6"m\Թ AgZE)w&[]fX3gZeĮTgG׉LU⒐gv̖H~و.gqw %N^#Ddn\htDNd?zp5 3WM id9Rƪ7n̨ૉf[{yf[UxKq%>vpK]wo)?"KpcZ# 9I7_nbRfi3s4۪9%<ikz JGuuTE)O.v H(zP 4vmk>"Ĕ/ l<1 331!%Gx6Z{oD{E=̑twqNXkz%ө͒Z ҃+Oٴ>(ÅJ#mcwҵNcB:Ɔ]C)&-6I?H@; @jH/ͱt|}9<"mC5]knЦg?|֘u=<澋<`Q$'VMpԎ#J.ڣD>īCzaww-I2s;;Iq{ka/\|*PQ6|6!2DuۏF4|!4Sb܃^E>=WDz`,h$Qt[+3"#ϧ!AfҒ:4m/=,l ^:ש~'8~jb3XN[kMG@Vn@FH6܀cD ~h[ȣǁXy<ݲBӆ~6KIG*Tl4sE6;n:Ω>R[IɞP?Qr!@UޣRҲs*l KѲ)^Rh+I'3ɝZ"j \ղ-Զb]Y TPa+!U/DT1?vIDׂU5=D?s ,%wz6&):Op^#/{֫[-I']6Zn<&v3;!+)S45_ELzbܐ aP^ɨռ3>T(5 Ȣ 3 eÝrz]2.-.z2m}zt {Tg1q?I7򃘹:JR+o%iVџ拉qv*a8H~r'S)|`oY^+=hA61zx"5I"ie-65T0-H{&>oq歱ǴS= yv !a|7uV[2Tȗ&8eUy JQ7'*w-q~AJReMԔl APJFe8.}S,UU߶*6"M8vړʷ XPݾ^< !Y(}Q܀:šxhVze[9qAw^<-rBQ }9tU(_v fsX6 ZR.Z׽9Jfs*rK\GX7b4CϽn\Gsb#(l/*f åԍr #!9ږ$'٢.$'vԶ3gHT͆9 G|Ƅanhkw[X&O$ `kKqSh(PGU@ qC]Y}/o4_+2Y".R/|v4TARa|"VgXH./1}\Ea!R5SaMPP ҁ7vABA1NCԀa, &HNyHkNw77a}BÚ;ӼԻL*-%٤HXtr7p7j)D~GC3ckÜtSQ)Ȁrv0kR2G|1iF0v("7ѼV> w-<960GRꎺZ:-o B`)NPh3M HcZNK@HSzvh\60Qi_[>GCa3#?[4\I}na D8w)F8`<@Tu>5pww'~8UX)G\Ǥ"io>=5S.5ӵ%S2}D5т#pE3th-| >q{x+$p+פ2=.MJTIT)®rA E;@yeʺxg1dfī$/NnILz22A DaiQ)7R~ [e\[ЉJUo)ߖ3a4s댘3r#[DK?х+H%HOK[^Bhwag#51Q: 5K$ZwJd< b㰭)xp@ekH3 {?IjOkvk"la¼Vi3*zRU{[g 2tr㥳l?1Od'exoWLry@lHf&|=  U'Ȼנ\*ߧ1MOElPjShz[5ϖH_bfôRÚC QIl:k9;+[D^$vě|e1.aPUb=t2hkpk7@f"zp>oڻ"w!{[l#{bQu2SX=t =sc͝2ٹM+V=[yZPnidpDC:xKPdOsA 2F <1,mf)GuW̙o.pwA.~X+;zy}gRB4 Exҧ68eǰ`!{fR4\6cMێ̫/-@.C5-bbre!,ռh ~R3Uzm^sN8:c4Z}=I#Vz<͏>ƞ idѷX9 E{աoܥ5M @FUU R .g !#ejlr脞nvϦF&2kLHK`%e8NhJ'NN]b۱*乬O:nQnYѸ`?#q.`ao3t%jx.9ls728}O]1M4`P?IwhR,mO.+u8R+xhU <}|R2.}oi uh{xۢ$ۄP{K, ZZ]&j ytPmpdF LF3ِ*rτp>[nغ9=WNMup7,p _1EZo#r®{Un1Mݪ c2 ${"`SblV%iՌa^M2By\R;4p@ ̠=q^h?{Ǡ&z5ٴm (cq-Î !,5x?s^i6SN{ɰw(B#OWt6Ę ZFҨ=aZq;e"CIC>鸭w{@> o6>jH x#S4yt$9x⍟˷P_L24$X_X<݆5X$ce4 aw2m.yv77IuNY%U? ,F(SD 4#SV"1gH#ߐDəqF3  3?O}mrsY"<r.f WgnT8Ol;WqsaSԲ[@I?Zs5A4Dk9 q;2g|^u]=-UԶ&oxɫrDGz8Ԥ=z.}a*6 >eҔY^|ŐyP&dMMLYΆ1D$_R*Yn ]i_#ӶQXr:itZdtoF/>8D}_X~#>0ea,X:BrV0#T/쓾3gr" >"Õ9?:bs]1ӟba2GfW(Ҋma?;wԿF5^>4pd%2AcI@i+a¥M㚹cPFܞz_ᰎyhC(' Bjq4_4SOc7*QS .~&BRCz d_a`#"ZZL°p₿9DžTPwf:"$#C_OZ.q51nλ4|[ⲥ铲z,<84eUxq6V@Mtww&f$z h(ޘT%;Jm3;LFKZ3\Bо$^րO,ô}H !GRiΰ%";JPԉ#=8q t_㲝wV0w2hdl9.%ѫ-S$ EG2+&]ǝǿ: K R/0 ytAr{8Fq=I| CuU O3JΛ~kt:LQk([U{XZ2o0A0}K\&**BQ` ko*J`"VDd]D@S/ɖ JhS&pO/lx39i,1r>M&3?!Y,¯7C}};y6ZxKKMBX1Bsqh+c-',q+;5ݓ,]=:JBEl&T2o"0uD{l{޾l =y;.GYv~ 3{4;#CG*-3J\]Ƹ%|kݾ7O77.wb{Q܄xa)ʊdyw`"~Ϡ[ќXFr_JG>0ɷ 45!Bc Mtuʸ Ih'jw'+KEQφdI邸mKaATM]xc:je/ouE͖͖AyoG8cןNtޱ"bƻLE ci=4[qG]8T3bZ:bϜ}تmpWlT7,.sn0KE@M MӒ.8h rW!5u=_[NJ1zQDP\1J&esXPu ?y$Awe-V0ƟtezFYT$fWt:\A4-,/I҉E˻-" ]e/hs/2{\ےHhv~a?_tdXÓ4=y籭r_SYv̤gQU+-1 (˛LNPtU 6ӵڴxv\'N~˵)OGa{%+-h1sJQW*uk/-v>KCA6Nueo|(!} nn̎C<(ɰ OA@:&tibN*L òٞK#KR6tqK$D2 i'Fs`ntI車"@GEn>K+-K<.JrN#y0(XPɊ 1-@{+}sn7!FiF؃Bb^WM Eo|"c@o>{ ?kvnn3Q2@\9`A> o)1Cߨ5^8oJɹ",iL? *c4mJpxA·"Ƃr@ QFlHCQ`g3^;e-r1sl3c %nЧ6i9{~RPÏ ] ӥ"۳#43&'k_KnG2Sھ-X~,Krj5Md5ekKdrq+FШu*ƦlT{ c +Ӌ(z™}Hgݛ%[m<΄ap\)rSQB*KB$pXVUi2VWT*O!4$`vBX-c͒%m7 7gI$XOi\u0SZДɷ<=k*wO-V\y,4Q/AkOO )vH{x;IZda#x}4NjerNOdBWhȔP/隩TݥN ZNnŲ,$>HQ_dv7e:_W%h+"Զ7Nس'>kc Pp.G'tS- Reply`ziEL]Ǖ2}w)E;5jڒPfلƎX,^R{В ǫh2g dΆ b>d_~7Ehij9]oǑ暧§,!]HrZ?QPTH-])ꓺ_n,߇Rwm|*G[E׃4LN86$g\4撅tʥ^`)ek}ؑe")4&G,G_JfsN PMrl}m$p Mhr v>k ꯤBgrXVbA S3?dgzx,X<(I~ Pys0+G_-m(` A-Yԑdug\[@cZneVR 2pYXV YN~=;PavRolPÿO1.z0^`fȭ;?L/SW{hԑQ>?ɝ-?"Tv,mA:`+mVXBF]vc/jQ(< Q|Rm@u9=LcU=_LIoTm'Yd^Wl^ 'G8?\T}{\%Y'GIVnN\5)x\,q!ڝW :ha T-ft1jm]] >eğ'JJ 9b/UЬH%KFX c&!*2tmbN8aS\IUUt-لzyɘ[[K%X~kY\z8Aﰐoǜo{]tP!6GSBNVoI6YV,Yd~K%p,W#F$TE.R[xj KuF..ri 3¾Ť Ͼň2 6H#Ч$ Ĵ<0Y0^T-:nP`O&6(xR4Tp@U5qcUɴrFW.F~w;5hC 9 l yj`ja`nر6URPpݜ+ R[gw0[+N\zL]$ {bG qD5n>J2:Z,=H4i!Q s6әʵ롄?ԺѥT#%ׁ0Ç ur0wJ|a_ݦ A'8Gp䏁:zƸa/$SĪ}O_3'l8n,z_xBsh4JƥA6<|Mv>Q"-DްcwM/j%%żn[24Hv'7RifFVYaxhc6 i+-ΙIǛ.*capѤ8th\VbCMQ#o~3ӇA$R#|<%%epvOuض^B+|1 k dT@o}O/"|ϩܺP="D#fx. ؑ-,* *i $^F4!GckB](`֑MAlxt0n}[fl*H1 iKȝC\ǧ=oAx֟Wt:'sF_vr.ag@-Uꠍy%NQb ?_1kO)A3D<#y"ykSpd*ɼ&\a???lˉK>x @/ v|U@87\ YDwyRSBK:BO|X˘28H9݊8w`ʔH  (^!Z/FW]N:qU܅g)0݇uYfpx)bhA=s>V NNJPA/+1_FTFx3"T $9x> v6T\Wa٨s["|=344XloV*]Ih` ]RQVy8pmF{Z9E3FhlEB|Ma6j ȼ'`O(pj$e_3|7g3Rql@޶&"Wt(~e\|h“Ӛ2g֩N3"8@eqO ojm[Ki"R/>BħΥZO:&`+&si52Sw%UVbK˙_ǡp#HC4:;)9|c:p+e di[Xq%' Wy|XIV}`Y/8lb_uCpm|H>!^^,6&bG$7>E&!g銓&E3/6.H>?&3qDC6v<>hȟug%)B4? '2BHߏ\A8DS6{[OU@RF{FbqX;1yUi^G\AO>pmrzxբgw6m$$ _ͭV5?#9>FeX j37+X j}56N=J-e8 x`j"P3W~#nB\pdP nZ$vS&^PrBYcS*]TWahf0Mݍx ayeg=Ni|c.L0QBu㳁#@.TXBi`d|y:.aJ[Q$rZ.&ԌFk/O4O+xSv n>ލ+q]$Mը Uʰ hG\67@eSs-Ys6@:?+Fސ諞:E֯xya: ,F)/l:C7!+7{AL<9o?nl矷X,鼭vwIH>H;\6x98P1C*=21LPПDϢ_ZŅYd+o"PKcY0֘D P\L߃؂l1w*+Wۜ ,b5"iX3l$Rl:jCmS-Lg:?ڹ{ gf_Zpn⎗|yENV71MCAQ{[)ڑAJwyT=?e1 ٣6;iK@ۆ@VN"CW!m?6]MQa&Nxv=<\NM7vPHviHŨ,YJ{/- *&K8MѼg%~M/)uo:545Ӎ3jltOܽIH )_A$1 2QVp+| CŰES\QrAiNI!Gfb%W]I`T8n4PHӉ=' "c Vn=~EdY[,! ,&4Cxt_O\!8HG'|yW..:s?\a}=qlRW+:]#%B4 (-XKdmwmŽ5;r¢_ SQMI+႘4=b/7РUq{D2{ ^H CH7)x*tC}\.2hx+p&C|#_ˉ HdUV3iI}}sal<@]y. `oSF4O(68*KgNb9lԿr]@@-e0mf/NW8 xu*lQJIELO<&Jt8c%ψkz/c%AW^3P2Q:7/ ~6YVYJŔØg_v, hbmى5+./;A's;O`:U'',n,p& UTs8\RAn i&枊7v̻LOjM[S\~ަ-]DIA_9AF+{.)1~䳝<ԏ5|egۢzyq U[я>T ,Gf\^^~P}"je ^ sGi =C륑]G9O^奚@ZU94X*}붖5$f:fE5*o>> O֮8M8!@C>Ǟt]9vb0$u'$3V:E줒lasLw+V66[`P^]Tj^bL,y }pplDpzpM7c 1oZ?zٰ5N e{HlD p"/+fL~m|]@Afz 6-ٳ`bs\0$"Jޛ m]x6 -?×GqYwM;$J[Ǥ%qw.&{½9{xF}t~gucFts%2Tz#2j5%@)3y:z/*ɏr}-D@)@H2Twk3^ϺIח]qrtGBk_}łCJ~Af PHjLE1yb?^_,'eMyYR0&̜ G)gx_ΡIITqZض u%7O'xJq_È83pO#;8¾bÝ**Hi'5;|W7-i^ q0ЦCQL=_*Ja`䡡 ڄғ`S6&Mr 8/[=' :=麬YAίlsT-BA*1+jPS_EB9 3 }e)DB͕rT!VQ HdWWj:A28m~t{xH AZCzMV<,Ƞo؃Tڔ}'G8A>Wa-U䖩鶢2}܄Zؚ[Hh%zZP%QM#ʿ`[zAH5kwf%3N}7 h+A@0hӑ>'T;J 9gK%ch&]ݧ;.Hwƍh˜]M쓛lsW]JrQVTMĒ*.iT)N Kz~'-쯾}pQ>z"i E,'1 $_J-rU8d*Рj aLJUɵ.Q>{dh{y?@wfo qמ3;c;g7h$l=gY|jV 7Ftq@!.MVa$u u9L|[=^A=䘯=}F@Syˠ' <ŠS{`h[(=L ;+jpҵv_^93RZ'HvݭZ=B_vMZ}}pa4}+p8@8j* }q*LYPF 9'`=v*zW:#:`ssg{9e2~Z],ZEǔ3/l4_aX# 2LBz?&Wj3NTɮEKMH<<_~ tcҔFU}|N m{Bucz/_S+)i<_ ^vz^htl BduJmǍIϤZ 6.8|lDkxb&2 ۨ{)/.4p3ʺ=(, Hr}._JG5}@~E(n,DŽ,- i1Was%dNȂ\U3_~JjÞtO@(M@aRꅗJ5|B@cdz%kAIFk-f&v%:'d(NxKɣCK4LQN,b+jsgY n;gz H״-ίj demL]ifEi,)EtXSF K>6 W±-{z5|ٮ.."KPY>D*Ck @\ ˇ/NHqX-25 M0oN fbTȪ[O_OUdanɲߞ߬XF*AIX9 W[]IQn~3ڶb4\lVkB;yTW''5mKmp3(.eܧr5 iP_uۺJSW%nɇҨreKŦrLE!t]ǼEcj]&oٝ ?ϕQp$!qY2Wlǯn6S>[J _T95|U;=n%E—3c΀tt8aavf18d9Sc(X@P*ٿ``;AS%_U$b)?%{kxr( jt2ɢ=Z>gh 2ٰdys@7v<-?Ҙh νN4Af]V\(Г.©yxbUco[Jo:Šŵ^.=y+!M"4=U-}IakvJGbzMPI5<@*E܇ױݼ'Q녦b$qJC!׶NK `)[ zNL]C~s7)cdoكbDrnq\R5mg[")IZ5:_ ^W!0i`6kQeQB6_ϭ#ܸ^_&{`WsS_@P35@wft;vb6H) dB)Y`TSla3?}ː۬ Ѻl2+ ttF@5P-3t աDV*a}aU9 MQUPtnw}ʒ4#D$6F)/V (&pK8]þnLa l)x~uXy8#* |8d$8Vua&c&lUTg9a;u2wޜ?=]Or++h溚k]N0"}~2b:s F+|aE\Nf\^5 !¿>qONJ4˛KN_|KMz yj9.THEX WF4XGx _F"1SxKP6Q $6ʲ5J壖ٽm/2E W]̇lÏ?qן1px+u2Af<.Zƒcf2_SE PJ&>eDgĐ+Fjz6K#\ݱ%(VOĈ %\A/$X<ߩ [eL:J Tx 28 blݙMd-%NGߤi(Uqg'&ɑS/V`PX O1ԉL*uWmz^G8O5]"zF%-p[]b8'Z|UǕꤟ%8$|Mfgۜ >cd=a`ZTD@q|%WȧsI>kGXﾇIU3ɽvɸdxE)c9 "_. CP`݂hY c@cӬem<m*lֽ4S\wc"'5v6^yB[ylK YW @ePo2zIq;,j]Kјn@O4)^&䚜Hb."o#0Axi83}p댿v5 ݄)[s}1|$*y is +d6Sߗq}8NW&ޏN]ϙĮE\]{rL+ݳh0/dx]t{{[(m25V:ߴqO^pSAMBX.^+t"KIZL| CڙǛ[b,s/sӄd .A @o@UW((W`5Ð,K8%['ZBC骼tDq"@5ϒ 5Y.lw(?Y>&a_2u1P;G}%3&GROD5縭3ե;b*aNcv},DSHg<<Az8 ihdzuߡoaAԷo x&Q\q5ߪ2uGbh:/yfk!{ چ2*gwVI_*^ucu-<@r WE2^hлtx_#j8}Qwd_SL5f*BR/+D=$bslmsdxaHf'!=|W%BVӇ/1ݓŝlwt@i8 I >j>`ZÜ+Py4bO8]_;vUc

     }%gQpZRxK)F\$.ڭCGVHƤN?5S;k12s^ZCԟ(y˭՟{e:qH.`ʧJAecSauolg1!o'0Tq>T6aNol[h,yl } ȕc#_k rsnÃD6՞"t0$zM/;{zmTߔ5-(5OZ': /tޚՎ`+2@Ko>E}_QdRÈSF Gـs!%T;N*'ĸdQw/"҅S*.yb5Y~$s\}nNו)[&iuqD# 'ܰ(霬,y}~_ 󄔾(Z[L\r~.(IZ ]eHQ:D`H 5m}uUEƁ Ζb;6qZr嬭j@7κ%ExjnLm$u&2SҪdd"ԡKk⇞'\#Z*' nO%[zJ4Wv&{1p9QlK\I^W,)Etɼ}O=RuDZ5'ezu\gFw"8!P#c`%PdK C/NU4okXlXe; =YBڭՏ tXf̪`d[ $ 7u&ـ "7X果"=}zhgFg uvޅGUL 5Hgͬ w7YtqWrG(9טb ߱Z^u<խ#pSAu#  g"nؚJ4nt-{zR@9K k; b17" Rwk?;hS^a/({/ZT{fG38n1K]eAB$Y[zr8Gÿ<,FJY(H}я_sg7S;MEBsS觵B>[چ6F̞jWTŎ5Tb:BV,׌K;; )8#V4%6'/8+ZXw 2%V2YH!^unEe!{Br9C(;0TU5j07 /wFyBN~McN%lZէ]v^#c]kHqtQuO1aA1N9ċmw<n8rWPOXI|Z Tߩb;WJiva$ }~TvƬL4X#37dUvp>8DxD|o'r Il߬_3ׯPADk6myU"RGée,)^*꣟+~5Z`IWcHf >܁ʟ 2柑ԧR8#ǩ,e`z5}yQ\\ˬjDwXS oKMD",Q]f-J<'7nr*(4&Z-"p(z/ZBaA3(ʫʴdD'ut(ɖ0 l %>hND+W%6xPehK\. F' 6.ښ! i0Bs0YE<> UYObLwKUZ~ $ k40Hs K4}$J\$]bOm{̎O m|OdbSHA[}fQE 7ewOH= .siQoHx[M"LI!GrLf:q`lLzEmgjq9h8>^F{𚡽%#C<5C8O 3vW͜; XN&:7Spfg~_Z G uO{]{KG,&\D^I>60D6JȾg+Au7xf!{M UuZ|ULA"7hH}8_4PcCW_ ʟ ޱA"* ح7*&BңN([q2 = ]P!{dIGj'" ڶޅ WTA6p*}~pPN!9eE6ٚOuʛ:|ޱ=M|y5GEވdo`G VL4C9_i;YS:,nF%Cb_7lٗ]2-E̛v[`NXʐ(D(,oB6$g8B[Bh>6 67z42<`#{o,m+{\^Q2Yg'[h1u,7#D*95-Tb&ʧ.XZTŸLU `#K<QzõOl h[1?~ɦ7/rPg DyԮPZxCH'ItKRC7FpPHĹ_2 X||h i{hU64nՂ pK/T%Yjo3+Mq@trQ+ajMk_lɪCvaC>rA`z4@ FN@&hF%'ug5ofP(,C9Bw#f@ (8Wݫj/wA^HLIqJ+NIf2)?fq5PWs⸠Hx0aIQ-&hiYJ Vd=j+GZnJndy>G~*m]]7*elqxBx,>Tk% |dߵYyFEb4 #6Q4}( 4^jbfJcY]>dBTm rSHWlu\8ʐLugšQzzg7*nwSB-+QY {-Qu&s K1;EX',~ӝav aq$hTԲ/|hQ?\ZK &mvX'ДQClN7]+q5Ot9-Z!:2v (@ #*7)rRä+ :NGt #C{ 417RxP0UzrT$r$}XpOI 64 ϫ#HqoAGt0yn"/Jf뎶>Py;/v6 5rROǿj$ƒGwRv"+(Hdz5?x?5Awh%X/!)śVֱ 4*µo {<Ը5(Ќv|}[B$XVSN=HkÒ]@ {ض2@D=LXf[~+CVaF 1.ݛMҙ4/מP_.j}هuHO䢣0ूbjJS~Wnb O0AVL*#+0|h+!M^GrGQa[Np5dճhR?4?Zx* u'A矇MIݹ[p>w}Dc.uVl¹/p+kv[*zZ5p4L{i"φ0n_2=L$Ҧ ыDyԢm8h$afщqUO-I#)\=l7Hu)?ҁGTp7!lő@tDCO~Igu G`#jSz{;밆i|$GCCS-f^`ji6&NW/L1Egʥ9Q2/j>Ƿ0^pdmv`;V!Ze]H%,eGf5PU·M'a/M2 B4Pɍt޸}#+Hzl`5ӂv +iUzd>'D#?m n:{(QuHwlNtPy, wR  q.ƛveI|Qo=_ ۶Hx2cT-i5JrYbDbWaYSJa C{? k]2 x)5kT.'; iZɿ^+v 9ʊq{oUݏNcmSӸ7cB` Luf`;כ/ $DmTDWx6=R[s ^vIx'DϤ+Nn_&+.ui.98k.hW2> 5&Dn?zHg #-4 m;) U#ӂw 偔P΋%Ӑ!X*90IȜ zURy1$h?9 nJޗ:oc|ǻoj04jнy{PL؀wZ Eڭsg<&ifߍ Nd!5PB_*4&kcH?D7p%l>ǕVAg`%N'o׵`,ճ_}c^=U{~*to[k]%IwS&!P@F0z/- JZC~ݭm} @o vOW7~yЋU&+ f=.̎L|8:k,hC%ۧxae|/L@FfN qၨ o#mfGw7?ɶxytw%LހU<a'\C߇YA2pCp!׋p i!o.줂Lcn.B|2-5+H"Q4c6ȇ] K>).6+H2%/EU?1N7pY4NkN\޿ 2 әS­, ZނU+FPH?虉*.׽K8PmKsv}gY.%l\^׵Y.]=R\~FCTzdJ~ɖb X=O#5m*Өvbw?s]nAN)5͈&FfSaǿH~JB*sqZ~XKl8N^tBq7g4DB$" O][1xzn>SBfIS}%qryC65(=J ?xr2W`%{OclڙJ{iX$~՜c $ `BYSW ,&iG7mpuaM_{ٻm=Lw|/Tu"d4 8!Ow nk$ʓS;\yEFnODJxEI|Dv?[8 lL\UCt8j) i0Ժ\$H0hϿ9U b#Arf5a" {B߈!x]qUR- hIʨZ.s!pB|y~Td}@1Z)`fB<7uL zd9Rz{CY|xC%ɼ(&;ql*Cdnri~fв-gEt"+V"r@J! '42OŢһbE"U1$Ul#j>Iú̋ۺ_^!:xZm<7{ag@6+,o"* jˊ*×X)SgB #ѬÅ,w%'{;3d)wњD |GdT"۵E}I~2*q-Z4?Fa+.on gGmĭ"8(0k☾< ~=W\t gc@*HzDa{#.Ln!MiѢcWfv׭&Y^ݍx4"9fjşݝLKoOAͪi~D;&K{YU6;3=ہxP)ri?;oxDS>MI0vKTO{4YXcl&0_F?߫ +R aa)٤jU\F 籘KK5^cX~oأaJ"Ԁt$F^FuMT?znUwn DQM.؞R`%5QVlIuf'Or@/dk=kA>4J+~jIi2yj3"|5/X19x'TcJwY4 ^4Tʳսh7|lv=dbB[ߵV ^ڔPUl<*%73+;b S!!mNN6*Qt'1&ɘ%(;I4nb:{P"o_ޝMer_SJCKïqIrk*c =L_%[/dIa.7u+W*v0"z@ NךS[ݭWhg|-u8 jb~dF֮13?cW ЗzNuUX{직,8uDPDt[Ov2 "jw vKYX6D W8T aRR|(6T,՟M^a9ܕfGY d#fYEn/qAc p34E./8+]'AecƄh2zRTC5*s_C}E4&u *;C )c5y/@0uH{LMrgZv86xa D V6voZ%zKKa$Ú b, hdLP͞ggy ;!=5|[))89))K3EMS6|̉Ep5#ӥMR٭|>kˆ{~7d;['Q8"Fn{n&anbX=rH| :b $!mU&Wb1zHf51;H'iNцLqac:VnE!ʵ&1AHdB@*w}_ao)ږkk]f' T216WP@zy,XgsTl(<7S5dæM)]B6cdy@iHNܿ"AZvPFt" 9-5Qe;.R<}ƪGԧBRQi(OH^nɛ^(52S|*X)p ~@ˁ<]l G !$% +a>QWWhu,6 uOl- E}Ќt0Yג765VjLq i}2yI1|EᆐnX*9\"? oQW"ሧkېSO7 " ecvY_-=}N 1#+W0^dG l $t1L?9{r?a`(ꗓ.aV@a&Uzܒ*WB *$WLF9^ÉW:dO/䓧}/Vf-"\^ZA9׫% vEaˣٱ_"A;3d릐kH7=usd۝oR,`15$ ɩ3 :"' stg5DݻH@0Gg$81v;;[Lxڌ/"ʘLBt}<|U_;C!]qe^Pqı:NʟZohшu7>x4UsfLցw\ @*7 Jj{zu I_KKo_x7PS"bb&F>IQhhѪ=.d;"i~q`9БXqsc:э 0Fhy)=- ZdǴ^pА/TBZH sl-OuU*w?L5Hz& ;Y$ ~> %]4kYq^%qL/K6f3(?|5^gqνw"n Er2?[8n !?9C)53 /XKv vQvGI"CN?,^9H3Tɦfb`SA{? 7&ekFrh{BkJA iB2"+w;12GXg?IP6Ԗ*\ ƈGxL OAxE/ +l A_\Rߑu3wrm!o{(\USb%4t]ua7u>xUn^kf'E6yHda[iK3Wt+8H,ұuH\.1Ǥ>ٌ&W$}JzcDD.QY 4$#n9 : }lJ,WފJkmQB1/׉MJ>SqtNWHcIX !ӒCiz9$2H*ߎ}HiZ ;#7vpp=eΠ1;[UMϒ$yJ;$tua /6;SR}~ V.|tp}wJ|#!EǩH]}v3A[a GsR)Dx:1]B u=Jw| |r\MEb=湃ar cw}-3c%X 3oװn!RJrͩs0#? Vb\?ldKJ/9OX^w1~JiyΩgSiP4%u ~Q>$ O>rDH6&id X0;݂6U?T ,Dzz~@'M0쩞&"CHUpG:cS asm(2WAםn{ [g.%ƍ05CxZ5(5;Ø)Tfxsիpƅ[.ka\/>K$҅`M\-JY): Μ/] sՊK;6Yh%Z{ ױ\0)Je~_wz$VKʠ__tG>I6W?2@ꤡIXLm;D)QT&"Si˴ $"C);?zr1Fs0{7~qv/y^}krrKv7 -pyxe` פQN*oYVQ\>q35Q,BY|#vҽX  8oRDnuy*hxQ\` ;[3@YC[aw4f5-'-+9B,Q)m !uQ#g@\?*\ [AT`_,pCaApSa)sēOfG6eek_}Vy'gJ;" !j5y紌4^y)zQMۓ%{d`Sc\A,J o *G)qqtCSCr]ؽ*˒d QF˩ Z AQ-Q:Nu<ه. d·*>r%Sj e(;^]oʶ? [biOG\@ 4=+ai_z 2ᴥ02kʰdJy<7[oC?ªŻ٥]G]8|(vr1Pe$diBMg,9ͬ z}2Y4 <S|ddV'9b(}x"6g_vLvw;`~73I(i j)Ln: T0j650"fYa:M u=#0{!Ռ<`ΘXJ䁃 Kt-me{Ӣ\2u(P&ri-IXjj[l!UC@iʢE6vHl5~2sck @HʗT e9YF ̈́:R\h9I"n%ɯz~iJ9+F'#U)d4΅`SV[g$[ӯts LB5YE-qކ%`=Íjoc y' pde _5 :04,ݬm $[_"wiA9FTސ7.oe1z\LT } 1+j:7}K>c뺾vGuߠR$jd>@EQQfcj`uP٤)Dx>tfuhf?(L:% ws|No(y"+Ei TX8Ҙz˶$2hŒdH‹,b4T=<H}G7[~0-3K\GcVe3˘k|%&ο.߬;;K.K"Z}IO/xu6Ub9Ḛ3BrJhxNC./H- d+HT{Lz/I-6}Y/gó$GOg2G8sl`p1k yucI !%x.~tT@x C8 @zt)I=4_g-R}@9x`(' j{@Ja0H+I/ņQP`Lδ0x8AFq6OW_ʕ{l1s߅PENllw|q[B>rKnO:♡JTTK_յL~bar傸12 *g{=*K1uYg|DޝYEׇhui-7yG#ZyZ&cq)XGX$WJ#텰Y.f婻!܈BNH 8̃] y%WLWf fIԬf]2 __,onށ?ۂzth (zJll̈L=u)7-/Xz١qfTF9a5,qԙ(Msw,w>Ozy D†ɯQ[y]"7 ?fId;$DQ>&c2P 4ËCWe>M9(;KV` Srsճݤy>nvUzRƲ<,WO?_8(k-+RAQ}uY؁aswsMPqZXXa3ܦYBs䮗NjVs*ec ꜛ @åәsC'. atvT{&۝\E,<պ݆UX@NjXEs..2-XK:GR}>&OV#|nZD_ΧCILI:ϔQƒ񪃋+gO8dC!m*4FDz \y;ٓJq;F YTȕ`;х9 bpXKMaN=1h-KIwVH^2Ae<6Wbb!&s ޒ{zhHWtGb'hn+10NF"0 QoEޥAݟ(Xy\?>żV"D= ^.r Z:C5+(f=pp'oɭnoGC5gk|Ѕ'%Qy*3]X /c7eB\/Xd7aX^5!/) i+ApLp(tw^Krg"%B3 fj*^MJRqŸ4ha6uHHwbU/&N,|V-$hh4+$qCY&F)skhהPRovTE^MmsJ g@ql aVܖ7S-}"a[ŵ2ȷkt(b]ɿ؟OlgST|-aX"RWW9԰T׎2`r ԕUky$*+ώE ͝tHP?&E8r؉L/7q=$lͣ4mv)9nx˱mTKm%*ycG%]AJ !ND2z/ E?g`cDkI*{&<(Ts4-tJ*]j!urp"oL`Fzd{^F!/9E&l=GAW,T=>'pVo?6=ZV4dasV싒6H#h  :$P'NC&N +NLg>pJ]1O%v^ rWzZ^(lV59h03GJHh6? GcH!o33WaϽ^stD[%:Y҇o-ƋQ^ZM-Vz+!Zt">?X8_ߦc:z) h)}U  b O;8Kq "vlz '5[l:fԏ(6\+jDa ^#b}:Ⱦn]QX,N 9cQm\3DH$)4d@39\q'4?F∘Ϡrݻ/Ru}ڭ9AlnPlFQ>dY`h&tRQԪToK9!11ב/.(~O7M';(jp 5%?iq9%7M?'~'3=0KKj]SUv5b@Ǫ]gApTߺH KVtBU!S? ` orB8mNN#xg 8 Kq;> u¹(&ّIdn`+ϓeyv@pSsO/=^ۺ Y6>,< OReYs8}B393gcj)*O(~'!,CQ?#ȩNGbL8@xȹ~,iy"`WHMZ yө0%`ڃtͳs{Qv U:F}W3"Z(F<*eNw}S"EY(wnd|K9);W5-˙s=cWѵ2Tw(ѻ q*^WFi'RD8 xHTk5,i~J!xN ɋprX8vl٠ ? Vir '@KS.s㗶N+'0 &Ef&JZ@IY*G_Uv6%ҙ\ś!6y+n7mB<]F\kg$0)ϲs%m $mQ ƊRu4ɠTL8 # qXQ$*47LTH#l, gCb͞R~)4rp dk2!W x*Y^.RK'jy*2o^?moE"[}+Z{'A )~SǰО~e@5G=Q=9Ռ!O)ԩY(.*+{7d0NQ)iVQl2:I_j:a_-j~kHWBUA5%DR7:+OzU\E99/zac)R_╖^=$.hς 8gGBV3kg L# iAO e_&GMjҒjs$sc,gsFg/`f:*x~SS)3F:M1ޡxC5ugrc9Yv@/Ur]ԻsLV9TpP H75XO Ǵ]~dj#>Wv1`^Wx-aWP ra}<5c)Y)ZeڪJ./th_3'qÕAIgG`TvJ!ݶp O/O,ohS+*(;(ʼiӰ =~@OR,x5%ReQN-_h# Y0ZpC ylLA*Y?{ d-|OF,99yp}+(׽|K6mY/ y͋rz- kIeK #nwPD`MuBJgb*edkRۓpؒMPzƖr|EsMFWk<ҶO+&OꐞˆW&sKaenI!^A*`ۓ[1G]~Z&賛nœ@iDfDE.,GRp/< CBHzH x| [`:ӾDhݽ}O"@7q ?U=WK2Y~|)sj/Zj ,&;t(>@)WM?e%h5_7߻]XR{ND@I*R65Jteoe W]QI[i- `_uUR_Ne6Dž0mn'03r[KikAMrՅj]͠<yffN՜e6FĀd*{8!M\K.u']gr-W +K3_5lS{"p 87U/wR].BryRDH%p(֥=&ŏW-jAU$E_JpOf)8 Qw^F ^P .2 XW2R H2s5֝5H(^]% 6zL^*D1\$b!_̓yҚuHNsuZ:ôzvKQ)ݢ ^͋g^PkF.uȩix@`ɭX w)A?e0vFlk?/Č}h=Τ!q6O:3Sr%IVYkw 3:(>׉,%FOؼUݕb rO5Ѳ)7P]Xr(椙Z1Z:ոƅCRFgi*-x|" PvrMNKfHf{]R2{[,<+sLNvax,sH7?ɽ 6CoI^2=$T÷y_á;UA בuQr1ʵF-[bd6XePs&T]TgO5R mF1*qydٲOvuҨk Дvp/83˿MZ2{?m7r*mMePݣOqS$1q/E6,ew*SpM)s *kƛ)v}?[1lrs^2'M;b$9YTSs>;@O!*9 #=\sv|6g{&MJ#zLe$A6&*f7*0o&;Lv)Iia1#\aqjhcyuc*6COK 7E Ĭ7,BKgW'<}`+Zϻ13UܓD}9J5Sˁu@~R )C:|̖|ٲhC2o=8sp/-ȇ>.xcsR\k jk>=Wȟ߅ {.^F!E6u?|Sms)U+Fz*4d]O>qhUhɓZzSɳI1,rR36A>_!겸N"f '_n3&[STra 6}[GgikU\͔g]<3t> -G|v` t¾pyQP;ϸM.FؽVb*O4Bo S*‰N<<)3`_`.S gQ32ݗ( E,WwOKPL#U cR1E!(37ͳ ?ɽP_ KnmB]D`f!HX#qmZbQg<1;j608FՒ[0n HB(^8*t~~$evhIY41_mW T*0pJN 8. %e&;$u},'H θXܹBi:7.O gg:{r8VcL_ED9FCāo|ԕ)ՃHYDT(0qCx!B8( AZ #!TL۽ @ &BTs[[$CmeY]Z( pKk ԕTsȤ]yEL((!od94c%I$bҮ yaa,A!k1S5xEL TCip)b߽rW.{Ŗlwo"T8l3Cu\z鋰0Yt٣Q$2; ⹌+hjpa.x%5DM@"0) zKF͞*a ^0,+䣫/|p#2 Z\! >k ́eWn  6ǻ#vh0:R!8q5(i]+p(1l Á] 9 uYfk}($^,͠ ­d<4˛S(/{Q`z{^,uw P{%&?qaDkj3\JOũ-Ҥ8ۚX2di\^{d)1Gڊ '#))/'&(ϭbi|tS}pJQ2)gAb=_vOn #>-]5*VjD4b]eT;:ejdJ!t~I(Wr|XR1fI} 5mQabIj|qYl$p3˭Y 8I >J ܎~$}:|N`2 5 ]@-WplDdLۈNe t>BEZȍE[wHh=:$.q!\N-l@UNYȫD2[S^aބ:LG9A.I]x__|?kF_ئf :nZ V8RUt ~ZX|^?Lg#jD֯(My wp )(O'DֆO^`SO5pƪUU@.G6LF^'`O֙ð# pqs}bVIAVRȳN _y1#ce [ҹˇl/X-ԐLhf%1蒊7k)2cXwNIK*VVX^ҜUǢjCVXj62 zQ~3nάH䀯Ї ,ik1/,cu(vPc|voE^aW9?gk 3[)CWU>̐vh8R-'P3sdb]XaJ3'vQ?y:kҼ $pkc}Q-э EQTDZ,4yc ZG1$6h)DFGtXB^;n"7#\A ԮEC/k&?Y; 9hE9¿OV Nx҄/BRI O$Xʴ%Pat`<VX}? (f&wUɬZ\h1Rb.nZcDڡu,󶮺|EA7}GA:B"b\@)J_P8A\7 M ur'36 - Y-zL ZWF-k,8Ng~qMt$\ m,ni?͍KJfwZPlKa5(ިf.䎰j$Q[eS*zVǒ4f_l @~q"RXR=Q,byݚlaF%J%G:BMiI^|0~q +#%cj=P10P?[ 3=S '@NIp@LD+`2K.<hxwiaB&uA (" uP8!cI)]q`+p3%s6W([6ȐRXol17V^g_z x2[vΒIAr#`Fv} ;5^WI۸"pNyԨل& }e^T WE]I`[|FA(e.wodU͝6:֒V.c781Or_CL)yx5ݠ f8$4`f1 ksv-[&v$#}zyp1|dx]0= 98,d/u|<CS;~cepZI%Dj i-FDz @^-|pqRFꑍ})_ Mf eU$_ M =4>6=V73X&Qr_;.6ED塅k)pr?=E;7|AlBӉI|ZR_Tzzo/ݺs1L+-ʔۣbvߩK'\HIӊ:[g{~b޷3N t9\?'Mpϫ(>S Ukr.& @.`7skL<2PGB0u&UU=$t F{r7^YQFi(z}WZ[ ̈́Ã>A8'(9RdRe:ʭC}(vNd$c.k-k4kae_jr_W7 euyjPV8@'t>‹527CCsQA|=0 djm rJj[*2b`]kXk$>g%L@35>L3B4lM0{S")MK+xݔjaݫOX^^ 6R DR&FR-%:vykQb衳^t**&1۔(@cDݷRM Ƕ vȗ;ֻo끓:^NTɦSg?5 }2]ب3"Wu.{,LXdmҴ*%t5fJvQ_)FcAWflij~DwU-o/քW5jgF4xږ~oa[)QXa['G[aǍkyE#TT9oVٷm ]PՇ0':hQ ic1W>fJɜ}~~USyv" >w1ӰҀa8W)3@#UYqӝ9H x6)>o ?4Pp ?PT^ k{en[mfMqɩURp᠞ъ+tA2Ga}ռ^v&Sy^1OBŦ?-GBZl7'gG * EH"(W2۽o<&ō N5 ح;E':davl+W/H[J@IAe|OS ē+@DT!WLCsߏP%h%x%  KAqm1s_0¿+X`aۺ@12qn(Г[Ԅ)lxtv [jʂ;keaGKÁr 5Xrmg6* $ً w,<>=l-= 0lsP'سFDϘDJwn51VDve,ޖݎΏ w])ll_۞J3Zy$ {s>XkRּ+>ྼT_TAwB*6s i$Xۄտ /@Hx*#C;bG~XIXi35xݭ.`T)@ԆEnkԤ+X/FP# gQ@TWX>=(g+G(k/})H o# I~o)~JhB0ȵ5 KNk55w"uS"X"n!E[ $KIlq B\xƑ^auQ P^d#Q;Ry+&mt~ /UT-H,<|j y*lqDJS;4GEYH b4![ud*z릉^65gFN͑hոTK#$Agml0\gPbߤOO5'b Z#W}3_r3#HQ<8xZY3 q)ZW^H_6-bjZcܑ{V>=s9ΓS9p 4(q]*3'Uux|DP$'{ Vbe*!g,A~`T@bHP\\k&!XƘrbr_N~mT!&]?|5骃~1`[~|5Ѡe^|uK_ugqT3ZbbtX  tԆ=*Pjk Zù,5<{ղ[/]Ip 'RW҃( '3q"} 1ʩvق ȵ* gl'Itf(FqdƩ~KgȲL%fj+rp? t[0iV𩝪k+ٴNю_0M^(n.u%~st4}<'wWPqexd5vg|0GZ-3V|a @ 7(rS5l`hQЩXtN)sn?ܱ qM=ͤ?qD$m#Swo?cGPU_@D2dP,{sO|5!جьQ:K@ ]#BMK=o%W0rx%:JFG$S-3I ~Y$8Y5RxO91(r1t)Xk!JncsUA=N;4CIG'L6JT!4Wc[A& >mi)\`;~BvK4•dgC[c&5e%d;dR-| $OpݍP )& -W# Wh /Ɩ=g*#j?*5oKM/E8Vo#J1b0#>'w{Y*$ZtJ9i1/T(=zq+b4mZQ-AGCu3kvBU9S(c)s`aEq,@dYn." nh05) 5|YixUS=V35ˑMۖƢ뗁ͳ#ߎm }lLr٬^]Iʋ9c&S i_āGOǨO.w2xύC:Sh5wMфTSZس@ň䉤VTaFڭ ?0FDn mՄ-f6/f kn4't#]cjh+ťIU'|I  mkw-:joGQ/f:b/9a KuNV'cp^/W%{@xF]n:S ?W,#tJhUG Uhs(8qN׾mkj֝z~89SL/ (/bL^Y08!Y0ZlpeqHΠr6%9J+v;<XoAV1w׹KܐUV]㍆;Rt$N9[n` ?΅tLD ֋i[!>ݞAyԽ<'/fyg!.vQ3I;S89~V .y xa?`<+1wy>k{;n'uKE '3#u$ ]%;; R/8q]i3z{WczH׈/3C2,CZ*Į3pn:U3w67v@6K~`Y-joEA ! Fv [^_ka ܉kRT#*\%M%/6(e,x+>jB*:|'Fޟ,;. +x쐋L$a-w._-T!;0u嗠:_F%uj#+=ւ!91ʜJ它WMJ[_ \0cSyf'__A^ZƆaz"N{^+`1뒐V, S*e^0s#K]i]chM. v~{Gk58™4/x*构~uVe4gaQVsRÿ%7ml6 @@@h //uto]}9&23,!˫D^ *7 ׽HLq36?st 5 Pګ{d,)Rm] "8(u?o7P,F3D;[G.8E%l/k!#k ,F@^?Nh/ &W9 {fjKD,?zĉvɇE%@"!>`lU~aNi$B E">e3pDs0-*'ihUt;:D i ]9p\˰$sDF6Rh-fZX۪鵕*ewH)5%Mt7 Y㋆'Wȟ]6Vbp7f"u tw3Ycf.`& FH/XV!R/n;FƬa(7 L 0 fMfT6oyizT kDϝjL \<խ"_a/-|xI}*{Io{jaBCmsGu 9e×&mӵqx,PlG |@%(Vxb*'W[P|'f'TGDZU&>36ð %,쐦Å'Qԋ6\/t;twNw@;,QC^"I1넢%Fs9[{pDIh~>m_?y+>KAS+g eġneg|qH'=Bd҉ݧzOl =6?V<&﹡4,.Z3mVuli#U%c)#n= c9@T𠂑(-i/֣չUb%eI@i[;z"2B]k>Yl+7w >|,p'NمZUY!U Q4L뒺NHi!Q5mw#MA7%W}+tD~m:PVÖI8t'BCa5tëd-_=k%/6ᭇ4b.:?Ag}u~N/%qkmwZ{ "yb-ru Va`K37&͙4 ]pͷ9?6~tch{F6I-&Q)/}x0p#N& CJ\U>aclB&ֹ UxU~/:)_AM GJ5= ~U~y%q攭F(}P;lԇƖbF"3ۄ$0Gdv4[ħEoJV_aiQzXUgO۹c<8sf󦮿}v\U˿Gՙ\C6ذ#M!ok128XQ]3gJ&[됐k?C,j.#^F|ZwU!)Yr YyWKuuQC DzN4!hc339~A~pW{484F$sZ&F3|j!ۘ'l]D]]rIJO~77v59q@H>{FBNC>4F2/P:]8e]]ɔ{g:hEq349(?ם|aMK<#Mi^a"v*8HſH48 :Q;ŷ = #D42e@0Ґ?5_qkގ |dAByqzhi/d'4!8ݤEgAd^:XڑܾXPqgOmk^W?'~^0Ţ*lʬDP?0qKmY@8&[ b ]pZ($~n8F:gКGqFcu\//44m? FF7N>;i 䤖a?]P%v߶( 7K$+4 bra耙 _TWPȃ 섌wcY ,BY慡a|n&`RKvS֚-Z_o?T*wvD^79_z)-lʺpʿfb?/?Mz}JFmm h1ȕJu5(rdmF™*#n-xL]! a[=W61l)ٵ "nt&JZXAƙcĮ45i5jϱK0ܱSG ܟˠ/4]鹿@p 'ДE5$V#%c7*xVU0cg;-;J06_@ !@ jD"Q{;O5\V `cӵI'm0r}5ŅSJ/LW;$RU-1YBicڷIb}TPfE6kGx$GWD3k2ANXלURCa:zD7fh~@uG5.ȯ,&TO%ӄT9Gxs(.8HAAKgLI^`[jΟhGE抙 U%{'D%p{}WAF}`Pj?<"G/(sZ:mO5ap" of#>*v)``| ϸ$aPk9Fٸr$ʴ4?.Xtyy~6 y.V!Yyq;4 fCbO?EJXR =GJlo|RE$ne{+@JߥeNW\Q~+f,6FlIZȢ^Q8v@8f%Y[x93b+m{LBi~3/L}rV׉qO$'u6|ǹ`ͣD_,3TOKJc \?"ܲͷ׬!ZYuI_ Yc32RN8W|eي@BL%C{`>g u0܇aS]i,w S"!3q0 `в\~\9ҹ:vQH<]{~վ MxE(3fRmK ODVǞhz2̻Oն:h^_V Uñf'Mʶxa?aeݨg#˨bGN!2"Ll%C/}= V`*mýfGvh2! WiQ1(Q7 au.yn<]9s 'O%ptLLx[8gh\I϶I=xH6뚇Liü1uRB@sg h̋9([B=Ph)l>%׷oX}[^V1lö'WdM$F.%O%vCKՐ{B)9PXJ+IHDŽI)E` -b;n5[ 5#睿 GeX>c;1{$ׂ8:}a#`4^66xVͣ5w0K ~JSW ת]_e߸aĐ1jNN;=Sf4Scu8r=m0)?k+I԰nT9c#LFAO>$#F; K]RblS8 *h 2diXЎUN~(V콜]BddnL54~z9Pdv(|z;v**Ah^4܀Eh.P^]LLjI:Fr Cx\6]S WQQ%{T܎X3LTR?bk W:5ԏѨfG,Ա3##T"eF4i5B ӝѽި'~"s GpדfoBY[^yʓUEeyQl27RGҌd]!cgrs[ `^-cVy_(B7U̻F82CT7R:sWftyn6Xf#%o׈hK:b1+B={ܟP} X ` |0o+Q͚2lΫt1~C.ӳwu*PzzRi~W%R KoDե}a*?JB~y @o:s~cZQxa*L(| w0ԟDք72DAQ."DNqdFvtUXƿMjR \l-s$BN2#Foh F6\ۉfސrKZL7=> en^C6ڢ| `vKI 6eF~,fB%RX a]0b淽6_0@:b5T4羚TF|D2DtIeUHfV#]Hk5k5.$(緍Û }a;˫K|CB%M곪iʆ=xD{>vZI]ww+&/)coOsJubR.eJKxn*sk|+aau>i\jXk=u@!Aڰ"Ȑtb2D3!8E9d18)Rkgg8Ç/`PvY4cB+e!:#7F]EcFI^7/OM҈߀{m)c"f4qF)]f۫ݗm421 ҸD-K\ Q@l7RW"TzOU؏&wm6fK\ym1ncصÄ'M,֯M (\.ϙ\[P'kL#cY}1q)^>`) ,:,^M>t_3eg*c>͚ K(tfBl%ecv'mUmo9 ?a9̺@#'z&|zsGAm+S(5f_N`,~8_Y> f#&4rh>y$d%?[lIa'LpRU<##>*^r‹w{tsKe}/uA,%ѬLxC}qN$r𧿢t%0w0IOPO;үuvsdH>iaPdI[Yhz)\v!iu +o*_@]>|FcU'~5s !ܓ[*Em=xGD?@Kf(OA>**/Nt>7i$+?}a#<'Y8b~YZh9˜k]bk7\uouLo]{ ]NpUaՅ<LF7 狏vв^Mqp|B@Njwj$:EyDlat'_a40qi0A@;!= Ō$nY9_·KcR 9>MvRiUu @K4 =WXm_?kzrzaR3"G"Sr`X*Nm( S I`d.PnʆV4FOo ,H/ă7"n^ܓZѰXou-K㍗tO/(lO|7PsïiP;OЇrD<]`>O@v55p0Tua={68ȇBnRQ&jAAVڣ6Ng04tr$afi~_×5/Nog-VEM)\/$cezLIQiPmsJu@9mOO:.r% eE&At,Py}Z:gvu?0 *X J\j2U@c4*$eVXjr 4R8{ۤ'i!K)tY>PT>q;עʛC=|p(V'w>KS$( z ٞ|*TF̮;w0sp8ԿGrpJuPA  $|{fjt<"B7&ַTE200'ݧuyͫs,*ڟD%r8ȕPʊ܏_H.8^ʦG-aW]hYPr`v΍ ^,P(`n$J,6:x8{Cy~4D r‘9Rf.9`0f6i]{/D/M8\c @j38tC뱊ωS |r8a-;|=J&X?>縄IvQ i#[CqGTm: /ug|Ϛt;ev"&L~Zyr??n2Jv@"秐$kW|a=p"evݍbi^MUJb;*͓o4lIVϢ@WEA*BxB检ΫĜxKNL Ee_oMh 㝕u{tiy*V>wX\Ɔ.g#zVG>PKgļ/n ۇTwm 9dV/DZ5{.<#dDkeMu,ɽ7F0N\x +ۯTo6ϔC}d2^|_]jiXaHql[ QP֜Lp]UȜmUB/$9g~t{u#=dD8ÃVwGKNJ)ES4H D[9㈄Z;rt X 0;؋*Z\{* eҽ *:{ĩ=68*4҉ݦ|p7 L/>βz*ҰTY}4º[tL.Y5&Ss+KK.*_Y2/C2 Och5~3SW OpQ\Vuᘏ)%`D`\ DT -^mbC,tχ|$24(:Yc*Feg~;Ʋas&H qsfdGz4m v}3ƬyoVZ!pxv頲oV)hBduo-1kH )15b?a0.3;UMwrA /K~BNm ĥ9f_.rjH2#`g:kth65qn1w@Imr4;m0Q71ÐlY(+_A5>qaz[)IxPׄ2<;) @~8I1Tl-aTҼؼnXNϲo)q3iBn^M\{L8_E)ɞMVvJ7kl&y wyYR[Uʕ'S8˹d1₽s@؜ߡ{01cݮ`S~kC,Чpy:U}1Qted}Ab0=i4\oOSYo'pF8Cʫk=… Q)oxH5!d*!OZ}ՠ t ~󷩦 3%[1^+5J_tC9YhAaT5(i>sprp8/Z;H ;i/oɒvVE2k5`% \*Y`3'D؝7xnjD\dB©BW߅ۥUKySV,BzO\W>z/hanP('-p3uWK#Y5Y .Vv:{yҼV?/z7k~KDrArEO!Ab/:n؎'bSk ((EWXA.R&4ퟌ'N1ӸƼ[H+fGI'jZPq#l^P>U<s lpGOKVAlqݣm^eCs]'u6z&ҨFp'V1&[4֕uӅLzUZ'0} 8 I(PD3@^XTfҞVf?cj-MYIzh!N1a>PPd&}&}` k#LG3K%wkȑ ͋/ lR&'^$A8!`}@ AWN߉mD:px{luGĞp bo砤ף4?[6\ * pmM\pG^+r}몆_5҅ŭO3俻yAEdoiǡIͧI 1=>Nx ['z}$zQ 9RtMmbf7>7=-Fx*C²B9_%)] R[VHD;B]kx>>#]z(q:R[\ ;[zJbnQK?"*IVO[vViFBl3bhPg+Ht◀+17jk'`d!ݯ:Rc(&BSWGo2CMZb[ijn"(2CxRjm Z ۻ6&zxtIWW5H3x2bk{?Oϐԣi LX+0_0]Ca,-:ޖ!:+luc׀j+'>DG ;1z/a"1t,ft5%sِ`)rJ}YDBdR/Lm]6+üQw+?4vr߱V`||e3ဠf>Ew6 R9촩D a](M2z)4ELh ظkZU〫I2AC -@t_kў:ox߷<~~4. tiOFʖYG͵pR8~ThwyN'窩a]{)wB}s.ayUg)eӉ^ߚrNsxlWɛ%f.]*j%lH@c[⎝FK{Gr@͛L-4Im)23WZXppG?dbp+dd1`Gó7."־P _׋LGnWu 2Wվ`M|p>/H!"tbsMna_))-FhY21ig&@$/8=ϫ嗢1 mօ7z9$ ZRm/ ȔVEN~&jDDg9I{ܽei6M6K;L*?ScNӯxỸh oQCS aoHnkU QInI٬ !ԟ{}`DwUF_YwVwDֲ#Lì E&R |hy[UA4õtQhgN4}K\z;KZd}G6t }Ӗt|iϨeE_ R\'z̔:?( oơ9!.p!F%o YCu=!3C@Ѫpb:v:+eml[,@;ŝf@joꙂY5zI>p1"&1cEڄJgFAX}abaV݃mt''1@b J!e!渿M0)Em`gߒ\_33pAY~+cSer- G )LcPK|pm*I&vޜOPlg™e1' A*ۘE Lw ӭ&#o.Իr-u.CdufZ ;0SHNi#  qɼ*}R;}kTb;b# Ep߰4FNAnuZf\~w8w5K?zXZbJ-N7ҹ8[KvVgq_*xa|ȵ -[]qh=P Xf񋏖AGV.mqNo} $AG_d/dq[kqj1+h`;zHY2r29cm!*2[ɷ,k+rS+mDM+zylXnjQ˹Rl+\^~Hm5RjIמ nQR{F#*Rź Tx$xrh S,rlDyyL}m<\`Lbd(E[=O}9 O$nX4=<"]6tYuL#t,>e/7e?rY8Wc?%8˪UN Ԕ7>9ƒRp jO. 2ʨ-F"G-xXqP pwIxqo>x `f(KY:@hˉaw\)E~ƫLI>Dj -~;Dj p>akZΑ;Ttנ}\S @4ɺ#wһ>]LozZ*08hu~:Whu`LüM6ĖxZ?ɘyfdJ`v/[bG!5:T/&S6z~<pP[DN^5Aq"&37R_f`sK1 "P5OvsI"~2հo=@p)KOo5J%!s`:zOW\-c:Aw4Y@Q@{g4>k7;aC$#!A> ښW.SfȎ"(Tojnd"w+6%|oSbB7,K.S<'ׄ\P1UMz,ȍx!UaTtR\[;ídߋL 6}_B܈Qed=]5r!Wx3͛㛳3J2/s,¨ƺ&o`ԽfIt(3 z3m#oɨyY«7W# ".dZnsHB}8'sq톃MЍyH)WkYA,G`}Ҟv S@۽ȗ;B*},-^'8Ω$!|Tܟ!{ t3OC:kˮSvvwm> 0ӄ$ phJ/S+&} =Uzl*}F ?9\f>%~A8뜘`q1Gm[)$roFĨEa,]"B")z.r?hBFPQK=xb 4nl8(+.Jz۴ t'-0e޶8;WhMi9KA|)߁aZwE=+܂wq^F Uw{cZ(yaKR};,N*9w9̹t*Y.;_<ҿf:‹ۈ4 Mƙ"IC 3w1A3l'zH"kx>o{+KȽFBJ9p0JfD uX$،HR͕(~bhڪ [̍JZ ;;J\] 85I0(THTA_,NjK5Z,k1cmBZj][>76ZLyV1h]5_f&N+,=H5#4|wV@xOOw%4E|$BgsF%h3;BlJPNg} .d` D,O)dzxI١|ipGoDAY۟ d؜!gF9o%5o?6y&oz dO;)l.\u:P 0`ЄdjlA)Ҭ(\5)Fx^=:]. 깻\b\ms8/(ku.jgVfxsbkV%xJt ?IOvQ#˗mȪYС;(3Ѫfw]c,eF |'C7C+T-x~󷺅u֬'VN0U1lbfD؊!c)Af`3pmE N̰V U@)t*ON /uK l![R_m*Kgyk˴dB7nЯ"uU>ߎfQ=K-nd?@G1jG\FEb2QV-Zw9Z:y9ۓ]~`}BT18gR1B dG׶o">NCb:MS A"(UN/WY ITf$bЏU4n`4yxu/+p=vB;3lxw g2UB@eOK N ?OA4WjT%zPv@#`mb̅WB9^(NkBdNEsbb[y8+FԯCCgC(B͞aL*DE /l KrnV _<芬+6ZI\dAKd c/JvEMʫ0p~(_>4|F̃b=V#o/S w{ڕlzq'{9a3K]0U3jj_JR-12CK/K-[x1P" ;Jn_Imn_(/VE67,[[_\nZńJހfoⷎ!j,g R0fj$\o')ޚb.oXE1xMW,= q! טd d.:]UI+jiWk*0:e`^96BXi4N'w+eMDŽl_Ҫb UeaseS4}&%B9*":~[}NoWim?W#nj}TW6<HCgG ԛ#ZuI }?O6{%>kyPX ?űp,F_E̸aIph9t)fuyE_NaW(L/ ]?, l[`Jz]j+]TO5HmsuL Ş@CFS3a9.g ]*fs*"̳EڢOγYGx2oQ%ח}]:.^m]>qŶ%7ش0"ﬞ+JކiHuڠ9V=V3GhdKҴ&rź0 /Z0GLH([~Z%A~[mn__5ZJ=`YIa Iv*ؼ+4aR@IjI%QV ^ 9I##w6J9CОӏ1ן BnCRDM!Mn3 Wki_㸡 މR~됂M"%t $_&,.g"_Oi?0( Z:InߔCtMPa|,GHϽJzôG=vuߍoo̞fn'en'_d$mq PSJ؂S(9-fӾRg8W8uoDRd-›=mЉ,Nڎ, }*0㻏<#`u]NoBւ AYtUKIP5sf5?6W LfKaԳcrb$:`E\Qcݚ[> Q4>>fn HڝNiAjV ?>Yp{ #Pr8}ʕ\dS`q7o8{x4kB WY=YNV9),QC椚n欰BJ@/ը#?$ Ks#!lw]޷QPl)rՃ/:"hy˝H,= sA`jRe[phTpg(2W6^ EcҋAڔb*85Gd-&rdƨjU1KU,R2`t>VbOfyg$#5U6z%Df4X*췘ZM5)Q魈ba,pM_)&j14\07%ļP f@?sm8[z/*KC\JndٱL%UVӑz5/r6Cui&A:=J!{\rAir(a>R[#.? LmzF^orZ K>@߻ Uɳbv9'piRZ/#x+ 7sASLqGW—U'\\@#b$SaeM?([w}WCFU2R(-Wc[tZibIʐ`I9 _8< ŀx$ muL ^<\3VYs"2>%QY:3a8.y G)[W [aPBؑ5L￁YƕMyU@xm,aq'(@݋`NJM6ޝ` Oic{ý#) Ff5#.8 6N M/Bia3-{#R0 츻'i8Ey[eK<NIμ4آOdrBQA3`mo6d$A<I,F.>{r.Fl(81j>lKlX\R9~28 =Zz)cCmYk,4es7&<֕>%O?JLj")%8lic#ᮧR@.yE #(BP9jh#`HMSl&[҈PܫGOO>|yn2JT}niշPX" {ɨφ՗M2yOaj1p9&ykWHҹc`r_xU<;DVYL*7!<1􂜃( xʇ6_3(pU_ruZ:UBTi$aZqwzS~ya Evu 3t*s<;n6B,`FaPOYE\1껭K4(Faٷn䰮Ę3_;c|tK> T2]}of K66Au PER^_.ZL.$,j-GƄnݧӘ 43ު)9Y*9H(kq:+oܩ_lHT^I}Ԋ"co+)Ko&U  kas&e}n}y=ED*m;"GT#3;$FTބj._l;L'74y ~/m)<ޜڣ=Ё1m=MSh%J78B8\ >j6LءWZ-$VJih"d*% *5|mSy0R_ }sRoT9 Q+ǟD=bW䑈i9C;Ί MՆL=pd״TEO F[F]ߌ8)$SKÒ` &+ _~q.OPgX[1Yh0 Did󙰵;hŬvQ)F\٤1`/ L+?SiTgd~+D7,Fqu-; I ctf͇kz èTߚ6,K"=emtAa<`KV͐iާֺsD^HYFM_n4ga  lqhϋhD¨>w7Smr=^9!L>7M H įΨiE ƣZCXCZy~e$V7:.!+8=,Xi4P *NsgxX(w߹߬N,[UqYNμ]=ϙc )llkLbgQ&Y븽lb@b>*&mo/+D᠄_k:*RiA?\`:gOo[>DZ-ζ,x=UkW"*"'DU>f ۶9]Zxf^1*'K |1W$ft cHE Olzi'PPf -^Q;n}/il'_Mx@ ))I)#mAA(b `in?q0슾WG\:BW|dӊahNaC'[`r"Rgq%.$ ՃOƶG`yij(2=7&Dquq2u$;\Kngc?vgsa) 0 ^D̃UIyQϤGj.T`ޓqa(}Dq: ¬QjZdA>,T; `؃ƹ rOH;:*UakԨ%W&^V.BVfe. >wXDt19'kqMcYf3dr_>ͼEa5\)^-PR5= ,?r%:+7'}ˌ>lܖw|:bj[ ^ 赬%FD \>UņZeԗu'L"4o VAso:TB+m`_M4XH2e޲I4@2 y!Íߣ\^^W2XGPa '=$Is |~L%,#ɇ?:7 hǗ8& b9Kg+dP6Q*Ҍ:/ޚ\MJ/cXP.K{S>28uw?Cr]<#=dy3/OeP1]TCMYK?&^ p|@&>{Sh<3,)߈t3^v?Mm, AQE#rO%Q|'"]1R_dBt#|`~㹐`F4$@<:\%;y) Ѩ=T=jHk˶oIX[ RNP}ğI$꧔dzNbVm^3" p״SR| w ܝmpHK"~ Xf&RKw%6Mr^~*C}p&<7ًW3q-PT4IZ7Tj"#QOC'Z7f [vcX/f% 1h[Xz'V-ZWN+/W%G.Pl A#Qr4ϙރ}o+GNOg y=d[i㮖 Tyt8|v@Ki[:ܙ{ Dɣ*Z=zr;6@Ha竲=bm$OJҺOpҌ.a]2eT@y(k^}恦1ǻ_y1m?PBצ6/;ZЃyt;4US]:`\g%d+mCd﯄1qx]圐 >B?ʛC#J/wNE䤇!,?YcF!Ņ{/('Ƅa&-Jd]Uls@G-"=\N ke9VT\.C$lyu6J$\1tc3vJYzfl#`վ@b&;+.cVIm->?I ,V]GxmT0r "#\@ kQ|gXvc"I:Iu"3 c V-_[NRuPF3\V+6=GIޞ䷞T F(6Mg$!v>:6JOZӹBOET7<1J0S!/noz`>LhUnmnk'.'SHcΪPy/KNM%yc_^Oχ Ie>]ITeA%<<=a Cn(r@M[4l=0% ](TJA(8_MZq+, 6M}8y8^'p  WkKB;܈S+җ*tUhJH%#YaHc5v wb 4 .JWG"(:XC&5>=Ohpc 6)TLՇ@IdϮ&֙sYr{mQB)e^<|R3O& G<B%2bw2K@%N^)ctn;.ti_+D|e*aZ|Y%)/o[bzV!,l|gC'1Й&Ѵ:d@'m#UA}Z3+%_NCWJFDu-_8~:f◆@tǓ95ǟ-T$X+n?Wzg~ A{XUR ˆc= f F_ǂO"1`oT$o8Pw'%*^.ѥ;Z,!"V>_/D1R"h"vGENCB6'OfaLxSL ޶NiW3cN7Dc+}5OZ̼8&<&'ר-V?~A&5#ӆ**DcJKuuPSS}UӭP7w묑a|yB^˲ !H F O܆rG 7[k4zi20ی'+e|,/ON"Zm(GRpٍwOdTxv5C':F>b.bHU9yh2scD9J*—rA vvpBV5PXle/4opqGpB+N0{rG ҹ *m@C]*o X׍Z=*R!H'_ UɅ.mg V[y߀Nl%krFM5_;Lu2Qdr&| {sKM}&=\7D\IĴg?n kr:)'ٵZ>ZAe2 ^!~䯘x"Ntp H3uVuhkGBaxl>)"yۀ+&Vk8fYa4%~}"_"H@Hw4.龉ì Ĉr@f҃l01Ӆ-vKdN)0} ژ<.jFw;ݱlZؼh8g*:g(Jcxz*c#Mr\kz$z@'|cggn_JȂ1NmNEow/̜YN9v㳣5.{3iWr"5ep,Ȥ: #js4jz&4dAfue߸ӴuВ8!' ۸%l䉨PHڏZi Ya A}S_qXaG| ~BֻY^^uPip4`^gؐ 3DD ޟFU{%zd]O&AlZ PftXuо|?Vi #"MmkV#jI5X>3`r}$YIs sDX-*WD$}T}4M%\]۹^F`bU۬(ĔK9vێb!|-l^Dר72HH$<4؄g}I\ (&0 J ҄b<#d68i W3b@;}0qn)Q g:y@| ot\tFV\ʚBC!|jSgtoʾnکBf܎!XO%C XhX()$l:B`n]:LITTfmE Du٩AhyiWUbl6iCn3?m卫_J(bl y2Y$dIb,OpóAlJmSF$4Rˉg\3?8B]Lمj&* tԼfͷ׋1Ec_備u׺9A?PM[UWXY>ȏef")52M>% ex{lI3^v<'Nv;`_O\݁3;M^p̞I \45C]:Cg{ {*Azf$p#R$nnb?FVi`K!)~o~E'0ƶju\ s,,Ma7UF6ˠٜގNM""/ [ :H=9bmaI%?MD_U/=L^:*Ugz2ʱW oɪ8z@S^(L!bE5R%13Wh9 ||X7:TcR]EȣgJ-36!."_9)C\24SȣB\'a!*R`-yVYuQ$ lR:U; 2\ 7[Dݘ~#6촺U-Rosȱ O/$ ܿ5(lp{5t2mFSeOm :^B_R3ĠA A^ :wOzU{o' 'KK^J+ ӧVK~M(<R>B Deߟ0ʕ>-8aʍMݱڷ;@i@_M~c m &4"c{3q(sIu:.BSzVrG)xDG.opӄQ p@D(yJp7l%{1f!5s&k\ :~O^ ˾Ba@Rj6>JJqtQ1(/ + O5?~-` 8hEM[+F?6d,i'b;E9wK駑8 ?| E>p&d;*!m^c;-m1m*LZטlJZ a, EGqj~r,j>lAVbB6۳Y8P5aݢ"|+)~|ë2;x5՛ wHQ4T HK~k0>:yf[{PmE =R_qö;%pt$Mzti]KA?бZvγ %Q!u=,Vnp(#מSMdK).xP !H8ubMc\X/9leN#'b`-:a43n#(lOX=,.B}$ &C)O3nzIʬ_}`@W.a_M"!ׁȊYzE` NQjۭxp8>TN]0cCā֭ `ENp!VjKHTx3mhq/6dHaNRAEbƃXoe3)mJ_;\ 쳝V K^^EbzgX%n@*G .E`wcZя0;~#UTNbk*U .,uP"f~0=4-N5RSXvyr=4ڮ@Z7UD_$B¿xM62-f/f0,Zd͹vZ1 A6?uhs3ﶭŏvY SLjC2Պbvoth\M8άgg|Nnq&!1:ԩWij s'x3k'@qfge` s H:C֯]2K~1+lmAwa3$<*~[h:9bZBB{W.7k!LՎ3ʹBxBZuM(MP֭,n~6(=el5uwLPl Yv_L S]8Oovhk;N;t5A*@QEc4P!_%y> *t?,9V,Ǎң 8x‘@E#TMB]0`}pv):oT'|HcH-2D:YV4O\~̕/2\\m}4:5eNJ1P7"4ABͭDŽ9Xgm_>ZK1S?ġܧǦ" ;욎HezsRϜQ)x!#20^<*qb(ᗀ퇡9"\hq.Qp{%)磁=MZIPt$۩%FZh*t0ڞBj?Cw[K.$.*&phm Q=kǽ|iSaQ?*1kS"{=Vyh/-n{]W?g OnJȹ͇UzOTsko8l9q d@/(Z6ՄNb\}bjۥ5Bu\fX_0_dk*H0'al 'PPaNu!PnwB='JyûSh#Vw} (ܕF7ʎPs7,򥺣1&1뉪G% 3Kڴ̼Ӷ^;qը|Voe#E-.[]H%jaBˏʿfrP(I^}Tj|>=@G9L|T3r.d^76eu& j#J%1E9h_lĊY)>4}O G72 ;jlgҢOkh۞nl}XRZ[Ƴ`4+ׁ;k!UAO-i$ IpjGY@;9Gǣ g#e%]S(vvddS:"Ү3@ld^56Feom#qycN%t9G`H+tCAӯii8;q]-K߫4C)]5ec ca%2>a.XKfEX̀`01ՠu]o[;0dAJ5K'g~ *TFuI<vOuwH&ZC8<(d ^@(sS r6J|= b%uBЙeAeݔ.c/{o5>-KxQ5Oyvfԛ@#qXFAyF )>Bn$Nވm'8-ꩰS+ }T骺^q񽬊/Gkq(.A xQ-GKL` "6B53;[syA- 属Ł5Pdl*1#X*:'WgqRp,̢ &Uɲ>mݝRlN2 ͬЧ !(/ގRc5P Ol!T 9lOtP'bx>== vΞ oB$; Whp~UmO'g1FEQջ0Qgr\pUDir|o"B-xRß4S30 ?q5dq8+L?TZȢ8j v;5f8M$y ҈xoy\b9iK\z \I(@@=X2T#X2նFK ⫨8kBcz_z~HhWA/8⢉/YxvjLMv-?Ʌ!KУq"# T)t6Sv`eTve!5U.iixxF?x{1 s QXJkӲgɪ9vsbkbjriH!g2ރ=mΎˮj&}Rbgz@yTut-Z' 5OY7o@xNoP/Mt3&ѰݜYsO#9~8p$TXGaR,[̑ױ};ojY1ߴyw<dȏM,,Q_:! tqQz?ȓTGQut!ox?XkGK mT/X|F/ܜD =~ c® ^̇?ab 믄u2im4^: ؔgzyZۏG=]Y H$@t9ٸYʂ mk4tıi`VW¬t%.utuI|"Up0鱗}lh|XeE<*7 ikXށU nKsrm4HLKj< ?0n/=!+o hU䏜z-ڽF~/Q 7ȫ bfkduuCD)Q6*jB׶ 4"D-oN81%Qx~3BP6job_ݺf MbyZ /G/']z~[ڧT$mɣ9@?هo01CW̩+/'JIt,EBcG81K&Q $- SxmJ ҠJzg* ah6Q_3Kd}ݎ 4W LTY*T-dPc<9H.y싰錗I{$9C9M/c˰H%mV+58[xRj3\(x"!Z)ƄkB:T|ø.r@8'0Ml*a)4"yQ D?8nI}E Z㎜&!Y05_a/9B2}_N!8?ӒMJ[rDRIlv[[xy[.5țlgs!숙}UxbɠyVԘ%eJp0p4Ntg3A|怡q^W 0Z>DYR;fq±-9ʍۢ&YPZFnnMDoZϛ2|1j+vao0|8i8@\f׸BzL1pJa"+ED{ `YѶ+UWjՂ6_:ˮaORyi> 4PB9c8Ӵ[$ۤ83*=$4 9WE}"D5WY/Aa/~o1&' IƎtX'Ð3\\'3aIx%E/)V9L o%'b={ݸK屸_$qߌȹk8"l; mKtraE|d&dfoU *AN]nc[Ttx_ J4.3zle%+YH X $H3n P${}Mk\ w^~֒''6g7|{9?% ns޴,+Y YK[M;v!c .Wy{ |SlJ$?]!|.Iv{_yZ71Yb/l#ߩ;}ӄǗy֍!mǟ)J?ଧ$H6)_TJ\C`&",/%"kn&986pq~報sID'Z$nAUҐ3h槅A[Bv^O0WSRHO:|+N6]HD64ϟ JDLkWLEʷv:D_MRi <лYIhk ,qg.|B0x IEp3l*bTjT:#[ WM533{M!x'% lq>͇K'UF є5|;j~kB3-d9j?|M=~U!>+XxZs"wPjtx֥[.$mQIwslXL;#ÐQ`/⌿L\9caDG/:H5~S֮+YD`[9#6q8'zq&!FF#8osP ".UԢBm-3}wX@P2Q+i Lvm+jխ0$_n֓sW o{|rBU8MOrqJf$yH.&Ehv[/?Aﮡmc;PnFl'&re۬Y|g7/b#ݎQ!3_yu(-Cq;#,0&L8#K` _k-7o*µHgele=t%IC&pYEcB~وgC&޲cs:t]2q#@;O!` r;  yYvdi-GzK`̒nHÇaKvnXG%N2+eV7;N'JJLT2ـb#ILA|sY\4֬BTc3B/9)0.)-ɥX|8;?,#Ƭ,rMP76[/7bJ-(B[f^,[!s Sef d$Xr#^;8V [v3tǯop:Kq? ՘ 눝Jv$Ȕj2CG?A0k,DE9G# bռ oXil9[.r_\Z%&;[TAł}}^S`,oI64|j{XdE|Q'# B~Z LTf\=~MzG`wɌ1~a`Gv&[v۳}Jz=7T*;)Q1 L]$jLr6N5Z?iDl^mtt۳p=|2{a"ԆMKJ̗Z{w|ϵ`1>T-LM3\.+I@Sc@&i,_ǭ3ሒ/uon`^ì)<+:{ oe&dj[ T ǵ0$QFX ֦6cHF"ʡb\?+ 4 s1^Zи =hrc8f)nYpa.CJFUV,{% 3Q. PmD'YNÞqE$w{ _Tm~XyajSgDWc;rl& ڃ2i0{[sI7J,F1gxzևv%Fy]LO|pʘ&*c GdS?g1tc @77h59#ޫb_%"S*K&g )dG,^UAD,2#ITK .Y 5G{ ;_ٓ$މJ)Fu,"uyh3C~zgv^+g08e7f.G][ {|4$GLيdUN|Ā*cRڝK< {w;;&>MXÞ%Xu)h e-ǺTy^78ZbdΓLll_"!h?nR C-1 l;+Z0 /bt8Y6 Zg= X GO4WQ`d;2Vq/cΩEGmJ>h6SZUy-+Cb_2~^"YfGo@·-۳eĩ'>Wmj=ԃ%:YZ#8p !6 H2JykKa7:razyg.EoST~ 1G>j5!1b$|[pS`e^ʎN]:a޶EMd ; h讱,Yɯ/arJA3=F˫pxNʡF:}Ϋ=JMo83"zy=״4`&N6>T0fU2FO)UuYE_ Y>^Y2((x쾬$Q&]rgLljXY_x^`P'젱8\Yԣdnж -]Xd#w) ڱ]NuZ|]oӱu8"G:>t.CZ [uRͨ(7VThE B?s1q_^O0$lBjzЏxnaƈH}N%Lad@ɹ !x*=gFkUhd֪LuP#eYwe9\;kƨ”j:xU{JgtAK?e~a2K‡BfJ+il,~k>E<z/ھ 1 d|w\ƺLR{ *?Q7XtiB)RR+zofB gj"ͷRtډ!)]N9+>Bͅ`e\J$ql-?v_īd8zSeT23R0hkVdh1GB[$Tpr2 EB!{%9xCBKufM&ۓr6OUuLDOО1ȠR&SVm^ E2 3/XЇt ]"[`4ibd[ x(f ZdqtÕ'1/ Lyz䂣>TVƭ wu'd#^*}b V?|},=N]%Ҕ]}V`q-yڹ Α'U?y؁/#}EDΔ ::ޘ+DA.Y!RI֟'zA뵪ײ6χ*TPB}?LFC)E#V)kEs=`6c2EA,(T.wL })HJ.7oJpH{k ny5? ]P=`\:7IZm46kFdSk֜?骩E 'H s^EH\A%&p^jG}^Hꓝ%2a-M8 ]˰2v屎 <3f]^4_Q̃O8u Gg2 DL8S|fvzs`6F܇<+ v|'-(˞zk)SSytzcn55H$! wWXF4>+RH{̿(Bfdf{^5=;I&3_鞯dGAoÝ!F4S ZQWgiHvf-s1$Lt z K_Y h1*V:l{#ci"kNd[#{>h*N vx)ە1YKsmyYq&גvFcЦPmKVE`-`sWq1 *0Y.ͿhW-fLG_nDJ0{D*#{)9Fx1fd/EȵN9E.KxxD%Ba:z 1":Xa (ڨV|$5E}2$},SQ8e=A=PɵT$XGC]H_:UK3Nbf W^J_}$[O`% :S4FgZ5fuvUMm~VIQ]":A]]Q#C:$tqzQU ?;^;_.ab!m!-d/`%bmkBڦUH]6? f!eq EUܜn/dF#ȕ N"}S^M}:-mG#kx 8G _:u4wPm2Y]6~/iz^\ g#D s-B;:ү9˕XLS%`6(hD-'}i4z<s2>`j?r*31o[\,N^Ynx!7Ѡ3 7Rғҏߖks6*(5k-رhN)ys7_wS t eml.T,dQ r3l b8w@tR'N/zK~:TI"5Pܹ;\Rrhé9ڳ)d"G!b`տER"C-4Tym1mQ-\Ս ?u")NaRXU\ w5j*dTK-\y9c'AtoD,YO?kx7oK|5!j(cs 2R^ nޞ]lFE C -|bnmy"(G ox5Gc\np&p8*(;} oWc6NFj+g;Uxj}]0V $tN))G~2r@yq*!z,-!Fo"fV>UlMn?y\- xH|%v*fӨG6RY8?)fhAJn #:eǸ|ݫF\ ^iEt-i*,$-L|,ZrvO?e;*]}5Acm;'AGxԜYd~/U(h$y}k@ජ`KPT!PZC }yl)MZ2[. MBn[a՗DWˍC#DM%jx8Td{Pw/+=2Gƹ "=ل*8)&~X(nma؞gP|guzWqC#2,*CrObf#A̧B~=!&*S.P/e :RVDꚄ Lh,%LXuk9]~uKt P؃O{w0v`nw y5hDԔ,!Sn(YN`WPH]Jtj8`[v]1IygeDt"HCWcn<?o7ϳO*tX7u 5~ƦCeOrB|x]$, =M3͍Z%ݾ$\=% `LY3;vW#㧣afS d4Ҍl7 kiCYZT4hd$tKsnps)z#k(о6Z}RJd!- }JFVmk:Kewԉ} X1ڇf[]G؉ӴxLdMvo%_1ZP8eъD B(vLY)n@Bwx4:HFzЭ;ˬ"6Eȴh\Bq-rhz(<) _ênUgjU?SKQtURu _^+SF1&_Joh*tm^Nb R_<+KG1-J, d' Va+v:gjlH鱗nV,d{<ݔΓ,*=3BNrcg듡058: ,ǔ  XH|fCG$ GRA+3Mz&Rڑu=9>'$DMUhqfG!eDABЫ B-H,;b:, -Ysl \ΨjvT_b_O^ Z8xeTRU") 9A5gKϧ5%G:uu6 U٫cU m@\yiôl+%KCW]րI"k(ڟ_A;vW%]i0酪˳}=ZFGjy]'$H>@qk|'RĬE8￨{SCD-i.r:Kb qq őUq@k+өR΂Î7[t!VgVzo.܈Jwo=5߁J˾ DagBH2Vr5D>C:b@My§vX~ܸ&1T;xډqhj Xj>B;{|-xΌظ!j,SHlNS%u>c]\p%,hC[{|9=zc`>YH9`.b$ 4Lm 85m#/DVbSȯS 9p\knc~-+od"JYiA)+3@@< 忻’|\4mbcf s9|gKY~^jƝy'ul%F#UwMo^xQ!=#lRy7q}JY 9о/?@ЕıjN"6.AQp qG ˂4},ͥa^xճtXUY Z+eOR >di }Cd. Y [n,1J1 ai>8gR:-m'> =:iN7"LsE 3!9/HlS1{;xJ l6U'F@2k>iXd$+Z ~XXIq>f~ݭ_Ts$|A#dQdLr6kogTB'G.YG'C-XA Gޠd7X/ R]x4`/a?X|E~z ,6U~TNCja4 gC@%Qt'9+ ZS {}p,hsg=\o&!y(uع>{G|ѷ~ |ER\f[6=]_+YZ%o =ϣ>šV%b-/ܪ 3aq:爗y i؇r<:jdK@3׆NADtl[fw]mEJO<@udo4/)z^=4]PD[ġM:/ 򋜗™SaUUfgQ@b}&TI]PKg|_iht1m˃׊ɉ015m.`f>$:1/5qr:._T y'i`A32XI P^k9C]QrD<nE*v2EgtXMьT UA#َ@.68)2C7C2 TluyfD4Lu(޾B-dӷe  foI+kg{HLp'w~Ip防jtU^yj,c)[V"q1!sqgKxyP*KA lNjIgg-P=l"ٱ1eWόǬZ8I:?杸t吻"K l 3[SIߺ㬈$L;I^Pj34G ?YQWتt!}n\aP،YO*o$&>\JU}bQS?*-Oт2&6 yFYR5E\8!7$@p )YΩ.B?vTy1KKp;kU@kQS_!Wg96\d^:n v j&}>،86MRΆ/'˛lx\^tȪF ߯Fd!b՟(}3`xTN7~ӣlidRd/^tiRWddH']c`,+K`!pAk!vK;XæZQ;TjͬK558/qᏵr̘c#5Vt(pP_wKEe9==j~ʨ ,db[@=݌1ǷaWѴ_=F_CLD܏5 -^B p/<>I9}4PTƧ,83rLV̄7?0+ǙD'nH݅ZwQ[jpH ^Ƴ?nVGz՝$;;|XF^YWh!CKk$+u |ىxSBʲ#­vlAGFP2gh`Kh||aWFr;&}<νvnd"8U{w/ ->^OXV]ȊAS/EK,ߵϖaF4,iU—`&|O~:D7 Kw 5+dq!S= tQ$ݢg|!",rQ24#k]6ع\K#m]BG$4o3m$ğ2T vد0a r5 FfŒZňtg+[2NpȪ!OYۼ#N3 _h$/m0H޳+|s:zUɁ^V%Iևաո^Ai[ٯD~mU@~U|M %_];m- gP^4Dw%}CLr'/KɜkթMޑ?Ds{Oj`ʭPyvOm.h)یì޽D,,b`5_}~pUy,p@:FYYuh&jGvLR.XWpd'*e&Gx?#X,U?5g&oН!H YLGl;~c+1$ְH]=K#&au<o0;UU+R5)+ "<%񆫪F/G]ݢXp'as#t^WH%FI )CچVl@Z{J)$W!ꒈu w^qLݭvqHޙ)l M 1$iX}<$Hܵ6l".% 4* s3Qi_حJž6^ٷ8r59%P&w*_ENDB~ُj3?3s 'R{ rjxMs^v M5@`x ⴤK A\gM"7hh͘dh6\asDQH{)2?X$kߚ\>\Mqm?8G~|G4KELXD`"E\Js%y(v $MV l H!+ Qѿ2(ShSG}*;iJOIiڶ*%CX96d3ŵVQQڤjnя@k-.ޫMxUMwS/dNRrQC4 >/Ah6𖀣z\5yv}YTk|u@_Iy: ̬mP Jl :L ‘#_-`<1UTÃȔp>'K! 5^S#4{2(91cX{bpqb2 z>giOҿB\;PTg@NZ /VGSlyfmq w;:KP8}t X5>9VҤ@Ek 0<#B ;ԅ b(s\@H2HChihfk6!fR,]gINn6&qXO)S5 0KYѶYMUNlXμ210wLIb~'*ob-lԳk@ȠK|?VAM2he$'9"1ӏ`h޻H,Y ;Q5b°$hwaC][JUP%%a񨬦2ϓ1w.1s7ZW(ZR=v'ZwyRqyl=Xu똡>&Ev*7 E%A\ۆ`/Max/hZ{TuZ L@:YhI'4nۻlIb[>Np׀M{ 3SO? z+7=^B{ IG (텓F?Seg*"+{'qݔ wY_?CVeB+ ~|Dz;]>76W;6}#̞u0,!I?۱vgU!΋Z,mO}GAvKIMv15Y0QP5Zjj&=AYAʷSJ|DC5aG "Ux)+ #H"ǰ5WޅoܨUtEi S5.U IюI]`p ѳdrIvV(ӷ`UÎ 1/ p 6_]^uQ5yIH-#&qqٞݰK 1V5c*yb̦ N6?6,7ceũ+pB_XDHTT (y|0o]CإjS0+sMκ|wM[`IތFG(HiU-&nyѐx'5N$RqZPlh. ,Vt ,bȴza h̋47d`Fs y ߬O/Pɣ 9k zLTf,ff:@ִV@a{4*EIfMTxʏzp#` ALݩW4xzyϐX)tD0iWztƙݖ+igtʕ4UlIAj"4&Cjod맪g Ln3 )XEY( nLĄ(dBKƕOE=eP^y]ȹe^6}bz^]5yw+-^$ G#9=S==>!Q#gxFZ,\9)kw{r-|Z.?zh.b/ ]ɩcs8p 1 ]j΍gS=M?oLϐx RL [(V&hz䰒N5b{N,˜tі( GrmiQfYR~QxAmQJ^MIӄl:|?hFCp'M|'gZv W?=K &(S):yGy םC@RGs 7vn.[n^<O`>ԛW/uJ0hY2O'cmm(.95c.[Iʤr)XRɲ_.Ӷ?9Υ|mI@4w,_G+.y7yCR%Hz1]ŷ4#RY "Bf?ŸavDfDžܗ>|YޅԚW{xbX*oZ"W5γzÂB$b,Up:ά =x`x׻+lKOzHd]6Gy=&fkt0~YhQr]_6"6yTOgVY nC֜ZQ\%Se[)CF k2@U?z4{tSp+qpOSMzAWgE R s (tÏ_X㢠/*u:*ʹ b-گsC.ńAQbg?;`\ۋD[`NZB Xֶn)\Lh,}5BݐdReƢ[U:Шkdvp>cTeAm%Gҷ%H`vE*Dp6k_`IKS0}G%؈Aۍ]B~nhp0{/k̰/Xh>e%,"v9]g ԯ v"۵)ft2NS:8ȵS ^Rtsr=bf_s*eA -§V6UQEL>pp=%Y -R-)C ;yc} RA!u4?8f)lJU`qyH?Xb! [a]7۱ԫ UawCW&@n];/6 `O$Uֳ\Kw2٨ #**?Zq'h'R[[Vsl/6oqH:bְ/U4\׍a߇6<8Wqk̵߬]Kzʑ0K% =ɺr 'uEj(i)wupu:.ǣhۓ3"-#8=ujOA;8 )^A{$_9UW#qHs17kCUYwgiZoW ޼b%~ڻG~*dK̛o.gD_Sd<lrXm aY;ؘaiNK +)E޿G5}1uOT_\|22#;)RZa)HUX)` u%*SF2&˯]fO,-Du>e8JvKGy@R @7Ε * ulҨIZ 9 |ޛyCQ'J(C lƎ?ڏta(E01{A#u$*^t(e"jRʩ:KAZ#=c& C#׮ե$W0VEڨгsSW\8gb:G$-C}^{BZA5Ev\r^"`4XxM,MoU F|l~Ds"f b];;z^@=bOI͂6IzI%E,4upD= ZIE}LKI DsVŏVh+)3j3>4mFM1l0}uڧ=oi e 4ڷ 6>.iBvX8VufQTՏMIt^x+gAWod3}ȫ5(Cs,_[LX'tVi'> i p󅞕!L MA|d#DEJY΀Ң[~gZ s1D>{OܨNYB PpSf=}w ~4d{m;b.)_sF%MΒ±9kbJ'28#j!ch!HIVf2sgL7-u'3ecI[ĊM{ͭ+ald@j 7 cv֤ZqmxЩ{&جylx1CcD)6}qO9!-&nH) 2xKF+o;ʤ $^$~v5-HHgsQp MݚBHQr7dS` > 3_fŅR(izny!o괖U,{!m? lyIDO$;AnFo!fm5k%ڦv|g *X,N먿XtO*. ( t:2癭d/Q rHC}qj|0_0@r+޸<_6%̂ݮ5zmr٠+}j*95ֳˡ[弐}ddJLjI#HXɡi6O؆sm]t!(hJxeO MA9$}wC[>̩E?RAa)|y|ÈܬN 0eʬ&r4oJK+@b2,i^Sݜk#?mqE$>b Zf'Unᮮ=.`m2%\O{x)/TOGb&lK]{ p4e 3 9jl=BS ˋDnG!Ԑ,._h nm> s#;<𨷘  XI!qAm2\I<T @hJq2v{Vړ)hq fUev'yTqOtZɴ/),:\h@ ~IaFDUdEd ?iZ3EaW ǻNzeٲo׬djko'z3 TsVka 3*~€i[ FHIJgL_d8eO2߻V5y 7> KmfhӠD:ӻwwbR)\l* 0گ>T5ٮK9D ӼLI jCE/9:w 4@h+7I= LԈBï]^LMWg}2._`߅ 3}1Z-G5owl:v2.S߭hjG&пCہ" _VFv"і$3'Q3j3VАó `|6%q.7ƸMET],C`,kJOЪ,uo(#` HFd+>P, h-kL)L`Y n)7wDVmq 0yΣ8th Hb~gtd2ȱv*BVTڛ48^Ԣ=Azʐ{F(𙬢﷗ I!fp =jZ3[Ʉ$E W,[Cx](3ºn %#7B&̱Ļ@0>20k)o=?TnLE<6O`@"삜kINOcE_F];jsPW_ﴻdgl\#غB!osIf 9UgvpSMY,G)_;!Xh[(5D@R:q EVY̠MgeZBݢ'Zgrsvn6z\d^f1ݰid&3opdf*dksȘ>V5Ké%<}uTݷ(yͺӍa WF+C{>{~mfY1|ƼފGWFjtI,+- p:/&t=2INV-(;_zIlEhaB_ItonȀW-7~ 8 t\ )P0D4WQ1eaI#nߵmy3<A}bADdio^hD|YJ4Cĩ\P_IE|A_K'sD1(4}<cD-@ 1|hV\k)uacf0 ?Dư$^;뾄4RUrc<"X|X1Nz, $tmR^c)'ZW.̬-hQwoW%y\ IjwRnMvۗ>"*P)˞DDc 3HMJErBv -rԓɘon++eL*\@IvbZ+ O;G'ԴNC"}=/ F-J|;$ !QGjAJ0}+= Ht Q'Iek'*gw({f\/^uP ؈z `4|EY5f9NDtS Md{Eq#oU.X7ӗv㋿>rwK⁉FTEP ykM ow稅lHQ,pdÃp_;~ Z@_1׳kOiM"޷ո )$bo\&OͮiQH0*pSo6:Wc㵐]Qy2Iڛs{uk3532qJ]`U U.&SCsTWy ^%̘:y^>==ht*:1$oCLK"`XNk_ HVpC^2wϐmbp-orhy OJySǼT5EyT>@/s >r89? z"amKY쳻V]>N/Ē'0ffsoZ}U̍EWRz̛psM+.V6$x9A0o׉o>l* s_%rVף()ϴ B &:!͠TJuI晵b?\(~/*9kXPԁwc9Sŷ:t > Mۦo=1Aqw%= o=ɉݷ%ͳ,/>Bt:UEf`nOkJXm.ݺzN/OX$/ O67[ zBUp=UKE;UݍĢ%~jK{K3C!wl]J*l9?Tcq*@N47 ?%@;i;@ ւl{[>4n$\iM δa6:]/6$dѝw18wq~ ėzWb82sla|wЂ+XlB$Z9Р(K )rrDyZ_9Gr!zU+!K U4%ꡍC×ҞC1 OGqZ{x ʪ.|\C[lWW7epI?,To=l~@IH C%{4.E6"/^v݆k}>z&^SaudfgܜAyF;/{_;!mׁ˒ %%unc}$g_?1PLs1(0,1<@l3퀾۱ bdwş$ǂ:&g >P2ϖp b7`8L=΍]&+H`%,5jEr(n?@b" ƒ5.X]#/[8}Ē3_%AjɈٞUv^ ^7V}+\4m{aE?y`֩ P3?BкzFnzPY|bpEQ3Q󼿘?叐mX8-*'GxP͟]ղE5R}?9h%q"1(8h~Xb?= %ѓ06}(D\Jz@cQ_MNyk_RSБnSG`<,܌S_4RdjU]JCq(аVF^xY)1p|eshc lQE-H&+zӨQ<~ e8yޭ D/ ܃!IŪ'yIIoD8o=< ^O535 2~ۉMZ*Ы+ e6kq:nu]?2>wg)X&5Pf7DAB)aBQA2@< #|P٥k$ɮL7 7i>eCR| ,mK};FlW'܆]=9N32>"RZBN{lht%i|+o']ٚtګGGpiI ( ̱,Ğ0].4k t@^6"sOOzv|6E~8Оt޽It6)5>m./1Vǽ SsbkzGyLL͓~;n̷ 'rX1Z˸K.Q!8ޤ>a]@)U-DusdYmʅ}&1}羅HģwQ@U^ ;r Gct/&z47-lq^ל3!O /VoByTkY ;7oN4w&MW.#3YgɎUn>|7B7ځ}qvO쮀^UbqDmE:S #lG6,fߔ0Tj2G4Bcãw.,4F&C{&xa eNj h]$n\K> Gj~dqVzl3*$Ov.㰴>,yY#mEJOҸr;Y.“ׅ1N !x姫({=Mb e檍*rnn3Э߭0$%Aì7uq ʬ2E4u^+"XVPI@L c-=8s_YBM֬u +ZQeҰH1W Tʁ8zN{ @+r׵z*`'YeҫWSyo &R?!ng+vI'k/'MOG >^.aԣ#͵Fti;'AYTfa礙.H98 ۽2e6;t8yXVo)(C:Obe'H6 kz7܃@vIfsAp@ܺC XttX֞8"PXbN]n*_=qMSh>R?MᲶqO +7q3/`:[-4G~n\Qgw"m:*H4`\gUe"nlf㶄 nor\?uuwB}B"tFp,Υj<'/JHb=-훥S$+%17]OS滍!$ I!e B BUv]!PfXVE͗G%.V!_ڋ/+X VXXT]qnO׀IuT>nxx R@{1GGhdTnZn~&ytL ֔r9U6C ĖϹQWl QQXD04zj.wfkjeh~V~c Gʐ$W֫&37\jHDQ.N7J*{; ,@/D%P9y]\.pyAU #@,@gUjb7GXwt9d3{(Wٴ\1QuG F,-eF!3_y%DaV09I1Szg.#w?iKLPJ_+ 攃yբl=k.woTփ éF"'73l\_`?kXQjKU]c)34|Q iNYov*^p߉ja:=s0r86msc^ZjpU)/7=ђ)P7,-?J0;]rUP#$w ڿ:`2vUUtW $k"VQ 7/,/}$x@/?fLb3RTڊϕ5˕JM._} ϶,x q^@E:dоJnD\pxg H]'T6Ǘ4^H)]BދqYNXi/RJj<=sո*('h&ϝkP&>?D3hL\I2(* +APs僃>%SG ;3>&9B}2s_mџ>|;cǷtc@j6^k ŤwDahʺgRp3PY:zάw]zuyL@z] *??$@Ă\0^s(śC͘ Tqʚg;3L} Y-][Q.Y8RdE;է7}M 1 y[? zU|ұyY>@zaJ&2qS^zAU qIwRR,`` o~_e֔iš$v%wP7un낫{ L'yOC#Z4Kr<'܏^`)t4ۜFS1I/ȫTJ<~J(41I<=B e{ #3u_%2c[滾Eq{5! đ+ԏ#wUޑ \u RS[&Us}DV 9Ћosw5=a\aPSVfКUg%P'(Fe"ZLR/+[|ark;wW8UJMjm|5 }Dx݆y*Sg(S,{'g@p6Kqv:džUl=p$b3a67-(u'xZi)IZzv!AҊQNb1. pXHs/]3 |[/aQg݆Ł݉ hOļܴQ Jkڍ)2ŒKDޏLwߋHZ,гܹrSdPGv(y$HUT?]78BXV> q-+=;vRr~Ef右 1dٙ3퀌ʙP #Tr[z$wHQyt})w7Zb<[[dJ83>\\Y66wQu]֦q-\(,Z|F TLp9xےuHƁއ"eq@1\V9Fb8ij;9 (we'S[2C%g_oas(B'BEFfYⷨ^6PX sCwQ60JjDjiEb)o(xx, A2i1OʸdCAѹgD%>/WPzB*Yai[{8$޷s$1eXto 4r!xTihakMϹrV0t*ڨoĘ2դ7"V,y%պ\a޸m '`2f,]=2>=Nk&XA}p"f9ҜnYssSݡa`Ԍ%^ʯk6~>ZW_Mqͺ*trNWx$q{Y G:n "DKlk/st^c Z/~snt#]KQ'qQ5,ɮ@(PףrGTwlN,]YYg=C=i}}w#Mɔ*aVKAVvXU!MkOP?wzt9u]6/3sT%S| USRTt'(7A$k+J}wZ埕A  /$ "* Lj_+{^S٥vxF4J=?#`y`<*B'Q-RSPE4\aG'Zl"/\P;ju|`=+RDՠ_#ծ.K6ٙmE|3o,H]P @{)\*̸^=CP5h?N)f`?蝘HWY^[~<ρUsA Xw7hlfvzE,[ SgxsؔyPN/ U1$\[c,x#6j)Q3o6:F RQ&\d!s$6t3 6NزRx>ȮTl؛ra!_f[VWyJn`5c8 ΝD|`[ߟX0I+{i{p#̹p_s_^|u]h%*Rzp?HZY 6ȋ3pǂlԘ)rs xAh% (+{FZKH95E,]޾DH]g1Ii`j"@>fNqjΒ;AtԔ$rOHGZLl-o$klR9<$p6}/NPὼ^X&Q= 9.f'SpD`nM* I^PMK%̍9vX/kp ׺\"C(GZŲ(0*Jä'v_<8 6 RzTx%uΣ;. ;b}%CS!iހgo;,:ʫZ+ }`Zk YK8@+~\CX)cʍ.R~x+&W]pAcԑ+Pcy0s4 5y_5FJ@uMZ.~Y'ۜaZ dOh MKKi%`P\A)$MLue{%edks[_>e%r)g/0sAW9a@E;VdeMPS}{943КQI$G2r*7o5e fʚbvYv52r&$wߤtoP:0)얲jz.L\y!/&Z:ćϊv3ʔ77w5ȣ]UiӸkGݠ<2 Xbsό^i{kN֣Fv=x}5z~ckr3iVJ25J#l䨿QI8UUx3Y:/3"'Oj.d?Uc㬴T^]R,жnF#̟D  v+$,~<쨾flX⚑֪qd:4"Գ_)%+Iq;s3kf{v|9tdPt02j9?!1M~fish̋ԥ( ~`nůٙ]#w! 9}Ky7~A6n} @!OE >*_0 % ƤtIzN23G tCywuYV J\_< Y yxh/Ylj!A.l }2% R?40OSTn뼱jj2}H7PQO#  +{WsQ m͍):Gx.r`"gZIٯWRSgMr."Gݿ<o^ˌuktzvR0Ʋk|uR L=CBbnW9D*3d@6r3#tinuG9!:O0ͥ*tX}(WMAJsGuv`M\,F6ɞ%8?x5 9CCbg4p=F̖%;Ѿ̵B$n)-,n SPnT|տ Q'( ܥyAxx[ fa]Fꉹ<q,drUK:ztޯ g=/LQDqvX`zfJ| PmLn*tsc}w_H%^oBp5@י;x陃Smؒ t9clHGVEeL Y֌ ~"a*dfyGfβ^ɤectIsg,ejk5Wi&gfg&כ)[+LrojJϺ@] SjXv~. zS(zo3ii ~Y/ڳx~u*7~ k;E-ҐAEd!-$JV!l3뼖kA$iVA4B}եY*seH=7I l?ЕS+t۹1`*KJ ~YT$C6: Jf&Ӭ߮* ayIFcUpO` 6+z-c!<Qn<z@wj!̦hfCMT_AvCPZLsOԠ:Z6bJ!A<ɏ뾣?5+;2U[Gɦj/'LexP˄"ݎDlI bLcrta6+e]\M)Z4&ID{V<֠%iSDK=R("nc=`-n%%H |Qa$zHl3dzO$P;leh!))Q=@8- tVHm>޺kK֥-[$%V}gYa52~eif: Ƕpx(WIU_=uPs:w K] 4@;w~u6V(Y:L̊a J@ȖIp/Ԗ4kӡ~'}bI3}~Fg@j+: ML e43BjnjٰX\tu/Pf vfҺIP#؎~ʊrb>%8Izo9j#!Y:2~(5VpщzNd;}҇ݯc U_Ѭ sT;rξ`YݔLOZx) +3|V͎5FbSep9mz唖K.@4, k7n>I+LЮ!PB!L7DM+ga.508PTYF$ïBzvpt*wm: 2yo͉C\.P!B홝-bKAzW(]~Vj#Wk5y20AߠVoeZ#D(PEmxʿ=& UO#D{*rBaDm8ۧE`fM-}w?!̑8wI$ 9jPܟnsکk:DLino|4wߋ*[:!a/F)6RWW.)Q8U+}4Lehą"]y68RUV̓pqk,@[|"⫶)*۸d~]ƆfAIlPeNj>y$bC2 { -V@s9(Vt-#/S_{=s_mpF3VqSR@?xMYɂpM7@|Q dWBÒl+lXL_`eEQbӬSkAA惸o!Ô)lUAޘ![nn3-/@KN'F\-jҫD}K^_ӿ`~y)d?}. }ϝ|5lq3r ]V8 BHdakݯmGX˓rUGc"0,4%%^ ƣY[{MP0QR9IӚv2Wuc$$JWTDJ9Yw2@7rᰩ}, V= 25RŬ@L1Ѿؾ/zZU Z7 R 靌LT֙cyT2_eQܸ ONRe޸ha&< O#w ٥-^j9@R_.c>ˢ q c'Qҭs f'il;[vec2^U*w*tEdDU93 A: 7\̸J};~騩2B|@3q}EaIŪΜ&–yʭb=W_pRJ'!4B0*JH ۹'$GM14{īW1AHPTQJ |_9)Z|5NTW}Ո zH ꊓyPbpxTKI? "u4K$V[#}D3zIYU&Ub埃H-sX^4V2BH.Lf Q[ga/8 Pg*˜  sK4 0h X Ji|NiSi xBdv ztQZ+- sP^($ G*9<)@v>D}#O\ UIvotqIa2eQ,0{,(qYi~m3\w2."ா;L$Rc(#@3&A?jEF;qQ%;[$cjşÝ[\VruG.x>&ܜ }.l&^9-[afzK*}W_|vλ^nfQ߻J,9bFy/!@Dw+y[2G,=uq5>t"8O!'G9 \u[0-HͷX;\amw,ӟ]pzJwbʮ Ihe?p9/Mo]|2t Γ'IE3Z ٚՕg&&$9$/6#=}Pk]}L-.qe#-NhIK(3p^0SkxϠ%ig"hd|:ݝ?{$9Ѿ%ƭ/ J|=sE?8x +oTwk[&L?%g5]8:K: F/=PsZ@ Ulw(P.F}w2L]Fp2[F^SQ^"HbDCPђ[t5fTVI 0(M'tgb Ff>h*塬-A{7~\ΐq-rh~I c^|z/ J`nc'})q9I1^Y&| Z,x kdn߄?*BZF;:-0cۇ) EşO|YekD)m*ZSO֩,O@kqK|V5l(~f&D⧐j_)BO_Wf[*97j噭36vcOfSN|ѨwH`\ \?(NFMgvMFŹY JNj1^#Ś&]P|wњ6ɔFsQf~N ~J#CRۢhzR8 $Up:cehH%)ds2nFE`_j7 q:B_NnUgjsy0AG8?DǛ\_2QN,)D8ִmj](w{;0NDVĿ;'=ȕ'\lpd2}P-*ӫr\Łb4\ ;RbbPX>i̶2q塤7ռdSW ]K\h8̛ǫ!,x)Hdh*/)>y9yaKh4e#8v05DbV1ZjKg̓Y>v,ÿ`'т^=GH @i%7B6wcy)p nX)}PR +w4j'\i_te}]l@f&p^AJ)IYp4<$6|KrKVHOA?l+wtSo0I6f:`Qn:8`a-8;BUWMTm줦sywdan7G$GcʧcfQ} \h^St4WZtbHs"{'Q'PN kODF)Hg_6ZVQ2"ӓtwM"GWzK{u3< xuN뎩tv3Eg}6c fStdJ Y? uT 8 %vRkH@eDezˉxTKyd£_'Ү;8LC9 htFC>&[%v@{T1.?6]4*VP^xXFקleOOO㭾 L\Ʌ;^'Uf!CLa^\ 8Z rIE'6.Qq_z1Gڞ )eFjSZ9?Kѓ8lLh0i뙨h7"ycUheuaRf;ki^͢|FtemgT϶:JV@ WQhH^c/k,=5yt9;1U2Sоs$P;WRԭ~֫שf\xeŞE 9A1T I WM )ALˌ6e~V!. wx~|ypľE-[kߙq;!i5oI!O``GePl8q%dzɑآ|W|ss%j̰)7߂'2C?Av)t,9r(?ic)0bƒkt3aSdgXvXPÅxz{{Y{)Mx2_3g zE=55/NTms.Sg9 Ոr=\:6HVi!PUܧ^Ũ^3#QC}wb_ǻQK#a0t官ZMԖh^R .kZ怒1a(,<燇H'*t_EHP{,~!NFpa+!qTpdDrʼnD k mQhhe.3m:I;XVe{`Ic0q<뢨rS3ssQtTUc~InYUdkn2Jͣ6k DP 8u˟U=~ִF5Ǧd~9z-5ɬڸyEh~)FJj0 &CY!E&w:ĺc-&6#`4{h$\[4"/[(QU%T7fAr"#l^D/ 8ףF "USTCBARױ,|* 97U X PmV$IZpF^F/.uAzUTovbFb(պ ce0ˇ5UGvKv=ѓ&8T4 UGȐ8ƲCTk}e_~ 9h+P]P쵿P6}kRQ.919,XG98 n@w69d Tu%Qή+m+1ՃuL5{1@H?G~#s/&4.Qq'r -4ymܔ?kLWV>&jÁ,QN a3R;&UUZ-jYiWC0K462aLfy`cioQ5', 3*.9BKOd\}/U#ʡdN24_&//ke>X-J`]EQ\b (9WҢXz0[La1Cq=0%|?oEׇD,8j!Ic}+nEFƗW֔ypf"S%_v|KL9 $V,7WUCq͢Srq.7w-[9Io8@`Pg1tڎόt_|aPMˋ8q@^'D4+icuQh䎅Ka`kV #ޫRVjuT)0@R ?o 1u5ZOGa%Q$Y MHx'(zŏS{3}gY{2F*pܸp\s^eگ=z}G G(:Q3kV'ȄAD: YZ