kernel-module-8812au-6.6-desktop-6.6.148-1> )lp ccf68de95aca333d05e8e23aa58110c6ccd8fbc3e30818eaa36e622bdf26bc073a182193242ddcf34abfa5a1d3be529bd5a74874&{tI BVQ>Bq?ad#+ - Y     9 <@EJpt~(89:G@HDIHXLY\\]^bcdefltuvw`xdyhx Ckernel-module-8812au-6.6-desktop6.6.1481Binary module 8812au for kernel-6.6-desktopBinary module 8812au for kernel-6.6-desktopjlocalhostVPROSAROSAGPLv2System/Kernel and hardwarehttps://www.kernel.orglinuxx86_64VPj#5f135a79f918f910b742b722931e700b223bd68099b3c05455fe5b16186fffc91rootrootkernel-6.6-desktop-6.6.148-1.src.rpminstallonlypkg(kernel-module)kernel-module-8812au-6.6-desktopkernel-module-8812au-6.6-desktop(x86-64)kmod(8812au)    kernel-6.6-desktop(x86-64)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)6.6.148-13.0.4-14.6.0-14.0-15.2-14.17.0jtw@jgH@jL@jL@jj9j Pj Pj Pj Pi@iD@iii@h/Mikhail Novosyolov BiteDasher BiteDasher 6.6.144-1BiteDasher BiteDasher 6.6.126-8BiteDasher 6.6.126-7Mikhail Novosyolov 6.6.126-6Mikhail Novosyolov 6.6.126-5Mikhail Novosyolov Mikhail Novosyolov Mikhail Novosyolov 6.6.126-3Mikhail Novosyolov 6.6.126-2Mikhail Novosyolov 6.6.126-1Mikhail Novosyolov Mikhail Novosyolov 6.6.106-3Mikhail Novosyolov - [bot] upd: 6.6.145 -> 6.6.148 - Changelog: - accel/ivpu: Reject firmware log with size smaller than header - afs: Annotate struct afs_addr_list with __counted_by - afs: Turn the afs_addr_list address array into an array of structs - ALSA: hda: conexant: Remove mic bias threshold override - ALSA: hda: Fix cached processing coefficient verbs - ALSA: seq: close a re-opened queue timer in the destructor - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: cs35l56: Don't use devres to unregister component - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: tas2781: bound firmware description string parsing - ata: libata-core: Reject an invalid concurrent positioning ranges count - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: use platform_get_irq() - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - binfmt_elf_fdpic: only honour the first PT_INTERP - binfmt_misc: set have_execfd only once the interpreter is opened - Bluetooth: btusb: validate Realtek vendor event length - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: hci_sync: Protect UUID list traversal - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: qca: fix NVM tag length underflow in TLV parser - Bluetooth: RFCOMM: Fix session UAF in set_termios - bonding: fix devconf_all NULL dereference when IPv6 is disabled - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bpf: drop bpf_lsm_getselfattr from hook list - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: free mapping node on duplicate reloc root insert - btrfs: reject free space cache with more entries than pages - can: bcm: add locking when updating filter and timer values - can: bcm: add missing device refcount for CAN filter removal - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: isotp: serialize TX state transitions under so->rx_lock - can: j1939: fix lockless local-destination check - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - comedi: comedi_parport: deal with premature interrupt - coredump: fix pidfs file refcount leak in umh_coredump_setup - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - dm-verity: avoid double increment of &use_bh_wq_enabled - dm-verity: make error counter atomic - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amd/display: set new_stream to NULL after release - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amd/pm: make pp_features read-only when scpm is enabled - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gt: use correct selftest config symbol - drm/i915: Return NULL on error in active_instance - drm/i915/selftests: Fix GT PM sort comparators - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/nouveau: fix reversed error cleanup order in ucopy functions - drm/radeon: fix r100_copy_blit for large BOs - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - drm/vc4: Prevent shader BO mappings from becoming writable - drm/virtio: bound EDID block reads to the response buffer - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - drm/vmwgfx: Validate vmw_surface_metadata::array_size - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - exfat: validate cluster allocation bits of the allocation bitmap - fbcon: Rename struct fbcon_ops to struct fbcon_par - fbcon: Use correct type for vc_resize() return value - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - firewire: net: Fix fragmented datagram reassembly - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - firmware_loader: introduce __free() cleanup hanler - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list - ftrace: Add global mutex to serialize trace_parser access - geneve: require CAP_NET_ADMIN in the device netns for changelink - gpio: mt7621: avoid corruption of shared interrupt trigger state - gpio: tegra: do not call pinctrl for GPIO direction - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - hinic: remove unused ethtool RSS user configuration buffers - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: occ: validate poll response sensor blocks - i2c: davinci: Unregister cpufreq notifier on probe failure - i2c: i801: fix hardware state machine corruption in error path - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - i40e: remove read access to debugfs files - IB/mad: Drop unmatched RMPP responses before reassembly - ice: fix LAG recipe to profile association - ice: use READ_ONCE() to access cached PHC time - ila: reload IPv6 header after pskb_may_pull in checksum adjust - Input: ims-pcu - fix firmware leak in async update - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - Input: ims-pcu - fix logic error in packet reset - intel_th: fix MSC output device reference leak - iomap: correct the range of a partial dirty clear - iommu/amd: Bound the early ACPI HID map - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/vt-d: Disallow SVA if page walk is not coherent - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - ipmi: fix refcount leak in i_ipmi_request() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - ipv6: ndisc: fix NULL deref in accept_untracked_na() - ksmbd: bound DACL dedup walk to copied ACEs - ksmbd: defer destroy_previous_session() until after NTLM authentication - ksmbd: pin conn during async oplock break notification - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate ACE size against SID sub-authorities - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - KVM: Introduce vcpu->wants_to_run - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - KVM: x86/mmu: Fix use-after-free on vendor module reload - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN - libceph: bound get_version reply decode to front len - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: guard missing CRUSH type name lookup - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: Reject monmaps advertising zero monitors - libceph: reject zero bucket types in crush_decode - libceph: remove debugfs files before client teardown - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - LoongArch: Fix oops during single-step debugging - lsm: infrastructure management of the sock security - mac802154: hold an interface reference across the scan worker - mac802154: llsec: reject frames shorter than the authentication tag - mctp: serial: handle zero-length frames to prevent rx buffer overflow - media: airspy: Return queued buffers on start_streaming() failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: cedrus: clean up media device on probe failure - media: cedrus: Fix missing cleanup in error path - media: cedrus: skip invalid H.264 reference list entries - media: cx231xx: fix devres lifetime - media: cx23885: add ioremap return check and cleanup - media: marvell-cam: fix missing pci_disable_device() on remove - media: meson: vdec: Fix memory leak in error path of vdec_open - media: msi2500: Return queued buffers on start_streaming() failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: pci: dm1105: Free allocated workqueue - media: pwc: Drain fill_buf on start_streaming() failure - media: pwc: Return queued buffers on start_streaming() failure - media: radio-si476x: Unregister v4l2_device on probe failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: stm32: dcmi: unregister notifier on probe failure - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: ti: vpe: unwind v4l2 device registration on probe error - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: v4l2-ctrls: validate HEVC active reference counts - media: vb2: use ssize_t for vb2_read/vb2_write - media: vidtv: fix reference leak on failed device registration - media: vimc: fix reference leak on failed device registration - media: vivid: add vivid_update_reduced_fps() - media: vivid: check for vb2_is_busy() when toggling caps - media: vpif_capture: fix OF node reference imbalance - mei: bus: access mei_device under device_lock on cleanup - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - mm: refactor mm_access() to not return NULL - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - mptcp: decrement subflows counter on failed passive join - mptcp: only set DATA_FIN when a mapping is present - mtd: fix double free and WARN_ON in add_mtd_device() error paths - mtd: mtdswap: remove debugfs stats file on teardown - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: rawnand: Add a helper for calculating a page index - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Pause continuous reads at block boundaries - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - net: bridge: vlan: fix vlan range dumps starting with pvid - net: dpaa: fix mode setting - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - net: hip04: fix RX buffer leak on build_skb failure - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: ipa: fix SMEM state handle leaks in SMP2P init - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/iucv: fix use-after-free of a severed iucv_path - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - net: macb: drop in-flight Tx SKBs on close - net: mana: Validate the packet length reported by the NIC - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net/packet: avoid fanout hook re-registration after unregister - net: pcs: xpcs: fix SGMII state reading - net: qrtr: ns: Raise node count limit to 512 - net: qrtr: restrict socket creation to the initial network namespace - net/sched: act_tunnel_key: Defer dst_release to RCU callback - net: slip: serialize receive against buffer reallocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - net: stmmac: reset residual action in L3L4 filters on delete - net/x25: fix use-after-free in x25_kill_by_neigh() - nexthop: initialize extack in nh_res_bucket_migrate() - nfp: Check resource mutex allocation - NFS: Charge unstable writes by request size, not folio size - NFSD: pass nfsd_file to nfsd_iter_read() - nfs: remove dead code for the old swap over NFS implementation - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: fix SQB pointer leak on init failure - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-vf: set TC flower flag on MCAM entry allocation - openvswitch: fix GSO userspace truncation underflow - ovl: use linked upper dentry in copy-up tmpfile - pds_core: check for workqueue allocation failure - pds_core: fix auxiliary device add/del races - pds_core: order completion reads after the ownership check - pds_core: reject component parameter in legacy firmware update - pds_core: yield the CPU while waiting for the adminq to drain - phonet: pep: fix use-after-free in pep_get_sb() - pinctrl: remove pinctrl_gpio_direction_output() - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - platform/x86/amd/pmc: Avoid logging "(null)" for DMI values - platform/x86/amd/pmc: Don't log during intermediate wakeups - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - powerpc/time: Prepare to stop elapsing in dynticks-idle - powerpc/vtime: Initialize starttime at boot for native accounting - ppp: annotate data races in ppp_generic - ppp: convert to percpu netstats - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - ppp: enable TX scatter-gather - pppoe: reload header pointer after dev_hard_header() - ppp: use IFF_NO_QUEUE in virtual interfaces - proc: Fix broken error paths for namespace links - rbd: Reset positive result codes to zero in object map update path - RDMA/cma: Fix hardware address comparison length in netevent callback - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/irdma: Prevent overflows in memory contiguity checks - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/siw: publish QP after initialization - RDMA/umem: Add helpers for umem dmabuf revoke lock - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add pinned revocable dmabuf import interface - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/umem: Introduce an option to revoke DMABUF umem - RDMA/umem: Move umem dmabuf revoke logic into helper function - rds: drop incoming messages that cross network namespace boundaries - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - RISC-V: KVM: Serialize virtual interrupt pending state updates - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Fix socket notification race - rxrpc: Pull out certain app callback funcs into an ops table - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Use irq-disabling spinlocks between app and I/O thread - sched/vtime: Get rid of generic vtime_task_switch() implementation - sctp: auth: verify auth requirement when auth_chunk is NULL - sctp: don't free the ASCONF's own transport in DEL-IP processing - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - sctp: fix auth_hmacs array size in struct sctp_cookie - sctp: validate stream count in sctp_process_strreset_inreq() - selftest: af_unix: Add Kconfig file. - selftests: af_unix: add USER_NS config - selftests/alsa: Fix memory leak in find_controls error path - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - selftests: openvswitch: add config file - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - seqlock: Allow KASAN to fail optimizing - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: sc16is7xx: implement gpio get_direction() callback - smb/client: handle overlapping allocated ranges in fallocate - smb: client: validate DFS referral PathConsumed - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - tipc: fix infinite loop in __tipc_nl_compat_dumpit - tipc: fix u16 MTU truncation in media and bearer MTU validation - tipc: restrict socket queue dumps in enqueue tracepoints - tls: device: push pending open record on splice EOF - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - udmabuf: Do not create malformed scatterlists - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - USB: serial: ftdi_sio: add support for E+H FXA291 - USB: serial: io_edgeport: cap received transmit credits - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: option: add TDTECH MT5710-CN - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - VDUSE: avoid leaking information to userspace - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - VFS/audit: introduce kern_path_parent() for audit - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - vxlan: mdb: Fix source list corruption on a failed replace - vxlan: require CAP_NET_ADMIN in the device netns for changelink - wan: wanxl: Only reset hardware after BAR mapping - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath6kl: fix OOB access from firmware ADDBA window size - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: cfg80211: cancel sched scan results work on unregister - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: mac80211: recalculate TIM when a station enters power save - wifi: mac80211: tear down new links on vif update error path - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7915: guard HE capability lookups - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mwifiex: bound uAP association event IEs to the event buffer - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: nl80211: validate nested MBSSID IE blobs - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: wilc1000: validate assoc response length before subtracting header - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - x86/boot/compressed: Disable jump tables - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xprtrdma: Clear receive-side ownership pointers on release - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- [bot] upd: 6.6.144 -> 6.6.145 - Changelog: - 6lowpan: fix NHC entry use-after-free on error path - 9p: skip nlink update in cacheless mode to fix WARN_ON - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: IPMI: Fix message kref handling on dead device - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: resource: Amend kernel-doc style - afs: Fix callback service message parsers to pass through -EAGAIN - afs: Fix error code in afs_extract_vl_addrs() - afs: Fix further netns teardown to cancel the preallocation charger - afs: Fix netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix unchecked-length string display in debug statement - afs: Fix vllist leak - afs: use kvfree() to free memory allocated by kvcalloc() - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - ALSA: aoa: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - ALSA: es1938: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: gus: check snd_ctl_new1() return value - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: seq: Clear variable event pointer on read - ALSA: seq: Fix partial userptr event expansion - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: seq: midi: Serialize output teardown with event_input - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: virtio: Add missing 384 kHz PCM rate mapping - ALSA: ymfpci: check snd_ctl_new1() return value - amt: fix size calculation in amt_get_size() - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: advertise the tcp fast open fix is applied - apparmor: check label build before no_new_privs test - apparmor: fix label can not be immediately before a declaration - apparmor: fix potential UAF in aa_replace_profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: put secmark label after secid lookup - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - arm64: dts: qcom: sm8450: Fix ICE reg size - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - arm64: Fix early handling of FEAT_E2H0 not being implemented - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - arm64/mm: convert ptep_clear() to ptep_get_and_clear() - arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) - arm64/mm: convert set_pte_at() to set_ptes(..., 1) - arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() - arm64: Revamp HCR_EL2.E2H RES1 detection - arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 - arm64: sysreg: Correct sign definitions for EIESB and DoubleLock - arm64: tegra: Fix Tegra234 MGBE PTP clock - arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - ARM: imx31: Fix IIM mapping leak in revision check - ARM: imx3: Fix CCM node reference leak - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - ASoC: codecs: aw88261: fix incorrect masks for boost regs - ASoC: codecs: hdac_hdmi: Validate written enum value - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - ata: libata: Fix ata_exec_internal() - ata: pata_pxa: Fix DMA channel leak on probe error - ata: sata_gemini: unwind clocks on IDE pinctrl errors - audit: add audit_log_nf_skb helper function - audit: Fix data races of skb_queue_len() readers on audit_queue - audit: fix potential integer overflow in audit_log_n_hex() - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: dat: fix tie-break for candidate selection - batman-adv: ensure minimal ethernet header on TX - batman-adv: fix VLAN priority offset - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: gw: acquire ethernet header only after skb realloc - batman-adv: retrieve ethhdr after potential skb realloc on RX - batman-adv: tt: avoid request storms during pending request - batman-adv: tt: prevent TVLV OOB check overflow - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - bitops: make BYTES_TO_BITS() treewide-available - bitops: use common function parameter names - block: Avoid mounting the bdev pseudo-filesystem in userspace - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - Bluetooth: btmtk: Fix btmtk.c undefined reference build error - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices. - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown - Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c - Bluetooth: btmtk: remove #ifdef around declarations - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: btrtl: validate firmware patch bounds - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - Bluetooth: hci_sync: annotate data-races around hdev->req_status - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci: validate codec capability element length - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: separate CIS_LINK and BIS_LINK link types - Bluetooth: vhci: validate devcoredump state before side effects - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - bonding: 3ad: fix mux port state on oper down - bonding: add ESP offload features when slaves support - bonding: Correctly support GSO ESP offload - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - bonding: fix type confusion in bond_setup_by_slave() - bonding: fix xfrm offload feature setup on active-backup mode - bonding: prevent potential infinite loop in bond_header_parse() - bonding: use common function to compute the features - bpf: Add missing access_ok call to copy_user_syms - bpf: Allow LPM map access from sleepable BPF programs - bpf, arm64: Reject out-of-range B.cond targets - bpf: Check tail zero of bpf_prog_info - bpf: Consistently use bpf_rcu_lock_held() everywhere - bpf: Disable xfrm_decode_session hook attachment - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - bpf: Fix effective prog array index with BPF_F_PREORDER - bpf: Fix stack slot index in nospec checks - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - bpf,fork: wipe ->bpf_storage before bailouts that access it - bpf, lsm: Add disabled BPF LSM hook list - bpf: Prefer dirty packs for eBPF allocations - bpf: Prefer packs that won't trigger an IBPB flush on allocation - bpf: Reject fragmented frames in devmap - bpf: Restore sysctl new-value from 1 to 0 - bpf: Restrict JIT predictor flush to cBPF - bpf: Run generic devmap egress prog on private skb - bpf: Skip redundant IBPB in pack allocator - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Support for hardening against JIT spraying - bpf: Tighten cgroup storage cookie checks for prog arrays - bpftool: Use libbpf error code for flow dissector query - bpf: Update transport_header when encapsulating UDP tunnel in lwt - bpf: zero-initialize the fib lookup flow struct - bridge: cfm: reject invalid CCM interval at configuration time - bridge: stp: Fix a potential use-after-free when deleting a bridge - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - btrfs: do not trim a device which is not writeable - btrfs: fix false IO failure after falling back to buffered write - btrfs: fix incorrect buffered IO fallback for append direct writes - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - btrfs: zoned: don't account data relocation space-info in statfs free space - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - bus: sunxi-rsb: Always check register address validity - can: bcm: add missing rcu list annotations and operations - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: esd_usb: kill anchored URBs before freeing netdevs - can: isotp: use unconditional synchronize_rcu() in isotp_release() - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - char: tlclk: fix use-after-free in tlclk_cleanup() - cifs: invalidate cfid on unlink/rename/rmdir - cifs: remove all cifs files before kill super - cifs: validate DFS referral string offsets - clk: at91: keep securam node alive while mapping it - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - clk: scmi: Fix clock rate rounding - clk: scpi: Unregister child clock providers on remove - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - configfs: fix lockless traversals of ->s_children - configfs_lookup(): don't leave ->s_dentry dangling on failure - coresight: cti: Fix DT filter signals silently ignored - coresight: etb10: restore atomic_t for shared reading state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Documentation: fix conservative governor freq_step description - cpufreq: Documentation: fix sampling_down_factor range - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - crypto: af_alg - Remove zero-copy support from skcipher and aead - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: ccp - Treat zero-length cert chain as query for blob lengths - crypto: crypto4xx - Remove ahash-related code - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: drbg - Fix the fips_enabled priority boost - crypto: ecc - Fix carry overflow in vli multiplication - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: hisilicon/qm - disable error report before flr - crypto: hisi-trng - Remove crypto_rng interface - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - crypto: pcrypt - restore callback for non-parallel fallback - crypto: qat - fix restarting state leak on allocation failure - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - crypto: qat - validate RSA CRT component lengths - crypto: rng - Free default RNG on module exit - crypto: sun4i-ss - Remove insecure and unused rng_alg - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - stop using crypto_ahash::init - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - cxgb4: Fix decode strings dump for T6 adapters - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - cxl/test: Fix integer overflow in mock LSA bounds checks - cxl/test: Zero out LSA backing memory to avoid leaking to user - dax/kmem: account for partial discontiguous resource upon removal - debugobjects: Plug race against a concurrent OOM disable - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - devlink: Fix parent ref leak in devl_rate_node_create() - dlm: fix add msg handle in send_queue ordered - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: Fix possible use after free - dmaengine: imx-sdma: Refine spba bus searching in probe - dmaengine: qcom: gpi: set DMA_PRIVATE capability - dmaengine: tegra: Fix burst size calculation - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm_early_create: fix freeing used table on dm_resume failure - dm era: fix NULL pointer dereference in metadata_open() - dm era: fix out-of-bounds memory access for non-zero start sector - dm-integrity: don't increment hash_offset twice - dm-ioctl: fix a possible overflow in list_version_get_info - dm-ioctl: report an error if a device has no table - dm-log: fix a bitset_size overflow on 32bit machines - dm-stats: fix dm_jiffies_to_msec64 - dm-stats: fix merge accounting - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - dm-verity: fix a possible NULL pointer dereference - dm-verity: increase sprintf buffer size - Documentation: proc: fix section numbering in table of contents - dpaa2-switch: fix VLAN upper check not rejecting bridge join - drbd: reject data replies with an out-of-range payload size - driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() - driver core: Guard deferred probe timeout extension with delayed_work_pending() - driver core: Use mod_delayed_work to prevent lost deferred probe work - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amd/display: Add missing kdoc for ALLM parameters - drm/amd: Fix set but not used warnings - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/amdgpu: initialize irq.lock spinlock earlier - drm/amdgpu: set sub_block_index for mca ras sub-blocks - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - drm/edid: fix OOB read in drm_parse_tiled_block() - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/msm/dp: fix HPD state status bit shift value - drm/msm/dp: Fix the ISR_* enum values - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - drm/tegra: Fix iommu_map_sgtable() return value check - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - drm/tidss: Drop extra drm_mode_config_reset() call - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - dt-bindings: power: imx93: Add MIPI PHY power domain - EDAC/i10nm: Don't fail probing if ADXL is missing - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - espintcp: use sk_msg_free_partial to fix partial send - evm: terminate and bound the evm_xattrs read buffer - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: bound uniname advance in exfat_find_dir_entry() - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: move free cluster out of exfat_init_ext_entry() - exfat: preserve benign secondary entries during rename and move - exfat: remove unnecessary read entry in __exfat_rename() - exfat: rename argument name for exfat_move_file and exfat_rename_file - ext2: fix ignored return value of generic_write_sync() - ext4: fix kernel BUG in ext4_write_inline_data_end - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - ext4: get rid of ppath in get_ext_path() - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: validate orphan inode entry count - fbcon: fix NULL pointer dereference for a console without vc_data - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: sm501fb: Fix buffer errors in OF binding code - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - firmware: arm_scmi: Read sensor config as 32-bit value - firmware_loader: fix device reference leak in firmware_upload_register() - firmware_loader: Fix recursive lock in device_cache_fw_images() - flow_dissector: check device type before reading ETH_ADDRS - fpga: dfl: add bounds check in dfh_get_param_size() - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - fs: efs: remove unneeded debug prints - fsl/fman: Free init resources on KeyGen failure in fman_init() - fs/ntfs3: add bounds check to run_get_highest_vcn() - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - fs/ntfs3: fsync files by syncing parent inodes - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - fuse: fix device node leak in cuse_process_init_reply() - fuse: re-lock request before returning from fuse_ref_folio() - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - gpio-f7188x: Add support for NCT6126D version B - gpio: htc-egpio: use managed gpiochip registration - gpio: mlxbf3: fail probe if gpiochip registration fails - gpio: mvebu: fail probe if gpiochip registration fails - gpio: sch: use raw_spinlock_t in the irq startup path - gpios: palmas: add .get_direction() op - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - gpu: host1x: Allow entries in BO caches to be freed - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - gpu: host1x: Fix iommu_map_sgtable() return value check - gue: validate REMCSUM private option length - handshake: Require admin permission for DONE command - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: add haptics page defines - HID: appleir: fix UAF on pending key_up_timer in remove() - HID: core: Fix OOB read in hid_get_report for numbered reports - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - HID: playstation: validate num_touch_reports in DualShock 4 reports - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: wacom: stop hardware after post-start probe failures - HID: wiimote: Fix table layout and whitespace errors - hwmon: adm1275: Prevent reading uninitialized stack - hwmon: (asus_atk0110) Check package count before accessing element - hwmon: (it87) Clamp negative values to zero in set_fan() - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - hwmon: (occ) unregister sysfs devices outside occ lock - hwmon: (pmbus) Fix passing events to regulator core - hwmon: (w83627hf) remove VID sysfs files on error and remove - hwmon: (w83793) remove vrm sysfs file on probe failure - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - hwrng: virtio: clamp device-reported used.len at copy_data() - hwspinlock: qcom: avoid uninitialized struct members - i2c: core: fix adapter debugfs creation - i2c: core: fix adapter deregistration race - i2c: core: fix adapter registration race - i2c: core: fix hang on adapter registration failure - i2c: core: fix irq domain leak on adapter registration failure - i2c: core: fix NULL-deref on adapter registration failure - i2c: mediatek: fix WRRD for SoCs without auto_restart option - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mpc: Fix timeout calculations - i2c: stm32f7: truncate clock period instead of rounding it - i3c: master: Prevent reuse of dynamic address on device add failure - i40e: Fix i40e_debug() to use struct i40e_hw argument - ia64: Make acpi_cpufreq_cpu_exit return void - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - IB/mlx4: Fix refcount leak in add_port() error path - IB/mlx5: Don't take the rereg_mr fallback without a new translation - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - IB/mlx5: Properly support implicit ODP rereg_mr - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - ice: fix ice_init_link() error return preventing probe - ieee802154: admin-gate legacy LLSEC dump operations - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - iio: accel: bmc150: clamp the device-reported FIFO frame count - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: event: Fix event FIFO reset race - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: light: al3010: fix incorrect scale for the highest gain range - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: opt3001: fix missing state reset on timeout - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: veml6030: fix channel type when pushing events - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: pressure: mpl115: fix runtime PM leak on read error - iio: tcs3472: power down chip on probe failure - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: goodix - clamp the device-reported contact count - Input: iforce - bound the device-reported force-feedback effect index - Input: ims-pcu - add response length checks - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix use-after-free and double-free in disconnect - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - validate control endpoint type - Input: maplecontrol - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: maplemouse - fix NULL pointer dereference in open() - Input: maplemouse - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: mms114 - reject an oversized device packet size - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - Input: touchwin - reset the packet index on every complete packet - iommu/amd: Fix a stale comment about which legacy mode is user visible - ionic: Fix check in ionic_get_link_ext_stats - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - ipv4: fib: Don't ignore error route in local/main tables. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - ipv4: igmp: remove multicast group from hash table on device destruction - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - ipv6: fix error handling in disable_ipv6 sysctl - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix more places with wrong ipv6 transport offsets - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: pass parsed transport offset to state handlers - ipvs: reload ip header after head reallocation - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - ipvs: use parsed transport offset in TCP state lookup - irqchip/crossbar: Fix parent domain resource leak - irqchip/crossbar: Use correct index in crossbar_domain_free() - irqchip/gic-v3-its: Fix OF node reference leak - irqchip/ts4800: Fix missing chained handler cleanup on remove - isofs: bound Rock Ridge symlink components to the SL record - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - kcm: use WRITE_ONCE() when changing lower socket callbacks - kconfig: fix potential NULL pointer dereference in conf_askvalue - KEYS: Use acquire when reading state in keyring search - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - ksmbd: fix integer overflow in set_file_allocation_info() - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: fix use-after-free in same_client_has_lease() - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - ksmbd: reject undersized DACLs before parsing ACEs - ksmbd: require source read access for duplicate extents - ksmbd: run set info with opener credentials - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: track the connection owning a byte-range lock - ksmbd: use opener credentials for delete-on-close - ksmbd: use opener credentials for FSCTL mutations - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - KVM: arm64: Initialize HCR_EL2.E2H early - KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - leds: uleds: Fix potential buffer overread - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - libbpf: Report error when a negative kprobe offset is specified - lib/test_meminit: use && for bools - llc: fix SAP refcount leak in llc_ui_autobind() - llc: fix SAP refcount leak when creating incoming sockets - lockd: Plug nlm_file leak when nlm_do_fopen() fails - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - LoongArch: Add PIO for early access before ACPI PCI root register - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - LoongArch: Report dying CPU to RCU in stop_this_cpu() - mac802154: remove interfaces with RCU list deletion - macsec: don't read an unset MAC header in macsec_encrypt() - macsec: fix promiscuity refcount leak in macsec_dev_open() - mailbox: mtk-adsp: fix UAF during device teardown - md/raid10: reset read_slot when reusing r10bio for discard - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - media: cedrus: Fix failure to clean up hardware on probe failure - media: mtk-jpeg: cancel workqueue on release for supported platforms only - media: nxp: imx8-isi: Convert to platform remove callback returning void - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: qcom: venus: drop extra padding in NV12 raw size calculation - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: relax encoder frame/blur step size on v6 - media: rockchip: rga: fix too small buffer size - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - media: uvcvideo: Avoid partial metadata buffers - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Fix sequence number when no EOF - media: v4l2-common: Add YUV24 format info - memstick: ms_block: reject a card that reports too many blocks - mfd: cros_ec: Delay dev_set_drvdata() until probe success - mfd: cs42l43: Sanity check firmware size - mfd: sm501: Fix reference leak on failed device registration - mfd: tps6586x: Fix OF node refcount - minix: avoid overflow in bitmap block count calculation - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: DEC: Ensure RTC platform device deregistration upon failure - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix gio device memory leak - MIPS: ip22-gio: fix kfree() of static object - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - MIPS: smp: report dying CPU to RCU in stop_this_cpu() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mmc: vub300: defer reset until cmd_mutex is unlocked - mm/damon/core: make charge_addr_from aware of end-address exclusivity - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm: do file ownership checks with the proper mount idmap - mm/fake-numa: fix under-allocation detection in uniform split - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - mm: shrinker: fix NULL pointer dereference in debugfs - mm: shrinker: remove redundant shrinker_rwsem in debugfs operations - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - mm/vmscan: flush deferred TLB before freeing large folios - module: decompress: check return value of module_extend_max_pages() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - mtd: rawnand: fix condition in 'nand_select_target()' - mtd: rawnand: fsl_ifc: return errors for failed page reads - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: pl353: fix probe resource allocation - mtd: slram: remove failed entries from the device list - mtd: spi-nor: Drop duplicate Kconfig dependency - mtd: spi-nor: swp: Improve locking user experience - net/9p: fix infinite loop in p9_client_rpc on fatal signal - net/9p: fix race condition on rdma->state in trans_rdma.c - net: add a common function to compute features for upper devices - net: af_key: initialize alg_key_len for IPComp states - net: atm: reject out-of-range traffic classes in QoS validation - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net, bpf: check master for NULL in xdp_master_redirect() - net: Drop the lock in skb_may_tx_timestamp() - net: dsa: sja1105: round up PTP perout pin duration - net: ena: clean up XDP TX queues when regular TX setup fails - net: enetc: check the number of BDs needed for xdp_frame - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: conntrack: revert ct extension genid infrastructure - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump - netfilter: ebtables: module names must be null-terminated - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: Use vmalloc_array() to improve code - netfilter: ebtables: zero chainstack array - netfilter: ecache: fix inverted time_after() check - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: Fix data race between add and dump in all hash types - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: fix race between dump and ip_set_list resize - netfilter: nf_conncount: callers must hold rcu read lock - netfilter: nf_conncount: fix zone comparison in tuple dedup - netfilter: nf_conncount: prevent connlimit drops for early confirmed ct - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: xt_connmark: reject invalid shift parameters - netfilter: xt_nat: reject unsupported target families - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - net: gianfar: dispose irq mappings on probe failure and device removal - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: lan743x: Initialize eth_syslock spinlock before use - net: liquidio: fix BAR resource leak on PF number failure - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net: marvell: prestera: initialize err in prestera_port_sfp_bind - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5: Check max_macs devlink param value against max capability - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - net/mlx5: Fix L3 tunnel entropy refcount leak - net: mvneta: re-enable percpu interrupt on resume - net: openvswitch: reject oversized nested action attrs - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - net: psample: fix info leak in PSAMPLE_ATTR_DATA - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net/sched: cake: reject overhead values that underflow length - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - net/sched: cls_flow: Dont expose folded kernel pointers - net/sched: hhf: clear heavy-hitter state on reset - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_drr: annotate data-races around cl->deficit - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - net/sched: sch_hfsc: Don't make class passive twice - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - net: sit: require CAP_NET_ADMIN in the device netns for changelink - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net: sparx5: unregister blocking notifier on init failure - net: sungem: fix probe error cleanup - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - net: thunderbolt: Fix frags[] overflow by bounding frame_count - net/tls: Consume empty data records in tls_sw_read_sock() - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - net: wwan: iosm: bound device offsets in the MUX downlink decoder - net: wwan: t7xx: check skb_clone in control TX - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: Don't reset the write verifier on a commit EAGAIN - nfsd: move name lookup out of nfsd4_list_rec_dir() - nfsd: release layout stid on setlease failure - nfsd: reset write verifier on deferred writeback errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - NFSv4/flexfiles: reject zero filehandle version count - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - NFSv4/pnfs: defer return_range callbacks until after inode unlock - nilfs2: fix backing_dev_info reference leak - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - NTB: epf: Make db_valid_mask cover only real doorbell bits - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - nvdimm/btt: Free arenas on btt_init() error paths - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Handle preemption in BTT lane acquisition - nvme-multipath: fix flex array size in struct nvme_ns_head - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - nvmet-auth: validate reply message payload bounds against transfer length - nvmet-rdma: handle inline data with a nonzero offset - nvmet: remove superfluous initialization - nvmet: return DHCHAP status codes from nvmet_setup_auth() - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - nvmet-tcp: Fix potential UAF when ddgst mismatch - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: avoid moving extents to occupied clusters - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: don't BUG_ON an invalid journal dinode - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2: kill osb->system_file_mutex lock - ocfs2: rebase copied fsdlm LVB pointers in locking_state - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: use kzalloc for quota recovery bitmap allocation - octeontx2-af: fix VF bringup affecting PF promiscuous state - octeontx2-af: mcs: Fix unsupported secy stats read - octeontx2-pf: check DMAC extraction support before filtering - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - of: cpu: add check in __of_find_n_match_cpu_property() - OPP: of: Fix potential memory leak in opp_parse_supplies() - orangefs: keep the readdir entry size 64-bit in fill_from_part() - partitions: aix: bound the pp_count scan to the ppe array - PCI: Add kerneldoc for pci_resize_resource() - PCI: altera: Do not dispose parent IRQ mapping - PCI: altera: Fix resource leaks on probe failure - PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining - PCI/ASPM: Don't reconfigure ASPM entering low-power state - PCI: Check ROM header and data structure addr before accessing - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - PCI: Fix restoring BARs on BAR resize rollback path - PCI: Free saved list without holding pci_bus_sem - PCI: host-common: Request bus reassignment when not probe-only - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - PCI: Introduce named defines for PCI ROM - PCI: iproc: Restore .map_irq() for the platform bus driver - PCI: loongson: Do not ignore downstream devices on external bridges - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: Move Resizable BAR code to rebar.c - PCI: Prevent resource tree corruption when BAR resize fails - PCI: rcar-host: Remove unused LIST_HEAD(res) - PCI: Skip Resizable BAR restore on read error - perf/core: Detach event groups during remove_on_exec - perf: Fix dangling cgroup pointer in cpuctx backport - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - perf trace beauty fcntl: Fix build with older kernel headers - perf/x86/amd/brs: Fix kernel address leakage - perf/x86/amd/core: Always use the NMI latency mitigation - perf/x86/amd/lbr: Fix kernel address leakage - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - phy: phy-can-transceiver: Check driver match and driver data against NULL - pinctrl: cs42l43: Fix polarity on debounce - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: meson: restore non-sleeping GPIO access - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - platform/x86/amd/pmc: Add delay_suspend module parameter - platform/x86/amd/pmc: Check for intermediate wakeup in function - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - pmdomain: imx: Fix i.MX8MP power notifier - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - PM: sleep: Use complete() in device_pm_sleep_init() - pNFS/filelayout: fix cheking if a layout is striped - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - powerpc/pseries: fix memory leak on krealloc failure in papr_init - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - power: supply: charger-manager: fix refcount leak in is_full_charged() - power: supply: core: fix supplied_from allocations - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - proc: only bump parent nlink when registering directories - proc: protect ptrace_may_access() with exec_update_lock (FD links) - proc: protect ptrace_may_access() with exec_update_lock (part 1) - proc: rename proc_setattr to proc_nochmod_setattr - pwm: imx27: Fix variable truncation in .apply() - qede: fix off-by-one in BD ring consumption on build_skb failure - qede: fix out-of-bounds check for cqe->len_list[] - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - RDMA/hns: Fix warning in poll cq direct mode - RDMA/irdma: Fix OOB read during CQ MR registration - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Remove raw RSS QP restrack tracking - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/srpt: fix integer overflow in immediate data length check - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - remoteproc: qcom: Fix leak when custom dump_segments addition fails - reset: sunxi: fix memory region leak on ioremap failure - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - Revert "PCI/MSI: Unmap MSI-X region on error" - Revert "treewide: Fix probing of devices in DT overlays" - ring-buffer: Fix event length with forced 8-byte alignment - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - riscv: probes: save original sp in rethook trampoline - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - rpmsg: use generic driver_override infrastructure - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: mpfs: fix counter upload completion condition - rtc: msc313: fix NULL deref in shared IRQ handler at probe - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - s390/monwriter: Reject buffer reuse with different data length - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - s390/process: Fix kernel thread function pointer type - s390/zcrypt: Remove the empty file - sched/fair: Fix cpu_util runnable_avg arithmetic - sched/fair: Only update stats for allowed CPUs when looking for dst group - sched: restore timer_slack_ns when resetting RT policy on fork - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: sg: Report request-table problems when any status is set - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Fix hexadecimal CHAP_I handling - scsi: target: Remove tcm_loop target reset handling - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - sctp: fix SCTP_RESET_STREAMS stream list length limit - sctp: hold socket lock when dumping endpoints in sctp_diag - sctp: validate embedded address parameter length - sctp: validate STALE_COOKIE cause length before reading staleness - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - seg6: validate SRH length before reading fixed fields - selftests/bpf: Add simple strscpy() implementation - selftests/bpf: Fix bpf_iter/task_vma test - selftests/bpf: Initialize operation name before use - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: do not manually call headers_install - selftests/hid: ensure CKI can compile our new tests on old kernels - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - selftests/hid: force using our compiled libbpf headers - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - selftests/mm: fix exclusive_cow test fork() handling - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - selinux: check connect-related permissions on TCP Fast Open - selinux: fix incorrect execmem checks on overlayfs - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: fix scoped_seqlock_read kernel-doc - seqlock: Introduce scoped_seqlock_read() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - smb/client: always return a value for FS_IOC_GETFLAGS - smb: client: fix change notify replay double-free - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix double-free in SMB2_open() replay - smb/client: Fix error code in smb2_aead_req_alloc() - smb: client: Fix next buffer leak in receive_encrypted_standard() - smb: client: fix overflow in passthrough ioctl bounds check - smb: client: fix query directory replay double-free - smb: client: fix query_info() replay double-free - smb: client: harden POSIX SID length parsing - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - smb: client: mask server-provided mode to 07777 in modefromsid - smb/client: preserve errors from smb2_set_sparse() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: resolve SWN tcon from live registrations - smb: client: restrict implied bcc[0] exemption to responses without data area - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - smb: client: use unaligned reads in parse_posix_ctxt() - smb: move some duplicate definitions to common/cifsglob.h - smb/server: do not require delete access for non-replacing links - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - sparc: led: avoid trimming a newline from empty writes - spi: dw: fix wrong BAUDR setting after resume - spi: ep93xx: fix double-free of zeropage on DMA setup failure - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: hisi-kunpeng: Use dev_err_probe() for host registration failure - spi: meson-spifc: fix runtime PM leak on remove - spi: rpc-if: Use correct device for hardware reinitialization on resume - spi: sh-msiof: abort transfers when reset times out - spi: uniphier: Fix completion initialization order before devm_request_irq() - spi: xilinx: use FIFO occupancy register to determine buffer size - staging: media: atomisp: reduce load_primary_binaries() stack usage - staging: most: video: avoid double free on video register failure - staging: nvec: fix use-after-free in nvec_rx_completed() - staging: rtl8723bs: core: move constants to right side in comparison - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: vme_user: bound slave read/write to the kern_buf size - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: fix location monitor leak in tsi148 bridge - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sysfs: clamp show() return value in sysfs_kf_read() - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - team: fix header_ops type confusion with non-Ethernet ports - thermal: hwmon: Fix critical temperature attribute removal - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - time: Fix off-by-one in compat settimeofday() usec validation - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - tipc: fix UAF in tipc_l2_send_msg() - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: reject inverted service ranges from peer bindings - tipc: require net admin for TIPCv2 netlink mutators - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - tools/power/x86/intel-speed-select: Harden daemon pidfile open - tools/testing: add linux/args.h header and fix radix, VMA tests - tools/virtio: check mmap return value in vringh_test - tpm: fix event_size output in tpm1_binary_bios_measurements_show - tpm: Make the TPM character devices non-seekable - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - tracing: Bound synthetic-field strings with seq_buf - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - tracing/osnoise: Call synchronize_rcu() when unregistering - tracing: Prevent out-of-bounds read in glob matching - tracing/probes: Fix double addition of offset for @+FOFFSET - tracing: probes: fix typo in a log message - treewide: Switch/rename to timer_delete[_sync]() - udf: validate free block extents against the partition length - udf: validate sparing table length as an entry count, not a byte count - udf: validate VAT header length against the VAT inode size - udmabuf: fix DMA direction mismatch in release_udmabuf() - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - usb: dwc3: run gadget disconnect from sleepable suspend context - usb: free iso schedules on failed submit - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: gadget: f_fs: initialize reset_work at allocation time - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - usb: gadget: f_printer: take kref only for successful open - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - usb: host: max3421: Reject hub port requests for non-existent ports - USB: idmouse: fix use-after-free on disconnect race - USB: iowarrior: fix use-after-free on disconnect - usb: iowarrior: remove inherent race with minor number - usbip: tools: support SuperSpeedPlus devices - usbip: vudc: fix NULL deref in vep_dequeue() - USB: ldusb: fix use-after-free on disconnect race - USB: legousbtower: fix use-after-free on disconnect race - USB: misc: uss720: unregister parport on probe failure - usb: mtu3: unmap request DMA on queue failure - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: keyspan_pda: fix information leak - USB: serial: option: add Telit Cinterion FE990D50 compositions - usb: sl811-hcd: disable controller wakeup on remove - USB: storage: include US_FL_NO_SAME in quirks mask - usb: typec: anx7411: use devm_pm_runtime_enable() - usb: typec: class: drop PD lookup reference - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - USB: ulpi: fix memory leak on registration failure - USB: usb-storage: ene_ub6250: restore media-ready check - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - userfaultfd: gate must_wait writability check on pte_present() - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - vduse: hold vduse_lock across IDR lookup in open path - vduse: Requeue failed read to send_list head - veth: fix NAPI leak in XDP enable error path - vfio/mlx5: Fix racy bitfields and tighten struct layout - vfio/pci: Fix racy bitfields and tighten struct layout - vfio/pci: Latch disable_idle_d3 per device - vfio/pci: Release the VGA arbiter client on register_device() failure - vfio/pci: Use a private flag to prevent power state change with VFs - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - vhost/net: complete zerocopy ubufs only once - vhost/vdpa: validate virtqueue index in mmap and fault paths - virtio-mmio: fix device release warning on module unload - virtio_net: disable cb when NAPI is busy-polled - virtio-net: fix len check in receive_big() - virtio_net: Support dynamic rss indirection table size - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - watchdog: apple: Add "apple,t8103-wdt" compatible - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: unregister PM notifier on watchdog unregister - wifi: ath9k: fix OOB access from firmware tx status queue ID - wifi: cfg80211: fix grammar in MLO group key error message - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: mac80211: free ack status frame on TX header build failure - wifi: mt76: fix argument to ieee80211_is_first_frag() - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: rt2x00: avoid full teardown before work setup in probe - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - workqueue: drop spurious '*' from print_worker_info() fn declaration - writeback: Avoid contention on wb->list_lock when switching inodes - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - X.509: Fix validation of ASN.1 certificate header - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - x86/bugs: Enable IBPB flush on BPF JIT allocation - x86/mm: Fix check/use ordering in switch_mm_irqs_off() - x86/platform/olpc: xo15: Drop wakeup source on driver removal - xen/gntdev: fix error handling in ioctl - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: use compat translator only for u64 alignment mismatch - xfrm: Use the XFRM_GRO to indicate a GRO call on input - xfrm: validate selector family and prefixlen during match - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfs: dump the recovered xattri log item if corruption happens - xfs: fail recovery on a committed log item with no regions - xfs: fix stupid compiler warning - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: move ->iop_recover to xfs_defer_op_type - xfs: recreate work items when recovering intent items - xfs: resample the data fork mapping after cycling ILOCK - xfs: use null daddr for unset first bad log block - xfs: use xfs_defer_finish_one to finish recovered work items - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Check frwr_wp_create() during connect - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Remove temp allocation of rpcrdma_rep objects - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Use sendctx DMA state for Send signaling - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Remove rudiment CVE patches- [bot] upd: 6.6.126 -> 6.6.144 - Changelog: - 6lowpan: fix off-by-one in multicast context address compression - 6pack: propagage new tty types - 9p: avoid putting oldfid in p9_client_walk() error path - accel/qaic: Add overflow check to remap_pfn_range during mmap - accel/qaic: Handle DBC deactivation if the owner went away - ACPI: AGDI: fix missing newline in error message - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - ACPI: PM: Save NVS memory on Lenovo G70-35 - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix - ACPI: scan: Use acpi_dev_put() in object add error paths - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: x86: cmos_rtc: Clean up address space handler driver - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - af_key: validate families in pfkey_send_migrate() - af_unix: Cache state->msg in unix_stream_read_generic(). - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Give up GC if MSG_PEEK intervened. - af_unix: read UNIX_DIAG_VFS data under unix_state_lock - af_unix: Reject SIOCATMARK on non-stream sockets - af_unix: Set gc_in_progress to true in unix_gc(). - agp/amd64: Fix broken error propagation in agp_amd64_probe() - alarmtimer: Fix argument order in alarm_timer_forward() - ALSA: 6fire: Fix input volume change detection - ALSA: 6fire: fix use-after-free on disconnect - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: i2sbus: fix OF node lifetime handling - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - ALSA: aoa: Use guard() for mutex locks - ALSA: asihpi: avoid write overflow check warning - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: fix stack out-of-bounds read in init_card - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - ALSA: core: Fix potential data race at fasync handling - ALSA: core: Serialize deferred fasync state checks - ALSA: core: Validate compress device numbers without dynamic minors - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: ctxfi: Limit PTP to a single page - ALSA: firewire-lib: fix uninitialized local variable - ALSA: firewire-motu: Protect register DSP event queue positions - ALSA: firewire-tascam: Do not drop unread control events - ALSA: fireworks: bound device-supplied status before string array lookup - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: fix some typos - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: hda: cs35l56: Propagate ASP TX source control errors - ALSA: hda: cs35l56: Put ACPI device after setting companion - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: add quirk for Framework F111:000F - ALSA: hda/realtek: Add quirk for Inspur S14-G1 - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: misc: Use guard() for spin locks - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - ALSA: scarlett2: Add missing sentinel initializer field - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - ALSA: timer: Fix UAF at snd_timer_user_params() - ALSA: ua101: Reject too-short USB descriptors - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - ALSA: usb-audio: Add sanity check for OOB writes at silencing - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Cap the packet size pre-calculations - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Evaluate packsize caps at the right place - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Improve Focusrite sample rate filtering - ALSA: usb-audio: midi2: Restart output URBs on resume - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - ALSA: usb-audio: Update the number of packets properly at receiving - ALSA: usb-audio: Use correct version for UAC3 header validation - ALSA: usb-audio: Use inclusive terms - amd-xgbe: fix link status handling in xgbe_rx_adaptation - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - amd-xgbe: fix sleep while atomic on suspend/resume - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - APEI/GHES: ensure that won't go past CPER allocated record - apparmor: fix aa_label to return state from compount and component match - apparmor: fix differential encoding verification - apparmor: Fix double free of ns_name in aa_replace_profiles() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: fix: limit the number of levels of policy namespaces - apparmor: fix memory leak in verify_header - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix NULL sock in aa_sock_file_perm - apparmor: fix race between freeing data and fs accessing it - apparmor: fix race on rawdata dereference - apparmor: fix rlimit for posix cpu timers - apparmor: fix side-effect bug in match_char() macro usage - apparmor: fix unprivileged local user can do privileged policy management - apparmor: fix use-after-free in rawdata dedup loop - apparmor: make label_match return a consistent value - apparmor: mediate the implicit connect of TCP fast open sendmsg - apparmor: provide separate audit messages for file and policy checks - apparmor: refcount the pdb - apparmor: remove apply_modes_to_perms from label_match - apparmor: replace recursive profile removal with iterative approach - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: validate DFA start states are in bounds in unpack_pdb - arm64: Add support for TSV110 Spectre-BHB mitigation - arm64: cpufeature: Make PMUVer and PerfMon unsigned - arm64: cputype: Add C1-Premium definitions - arm64: cputype: Add C1-Ultra definitions - arm64: cputype: Add NVIDIA Olympus definitions - arm64: Disable branch profiling for all arm64 code - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8-apalis: Fix LEDs name collision - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - arm64: dts: rockchip: Fix rk356x PCIe range mappings - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU - arm64: errata: Mitigate TLBI errata on various Arm CPUs - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - arm64: Fix sampling the "stable" virtual counter in preemptible section - arm64: Force the use of CNTVCT_EL0 in __delay() - arm64: io: Extract user memory type in ioremap_prot() - arm64: io: Rename ioremap_prot() to __ioremap_prot() - arm64: kexec: Remove duplicate allocation for trans_pgd - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - arm64: mm: Batch dsb and isb when populating pgtables - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() - arm64: probes: Handle probes on hinted conditional branch instructions - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - arm64/scs: Fix handling of advance_loc4 - arm64/scs: Fix potential sign extension issue of advance_loc4 - arm64: tegra: smaug: Add usb-role-switch support - arm64: tlb: Allow XZR argument to TLBI ops - arm64: tlb: Flush walk cache when unsharing PMD tables - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI - arm64/xor: fix conflicting attributes for xor_block_template - ARM: 9467/1: mm: Don't use %pK through printk - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: clean up the memset64() C wrapper - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: group is_permission_fault() with is_translation_fault() - ARM: integrator: Fix early initialization - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - ARM: omap2: Fix reference count leaks in omap_control_init() - ARM: socfpga: Fix OF node refcount leak in SMP setup - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - ASoC: amd: yc: Add quirk for HP 200 G2a 16 - ASoC: codecs: ab8500: Fix casting of private data - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - ASoC: codecs: simple-mux: Fix enum control bounds check - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - ASoC: cs42l43: Correct handling of 3-pole jack load detection - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: detect empty DMI strings - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - ASoC: es8328: Add error unwind in resume - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: fix comment typo - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_micfil: Add access property for "VAD Detected" - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: Intel: catpt: Fix the device initialization - ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm: move component registration to unmanaged version - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6asm-dai: close stream only when running - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays - ASoC: simple-card-utils: use __free(device_node) for device node - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - ASoC: soc-core: drop delayed_work_pending() check before flush - ASoC: soc-core: flush delayed work before removing DAIs and widgets - ASoC: SOF: compress: return the configured codec from get_params - ASoC: SOF: Don't allow pointer operations on unconfigured streams - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda: Place check before dereference - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: sti: Return errors from regmap_field_alloc() - ASoC: sti: use managed regmap_field allocations - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - atm: fore200e: fix use-after-free in tasklets during device removal - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - atm: lec: fix use-after-free in sock_def_readable() - audit: add fchmodat2() to change attributes class - audit: add missing syscalls to read class - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - audit: fix incorrect inheritable capability in CAPSET records - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - auxdisplay: arm-charlcd: fix release_mem_region() size - auxdisplay: line-display: fix OOB read on zero-length message_store() - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - batman-adv: Avoid double-rtnl_lock ELP metric worker - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: clear current gateway during teardown - batman-adv: dat: handle forward allocation error - batman-adv: dat: prevent false sharing between VLANs - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: fix fragment reassembly length accounting - batman-adv: fix integer overflow on buff_pos - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: hold claim backbone gateways by reference - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: mcast: fix use-after-free in orig_node RCU release - batman-adv: prevent ELP transmission interval underflow - batman-adv: reject new tp_meter sessions during teardown - batman-adv: reject oversized global TT response buffers - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: stop tp_meter sessions during mesh teardown - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: tp_meter: keep unacked list in ascending ordered - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tt: fix negative last_changeset_len - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tt: prevent TVLV entry number overflow - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tt: track roam count per VID - batman-adv: tvlv: abort OGM send on tvlv append failure - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: v: stop OGMv2 on disabled interface - bcache: fix cached_dev.sb_bio use-after-free and crash - bcache: fix uninitialized closure object - binder: don't use %pK through printk - binfmt_misc: restore write access before closing files opened by open_exec() - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - blk-cgroup: fix UAF in __blkcg_rstat_flush() - blk-cgroup: wait for blkcg cleanup before initializing new disk - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - blktrace: fix __this_cpu_read/write in preemptible context - block: add pgmap check to biovec_phys_mergeable - block: relax pgmap check in bio_add_page for compatible zone device pages - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: bnep: reject short frames before parsing - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: btmtk: accept too short WMT FUNC_CTRL events - Bluetooth: btmtk: add the function to get the fw name - Bluetooth: btmtk: fix urb->setup_packet leak in error paths - Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btmtk: validate WMT event SKB length before struct access - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: btusb: Allow firmware re-download when version matches - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - Bluetooth: hci_conn: fix potential UAF in create_big_sync - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - Bluetooth: hci_ll: Fix firmware leak on error path - Bluetooth: hci_qca: Cleanup on all setup failures - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - Bluetooth: hci_sync: Fix hci_le_create_conn_sync - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - Bluetooth: HIDP: Fix possible UAF - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - Bluetooth: ISO: Fix defer tests being unstable - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU - Bluetooth: MGMT: Fix backward compatibility with userspace - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: MGMT: validate LTK enc_size on load - Bluetooth: MGMT: validate mesh send advertising payload length - Bluetooth: qca: fix ROM version reading on WCN3998 chips - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - Bluetooth: serialize accept_q access - Bluetooth: SMP: derive legacy responder STK authentication from MITM state - Bluetooth: SMP: force responder MITM requirements before building the pairing response - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy - Bluetooth: virtio_bt: clamp rx length before skb_put - Bluetooth: virtio_bt: validate rx pkt_type header length - bnxt_en: Fix NULL pointer dereference - bonding: 3ad: implement proper RCU rules for port->aggregator - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - bonding: add support for per-port LACP actor priority - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - bonding: fix NULL pointer dereference in actor_port_prio setting - bonding: fix use-after-free due to enslave fail after slave array update - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - bonding: only set speed/duplex to unknown, if getting speed failed - bonding: print churn state via netlink - bonding: refuse to enslave CAN devices - bpf: Add CHECKSUM_COMPLETE to bpf test progs - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf, arm64: Fix off-by-one in check_imm signed range check - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - bpf, devmap: Remove unnecessary if check in for loop - bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks - bpf: export bpf_link_inc_not_zero. - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf: fix end-of-list detection in cgroup_storage_get_next_key() - bpf: Fix NULL deref in map_kptr_match_type for scalar regs - bpf: Fix OOB in pcpu_init_value - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf: Fix RCU stall in bpf_fd_array_map_clear() - bpf: Fix regsafe() for pointers to packet - bpf: Fix stack-out-of-bounds write in devmap - bpf: Fix stale offload->prog pointer after constant blinding - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN - bpf: Forget ranges when refining tnum after JSET - bpf: Free reuseport cBPF prog after RCU grace period. - bpf: handle fake register spill to stack with BPF_ST_MEM instruction - bpf: preserve constant zero when doing partial register restore - bpf: preserve STACK_ZERO slots on partial reg spills - bpf: reject direct access to nullable PTR_TO_BUF pointers - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - bpf: Reject sleepable kprobe_multi programs at attach time - bpf: Release module BTF IDR before module unload - bpf: Remove mark_precise_scalar_ids() - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - bpf, sockmap: Fix af_unix iter deadlock - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix FIONREAD for sockmap - bpf, sockmap: Fix incorrect copied_seq calculation - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - bpf, sockmap: Take state lock for af_unix iter - bpf: support non-r10 register spill/fill to/from stack in precision tracking - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpftool: Fix truncated netlink dumps - bpf: track aligned STACK_ZERO cases as imprecise spilled registers - bpf: Track equal scalars history on per-instruction level - bpf: use kvfree() for replaced sysctl write buffer - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path - bpf: verifier improvement in 32bit shift sign extension pattern - bridge: br_nd_send: linearize skb before parsing ND options - bridge: br_nd_send: validate ND option lengths - bridge: mcast: Fix a possible use-after-free when removing a bridge port - btrfs: abort transaction on failure to update root in the received subvol ioctl - btrfs: add raid stripe tree definitions - btrfs: add support for inserting raid stripe extents - btrfs: always fallback to buffered write if the inode requires checksum - btrfs: continue trimming remaining devices on failure - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: do not strictly require dirty metadata threshold for metadata writepages - btrfs: don't take device_list_mutex when querying zone info - btrfs: fix block_group_tree dirty_list corruption - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - btrfs: fix double free in create_space_info() error path - btrfs: fix double free in create_space_info_sub_group() error path - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - btrfs: fix leak of kobject name for sub-group space_info - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: fix NULL dereference on root when tracing inode eviction - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix super block offset in error message in btrfs_validate_super() - btrfs: fix the qgroup data free range for inline data extents - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: handle user interrupt properly in btrfs_trim_fs() - btrfs: log new dentries when logging parent dir of a conflicting inode - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - btrfs: move btrfs_crc32c_final into free-space-cache.c - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: qgroup: return correct error when deleting qgroup relation item - btrfs: read raid stripe tree from disk - btrfs: reject root items with drop_progress and zero drop_level - btrfs: remove btrfs_crc32c wrapper - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() - btrfs: replace BUG() with error handling in __btrfs_balance() - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - Buffer overflow in drivers/xen/sys-hypervisor.c - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - bus: fsl-mc: fix use-after-free in driver_override_show() - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions - bus: omap-ocp2scp: Convert to platform remove callback returning void - bus: omap-ocp2scp: fix OF populate on driver rebind - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - cache: enforce cache groups - can: bcm: fix locking for bcm_op runtime updates - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - can: gs_usb: gs_can_open(): always configure bitrates before starting device - can: gw: fix OOB heap access in cgw_csum_crc8_rel() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - can: mcp251x: add error handling for power enable in open and resume - can: mcp251x: fix deadlock in error path of mcp251x_open - can: raw: fix ro->uniq use-after-free in raw_rcv() - can: statistics: add missing atomic access in hot path - can: ucan: fix devres lifetime - can: ucan: Fix infinite loop from zero-length messages - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - cdc-acm: new quirk for EPSON HMD - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - ceph: fix a buffer leak in __ceph_setxattr() - ceph: fix i_nlink underrun during async unlink - ceph: fix memory leaks in ceph_mdsc_build_path() - ceph: only d_add() negative dentries when they are unhashed - ceph: supply snapshot context in ceph_uninline_data() - ceph: supply snapshot context in ceph_zero_partial_object() - cgroup/cpuset: Reset DL migration state on can_attach() failure - cgroup: fix race between task migration and iteration - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - char: tpm: cr50: Remove IRQF_ONESHOT - checkpatch: add support for Assisted-by tag - cifs: abort open_cached_dir if we don't request leases - cifs: change_conf needs to be called for session setup - cifs: Fix busy dentry used after unmounting - cifs: Fix locking usage for tcon fields - cifs: make default value of retrans as zero - cifs: open files should not hold ref on superblock - cifs: some missing initializations on replay - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: imx: imx8-acm: fix flags for acm clocks - clk: mediatek: Fix error handling in runtime PM setup - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: microchip: core: correct return value on *_get_parent() - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: dispcc-sc7180: Add missing MDSS resets - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - clk: qoriq: avoid format string warning - clk: renesas: rzg2l: Fix intin variable size - clk: renesas: rzg2l: Select correct div round macro - clk: rk808: fix OF node reference imbalance - clk: tegra: tegra124-emc: fix device leak on set_rate() - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - clk: visconti: pll: initialize clk_init_data to zero - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clocksource/drivers/sh_tmu: Always leave device running after probe - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clsact: Fix use-after-free in init/destroy rollback asymmetry - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: dt2815: add hardware detection to prevent crash - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - coresight: etm3x: Fix cpulocked warning on cpuhp - counter: Fix refcount leak in counter_alloc() error path - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - cpufreq: conservative: Reset requested_freq on limits change - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - cpuidle: powerpc: avoid double clear when breaking snooze - cpuidle: Skip governor when only one idle state is available - cpuset: Fix missing adaptation for cpuset_is_populated - crypto: af_alg - Cap AEAD AD length to 0x80000000 - crypto: af-alg - fix NULL pointer dereference in scatterwalk - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - crypto: algif_aead - Fix minimum RX size check for decryption - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel - Remove cfb and ofb - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - reject short ahash digests during instance creation - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: caam - fix DMA corruption on long hmac keys - crypto: caam - fix overflow on long hmac keys - crypto: caam - guard HMAC key hex dumps in hash_digest_key - crypto: cavium - fix dma_free_coherent() size - crypto: ccp - Add an S4 restore flow - crypto: ccp - copy IV using skcipher ivsize - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed - crypto: ccp - Factor out ring destroy handling to a helper - crypto: ccp - Move direct access to some PSP registers out of TEE - crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: hisilicon/qm - move the barrier before writing to the mailbox register - crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable - crypto: hisilicon/trng - modifying the order of header files - crypto: hisilicon/trng - support tfms sharing the device - crypto: hisilicon/zip - adjust the way to obtain the req in the callback function - crypto: hisilicon/zip - remove zlib and gzip - crypto: hisilicon/zip - support deflate algorithm - crypto: jitterentropy - replace long-held spinlock with mutex - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - crypto: nx - fix context leak in nx842_crypto_free_ctx - crypto: nx - Migrate to scomp API - crypto: octeontx - fix dma_free_coherent() size - crypto: pcrypt - Fix handling of MAY_BACKLOG requests - crypto: qat - fix warning on adf_pfvf_pf_proto.c - crypto: qat - remove unused character device and IOCTLs - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - use swab32 macro - crypto: sa2ul - Fix AEAD fallback algorithm names - crypto: scatterwalk - Backport memcpy_sglist() - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - rename first/last to first_desc/last_desc - crypto: testmgr - Hide ENOENT errors - crypto: testmgr - Hide ENOENT errors better - cxl: Fix premature commit_end increment on decoder commit failure - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - dcache: Limit the minimal number of bucket to two - debugfs: check for NULL pointer in debugfs_create_str() - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - device property: Allow secondary lookup in fwnode_get_next_child_node() - device property: Make modifications of fwnode "flags" thread safe - device property: set fwnode->secondary to NULL in fwnode_init() - dev_printk: add new dev_err_probe() helpers - devres: fix missing node debug info in devm_krealloc() - Disable -Wattribute-alias for clang-23 and newer - dlm: prevent NPD when writing a positive value to event_done - dma-buf: Include ioctl.h in UAPI header - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - dmaengine: idxd: Fix crash when the event log is disabled - dmaengine: idxd: Fix freeing the allocated ida too late - dmaengine: idxd: Fix leaking event log memory - dmaengine: idxd: Fix memory leak when a wq is reset - dmaengine: idxd: Fix not releasing workqueue on .release() - dmaengine: idxd: Remove usage of the deprecated ida_simple_xx() API - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dma-mapping: add missing `inline` for `dma_free_attrs` - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - dm cache: fix concurrent write failure in passthrough mode - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: fix missing return in invalidate_committed's error path - dm cache: fix null-deref with concurrent writes in passthrough mode - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache metadata: fix memory leak on metadata abort retry - dm cache policy smq: check allocation under invalidate lock - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: support shrinking the origin device - dm: clear cloned request bio pointer when last clone bio completes - dm: don't report warning when doing deferred remove - dm: fix a buffer overflow in ioctl processing - dm init: ensure device probing has finished in dm-mod.waitfor= - dm-integrity: fix a typo in the code for write/discard race - dm-integrity: fix recalculation in bitmap mode - dm log: fix out-of-bounds write due to region_count overflow - dm mirror: fix integer overflow in create_dirty_log() - dm mpath: make pg_init_delay_msecs settable - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - dm-thin: fix metadata refcount underflow - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm: use bio_clone_blkg_association - dm-verity: correctly handle dm_bufio_client_create() failure - dm-verity: disable recursive forward error correction - dm-verity-fec: correctly reject too-small FEC devices - dm-verity-fec: correctly reject too-small hash devices - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - docs: fix WARNING document not included in any toctree - Documentation: fix a hugetlbfs reservation statement - Documentation: ioctl-number: Extend "Include File" column width - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - Documentation: trace: Refactor toctree - Documentation: tracing: Add PCI tracepoint documentation - Documentation: tracing: Add ring-buffer mapping - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2-switch: do not clear any interrupts automatically - dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - drbd: Balance RCU calls in drbd_adm_dump_devices() - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - drbd: fix null-pointer dereference on local read error - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value - driver core: Don't let a device probe until it's ready - driver core: generalize driver_override in struct device - driver core: platform: use generic driver_override infrastructure - driver core: reject devices with unregistered buses - drivers/base/memory: fix memory block reference leak in poison accounting - drivers/base/memory: set mem->altmap after successful device registration - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - drivers: iio: mpu3050: use dev_err_probe for regulator request - drm: Account property blob allocations to memcg - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - drm/amd/display: Allow DCE link encoder without AUX registers - drm/amd/display: Avoid updating surface with the same surface under MPO - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - drm/amd/display: Do not skip unrelated mode changes in DSC validation - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - drm/amd/display: Fix integer overflow in bios_get_image() - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - drm/amd/display: Remove conditional for shaper 3DLUT power-on - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amd: Drop special case for yellow carp without discovery - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() - drm/amdgpu: Add basic validation for RAS header - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdgpu: Add default case in DVI mode validation - drm/amdgpu: Add HAINAN clock adjustment - drm/amdgpu: add support for HDP IP version 6.1.1 - drm/amdgpu: Adjust usleep_range in fence wait - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - drm/amdgpu: fix spelling typos - drm/amdgpu: Fix use-after-free race in VM acquire - drm/amdgpu: fix zero-size GDS range init on RDNA4 - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu/gmc9.0: add bounds checking for cid - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn3: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu: zero-initialize GART table on allocation - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix debug watchpoints for logical devices - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - drm/amdkfd: fix NULL dereference in get_queue_ids() - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) - drm/amd: Set num IP blocks to 0 if discovery fails - drm/arcpgu: fix device node leak - drm/ast: dp501: Fix initialization of SCU2C - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - drm/bridge: it66121: acquire reset GPIO in probe - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: samsung-dsim: Fix memory leak in error path - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/display/dp_mst: Add protection against 0 vcpi - drm/dp: Add eDP 1.5 bit definition - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup - drm/fbdev-helper: Set and clear VGA switcheroo client from fb_info - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/hyperv: validate resolution_count and fix WIN8 fallback - drm/hyperv: validate VMBus packet size in receive callback - drm/i915/acpi: free _DSM package when no connectors - drm/i915: Constify watermark state checker - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Fix potential overflow of shmem scatterlist length - drm/i915: Fix potential UAF in TTM object purge - drm/i915/gem: Fix phys BO pread/pwrite with offset - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - drm/i915/gt: Check set_default_submission() before deferencing - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/i915/psr: Do not use pipe_src as borders for SU area - drm/i915/psr: Read Intel DPCD workaround register - drm/i915: Simplify watermark state checker calling convention - drm/i915: skip __i915_request_skip() for already signaled requests - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - drm/i915/wm: Verify the correct plane DDB entry - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - drm/ioc32: stop speculation on the drm_compat_ioctl path - drm/komeda: fix integer overflow in AFBC framebuffer size check - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() - drm/msm/a2xx: fix pixel shader start on A225 - drm/msm/a6xx: Fix HLSQ register dumping - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - drm/msm/dpu: fix mismatch between power and frequency - drm/msm/dsi: add the missing parameter description - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - drm/msm/dsi: don't dump registers past the mapped region - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm: Fix dma_free_attrs() buffer size - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/shrinker: Fix can_block() logic - drm/msm/snapshot: fix dumping of the unaligned regions - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/radeon: Add HAINAN clock adjustment - drm/radeon: add missing revision check for CI - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm: Remove plane hsub/vsub alignment requirement for core helpers - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - drm/solomon: Fix page start when updating rectangle in page addressing mode - drm/ssd130x: Replace .page_height field in device info with a constant - drm/ssd130x: Store the HW buffer in the driver-private CRTC state - drm/ssd130x: Use bool for ssd130x_deviceinfo flags - drm/sun4i: backend: fix error pointer dereference - drm/sun4i: Fix resource leaks - drm/sysfb: ofdrm: fix PCI device reference leaks - drm/tegra: dsi: fix device leak on probe - drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used - drm/v3d: Reject empty multisync extension to prevent infinite loop - drm/v3d: Set DMA segment size to avoid debug warnings - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: fix krealloc() memory leak - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: platform_get_irq_byname() returns an int - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Release runtime PM reference after binding V3D - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - drm/virtio: Fix driver removal with disabled KMS - drm/virtio: use uninterruptible resv lock for plane updates - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - dt-bindings: connector: add pd-disable dependency - dt-bindings: gpio: fix microchip #interrupt-cells - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - dt-bindings: net: Fix Tegra234 MGBE PTP clock - e1000: check return value of e1000_read_eeprom - e1000/e1000e: Fix leak in DMA error cleanup - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - e1000e: Unroll PTP in probe error handling - EDAC/altera: Remove IRQF_ONESHOT - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/mc: Fix error path ordering in edac_mc_alloc() - efi: Allocate runtime workqueue before ACPI init - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - EFI/CPER: don't dump the entire memory region - EFI/CPER: don't go past the ARM processor CPER record buffer - efi: Fix reservation of unaccepted memory table - erofs: add GFP_NOIO in the bio completion if needed - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - erofs: fix the out-of-bounds nameoff handling for trailing dirents - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() - err.h: use __always_inline on all error pointer helpers - esp: fix skb leak with espintcp and async crypto - eth: bnxt: always recalculate features after XDP clearing, fix null-deref - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - eventfs: Hold eventfs_mutex and SRCU when remount walks events - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - eventpoll: defer struct eventpoll free to RCU grace period - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: Fix integer overflow in ep_loop_check_proc() - eventpoll: kill __ep_remove() - eventpoll: move epi_fget() up - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - exfat: fix potential use-after-free in exfat_find_dir_entry() - exit: prevent preemption of oopsing TASK_DEAD task - exit: Sleep at TASK_IDLE when waiting for application core dump - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - ext4: always allocate blocks only from groups inode can use - ext4: always drain queued discard work in ext4_mb_release() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: avoid infinite loops caused by residual data - ext4: convert bd_bitmap_page to bd_bitmap_folio - ext4: convert bd_buddy_page to bd_buddy_folio - ext4: convert inline data to extents when truncate exceeds inline size - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - ext4: don't cache extent during splitting extent - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: drop extent cache when splitting extent fails - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - ext4: fix dirtyclusters double decrement on fs shutdown - ext4: fix e4b bitmap inconsistency reports - ext4: fix fsync(2) for nojournal mode - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix journal credit check when setting fscrypt context - ext4: fix memory leak in ext4_ext_shift_extents() - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix stale xarray tags after writeback - ext4: fix the might_sleep() warnings in kvfree() - ext4: fix use-after-free in update_super_work when racing with umount - ext4: get rid of ppath in ext4_convert_unwritten_extents_endio() - ext4: get rid of ppath in ext4_ext_convert_to_initialized() - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() - ext4: get rid of ppath in ext4_ext_insert_extent() - ext4: get rid of ppath in ext4_find_extent() - ext4: get rid of ppath in ext4_split_convert_extents() - ext4: get rid of ppath in ext4_split_extent() - ext4: get rid of ppath in ext4_split_extent_at() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: mark group add fast-commit ineligible - ext4: mark group extend fast-commit ineligible - ext4: move ext4_percpu_param_init() before ext4_mb_init() - ext4: publish jinode after initialization - ext4: reject mount if bigalloc with s_first_data_block != 0 - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio - ext4: subdivide EXT4_EXT_DATA_VALID1 - ext4: use optimized mballoc scanning regardless of inode format - ext4: validate p_idx bounds in ext4_ext_correct_indexes - extcon: ptn5150: handle pending IRQ events during system resume - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: fix incorrect file address mapping when inline inode is unwritten - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix out-of-bounds access in sysfs attribute read/write - f2fs: fix to add gc count stat in f2fs_gc_range - f2fs: fix to avoid mapping wrong physical block for swapfile - f2fs: fix to avoid memory leak in f2fs_rename() - f2fs: fix to avoid migrating empty section - f2fs: fix to avoid UAF in f2fs_write_end_io() - f2fs: fix to detect potential corrupted nid in free_nid_list - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - f2fs: fix to round down start offset of fallocate for pin file - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - f2fs: fix zoned block device information initialization - f2fs: keep atomic write retry from zeroing original data - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: validate compress cache inode only when enabled - f2fs: zone: fix to avoid inconsistence in between SIT and SSA - fanotify: fix false positive on permission events - fat: avoid parent link count underflow in rmdir - fbcon: Avoid OOB font access if console rotation fails - fbcon: check return value of con2fb_acquire_newinfo() - fbcon: Remove struct fbcon_display.inverse - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - fbdev: fix use-after-free in store_modes() - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: offb: fix PCI device reference leak on probe failure - fbdev: rivafb: fix divide error in nv3_arb() - fbdev: smscufx: properly copy ioctl memory to kernelspace - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - file: add fput() cleanup helper - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_scpi: Fix device_node reference leak in probe path - firmware: dmi: Correct an indexing error in dmi.h - firmware: google: framebuffer: Do not mark framebuffer as busy - firmware: google: framebuffer: Do not unregister platform device - fix it87_wdt early reboot by reporting running timer - flow_dissector: do not dissect PPPoE PFC frames - fork: defer linking file vma until vma is fully initialized - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - fpga: of-fpga-region: Fail if any bridge is missing - fpga: region: fix use-after-free in child_regions_with_firmware() - fs: add for 'init_fs' - fs/adfs: validate nzones in adfs_validate_bblk() - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - fs/nfs: Fix readdir slow-start regression - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs: ntfs3: check return value of indx_find to avoid infinite loop - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - fs/ntfs3: validate rec->used in journal-replay file record check - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - fs: prepare for adding LSM blob to backing_file - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Update the mcount_loc check of skipped entries - fuse: Check for large folio with SPLICE_F_MOVE - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fuse: quiet down complaints in fuse_conn_limit_write - fuse: reject fuse_notify() pagecache ops on directories - fuse: reject oversized dirents in page cache - fuse: re-lock request before replacing page cache folio - futex: Clear stale exiting pointer in futex_lock_pi() retry path - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - genetlink: Use internal flags for multicast groups - gfs2: Add metapath_dibh helper - gfs2: add some missing log locking - gfs2: Call unlock_new_inode before d_instantiate - gfs2: fiemap page fault fix - gfs2: Fix unlikely race in gdlm_put_lock - gfs2: fix use-after-free in gfs2_qd_dealloc - gfs2: Fix use-after-free in iomap inline data write path - gfs2: Improve gfs2_consist_inode() usage - gfs2: prevent NULL pointer dereference during unmount - gfs2: Retries missing in gfs2_{rename,exchange} - gfs2: Validate i_depth for exhash directories - gpio: aspeed-sgpio: Change the macro to support deferred probe - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: acpi: Fix gpio count with string references - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - gpio: mvebu: fix NULL pointer dereference in suspend/resume - gpio: mxc: fix irq_high handling - gpio: mxc: map Both Edge pad wakeup to Rising Edge - gpio: of: clear OF_POPULATED on hog nodes in remove path - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - gpio: sprd: Change sprd_gpio lock to raw_spin_lock - gpio: tegra: fix irq_release_resources calling enable instead of disable - gro: change the BUG_ON() in gro_pull_from_frag0() - gve: defer interrupt enabling until NAPI registration - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - hdlc_ppp: sync per-proto timers before freeing hdlc state - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - hfsplus: fix volume corruption issue for generic/498 - hfsplus: pretend special inodes as regular files - hfsplus: return error when node already exists in hfs_bnode_create - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - HID: alps: fix NULL pointer dereference in alps_raw_event() - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - HID: apple: avoid memory leak in apple_report_fixup() - HID: asus: add xg mobile 2023 external hardware support - HID: asus: avoid memory leak in asus_report_fixup() - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - HID: core: Add printk_ratelimited variants to hid_warn() etc - HID: core: clamp report_size in s32ton() to avoid undefined shift - HID: core: Fix size_t specifier in hid_report_raw_event() - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: hid-pl: handle probe errors - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() - HID: magicmouse: Do not crash on missing msc->input - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - HID: mcp2221: cancel last I2C command on read error - HID: multitouch: add eGalaxTouch EXC3188 support - HID: multitouch: Check to ensure report responses match the request - HID: pass the buffer size to hid_report_raw_event - HID: playstation: Add missing check for input_ff_create_memless - HID: playstation: Clamp num_touch_reports - HID: prodikeys: Check presence of pm->input_ep82 - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - HID: quirks: really enable the intended work around for appledisplay - HID: roccat: fix use-after-free in roccat_report_event - HID: uclogic: Fix regression of input name assignment - HID: usbhid: fix deadlock in hid_post_reset() - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - hisi_acc_vfio_pci: update status after RAS error - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimer: Fix trace oddity - hrtimer: Reduce trace noise in hrtimer_start() - hrtimers: Update the return type of enqueue_hrtimer() - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - hv_sock: fix ARM64 support - hv: utils: handle and propagate errors in kvp_register - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - hwmon: (aht10) Add support for dht20 - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (axi-fan-control) Make use of dev_err_probe() - hwmon: (axi-fan-control) Use device firmware agnostic API - hwmon: axi-fan: don't use driver_override as IRQ name - hwmon: (corsair-psu) Close HID device on probe errors - hwmon: (f71882fg) Add F81968 support - hwmon: (it87) Check the it87_lock() return value - hwmon: (ltc2992) Clamp threshold writes to hardware range - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - hwmon: (occ) Fix division by zero in occ_show_power_1() - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - hwmon: (pmbus/core) Protect regulator operations with mutex - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - hwmon: (pxe1610) Check return value of page-select write in probe - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - i2c: s3c24xx: check the size of the SMBUS message before using it - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: stub: Reject I2C block transfers with invalid length - i2c: tegra: Don't mark devices with pins as IRQ safe - i2c: tegra: Fix NOIRQ suspend/resume - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - i3c: dw: Initialize spinlock to avoid upsetting lockdep - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - i3c: master: Update hot-join flag only on success - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - i3c: Move device name assignment after i3c_bus_init - i40e: Cleanup PTP pins on probe failure - i40e: don't advertise IFF_SUPP_NOFCS - i40e: Fix preempt count leak in napi poll tracepoint - i40e: fix registering XDP RxQ info - i40e: fix src IP mask checks and memcpy argument names in cloud filter - i40e: use xdp.frame_sz as XDP RxQ info frag_size - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: fix VLAN filter lost on add/delete race - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - iavf: stop removing VLAN filters from PF on interface down - iavf: wait for PF confirmation before removing VLAN filters - IB/cache: update gid cache on client reregister event - IB/core: Fix zero dmac race in neighbor resolution - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - ibmveth: Disable GSO for packets with small MSS - ice: fix double-free of tx_buf skb - ice: fix locking in ice_dcb_rebuild() - ice: Fix memory leak in ice_set_ringparam() - ice: fix NULL pointer dereference in ice_reset_all_vfs() - ice: fix retry for AQ command 0x06EE - ice: fix setting promisc mode while adding VID filter - ice: fix VF queue configuration with low MTU values - ice: reintroduce retry mechanism for indirect AQ - ice: Remove jumbo_remove step from TX path - ice: use ice_update_eth_stats() for representor stats - icmp: fix NULL pointer dereference in icmp_tag_validation() - icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns - icmp: move icmp_global.credit and icmp_global.stamp to per netns storage - icmp: prevent possible overflow in icmp_global_allow() - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - igc: fix missing update of skb->tail in igc_xmit_frame() - iio: accel: fix ADXL355 temperature signature value - iio: adc: ad7768-1: fix one-shot mode data acquisition - iio: adc: npcm: Convert to platform remove callback returning void - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: ti-adc161s626: fix buffer read on big-endian - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - iio: buffer: Fix wait_queue not being removed - iio: buffer: hw-consumer: fix use-after-free in error path - iio: chemical: bme680: Fix measurement wait duration calculation - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: common: st_sensors: Fix use of uninitialize device structs - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: ad5686: fix ref bit initialization for single-channel parts - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: dac: ds4424: reject -128 RAW value - iio: dac: max5821: fix return value check in powerdown sync - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: gyro: adis16260: fix division by zero in write_raw - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: gyro: itg3200: Fix unchecked return value in read_raw - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - iio: imu: inv_icm42600: fix odr switch to the same value - iio: imu: inv_icm42600: fix odr switch when turning buffer off - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: light: bh1780: fix PM runtime leak on error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: light: vcnl4035: fix scan buffer on big-endian - iio: magnetometer: Remove IRQF_ONESHOT - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: pressure: mprls0025pa: fix scan_type struct - iio: sca3000: Fix a resource leak in sca3000_probe() - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: temperature: tsys01: fix broken PROM checksum validation - iio: Use IRQF_NO_THREAD - ima: check return value of crypto_shash_final() in boot aggregate - ima: verify the previous kernel's IMA buffer lies in addressable RAM - include: uapi: netfilter_bridge.h: Cover for musl libc - indirect_call_wrapper: do not reevaluate function pointer - inet: add indirect call wrapper for getfrag() calls - inet: frags: add inet_frag_queue_flush() - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - inet: frags: flush pending skbs in fqdir_pre_exit() - inet: move icmp_global_{credit,stamp} to a separate cache line - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: elan_i2c - validate firmware size before use - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: synaptics-rmi4 - fix a locking bug in an error path - Input: uinput - fix circular locking dependency with ff-core - Input: uinput - take event lock when submitting FF request "event" - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - Input: xpad - add "Nova 2 Lite" from GameSir - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - fix out-of-bounds access for Share button - iomap: allocate s_dio_done_wq for async reads as well - iomap: don't revert iov_iter on partially completed buffered writes - iomap: fix submission side handling of completion side errors - iomap: reject delalloc mappings during writeback - iommu/amd: move wait_on_sem() out of spinlock - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - iommu/amd: Use atomic64_inc_return() in iommu.c - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - iommufd: Fix a race with concurrent allocation and unmap - iommufd: vfio compatibility extension check for noiommu mode - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - iommu/vt-d: Flush cache for PASID table before using it - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - ionic: fix persistent MAC address override on PF - ionic: Rate limit unknown xcvr type messages - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - io_uring/filetable: clamp alloc_hint to the configured alloc range - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix multishot recv missing EOF on wakeup race - io_uring/poll: fix signed comparison in io_poll_get_ownership() - io_uring/sync: validate passed in offset - io_uring/timeout: check unused sqe fields - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ip6_gre: Use cached t->net in ip6erspan_changelink(). - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - ip6_vti: set netns_immutable on the fallback device. - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipc: don't audit capability check in ipc_permissions() - ipc: limit next_id allocation to the valid ID range - ipc/shm: serialize orphan cleanup with shm_nattch updates - ipmi: Add limits to event and receive message requests - ipmi: Check event message buffer response for bad data - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ipmi: ipmb: initialise event handler read bytes - ipmi:si: Return state to normal if message allocation fails - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - ipmi:ssif: Clean up kthread on errors - ipmi:ssif: Fix a shutdown race - ipmi:ssif: NULL thread on error - ipmi:ssif: Remove unnecessary indention - ipv4: account for fraggap on the paged allocation path - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: fib: Annotate access to struct fib_alias.fa_state. - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - ipv4: icmp: fix null-ptr-deref in icmp_build_probe() - ipv4: icmp: validate reply type before using icmp_pointers - ipv4: igmp: annotate data-races around idev->mr_maxdelay - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - ipv6: account for fraggap on the paged allocation path - ipv6: add NULL checks for idev in SRv6 paths - ipv6/addrconf: annotate data-races around devconf fields (II) - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - ipv6: avoid overflows in ip6_datagram_send_ctl() - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: exthdrs: refresh nh after handling HAO option - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - ipv6: Fix a potential NPD in cleanup_prefix_route() - ipv6: fix a race in ip6_sock_set_v6only() - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - ipv6: Fix out-of-bound access in fib6_add_rt2node(). - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - ipv6: fix possible UAF in icmpv6_rcv() - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() - ipv6: mcast: Fix use-after-free when processing MLD queries - ipv6: prevent possible UaF in addrconf_permanent_addr() - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - ipv6: sit: reload inner IPv6 header after GSO offloads - ipv6: use RCU in ip6_xmit() - ipv6: validate extension header length before copying to cmsg - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - ipvs: clear the svc scheduler ptr early on edit - ipvs: fix MTU check for GSO packets in tunnel mode - ipvs: fix NULL deref in ip_vs_add_service error path - ipvs: skip ipv6 extension headers for csum checks - irqchip/ath79-cpu: Remove unused function - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - ixgbevf: add missing negotiate_features op to Hyper-V ops table - ixgbevf: fix link setup issue - ixgbevf: fix use-after-free in VEPA multicast source pruning - jbd2: gracefully abort on checkpointing state corruptions - jfs: Add missing set_freezable() for freezable kthread - jfs: nlink overflow in jfs_rename - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - kbuild: Add objtool to top-level clean target - kbuild: Leave objtool binary around with 'make clean' - kexec: derive purgatory entry from symbol - KEYS: fix overflow in keyctl_pkey_params_get_2() - keys: Pin request_key_auth payload in instantiate paths - kprobes: avoid crash when rmmod/insmod after ftrace killed - kprobes: Remove unneeded goto - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - ksmbd: add durable scavenger timer - ksmbd: add support for supplementary groups - ksmbd: avoid reclaiming expired durable opens by the client - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: Compare MACs in constant time - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - ksmbd: do not expire session on binding failure - ksmbd: Don't log keys in SMB3 signing and encryption key generation - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - ksmbd: fix null pointer dereference in compare_guid_key() - ksmbd: fix OOB write in QUERY_INFO for compound requests - ksmbd: fix out-of-bounds read in smb_check_perm_dacl() - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - ksmbd: fix use-after-free by using call_rcu() for oplock_info - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - ksmbd: fix use-after-free of share_conf in compound request - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops - ksmbd: reject non-VALID session in compound request branch - ksmbd: replace connection list with hash table - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: require minimum ACE size in smb_check_perm_dacl() - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: unset conn->binding on failed binding request - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: use msleep instaed of schedule_timeout_interruptible() - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: validate EaNameLength in smb2_get_ea() - ksmbd: validate inherited ACE SID length - ksmbd: validate owner of durable handle on reconnect - ksmbd: validate response sizes in ipc_validate_msg() - ktest: Avoid undef warning when WARNINGS_FILE is unset - ktest: Fix the month in the name of the failure directory - ktest: Honor empty per-test option overrides - ktest: Run POST_KTEST hooks on failure and cancellation - kunit: config: Enable KUNIT_DEBUGFS by default - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: tool: copy caller args in run_kernel to prevent mutation - KVM: arm64: Discard PC update state on vcpu reset - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: PMU: Preserve AArch32 counter low bits - KVM: arm64: Remove VPIPT I-cache handling - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION - KVM: SVM: Add a helper to look up the max physical ID for AVIC - KVM: SVM: check validity of VMCB controls when returning from SMM - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated - KVM: VMX: Update SVI during runtime APICv activation - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - KVM: x86: Fix KVM_GET_MSRS stack info leak - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - KVM: x86: Fix shadow paging use-after-free due to unexpected role - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs - KVM: x86: Use scratch field in MMIO fragment to hold small write values - KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - l2tp: Drop large packets with UDP encap - landlock: Fix handling of disconnected directories - leds: lgm-sso: Remove duplicate assignments for priv->mmap - leds: qcom-lpg: Check for array overflow when selecting the high resolution - leds: qcom-lpg: Check the return value of regmap_bulk_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: check xbc_init_node() return in override path - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - libbpf: Fix OOB read in btf_dump_get_bitfield_value - libbpf: Fix -Wdiscarded-qualifiers under C23 - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: define and enforce CEPH_MAX_KEY_LEN - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential out-of-bounds access in osdmap_decode() - libceph: Fix slab-out-of-bounds access in auth message processing - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - libceph: prevent potential out-of-bounds reads in process_message_header() - libceph: reject preamble if control segment is empty - libceph: Use u32 for non-negative values in ceph_monmap_decode() - lib/crypto: chacha: Zeroize permuted_state before it leaves scope - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - lib/scatterlist: fix length calculations in extract_kvec_to_sg - lib/scatterlist: fix temp buffer in extract_user_to_sg() - libsubcmd: Fix null intersection case in exclude_cmds() - lib: test_hmm: evict device pages on file close to avoid use-after-free - lib/ts_kmp: fix integer overflow in pattern length calculation - locking: Fix rwlock support in - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - LoongArch: Add spectre boundry for syscall dispatch table - LoongArch: Add WriteCombine shadow mapping in KASAN - LoongArch: Add writecombine support for DMW-based ioremap() - LoongArch: Disable instrumentation for setup_ptwalker() - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - LoongArch: Give more information if kmem access failed - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE - LoongArch: Prefer top-down allocation after arch_mem_init() - LoongArch: Remove unused code to avoid build warning - LoongArch: Rework KASAN initialization for PTW-enabled systems - LoongArch: Show CPU vulnerabilites correctly - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: vDSO: Emit GNU_EH_FRAME correctly - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - loop: fix partition scan race between udev and loop_reread_partitions() - lsm: add backing_file LSM hooks - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - mac802154: llsec: add skb_cow_data() before in-place crypto - macsec: fix replay protection at XPN lower-PN wrap - macvlan: annotate data-races around port->bc_queue_len_used - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - mailbox: add sanity check for channel array - mailbox: Allow controller specific mapping using fwnode - mailbox: bcm-ferxrm-mailbox: Use default primary handler - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: mailbox-test: don't free the reused channel - mailbox: mailbox-test: free channels on probe error - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: sprd: clear delivery flag before handling TX done - mailbox: sprd: mask interrupts that are not handled - mailbox: Use dev_err when there is error - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use of_property_match_string() instead of open-coding - mctp: i2c: fix skb memory leak in receive path - mctp i2c: initialise event handler read bytes - mctp: route: hold key->lock in mctp_flow_prepare_output() - md/bitmap: fix GPF in write_page caused by resize race - md-cluster: fix NULL pointer dereference in process_metadata_update - md/raid10: fix any_working flag handling in raid10_sync_request - md/raid10: fix deadlock with check operation and nowait requests - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - md/raid1: fix data lost for writemostly rdev - md/raid1,raid10: don't ignore IO flags - md/raid5: fix soft lockup in retry_aligned_read() - md/raid5: validate payload size before accessing journal metadata - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - media: amphion: Fix race between m2m job_abort and device_run - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - media: ccs: Accommodate C-PHY into the calculation - media: ccs: Avoid possible division by zero - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: dvb-core: dmxdevfilter must always flush bufs - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - media: dvb-net: fix OOB access in ULE extension header tables - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - media: i2c: imx412: Assert reset GPIO during probe - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix digital gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c: ov08d10: fix image vertical start setting - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Initialize subdev before controls - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex - media: mediatek: encoder: Fix uninitialized scalar variable issue - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: mediatek: vcodec: fix use-after-free in encoder release path - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - media: omap3isp: drop the use count of v4l2 pipeline - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - media: omap3isp: set initial format - media: pci: zoran: fix potential memory leak in zoran_probe() - media: pvrusb2: fix URB leak in pvr2_send_request_ex - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: radio-keene: fix memory leak in error path - media: rc: fix race between unregister and urb/irq callbacks - media: rc: igorplugusb: fix control request setup packet - media: rc: igorplugusb: heed coherency rules - media: rc: streamzap: Error handling in probe - media: rc: ttusbir: fix inverted error logic - media: rc: ttusbir: respect DMA coherency rules - media: rc: xbox_remote: heed DMA restrictions - media: rkisp1: Fix filter mode register configuration - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - media: saa7164: add ioremap return checks and cleanups - media: solo6x10: Check for out of bounds chip_id - media: staging: imx: request mbus_config in csi_start - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - media: uvcvideo: Enable VB2_DMABUF for metadata stream - media: uvcvideo: Fix allocation for small frame sizes - media: v4l2-async: Fix error handling on steps after finding a match - media: venus: vdec: fix error state assignment for zero bytesused - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: verisilicon: AV1: Fix enable cdef computation - media: verisilicon: AV1: Fix tile info buffer size - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Set IDR flag for intra_only frame type - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - media: vidtv: fix nfeeds state corruption on start_streaming failure - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - media: vidtv: fix pass-by-value structs causing MSAN warnings - memfd: deny writeable mappings when implying SEAL_WRITE - memory: mtk-smi: Convert to platform remove callback returning void - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: tegra124-emc: Fix dll_change check - memory: tegra30-emc: Fix dll_change check - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - mfd: core: Add locking around 'mfd_of_node_list' - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - mfd: wm8350-core: Use IRQF_ONESHOT - minix: Add required sanity checking to minix_check_superblock() - MIPS: Always record SEGBITS in cpu_data.vmbits - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - MIPS: Fix the GCC version check for `__multi3' workaround - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - mips: mm: Allocate tlb_vpn array atomically - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - mips: ralink: update CPU clock index - MIPS: rb532: Fix MMIO UART resource registration - MIPS: Work around LLVM bug when gp is used as global register variable - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: possible double-free of cctx->remote_heap - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mmc: block: use single block write in retry - mmc: core: Avoid bitfield RMW for claim/retune flags - mmc: core: Fix host controller programming for fixed driver type - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - mmc: vub300: fix NULL-deref on disconnect - mm/damon/core: disallow time-quota setting zero esz - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: use time_in_range_open() for damos quota window start - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/ops-common: call folio_test_lru() after folio_get() - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() - mm/highmem: fix __kmap_to_page() build error - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - mm/huge_memory: update file PMD counter before folio_put() - mm/hugetlb: avoid false positive lockdep assertion - mm/hugetlb_cma: round up per_node before logging it - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: rename folio_putback_active_hugetlb() to folio_putback_hugetlb() - mm/hugetlb: rename isolate_hugetlb() to folio_isolate_hugetlb() - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - mm/kasan: fix double free for kasan pXds - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mm/kfence: fix KASAN hardware tag faults during late enablement - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - mm/mempolicy: fix wrong mmap_read_unlock() in migrate_to_node() - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - mm/page_alloc: clear page->private in free_pages_prepare() - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - mm/tracing: rss_stat: ensure curr is false from kthread context - modpost: Amend ppc64 save/restfpr symnames for -Os build - module: add helper function for reading module_buildid() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - module: Fix kernel panic when a symbol st_shndx is out of bounds - mpls: add missing unregister_netdevice_notifier to mpls_init - mptcp: add-addr: always drop other suboptions - mptcp: allow subflow rcv wnd to shrink - mptcp: cleanup fallback dummy mapping generation - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: do not drop partial packets - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - mptcp: fastclose msk when linger time is 0 - MPTCP: fix lock class name family in pm_nl_create_listen_socket - mptcp: fix missing wakeups in edge scenarios - mptcp: fix receive space timestamp initialization - mptcp: fix retransmission loop when csum is enabled - mptcp: fix rx timestamp corruption on fastopen - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: fix slab-use-after-free in __inet_lookup_established - mptcp: handle first subflow closing consistently - mptcp: introduce the mptcp_init_skb helper - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: fix potential data-race - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: avoid sending RM_ADDR over same subflow - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation - mptcp: pm: in-kernel: always mark signal+subflow endp as used - mptcp: pm: in-kernel: always set ID as avail when rm endp - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: reset rcv wnd on disconnect - mptcp: sockopt: check timestamping ret value - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: sync the msk->sndbuf at accept() time - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use plain bool instead of custom binary enum - mtd: Avoid boot crash in RedBoot partition table parser - mtd: docg3: Convert to platform remove callback returning void - mtd: docg3: fix use-after-free in docg3_release() - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - mtd: physmap_of_gemini: Fix disabled pinctrl state check - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - mtd: rawnand: pl353: Fix software ECC support - mtd: rawnand: pl353: make sure optimal timings are applied - mtd: rawnand: serialize lock/unlock against other NAND operations - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: spinand: Fix kernel doc - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - mtd: spi-nor: sst: Fix SST write failure - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - myri10ge: avoid uninitialized variable use - neighbour: add RCU protection to neigh_tables[] - neigh: let neigh_xmit take skb ownership - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - net: add proper RCU protection to /proc/net/ptype - net: Add skb_dstref_steal and skb_dstref_restore - net: add support for segmenting TCP fraglist GSO packets - net: af_key: zero aligned sockaddr tail in PF_KEY exports - net: ag71xx: check error for platform_get_irq - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - net: annotate data-races around sk->sk_{data_ready,write_space} - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: fix leaking free_bds - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - net: bcmgenet: fix racing timeout handler - net: bcmgenet: increase WoL poll timeout - net: bcmgenet: Initialize u64 stats seq counter - net: bcmgenet: keep RBUF EEE/PM disabled - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: switch to use 64bit statistics - net: bonding: add broadcast_neighbor option for 802.3ad - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - net: bonding: fix NULL deref in bond_debug_rlb_hash_show - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - net: bonding: fix use-after-free in bond_xmit_broadcast() - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: bridge: Flush multicast groups when snooping is disabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net: bridge: use a stable FDB dst snapshot in RCU readers - net: caif: clear client service pointer on teardown - netconsole: avoid out-of-bounds access on empty string in trim_newline() - netconsole: propagate device name truncation in dev_name_store() - net: consume xmit errors of GSO frames - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - netdevsim: zero initialize struct iphdr in dummy sk_buff - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: dsa: microchip: Fix error path in PTP IRQ setup - net: dsa: mt7530: fix FDB entries not aging out with short timeout - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: properly keep track of conduit reference - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - net: enetc: fix the output issue of 'ethtool --show-ring' - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - net: ethernet: xscale: Check for PTP support properly - net: fec: fix pinctrl default state restore order on resume - net: fec: fix the PTP periodic output sysfs interface - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: bpf: defer hook memory release until rcu readers are done - netfilter: bridge: make ebt_snat ARP rewrite writable - netfilter: conntrack: add missing netlink policy validations - netfilter: conntrack_irc: fix possible out-of-bounds read - netfilter: conntrack: remove sprintf usage - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - netfilter: ctnetlink: ensure safe access to master conntrack - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() - netfilter: ctnetlink: ignore explicit helper on new expectations - netfilter: ctnetlink: remove refcounting in expectation dumpers - netfilter: ctnetlink: use netlink policy range checks - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: flowtable: strictly check for maximum number of actions - netfilter: ip6t_eui64: reject invalid MAC header for all packets - netfilter: ip6t_hbh: reject oversized option lists - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() - netfilter: ipset: drop logically empty buckets in mtype_del - netfilter: ipset: stop hash:* range iteration at end - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: nf_conncount: fix tracking of connections from localhost - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - netfilter: nf_conntrack_expect: honor expectation helper field - netfilter: nf_conntrack_expect: skip expectations in other netns via proc - netfilter: nf_conntrack_expect: store netns and zone in expectation - netfilter: nf_conntrack_expect: use expect->helper - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case - netfilter: nf_conntrack_helper: pass helper to expect cleanup - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp - netfilter: nf_conntrack_sip: get helper before allocating expectation - netfilter: nf_log: validate MAC header was set before dumping it - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_log: account for netlink header size - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: nf_tables: always walk all pending catchall elements - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - netfilter: nf_tables: reject immediate NF_QUEUE verdict - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: nf_tables: reset table validation state on abort - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_ct: add seqadj extension for natted connections - netfilter: nft_ct: bail out on template ct in get eval - netfilter: nft_ct: drop pending enqueued packets on removal - netfilter: nft_ct: fix missing expect put in obj eval - netfilter: nft_ct: fix use-after-free in timeout object destroy - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: nft_inner: Fix IPv6 inner_thoff desync - netfilter: nft_osf: restrict it to ipv4 - netfilter: nft_set_hash: fix get operation on big endian - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_tunnel: fix use-after-free on object destroy - netfilter: reject zero shift in nft_bitwise - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: skip recording stale or retransmitted INIT - netfilter: synproxy: add mutex to guard hook reference counting - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: x_tables: ensure names are nul-terminated - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: xtables: restrict several matches to inet family - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - netfilter: x_tables: unregister the templates first - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - netfilter: xt_multiport: validate range encoding in checkentry - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - netfilter: xt_policy: fix strict mode inbound policy matching - netfilter: xt_socket: enable defrag after all other checks - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: xt_time: use unsigned int for monthday bit shift - net: fix fanout UAF in packet_release() via NETDEV_UP race - net: Fix icmp host relookup triggering ip_rt_bug - net: fix segmentation of forwarding fraglist GRO - netfs: fix error handling in netfs_extract_user_iter() - netfs: Fix overrun check in netfs_extract_user_iter() - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net: ftgmac100: fix ring allocation unwind on open failure - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - net: gro: don't merge zcopy skbs - net: gso: fix tcp fraglist segmentation after pull from frag_list - net: guard timestamp cmsgs to real error queue skbs - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - net: hns3: extend HCLGE_FD_AD_QID to 11 bits - net: hns3: fix double free issue for tx spare buffer - net: hsr: defer node table free until after RCU readers - net: hsr: fix potential OOB access in supervision frame handling - net: hsr: fix VLAN add unwind on slave errors - net: ifb: report ethtool stats over num_tx_queues - net: intel: fix PCI device ID conflict between i40e and ipw2200 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: fix event ring index not programmed for IPA v5.0+ - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - net: ipv4: stop checking crypto_ahash_alignmask - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: ipv6: flowlabel: defer exclusive option free until RCU teardown - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak - net: ipv6: stop checking crypto_ahash_alignmask - net/iucv: fix locking in .getsockopt - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - netlabel: validate unlabeled address and mask attribute lengths - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: lan966x: avoid unregistering netdev on register failure - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - net: libwx: fix VF illegal register access - net: macb: fix clk handling on PCI glue driver removal - net: macb: Fix tx/rx malfunction after phy link down and up - net: macb: fix uninitialized rx_fs_lock - net: macb: fix use-after-free access to PTP clock - net: macb: Introduce gem_init_rx_ring() - net: macb: Move devm_{free,request}_irq() out of spin lock area - net: macb: properly unregister fixed rate clocks - net: macb: queue tie-off or disable during WOL suspend - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume - net: macb: Shuffle the tx ring before enabling tx - net: macb: Use dev_consume_skb_any() to free TX SKBs - net: macb: use the current queue number for stats - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: mana: fix use-after-free in add_adev() error path - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown - net: mana: Ring doorbell at 4 CQ wraparounds - net: mana: validate rx_req_idx to prevent out-of-bounds array access - net: mctp: ensure our nlmsg responses are initialised - net: mctp: fix don't require received header reserved bits to be zero - net: mctp i2c: check length before marking flow active - net: mctp-i2c: fix duplicate reception of old data - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - net/mlx5: Avoid "No data available" when FW version queries fail - net/mlx5: Do not restore destination-less TC rules - net/mlx5: DR, Fix circular locking dependency in dump - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5e: Fix features not applied during netdev registration - net/mlx5e: Fix race condition during IPSec ESN update - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Prevent concurrent access to IPSec ASO context - net/mlx5: Fix deadlock between devlink lock and esw->wq - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: Fix multiport device check over light SFs - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/mlx5: IFC updates for disabled host PF - net/mlx5: lag: Check for LAG device before creating debugfs - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net/mlx5: Query to see if host PF is disabled - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - net/mlx5: Update the list of the PCI supported devices - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mv643xx: fix OF node refcount - net: mvpp2: Add metadata support for xdp mode - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - net: mvpp2: limit XDP frame size to the RX buffer - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: sync RX data at the hardware packet offset - net: ncsi: fix skb leak in error paths - net: netconsole: move newline trimming to function - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - net: nfc: nci: Fix parameter validation for packet data - net: nfc: nci: Fix zero-length proprietary notifications - netns-ipv4: reorganize netns_ipv4 fast path variables - net: openvswitch: Avoid releasing netdev before teardown completes - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - net: phonet: free phonet_device after RCU grace period - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: phy: clean the sfp upstream if phy probing fails - net: phy: dp83869: fix setting CLK_O_SEL field. - net: phy: DP83TC811: add reading of abilities - net: phy: move at803x PHY driver to dedicated directory - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: qrtr: ns: Fix use-after-free in driver remove() - net: qrtr: ns: Free the node during ctrl_cmd_bye() - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: qrtr: ns: Limit the total number of nodes - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - net: rds: clear i_sends on setup unwind - net/rds: Clear reconnect pending bit - net/rds: Fix circular locking dependency in rds_tcp_tune - net: rds: fix MR cleanup on copy error - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - net/rds: handle zerocopy send cleanup before the message is queued - net/rds: No shortcut out of RDS_CONN_ERROR - net/rds: Optimize rds_ib_laddr_check - net/rds: rds_sendmsg should not discard payload_len - net/rds: reset op_nents when zerocopy page pin fails - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: zero per-item info buffer before handing it to visitors - net: remove WARN_ON_ONCE when accessing forward path array - net: rfkill: prevent unlimited numbers of rfkill events from being created - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - net/sched: act_api: use RCU with deferred freeing for action lifecycle - net: sched: act_csum: validate nested VLAN headers - net/sched: act_ct: Only release RCU read lock after ct_ft - net/sched: act_gate: snapshot parameters with RCU on replace - net/sched: act_ife: Fix metalist update behavior - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - net/sched: cls_flower: revert unintended changes - net/sched: cls_flow: fix NULL pointer dereference on shared blocks - net/sched: cls_fw: fix NULL dereference of "old" filters before change() - net/sched: cls_fw: fix NULL pointer dereference on shared blocks - net/sched: ets: fix divide by zero in the offload path - net/sched: fix pedit partial COW leading to page cache corruption - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix probability gaps in 4-state loss model - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: validate slot configuration - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/sched: sch_netem: fix out-of-bounds access in packet corruption - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: taprio: fix NULL pointer dereference in class dump - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - net/sched: teql: Fix double-free in teql_master_xmit - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - net: sfp: improve Huawei MA5671a fixup - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net: skb: fix cross-cache free of KFENCE-allocated skb head - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - net: skbuff: fix pskb_carve leaking zcopy pages - net: skbuff: preserve shared-frag marker during coalescing - net: skbuff: propagate shared-frag marker through frag-transfer helpers - net: skmsg: preserve sg.copy across SG transforms - net/smc: avoid early lgr access in smc_clc_wait_msg - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - net/smc: Do not re-initialize smc hashtables - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - net: sparx5/lan969x: fix PTP clock max_adj value - net: stmmac: avoid shadowing global buf_sz - net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz - net: stmmac: Fix error handling in VLAN add and delete paths - net: stmmac: fix integer underflow in chain mode - net: stmmac: Fix PTP ref clock for Tegra234 - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: remove support for lpi_intr_o - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: strparser: fix skb_head leak in strp_abort_strp() - net: sunhme: Fix sbus regression - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers - net: tcp: accept old ack during closing - net/tcp-md5: Fix MAC comparison to be constant-time - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net: tls: fix strparser anchor skb leak on offload RX setup failure - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption - net: tls: prevent chain-after-chain in plain text SG - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - net: txgbe: fix firmware version check - net: txgbe: fix RTNL assertion warning when remove module - net: txgbe: leave space for null terminators on property_entry - net: usb: aqc111: Do not perform PM inside suspend callback - net: usb: catc: enable basic endpoint checking - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - net: usb: kalmia: validate USB endpoints - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode - net: usb: kaweth: validate USB endpoints - net: usb: lan78xx: fix silent drop of packets with checksum errors - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: pegasus: enable basic endpoint checking - net: usb: pegasus: validate USB endpoints - net: usb: r8152: add TRENDnet TUC-ET2G - net: usb: r8152: fix transmit queue timeout - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: sr9700: remove code to drive nonexistent multicast filter - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - nexthop: fix IPv6 route referencing IPv4 nexthop - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - nfc: hci: fix out-of-bounds read in HCP header parsing - nfc: hci: shdlc: Stop timers and work before freeing context - nfc: llcp: add missing return after LLCP_CLOSED checks - nfc: llcp: Fix use-after-free in llcp_sock_release() - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: complete pending data exchange on device close - nfc: nci: fix circular locking dependency in nci_close_device - nfc: nci: free skb on nci_transceive early error paths - NFC: nxp-nci: allow GPIOs to sleep - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems - nfc: nxp-nci: remove interrupt trigger type - nfc: pn533: allocate rx skb before consuming bytes - NFC: pn533: bound the UART receive buffer - nfc: pn533: properly drop the usb interface reference on disconnect - nfc: rawsock: cancel tx_work before socket teardown - nfc: s3fwrn5: allocate rx skb before consuming bytes - NFC: trf7970a: Ignore antenna noise when checking for RF field - nfnetlink_osf: validate individual option lengths in fingerprints - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - nfsd: check get_user() return when reading princhashlen - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - nfsd: fix posix_acl leak on SETACL decode failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - NFSD: Fix SECINFO_NO_NAME decode error cleanup - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd - nfsd: never defer requests during idmap lookup - NFS: Fix a deadlock involving nfs_release_folio() - nfs: pass explicit offset/count to trace events - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - NTB: ntb_transport: Fix too small buffer for debugfs_name - ntfs3: add buffer boundary checks to run_unpack() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ntfs: ->d_compare() must not block - nvdimm/bus: Fix potential use after free in asynchronous initialization - nvdimm: virtio_pmem: serialize flush requests - nvme-apple: drop invalid put of admin queue reference count - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme: fix admin queue leak on controller reset - nvme: fix memory allocation in nvme_pr_read_keys() - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nvmem: imx: assign nvmem_cell_info::raw_len - nvmem: layouts: onie-tlv: fix hang on unknown types - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - nvme-pci: cap queue creation to used queues - nvme-pci: ensure we're polling a polled queue - nvme-pci: fix missed admin queue sq doorbell write - nvme-pci: Fix race bug in nvme_poll_irqdisable() - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - nvme: reject invalid pr_read_keys() num_keys values - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free - nvmet-tcp: fix race between ICReq handling and queue teardown - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - objtool: Fix Clang jump table detection - objtool: Handle Clang RSP musical chairs - objtool: Remove max symbol name length limitation - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2: fix listxattr handling when the buffer is full - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: fix possible deadlock between unlink and dio_end_io_write - ocfs2: fix reflink preserve cleanup issue - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: reject oversized group bitmap descriptors - ocfs2: split transactions in dio completion to avoid credit exhaustion - ocfs2: validate bg_bits during freefrag scan - ocfs2: validate group add input before caching - ocfs2: validate inline data i_size during inode read - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: disable per ring interrupts - octeon_ep: ensure dbell BADDR updation - octeon_ep: Relocate counter updates before NAPI - octeon_ep: restructured interrupt handlers - octeon_ep: set backpressure watermark for RX queues - octeon_ep: support Octeon CN10K devices - octeon_ep: support to fetch firmware info - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: CGX: fix bitmap leaks - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: Fix default entries mcam entry action - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - octeontx2-af: Fix PF driver crash with kexec kernel booting - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - octeontx2-af: replace deprecated strncpy with strscpy - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - octeontx2-pf: avoid double free of pool->stack on AQ init failure - octeontx2-pf: Unregister devlink on probe failure - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - of: unittest: fix use-after-free in testdrv_probe() - openrisc: define arch-specific version of nop() - openvswitch: cap upcall PID array size and pre-size vport replies - openvswitch: defer tunnel netdev_put to RCU release - openvswitch: validate MPLS set/set_masked payload length - openvswitch: vport: fix self-deadlock on release of tunnel ports - ovl: Fix uninit-value in ovl_fill_real - padata: Fix pd UAF once and for all - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove comment for reorder_work - padata: Remove cpu online check from cpu add and removal - params: Replace __modinit with __init_or_module - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - parisc: Fix IRQ leak in LASI driver - parisc: Flush correct cache in cacheflush() syscall - parisc: Increase initial mapping to 64 MB with KALLSYMS - parisc: kernel: replace kfree() with put_device() in create_tree_node() - parisc: _llseek syscall is only available for 32-bit userspace - parisc: Prevent interrupts during reboot - parport: Fix race between port and client registration - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI/AER: Clear only error bits in PCIe Device Status - PCI/AER: Stop ruling out unbound devices as error source - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - PCI: Do not attempt to set ExtTag for VFs - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Enable AtomicOps only if Root Port supports them - PCI: endpoint: Avoid creating sub-groups asynchronously - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup - PCI: endpoint: Remove unused field in struct pci_epf_group - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - PCI: Fix pci_slot_lock () device locking - PCI: Fix pci_slot_trylock() error handling - PCI: hv: Set default NUMA node to 0 for devices without affinity info - PCI: Initialize RCB from pci_configure_device() - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - PCI: Mark ASM1164 SATA controller to avoid bus reset - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI/MSI: Unmap MSI-X region on error - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - PCI/portdrv: Fix potential resource leak - PCI: Supply bridge device, not secondary bus, to read window details - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Fix polling delay for L2 state - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Use DWC IP core version - PCI: Update BAR # and window messages - PCI: Use resource names in PCI log messages - PCI: Use resource_set_range() that correctly sets ->end - PCMCIA: Fix garbled log messages for KERN_CONT - pcnet32: stop holding device spin lock during napi_complete_done - pds_core: add an error code check in pdsc_dl_info_get - pds_core: ensure null-termination for firmware version strings - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - perf/arm-cmn: Reject unsupported hardware configurations - perf/arm-cmn: Support CMN-600AE - perf: arm_spe: Properly set hw.state on failures - perf branch: Avoid incrementing NULL - perf callchain: Fix srcline printing with inlines - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf: Extract a few helpers - perf: Fix dangling cgroup pointer in cpuctx - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - perf lock: Fix option value type in parse_max_stack - perf: Make sure to use pmu_ctx->pmu for groups - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf unwind-libdw: Fix invalid reference counts - perf util: Kill die() prototype, dead for a long time - perf/x86/intel/uncore: Skip discovery table for offline dies - phonet: Pass ifindex to fill_addr(). - phonet: Pass net and ifindex to phonet_address_notify(). - phonet/pep: disable BH around forwarded sk_receive_skb() - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - phy: tegra: xusb: Fix per-pad high-speed termination calibration - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - pidfd: refuse access to tasks that have started exiting harder - pinctrl: abx500: Fix type of 'argument' variable - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - pinctrl: mediatek: common: Fix probe failure for devices without EINT - pinctrl: pinctrl-pic32: Fix resource leak - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - ping: annotate data-races in ping_lookup() - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - platform/chrome: cros_ec_lightbar: Fix response size initialization - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - platform/surface: surfacepro3_button: Drop wakeup source on remove - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro - platform/x86/amd/pmc: Add support for Van Gogh SoC - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - platform/x86: classmate-laptop: Add missing NULL pointer checks - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: hp-bioscfg: Support allocations of larger data - platform/x86: hp-wmi: Ignore backlight and FnLock events - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery - platform/x86: ISST: Correct locked bit width - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - platform/x86: panasonic-laptop: Fix sysfs group leak in error path - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - pmdomain: bcm: bcm2835-power: Fix broken reset status read - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - pmdomain: core: Fix detach procedure for virtual devices in genpd - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - PM: hibernate: Don't ignore return from set_memory_ro() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: runtime: Fix a race condition related to device removal - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - pNFS: Fix a deadlock when returning a delegation during open() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - pNFS: Fix use-after-free in pnfs_update_layout() - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - powerpc64/bpf: do not increment tailcall count when prog is NULL - powerpc: 83xx: km83xx: Fix keymile vendor prefix - powerpc/crash: fix backup region offset update to elfcorehdr - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - powerpc/warp: Fix error handling in pika_dtm_thread - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: ab8500: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: axp288_charger: Do not cancel work before initializing it - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: max17042: avoid overflow when determining health - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - pppoe: drop PFC frames - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - printk: add print_hex_dump_devel() - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - pstore: ram_core: fix incorrect success return when vmap() fails - pstore/ram: fix buffer overflow in persistent_ram_save_old() - pstore/ram: fix resource leak when ioremap() fails - ptp: vclock: Switch from RCU to SRCU - ptrace: Convert ptrace_attach() to use lock guards - ptrace: slightly saner 'get_dumpable()' logic - pwm: imx-tpm: Count the number of enabled channels in probe - qed: fix double free in qed_cxt_tables_alloc() - quota: fix livelock between quotactl and freeze_super - quota: Fix race of dquot_scan_active() with quota deactivation - r8152: fix incorrect register write to USB_UPHY_XTAL - r8152: handle the return value of usb_reset_device() - randomize_kstack: Maintain kstack_offset per task - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - rbd: fix null-ptr-deref when device_add_disk() fails - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: s/boost_kthread_mutex/kthread_mutex - RDMA/bnxt_re: zero shared page before exposing to userspace - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - RDMA/core: Fix a couple of obvious typos in comments - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - RDMA/core: Prefer NLA_NUL_STRING - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - RDMA/efa: Fix typo in efa_alloc_mr() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - RDMA/hns: Fix WQ_MEM_RECLAIM warning - RDMA/hns: Notify ULP of remaining soft-WCs during reset - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Fix double free related to rereg_user_mr - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - RDMA/irdma: Initialize free_qp completion before using it - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - RDMA/mana_ib: Disable RX steering on RSS QP destroy - RDMA/mana: Validate rx_hash_key_len - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - RDMA: Move DMA block iterator logic into dedicated files - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/rtrs-clt: For conn rejection use actual err number - RDMA/rtrs: Fix use-after-free in path file creation cleanup - RDMA/rtrs: server: remove dead code - RDMA/rtrs-srv: fix SG mapping - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - RDMA/siw: Fix potential NULL pointer dereference in header processing - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - RDMA/srp: bound SRP_RSP sense copy by the received length - RDMA/umad: Reject negative data_len in ib_umad_write - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/umem: fix kernel-doc warnings - RDMA/umem: Fix truncation for block sizes >= 4G - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - rds: ib: reject FRMR registration before IB connection is established - rds: mark snapshot pages dirty in rds_info_getsockopt() - regmap: Synchronize cache for the page selector - regset: use kvzalloc() for regset_get_alloc() - regulator: act8945a: fix OF node reference imbalance - regulator: bd9571mwv: fix OF node reference imbalance - regulator: core: fix locking in regulator_resolve_supply() error path - regulator: core: move supply check earlier in set_machine_constraints() - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - regulator: pca9450: Correct interrupt type - regulator: pca9450: Make IRQ optional - regulator: rk808: fix OF node reference imbalance - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - remoteproc: imx_rproc: Fix invalid loaded resource table detection - remoteproc: mediatek: Break lock dependency to `prepare_lock` - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - remoteproc: xlnx: Only access buffer information if IPI is buffered - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - resource: Add resource set range and size helpers - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "ALSA: usb: Increase volume range that triggers a warning" - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - Revert "crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx" - Revert "crypto: nx - fix context leak in nx842_crypto_free_ctx" - Revert "crypto: nx - Migrate to scomp API" - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" - Revert "ice: fix double-free of tx_buf skb" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "mfd: da9052-spi: Change read-mask to write-mask" - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - Revert "mptcp: add needs_id for netlink appending addr" - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - Revert "perf unwind-libdw: Fix invalid reference counts" - Revert "ptp: add testptp mask test" - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "selftest/ptp: update ptp selftest to exercise the gettimex options" - Revert "tcpm: allow looking for role_sw device in the main node" - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - Revert "wireguard: device: enable threaded NAPI" - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - Revert "x86/vdso: Fix output operand size of RDPID" - Revert "xattr: switch to CLASS(fd)" - ring-buffer: Fix reporting of missed events in iterator - ring-buffer: Remove ring_buffer_read_prepare_sync() - riscv: kgdb: fix several debug register assignment bugs - riscv: Sanitize syscall table indexing under speculation - rnbd-srv: Zero the rsp buffer before using it - romfs: check sb_set_blocksize() return value - rpmsg: char: Fix use-after-free on probe error path - rpmsg: core: fix race in driver_override_show() and use core helper - rseq: Clarify rseq registration rseq_size bound check comment - rtc: abx80x: Disable alarm feature if no interrupt attached - rtc: interface: Alarm race handling should not discard preceding error - rtc: ntxec: fix OF node reference imbalance - rtc: zynqmp: correct frequency value - rtmutex: Use waiter::task instead of current in remove_waiter() - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - rust: kunit: fix warning when !CONFIG_PRINTK - rust: pin-init: add references to previously initialized fields - rust: pin-init: internal: init: document load-bearing fact of field accessors - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix anonymous key handling - rxrpc: Fix call removal to use RCU safe deletion - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - rxrpc: Fix data-race warning and potential load/store tearing - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: Fix key quota calculation for multitoken keys - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix memory leaks in rxkad_verify_response() - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - rxrpc: Fix potential UAF after skb_unshare() failure - rxrpc: Fix recvmsg() unconditional requeue - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix the ACK parser to extract the SACK table for parsing - rxrpc: only handle RESPONSE during service challenge - rxrpc: Only put the call ref if one was acquired - rxrpc: reject undecryptable rxkad response tickets - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - s390/cio: make sch->lock spinlock pointer a member - s390/cio: use generic driver_override infrastructure - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - s390/debug: Reject zero-length input before trimming a newline - s390/debug: Reject zero-length input in debug_input_flush_fn() - s390/entry: Scrub r12 register on kernel entry - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - s390/pci: Handle futile config accesses of disabled devices directly - s390/perf: Disable register readout on sampling events - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/syscalls: Add spectre boundary for syscall dispatch table - s390/xor: Fix xor_xc_2() inline assembly constraints - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - sched/fair: Fix pelt clock sync when entering idle - sched: idle: Consolidate the handling of two special cases - sched: idle: Make skipping governor callbacks more consistent - sched/rt: Skip currently executing CPU in rto_next_cpu() - sched: Use u64 for bandwidth ratio calculations - scripts/dtc: Remove unused dts_version in dtc-lexer.l - scripts: generate_rust_analyzer.py: avoid FD leak - scripts: generate_rust_analyzer.py: define scripts - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Have mcount rela sort use direct values - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused macro defines - scripts/sorttable: Remove unused write functions - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Zero out weak functions in mcount_loc table - scsi: buslogic: Reduce stack usage - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - scsi: csiostor: Fix dereference of null pointer rn - scsi: efct: Use IRQF_ONESHOT and default primary handler - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec - scsi: hisi_sas: Fix NULL pointer exception during user_scan() - scsi: hisi_sas: Use macro instead of magic number - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - scsi: isci: Fix use-after-free in device removal path - scsi: lpfc: Properly set WC for DPP mapping - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: qla2xxx: Fix bsg_done() causing double free - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - scsi: ses: Fix devices attaching to different hosts - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - scsi: target: core: Fix integer overflow in UNMAP bounds check - scsi: target: Fix recursive locking in __configfs_open_file() - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: tcm_loop: Drain commands in target_reset handler - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix use-after free in init error and remove paths - scsi: ufs: core: Flush exception handling work when RPM level is zero - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - scsi: ufs: host: mediatek: Require CONFIG_PM - sctp: diag: reject stale associations in dump_one path - sctp: discard stale INIT after handshake completion - sctp: fix missing encap_port propagation for GSO fragments - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - sctp: fix race between sctp_wait_for_connect and peeloff - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - sctp: purge outqueue on stale COOKIE-ECHO handling - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - sctp: stream: fully roll back denied add-stream state - security/keys: fix missed RCU read section on lookup - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - seg6: separate dst_cache for input and output paths in seg6 lwtunnel - selftest/arm64: Fix sve2p1_sigill() to hwcap test - selftest: memcg: skip memcg_sock test if address family not supported - selftests/bpf: add stack access precision test - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - selftests/bpf: Tests for per-insn sync_linked_regs() precision tracking - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: veristat: fix printing order in output_stats() - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests/memfd: delete unused declarations - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - selftests/mm: skip migration tests if NUMA is unavailable - selftests: mptcp: add a check for 'add_addr_accepted' - selftests: mptcp: add test for extra_subflows underflow on userspace PM - selftests: mptcp: drop nanoseconds width specifier - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: join: check RM_ADDR not sent over same subflow - selftests: mptcp: more stable simult_flows tests - selftests/mqueue: Fix incorrectly named file - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - selftests/powerpc: Re-order *FLAGS to follow lib.mk - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selinux: don't reserve xattr slot when we won't fill it - selinux: fix overlayfs mmap() and mprotect() access checks - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - serdev: make serdev_bus_type const - serdev: Provide a bustype shutdown function - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_dw: handle clock enable errors in runtime_resume - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: 8250: Fix TX deadlock when using DMA - serial: 8250_pci: add support for the AX99100 - serial: altera_jtaguart: handle uart_add_one_port() failures - serial: caif: fix use-after-free in caif_serial ldisc_close() - serial: caif: hold tty->link reference in ldisc_open and ser_release - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: imx: change SERIAL_IMX_CONSOLE to bool - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: samsung_tty: Use port lock wrappers - serial: sh-sci: fix memory region release in error path - serial: SH_SCI: improve "DMA support" prompt - serial: uartlite: fix PM runtime usage count underflow on probe - serial: zs: Convert to use a platform device - serial: zs: Fix bootconsole handover lockup - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: zs: Switch to using channel reset - sfc: fix error code in efx_devlink_info_running_versions() - sh: platform_early: remove pdev->driver_override check - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: fix OF node refcount - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - smb: client: add proper locking around ses->iface_last_update - smb: client: Compare MACs in constant time - smb: client: correctly handle ErrorContextData as a flexible array - smb: client: correct value for smbd_max_fragmented_recv_size - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - smb: client: fix atomic open with O_DIRECT & O_SYNC - smb: client: fix broken multichannel with krb5+signing - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb: client: fix cifs_pick_channel when channels are equally loaded - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - smb: client: fix krb5 mount with username option - smb: client: fix off-by-8 bounds check in check_wsl_eas() - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path - smb: client: fix OOB reads parsing symlink error response - smb/client: fix out-of-bounds read in smb2_compound_op() - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix possible infinite loop and oob read in symlink_data() - smb: client: fix potential UAF and double free in smb2_open_file() - smb: client: prevent races in ->query_interfaces() - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - smb: client: reject userspace cifs.spnego descriptions - smb: client: require a full NFS mode SID before reading mode bits - smb: client: require net admin for CIFS SWN netlink - smb: client: Use FullSessionKey for AES-256 encryption key derivation - smb: client: use kzalloc to zero-initialize security descriptor buffer - smb: client: validate dacloffset before building DACL pointers - smb: client: validate the whole DACL before rewriting it in cifsacl - smb: common: change the data type of num_aces to le16 - smb: move some duplicate definitions to common/smbacl.h - smb: server: fix active_num_conn leak on transport allocation failure - smb/server: Fix another refcount leak in smb2_open() - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix use-after-free in smb2_open() - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - soc: fsl: qbman: fix race condition in qman_destroy_fq - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - soc: qcom: llcc: fix v1 SB syndrome register offset - soc: qcom: ocmem: make the core clock optional - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: smem: handle ENOMEM error during probe - soc/tegra: cbb: Set ERD on resume for err interrupt - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - soc: ti: k3-socinfo: Fix regmap leak on probe failure - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - sound: ua101: fix division by zero at probe - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - soundwire: cadence: Clear message complete before signaling waiting thread - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - spi: at91-usart: fix controller deregistration - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: cadence: fix controller deregistration - spi: cadence: fix unclocked access on unbind - spi: coldfire-qspi: fix controller deregistration - spi: dln2: fix controller deregistration - spi: fix resource leaks on device setup failure - spi: fix statistics allocation - spi: fix use-after-free on controller registration failure - spi: fsl-espi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: fsl-qspi: Use reinit_completion() for repeated operations - spi: geni-qcom: Check DMA interrupts early in ISR - spi-geni-qcom: initialize mode related registers to 0 - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - spi: img-spfi: fix controller deregistration - spi: imx: fix runtime pm leak on probe deferral - spi: imx: fix use-after-free on unbind - spi: intel-pci: Add support for Nova Lake mobile SPI flash - spi: lantiq-ssc: fix controller deregistration - spi: meson-spicc: Fix double-put in remove path - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - spi: mpc52xx: fix use-after-free on unbind - spi: mtk-nor: fix controller deregistration - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - spi: omap2-mcspi: fix controller deregistration - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: qup: fix controller deregistration - spi: qup: fix error pointer deref after DMA setup failure - spi: rockchip: fix controller deregistration - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - spi: rspi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: s3c64xx: fix NULL-deref on driver unbind - spi: sh-hspi: fix controller deregistration - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - spi: spidev: fix lock inversion between spi_lock and buf_lock - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: spi-ti-qspi: switch to use modern name - spi: sprd: fix controller deregistration - spi: sprd: fix error pointer deref after DMA setup failure - spi: stm32: fix Overrun issue at < 8bpw - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - spi: tegra114: fix controller deregistration - spi: tegra20-sflash: fix controller deregistration - spi: ti-qspi: fix controller deregistration - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: tools: Add include folder to .gitignore - spi: topcliff-pch: fix use-after-free on unbind - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - spi: zynqmp-gqspi: fix controller deregistration - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - Squashfs: check metadata block offset is within range - staging: greybus: lights: avoid NULL deref - staging: media: atomisp: Disallow all private IOCTLs - staging: rtl8723bs: fix memory leak on failure path - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - staging: rtl8723bs: fix null dereference in find_network - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() - staging: sm750fb: fix division by zero in ps_to_hz() - staging: vme_user: fix root device leak on init failure - string: add mem_is_zero() helper to check if memory area is all zeros - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - sunrpc: fix cache_request leak in cache_release - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Remove queue-shortening warnings - sysctl: fix uninitialized variable in proc_do_large_bitmap - sysfs: don't remove existing directory on update failure - tap: free page on error paths in tap_get_user_xdp() - taskstats: set version in TGID exit notifications - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: call sk_data_ready() after listener migration - tcp: defer regular ACK while processing socket backlog - tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. - tcp: Fix imbalanced icsk_accept_queue count. - tcp: optimize inet_use_bhash2_on_bind() - tcp: Rearrange tests in inet_csk_bind_conflict(). - tcp: restrict SO_ATTACH_FILTER to priv users - tcp: Set pingpong threshold via sysctl - tcp: tcp_tx_timestamp() must look at the rtx queue - tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. - tee: optee: prevent use-after-free when the client exits before the supplicant - test_kprobes: clear kprobes between test runs - tg3: Fix race for querying speed/duplex - tg3: replace placeholder MAC address with device property - thermal: core: Fix thermal zone device registration error path - thermal: core: Fix thermal zone governor cleanup issues - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - thermal: int340x: Fix sysfs group leak on DLVR registration failure - thunderbolt: Bound root directory content to block size - thunderbolt: Clamp XDomain response data copy to allocation size - thunderbolt: Fix property read in nhi_wake_supported() - thunderbolt: Limit XDomain response copy to actual frame size - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - thunderbolt: Reject zero-length property entries in validator - thunderbolt: Validate XDomain request packet size before type cast - time: Fix off-by-one in settimeofday() usec validation - time/jiffies: Mark jiffies_64_to_clock_t() notrace - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG - tipc: fix divide-by-zero in tipc_sk_filter_connect() - tipc: fix double-free in tipc_buf_append() - tipc: fix duplicate publication key in tipc_service_insert_publ() - tipc: fix RCU dereference race in tipc_aead_users_dec() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - tls: Preserve sk_err across recvmsg() when data has been copied - tls: Purge async_hold in tls_decrypt_async_wait() - tools/accounting: handle truncated taskstats netlink messages - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - tools: Fix bitfield dependency failure - tools/power cpupower: Reset errno before strtoull() - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - tools/rv: Fix cleanup after failed trace setup - tpm: avoid -Wunused-but-set-variable - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - tpm: tpm_tis: add error logging for data transfer - tpm: tpm_tis: stop transmit if retries are exhausted - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() - tracing: Add NULL pointer check to trigger_data_free() - tracing: Add recursion protection in kernel stack trace recording - tracing: Avoid NULL return from hist_field_name() on truncation - tracing: branch: Fix inverted check on stat tracer registration - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - tracing: Fix checking of freed trace_event_file for hist files - tracing: Fix false sharing in hwlat get_sample() - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Fix syscall events activation by ensuring refcount hits zero - tracing: Fix to set write permission to per-cpu buffer_size_kb - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - tracing/probe: reject non-closed empty immediate strings - tracing/probes: Limit size of event probe to 3K - tracing/probes: Point the error offset correctly for eprobe argument error - tracing: Properly process error handling in event_hist_trigger_parse() - tracing: Rebuild full_name on each hist_field_name() call - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Switch trace_osnoise.c code over to use guard() and __free() - tracing: Wake up poll waiters for hist files when removing an event - tty: hvc_iucv: fix off-by-one in number of supported devices - tty: serial: pch_uart: add check for dma_alloc_coherent() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - tun: free page on build_skb failure in tun_xdp_one() - tun: free page on short-frame rejection in tun_xdp_one() - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - ublk: Validate SQE128 flag before accessing the cmd - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - udf: fix partition descriptor append bookkeeping - udf: reject descriptors with oversized CRC length - udp: clear skb->dev before running a sockmap verdict - udp: Fix wildcard bind conflict check when using hash2 - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n - um: drivers: call kernel_strrchr() explicitly in cow_user.c - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - unshare: fix unshare_fs() handling - USB: add QUIRK_NO_BOS for video capture several devices - usb: bdc: fix sleep during atomic - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() - usb: cdns3: fix role switching during resume - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue - usb: cdns3: gadget: fix request skipping after clearing halt - usb: cdns3: gadget: fix state inconsistency on gadget init failure - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: remove redundant if branch - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: core: convert ci_role_switch to local variable - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: class: cdc-wdm: fix reordering issue in read code path - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: core: Fix SuperSpeed root hub wMaxPacketSize - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - USB: core: Limit the length of unkillable synchronous timeouts - usb: core: new quirk to handle devices with zero configurations - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - usb: dwc2: fix resume failure if dr_mode is host - usb: dwc2: Fix use after free in debug code - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: dwc3: gadget: Move vbus draw to workqueue context - usb: dwc3: Move GUID programming after PHY initialization - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: ehci-brcm: fix sleep during atomic - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - usb: gadget: f_ncm: Fix net_device lifecycle with device_move - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: net2280: Fix double free in probe error path - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: image: mdc800: kill download URB on timeout - usbip: validate number_of_packets in usbip_pack_ret_submit() - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: mdc800: handle signal and read racing - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - USB: omap_udc: DMA: Don't enable burst 4 mode - usb: port: add delay after usb_hub_set_port_power() - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - USB: serial: belkin_sa: validate interrupt status length - USB: serial: cypress_m8: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: digi_acceleport: fix memory corruption with small endpoints - USB: serial: f81232: fix incomplete serial port generation - USB: serial: io_edgeport: add support for Blackbox IC135A - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - USB: serial: io_ti: fix heap overflow in get_manuf_info() - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: kl5kusb105: fix bulk-out buffer overflow - USB: serial: mct_u232: fix memory corruption with small endpoint - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: option: add MeiG Smart SRM825WN - USB: serial: option: add MeiG SRM813Q - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: option: add Telit Cinterion FN990A MBIM composition - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: serial: option: add Telit FN920C04 RNDIS compositions - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: storage: Add quirks for PNY Elite Portable SSD - usb: storage: Expand range of matched versions for VL817 quirks entry - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: tcpm: reset internal port states on soft reset AMS - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - usb: typec: ucsi: Check if power role change actually happened before handling - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: Don't update power_supply on power role change if not connected - usb: typec: ucsi: Move unregister out of atomic section - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - usb: typec: ucsi: validate connector number in ucsi_connector_change() - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: ulpi: fix double free in ulpi_register_interface() error path - usb: ulpi: fix memory leak on ulpi_register() error paths - USB: usbcore: Introduce usb_bulk_msg_killable() - usb: usblp: fix heap leak in IEEE 1284 device ID via short response - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts - usb: xhci: Fix memory leak in xhci_disable_slot() - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - usb: xhci: Prevent interrupt storm on host controller error (HCE) - usb: yurex: fix race in probe - userfaultfd: allow registration of ranges below mmap_min_addr - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - vfio: Create vfio_fs_type with inode per device - vfio/pci: Insert full vma on mmap'd MMIO fault - vfio/pci: Use unmap_mapping_range() - vhost: fix caching attributes of MMIO regions by setting them explicitly - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - virtiofs: fix UAF on submount umount - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false - virt: vbox: uapi: Mark inner unions in packed structs as packed - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - vrf: Fix a potential NPD when removing a port from a VRF - vsock: fix buffer size clamping order - vsock: keep poll shutdown state consistent - vsock/virtio: fix accept queue count leak on transport mismatch - vsock/virtio: fix length and offset in tap skb for split packets - vsock/virtio: reset connection on receiving queue overflow - vsock/vmci: fix sk_ack_backlog leak on failed handshake - vsock/vmci: fix UAF when peer resets connection during handshake - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - vxlan: validate ND option lengths in vxlan_na_create - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - watchdog: imx7ulp_wdt: handle the nowayout option - watchdog: starfive-wdt: Fix PM reference leak in probe error path - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - wifi: ath11k: clear shared SRNG pointer state on restart - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - wifi: ath11k: fix warning when unbinding - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: skip status ring entry processing - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath5k: do not access array OOB - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: brcmfmac: Fix error pointer dereference - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: brcmfmac: validate bsscfg indices in IF events - wifi: brcmsmac: Fix dma_free_coherent() size - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - wifi: cfg80211: wext: fix IGTK key ID off-by-one - wifi: cw1200: Fix locking in error paths - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - wifi: iwlwifi: mvm: check the validity of noa_len - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: libertas: fix use-after-free in lbs_free_adapter() - wifi: libertas: fix WARNING in usb_tx_block - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: mac80211: fix NULL deref in mesh_matches_local() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. - wifi: mac80211: remove station if connection prep fails - wifi: mac80211: set default WMM parameters on all links - wifi: mt76: connac: introduce helper for mt7925 chipset - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7921: fix a potential clc buffer length underflow - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - wifi: nl80211: reject oversized EMA RNR lists - wifi: radiotap: reject radiotap with unknown bits - wifi: rsi: fix kthread lifetime race between self-exit and external-stop - wifi: rt2x00usb: fix devres lifetime - wifi: rtl8xxxu: fix potential use of uninitialized value - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: check for PCI upstream bridge existence - wifi: rtw88: fix device leak on probe failure - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw89: pci: restore LDO setting after device resume - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - wifi: wl1251: validate packet IDs before indexing tx_frames - wifi: wlcore: Fix a locking bug - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom - wireguard: send: append trailer after expanding head - workqueue: Factor out assign_rescuer_work() - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - workqueue: Only assign rescuer work when really needed - workqueue: Process rescuer work items one-by-one using a cursor - X.509: Fix out-of-bounds access when parsing extensions - x86/apic: Disable x2apic on resume if the kernel expects so - x86/CPU/AMD: Call the spectral chicken in the Zen2 init function - x86/CPU/AMD: Move the Zen3 BTC_NO detection to the Zen3 init function - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache - x86/CPU/AMD: Rename init_amd_zn() to init_amd_zen_common() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - x86/CPU: Fix FPDSS on Zen1 - x86/efi: defer freeing of boot services memory - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/hyperv: Fix error pointer dereference - x86/kexec: add a sanity check on previous kernel's ima kexec buffer - x86/kexec: Copy ACPI root pointer address from config table - x86/kexec: Disable KCOV instrumentation after load_segments() - x86/platform/uv: Handle deconfigured sockets - x86/sev: Allow IBPB-on-Entry feature for SNP guests - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - x86: shadow stacks: proper error handling for mmap lock - x86/shstk: Prevent deadlock during shstk sigreturn - x86/uprobes: Fix XOL allocation failure for 32-bit tasks - x86/xen: Fix xen_e820_swap_entry_with_ram() - x86/xen: make some functions static - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - xattr: switch to CLASS(fd) - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - xenbus: Use .freeze/.thaw to handle xenbus devices - xen-netback: reject zero-queue configuration from guest - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: fix double free via VMA splitting - xen/privcmd: restrict usage in unprivileged domU - xen/virtio: Don't use grant-dma-ops when running as Dom0 - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - xfrm: ah: account for ESN high bits in async callbacks - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - xfrm: call xdo_dev_state_delete during state update - xfrm: Check for underflow in xfrm_state_mtu - xfrm: clear trailing padding in build_polexpire() - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: esp: avoid in-place decrypt on shared skb frags - xfrm: espintcp: do not reuse an in-progress partial send - xfrm: esp: restore combined single-frag length gate - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path - xfrm: Fix the usage of skb->sk - xfrm: input: hold netns during deferred transport reinjection - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - xfrm: provide message size for XFRM_MSG_MAPPING - xfrm: route MIGRATE notifications to caller's netns - xfrm: skip templates check for packet offload tunnel mode - xfrm_user: fix info leak in build_mapping() - xfrm_user: fix info leak in build_report() - xfrm: Wait for RCU readers during policy netns exit - xfs: avoid dereferencing log items after push callbacks - xfs: delete attr leaf freemap entries when empty - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix a resource leak in xfs_alloc_buftarg() - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: fix integer overflow in bmap intent sort comparator - xfs: fix remote xattr valuelblk check - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: fix undersized l_iclog_roundoff values - xfs: mark data structures corrupt on EIO and ENODATA - xfs: save ailp before dropping the AIL lock in push callbacks - xfs: stop reclaim before pushing AIL during unmount - xhci: tegra: Fix ghost USB device on dual-role port unplug - xprtrdma: Decrement re_receiving on the early exit paths - xsk: Fix fragment node deletion to prevent buffer leak - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: Fix zero-copy AF_XDP fragment drop - xsk: Get rid of xdp_buff_xsk::xskb_list_node - xsk: introduce helper to determine rxq->frag_size - xsk: respect tailroom for ZC setups - xsk: s/free_list_node/list_node/ - xsk: tighten UMEM headroom validation to account for tailroom and min frame - xsk: validate MTU against usable frame size on bind - zonefs: handle integer overflow in zonefs_fname_to_fno - zram: do not forget to endio for partial discard requests - zram: fix use-after-free in zram_bvec_write_partial() - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Fix CIFSwitch vulnerability- FIX GPO Frag vulnerability- Fix PinTheft- Fix memory leak in AFS code- Fix CVE-2026-46300, CVE-2026-46333, CVE-2025-54518- Remove dead, not used patches- Fix Dirtyfrag- Fix CVE-2026-31431 (Copyfail)- Fix regression with touchpad on notebook Positron Proxima 15 and probably others (bz#19950) - https://bugzilla.rosa.ru/show_bug.cgi?id=19950- [bot] upd: 6.6.106 -> 6.6.126 - Changelog: - 6pack: drop redundant locking and refcounting - 9p: fix cache/debug options printing in v9fs_show_options - 9p: fix /sys/fs/9p/caches overwriting itself - 9p: sysfs_init: don't hardcode error to ENOMEM - accel/habanalabs/gaudi2: fix BMON disable configuration - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - accel/habanalabs: support mapping cb with vmalloc-backed coherent memory - accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() - ACPI: battery: Add synchronization between interface updates - ACPI: battery: allocate driver data through devm_ APIs - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - acpi: Break out nesting for hmat_parse_locality() - ACPI: button: Call input_free_device() on failing input device registration - ACPICA: Allow to skip Global Lock initialization - ACPICA: Avoid walking the Namespace if start_node is NULL - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - ACPICA: Fix largest possible resource descriptor index - ACPICA: Update dsmethod.c to get rid of unused variable warning - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - ACPI: CPPC: Check _CPC validity for only the online CPUs - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Perform fast check switch only for online CPUs - ACPI: debug: fix signedness issues in read/write helpers - acpi, hmat: calculate abstract distance with HMAT - acpi/hmat: Fix lockdep warning for hmem_register_resource() - acpi, hmat: refactor hmat_register_target_initiators() - ACPI: HMAT: Remove register of memory node for generic target - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Add setting of generic port system locality attributes - acpi: numa: Create enum for memory_target access coordinates indexing - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 - ACPI: processor: idle: Fix memory leak when register cpuidle device failed - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Fix buffer properties extraction for subnodes - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() - ACPI: property: Return present device nodes only on fwnode interface - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - acpi,srat: Fix incorrect device handle check for Generic Initiator - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() - afs: Fix potential null pointer dereference in afs_put_server - af_unix: Initialise scc_index in unix_add_edge(). - allow finish_no_open(file, ERR_PTR(-E...)) - alpha: don't reference obsolete termio struct for TC* constants - ALSA: ac97bus: Use guard() for mutex locks - ALSA: ac97: fix a double free in snd_ac97_controller_register() - ALSA: ctxfi: Fix potential OOB access in audio mixer handling - ALSA: dice: fix buffer overflow in detect_stream_formats() - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - ALSA: firewire-motu: add bounds check in put_user loop for DSP events - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. - ALSA: lx_core: use int type to store negative error codes - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer - ALSA: scarlett2: Fix buffer overflow in config retrieval - ALSA: serial-generic: remove shared static buffer - ALSA: uapi: Fix typo in asound.h comment - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: add mono main switch to Presonus S1824c - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: fix control pipe direction - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: fix uac2 clock source at terminal parser - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() - ALSA: usb-audio: Kill timer properly at removal - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Update for native DSD support quirks - ALSA: usb: Increase volume range that triggers a warning - ALSA: usb-mixer: us16x08: validate meter packet indices - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path - ALSA: wavefront: Clear substream pointers on close - ALSA: wavefront: Fix integer overflow in sample size validation - ALSA: wavefront: Use guard() for spin locks - ALSA: wavefront: Use standard print API - amba: tegra-ahb: Fix device leak on SMMU enable - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - amd-xgbe: avoid misleading per-packet error log - amd-xgbe: Avoid spurious link down messages during interface toggle - amd-xgbe: reset retries and mode on RX adapt failures - arc: Fix __fls() const-foldability via __builtin_clzl() - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - arm64: cputype: Add Neoverse-V3AE definitions - arm64: dts: add off-on-delay-us for usdhc2 regulator - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props - arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl - arm64: dts: imx8mp: Correct thermal sensor index - arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM - arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1 - arm64: dts: imx8mp-venice-gw702x: remove off-board uart - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: qcom: msm8916: Add missing MDSS reset - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A - arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro - arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A - arm64: dts: rockchip: remove dangerous max-link-speed from helios64 - arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: ti: k3-am62p: Fix memory ranges for GPU - arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - arm64: kprobes: call set_memory_rox() for kprobe page - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - arm64: mte: Do not flag the zero page as PG_mte_tagged - arm64: Set __nocfi on swsusp_arch_resume() - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels - ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad() - ARM: 9468/1: fix memset64() on big-endian - ARM: at91: pm: fix MCKx restore routine - ARM: at91: pm: save and restore ACR during PLL disable/enable - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - ARM: dts: imx51-zii-rdu1: Fix audmux node names - ARM: dts: imx6q-ba16: fix RTC interrupt level - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32 - ARM: dts: microchip: sama7g5: fix uart fifo size to 32 - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible - ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: renesas: gose: Remove superfluous port property - ARM: dts: renesas: porter: Fix CAN pin group - ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties - ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend - ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - ARM: tegra: transformer-20: add missing magnetometer interrupt - ARM: tegra: transformer-20: fix audio-codec interrupt - arp: do not assume dev_hard_header() does not change skb->head - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - ASoC: ak4458: Disable regulator when error happens - ASoC: ak5558: Disable regulator when error happens - ASoC: amd: acp: Adjust pdm gain value - ASoC: amd: fix memory leak in acp3x pdm dma ops - ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO - ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 - ASoC: amd: yc: Fix microphone on ASUS M6500RE - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: codecs: wsa881x: Drop unused version readout - ASoC: codecs: wsa881x: fix unnecessary initialisation - ASoC: codecs: wsa883x: fix unnecessary initialisation - ASoC: codecs: wsa884x: fix codec initialisation - ASoC: cs4271: Fix regulator leak on probe failure - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe - ASoC: fsl: imx-card: Do not force slot width to sample width - ASoC: fsl_sai: Add missing registers to cache default - ASoC: fsl_sai: fix bit order for DSD format - ASoC: fsl_xcvr: clear the channel status control memory - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping - ASoC: Intel: catpt: Fix error path in hw_params() - ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - ASoC: qcom: audioreach: fix potential null pointer dereference - ASoC: qcom: q6adm: the the copp device only during last instance - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed - ASoC: qcom: q6asm-dai: perform correct state check before closing - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - ASoC: qdsp6: q6asm: do not sleep while atomic - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - ASoC: stm32: sai: fix clk prepare imbalance on probe failure - ASoC: stm32: sai: fix device leak on probe - ASoC: stm32: sai: fix OF node leak on probe - ASoC: stm32: sai: manage context in set_sysclk callback - ASoC: tas2781: fix getting the wrong device number - ASoC: tlv320adcx140: fix null pointer - ASoC: tlv320adcx140: fix word length - ASoC: tlv320adcx140: Propagate error codes during probe - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - ASoC: wm8940: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8974: Correct PLL rate rounding - ata: libata: Add cpr_log to ata_dev_print_features() early return - ata: libata: Call ata_dev_config_lpm() for ATAPI devices - ata: libata-core: Introduce ata_dev_config_lpm() - ata: libata: Print features also for ATAPI devices - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() - ata: libata-scsi: Fix system suspend for a security locked drive - atm: Fix dma_free_coherent() size - atm/fore200e: Fix possible data race in fore200e_open() - audit: record fanotify event regardless of presence of rules - backlight: led-bl: Add devlink to supplier LEDs - backlight: lp855x: Fix lp855x.h kernel-doc warnings - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - bcma: don't register devices disabled in OF - be2net: fix data race in be_get_new_eqd - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - be2net: pass wrb_params in case of OS2BMC - bfs: Reconstruct file type when loading from disk - binder: fix BR_FROZEN_REPLY error log - binderfs: fix ida_alloc_max() upper bound - binder: remove "invalid inc weak" check - bits: add comments and newlines to #if, #else and #endif directives - bits: introduce fixed-type GENMASK_U*() - blk-cgroup: fix possible deadlock while configuring policy - blk-crypto: fix missing blktrace bio split events - blk-mq: Abort suspend when wakeup events are pending - blk-mq: add helper for checking if one CPU is mapped to specified hctx - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx - blk-mq: don't schedule block kworker on isolated CPUs - blk-mq: setup queue ->tag_set before initializing hctx - blk-mq: skip CPU offline notify on unmapped hctx - block,bfq: fix aux stat accumulation destination - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - block: fix race between set_blocksize and read paths - block: make REQ_OP_ZONE_OPEN a write operation - block: rate-limit capacity change info log - block: rnbd-clt: Fix leaked ID in init_dev() - block: rnbd-clt: Fix signedness bug in init_dev() - block: use int to store blk_stack_limits() return value - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: bcsp: receive data only if registered - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - Bluetooth: btrtl: Avoid loading the config file on security chips - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - Bluetooth: btusb: revert use of devm_kzalloc in btusb - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync - Bluetooth: hci_event: validate skb length for unknown CC opcode - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work - Bluetooth: ISO: don't leak skb in ISO_CONT RX - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: ISO: Fix possible UAF on iso_conn_free - Bluetooth: L2CAP: export l2cap_chan_hold for modules - Bluetooth: MGMT: cancel mesh send timer when hdev removed - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() - Bluetooth: rfcomm: fix modem control handling - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - bnxt_en: correct offset handling for IPv6 destination address - bnxt_en: Fix a possible memory leak in bnxt_ptp_init - bnxt_en: Fix potential data corruption with HW GRO/LRO - bonding: annotate data-races around slave->last_rx - bonding: check xdp prog when set bond mode - bonding: don't set oif to bond dev when getting NS target destination - bonding: limit BOND_MODE_8023AD to Ethernet devices - bonding: provide a net pointer to __skb_flow_dissect() - bonding: return detailed error when loading native XDP fails - bonding: set random address only when slaves already exist - bpf: account for current allocated stack depth in widen_imprecise_scalars() - bpf: Add bpf_prog_run_data_pointers() - bpf, arm64: Do not audit capability check in do_jit() - bpf: Avoid RCU context warning when unpinning htab with internal structs - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - bpf: Clear pfmemalloc flag when freeing all fragments - bpf: Do not audit capability check in do_jit() - bpf: Do not let BPF test infra emit invalid GSO types to stack - bpf: Do not limit bpf_cgroup_from_id to current's namespace - bpf: Don't use %pK through printk - bpf: Enforce expected_attach_type for tailcall compatibility - bpf: Explicitly check accesses to bpf_sock_addr - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - bpf: Fix invalid prog->stats access when update_effective_progs fails - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - bpf: Free special fields when update [lru_,]percpu_hash maps - bpf: Handle return value of ftrace_set_filter_ip in register_fentry - bpf: Improve program stats run-time calculation - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Reject bpf_timer for PREEMPT_RT - bpf: Reject negative offsets for ALU ops - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - bpf/selftests: test_select_reuseport_kern: Remove unused header - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Sync pending IRQ work before freeing ring buffer - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - bridge: mcast: Fix use-after-free during router port configuration - bridge: Redirect to backup port when port is administratively down - broadcom: b44: prevent uninitialized value usage - btrfs: always detect conflicting inodes when logging inode refs - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - btrfs: do not assert we found block group item when creating free space tree - btrfs: do not skip logging new dentries when logging a new name - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: don't log conflicting inode if it's a dir moved in the current transaction - btrfs: don't rewrite ret from inode_permission - btrfs: ensure no dirty metadata is written back for an fs with errors - btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() - btrfs: factor out init_space_info() from create_space_info() - btrfs: fix a potential path leak in print_data_reloc_error() - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type - btrfs: fix incorrect readahead expansion length - btrfs: fix invalid extref key setup when replaying dentry - btrfs: fix leaf leak in an error path in btrfs_del_items() - btrfs: fix memory leak of fs_devices in degraded seed device path - btrfs: fix memory leaks in create_space_info() error paths - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() - btrfs: fix reservation leak in some error paths when inserting inline extent - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - btrfs: introduce btrfs_space_info sub-group - btrfs: mark dirty extent range for out of bound prealloc extents - btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() - btrfs: ref-verify: handle damaged extent root tree - btrfs: scrub: always update btrfs_scrub_progress::last_physical - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: send: check for inline extents in range_is_hole_in_parent() - btrfs: store fs_info in space_info - btrfs: tree-checker: fix the incorrect inode ref size check - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: use readahead_expand() on compressed extents - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - bus: fsl-mc: Check return value of platform_get_resource() - bus: mhi: ep: Fix chained transfer handling in read path - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - cachestat: do not flush stats in recency check - caif: fix integer underflow in cffrml_receive() - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak - can: etas_es58x: allow partial RX URB allocation to succeed - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - can: gs_usb: gs_can_open(): fix error handling - can: gs_usb: gs_make_candev(): populate net_device->dev_port - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: gs_usb: increase max interface to U8_MAX - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - can: j1939: make j1939_session_activate() fail if device is no longer registered - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: netlink: can_changelink(): allow disabling of automatic restart - can: peak_usb: fix shift-out-of-bounds issue - can: rcar_canfd: Fix CAN-FD mode as default - can: rcar_canfd: Fix controller mode setting - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - can: sja1000: fix max irq loop handling - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - ceph: add checking of wait_for_completion_killable() return value - ceph: fix crash in process_v2_sparse_read() for encrypted directories - ceph: refactor wake_up_bit() pattern of calling - cgroup: split cgroup_destroy_wq into 3 workqueues - char: applicom: fix NULL pointer dereference in ac_ioctl - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - char: misc: restrict the dynamic range to exclude reserved minors - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - cifs: client: fix memory leak in smb3_fs_context_parse_param - cifs: Fix memory and information leak in smb3_reconfigure() - cifs: fix memory leak in smb3_fs_context_parse_param error path - cifs: fix pagecache leak when do writepages - cifs: Fix TCP_Server_Info::credits to be signed - cifs: fix typo in enable_gcm_256 module parameter - cifs: Fix uncached read into ITER_KVEC iterator - cifs: parse_dfs_referrals: prevent oob on malformed input - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points - cifs: stop writeback extension when change of size is detected - clk: at91: clk-master: Add check for divide by 3 - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: peripheral: fix return value - clk: keystone: fix compile testing - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: qcom: camcc-sm6350: Fix PLL config of PLL2 - clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other - clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback - clk: renesas: cpg-mssr: Read back reset registers to assure values latched - clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register - clk: renesas: r9a06g032: Fix memory leak in error path - clk: renesas: rzg2l: Remove critical area - clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable() - clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R() - clk: renesas: Use str_on_off() helper - clk: samsung: exynos-clkout: Assign .num before accessing .hws - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - clk: tegra: do not overallocate memory for bpmp clocks - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clocksource/drivers/clps711x: Fix resource leaks in error paths - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - cnic: Fix use-after-free bugs in cnic_delete_task - comedi: c6xdigio: Fix invalid PNP driver unregistration - comedi: check device's attached status in compat ioctls - comedi: dmm32at: serialize use of paged registers - comedi: fix divide-by-zero in comedi_buf_munge() - comedi: Fix getting range information for subdevices 16 to 255 - comedi: multiq3: sanitize config options in multiq3_attach() - comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - compiler_types.h: add "auto" as a macro for "__auto_type" - compiler_types: Move unused static inline functions warning to W=2 - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - coresight: etm4x: Add context synchronization before enabling trace - coresight-etm4x: Conditionally access register TRCEXTINSELR - coresight: etm4x: Correct polling IDLE bit - coresight: etm4x: Extract the trace unit controlling - coresight: etm4x: Support atclk - coresight: Only register perf symlink for sinks with alloc_buffer - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - coresight: trbe: Return NULL pointer for allocation failures - counter: 104-quad-8: Fix incorrect return value in IRQ handler - counter: interrupt-cnt: Drop IRQF_NO_THREAD flag - cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist - cpufreq: Initialize cpufreq-based invariance before subsys - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() - cpufreq/longhaul: handle NULL policy in longhaul_exit - cpufreq: nforce2: fix reference count leak in nforce2 - cpufreq: s5pv210: fix refcount leak - cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() - cpufreq: tegra186: Initialize all cores to max frequencies - cpufreq: tegra186: Set target frequency for all cpus in policy - cpuidle: Fail cpuidle device registration if there is one already - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: governors: menu: Select polling state in some more cases - cpuidle: governors: teo: Drop misguided target residency check - cpuidle: menu: Use residency threshold in polling state override decisions - cpuidle: qcom-spm: fix device and OF node leaks at probe - cpuset: Treat cpusets in attaching as populated - cramfs: Verify inode mode when loading from disk - crash: fix crashkernel resource shrink - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx - crypto: af_alg - Set merge to zero early in af_alg_sendmsg - crypto: af_alg - zero initialize memory allocated via sock_kmalloc - crypto: aspeed-acry - Convert to platform remove callback returning void - crypto: aspeed - Fix dma_unmap_sg() direction - crypto: aspeed - fix double free caused by devm - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - crypto: atmel - Fix dma_unmap_sg() direction - crypto: authenc - Correctly pass EINPROGRESS back up to the caller - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: caam - Add check for kcalloc() in test_len() - crypto: caam - double the entropy delay interval for retry - crypto: ccree - Correctly handle return of sg_nents_for_len - crypto: essiv - Check ssize for decryption and in-place encryption - crypto: hisilicon/qm - check whether the input function and PF are on the same device - crypto: hisilicon/qm - Fix device reference leak in qm_get_qos_value - crypto: hisilicon/qm - restore original qos values - crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs - crypto: hisilicon - re-enable address prefetch after device resuming - crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations - crypto: keembay - Add missing check after sg_nents_for_len() - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - crypto: rng - Ensure set_ent is always present - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - crypto: sha256 - fix crash at kexec - crypto: starfive - Correctly handle return of sg_nents_for_len - crypto: sun8i-ce - remove channel timeout field - crypto: virtio - Add spinlock protection with virtqueue notification - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req - csky: fix csky_cmpxchg_fixup not working - dax: skip read lock assertion for read-only filesystems - devcoredump: Fix circular locking dependency with devcd->mutex. - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - Disable SLUB_TINY for build testing - dlm: check for defined force value in dlm_lockspace_release - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - dmaengine: apple-admac: Add "apple,t8103-admac" compatible - dmaengine: at_hdmac: fix device leak on of_dma_xlate() - dmaengine: bcm-sba-raid: fix device leak on probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - dmaengine: dw: dmamux: fix OF node leak on route allocation failure - dmaengine: dw-edma: Set status for callback_result - dmaengine: idxd: fix device leaks on compat bind and unbind - dmaengine: idxd: Fix double free in idxd_setup_wqs() - dmaengine: idxd: Fix refcount underflow on module unload - dmaengine: idxd: Remove improper idxd_free - dmaengine: lpc18xx-dmamux: fix device leak on route allocation - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: omap-dma: fix dma_pool resource leak in error paths - dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees - dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() - dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() - dmaengine: sh: setup_xref error handling - dmaengine: stm32: dmamux: fix device leak on route allocation - dmaengine: stm32: dmamux: fix OF node leak on route allocation failure - dmaengine: tegra-adma: Fix use-after-free - dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation - dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - dmaengine: ti: k3-udma: fix device leak on udma lookup - dmaengine: xilinx_dma: Fix uninitialized addr_width when "xlnx,addrwidth" property is missing - dmaengine: xilinx: xdma: Fix regmap max_register - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - dma/pool: distinguish between missing and exhausted atomic pools - dma/pool: eliminate alloc_pages warning in atomic_pool_expand - dm-bufio: align write boundary on physical block size - dm-ebs: Mark full buffer dirty even on partial write - dm: fix NULL pointer dereference in __dm_suspend() - dm: fix queue start/stop imbalance under suspend/load/resume races - dm-integrity: limit MAX_TAG_SIZE to 255 - dm log-writes: Add missing set_freezable() for freezable kthread - dm-raid: fix possible NULL dereference with undefined raid type - dm-snapshot: fix 'scheduling while atomic' on real-time kernels - dm-verity: fix unreliable memory allocation - doc: fix seg6_flowlabel path - docs: networking: can: change bcm_msg_head frames member to support flexible array - Documentation: process: Also mention Sasha Levin as stable tree maintainer - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - dpaa2-switch: add bounds check for if_id in IRQ handler - dpaa2-switch: fix buffer pool seeding for control traffic - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero - driver core: enforce device_lock for driver_match_device() - driver core/PM: Set power.no_callbacks along with power.no_pm - drivers/base/node: fix double free in register_one_node() - drivers/base/node: handle error properly in register_one_node() - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() - drivers/perf: hisi: Relax the event ID check in the framework - drivers/usb/dwc3: fix PCI parent check - drm/amd: add more cyan skillfish PCI ids - drm/amd: Avoid evicting resources at S5 - drm/amd: Check whether secure display TA loaded successfully - drm/amd: Clean up kfd node on surprise disconnect - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Bump the HDMI clock to 340MHz - drm/amd/display: Check dce_hwseq before dereferencing it - drm/amd/display: Check NULL before accessing - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Enable mst when it's detected but yet to be initialized - drm/amd/display: ensure committing streams is seamless - drm/amd/display: Fix black screen with HDMI outputs - drm/amd/display: Fix DP no audio issue - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() - drm/amd/display: Fix null pointer deref in dcn20_resource.c - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: Increase DPCD read retries - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Remove redundant semicolons - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() - drm/amd/display: use udelay rather than fsleep - drm/amd: Fix suspend failure with secure display TA - drm/amdgpu: Add additional DCE6 SCL registers - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/amdgpu: csa unmap use uninterruptible lock - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amdgpu: fix a memory leak in fence cleanup when unloading - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - drm/amdgpu: Fix function header names in amdgpu_connectors.c - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amdgpu: Forward VMID reservation errors - drm/amdgpu/gfx10: fix wptr reset in KGQ init - drm/amdgpu/gfx11: fix wptr reset in KGQ init - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amdgpu: Power up UVD 3 for FW validation (v2) - drm/amdgpu: reject gang submissions under SRIOV - drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/amdgpu/soc21: fix xclk for APUs - drm/amdgpu: use atomic functions with memory barriers for vm fault info - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - drm/amdkfd: Don't use sw fault filter if retry cam enabled - drm/amdkfd: fix a memory leak in device_queue_manager_init() - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - drm/amdkfd: fix vram allocation failure for a special case - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amd/pm: Don't clear SI SMC table when setting power limit - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) - drm/amd/powerplay: Fix CIK shutdown temperature - drm/ast: Use msleep instead of mdelay for edid read - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - drm/bridge: it6505: select REGMAP_I2C - drm/bridge: lt9211: Drop check for last nibble of version register - drm/etnaviv: fix flush sequence logic - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/gma500: Fix null dereference in hdmi teardown - drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - drm/i915/backlight: Return immediately when scale() finds invalid parameters - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - drm/i915/guc: Skip communication warning on reset in progress - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/imx/tve: fix probe device leak - drm/mediatek: Disable AFBC support on Mediatek DRM driver - drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue - drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() - drm/mediatek: Fix device use-after-free on unbind - drm/mediatek: fix potential OF node use-after-free - drm/mediatek: Fix probe memory leak - drm/mediatek: Fix probe resource leaks - drm/mgag200: Fix big-endian support - drm/mgag200: fix mgag200_bmc_stop_scanout() - drm/msm/a2xx: stop over-complaining about the legacy firmware - drm/msm/a6xx: fix bogus hwcg register updates - drm/msm/a6xx: Fix GMU firmware parser - drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - drm/msm/dpu: Add missing NULL pointer check for pingpong interface - drm/msm/dpu: fix incorrect type for ret - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - drm/msm: make sure to not queue up recovery more than once - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/nouveau: restrict the flush page to a 32-bit address - drm/panel: novatek-nt35560: Fix invalid return value - drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel - drm/panel: sony-td4353-jdi: Enable prepare_prev_first - drm/panel: visionox-rm69299: Don't clear all mode flags - drm/pl111: Fix error handling in pl111_amba_probe - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] - drm/rcar-du: dsi: Fix 1/2/3 lane support - drm/rockchip: vop2: use correct destination rectangle height check - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - drm/sched: Fix race in drm_sched_entity_select_rq() - drm: sti: fix device leaks at component probe - drm/sysfb: Do not dereference NULL pointer in plane reset - drm/tegra: Add call to put_pid() - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/tidss: Use the crtc_* timings when programming the HW - drm/tilcdc: Fix removal actions in case of failed probe - drm/tilcdc: request and mapp iomem with devres - drm/ttm: Avoid NULL pointer deref for evicted BOs - drm/vgem-fence: Fix potential deadlock on release - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() - drm/vmwgfx: Fix a null-ptr access in the cursor snooper - drm/vmwgfx: Fix copy-paste typo in validation - drm/vmwgfx: Fix Use-after-free in validation - drm/vmwgfx: Use kref in vmw_bo_dirty - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml - dt-bindings: PCI: amlogic: Fix the register name of the DBI region - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO - dt-bindings: power: qcom,rpmpd: Add SM7150 - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner - dt-bindings: power: qcom,rpmpd: document the SM8650 RPMh Power Domains - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions - dt-bindings: power: rpmpd: Add MSM8917, MSM8937 and QM215 - dt-bindings: power: rpmpd: Update part number to X1E80100 - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - e1000: fix OOB in e1000_tbi_should_accept() - EDAC/altera: Delete an inappropriate dma_free_coherent() call - EDAC/altera: Handle OCRAM ECC enable after warm reset - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller - EDAC/i3200: Fix a resource leak in i3200_probe1() - EDAC/mc_sysfs: Increase legacy channel support to 16 - EDAC/x38: Fix a resource leak in x38_probe1() - efi/cper: Add a new helper function to print bitmasks - efi/cper: Adjust infopfx size to accept an extra space - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs - efi/cper: Fix cper_bits_to_str buffer handling and return value - efi/libstub: Fix page table access in 5-level to 4-level paging transition - efivarfs: fix error propagation in efivar_entry_get() - epoll: Remove ep_scan_ready_list() in comments - espintcp: fix skb leaks - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - ethernet: Extend device_get_mac_address() to use NVMEM - ethernet: rvu-af: Remove slash from the driver name - ethtool: Avoid overflowing userspace buffer on stats query - eventpoll: Replace rwlock with spinlock - exec: Fix incorrect type for ret - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - exfat: fix remount failure in different process environments - exfat: limit log print for IO error - Expand the type of nfs_fattr->valid - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() - ext4: align max orphan file size with e2fsprogs limit - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() - ext4: clear i_state_flags when alloc inode - ext4: correctly handle queries for metadata mappings - ext4: correct the checking of quota files before moving extents - ext4: detect invalid INLINE_DATA + EXTENTS flag combination - ext4: filesystems without casefold feature cannot be mounted with siphash - ext4: fix an off-by-one issue during moving extents - ext4: fix checks for orphan inodes - ext4: fix error message when rejecting the default hash - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - ext4: fix incorrect group number assertion in mb_check_buddy - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() - ext4: fix string copying in parse_apply_sb_mount_options() - ext4: free orphan info with kvfree - ext4: guard against EA inode refcount underflow in xattr update - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - ext4: increase IO priority of fastcommit - ext4: introduce ITAIL helper - ext4: refresh inline data size before write operations - ext4: remove unused return value of __mb_check_buddy - ext4: validate ea_ino and size in check_xattrs - ext4: verify orphan file size is not too big - ext4: wait for ongoing I/O to complete before freeing blocks - ext4: xattr: fix null pointer deref in ext4_raw_inode() - extcon: adc-jack: Cleanup wakeup source only if it was enabled - extcon: adc-jack: Fix wakeup source leaks on device unbind - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - f2fs: drop inode from the donation list when the last file is closed - f2fs: ensure node page reads complete before f2fs_put_super() finishes - f2fs: fix age extent cache insertion skip on counter overflow - f2fs: fix condition in __allow_reserved_blocks() - f2fs: fix infinite loop in __insert_extent_tree() - f2fs: fix return value of f2fs_recover_fsync_data() - f2fs: fix to avoid overflow while left shift operation - f2fs: fix to avoid potential deadlock - f2fs: fix to avoid updating compression context during writeback - f2fs: fix to avoid updating zero-sized extent in extent cache - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() - f2fs: fix to propagate error from f2fs_enable_checkpoint() - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - f2fs: fix wrong block mapping for multi-devices - f2fs: fix zero-sized extent for precache extents - f2fs: invalidate dentry cache on failed whiteout creation - f2fs: keep POSIX_FADV_NOREUSE ranges - f2fs: remove unused GC_FAILURE_PIN - f2fs: use f2fs_err_ratelimited() to avoid redundant logs - f2fs: use global inline_xattr_slab instead of per-sb slab cache - fbcon: fix integer overflow in fbcon_do_set_font - fbcon: Fix OOB access in font allocation - fbcon: Set fb_display[i]->mode to NULL when the mode is released - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds - fbdev: atyfb: Check if pll_ops->init_pll failed - fbdev: bitblit: bound-check glyph index in bit_putcs* - fbdev: Fix logic error in "offb" name match - fbdev: gbefb: fix to use physical address instead of dma address - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() - fbdev: tcx.c fix mem_map to correct smem_start offset - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - filelock: add FL_RECLAIM to show_fl_flags() macro - filemap: cap PTE range to be created to allowed zero fill in folio_map_range() - firewire: core: fix overlooked update of subsystem ABI version - firewire: nosy: Fix dma_free_coherent() size - firmware: arm_scmi: Account for failed debug initialization - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - firmware: arm_scmi: Fix unused notifier-block in unregister - firmware: firmware: meson-sm: fix compile-test default - firmware: imx: scu-irq: fix OF node leak in - firmware: imx: scu-irq: Init workqueue before request mbox channel - firmware: imx: scu-irq: Set mu_resource_id before get handle - firmware: meson_sm: fix device leak at probe - firmware: stratix10-svc: Add mutex in stratix10 memory management - firmware: stratix10-svc: fix bug in saving controller data - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc - Fix memory leak in posix_clock_open() - fjes: Add missing iounmap in fjes_hw_init() - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - flex_proportions: make fprop_new_period() hardirq safe - floppy: fix for PAGE_SIZE != 4KB - fou: Don't allow 0 for FOU_ATTR_IPPROTO. - fs/9p: Don't open remote file with APPEND mode when writeback cache is used - fs: Add 'initramfs_options' to set initramfs mount options - fs: always return zero on success from replace_fd() - fscontext: do not consume log entries when returning -EMSGSIZE - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - fs/nfs/io: make nfs_start_io_*() killable - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() - fs/nls: Fix utf16 to utf8 conversion - fs/notify: call exportfs_encode_fid with s_umount - fsnotify: do not generate ACCESS/MODIFY events on child for special files - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fs: ntfs3: Fix integer overflow in run_unpack() - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - fs/ntfs3: Initialize allocated memory before use - fs/ntfs3: out1 also needs to put mi - fs/ntfs3: Prevent memory leaks in add sub record - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs/ntfs3: Support timestamps prior to epoch - fs/proc: fix uaf in proc_readdir_de() - fs: quota: create dedicated workqueue for quota_release_work - fs: udf: fix OOB read in lengthAllocDescs handling - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() - ftrace: Fix BPF fexit with livepatch - ftrace: Fix softlockup in ftrace_module_enable - ftrace/samples: Fix function size computation - fuse: allocate ff->release_args only if release is needed - fuse: Always flush the page cache before FOPEN_DIRECT_IO write - fuse: check if copy_file_range() returns larger than requested size - fuse: fix livelock in synchronous file put from fuseblk workers - fuse: fix readahead reclaim deadlock - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write - fuse: prevent overflow in copy_file_range return value - fuse: zero initialize inode private data - futex: Don't leak robust_list pointer on exec race - futex: Prevent use-after-free during requeue-PI - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - gcov: add support for GCC 15 - genalloc.h: fix htmldocs warning - genirq/irq_sim: Initialize work context pointers properly - gfs2: fix freeze error handling - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - gfs2: fix remote evict for read-only filesystems - gfs2: Fix use of bio_chain - gpio: 104-idio-16: Define maximum valid register address offset - gpio: idio-16: Define fixed direction of the GPIO lines - gpiolib: acpi: Add quirk for Dell Precision 7780 - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler - gpiolib: Extend software-node support to support secondary software-nodes - gpio: ljca: Fix duplicated IRQ mapping - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - gpio: omap: do not register driver in probe() - gpio: pca953x: Add support for level-triggered interrupts - gpio: pca953x: fix wrong error probe return value - gpio: pca953x: handle short interrupt pulses on PCAL devices - gpio: pca953x: mask interrupts in irq shutdown - gpio: pca953x: Utilise dev_err_probe() where it makes sense - gpio: pca953x: Utilise temporary variable for struct device - gpio: pci-idio-16: Define maximum valid register address offset - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - gpio: rockchip: mark the GPIO controller as sleeping - gpio: rockchip: Stop calling pinctrl for set_direction - gpio: update Intel LJCA USB GPIO driver - gpio: wcd934x: mark the GPIO controller as sleeping - gpu: host1x: Fix race in syncpt alloc/free - gue: Fix skb memleak with inner IP protocol 0. - gve: Correct ethtool rx_dropped calculation - gve: Fix stats report corruption on queue count change - hfs: clear offset and space out of valid records in b-tree node - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - hfs: make proper initalization of struct hfs_find_data - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() - hfsplus: fix volume corruption issue for generic/070 - hfsplus: fix volume corruption issue for generic/073 - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfsplus: Verify inode mode when loading from disk - hfs: validate record offset in hfsplus_bmap_alloc - HID: amd_sfh: Stop sensor before starting - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) - HID: asus: add support for missing PX series fn keys - HID: asus: add Z13 folio to generic group for multitouch to work - HID: core: Harden s32ton() against conversion to 0 bits - HID: elecom: Add support for ELECOM M-XT3URBK (018F) - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - HID: hid-input: Extend Elan ignore battery quirk to USB - HID: hid-input: only ignore 0 battery events for digitizers - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen - HID: intel-ish-hid: Reset enum_devices_done before enumeration - HID: intel-ish-hid: Update ishtp bus match to support device ID table - HID: logitech-dj: Remove duplicate error logging - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL - HID: multitouch: fix name of Stylus input devices - HID: multitouch: fix sticky fingers - HID: playstation: Center initial joystick axes to prevent spurious events - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 - HID: quirks: work around VID/PID conflict for appledisplay - HID: uclogic: Fix potential memory leak in error path - HID: usbhid: paper over wrong bNumDescriptor field - hrtimer: Fix softirq base check in update_needs_ipi() - hrtimer: Remove unused function - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimers: Unconditionally update target CPU base after offline timer migration - hsr: Fix supervision frame sending on HSRv0 - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (ibmpex) fix use-after-free in high/low store - hwmon: (k10temp) Add device ID for Strix Halo - hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models - hwmon: (max16065) Use local variable to avoid TOCTOU - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - hwmon: (occ) Mark occ_init_attribute() as __printf - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - hwmon: (sht3x) Fix error handling - hwmon: sy7636a: add alias - hwmon: sy7636a: Fix regulator_enable resource leak on error path - hwmon: (tmp401) fix overflow caused by default conversion rate value - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - hwrng: nomadik - add ARM_AMBA dependency - hyperv-tlfs: Change prefix of generic HV_REGISTER_* MSRs to HV_MSR_* - i2c: amd-mp2: fix reference leak in MP2 PCI device - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Add quirk for Intel Xe - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware - i2c: designware: Fix clock issue when PM is disabled - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA - i3c: fix refcount inconsistency in i3c_master_register - i3c: master: Inherit DMA masks and parameters from parent device - i3c: master: svc: Prevent incomplete IBI transaction - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - i40e: add mask to apply valid bits for itr_idx - i40e: add max boundary check for VF filters - i40e: add validation for ring_len param - i40e: fix idx validation in config queues msg - i40e: fix idx validation in i40e_validate_queue_map - i40e: fix input validation logic for action_meta - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path - i40e: fix scheduling in set_rx_mode - i40e: fix validation of VF state in get resources - i40e: improve VF MAC filters accounting - i40e: increase max descriptors for XL710 - i40e: remove redundant memory barrier when cleaning Tx descs - iavf: fix off-by-one issues in iavf_config_rss_reg() - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - IB/sa: Fix sa_local_svc_timeout_ms read race - ice: Avoid detrimental cleanup for bond during interface stop - ice: Don't use %pK through printk or tracepoints - ice: initialize ring_stats->syncp - ice: stop counting UDP csum mismatch as rx_errors - idr: fix idr_alloc() returning an ID out of range - igb: fix link test skipping when interface is admin down - igc: fix race condition in TX timestamp read for register 0 - iio: accel: bmc150: Fix irq assumption regression - iio: accel: fix ADXL355 startup race condition - iio: accel: iis328dq: fix gain values - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: adc: ad7280a: handle spi_setup() errors in probe() - iio: adc: ad9467: fix ad9434 vref mask - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver - iio: adc: exynos_adc: fix OF populate on driver rebind - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: rtq6056: Correct the sign bit index - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains - iio: chemical: scd4x: fix reported channel endianness - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: core: add missing mutex_destroy in iio_dev_release() - iio: core: add separate lockdep class for info_exist_lock - iio: dac: ad5360: use int type to store negative error codes - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - iio: frequency: adf4350: Fix prescaler usage. - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - iio: imu: inv_icm42600: Simplify pm_runtime setup - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection - iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: xilinx-ams: Unmask interrupts after updating alarms - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - ima: Handle error code returned by ima_filter_rule_match() - ima: limit the number of ToMToU integrity violations - inet: Avoid ehash lookup race in inet_ehash_insert() - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - inet: ping: Fix icmp out counting - init: handle bootloader identifier in kernel parameters - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - Input: atmel_mxt_ts - allow reset GPIO to sleep - Input: cros_ec_keyb - fix an invalid memory access - Input: goodix - add support for ACPI ID GDIX1003 - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: imx_sc_key - fix memory corruption on unload - Input: iqs7222 - avoid enabling unused interrupts - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak - intel_th: fix device leak on output open() - intel_th: Fix error handling in intel_th_output_open - interconnect: debugfs: Fix incorrect error handling for NULL path - interconnect: debugfs: initialize src_node and dst_node to empty strings - interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS - iomap: account for unaligned end offsets when truncating read range - iomap: adjust read range correctly for non-block-aligned positions - iomap: always run error completions in user context - iomap: factor out a iomap_dio_done helper - iommu/amd: Fix pci_segment memleak in alloc_pci_segment() - iommu/amd/pgtbl: Fix possible race while increase page table level - iommu/amd: Skip enabling command/event buffers for kdump - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/apple-dart: fix device leak on of_xlate() - iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal - iommu: disable SVA when CONFIG_X86 is set - iommu/exynos: fix device leak on of_xlate() - iommufd: Don't overflow during division for dirty tracking - iommufd: Make vfio_compat's unmap succeed if the range is already empty - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED - iommu/ipmmu-vmsa: fix device leak on of_xlate() - iommu/mediatek: fix device leak on of_xlate() - iommu/mediatek: fix use-after-free on probe deferral - iommu/mediatek-v1: fix device leak on probe_device() - iommu/mediatek-v1: fix device leaks on probe() - iommu/omap: fix device leaks on probe_device() - iommu/qcom: fix device leak on of_xlate() - iommu/sun50i: fix device leak on of_xlate() - iommu/tegra: fix device leak on probe_device() - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - iommu/vt-d: PRS isn't usable if PDS isn't supported - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - io_uring: backport io_should_terminate_tw() - io_uring: correct __must_hold annotation in io_install_fixed_file - io_uring: fix filename leak in __io_openat_prep() - io_uring: include dying ring in task_work "should cancel" state - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - io_uring: move local task_work in exit cancel loop - io_uring/poll: correctly handle io_poll_add() return value on update - ip6_gre: make ip6gre_header() robust - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - ipmi: Fix handling of messages with provided receive message pointer - ipmi: Fix __scan_channels() failing to rescan channels - ipmi: Fix the race between __scan_channels() and deliver_response() - ipmi: Rework user message limit handling - ipv4: Fix reference count leak when using error routes with nexthop objects - ipv4: ip_gre: make ipgre_header() robust - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe - ipv6: add exception routes to GC list in rt6_insert_exception - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - ipv6: annotate data-race in ndisc_router_discovery() - ipv6: avoid possible NULL deref in modify_prefix_route() - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - ipv6: clear RA flags when adding a static route - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF - ipv6: Fix use-after-free in inet6_addr_del(). - ipv6: np->rxpmtu race annotation - ipv6: use the right ifindex when replying to icmpv6 from localhost - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() - ipvlan: Make the addrs_lock be per port - ipvs: Defer ip_vs_ftp unregister during netns cleanup - ipvs: fix ipv4 null-ptr-deref in route error path - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - irqchip/gic-v3-its: Avoid truncating memory addresses - irqchip/imx-mu-msi: Fix section mismatch - irqchip/irq-bcm7038-l1: Fix section mismatch - irqchip/irq-bcm7120-l2: Fix section mismatch - irqchip/irq-brcmstb-l2: Fix section mismatch - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() - irqchip/qcom-irq-combiner: Fix section mismatch - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - irqchip/sifive-plic: Respect mask state when setting affinity - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() - ixgbevf: Add support for Intel(R) E610 device - ixgbevf: fix getting link speed data for E610 devices - ixgbevf: fix mailbox API compatibility by negotiating supported features - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted - jbd2: ensure that all ongoing I/O complete before freeing blocks - jbd2: fix the inconsistency between checksum and data in memory for journal sb - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key - jbd2: use a weaker annotation in journal handling - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - kallsyms: Fix wrong "big" kernel symbol type read from procfs - kasan: fix GCC mem-intrinsic prefix with sw tags - kasan: refactor pcpu kasan vmalloc unpoison - kbuild: uapi: Strip comments before size type check - kbuild: Use objtree for module signing key path - kconfig: fix static linking of nconf - kconfig/mconf: Initialize the default locale at startup - kconfig/nconf: Initialize the default locale at startup - kernel.h: Move ARRAY_SIZE() to a separate header - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths - kernfs: Fix UAF in polling when open file is released - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - KEYS: trusted_tpm1: Compare HMAC values in constant time - KEYS: X.509: Fix Basic Constraints CA flag parsing - kmsan: fix out-of-bounds access to shadow memory - ksmbd: add max ip connections parameter - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - ksmbd: close accepted socket when per-IP limit rejects connection - ksmbd: fix buffer validation by including null terminator size in EA length - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - ksmbd: Fix memory leak in get_file_all_info() - ksmbd: fix null pointer dereference in alloc_preauth_hash() - ksmbd: Fix race condition in RPC handle list access - ksmbd: fix recursive locking in RPC handle list access - ksmbd: Fix refcount leak when invalid session is found on session lookup - ksmbd: fix use-after-free in ksmbd_session_rpc_open - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - ksmbd: fix use-after-free in session logoff - ksmbd: ipc: fix use-after-free in ipc_msg_send_request - ksmbd: skip lock-range check on equal size to avoid size==0 underflow - ksmbd: smbd: fix dma_unmap_sg() nents - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - ksmbd: transport_ipc: validate payload size before reading handle - ksmbd: use sock_create_kern interface to create kernel socket - ksmbd: vfs: fix race on m_flags in vfs_cache - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - ktest.pl: Fix uninitialized var in config-bisect.pl - kunit: kasan_test: disable fortify string checker on kasan_strings() test - KVM: arm64: Check the untrusted offset in FF-A memory share - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - KVM: Don't clobber irqfd routing type when deassigning irqfd - KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() - KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE - KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits - KVM: nSVM: Fix and simplify LBR virtualization handling with nested - KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation - KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) - KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit - KVM: selftests: Add -U_FORTIFY_SOURCE to avoid some unpredictable test failures - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 - KVM: SVM: Fix redundant updates of LBR MSR intercepts - KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN - KVM: SVM: Set synthesized TSA CPUID flags - KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O - KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer - KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 - l2tp: avoid one data-race in l2tp_tunnel_del_work() - lan966x: Fix sleeping in atomic context - leds: flash: leds-qcom-flash: Update torch current clamp setting - leds: led-class: Only Add LED to leds_list when it is fully ready - leds: leds-lp50xx: Allow LED 0 to be added to module bank - leds: leds-lp50xx: Enable chip before any communication - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs - leds: netxbig: Fix GPIO descriptor leak in error paths - leds: spi-byte: Use devm_led_classdev_register_ext() - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - libbpf: Fix reuse of DEVMAP - libceph: fix invalid accesses to ceph_connection_v1_info - libceph: fix potential use-after-free in have_mon_and_osd_map() - libceph: make calc_target() set t->paused, not just clear it - libceph: make decode_pool() more resilient against corrupted osdmaps - libceph: make free_choose_arg_map() resilient to partial allocation - libceph: prevent potential out-of-bounds reads in handle_auth_done() - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: replace BUG_ON with bounds check for map->max_osd - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - libceph: reset sparse-read state in osd_fault() - libceph: return the handler error from mon_handle_auth_done() - lib/crypto: aes: Fix missing MMU protection for AES S-box - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit - lib/genalloc: fix device leak in of_gen_pool_get() - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map - libperf event: Ensure tracing data is multiple of 8 sized - lib/vsprintf: Check pointer before dereferencing in time_and_date() - livepatch: Match old_sympos 0 and 1 in klp_find_func() - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - lockd: fix vfs_test_lock() calls - locking/spinlock/debug: Fix data-race in do_raw_write_lock - LoongArch: Add machine_kexec_mask_interrupts() implementation - LoongArch: Add more instruction opcodes and emit_* helpers - LoongArch: Add new PCI ID for pci_fixup_vgadev() - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Automatically disable kaslr if boot from kexec_file - LoongArch: BPF: Sign extend kfunc call arguments - LoongArch: BPF: Zero-extend bpf_tail_call() index - LoongArch: Check the return value when creating kobj - LoongArch: Correct the calculation logic of thread_count - LoongArch: Don't panic if no valid cache info for PCI - LoongArch: Enable exception fixup for specific ADE subcode - LoongArch: Fix build errors for CONFIG_RANDSTRUCT - LoongArch: Fix PMU counter allocation for mixed-type event groups - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Mask all interrupts during kexec/kdump - LoongArch: Refactor register restoration in ftrace_common_return - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED - LoongArch: Update help info of ARCH_STRICT_ALIGN - LoongArch: Use correct accessor to read FWPC/MWPC - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - LoongArch: Use __pmd()/__pte() for swap entry conversions - LoongArch: Use UAPI types in ptrace UAPI header - LoongArch: Use unsigned long for _end and _text - loop: Avoid updating block size under exclusive owner - m68k: bitops: Fix find_*_bit() signatures - macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse - macvlan: fix error recovery in macvlan_common_newlink() - macvlan: fix possible UAF in macvlan_forward_source() - mailbox: mailbox-test: Fix debugfs_create_dir error checking - mailbox: pcc: don't zero error register - mailbox: pcc: Refactor error handling in irq handler into separate function - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - maple_tree: fix tracepoint string pointers - md/raid5: fix IO hang when array is broken with IO inflight - media: adv7180: Add missing lock in suspend callback - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Only validate format in querystd - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() - media: amphion: Add a frame flush mode for decoder - media: amphion: Cancel message work before releasing the VPU core - media: amphion: Delete v4l2_fh synchronously in .release() - media: amphion: Make some vpu_v4l2 functions static - media: amphion: Remove vpu_vb_is_codecconfig - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove - media: cec: Fix debugfs leak on bus_register() failure - media: cx18: Add missing check after DMA map - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - media: fix uninitialized symbol warnings - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe - media: i2c: imx214: Fix link frequency validation - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - media: i2c: mt9v111: fix incorrect type for ret - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - media: imon: make send_packet() more robust - media: lirc: Fix error handling in lirc_register() - media: mc: Clear minor number before put device - media: mc: Fix MUST_CONNECT handling for pads with no links - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() - media: mediatek: vcodec: Use spinlock for context list protection lock - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: ov08x40: Fix the horizontal flip control - media: pci: ivtv: Add missing check after DMA map - media: pci: ivtv: Don't create fake v4l2_fh - media: pvrusb2: Fix incorrect variable used in trace message - media: rc: fix races with imon_disconnect() - media: rc: st_rc: Fix reset control resource leak - media: redrat3: use int type to store negative error codes - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - media: samsung: exynos4-is: fix potential ABBA deadlock on init - media: st-delta: avoid excessive stack usage - media: TDA1997x: Remove redundant cancel_delayed_work in probe - media: tuner: xc5000: Fix use-after-free in xc5000_release - media: tunner: xc5000: Refactor firmware load - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID - media: uvcvideo: Use heuristic to find stream entity - media: v4l2-mem2mem: Fix outdated documentation - media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: verisilicon: Fix CPU stalls on G2 bus error - media: verisilicon: g2: Use common helpers to compute chroma and mv offsets - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index - media: verisilicon: Store chroma and motion vectors offset - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path - media: vidtv: initialize local pointers upon transfer of memory ownership - media: vpif_capture: fix section mismatch - media: vpif_display: fix section mismatch - media: zoran: Remove zoran_fh structure - mei: me: add nova lake point S DID - mei: me: add wildcat lake P DID - mei: trace: treat reg parameter as string - memcg: fix data-race KCSAN bug in rstats - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - memory tiering: add abstract distance calculation algorithms management - memory tiers: use default_dram_perf_ref_source in log message - memstick: Add timeout to prevent indefinite waiting - mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup - mfd: da9055: Fix missing regmap_del_irq_chip() in error path - mfd: da9063: Split chip variant reading in two bus transactions - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: madera: Work around false-positive -Wininitialized warning - mfd: max77620: Fix potential IRQ chip conflict when probing two devices - mfd: mt6358-irq: Fix missing irq_domain_remove() in error path - mfd: mt6397-irq: Fix missing irq_domain_remove() in error path - mfd: rz-mtu3: Fix MTU5 NFCR register offset - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - migrate: correct lock ordering for hugetlb file folios - minixfs: Verify inode mode when loading from disk - minmax: add a few more MIN_T/MAX_T users - minmax: avoid overly complicated constant expressions in VM code - minmax: don't use max() in situations that want a C constant expression - minmax: fix up min3() and max3() too - minmax.h: add whitespace around operators and after commas - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: update some comments - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax: improve macro expansion and type checking - minmax: make generic MIN() and MAX() macros available everywhere - minmax: simplify and clarify min_t()/max_t() implementation - minmax: simplify min()/max()/clamp() implementation - MIPS: Fix a reference leak bug in ip22_check_gio() - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add missing properties to cpu node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow - MIPS: mm: Prevent a TLB shutdown on initial uniquification - misc: fastrpc: Add missing dev_err newlines - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - misc: fastrpc: Fix fastrpc_map_lookup operation - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Skip reference for DMA handles - misc: genwqe: Fix incorrect cmd field being reported in error - mISDN: annotate data-race around dev->work - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats - mlxsw: spectrum_router: Fix neighbour use-after-free - mlxsw: spectrum_router: Fix possible neighbour reference count leak - mm: add folio_expected_ref_count() for reference count calculation - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() - mm/balloon_compaction: we cannot have isolated pages in the balloon list - mmc: core: SPI mode remove cmd7 - mmc: host: renesas_sdhi: Fix the actual clock - mmc: mvsdio: Fix dma_unmap_sg() nents value - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function - mmc: sdhci-cadence: add Mobileye eyeQ support - mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig - mmc: sdhci-msm: Avoid early clock doubling during HS400 transition - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode - mm/damon/core: set quota->charged_from to jiffies at first charge window - mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure - mm/damon/sysfs: fix use-after-free in state_show() - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure - mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() - mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() - mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() - mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() - mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() - mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out() - mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() - mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() - mm/damon/tests/core-kunit: handle memory failure from damon_test_target() - mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() - mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm: fix arithmetic for bdi min_ratio - mm: fix arithmetic for max_prop_frac when setting max_ratio - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: check ref_count instead of lru before migration - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - mm: hugetlb: avoid soft lockup when mprotect to large memory area - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/hugetlb: fix folio is still mapped when deleted - mm: introduce and use {pgd,p4d}_populate_kernel() - mm, kfence: describe @slab parameter in __kfence_obj_info() - mm/kfence: randomize the freelist on initialization - mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios - mm/khugepaged: fix the address passed to notifier on testing young - mm: kmsan: fix poisoning of high-order non-compound pages - mm/ksm: fix exec/fork inheritance support for prctl - mm/ksm: fix flag-dropping behavior in ksm_madvise - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - mm: memcg: add per-memcg zswap writeback stat - mm: memcg: add THP swap out info for anonymous reclaim - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: make stats flushing threshold per-memcg - mm: memcg: move vmstats structs definition above flushing code - mm: memcg: optimize parent iteration in memcg_rstat_updated() - mm: memcg: restore subtree stats flushing - mm/memory: do not populate page table entries beyond i_size - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory - mm/memory-tier: fix abstract distance calculation overflow - mm/mempool: fix poisoning order>0 pages with HIGHMEM - mm/mempool: replace kmap_atomic() with kmap_local_page() - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() - mm: migrate_device: use more folio in migrate_device_finalize() - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - mm/page_alloc: prevent pcp corruption with SMP=n - mm, percpu: do not consider sleepable allocations atomic - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/secretmem: fix use-after-free race in fault handler - mm: simplify folio_expected_ref_count() - mm/truncate: unmap large folio on split failure - mm: workingset: move the stats flush into workingset_test_recent() - most: usb: fix double free on late probe failure - most: usb: Fix use-after-free in hdm_disconnect - most: usb: hdm_probe: Fix calling put_device() before device initialization - mptcp: avoid deadlock on fallback while reinjecting - mptcp: avoid dup SUB_CLOSED events after disconnect - mptcp: avoid unneeded subflow-level drops - mptcp: clear scheduled subflows on retransmit - mptcp: decouple mptcp fastclose from tcp close - mptcp: Disallow MPTCP subflows from sockmap - mptcp: do not fallback when OoO is present - mptcp: drop bogus optimization in __mptcp_check_push() - mptcp: ensure context reset on disconnect() - mptcp: fallback earlier on simult connection - mptcp: fix ack generation for fallback msk - mptcp: fix a race in mptcp_pm_del_add_timer() - mptcp: fix duplicate reset on fastclose - mptcp: fix MSG_PEEK stream corruption - mptcp: fix premature close in case of fallback - mptcp: Fix proto fallback detection with BPF - mptcp: fix race condition in mptcp_schedule_work() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). - mptcp: only reset subflow errors when propagated - mptcp: pm: ignore unknown endpoint flags - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR - mptcp: pm: in-kernel: usable client side with C-flag - mptcp: pm: nl: announce deny-join-id0 flag - mptcp: propagate shutdown to subflows when possible - mptcp: restore window probe - mptcp: schedule rtx timer only after pushing data - mptcp: set remote_deny_join_id0 on SYN recv - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - mptcp: tfo: record 'deny join id0' info - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() - mtdchar: fix integer overflow in read/write ioctls - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds - mtd: nand: raw: atmel: Fix comment in timings preparation - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: relax ECC parameter validation check - mtd: onenand: Pass correct pointer to IRQ handler - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - mtd: rawnand: fsmc: Default to autodetect buswidth - mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove - mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - mtd: rawnand: stm32_fmc2: fix ECC overwrite - nbd: defer config put in recv_work - nbd: defer config unlock in nbd_genl_connect - nbd: restrict sockets to TCP and UDP - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() - net/9p: fix double req put in p9_fd_cancelled - net: Add locking to protect skb->dev access in ip_output - net: add skb_header_pointer_careful() helper - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - net: allow small head cache usage with large MAX_SKB_FRAGS values - net: Allow to use SMP threads for backlog NAPI. - net: aquantia: Add missing descriptor cache invalidation on ATL2 - net: atlantic: fix fragment overflow handling in RX path - net: bcmasp: fix early exit leak with fixed phy - net: bonding: fix possible peer notify event loss or dup issue - net: bridge: annotate data-races around fdb->{updated,used} - net: bridge: Bounce invalid boolopts - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct - net: bridge: fix MST static key usage - net: bridge: fix static key check - net: bridge: fix use-after-free due to MST port state bypass - net: bridge: Install FDB for bridge MAC on VLAN 0 - net: bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry - net: call cond_resched() less often in __release_sock() - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts - net/cls_cgroup: Fix task_get_classid() during qdisc run - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates - netdevsim: add Makefile for selftests - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - net: dlink: handle copy_thresh allocation failure - net: dlink: handle dma_map_single() failure properly - net: don't touch dev->stats in BPF redirect paths - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: dsa: b53: skip multicast entries for fdb_dump() - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: fix off-by-one in maximum bridge ID determination - net: dsa: hellcreek: fix missing error handling in LED registration - net: dsa: improve shutdown sequence - net: dsa: lantiq_gswip: do also enable or disable cpu port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: microchip: common: Fix checks on irq_find_mapping() - net: dsa: microchip: Fix reserved multicast address table programming - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: lan937x: Fix RGMII delay tuning - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: do not transmit redirected XDP frames when the link is down - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - net: enetc: fix the deadlock of enetc_mdio_lock - net: ethernet: adi: adin1110: Check return value of devm_gpiod_get_optional() in adin1110_check_spi() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error - net: fec: cancel perout_timer when PEROUT is disabled - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not register PPS event for PEROUT - net: fec: do not update PEROUT if it is enabled - net: fec: ERR007885 Workaround for XDP TX path - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan - netfilter: ipset: Remove unused htable_bits in macro ahash_region - netfilter: nf_conncount: fix leaked ct in error paths - netfilter: nf_conncount: rework API to use sk_buff directly - netfilter: nf_conncount: update last_gc only when GC has been performed - netfilter: nf_reject: don't reply to icmp error messages - netfilter: nf_tables: allow loads only when register is initialized - netfilter: nf_tables: avoid chain re-validation if possible - netfilter: nf_tables: drop unused 3rd argument from validate callback ops - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - netfilter: nf_tables: fix memory leak in nf_tables_newrule() - netfilter: nf_tables: missing objects with no memcg accounting - netfilter: nf_tables: pass context structure to nft_parse_register_load - netfilter: nf_tables: reject duplicate device on updates - netfilter: nf_tables: remove redundant chain validation on register store - netfilter: nft_connlimit: update the count if add was skipped - netfilter: nft_objref: validate objref and objrefmap expressions - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation - netfilter: nft_synproxy: avoid possible data-race on update operation - netfilter: replace -EEXIST with -EBUSY - net: fix memory leak in skb_segment_list for GRO packets - net: fix NULL pointer dereference in l3mdev_l3_rcv - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - net: gro: fix outer network offset - net/handshake: duplicate handshake cancellations leak socket - net/handshake: Fix memory leak in tls_handshake_accept() - net/handshake: restore destructor on submit failure - net: hns3: add VLAN id validation before using - net: hns3: fix data race in hns3_fetch_stats - net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - net: hns3: return error code when function fails - net: hns3: using the num_tqps in the vf driver to apply for resources - net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx - net: hsr: Add support for MC filtering at the slave device - net: hsr: Add VLAN CTAG filter support - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() - net: hv_netvsc: reject RSS hash key programming without RX indirection table - net: intel: fm10k: Fix parameter idx set but not used - net/ip6_tunnel: Prevent perpetual tunnel growth - net: ipv6: fix field-spanning memcpy warning in AH output - net/ipv6: Remove expired routes with a separated list of routes. - net: lan743x: Allocate rings outside ZONE_DMA - net: lan966x: Fix the initialization of taprio - net: libwx: fix device bus LAN ID - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup - net: liquidio: fix overflow in octeon_init_instr_queue() - net: liquidio: Initialize netdev pointer before queue setup - net: macb: avoid dealing with endianness in macb_set_hwaddr() - net: macb: fix unregister_netdev call order in macb_remove() - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() - net: marvell: prestera: fix NULL dereference on devlink_alloc() failure - net: mdio: aspeed: add dummy read to avoid read-after-write issue - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - net: mdio: fix resource leak in mdiobus_register_device() - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - net/mlx5: Clean up only new IRQ glue on request_irq() failure - net/mlx5: Drain firmware reset in shutdown callback - net/mlx5e: Account for netdev stats in ndo_get_stats64 - net/mlx5e: Consider aggregated port speed during rate configuration - net/mlx5e: Don't print error message due to invalid module - net/mlx5e: Don't query FEC statistics when FEC is disabled - net/mlx5e: Fix maxrate wraparound in threshold between units - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Fix validation logic in rate limiting - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Harden uplink netdev access against device unbind - net/mlx5e: Report rx_discards_phy via rx_dropped - net/mlx5e: Restore destroying state bit after profile cleanup - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload - net/mlx5e: TC, delete flows only for existing peers - net/mlx5e: Use extack in get module eeprom by page callback - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() - net/mlx5: fw reset, add reset timeout work - net/mlx5: fw reset, clear reset requested on drain_fw_reset - net/mlx5: fw_tracer, Handle escaped percent properly - net/mlx5: fw_tracer, Validate format string parameters - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Serialize firmware reset with devlink - net/mlx5: Skip HotPlug check on sync reset using hot reset - net/mlx5: Stop polling for command response if interface goes down - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: mscc: ocelot: Fix crash when adding interface under a lag - net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - net: netpoll: ensure skb_pool list is always initialized - net: netpoll: fix incorrect refcount handling causing incorrect cleanup - net: netpoll: flush skb pool during cleanup - net: netpoll: Individualize the skb pool - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write - net: nfc: nci: Add parameter validation for packet data - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy - net: openvswitch: fix data race in ovs_vport_get_upcall_stats - net: openvswitch: fix middle attribute validation in push_nsh() action - net: openvswitch: remove never-working support for setting nsh fields - net: phy: adin1100: Fix software power-down ready condition - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY - net: phy: clear link parameters on admin link down - net: phy: dp83867: Disable EEE support as not implemented - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - net: phy: fix phy_uses_state_machine() - net: phy: marvell: Fix 88e1510 downshift counter errata - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration - net: phy: move phy_link_change() prior to mdio_bus_phy_may_suspend() - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - netpoll: remove netpoll_srcu - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() - net: ravb: Enforce descriptor type ordering - net: ravb: Ensure memory write completes before ringing TX doorbell - net: Remove conditional threaded-NAPI wakeup based on task state. - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - netrom: fix double-free in nr_route_frame() - netrom: Fix memory leak in nr_sendmsg() - net: rose: fix invalid array index in rose_kill_by_device() - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - net/sched: act_ife: avoid possible NULL deref - net/sched: act_ife: convert comma to semicolon - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net/sched: cls_u32: use skb_header_pointer_careful() - net/sched: Enforce that teql can only be used as root qdisc - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change - net/sched: ets: Remove drr class from the active list if it changes to strict - net_sched: limit try_bulk_dequeue_skb() batches - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop - net/sched: sch_qfq: do not free existing class in qfq_change_class() - net/sched: sch_qfq: Fix null-deref in agg_dequeue - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module - net: sh_eth: Disable WoL if system can not suspend - net/smc: fix mismatch between CLC header and proposal - net: sock: fix hardened usercopy panic in sock_recv_errqueue - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - net: stmmac: Correctly handle Rx checksum offload errors - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - net: stmmac: Fix accessing freed irq affinity_hint - net: stmmac: fix rx limit check in stmmac_rx_zc() - net: stmmac: fix the crash issue for zero copy XDP_TX action - net: stmmac: make sure that ptp_rate is not 0 before configuring EST - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: tls: Cancel RX async resync request on rcd_delta overflow - net: tls: wait for async completion on last message - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - net: update netdev_lock_{type,name} - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - net: usb: asix_devices: Check return value of usbnet_get_endpoints - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock - net: usb: asix: validate PHY address before use - net: usb: dm9601: remove broken SR9700 support - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: pegasus: fix memory leak in update_eth_regs_async() - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast - net: usb: rtl8150: Fix frame padding - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - net: usb: sr9700: fix incorrect command used to write single register - net: usb: sr9700: support devices with virtual driver CD - net: vlan: sync VLAN features with lower device - net: When removing nexthops, don't call synchronize_net if it is not necessary - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() - net: wwan: t7xx: fix potential skb->frags overflow in RX path - nexthop: Forbid FDB status change while nexthop is in a group - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). - nfc: nci: Fix race between rfkill and nci_unregister_device(). - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() - nfp: fix RSS hash key size when RSS is not supported - NFS4: Fix state renewals missing after boot - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags - NFS: Avoid changing nlink when file removes and attribute updates race - NFS: check if suid/sgid was cleared after a write as needed - nfs_common: factor out nfs_errtbl and nfs_stat_to_errno - NFSD/blocklayout: Fix minlength check in proc_layoutget - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap - nfsd: convert to new timestamp accessors - nfsd: decouple the xprtsec policy check from check_nfsd_access() - NFSD: Define a proc_layoutcommit for the FlexFiles layout type - nfsd: don't ignore the return code of svc_proc_register() - nfsd: Drop the client reference in client_states_open() - nfsd: Fix a regression in nfsd_setattr() - NFSD: Fix crash in nfsd4_read_release() - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - NFSD: Fix last write offset handling in layoutcommit - nfsd: Fix NFSv3 atomicity bugs in nfsd_setattr() - NFSD: Fix permission check for read access to executable-only files - NFSD: fix race between nfsd registration and exports_proc - NFSD: free copynotify stateid in nfs4_free_ol_stateid() - nfsd: Mark variable __maybe_unused to avoid W=1 build break - NFSD: Minor cleanup in layoutcommit processing - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: NFSv4 file creation neglects setting ACL - nfsd: provide locking for v4_end_grace - NFSD: Remove NFSERR_EAGAIN - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - NFSD: Rework encoding and decoding of nfsd4_deviceid - nfsd: set security label during create operations - NFSD: use correct reservation type in nfsd4_scsi_fence_client - NFS: enable nconnect for RDMA - NFS: Fix inheritance of the block sizes when automounting - NFS: Fix up the automount fs_context to use the correct cred - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() - NFS: Initialise verifiers for visible dentries in readdir and lookup - NFS: Serialise O_DIRECT i/o and truncate() - NFS: sysfs: fix leak when nfs_client kobject add fails - NFS: trace: show TIMEDOUT instead of 0x6e - NFSv4.1: fix backchannel max_resp_sz verification check - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Don't clear capabilities that won't be reset - NFSv4: ensure the open stateid seqid doesn't go backwards - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4: handle ERR_GRACE on delegation recalls - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - nilfs2: Fix potential block overflow that cause system hang - nios2: ensure that memblock.current_limit is set when setting pfn limits - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot - NTB: epf: Allow arbitrary BAR mapping - ntfs3: Fix uninit buffer allocated by __getname() - ntfs3: fix uninit memory after failed mi_read in mi_format_new - ntfs3: init run lock for extend inode - ntfs3: pretend $Extend records as regular files - ntfs: Do not overwrite uptodate pages - ntfs: set dummy blocksize to read boot_block when mounting - null_blk: fix kmemleak by releasing references to fault configfs items - null_blk: Fix the description of the cache_size module argument - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - nvme-auth: use kvfree() for memory allocated with kvcalloc() - nvme-fc: don't hold rport lock when putting ctrl - nvme-fc: release admin tagset if init fails - nvme-fc: rename free_ctrl callback to match name pattern - nvme-fc: use lock accessing port_state and rport state - nvme: fix admin request_queue lifetime - nvme: fix PCIe subsystem reset controller state transition - nvme-multipath: fix lockdep WARN due to partition scan work - nvme-multipath: Skip nr_active increments in RETRY disposition - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - nvme-pci: disable secondary temp for Wodposit WPBSNM8 - nvme-pci: do not directly handle subsys reset fallout - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - nvmet-fc: avoid scheduling association deletion twice - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - nvmet-tcp: remove boilerplate code - nvme: Use non zero KATO for persistent discovery connections - objtool: Fix standalone --hacks=jump_label - objtool: Fix weak symbol detection - ocfs2: clear extent cache after moving/defragmenting extents - ocfs2: fix double free in user_cluster_connect() - ocfs2: fix kernel BUG in ocfs2_find_victim_chain - ocfs2: fix memory leak in ocfs2_merge_rec_left() - ocfs2: fix recursive semaphore deadlock in fiemap call - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() - octeon_ep: Fix memory leak in octep_device_setup() - octeontx2-af: Fix error handling - octeontx2: cn10k: fix RX flowid TCAM mask handling - octeontx2: Fix otx2_dma_map_page() error return code - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - of: fix reference count leak in of_alias_scan() - of: platform: Use default match table for /firmware - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - once: fix race by moving DO_ONCE to separate section - openat2: don't trigger automounts with RESOLVE_NO_XDEV - orangefs: fix xattr related buffer overflow... - padata: Reset next CPU when reorder sequence wraps around - page_pool: always add GFP_NOWARN for ATOMIC allocations - page_pool: Clamp pool size to max 16K pages - page_pool: Fix use-after-free in page_pool_recycle_in_ring - parisc: Do not reprogram affinitiy on ASP chip - parisc: don't reference obsolete termio struct for TC* constants - parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() - parisc: entry.S: fix space adjustment on interruption for 64-bit userspace - parisc: Remove spurious if statement from raw_copy_from_user() - PCI: Add PCI_VDEVICE_SUB helper macro - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/AER: Support errors introduced by PCIe r6.0 - PCI: brcmstb: Fix disabling L0s capability - PCI: cadence: Check for the existence of cdns_pcie::ops before using it - PCI: Disable MSI on RDC PCI to PCIe bridges - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - PCI: j721e: Fix programming sequence of "strap" settings - PCI: keystone: Exit ks_pcie_probe() for invalid mode - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths - PCI/PM: Skip resuming to D0 if device is disconnected - PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2 - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI/sysfs: Ensure devices are powered for config reads - PCI/sysfs: Ensure devices are powered for config reads (part 2) - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - perf arm-spe: Extend branch operations - perf arm_spe: Fix memset subclass in operation - perf: arm_spe: Prevent overflow in PERF_IDX2OFF() - perf arm-spe: Rename the common data source encoding - perf evsel: Avoid container_of on a NULL leader - perf evsel: Ensure the fallback message is always written to - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf lock contention: Load kernel map before lookup - perf maps: Add maps__load_first() - perf python: split Clang options when invoking Popen - perf record: skip synthesize event when open evsel failed - perf: sched: Fix perf crash with new is_user_task() helper - perf session: Fix handling when buffer exceeds 2 GiB - perf: Skip user unwind if the task is a kernel thread - perf subcmd: avoid crash in exclude_cmds when excludes is empty - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf test stat: Avoid hybrid assumption when virtualized - perf tools: Add fallback for exclude_guest - perf tools: Fix split kallsyms DSO counting - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - perf util: Fix compression checks returning -1 as bool - perf/x86/amd: Check event before enable to avoid GPF - perf/x86/intel: Correct large PEBS flag check - perf/x86/intel: Do not enable BTS for guests - phy: broadcom: bcm63xx-usbh: fix section mismatches - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - phy: cdns-dphy: Store hs_clk_rate and return it - phy: drop probe registration printks - phy: freescale: imx8m-pcie: assert phy reset during power on - phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it - phy: mscc: Fix PTP for VSC8574 and VSC8572 - phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path - phy: phy-snps-eusb2: refactor constructs names - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() - phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() - phy: rockchip: inno-usb2: fix communication disruption in gadget mode - phy: rockchip: inno-usb2: fix disconnection in gadget mode - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: stm32-usphyc: Fix off by one in probe() - phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 - phy: tegra: xusb: fix device and OF node leak at probe - phy: ti: omap-usb2: fix device leak at unbind - phy: ti-pipe3: fix device leak at unbind - phy: Use device_get_match_data() - pid: Add a judgment for ns null in pid_nr_ns - pinctrl: check the return value of pinmux_ops::get_function_name() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - pinctrl: keembay: release allocated memory in detach path - pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver - pinctrl: meson-gxl: add missing i2c_d pinmux - pinctrl: meson: mark the GPIO controller as sleeping - pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping - pinctrl: qcom: msm: Fix deadlock in pinmux configuration - pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins - pinctrl: renesas: Use int type to store negative error codes - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: samsung: Drop unused S3C24xx driver data - pinctrl: single: fix bias pull up/down handling in pin_config_set - pinctrl: single: Fix incorrect type for error return variable - pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling - pinctrl: stm32: fix hwspinlock resource leak in probe function - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver - platform/x86: acer-wmi: Ignore backlight event - platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - platform/x86: asus-wmi: use brightness_set_blocking() for kbd led - platform/x86: hp-bioscfg: Fix automatic module loading - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names - platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing - platform/x86: hp-bioscfg: Skip empty attribute names - platform/x86: huawei-wmi: add keys for HONOR models - platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic - platform/x86: intel: chtwc_int33fe: don't dereference swnode args - platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks - platform/x86: intel: punit_ipc: fix memory corruption - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - platform/x86: intel_telemetry: Fix PSS event register mask - platform/x86: intel_telemetry: Fix swapped arrays in PSS output - platform/x86: msi-laptop: add missing sysfs_remove_group() - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - pmdomain: arm: scmi: Fix genpd leak on provider registration failure - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains - pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu - pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup - pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup - pmdomain: imx: Fix reference count leak in imx_gpc_probe() - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset - pmdomain: qcom: rpmhpd: Add MXC to SC8280XP - pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state - pmdomain: samsung: plug potential memleak during probe - pmdomain: Use device_get_match_data() - PM: runtime: Add new devm functions - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - PM: sleep: core: Clear power.must_resume in noirq suspend error path - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - posix-clock: introduce posix_clock_context concept - posix-clock: Store file pointer in struct posix_clock_context - powercap: fix race condition in register_control_type() - powercap: fix sscanf() error return value handling - powerpc/32: Fix unpaired stwcx. on interrupt exit - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit - powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format - powerpc/64s/radix/kfence: map __kfence_pool at page granularity - powerpc/64s/slb: Fix SLB multihit issue during SLB preload - powerpc/addnote: Fix overflow on 32-bit builds - powerpc/eeh: Use result of error_detected() in uevent - powerpc/kexec: Enable SMT before waking offline CPUs - powerpc, mm: Fix mprotect on book3s 32-bit - powerpc/powernv/pci: Fix underflow and leak issue - powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages - powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION - powerpc/pseries/msi: Fix potential underflow and leak issue - power: supply: apm_power: only unset own apm_get_power_status - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery - power: supply: bq27xxx: restrict no-battery detection to bq27000 - power: supply: cw2015: Check devm_delayed_work_autocancel() return code - power: supply: cw2015: Fix a alignment coding style issue - power: supply: max77976_charger: fix constant current reporting - power: supply: qcom_battmgr: add OOI chemistry - power: supply: qcom_battmgr: handle charging state change notifications - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() - power: supply: sbs-charger: Support multiple devices - power: supply: wm831x: Check wm831x_set_bits() return value - pps: fix warning in pps_register_cdev when register device fail - proc: fix type confusion in pde_set_flags() - ps3disk: use memcpy_{from,to}_bvec index - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. - ptp: add testptp mask test - ptp: Limit time setting of PTP clocks - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() - pwm: bcm2835: Make sure the channel is enabled after pwm_request() - pwm: berlin: Fix wrong register in suspend/resume - pwm: stm32: Always program polarity - pwm: tiehrpwm: Fix corner case in clock divisor calculation - qed: Don't collect too many protection override GRC elements - quota: remove unneeded return value of register_quota_format - r8152: add error handling in rtl8152_driver_init - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - r8169: fix RTL8117 Wake-on-Lan in DASH mode - r8169: set EEE speed down ratio to 1 - rbd: check for EOD after exclusive lock is ensured to be held - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - RDMA/bnxt_re: fix dma_free_coherent() pointer - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() - RDMA/bnxt_re: Fix the inline size for GenP7 devices - RDMA/bnxt_re: Fix to use correct page size for PDE table - RDMA/cm: Fix leaking the multicast GID table reference - RDMA/cm: Rate limit destroy CM ID timeout error message - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() - RDMA/core: Resolve MAC of next-hop device without ARP support - RDMA/efa: Remove possible negative shift - RDMA/hns: Fix the modification of max_send_sge - RDMA/hns: Fix wrong WQE data when QP wraps around - RDMA/irdma: Add support to re-register a memory region - RDMA/irdma: avoid invalid read in irdma_net_event - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY - RDMA/irdma: Fix data race in irdma_free_pble - RDMA/irdma: Fix data race in irdma_sc_ccq_arm - RDMA/irdma: Fix SD index calculation - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/mlx5: Fix vport loopback forcing for MPV device - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation - RDMA/rtrs: server: Fix error handling in get_or_create_srv - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure - RDMA/rxe: Fix race in do_task() when draining - RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests - RDMA/rxe: Remove the direct link to net_device - RDMA/siw: Always report immediate post SQ errors - rds: Fix endianness annotation for RDS_MPATH_HASH - rds: ib: Increment i_fastreg_wrs before bailing out - regmap: Fix race condition in hwspinlock irqsave routine - regmap: maple: free entry on mas_store_gfp() failure - regmap: Remove superfluous check for !config in __regmap_init() - regmap: slimbus: fix bus_context pointer in regmap init calls - regulator: core: disable supply if enabling main regulator fails - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex - regulator: fixed: fix GPIO descriptor leak on register failure - regulator: scmi: Use int type to store negative error codes - regulator: sy7636a: fix lifecycle of power good gpio - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - remoteproc: qcom: q6v5: Avoid handling handover twice - remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - reset: fix BIT macro reference - resource: introduce is_type_match() helper and use it - resource: replace open coded resource_intersection() - resource: Reuse for_each_resource() macro - Revert "cpuidle: menu: Avoid discarding useful information" - Revert "driver core: enforce device_lock for driver_match_device()" - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - Revert "gfs2: Fix use of bio_chain" - Revert "iommu/amd: Skip enabling command/event buffers for kdump" - Revert "ipmi: fix msg stack when IPMI is disconnected" - Revert "loop: Avoid updating block size under exclusive owner" - Revert "mtd: rawnand: marvell: fix layouts" - Revert "net: Allow to use SMP threads for backlog NAPI." - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - Revert "net: Remove conditional threaded-NAPI wakeup based on task state." - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Revert "nfc/nci: Add the inconsistency check between the input data length and count" - Revert "nfs: clear SB_RDONLY before getting superblock" - Revert "nfs: ignore SB_RDONLY when mounting nfs" - Revert "nfs: ignore SB_RDONLY when remounting nfs" - Revert "perf dso: Add missed dso__put to dso__load_kcore" - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - Revert "SUNRPC: Don't allow waiting for exiting tasks" - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - Revert "xfrm: destroy xfrm_state synchronously on net exit path" - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - riscv: bpf: Fix uninitialized symbol 'retval_off' - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - riscv: clocksource: Fix stimecmp update hazard on RV32 - riscv: compat: fix COMPAT_UTS_MACHINE definition - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - RISC-V: Don't print details of CPUs disabled in DT - riscv: Improve exception and system call latency - riscv: kprobes: Fix probe address validation - RISC-V: KVM: Fix guest page fault within HLV* instructions - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - RISC-V: Remove unnecessary include from compat.h - riscv: Replace function-like macro by static inline function - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: stacktrace: fix backtracing through exceptions - riscv: uprobes: Add missing fence.i after building the XOL buffer - rocker: fix memory leak in rocker_world_port_post_fini() - rpmsg: glink: fix rpmsg device leak - rseq: Protect event mask against membarrier IPI - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: gamecube: Check the return value of ioremap() - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - rtc: interface: Fix long-standing race when setting alarm - rtc: optee: fix memory leak on driver removal - rtc: pcf2127: clear minute/second interrupt - rtc: pcf2127: fix SPI command byte for PCF2131 backport - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - rtc: rx8025: fix incorrect register reference - rtc: x1205: Fix Xicor X1205 vendor prefix - rtnetlink: Allow deleting FDB entries in user namespace - rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target - s390/ap: Don't leak debug feature files if AP instructions are not available - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/cio: Update purge function to unregister the unused subchannels - s390/cpum_cf: Deny all sampling events by counter PMU - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - s390/ctcm: Fix double-kfree - s390/dasd: Fix gendisk parent after copy pair swap - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - s390/ipl: Clear SBP flag when bootprog is set - s390/mm: Fix __ptep_rdp() inline assembly - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump - s390/pci: Restore IRQ unconditionally for the zPCI device - s390/pci: Use pci_uevent_ers() in PCI recovery - s390/smp: Fix fallback CPU detection - samples/ftrace: Adjust LoongArch register restore order in direct calls - samples: work around glibc redefining some of our defines wrong - sched/balancing: Rename newidle_balance() => sched_balance_newidle() - sched/deadline: Fix race in push_dl_task() - sched/deadline: only set free_cpus for online runqueues - sched/fair: Fix pelt lost idle time detection - sched/fair: Forfeit vruntime on yield - sched/fair: Proportional newidle balance - sched/fair: Revert max_newidle_lb_cost bump - sched/fair: Small cleanup to sched_balance_newidle() - sched/fair: Small cleanup to update_newidle_cost() - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - sched: Remove never used code in mm_cid_get() - sched/rt: Fix race in push_rt_task - scripts: generate_rust_analyzer: Add compiler_builtins -> core dep - scs: fix a wrong parameter in __scs_magic - scsi: aic94xx: fix use-after-free in device removal path - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() - scsi: core: Fix a regression triggered by scsi_host_busy() - scsi: core: Fix error handler encryption support - scsi: core: Wake up the error handler when final completions race against each other - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: mpi3mr: Fix controller init failure on fault during queue creation - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - scsi: myrs: Fix dma_alloc_coherent() error check - scsi: pm8001: Use int instead of u32 to store error codes - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod - scsi: pm80xx: Fix race condition caused by static variables - scsi: qla2xxx: Allow recovery for tape devices - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: edif: Fix dma_free_coherent() size - scsi: qla2xxx: edif: Fix incorrect sign of error code - scsi: qla2xxx: Fix improper freeing of purex item - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Query FW again before proceeding with login - scsi: qla2xxx: Sanitize payload size to prevent member overflow - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp - scsi: qla2xxx: Validate sp before freeing associated memory - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - scsi: sg: Do not sleep in atomic context - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls - scsi: smartpqi: Fix device resources accessed after device removal - scsi: stex: Fix reboot_notifier leak in probe error path - scsi: storvsc: Process unsupported MODE_SENSE_10 - scsi: target: Do not write NUL characters into ASCII configfs output - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - scsi: target: Reset t_task_cdb pointer in error case - scsi: target: target_core_configfs: Add length check to avoid buffer overflow - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error - scsi: ufs: core: Disable timestamp functionality if not supported - scsi: ufs: core: Fix EH failure after W-LUN resume error - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() - sctp: avoid NULL dereference when chunk data buffer is missing - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). - sctp: Fix MAC comparison to be constant-time - sctp: Hold RCU read lock while iterating over address list - sctp: Hold sock lock while iterating over address list - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - sctp: Prevent TOCTOU out-of-bounds write - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - selftest/ptp: update ptp selftest to exercise the gettimex options - selftests: arg_parsing: Ensure data is flushed to disk before reading. - selftests: arm64: Check fread return value in exec_target - selftests: bonding: add delay before each xvlan_over_bond connectivity check - selftests: bonding: add ipvlan over bond testing - selftests: bonding: add missing build configs - selftests: bonding: Add more missing config options - selftests/bpf: Check for timeout in perf_link test - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - selftests/bpf: Fix failure paths in send_signal test - selftests/bpf: Improve reliability of test_perf_branches_no_hw() - selftests/bpf: make arg_parsing.c more robust to crashes - selftests/bpf: skip test_perf_branches_hw() on unsupported platforms - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - selftests: Disable dad for ipv6 in fcnal-test.sh - selftests: drv-net: fix RPS mask handling for high CPU numbers - selftests: fib_nexthops: Fix creation of non-FDB nexthops - selftests/ftrace: traceonoff_triggers: strip off names - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: check no dup close events after error - selftests: mptcp: check subflow errors in close events - selftests: mptcp: connect: catch IO errors on listen side - selftests: mptcp: connect: fix fallback note due to OoO - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: disable add_addr retrans in endpoint_tests - selftests: mptcp: join: endpoints: longer transfer - selftests: mptcp: join: fix local endp not being tracked - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: properly kill background tasks - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: join: validate C-flag + def limit - selftests: mptcp: pm: ensure unknown flags are ignored - selftests: mptcp: sockopt: fix error messages - selftests: mptcp: userspace pm: validate deny-join-id0 flag - selftests: net: amt: wait longer for connection before sending packets - selftests/net: convert fib-onlink-tests.sh to run it in unique namespace - selftests/net: convert sctp_vrf.sh to run it in unique namespace - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - selftests: netdevsim: set test timeout to 10 minutes - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests: net: fib-onlink-tests: Convert to use namespaces by default - selftests: net: fix "buffer overflow detected" for tap.c - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - selftests: net: fix server bind failure in sctp_vrf.sh - selftests: net: local_termination: Wait for interfaces to come up - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - selftests: net: replace sleeps in fcnal-test with waits - selftests: net: use BASH for bareudp testing - selftests/net: use destination options instead of hop-by-hop - selftests/nolibc: fix EXPECT_NZ macro - selftests: openvswitch: Fix escape chars in regexp. - selftests: Replace sleep with slowwait - selftests: traceroute: Use require_command() - selftests/tracing: Run sample events to clear page cache events - selftests/user_events: fix type cast for write_index packed member in perf_test - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - serial: 8250_dw: handle reset control deassert error - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_pci: Fix broken RS485 for F81504/508/512 - serial: add support of CPCI cards - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - serial: max310x: Add error checking in probe() - serial: sc16is7xx: fix bug in flow control levels init - serial: sc16is7xx: refactor EFR lock - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - serial: sc16is7xx: remove useless enable of enhanced features - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sprd: Return -EPROBE_DEFER when uart clock is not ready - serial: stm32: allow selecting console when the driver is module - sfc: fix potential memory leak in efx_mae_process_mport() - shmem: fix tmpfs reconfiguration (remount) when noswap is set - slimbus: core: fix device reference leak on report present - slimbus: core: fix runtime PM imbalance on report present - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - smack: fix bug: unprivileged task can create labels - smb: client: fix cifs_pick_channel when channel needs reconnect - smb: client: fix crypto buffers in non-linear memory - smb: client: fix incomplete backport in cfids_invalidation_worker() - smb: client: fix memory leak in cifs_construct_tcon() - smb/client: fix memory leak in smb2_open_file() - smb: client: fix missing timestamp updates after utime(2) - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value - smb/client: fix NT_STATUS_NO_DATA_DETECTED value - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value - smb: client: fix potential cfid UAF in smb2_query_info_compound - smb: client: fix potential UAF in smb2_close_cached_fid() - smb: client: Fix refcount leak for cifs_sb_tlink - smb: client: fix refcount leak in smb2_set_path_attr - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path - smb: client: fix wrong index reference in smb2_compound_op() - smb: client: introduce close_cached_dir_locked() - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - smb: client: transport: avoid reconnects triggered by pending task work - smb: client: validate change notify buffer before copy - smb: fix invalid username check in smb3_fs_context_parse_param() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: don't use delayed_work for post_recv_credits_work - smb: server: fix IRD/ORD negotiation with the client - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - smb/server: fix possible memory leak in smb2_read() - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix refcount leak in parse_durable_handle_context() - smb/server: fix refcount leak in smb2_open() - smb/server: fix return value of smb2_ioctl() - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - smc91x: fix broken irq-context in PREEMPT_RT - smp: Fix up and expand the smp_call_function_many() kerneldoc - smsc911x: add second read of EEPROM mac when possible corruption seen - soc: amlogic: canvas: fix device leak on lookup - soc: aspeed: socinfo: Add AST27xx silicon IDs - soc: qcom: ocmem: fix device leak on lookup - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: qcom: smem: fix hwspinlock resource leak in probe error paths - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - sparc64: fix hugetlb for sun4u - sparc64: fix prototypes of reads[bwl]() - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix error handling in scan_one_device() - sparc/module: Add R_SPARC_UA64 relocation handling - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: cadence-quadspi: Fix clock disable on probe failure path - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - spi: cadence-quadspi: Implement refcount to handle unbind during busy - spi: fsl-cpm: Check length parity before switching to 16 bit mode - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - spi: imx: keep dma request disabled before dma transfer setup - spi: loopback-test: Don't use %pK through printk - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: rpc-if: Add resume support for RZ/G3E - spi: spi-mem: Add a new controller capability - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-nxp-fspi: add extra delay after dll locked - spi: spi-sprd-adi: Fix double free in probe error path - spi: sprd-adi: switch to use spi_alloc_host() - spi: sprd: adi: Use devm_register_restart_handler() - spi: tegra114: Preserve SPI mode bits in def_command1_reg - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - spi: tegra210-quad: Fix timeout handling - spi: tegra210-quad: Move curr_xfer read inside spinlock - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer - spi: tegra: Fix a memory leak in tegra_slink_probe() - spi: Try to get ACPI GPIO IRQ earlier - spi: xilinx: increase number of retries before declaring stall - Squashfs: add additional inode sanity checking - Squashfs: fix uninit-value in squashfs_get_parent - Squashfs: reject negative file sizes in squashfs_read_inode() - staging: axis-fifo: fix maximum TX packet length check - staging: axis-fifo: fix TX handling on copy_from_user() failure - staging: axis-fifo: flush RX FIFO on read errors - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() - staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0 - staging: most: remove broken i2c driver - staging: rtl8712: Remove driver using deprecated API wext - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing - strparser: Fix signed/unsigned mismatch bug - SUNRPC: call xs_sock_process_cmsg for all cmsg - sunrpc: fix null pointer dereference on zero-length checksum - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - svcrdma: bound check rq_pages index in inline path - svcrdma: return 0 on success from svc_rdma_copy_inline_range - task_work: Fix NMI race condition - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - tcp: fix __tcp_close() to only send RST when required - tcp: fix tcp_tso_should_defer() vs large RTT - tcpm: allow looking for role_sw device in the main node - tcpm: switch check for role_sw device with fw_node - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - team: fix check for port enabled in team_queue_override_port_prio_changed() - team: Move team device type change at the end of team_port_add - tee: allow a driver to allocate a tee_device without a pool - testptp: Add option to open PHC in readonly mode - textsearch: describe @list member in ts_ops search - tg3: prevent use of uninitialized remote_adv and local_adv variables - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - thunderbolt: Add support for Intel Wildcat Lake - thunderbolt: Use is_pciehp instead of is_hotplug_bridge - timers: Fix NULL function pointer race in timer_shutdown_sync() - tipc: Fix use-after-free in tipc_mon_reinit_self(). - tipc: use kfree_sensitive() for session key material - ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx - tls: always set record_type in tls_process_cmsg - tls: don't rely on tx_work during send() - tls: make sure to abort the stream if headers are bogus - tls: trim encrypted message to match the plaintext on short splice - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). - tls: wait for async encrypt in case of error during latter iterations of sendmsg - tls: wait for pending async decryptions if tls_strp_msg_hold fails - tools bitmap: Add missing asm-generic/bitsperlong.h include - tools build: Align warning options with perf - tools/cpupower: fix error return value in cpupower_write_sysfs() - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - tools: lib: thermal: don't preserve owner in install - tools: lib: thermal: use pkg-config to locate libnl3 - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/testing/nvdimm: Use per-DIMM device handle - tools: ynl: Specify --no-line-number in ynl-regen.sh. - tpm: Cap the number of PCR banks - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - tracefs: fix a leak in eventfs_create_events_dir() - tracing: Do not register unsupported perf events - tracing: dynevent: Add a missing lockdown check on dynevent - tracing: Fix crash on synthetic stacktrace field usage - tracing: Fix fixed array of synthetic event - tracing: Fix ftrace event field alignments - tracing: Fix memory leaks in create_field_var() - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference - tracing: Fix tracing_marker may trigger page fault during preempt_disable - tracing: Silence warning when chunk allocation fails in trace_pid_write - tracing/tools: Fix incorrcet short option in usage text for --threads - tty: fix tty_port_tty_*hangup() kernel-doc - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - tty: introduce and use tty_port_tty_vhangup() helper - tty: n_gsm: Don't block input queue by waiting MSC - tunnels: reset the GSO metadata before reusing the skb - uacce: ensure safe queue release with state management - uacce: fix cdev handling in the cleanup path - uacce: fix isolate sysfs check condition - uacce: implement mremap in uacce_vm_ops to return -EPERM - ublk: complete command synchronously on error - ublk: fix deadlock when reading partition table - ublk: make sure io cmd handled in submitter task context - ublk: prevent invalid access with DEBUG - udp_tunnel: use netdev_warn() instead of netdev_WARN() - uio_hv_generic: Let userspace take care of interrupt mask - uio_hv_generic: Set event for all channels on the device - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe - um: Fix help message for ssl-non-raw - um: virtio_uml: Fix use-after-free after put_device in probe - Unbreak 'make tools/*' for user-space targets - uprobe: Do not emulate/sstep original instruction when ip is changed - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - usb: cdns3: Fix double resource release in cdns3_pci_probe - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget - usb: chaoskey: fix locking for O_NONBLOCK - usb: core: Add 0x prefix to quirks debug output - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor - usb/core/quirks: Add Huawei ME906S to wakeup quirk - usb: dwc2: disable platform lowlevel hw resources during shutdown - usb: dwc2: fix hang during shutdown if set as peripheral - usb: dwc2: fix hang during suspend if set as peripheral - usb: dwc3: Check for USB4 IP_NAME - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: keep susphy enabled during exit to avoid controller faults - usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: dwc3: pci: Sort out the Intel device IDs - USB: Fix descriptor count when handling invalid MBIM extended descriptor - usb: gadget: configfs: Correctly set use_os_string at bind - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - usb: gadget: f_hid: Fix zero length packet transfer - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: lpc32xx_udc: fix clock imbalance in error path - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - usb: gadget: Store endpoint pointer in usb_request - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - usbip: Fix locking bug in RT-enabled kernels - USB: lpc32xx_udc: Fix error handling in probe - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - usbnet: Fix using smp_processor_id() in preemptible code warnings - usbnet: limit max_mtu based on device's hard_mtu - usbnet: Prevents free active kevent - usb: ohci-nxp: fix device leak on probe failure - usb: ohci-nxp: Use helper function devm_clk_get_enabled() - USB: OHCI/UHCI: Add soft dependencies on ehci_platform - usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal - usb: phy: Initialize struct usb_phy list_head - usb: phy: isp1301: fix non-OF device reference imbalance - usb: phy: twl6030: Fix incorrect type for ret - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - usb: raw-gadget: do not limit transfer length - usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() - usb: renesas_usbhs: Fix synchronous external abort on unbind - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - USB: serial: ftdi_sio: match on interface number for jtag - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC - USB: serial: option: add Foxconn T99W760 - USB: serial: option: add Quectel RG255C - USB: serial: option: add SIMCom 8230C compositions - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: option: add Telit Cinterion FE910C04 new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Telit LE910 MBIM composition - USB: serial: option: add UNISOC UIS7720 - USB: serial: option: move Telit 0x10c7 composition in the right place - usb: storage: Fix memory leak in USB bulk transport - USB: storage: Remove subclass and protocol overrides from Novatek quirk - usb: storage: sddr55: Reject out-of-bound new_pba - usb: typec: tipd: Clear interrupts first - usb: typec: ucsi: Handle incorrect num_connectors capability - usb: typec: ucsi: psy: Set max current to zero when disconnected - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer - usb: udc: Add trace event for usb_gadget_set_state - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. - usb: vhci-hcd: Prevent suspending virtually attached devices - usb: xhci: Apply the link chain quirk on NEC isoc endpoints - usb: xhci: limit run_graceperiod for only usb 3.0 devices - usb: xhci: move link chain bit quirk checks into one helper function. - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - vdpa/pds: use %pe for ERR_PTR() in event handler registration - veth: fix data race in veth_get_ethtool_stats - vfio/pds: replace bitmap_free with vfree - vfio: return -ENOTTY for unsupported device feature - vfs: Don't leak disconnected dentries on umount - vhost: Take a reference on the task in struct vhost_task. - vhost: vringh: Fix copy_to_iter return value check - vhost: vringh: Modify the return value check - vhost/vsock: improve RCU read sections around vhost_vsock_get() - via_wdt: fix critical boot hang due to unnamed resource allocation - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - virtio_console: fix order of fields cols and rows - virtio: fix typo in virtio_device_ready() comment - virtio: fix virtqueue_set_affinity() docs - virtio: fix whitespace in virtio_config_ops - virtio-net: fix incorrect flags recording in big mode - virtio-net: fix received length check in big packets - virtio_vdpa: fix misleading return in void function - vmxnet3: unregister xdp rxq info in the reset path - vsock: fix lock inversion in vsock_assign_transport() - vsock: Ignore signal/timeout on connect() if already established - vsock/test: add a final full barrier after run all tests - vsock/test: fix seqpacket message bounds test - vsock/test: verify socket options after setting them - vsock/virtio: cap TX credit to local buffer size - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - w1: fix redundant counter decrement in w1_attach_slave_device() - w1: therm: Fix off-by-one buffer overflow in alarms_store - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - watchdog: starfive: Fix resource leak in probe error path - watchdog: wdat_wdt: Fix ACPI table leak in probe function - wifi: ath10k: avoid unnecessary wait for service ready message - wifi: ath10k: Fix connection after GTK rekeying - wifi: ath10k: fix dma_free_coherent() pointer - wifi: ath10k: Fix memory leak on unsupported WMI command - wifi: ath11k: Add missing platform IDs for quirk table - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode - wifi: ath11k: fix peer HE MCS assignment - wifi: ath11k: fix RCU stall while reaping monitor destination ring - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - wifi: ath12k: fix dma_free_coherent() pointer - wifi: ath12k: free skb during idr cleanup callback - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - wifi: avoid kernel-infoleak from struct iw_point - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - wifi: cfg80211: Fix bitrate calculation overflow for HE rates - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() - wifi: ieee80211: correct FILS status codes - wifi: mac80211: collect station statistics earlier when disconnect - wifi: mac80211: correctly check if CSA is active - wifi: mac80211: Discard Beacon frames to non-broadcast address - wifi: mac80211: do not use old MBSSID elements - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice - wifi: mac80211: fix CMAC functions not handling errors - wifi: mac80211: Fix HE capabilities element check - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - wifi: mac80211: increase scan_ies_len for S1G - wifi: mac80211: move TDLS work to wiphy work - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined - wifi: mac80211: reject address change while connecting - wifi: mac80211: remove RX_DROP_UNUSABLE - wifi: mac80211: skip rate verification for not captured PSDUs - wifi: mt76: Fix DTS power-limits on little endian systems - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() - wifi: mwifiex: send world regulatory domain to driver - wifi: rsi: Fix memory corruption due to not set vif driver data size - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - wifi: rtw88: sdio: use indirect IO for device registers before power-on - wifi: rtw89: avoid circular locking dependency in ser_state_run() - wifi: virt_wifi: Fix page fault on connect - wifi: wilc1000: avoid buffer overflow in WID string configuration - wifi: wlcore: ensure skb headroom before skb_push - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 - x86/boot: Fix page table access in 5-level to 4-level paging transition - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - x86: disable image size check for test builds - x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - x86/fpu: Ensure XFD state on signal delivery - x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers - x86/kfence: avoid writing L1TF-vulnerable PTEs - x86/kfence: fix booting on 32bit non-PAE systems - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - x86: make page fault handling disable interrupts properly - x86/microcode/AMD: Add more known models to entry sign checking - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - x86/microcode/AMD: Limit Entrysign signature checking to known generations - x86/microcode/AMD: Select which microcode patch to load - x86/microcode: Fix Entrysign revision check for Zen1/Naples - x86/ptrace: Always inline trivial accessors - x86/resctrl: Add missing resctrl initialization for Hygon - x86/resctrl: Fix memory bandwidth counter width for Hygon - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - x86/umip: Check that the instruction opcode is at least two bytes - x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) - x86/vdso: Fix output operand size of RDPID - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - x86/xen: Fix sparse warning in enlighten_pv.c - x86/xen: Move Xen upcall handler - xen/events: Cleanup find_virq() return codes - xen/events: Return -EEXIST for bound VIRQs - xen/events: Update virq_to_irq on migration - xen/manage: Fix suspend error path - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: delete x->tunnel as we delete x - xfrm: Determine inner GSO type from packet inner protocol - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - xfrm: flush all states in xfrm_state_fini - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: state: fix out-of-bounds read during lookup - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - xfs: always warn about deprecated mount options - xfs: fix a memory leak in xfs_buf_item_init() - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - xfs: use deferred intent items for reaping crosslinked blocks - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: decouple endpoint allocation from initialization - xhci: dbc: enable back DbC in resume if it was enabled before suspend - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: poll at different rate depending on data transfer activity - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - xhci: dbgtty: fix device unregister - xhci: dbgtty: fix device unregister: fixup - xhci: fix memory leak regression when freeing xhci vdev devices depth first - xsk: Fix race condition in AF_XDP generic RX path - xtensa: simdisk: add input size check in proc_write_simdisk - Updated by kernel-updater-bot (https://abf.io/mikhailnov/kernel-updater-bot)- Patch from Hans to fix SYNA3602 touchpads- Update initrd size (kb#456)6.6.148-1.module.8812au6.6.148-16.6.148-15.13.6_23_g28812au.ko/lib/modules/6.6.148-desktop-1rosa2021-x86_64/kernel/net/wireless/-O2 -fomit-frame-pointer -gdwarf-4 -Wstrict-aliasing=2 -pipe -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -fPIC -fstack-protector-strong --param=ssp-buffer-size=4 -m64 -mtune=generichttps://rosa.rucpioxz6Tx86_64-rosa-linux-gnuELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=dbdcc0d772ff04db6968ffb01ee3caf00ddbe1d5, not strippedPooorosa2021https://bugzilla.rosa.rubasesystem-minimalfilesystemsetup@@@utf-8447d7d545b87a6db050e362a6cb8082f8ccd7e069b47cf1b101b7932ce2192c5a61b5f4cc9b65d88239fd73fc828e7e8827c3775c8a86da44c93159aafc6366a?7zXZ 1!*}c] crv(vX0bRb(? !wRz1z'TAk= 9]Ks}M[UhWr_4mi;?wyYg؝ſZ(hk1B{D.{^ [2rG>WSZ "7v;Vs\MlEtolgͺThd#PW)XmD#Ә+ʡD&5hb$|"*R*_t gSGn:ѵжĨ ^`  _ZK.^S%~QϽɎҊu?F{ݞaj4*''RL9٤r*N$uysL)3ek;'lDNQ>Wq NO8Rɿ%#q[웍 `p&,/U΃6;^GbHӅ!Buɯ dެP ݩhĶ[&K Mŕ՞r{ `R~z']0co;we ^VޛY$f ־0ÑŐq#0!7pY_.UiR+y*-F I^)HӺ2upߴ^>@4)ZEv8|,vM-fZ+*3-tj%m_lQ Cf{A0k@:?[['nKE~ AyG1Sԓ`kNLM05~VT(/rґ?2`G4ߜ5`!7| GcEQN2Ȓ*pV/ ِJ"߻:JvZ_ˤ~C7XU'zw4ZUD]\My'T{2*Z=O\N (:Йd2ͱ~X5ij" ?k}R?7.f4g^tpպ+1X"̿s֩*KGmv`^\t48)aEɻ'¯Ud )G\o|bg D8FvC:3$"6dKQR;FfJ[J,F* 9 xo5GRZii^\%cF&>%cA[vE"7 DĨtGe?sFg{w;\ˆڸOcc2?=㬜f [̺ ~NI\~E2fv3} `}c,JO:hc>jq|j1:|@M*R4NTaFr:s:apx\zĠRđ]bWc^ъB9a4Hdq/Z+Z<_PVX<,MOƚ  6QtEL4aOp$5ap*,!0ɛ4FP䠈QŶ7gJlED燶wsdif Ia$wvHj ͦ@ qLݾ-U)bۂ5N@q S(-t\ ,Kr- 2܄x㉔]F/2ac.mx6jz\xK])gkZ4,澊'>)K'G0k *ze.&{~av10rtcr:{*gh+[I»c4cNdf<ٌX=<?Kn\ .yWϼgF}iWQBȰ k2: H<& UkxeR(€ Ip:?AQp_LP8BܔqΩ_;ި,V"JȬKt3Dh+#[[S'yY[K$?3ImbOB*7]lɉg{Y\k|L?xV#餏$HoeMfgP݇g Wݩ SJwbZՒDwClRJ#&pb%RgK? n;F֢x-OIna]*Ycr3Xd q OcHߦ]ڭc A"+w&ZmQeRaA n@a>PQQLPqqkAXÉ_ŗfJI]2x£7nWC;)2"&*R2{öx &XiSٷ͡rwя+f5J%??̔^26.-XNc}>q5 w奊U7"KRG~97}O:NΓls ![>Iɖ RqZd#zc ts@TS||[#Tߦb#~5FA+2-P'`gqMQWُ_=^,6XT-Ԯ#o .*spS$`7MF]y{[dR{~./l䨔@>Ï1:z; SA[2d=yF'J `Udh [T+D'"Bj v]sտ6;QTQSWcA$e$[nc|2c@ {~#ƒk[EcUsC1NT;|\?P)NV 0{)=˙U|i|f5I&qlQ㷣 *l #fE=]'d珷Q$1RJ<뫢"eKtY)U?E&ďq}C>ċ Ά+txQyZw2$GuWȴ!ۊGf}Cͤ)X>/XkJzyD*'Cⲡ<1trX@D-O`aLY|"üo\*.7 Y7Z~Ī xV~icZrR9ps1`ܖjLgޑ^/Hb}ÁNG)24+I[irF큔9@הh{yFD{jPh\[sI2J(/ϷϚ[Ө^I3Ag˿c 4'mx/@z~Ͱ"̯"lAd{dc?۽Hlc@O2unݾPf[T\xOivW[kGڿ:j W3<:)a_6MoCZj%ڑ.; SG J~\rЋMgroM?AXck0F=eyF *RlpXS=\ar:~i&+g  QˣB ~*j1FuD\$xdcњ: }WMx&=~ - S*BC̙, j9(sLlζ"qKҬ3T]=c$W7B-y\lsbƌD$ml_4 쏛(;KYF / t^ccj̃߸Ě3);x5ђ!砂DoZvusUtaB_y$sj=8-yOqzJ~H),m'7:R?K~8$OЄpp>OWh9P-!ѱ-L|,fur\׎qԒ_$ruuXϾ$6JJ/$;{j:7d U,PDobiOZ7f566I"^ꡇN:xWn8əSϨ09YiB+]jهLeMD8k;ؾD\D(lzh'H6:j=%x?g\Iw} wlBSOmbp$ŽX]ʶ)n~}y%,Hz*8G|HF]m|iXY@H46Œ%x{T{[5AF/f$925v1?YeߴT7Ž4Tk n5O o\CNv!npV3pJҼb8)χQě 9SQlOe n!EoTcI~*2hQt}37qOl7Ŵܣx r4xu`0H`$>+I xTT_E$&bl0!4ܛ ^雸Bܿ'M1gֆZXgCjK_R?HqymuWhxt bI~)ex?V>ɡ^ %EH.#`~Z9ܡ..y0o4z] >e(wH^ { /cY:c zM)Yu%-/Fyp`ynu ?J_bVP 9yat>:4V}QdRQ2 G~WT𰽌 X}s k6WQݧZZܬ%zJڍסLwAuw8#oN6.po~|*n6hvu`DaEg?T ?[%*}6AS/[9# B&5W{ȧS4V8L!,O} E@qK=߾NIbV8]yԗ*:5i&CegɳJ%p~N_RIe y="d'XVUI.1TfΘb\e;0\aA6j띀P]yOzmS3[&n_o|LKkG+";B{LW͡'?p7g֍ĜZT6v Djp9EըX$Tx4Ul!# (gu+ox6줰 @ yP.$~Nۍ,40Oxg%!6&\.ݻxZn8J |sAO@ֵe!ڬY2X>%4n V-:/'mӗߐ2{5~nfW 22O#hEb9ɹ:N9Qn߄qVtչCLW۲YM-K J9>",VaD} k p`t9?yu0](FUL RWUkwE( b<1O?kҳ:|(S߰<%ϬMW.Y6 $ it6hgXx HY@CɆgWy/yo;_7q`tX-dG j`t+83\?AJV1duHBꠍ!N |e ?Np!~ts>)p[v"LsZF 2:cD8+v Sr}5_[&n}5u\/LněGL2_ό̯/B\ǽ׀j{1 ăҲWz GNG,\0wMS_dպ|mG5 LpmdҪ}c߄X0C a* ,8nvplu@:. # Z{|N_/Q 3>+INPo0 =tB60P um_cLWխXCu|ft$ `Udz%Ob^u/Q49ud~uO&QW|IVaōѧ7OpwK +Nzs{(VbzB>'Xuz Ƨ/7[)l>@nM_5=J0 nAr1pkG0q^NGZ 8Q ?P Iz LL-ҁ6I12oO9*Д vj=RڡGX!rQAIs19ofLƱ@Z x៳]vqNݳ53OBaJyy%k{X])m]G$|~<ۓ{6W4&E:_f}3 序S j6RE@Lv娹ÞFg(6mt*cFvdgFl<v#Jz ғ /tӊjfnn%8#MߌB\Oj;˔քLSt`\|McW(V!?'@a`Cް\ao2bΡYz!F_R\و{?e9YOBM5}Sk8QO_^%M>vɶG5U#Ix,}bQd6=$rs`̒a9 Y˕# bgz=eW- K3ʽTn ht1ϖbI#fH|*YAU(d7JJPb_q_FX~+c룚k!/b^9酅=y/Zg# Z6y4.k=Ń*kkm[4qh{M|j<~jEv'oWU)RN!cԷS۽+b{iaEר \'2˜9id:lYtAPG蓃 &b]΃ Ӄ_a%- lzi@}L%(],A_BLx6Cn[]',$Ou suKHWm=+ rӢh n#*놩/WE Mݗ4N9U$I ^4!@UC+πU ?-E};rsSݘJ, teD.̾Mr/(* 4JnK82ʱ_FҾ$oڂ{4&:}Pd׌`hڬ 5>1HĻ#x x\ +fNE5"{G>ߥZ7(kۤF;9O쀷.FW+F !%i7nxX,پXe=)rIxtbԕƖdGH$$7"Du \fSAы,% Ɗt2:#ci-x(lb.^YhְMX FՀF7Rr %EӾ0 P"? s_T#A~g-'X}xKKZ5Ms|-b) cdž`/CVe]"w թ:A;)PFkJJH|: Jϝe@;t:B8=(-EAHu&NR૥cK']V%eЧ@+U&N,[׋*{Epcɻ[JE׳k&` hB 怫},?+e iYVڒV%+KW(|]=9Hxa!Et_z2@gSxI Xzҟ2v DaD8 Ž(hC@Fc\0*"̒0=cW) U:RFj5!RYec(v>ې X\߿ q0I(^j&Ξc`&r]QW\lHI4&Z{ 3M k*i: ^m14ۊ$ FZ}s ʂ|%܋f{Ƈ}Uԏy/5ap$W.{ bL˥,c~_QjUt"E`<ck@}T|>h:i{D yIpS%zEZSJ́/doגppN{>}o˗3/Zuc6:>tGCp/2[bs$),V]GۖPߏ׌l)JT~=6U]V}oE5( V~&_ l="JxM({B03ܯ\-6eWc=ExXHUVqxSyJOZ)U* p1ـ]t>:[Dk/瑑AÎ.n:ZC@ Dc y8ܕ%ݮmdn`9*axyhBn6b&"IO+_8A&g şeFsL_`ױ%n=C;[MpXMUšz<"%_ÅΪAQG=sF>>7W5&'c~J^߳hWɕ|UH*ɤ]G~VP0:DS0o2%q_. '?뤃0ӖFd,ܝ("G.i{R@DUbQ\}0hM^U,nlDg?,bR4\Թ$ܰqc?!uV1Nf7+ puy?$%WmRU}{-~zpmCj^ Z2$fOIG듼]p0fFOp8%]}G  Y6m 6xvy3<>mh)2j2 fړ#W}x(j03Oa)}2+-V#kp_F}Gi̺-wնBq$O e~fKWxӉ]=+3n>DC:qKxCi꜊v+L9zҗW"HW.p?aT].J?KrGΥÿOo zaB2 !ُz1S]/(uD2nMo"h <X\w[G-Ki9K$ҵ x/b>N8BDCDckU4q+┧>)~ВjjO7 `O9D8T\oixFg z_(?w.z3< ׼&n(WZ(̭L)È\M`/o}rE9)pw!vլΊz)8}f_: k&]ݛI&^&N 0M3<3_ƽV׮PK[8X5eE_gjq^f2u?#4'9%jRB?[CUyrH{d9 [L42<*WY|-o08ZZvRz)hJ>kۜ!=-:}"!=/pyAAVP2kzP^w;Zm+p V: Ga( G|>y?_eJCBJkлwcRa)(`bAi$ƔKây0l]"q+=p}.Js,ɮ 6 .~,!zzk7|NaVQ+ڟo޼McЃ4JupCgr܍ͣTm;KJ=Jp yJHI;dD$y:rfHpR= }8BD%Ƞ3uPT}K̄" c̶j1Q:jn$铑tl0486S z\M'8kfPQBEs\H6* np OmrY( ^[o`OA97Fo8 ݟA*>:MNG8jRzPUjDŽRԶ!@"an{욂Kĺ}Ai>f^̛ٸ-!c {' [ &aXl9OL*9(±cJ3@[|K,G S3_*KaOq(`-~h-dcSA ynT_ .A7lxR"bkr &3DU2 U*!-`o׏=~&JY PPq2N̏W*_҆i4⼿B N GÍ8zeP9`,YqN6/p}67'pϕ M;|*撱/;2bSe4ik`23xio5g/XM7Zʌxa* =FFȞ8&_*.I7EW+?p .ny|܌BKR3RgWʹU'ACqR@6 H13nu >_)]ev D[pЙk">Õ3>'eRu Ǎ\$m\=-ChQbAe0i؋*s yB<2(%k6,xv$8젖dsJeχ[3#|b8b#L OmuU4GW Zd6c<`r֞ t`,3疒;_eGtO?S!zu2ق$*nA5*ziDӫ[ilDL ,#}hF_(1joH^C0w;gBFg[;̓O"&zA$j;Tjqm8 Gտb3X,{ SmGJ6 dq8Yio\%b5\of 74 *a;6a1R$ њԙ \ .T/;;p)\I<(G[l''6 8zGE.[Pi-5X xok)sh!9Di6fTXj CpWo=QOp; WKۊM||VXG]^!?&e (|X9KuB.dzٰHԊx= EbOgxG^IlHT6U!7! ?Gtݘ\F 2Ñ8z0Qxs'ff&:S>tn(,̷;Y|И=RpjsR`[.iQHNws3/~^WVVHڪ,J{xZ7Lbj%Tvy߷?"&=-n cRQ cHKli(c?w:, ZMW8Ԏ@NQJ=FJe F-L>ؐycv>b@7;I2\R%eM 3U.z=8A3 Y|d#p~-hHg o:xgH7B-3Z -TޚÐ[P>".qmlY [ ,EԘ`:{DI9L“d>* L-4+%g[ÈZ bjiWIz~@k^ jAwWN՟A=_\& #YզH\$L Ȫg+Vϟi%N{x\ ]aC7'!u Jpwi| t?dU+wB#:8|os,4h[Ja-i!BPG0?W S{T_o$` o7[K4PVr:79=ica wDꇲgU̠Dˆ:S !@ #[AIsAr^Tbwn~{M=deسΏH#EP ]O}8_ݳb2 T(dh4C[rVF߄jݔ@2/} 3Ck!ukDY9+5|k\{Cл/Q%KqfzQZXc.|cHdKX;KDV4%ɟ0 +:JgCF=с);DgeYHMEy } dILV`D(/JN&bnZ35 !,,;:W!Ŝ;P I@-23ע`w·>-D=Q-'Pvgy̋^Rf3FyǗoK 5YߛpS+E 9J$;BH3VplȜmn}o>+Dv^=yM8sN?hFʄ*Pm 1kx6t&z}u:;.eׯ?O#~mRZٗp}$=]Z18"rttJyl|noѶ1`ͽS\q l;ZBeT6eowos Sw\IX*u:w9!@segs!p@GWzc퉠܅w#7Okk%02Dý-ZJ+a8G`wvO:hv g h6v 1eI 'k)*_'P֬F ܎K~EW@Tc`&Ua=/z <[m  '_DcY' ;&{-H$FR_u)/=e|O/. ~ C~C]8A`mIo xf|!O ()9\"ٺMNeTfzpAA00\pH8D%D1<"R--0n)ӌle9J+̀ĮrJ8S?:`K5UJs]* -0vx:'Z[ I1 ϾG&(WO/NTd{K֒W{#*S/qKçi-Q_9- \Gzq[Qhlإ2)8P5YO 5[$; R"{UB>6BѱWYS;A$;C=4km%cvgC@_a'@SsB[Ia(jW g(h۸Js7XP0 %ۡPPYף &,PkĽນh2\@"[m󒕌F<8  .erޓ>jQ[pFeȾzC9O(klu2b4}O△jr! ҝxv=yVSㆷGGB4 Q5 [~UME1\L;X68b$&R!H.T$뽪@扨~)ӅjqjFx<}IR1Xeu{¢{:tV[+H-sA>R(w$'|ep O%oB"x2^Zz/gCâ[6-Ç|z-kb1upvX RY]>-7lr .U"8ڮ_`*O:/`Y0^Zj@:MWɴ t('C8D)B:͂ /\djݳ k[2Ii|ԖWɱr1Dv"g‾jw3!ZM* ׌Z}-bG(z s(UsZq! hI:(Jeq@ʜ~)v"DW w+x+ъdf.̾ dDUiz4'51;̇qWzluxm(_lrh[7w'Q>?PBng)Iߧ＼uKlcH @އqY[FAf!}eZM'TH{Pр:\ |(@9[wdD@Q͝By.$|`cX'` țUCzIQR<SxBoʗW@FB1T !vxy>u%EsSc^JАtŧg c2t%SNTp(n̆ۋM.aI0T]Ǽ"^?QXlNŠ6=Ev}ntgm'+QUzX?IΧRlڕf L?Y5I|WYJ3's} kڌǕ;` <3w7FK\q~=G -&Oua_Ys:[Cu JrLoH-Zv=/ w<+v)'^6f'Fitɛ֩4\1I:hD;RUgSFd{QSoWtq{2] 'qCVlDrѩIO`Ts}MBK98p#tzH XM&]Q=zDt4Dg<}h #1{j2H ؍~̿` ˹Ńh| ݵܛYXY`LL#;ٮpn/S21tGS4@'J GX&a;fjK?kZDܥ߸/L2CYrEvCT)\U̻z*ȥs;7#T ά?"Dr1c$$qDzSeëNj?mͿ#aH-[st2o8xVn{'0"ȯ/nf^a9o pȚޏŭgYD#sY$vc+hY{@6 mErp<}Dr*hy:vjПQ:o$(G0QgԾhe_9aqR[.^!XmOtI}bX0;ir w yY0IǐE"A)=c$B>-phimݼe.2bKk݆8v@b$YH9Yes5Nl9}]OLO=W,)(8=1:M *Lw|~* Q|Yɵv.1lq F-T*YnF `_~0܃Bäa-gL?[(΁+2ݞϲϹ67wHCwʑ0` igV֏fuxSKXA{_ePe(m߶E :DZySi>b[D\wyK="B7YڏbnxJU 7ެP3\#2,B6=P9lH+CyA7C='wNXj`!rsw z%x2ZxB-^1ы<;Fѯ¦F@SȞ$ڏS9g!.pȌF;' =a Ƙi^ewLП8G:g\~5M㖈Z9א늜S+-pHmL8pMb*V.J Iݫp[)%n@"}l 0F`dGFR(v%un/HHE75*{(}J&%v%I)֭Nz]N֧%`68A6s8>X$GH#=3v&"R*2 ;ʖe!aulRiFǩ`ipRpSJ-qBSEI'.kʗtXɫêTw9 Yh;jXpJ=O)nnmք^<# U18rܖivU/N,%HOymtvL ]\mx1 XT7 $D7ɛ!j1ҳ8&ׂaCgDf[اz;Or_?ԕ28ʺ~<=o)ِ[=?Iܳu` Lhؐ[Mba8_|Ӧc/ka;x! M4:4yڨhXjSMcV@6ޤlj H֊i~mYg A1Rv3"I & (up;b›ac]Wa]Ҥ9NUǭ1%&Ny]IK%k(gUG/byHrKB'qBW;úRC3c VS^IzXH|WQA-/]R8|!t$Cp+hUb@'D L09SŒԷn0heQk{?c h?Rc6"%/%>I6+@v/}e!U,<ZLnw1iw3Ċ5% }/k,¨$ 3L{%akE#I%$cSgU9~8@ h_s |r*_΅V`-$N"IrM @!wQaB+[2qd)axS/$]?*uCB取 ;sxb?^n&8e!m,<˭d` =@V݃fiTfQ˝ҔEL%" uW7?Dpw͸aOwA&u]ܙƈL")a'lC;)KqTt#rSKqQ uI`Zȗ.Y1\`PG$@Vl/Z1! \/)w°LN@\,8 PŽܩћc`ZpI~Bt3ۀ6)))Nr.S:!vD>u[^~ mߏWLybѤ`3RcA@ ͝/OL5LкF&TC c֕P̨f?/U|S=JvSB't=rdZbf!ud UfӰ\ٞ:1ټFUf #͠wL'b\0%{9AH:D^~DqB&߳hZ1w 32Qox_A=Atכ9`1̉z 'ݓ L*lW1^)tRs83%aM7&5`RJ  @Gҳ4{ět@ǾO> ac4"G4E;hc>qwX+IIu,>\ߜ9eku$?Y-qp`kYd,B"yBfphbMXqne?w^e"\f79z~pMp|3!4d! -:O״͉5]g_\TKAs+PEV?<{aV?}a!"U.4׸4`9kZR԰G`rc0KIpΪ<8${RY"ʏ[5ʌ_f2h4!LBZR1Ly{M('!xV@gjKORo+HѰ p5S]Ӌʾ qd;cU3q46tD11/OiȀ&ζd?{>TM0W2 EI?~k, m41y/=Ï  > gg(K#ݹ/Po1T>/ %aF|㿴p~)CN/? J6&8H 켰ww>XS TVW7JMy3O|Ȥ9 Mа5U\@!4;#NK"Y}>~P욀:fύH#np7Ｋi_=23ebk㹉PHCAi퀂^ɫ!3 .^dz eN?2K$M/~ᠸ^<͘dQhcp_3"!pM@:uP W/ Khc^{"*~mU1L _5:0ߴ[G]FaA G޽?_&oD^lЩ)t^ Ab>x@ Ck·|[ bEsꂸ}J?([YD*k7kit iyy k7Լy[l9\/'m.xW$<"*^䉩Mq7"(~@j;(0u~SֻÒ}԰kwڧMo]g1S_J'ꎧ^k']Dkqdnj7>[tzN&)s ɧ)[Dսi2i0htKZ3-\SĄ 3+LA.<@uJ~*Flf!(Q(ċBB.`FYh򱃐?v`߂iѭOI|^WK) (lfm^-}oa-RG߸LiԚB^^z1-mKǕӝnVo+y:ֲ >UDDJ3:kZy:M툒J316rS8G,ΥϹ?>抁h_e)ÂgS*Sn^5V"4:_=y>8iݔŋYda-0a|L0FTRʒkaޒSR*DU:L\936' 0N?x ޴ ] #X19a: <ѐoawOIlQ} I b|*؛H%%.dCmmzqWRGTyNs?L|d8b,?%k'hs⮱RNiJHr~r:(!P*]%sccc5+ .R +K[ X8nDkRFg^<ݟNY&|~ЕajJZ4m= iw8HҏKW841tϷe<%rp S`+Lv:uQuzt'BBbPEEWvKziNH5qqJEnsH8|/qؽ8#59CDe>5ՄMtdH gsqͫvֵhfgn?53 R1,Uɀ[)TW p(j$/+84t!PDG>Ht✺I%Ӫz<.ȑ-z#!B$t ޏ| [ FT~I׮iZ)R0a9 4y+,y*M&>dܜ/_$Ұ%XZ5CRAYtr3BըU/)YKhkR8+C }AtvI,$8F=d,puYcT8*H.ok*mo:)6GsN9Q "- X%j( *((H{jorx.5Z!b(__Yt[e ƽ_(&D/lit3a?RQ??{(/KfqwʟXh-Mj&ʾ-ӆ%2ƆMik@g))NF( A 7 #b1&є;[i' SS?+ D|HfY4%KS.='2z%{wS U c̩v-.%"je}lin{C&!wF"Ե9.FjU?z8s~r/ ,4evtAj48Hf߀7 cI@JڄD"u7[diS(6{sw:P܁bA@kpDiHU[jV1ҷ|4aK#?jvi@  b1Е4'(v+^qb!K?r:NP$:%4ҜO}tǂާ*bugIE?Ċ˯d5qzJd҅GY] H9LRYݽ"2(әaǎTT'E. חvp?C6: uO[~AyD1D'1a<']́vԈY>=9^,vp12bxs P.=S9œp J/c :{I^(}~{m}.+1G8+Ly 8:f:2qpCY\c<BͳPyG%?n[qu#1`]YvR tU'(Pmz ?er,bW]wx -j7:h D|rmb6 Nzp1ee E8Tށ̌P'3\>KGg(mԼKI$*tW:H=)҅[e%>bEf갋|4^Y )t1P/6-Js;Z5^p"WOYs)+^UKx[VqV9^-[~u)Plη`@nrχᓄ#m[4Jf$!]k&ZE\&[GEsa9ϙM'09&6JƆuu(ڼ_#O,6}~q f?=0L[{q@{;, N涢4, P_`Mvէ(%rd 綵?,Ga=,g*rj6/;$B7H@Pqyz̛ۧV?[K]:3a ܤG"+6Swk3-P?6aܓ`0B]J YQ[Ѓkq<}_gL"iGIѩF_Ru0Vl {}saXmY+UfDM $G-6\Y;.3m#}ε%K(Z&jלwCH=Suoa!8oؒbb?=ub<:(3wUg:&0ӈYK*8/~WbVŜs%y3FqޠgС5*̠`HQg*%= 40̓IS<^-T3o{5'cyhٟMpSq @Gk *S;1jb* w1",ɡ"Y=$pK3Kl61m8YAʖ܀ͥV@%azI:OĎ@㨳g﹊{WœRTeD,T(gGfD3># ?WEyFeO^QvOѳ&\ۖ.Ȍ/*f_]R`+VTŬ|Go>T,L"'HW>iկNf/e= }A6S_,|Oӓ ,(|0dg;h5%}b(< zvb+%=bR̗wnwC+gj5򐅪#X 4=_9߈ř Jmzt}87՞dYixT+ՃyUo8XÛts3Œ 螼n!Y%)s1 ]Ys`)氵p)|1C!tL#dy9a<vA-\bD֋M˖_?P]tCPqnN$YOGti+sk9cE%ܳhr1CZf0ǫێ(oJ7=WgIJ޹*E$Oʫ }yo6/%@ҝV)2hb"7aKēpSX9z&ٮy, 11 iFa7 q\}{ZD|I|II_x~ JWC8sM!(?nF=hYQiWF..[X/%KiXQ\#);IS{%Wb4µA^2[PLGӄOp{jd9}ǫ*zj*?( 8l ՑaNcL ͈ak">E/}u%̡4ْ I5+v)bvѵ"K9y 8MR\Pj!>t '-,J1v=bm<ڛ¥S|$Q; @q&۲ݐӨF̰8dKǺsX1qj{(/,@deQĆt\(8/'>XI/?)`IFUuS'ˎh!Ɖ"d$g/ 0q |;/x"0oN^BI(LN]vUů{ }Fax]b-<(-AOna$ښHsfk?@=pLsx[!z-wGȵpߵ )r5kg4~Ü }#*}c񸮭㘊8N엤߷l }:U>C„I‹ľs^M\ׄ(rp@V,A 8ܕsdN$j|*Olco(,A$ڣS̤.^+ۇ,[QuD@/]&bR`vnE?+*[;Z17=]9 {&!~a%]~>{+9Cod[ ~Y4\c>WߓNT\ 3͘ڢ'C+H'+ KZP@~hyge˱քN^0iyS9 ۵q]gCZL_BdZE?1s0A ?ko!<!>`urregYuQeh! 0y<)R3~w;D# u_+;"Ҕ%dS*Ҽ/sٕ%s"dTfS%'tCRtjWŒK Sv@547]"y+0Eqd @6/#!w5Հ~cSL+t6[ey+R+'`8hS3F]9_nrFIfMg,wsz&crYk[:mLRUhD0?'WZ=ʳb ߾YWc\G?.Vr%BMRJi'𰇟ywSC_-[)_.b o?"*pB {aou?4 !quDEP<,T֔q{# ! $?HyiHmN-zUQ~6ކf(; Y`&VZ`%iknVTZPƲ5C98 Ut3 G( *} {-:f(6~7U mt!JĆY 4/m`=+m-4>N"+J(]ݐg_r)gjp3ܽgՖu;8dːiǻ|9H/fms0ӦR~O[QAYԎw%»U驵N3L%&:$ޑϿ֨cш ,|2 ﹄Ux L\.?4tky,TKEci'j΀Ufð;%, [V:7uEȖ,C-{DsCB7ka&u _|\ZXyo9N8T[+B/\jHI.\E_eh")hN Pexx#ܵekԉ#[\ _@H@&i@ P>n9$2>mlz?| ^ævNM oQN{$V;!+׹,_YԈ e%lxReUk+sF^.Omj MCYVE-aTsAYS3\w[ EYu9_2r)G{ab}(<DzT׶ȹ*0!`nʧ\aKbC{E:X ^:{l;?Z:J{42+*ّ@lQ\$TAO ЀDz *`3dxMs=` PQrVOPoC(Hhxi ʻӋwERt4]y]*S P9o #*t?Vۣ DԽW60ǀcgh$[%_kv\@|[xXT[-:U@c3gCY9j6i[AT26WCA5>1MyϖRa[d[c3YeLZQh#TSJP\ze#q;8gˆNʟ|oAsjkQ1NI?q餓AشiRݵ.{k(z^kӵl* +IЎڞC~ L"b螇&<vfkcD P XvKf,^I8EiJR&yIA?' 鏗9'=E UM.Ց3!׿AؙdTTBf"#Pȃ/8m x6_~Wm,OvCkGzp^H&ƂWXBʥ'i_hYb5|نuh,mik@oAպpDĺQfTkr[9 zf} p_u-EV}Gw}#ڧz=]QV_d)C^ ز^f&{Sr#Ϫ1:{3$Ry,iyO1' R5b9kù4G!$9T,&Vyg^2ŐĜZ8ig2kSB[d%l-,fz8C%a!ʻ'\@-e ]nj)O,"hK3k+LUp(n؆$7k% z\hO=A^ [(eT‰7bk\ bᄂiZ!6UJ?٧Z|裈9\I%  E'D)Lpnɴ z@ %<-$6ꊚiob~ݍT)ta )+@;8#Hg~zCOmlX@es?:IJfzkjJu[:#sg3-,gu>uu͛R%\zu{#ABԴoLRѭ$t1ɁO蟡}Ϫ~)F̱$8h&OB`CzH;t1샙y(Ams] (!XߤIǷU{1z{HPyD]*Yvcd%A*^lCN 2[O+Gޔm9GR$y=i$b'6Na*]'MM"vsvz81'z<ۧӖC݃r*j3;u'3cRqIfv2U57K׭d@:PA*Ht1Ixk%]ӱ&Mo|X *B@%8[Cl7¢ka|/MgP- @b)B`ۯ֞ '6ce{jHN^sUL ţV˔iCqH*D74V Id,vΆC(#db}Qyxtȅ *\ d'wgof +{ skI#ah8AiѢK(oDG{]lpOo¯R8 "6|V!ws)#Z6re\)/DȷVq7;yAۑ5h㗐4x9<*rR'\2y>#2#M&& ´h܎, -^_g{&~K?ɺ4uhF_ X2C wCWt|h}4(k?~WW*ڮ!M5  I CBG P D_7`ڬR|ႲAIbdF R,K7Yi11N>L@(%Lu|9^A\+鮴o2"Һ92}C%NFlb/7Ҁt!E%rDO!h[1qm+%/"3"?#o?bVԥf:,wm!).zzRwb/Uhķr.FusxwxD(czO< m_0e0J&80Ηਰv4;KRNppc'w ̎Z%{k- :(+rp^KwK(T@ ĄljPCEն%N-ē~?$K) y~3FSP7d.fu%'a%*IN=c%=-{\d5@톢 #g\Em?#ctwIAlr]*3M~فi/%OD۠ zvyf kʟ&iTbN읽'#GUu)n>mYŻz3'ScK 3 M`NhFqS k?yY +.];YQZ#BqŽs lHHҢW`v2;Bmt"?ys"U{JuC9{EL;iIEuPdn{,m`5&S͕yf= WgF~b6Ҿ^R.q5e#7uB/[}&_X^/"KΙUʕ66z\204g$3.VkQFB7-brՀK02l7rd99/6e7ʯ7״f LȒKEED|U]d豷#[-MPֆ1'2]]j8vLbO-A4OGN*uCGTuXR{>6×*Z?,^H]INȝXaEXv#b !;tdeyʚ:v{.ӭK>tMWِq;z 0* d׾+*\ʉ ȡ$Sn(|*n=ZG_&yaһicP mE9E| a]@ykUsc}2J]cH*j\DDU8qZ Sm=(1DA-KǟaX@o""JpG;%D'.pጙɵ+Q N5@Ax]rϻg[˕¤s~0Ž$tA|x/l>xV.W7#uG骵>,&pW!boՑs-w \?&x7bRBoׂYTڥT ([f z1RCc3~Hҙ U=9/oԐGQоH:"Km 5 uK< >}b JUTUCJ*'.A@aG ,bm`KkgݻA軙1v_RXx(N:Uw76; Eֺ~79i>>Y.(I|{ ^pP@Qz/zTT )D {+FPd(ll;}dAxY[(_xXaq$88 -$3fIl=]dJ-158BwB)QK =SۅU+[&ԒZ"٤bRƵJC0`7-7am5 OW환ݓ;eKiR8&*G2 ͨkL?YXt/_ʶS2œ `^mZ!(N=`8{žFxxk*?_$0ѫtpܵM\׭*Uw5-+>+G+}s@&N*&ʫht r_rAHM~v Jh ( G$IHzW A'?6:0X][Pi=9~Tppx _rEo.-޼lZOyMkz)! )ЂēxO/6He|p$fI.$04P~>amGb\Y|M紴Ai"]rt#]&FRp#"J'ebA >grPh?g%S8[troRۧEeIy#Tfe>QAqY)Tt= w|CF8JY`1`oW/ڽ" 1kSI5L7,x2Ȳ_<01} θB|44a)0שּׁ>xX {0ĵ[guu7lWi dkp(:n27:Y3{~ݭcH?*:BIrI,;Xvqxڑf?f熋ЎKG6 o p塒KΠ Ciy' yE6fa`|.3ZSXYI-")_#&j I,0Zw F13)旱bɨK6Xxێma "N1>#ur져 OvǮ;S_ h̘0 6t(sF3?F 55\J3IԲYQ]׮WIGaY SW\ hѥZtsӮ_$fM؀iPE7mpq _4": a /n| zǺ>Rb; 1 5$aA^5xlmF X#G[e9 !l[,|4(+a âǹNw*`/P;p \(9ّC9 fB)U<^0mo٬|z̿[Iڗړ(Hi秊A/K2FBtLfHbJf#^N]ܖ1,Sr 8$;akCg@eB$93ċðr~+Cʋg#L D?#!}Yȳ8uKLmx0DQ8o!Nd $XSf6ǞƒɥN `5&|1,o(<1X5 IY /_ppBr(hڔ| yA p59AWfGQq >ds !bv.?2(s;7^I:~I?7o/Om_co7}>oz}x#!c*+Fʸ|@Yi\_E&pgu?edٯb(W4=#_6ĕbl3ʌer^bV  ."mW^_Vd&M S_@$W!ʹl=_7ϿnۨT>wk ~B9DC)_ڄJ*ä>ӳI˺@ÈSQ #.p󂵩_/ ײX5C_Z1{yYS -͑z\>)|?S+RX oGm.*uo:ZPZ yVEPpq6U"FN_xQ $epLf Tyե%)A_Je)0ߥW[?Mo~ S(J}_R^X%t}Ok0|F :yB! qݧbp綥KEZaru,2fOW$=8)`9/CRL44WEBuixIkIqpcJùa<̴],(s9˜{H++w:#2nlV?ѡMy`:O@E CUZmȅǐCnzwmE2概Px˶@v\ḇ h1:s Sgȉd=v16YGC6^~6*=bX%bbz1JC=(j,5g %/.nejz|-+l6]awkK:JMV9y|&| bߪM/+`,xtmo2ُquj5tDp@UK<|/aAs8SZvӟ#DΥcʛ F9N=cm6ƦXOxE olPrڟWB;%aV3t# Ƹ!|3T75r)ɰX`8ZNr|=iG\I۟ayqdNR"S) 161#YF9+--$P!m;hD#`\X7`}-,y5q` \%%`JBhay[TTݥKCfTc-' bQUq . )QW# w#|$EVU; ijRӓnyC~YO 滖JHF/X#8TzxFdН5'9}sZLῶ\lilu [ic`[8([V>Y\Op怡u 6"ϊR#rpҟ+&ɩ2Zq)`"9JQ5I˶8dwqC.XS/ܹ~D;"ʻ{_QW)tlV/}.ew[6> .Ae[,{3 |B@}8w+kvZ=hS׸fwM3 PAkh4; ʧhUЈ[Ӳ^ۼ}>xv  zOMX3|;FO\qD6Gc#Ow0/ Rz:*2!RAk3!n.}L| ѮrIkb4a@ihBc ]|tF7,1􌃥[j$?,zTL YT]C-^GUX0<<ҟ6h4=^P;ۼyJ%3x8&aygi3 BMf4,>¤@lsceCz#C@os$k!(-̸9KTcmN`̇;vR{"1kuW<-&t+N1}=+ϮB_XaQ0=¢NX>\~n93aq7a9޻AՕF`?:k6!Z7$@ujr{&"0'j$8bL#juv cL-TL+]6ت fS'ћ@V.EX`gt"SE, K2~:NG!I )#S^۝4 ܪ`XUWQ@躖EެFIF—u:W2:>umOZ+0A0MnL.H!nfq]Xn4FVZ|npaKq(]mk؇S)5UZL{;5G;!E\o+SjẤnbAQ ry^!L.&ӢYv;+* HVFQfkmY:1ںImJT37Fx}]mZNu\Xߟ9d7_0B tMܾ1<{CZƺhml~}bDٜTj)D\j8J+l>HP'9㘻V<А=Xq AMo!R0̘q M)oJ*x#[LIsǪ6ICp!Dٌ魃^J|b.^|s`un.:!1Vꮁ6}e\_xn,F%V-FG5XcXPwq./9;m984_ N;q힯i1ϾߔMdw6mAkAnD5`k N EdUe`g!r.W,'ot =go2VIӚ̢nJѴcnrvS>nYl@ PDh 2QBuws%Uȩ܌zPs4iI*=@Afek@n YpPJ9X*frZ)%Ɂr+p%ۤ ``I;fUsQL8ǂvTig!h hZl 6jx;(`'5\RO: 4ທJMK~$L-K[M6ڿAIUA =K 'bUa+NxB dA[cfpQ~}+F?V7hEP )QC4tp}Lh@Wn)<èR_[Խ5UԢ^\i,dMྒྷW3:b4E|:Za8@lY^Դ[S&DԸ»wYyZ4Xbs=S[mo^5j!V[$'tty&ghEEIYq%J9mа78K &7DFst `14tDXh+71 :齙@4xC-QpO[oWO Kb/FgЄX{ґB,LRή6$$fp`# &_7p 5=+ fF& [O:hƟg?#dls 2I$'`U߷XRAwҜ ųQƐ;^'KE Ksl%&n`/|N%ٿ/`x)_A"u4G&͋PFC7u1d0[3B u;z/Ћߨ%%@>|v=AUbO/>/XB"?nv\4*DO _BV=. }`LCɼ#1yW N2X5~D Ũڀ_0xuZxG3>mB804ɘQ,0Y<'<2רRw00ve@RY"^/p~^HZGV[S :(f9Bq< ҿB'Ƹ<Ÿf %u$aQSb{flQQVPؽ)S {;|_~ }(8|O\f70]9Xh/1!I6Ck ;UHʆժ4DFԡBƝ(r\t Xɖ@V@=]^_ ֐Qq) POFv+V΂A{5N;9*ht #51#nվsʹmo \-·US-hcgT>L\m@,erKG:R*$k PW$kfqiն (g<R_\ctONXi,²^2zpdhWXﻢC+ m;J{ډ|wʀV2_ RxlBrsN*i\F;ܡȂFDe`L(jXlL'CSs0'#S rtFG2&=P9xGslcЏΙ\`lZaq ė` C) )sOQS3@A<'V ^ք}}e6RQhI2d,RRb;f~gm+ ;0ɧ>ĩgto>)m]qg_;G[&'oǾ^eu:2a#z/7yϕLGiϹeGiK\9p|qyC >$l.X̬}ĊK`IsB®gH5BD `#~q;m9`o9 O'EK-QDvOi/z@\e`nۣ-ç-,`^{[>MJwʫ]t^iȤ3ܑ.+P@k/MADET-rgp  W;DZxQfV~kAE<2 ?A؄_7i<0`aMΫ̾t#k!ݪV oU^`WP6l v{\ia"Q>+3X K3EFs1-4mʏ,C=4LŽr uW~lf]ԐO:Ļ'gJ%hrCIUIӮ9'ۄ@FmF m>it6{ 3vV[dS%)5^*tI\E!;ql<@GX4Uo/d&}b*|-n§AYi!+tb*e=e>yZPhn pϸuT a{ivp$m6  җvtu' m͕Pb)u Lu$;VYc3.bB:9ҴzUs:sNչַ+&Lql])3Q'C^t拊/d&~;ߊd}TO%dCǵA_*VF!ObE)yjns<@B4nW;kR7ޯu$e2Fd11eOdŊ:zDo!A<EbYOmHkFΒ'4 A8\B</ma2o/= LQ4bbbE%(lӟ_.ul+C.3ı[N\"UaHz}<*0@Ԫ#A^#X6(SuO<|M'nׄHUDqeE@)v !R  纛}hOBDAw0]ǦЙU ]vv 2/Dbn Nk&Vw4JO=w̧Vֳ=`b+Y${ttdennlGi*;3VDrLmJ)I;PGU~gR t ``ǹ*VpDfby6O a|j)C,f}PfKUO%Ys']$c>RjRbW T6x\Ru'#+v̢zzqrwiOc_d5PtFΈz<Lk睛 @LI Nmy#0Ν'gϮ&Y3woDT?L5slQަ\M Gr1"lb@sh#=<;{& +-\,Wg㙃nQPbM2 1b恭)꨿ϛf̭!:iGSh@'/bڨGFKw Oa8qQ|nCA|z~p)k k=4iIvA;5HD jO6KdW򑲀 Kigk!f)t#MI7[cqW vgJ͒@U9C/q2ulQ{'Ӈoi=lvHs.iAszTZ^-,01Qpĉ哣_0Dxe֩e?F<.4t`2eQ{O]J()EH _-̱UXRycU^Eڽ nʣIQi/ȱ1 3X"` jG$"8sW^Mo9*,O1Df/82.O/x&#['Up2OYuU~qJAFX8Q.Gp|)1T&-Ws=~*0f73T!sw(E8B??& {K\eV]۷_~2"|0F8ɂ8{+&Ji޷i.Ulb|Zﾋ#]V׉mdvZX㐫/}Js7H+;ݫW6AU;89kJb$~}:BAnyE3eT,>L ˏ!9u: &l@YdbbWSR"@|Us/C /Q5B \JIVOJ|N}_?L|{/-_lW -Qӵlj>(:ꨎ1s}gbz"v] 2t'y3pWf򏖮hц 7imհ}Os~AR}f4Lan\ HzP:ޓDi}\duM1 o̬[2ϐtw[k>&;F9ـ^/d`yF~Yb` 4DyHJ%gŰZX3KNi:8M-m3Y?CO`}!"^?B4i{ 7503Κ ֤*%;X [mB*dϰ v®˴W8!fN:'1 0܁>e̍8$_Ce% ^56QGTO'8U +4 zQQIew3ZH96?z&<%lErt}} f*1!_=-74#ZQØ`Mk׭2* i-sD]&Έ>q 6l(LTW]ۡꃥ J;t*>f6.bT'${#4JXA&>r謑sƪ¯aN&8Ȭ*Z>"*K?ԉ{ E9T hwd1^&n E|@gCZ ͅE,3t6?Y()ЫYXx3&IZu\A)@K`qbj9x<𺺏@LE9ȄVޫCeްzL[zފc \C.MNZkbY 4=Mb'Ump*9:]s@oشu8=:]}] +ˆJɳ} V+)FE{m AnrG15i_{`x +G0~L%;C,tSÑ (sYSp4z}+RғDp]~$ U*p`1pW0l_eV*KcCFSPՓno E3d{GwSb9t0.=plڮjBB!YJAlTݞ\k!!1 Ш;:/x(995{?-̧t6RG&¦3ÁPЬ6w?I)vl`q\\"ҷ5d"g6TIfw;;(,GKO~%| N#C6><,SE͑Wэ݌eHc|QcH*epN1 =mqD3cfg[={Y7H6=K}> !"[KSL1:0"IM2էq>=i*¯6:B /䝃,#hqo(L.1+I$| q(WTZxxyZU8q,J 3;gLzzşHM$ٱ&x1eԐЍIK(~Swv>A>rٽZhPJ}ip6\(ãbTۦ)Wk\'fZz1J>Ro3?G1[9 W 0x~# "bYS*]W`Kv2't\q:r TQ<[n2}^UD`_Y({p1JX*o\xq~XDMIEo9Γ`3[Y%:n"u^]<8_ ĸ{4N.70 !)4}ʰ\#1`Sϣ߃(niwDg ?ZsЈxo/*54)(>m[#7B &5"j(Yy;y9@+[g)+6,iOKyἃ뻵â*2LR_ַ:o]۬Su¦!#8rP.}5Q}ӔI_A] t3$dߗ.nVɽ~z ڑ&x~Q[N G "9fBDH:gk^s3z[r;xՆU#hE`Q]Ē3~|V0DkAh-PR_"yQjm@83x6M_n]<7_cY_p3/o)=?R;Lx,VE:ΎnVfY;~HP X} i}{'j@=-b;bȗ+ H ?1NY {P0^,=-Ρ 2`?*Gm5 bN>R&XI`tNL8t`XkRqKSl ȥ4}̭q``z8H.zRy#jx(*gcc*r9_c,e1n7@K?#1W6%5ҘF x >"В̽_Qz]ŖkcDz6dž= .:Nn i$fy즀" F:n/Ȧ1G[gNo *uop%c]ݚ.S5l$>[h~6$>>R]Tt_<%S3Yq7[QvPl"KX8.ٔM{d;q\ʩ~ hZfM32!}o &b7!O^,q"3s8S͛&I%I$nTd=GwZ9LhRe>oh/?@Rۋu;C/F^P?OR}13Qҝ%mN{ʖEW3{w5;MBfYNFsS1j+AwV P/=:i4%ni:t L*[lqsZZ{:ZK46np8a;n,,1ˢl i1Yj~H̭HCZ%3Y~]:|zj9`q5մSydvE撽筶S:P-C\zʒ U]p.lVlg'vR>su?,#y%hFsdR{;uϙrōuV?RiLKJCP!mۮ\-q"Xp/ȃ_5':ǪYFXQ):VVJU\:EZ,>:H(^)')#p ش -\9qXvݎ"4)㤜QAfK$@]yztUxq oCzӶg^gٺZ %f_ Tgbܣ?J,,O(ܷc$|rwuz; h ljS=+bs %q0 r6 -ܝHpG}P.+{ ^Oa]2pE5%}@C:?7>bc #:1r[:KI0%eES>RV#; /8M;rSK-3Y NQS!s?!;af3',gXqK*JA=M2?|MI$hL/w 6R9u>ZWOy ؑ ȫDǙJAm|@ts ]\F"9ft>_p=yXTpPIXEpKfxCምB/pǒsXswн9e TɮS sgkUm*$`<=v;LإeM ] DoNۣtSbdeaC+ &E5A^#r ^8:CPdL^81OJ{K5F)ZV=YgVT}>[^2+ JUA^fg6g oYݚr.64_H)b@Oeò<~{2Z2>|qC㵂ot W<{mYنYb>KC70%-G[iߧ6kߺy|ҸI N8gi.z`oBC5yM"QX:B bԶ4}-louc6tSLMfP@f@ |PNgDpp;ժĤa̯Pz 7}@:֑-ocL_ QnN_oJ/=y]=Iz@")7ؙcr2,M _CfVR5xe'@k,]PUsL岏Pg>bUߥ 0n`tW*+ $*)C(Fܝ5ոEBEU("V6dde U1:/˃uB4^5Y@b5k`49/h6jL@}]J/FT'M{$oNXIsJu7\`Fap N^bh]wDܑY=BF>HМxV+Jϰ͚e"#g QtKVyOb|c/ojf:82 r'eb>A1t&V_. k[2i( Ӻ6Sgx'DE1577WKLֹʟoKR5-7U6>Fa=Onc~=Mn!/oV\5ਗ@2YY5 qe7lIREq\s ҔQ\$ *VjU;|3ZtBγݶ#G(3C8ӂH*!M;1z&_Ĵto#CǝٶҍCރ#qv|DS4洤'ߣEcC猦'l$(L =V;Ο-6- ʝʁz0rxhyAlR5Y!ۄ̻-TJv+84vMo nm ?]y"5RwO(D7R/c?7Y_p[mn~ke^J8}& YZQicqypNq^q%{N+"I4H Hj*@̇tɻʱݩoTxB ɥ],&NBR:꣞AugNJg_VX Ѷc_vpK4Ӝ$e7`6yGepvacVll 񗌚 /"@wۥ`S J 8 dV )t|L|@ɴV,Kkahr޳0aTm>)n1lcؐ^C Gb1MeZ*LDP΅ض I70xY_^@֡JG9#:Z`/5kz ˉZqpZ>W\ ֑X@G"1t?@Lh<>njR9}p߻\…KO7>R C`d][2j#:.(oy-6\/P*I܀,ZXT-U*}=In@#j*>:ؙIIKR7wbCMbڧdk Q[h 5/Ht2(!}'[JPl pvz!H<`31ɗ ai7=aeRԻ ;x#+!!j%G2~JmU$=Yɰomُ|a9C៽&B۠Fqyޫ n,C'~:譒`mxXƎp*LBi_c07Ҏ}#yKy2_/gcTv<lm2qgjaz`Ъk߸A8[v!fst eVI܇3;-*Ml&?ўa P{ޟF#$|z Ӱ|*6J6MZϮ_4B޿փ!*B8@=;] s߬s[-d+؊4Gjm/+Ϩ Mu.qxLbڜ`iY0՜UD nAq~ktxR8yvߙ3q:wX<`;˼y7~DV0|D+9-Ww'4*wyܜ1NDd'3sKYۼXidߣ'"eh'=]4AI?,{Z_-1 譎Ʉu$+YCRS!>وxѦK`HM1c48 :X) ZY*7Nnq}OuE =L1r!Q: E( r5BKW )"Gqdp_}yg'm43͓TMXrn6RS_K(gHԏWu6(CD5]}=~%>O)BX*.N{9*B[!~4_܃9^nc׈oٗJFKm>M~P$Ds>Sڼ}<]m2z[DȅhH3(E T*la &a 7~!zma_w}rR'f6eJ»_]C43X1O \d &CZ eޑ~g$Fjא~C>,09@)pY䔱V_~McKdK2Zp[8ZZoەބ~(k4eQ4jLBKazFYqPoϗ2ĦR85Cug,}t;QAmhvo+d+}r#7B1SJN % Ks4 w%&ғMH 4ܹ:0!9TQI2!m7@s4^ی;|* { NARF:,O^aHؕmCG)x]IqʊpsS?7L,ܱmXJZJO2QD(RX{ɝ:_ ]q{zep,4Iv(Sri~V0 sL^75̔g\>}MN@m|8f&kMDBĽ 8~O=_/Ic]x.Le8Q8dSZl͞yZ\7?Y^qj6hn}3v(M}fRnퟘnOG;ّWot "aʉ*6I翑%؆={Eɑ[xHߐETWiƩ]/z*a\m.}'  *Y?(\CqbECQ([/1R84f^XI}p]>F ǎ4caj@R*!g>m7KI6i);"lzC7#&ߖQjL he Ũ!!0n̠ '|fMsw8F؊(9w&'˂PBq@n('hxHC0!*(i0V__$G#Vkf=1mUx#^kH#=q%gPE>|BB Ds c*GqRCy ieAH% i3\mǺTM_<-SppFgԂM@tp̚-?E|٠7Pɿ!C RQɋVCIG(jA]zVfg5mڝx}JjJBIvoEEV/h u>dz=Ke);zxgIBp<#09qmꚼ{㮯vP;&i ^ qW߀^0'/m)lj^0Lܽg&%'cuo NPsyfH f6?z?3Qm6FfOO;tU%zH~ iCy!,{TAKZ fbY,1v/&>=4Ԓ `=JPLr?Ը89ns5#}B$\e+(!FvTsq՜`Mirϡc[%׉ HyR{jz pzO1Nt;[Ѝ;+[R-> G3ך ޘst9:Zh,4+4i;c_IAZ~Q蔻)" B mҒFA NLPz"ʋUV/2Jk=.:fEc:tNfԴrU3ag |3K]BUH|Y}}Ϸ$sxa9]IeDdzx_J J"Um?Aw+yzmf9aEXMaU/΀xF,MIeA2H2<K6J aւݮe=ݷ0x&$t{2?8Y6nUyv[L3r4)kRU`{ء9;glHf&t_ˌUX (QSSr#]y1X6p^r갃R>ӅCc3~w] Vy|ΞKiE uRrеZ:։I\a{I4V(þ]gr%A 51M1fTULp}* zdD("d]2.2 -W4V-!] ַ݆xrGhhm%l(°46GA"9 ݇s:]OR/ U9ͧ&R"x=%fԣAC&Ӏ @!=,R0f6mld*Lm]CN\$b?_ MF䛶e^ֶ̜T (l[,x0H|M9Gغ-9RuSbFq:\.&R;TAfqguKL!5)>CP:㩘9^jpyh֫}l=I|銴-rp1#ǷRύW7K5__b_,ŒE0yvV fL'<.7 MoDkg#JBۯ@3܌v^f{axY0ҿ8JJwsρSQYt@}'hLwKpD2UZe?lJ&kOp輷iizH SG'Waߵ8wnލcDX?4H;v߃h+9S6j5㨶bًa=,3Q+PNS;E7w%|cMLpTPt!=[o^ujvo^x|*uFo$o,yJlZZ\?!\="\{^2|2E'hi2 ԥW+q]-YNQZ3ǥ+xgX(7] A3O|_dХd<)c^gzYm]/1uakYJ ٬3TԞtuDP0J`،CYJ; 2#8@4H{F%@3t5 F*wS@~stf"d̳ C)sQ YQ>t]Wm@(?<c98TFzEcdytXMJ1m nzC[9BJ $u(^Nf򋂭}@[piD]Zr8Y1E'waEC@-1&ٺ= ey5J(cU{AV2@Jm&kS5~Y9T .&VO@w˹)M=UZ!4ja+fXy-gqiG!c0`o_TDE%xL)x v x I+%i:m|`FRτXf K mOAN#@m.(Me=Sg6QI͂êSoj"?YD`zqd^Z1 C+fFtFBz¶+:Stҥ1֌+8n WW&<,ju J[hLi ЀstHyNW^C#x'}\Xn+^۩ g=QUgJw "an?S 8sZM sL9͈Є>y >D V_QlKm#s ,$;R Z` R%D\#Ze %j.k4 i^n/"ҏ"~O; _wBdˈ.De?T|K,ၽщ2q֌M$<׸Z" x0(ceIy1xK*c բN$Gq=63 cOevB9xT#z12Py{=sXxhR B8sN>y-k>gۨPdd>2~hZ0\8i(D[_ZA0ed/ޫk+bI/ҲUȲCVL?xPs)LiWvvs,xt;˂0Tțx@8R8) FzsDWgPMngUiX[QH/B*D_KNKk6p Fզ:WTVӫ9HһTj.Es\H\1&D"J!/@=0|YP惁msPxVt-UYpLR'XOJ!ۋ_L4_>tҙ*EoY{^k\4R=g<=أZ=s7Ci"4w"Dп=- KOI큝\.n^SPH@$v+X\o М3sbdSB_ɖ35"`˨01S?#+ՙ3pv'M5zSH&{p߬Vti hal꼙sZhR`ki ˋFI2:âXi:)J 0+r~ ݌r3Xs3銸R}ݭ}/hޫH5`ѧ0#R.=Ա[*%Vg(zKM;R>b$LbD zB5@tRɇM| Q}r P@ha1wImj*"(o>n>Oߗ0.퇧z¶hL̜̏ ;_  36mϾn%% GfȘ]q`AnqIҝ#jQq~8#;],+ͅrR?"fUx  ;LD@k0H4&X> .!Aޯ8p#j(!(Jxw?[@TlۙהtQ-mJP2FQm6N*;zć "K dK@$7FV6B Г:&3,@Nh_B`h'u۶(<߹RraEYKbQe||Q>)TO_&q"n(-RW;p&?+ .*(b45ŏStSm }4jʣn{̆ Lv) Gzb-zG" +՛[XRZk%ٗN25vDΦ O9%G:V}x Gn|mO!]B4/$W\׵ a}$"8Vs\94;x?LkxϚ J*d*QYa;ٰCCÑ:7>` y bܸ=) f F}8 [HTgvEBc|N0τ#?P+{T zabFXGgmF#dHҙަIcEdJx܉7riDM=:_db\@7sɤ6͹0W>5̎C nQJtK6ͧ8 m3jk&$˜r"Ǯ =`7u،w`k{B5K_eS}TJ]X<X-BO1.pJvRBt_@V٘A ,1'x5vT+ǿ( # jLȁ͌"su uTht8͈W,k=2SrL5$WO([ERN2d_*X*|898a|6v|)ȝ ˇ6<s*/ {@&Hcjwٔw$(=`ةda.:D{ f]͆U/z 5TO\i"u' Pe2{9+RQs4(4.)(8h ;Pգc[ Sr`F¸Vٴ%Ue5J:G;y^rV{L`hvCNa}&`suD/Gi_OP)*VT6 2/,m ^.k$g۱Z@2VA 9 @RRGMO,EGxq.!gne4FKo ^iWzAqD<2JyRr9YL˞D[6S!tLJ||:čNo|׏t\Bʜ7U5>wBg oSRh;u-l˕@*(hkr ڔޕbGj%*%kVCC܀>-d37L= ~̭THwM(Q+*[CKDz #HƬVm8W\T PASDHsݵ3z߱ +US;olSrc Zl¹ S;"?lWzt=T$}_DdFJҷC$7I`Sg3|r}l>a.1D[`g}tAYVN7z(n}Xlh8UV o`t*,yzXxn葡-6#F.@1 sl\BeB/F5FlpP諮hgK[Ek5m t <o 2!i۸1XSrDL3P.`TXȸ`fҟ _t,kdUEYZnUz>R[vktĴWޭZ>uf2m+B,QWS_mdT+ʒ;s;FIf*%zIqѓO3W`&=O5X;_tUAMdXhe 's*jͨaw͌0kvqzP[ڀK]vNƫ[;HȲZJ~bha}4JK_,-l}v}._BI`A;=ۨ< `q  68#O.R䲐}9>3׬A2JAwerR6qiYT\wBûb=B7>R W4zߋE]녎V./;5/EHXG] +pW!]F0 k0q#7rP~p-;:qBm: YYrB߼N.Z*'Tf@M7&ŭQ P.7.`p44+QGMӭjZ%!Ɉ >]QLL#hAv*QG?PjQ7}F ==y@&8ɡ[m0fb3xs8ؔ6`[A (gڽ3[!e11gSO:<DS?Ҡ_a,ǟ2=!L{`}LjU9avB&nz Q1~>Q3U.+V&+*1׏kqD(;ͺF:"Aʽ|E*{# ?+,'9G;̱;q2]ʊ}\feF4JBBV;W,1VYb `jh{x@v1Q_ɮzCXUzXvMb֕qSzPZr$xUzKoG)Ec$Tl }ޏ@F8gF}oy!ER( ,ufY9M]R*yH/;~.Jnǃ$ڏ,2V[j>&v'2b*A  OWSR2i{b%(OAQxGp\j 8%&R2/}d N9ˣ_9P~o?PlfxTm+~WZhkBo]'nM qƹ9lk}Cgg0xLwKJ>wJ<yD/˘;қ6*a/鄷hxvvY>7osE ^~nhVc՗?QU'#@oX+!E|JR}׳ՊEmUJ[#2D8mJjyU/%l %E.v/ln<聛OpzF@cXYdϤgR|jQ\ͷdP i)R'Wgj q,5]jAo'*FLUΝvvS ;;cs~R,"}{׺h2P˂llpMz [9B'*Tc{LHN-dK%N{@Ydmm0X74ANY{IS`wb~#Eo7(NzgF okiu>wtxR3 kcB}ӿvե asc8~W1V<ǤӰc~-\[kJ"T%kaW ((aC)B*A/'Y;Td9{%c--壘&>1jw82 Ƌ2^ {+]"fڭ8[Zy:kg]zj 09jardFs,DE =Ԅ 0N ۋՉ9#j){UkW Mt4bc^*i]\м!K7.`ݭ5I=7pF?0ņIhM9\ mfnx<ꩽּ)$ӸӈjLBPH%dio3wK5۾iDBgOzCkGT;d 4EfiބA*=a-ibt.h.ĵ×8F¶Sq#lzP ԃpfBϞGi|Kl9V1O~>Z\c7 o3N&i4y^EQ|:09N&ds1~CGgқ)%[~ГDc@Q+/Sj;[WW[ ͩaRM([Ӕi셊ySi j,B7%E.;kglѩ5 @vwX4ѵuG0.lԛVV+7F+-eӥgܐ|n˝u+O~_d≠h*A 4yamQ<|!O2$Ei 咄K']O֬ q91Gusإ 7JK3ͥ4WT0|FU9sJ;+A>ӫ\h5X{XC_Vn4Cvia%FIS7N7FacZ1uv%mH[[~Ӎg(wb `:8ڥ-l* me h:5b1OBp3Ne2KPWƍ8'Aز/p WّMd,7as-WVLűV4h`Ǩ4Chf‘;6oˍ,ny7a͞|t031~VRVQn ='3 2`\3FRB5Dn@H*8XƲ&>ޫ˜q((ܫiOVA+FھJ'0PwrFz Xw2.3ؗNۍ{ ,yd*i '&ㆼP4 "rb1G ynxO#BNԬ?8[e?;Ҵ9DlF J-AL4#k'ȃʟJ >'%6V) QtG8|qO1MrP&$?h=4 FߪrH l -O:?q -ɻ#tT?LZ _1NŠ%Nz 3 IQ/Kx:ٳAB=(|oEq=7.\k1IDL[ePJ3lg/Ÿ.;1 <ht;G,$u%7\r! cJѝY!pj4zٍdY~2c1Mx! 4)~:#9 YB^Ν 44G>BX.u&-V D8o&mk~bOsW`vTM@>Z_åH*1AށN2ήCvBW`cd;l+H0tlWL/+R7-4R[%4ƣ /_5nF#;M`j1Zx%s9hsb~SK}-# g NA֣ ֟Nr1)?Dve14h) {2tT OV+ Mivt"\t8x͙%_tc%ncoEs+'Xg=rkjKإȚb7JWKC6 c@T웞5x+ffjG z j!.s< GE0x#kcaf}1voMBOCL tk DfES-G]l]~p ʑc캤Y -O2Ӎ{עU.6JY.9oKIJux0+ ^-k=7dw$U^q/(*t"xD LTaG><A׺@0*>wi+#*YOtWBf6~ l==,_Fzq&߂N-hg7,g&ZNO-=vtT?z֌\9P2 e?ˢ͕Kv>ɣ  lӕV{j$?EY`3pY@|~ ji/!)۷^B\Ci ջP/6=v&BKNbsfGٹgKP.2$x>mEkÏdA#({Zs;/"qpVMU)qOeex! h#+k_f!7-+}wZv"&OMI=udk+sґ$ݞNY ѷ[U)vi޼vZP%:ZD Xx61^V-ZߨȏmEN/{ YvNqD$ڊ 'I *߇֬ (pM6jsdڃ*i;zXX,"HCK (dqfWD= ug¾h۪gd˭P]SrÓuA(b勃8aBn7|,Y@BA|{ ]%E>ϠT  ӏojfd=._gDG([H|؏&v9aO: lGJ@{EqBI* ˛:Q&ŷ\Xroq$}҉CPbPm $DȆnH+k)fڡ$UIn3@1Ca wzFjTlt"[`iV(^7J -q"\8sr`"\FH3.]FNbn\n9PÊt'$bۋ+#N2{mQj[p/}Db D΂e#ĨS*tD:30ЊpM6Eɪ#mW˭/0hCK@4(᏿ ZKkCt Pog͛d^pv!QJ=R/ޖ@p}Dt mȲ*>.TxJ,o #gR;V+-MI!04fk5o[EcCMBU1 lY$H8V[3se9V\$k`31GqޯZu1 ņfw|QpU $"rH^F+\P֝bC0C몒&Uy6 QōD[аûzXMIb*z|-0e_VJD="T,ZyaaQZnFe@e&ЅP3J'~ Ҁ#Q7\44sae<E;ĭ"iTȼk( errv 1ww * ?L̐r,/wgڕR?tA2 H É*7eN! q/0Z5Vj@] No2/x5Фg'ZHc 5,:+UIt1`4EbQ#!;ɵ -\7JsWEyHc`[n͡}~l:$=([vVy_o;I "Gk>t>"p?T{PX[&đ[p ^NfD9UplL*lԘD e $|E)hH;Ԁ|a&\I^ E]r]jo:օGMa2/_% QU?5Y{c:ťz02A] -U R uEX s*8o1pא']d J2i'؀^tim룱Qu6zq^ q貄M,0F|N-ЛOZ%Fnȿ,,W\Wt).\pAS0*I['[ YCцP+Rޛ4jʧp7N*ìMǐ{EYvٺӑ~)e0Fz=28~˚ 3Jo9fP'pD@b2p;'罽:d!>dl@^FѮ6&,RGY}@z*C>TgRk'M/ N(R81NCF5KSK\ ־v˳b1 =b/ qoI/;q\3D TA`8ì{eiJVj.#{ '7i៦bjr 9i'6vW'1Z   f٨lHf|wфυ_tH!g(d1E)R< Uzv7cfDY4t!>tΒ$ކpBA;A^nըz"{u\G8ӐvqɠuGS[ȕX{ˠVn; 17~$^/Ϗzx v:*Ĵ;GRl׿?/KQ#!ܸl<)BtKqIQ-9+kqi@H`Aؑ9¯[EO=:AҖ/#l|wvyር#?8&vU*H!]{8q:(~԰b& %CC[֝rsE=Q'Xt+;u0RrLszG}-W p4WOG| E@:E~5'F`:TkQGf8nf{E1Ov>4tC9j*{MU?&as8tTj. VO/{Q,w[Id/$oO}&Lu=@ϑpòťѻ :¬r.<&AV'LHBګ/@-^:OdDLm,aO [!d4pC2 /ˎo@ (֓U=;z4PghMzkPV.[wVy2Ow3o;0 ڐa4q,>gOfr9f PD@7CT7.)RӻyȌsb(tՀeuA47eZ˜kX 3CunV@~j<Č}oek;I[Sv $7u, @H h0o== UwbgT#8tlh⁇ʳ5Q2Z؋u.AM5/U8kB{AKZHn$1Wj6&h0XX-\XbPLpFod=sxiE-pSyL|XlfKd$|8=xsC=H <3; ɱ>"P~wנcEk))(`敵EyR _MNlD ﯅#)Mqt>*m  y+t$ɿf&tn>7`gq ]L {<_2M3 @gd)+(d*BQ~e0S<ΛwGp29_ILs;,y`9gƮu R_ݤ,3ؒ5КK!-ZY `zk3޺Ag|a\ qעa/#j783l~t~VL^&čʰ6bf~ yJfatнVL!wt:8ə~M 5$mCX~]1&~_l3qM'p:]TjSs,4 ,cjD_08[K~mם`NQKV>"&둭ڟP ֵ MD&zKb}a1+9 ,feH7S15>SoOuk3S_mqB4CW.= |)V ;FRˠcq6YR;s>V? g$йx4fQhS0Rp_PIJSr% ń+uPk-qoS('W[%l?kP.nԵ/]Wvdd8a$\'>^\ܭ~ҟEhtήK_b Լ(8S姧\alN>BNȆ_Jm[71o1m Y@[87L뿌 2~]3SʱT~]T]D,nc/eʿ l=YT_J?( g*0l>os. ̝Uwn bMoO0ɷddp^6)ӡHs>e19hP&'In̲id_cK>8_OGldܢU/2ĞHД*EӰΧVAE/@ʤQ338# CCVlHŸFĺ[CPNNOId3ҟ+xVɑ#E2 $ |OD|T wDoݴ Yz\"am#cNjݞV)$ia[ 7&wyҞEo-/psu̺\wc<_.-ތ!PvJrܓ]ѹn2sX~t'!znW_Hw-Y7{ǽYiF# _8t%[+htVIruW`Td1yn a<-:,Osy-<%b_\AJbN]ˀq-!!?7M KCa #3&@[>(kD8!oDh)aH͏0;~.$m& +M2_8@eJ m-7CH׼h~׆bM*Kd0^E+^ "XݗҘOI8%D&Qk󸸫"9uNM#8GI"S'$}y,Ix2 ?^kIi+Kz[ bܘ!Ҷ3mڍrq8;tE NjPYl,#KKdR2uoXjq|) ,D؁RCpЪHtO4%醯jĪjpC! en'bw6Z7e(n]%YW(D,B7q?ɭ?q,\֭_4QCU??Ael}6YT7Oal;,JT/M dGըK˔H_KPudصl=t07a+cr%z=F-,jȈ=WצYOGU81y`ܷpN#ˎ0M6FɡS?@(`]0\lךVРckI8M$D̦,F!k>3/9n!v!S7׽0'Zρ^~0sBLRTY;vy9uTEKf|jc'u?lTZ%,tt?C g$s̶S9 &=~x;xtUʵcR.ܚm~0Smuxb-[_O`eh"B:KqEnVXtؽKZfsV^=0( ]梯y~ie|,6Oxөp1[\wWPKbXst:M vp߼m揱DDzI[V4hvk[BNL"uQTh><#o(MuX Ъ "Ƌ፡bfQ3>3EV0QjP.T 7Q>*2gx)VyCNp 󚌳Qa\JUt‡_m/NDu`7_Z)#d`5s2~ Ѐv%&j{Nq0BA/SavR̞1QI@[^7<;hv Ryn.i3b\Pbٚ!=r}j6#d/O=5"PyȊ;)B_惁JfMܠ.sQgo!'ɋV,`ȗrUޱx{2I7KK?5D`T*;} X֝04ch% ,sxc3U^:i@$8Uh#pLJФ+宐G9ݿCCc0NE͑;Ygw=3G1CbE?A{u4!9@3yZ8%ë -׆z➸t/apF =M8xVnazU5C&siXEr+;ʊBY^èh| 1- bI(/ 0] E!NȻHMw~ ͚?%&rQ]TeN8uHhJsͣ-Yv+0ZvHfzp:L8a}(z>eo}|Ҩ 屮BK"O|ƍ}Vcj=kҦ ZWJ^E-Sʠ)HU/ xFoP _rA:p4*Fsud H}S6#Ӗ 4/+"tڸu[HTLPgpŘD!SqyIBs)#?ZƵNE-&qz"Z~ Ey5g yڂLߟtA_7߈bPW ]A_Vm YQ[ %\R)qij-9yn%-]NV`K*2!*boA␬Cc!H.52^w3{e9}hLJ6*tKwqfa0zS{{O5)%Wt MӵR|u-,r)O+'O&z kD'hx7o+1^re_9&Z?tp# rM'UFE jxx- ѝ;P #Ss j/ǶRF42hWjo+4LmmUe;՗niTf|2?wm 71qY;G鸯g)[xqܰj*7bH}"ٱhIx$' <^q;NJ|R4Y !>aPdOq`g ۠L\>]W<~VCb6jO,37/gHr-3?˗(h;3 ߋh+ Ɠ~lPp8BSmۡ ~Tj0['k㖭H^ZG ׇ;o#-M,w*~7x]#;LsL 3sFiC/ ͖}!B]SմC7|$MAGq}\oI*˓Gje:l \:VMӱgYOAxuDO9QI\ջbDZqUfH/}JZhOe6sIc$cm9+ 9c~J*%p)sxWSQ.;Q^6S`dsDb ;rR7kQԝ}$V:Ok T"fE;X mYb%:t'V wO 1]4A]"O7nG;r̻ wQ4Lʃ(g?͋4 ' s;"Ѯ@'KYEG :9lpWO mİUDŽ <ӳl5_Ĥ&)$@K4e@57j0B4eE , NfI #oH`YTNnk̹҂ ekx/uҾ<}kw.5J ڀ>?3/g0EX02r+δ-(,|򴝄 x:]W5Ȭ؊1j.rO@ 5=pRvyb+/_ǥ(p2)!%=#7c:e;ʘ65g0^}ҵ9lX0$dN$(HRui48zlMO8:Sa=XZ$'ҎҪ|:YL4&Rkm;h(;4LNry7B< a Ds',aV)SդjNGg<DF -0Hceɾny;kp 5dy$B0Ӷ'}Fb{ltYT3iL:꿙4xޛ2)RJmߣE)e8TlO12,tϻ, )K1UIzv`lܳ{3~U3Рڤ9`u pqzC.(< tQ1u菂g}E*=Fkڎ# h {KDkUo_5. ruqܯÅgS橳x8>9f h M]B0) ܋7%-Rk542֯bVŗhxYÒi k/aO!i&Ա9R.:{1y+7T%O^|q=X9`rg:*3jsMp-j8h֩[Px؟ dx8 #WKvnéڰA ԷgIlVZ5'61iSV)$V.u۫p fEMAnyu_ D +pzLVbу9o4$U3Vc75=XArMCSаrQ&.V䑀æ+ŨP*> `ʽr *pPmp g-gQ᪓o+.oOϷ% f'97Rcc$[$e-ejC~&X7ȡMIRFn5ƕWi2B8\L?0]"x9%n')eMo-`X_W }PpV;Rs{hȑ3bNh(!k#\lvBxxd5{nԗ[[$w t.!:Em#fiV䊅t":}/1)}95y^*u$ocpZ:ʻvj%X&gԱa:3_sJy_Uφ[a@A;dЪn.l"5_Wy<[ɡ4uk ၤMMjO4*0]nK6~oikݍq2kV3ϒ,j@?D6~Bcj[C b^`Y^&P{:hoV{I)1R_ Ls"(WU1i^ )06K_q`9 X"Ac\hܥh!d`-3hR HyD/ao|{HLx}Z8-S}y{{dluuV ,;h=d x8A,9uWmϰ=U_eFH`aMfnUv}\Sv8Z9_Uم'"'K̆?S.͖o6I(ޝE,Fӫ*|RrtmP]#T9CEW]ϹtF U Yw xD$Ű~4Cue{렑BծHjgJkQ`=/^pk\Kj %3 NW*Kuҗc Z^mg|؞ߑ)RIzY+Jc! ˾>BYTj\rfPm;t\>ήDrG|h>Ӌpx TЍi%t?/Iz'2AOtpA6ڕGbblD4Ń~4Y DO+aP^aܬ--0~Hcʈ]baY/6ً̟JiG0T2햠z-,q Hw7D̝1pRP ;~A"&I IYϙi^P62c >eH5'ZsU|2QąPm[=n&(]{NIb݄=MnY&["{28aGG{7iZU-)Yasg[ E#ELВ[OOanRHLC#hTcuu)@ۉߎb;z;{7t?IOV̭N:W!Y ЭwY[x5M XNFy/$]w+k3OM`F] 6ݫjٔeD%a>Pj?Y+nu2Vmf;#] N!h7q&(=m9.$Vי*m?Lt!g0e* cL&~=MfІ@^%S:Oĺqzc'uJО} =/*"_F-Z;ك:4q;-?JO6ВtCGHY%ϛkW~B*Q3ELvk t1DN{Բ)I,Jm^ wӻ"׭Pć֭]&\'>$P]+RKX̓E]q[(1GU5;͘ E+/~ߡ`G#1'bKW g?hޖRj[4RD h@JnΕ/9?<0FuƲ W"uz(ʏwuJCZ0f[ROBhc{G9J_\<>\ݔzJVfʼn{*Qt9t2h, ??SC~Ҹ\4[nZe3iɹ*Np<n㵢|̆+ED7gF'"KZAZ,_lM\ :=ʹLad:\ג+ @j .Y}={ ;6\Hy/~!#K t'4mR;~^[c`,h)>ȵNEϮ,*% :ROf+?[^E|$kXcn-14d@ةnzy^CySHB \TT7#B,A0xɁu3kfXP KRseWjK^(PԹVc ^ЌΞcWxD;w}Bʵ{{$m)˙S?l8]ЊWBhbJW՛ +^ulAJ~ &HgJ b![Ϗg;Ov78ho;q,4i*xz݊o c,TEМp@le}Q2hBl\{ˮK| o3 XPx][)|+,1dP5q7M['aaGfgWhαQ"2a $PӸF] F} V&h2]MT]"ۧxj )` 9#̅HpGFkk` $#Rzِ4ccFZkk@#ӷoIR#.17%YHg)Vd[VmhpDU斵*~ረDo2l̄",KPvgMFvx;c ASM 9>Ѓ'%"|3b|ݺ onIeƙ9.6}* v=K⊛?[qIibS] k}R3"]2_°d T5}sOo E'֏UaOM ) %X/naƸPDA2fAz6:/p<ʐ\U9mb0Rp7C۲(( N ܏yE3^ 0h"9mi:a?x|võYUՃ 6/ 1<6|ϲR!i%5R6!. (ɤV%Ab3o E IE َԅ2bVÙ!OPT Ć`e%3&9)%eA (@ 7Jr[k(5(J&9 nlE篷Y,-o [l.ZqOOExI+X 1unCN /~MZd~2e3zBpfٝȑ߭=AY h2PrUijC_]ǂ_xڕJ-*IVm(WeJG W~r>ͭz~fد.jד WX7QZȱ:v*`׎HHju}%d/^ݪᒔiqlfj#%B{kUn187Ȑ/! #KZXYʄt%jrTV?=_U3ښJk[y6N+ #׵u^viL Adtjgd;J3C߳gVqfɀ6%e*2<̰XuۋPٿ_bhhWn0_. a'<5Ct[?}gBÄІO*(q:3oh '5@IXB5L[\Y +S聴+ lZ\|$~ 7ܲH1e֤; 1sYΤᰅLB8]6ULWfS#ͽbpBdat\z?u%Nsď,rAmbZWygh/K{c]A.w'*U+4 +3'" 4JFle Sڟ|3f!g@Gc>œf.0uV^ CPlA| &8 ­IE#% uaTZ(SEP03FAW=:=w&qg>c%H]ʅB!9S"wQCll}2?KM# #_DT !jv+)&|o%)w+=r~,Wd$Vg]h݀*roƑ*9: -)6բ% 96Nj_<='eȝL54V ip\-zZ] 1ui~1O2/`%=iۇLMApC|$r`Ϣu`AW\q$jCt-Tjm툶y: ܟGPï<IښXw"Y/%k:} ?L0<&NjEgk,Oo94F?U^ T9.q;Z0wLy r"bjS0:A@jg2g7h+Ug I|Fdnqc@VZڞ잞o \wU:@͊^R:uD֌T؅lzoq.AfCJblB1Qk\@*1RL" :YObG::Y(wW1m {sG c@d/p?k2[6&yxLg)$IO=QnR@>xn0@*iY6'. 6(](K~4!wdzrC"LB[]VxQc:3{>S( ML!SÐwqmxoWG4SD{=fϾM'֮*eCjav[b+zhB@; u+ɸ-CSu[LƜǟTƣlU1MU=uU}vK@k"SC46bq5H@;8N83ַ?h53(ĩ8i($Nn$SM|>pjT<@9=e-'lmJ)ࠗH"IR \zj!R\`B VAqzkQQnW!DSY eD+BOph [jxR1LєNVU>}?c fZk kW8ro\fJ:ek^CC4^_GI{w 9wa7&bww#L+DArQ wAg.78 q o$$#uѸL;qt0MJ;x#VP}F Ԁi34 Ϥ=̤I!&aM] 8~_-Ӎl*m[@5V@O ꈒT* @qRM %ô۸?v` w8lt(?H0u52'7=ϺQ,?ӤnLmj"%A]諽^F=Mx4prMۡOM=̶C4:2uc5Ӵ aTIIg\ɺw;'26 "G5˲ WŽPU8ʲ G4@p$,Ku;KbMk!1 m΀|ts;nJ|waF(㐘vC'bZ?8qȗB ddӾ[2n:tQ/ز\X4)LZ jo։ rsQ2\HD`EFv(Vy3F'.7H Rɠr qD?se #ʱ[cZr.vUg:@(a&-!XDgX,J %Tj~W>3ă Rқhs4T' G/)Jbze̥9ׂ c Weexd("/!p KT Ɗo"*tD+cɪYH[;8^vүFt0HXzc{5:l-, զ;P[wY:}8\X?gtw*O,A|)/J8[_eï4u7խCt/+ Ra.Z`J "\ m=9s60O2aoYsSVA+Y6c&̛ y Rt*;{f(CIʞ$QeA$V/0wcP?zt3+(CVn,J7W+IW+5Sj8^{hEU4qѨ]eו)\{f*Z@ ԕlfӱXqzz$1;t%Y!W+:N13Hey*5qW5𫑰H=mه:0K'IZ1U ny,r<B͇MKn,I5g$}YeĨ< eB4B ˾^jjxlE:Qgv!qkSS"P2.JB>EYtߧnq)eܘUі˱Hj?5H`5qv)e _4hD\y/ɩA"W,i'oPmCN^Ȍc*]*}W,7BrNWf 7vזVcgid̗mE!/}\ar/C~5u_RnqtU漄Xc6^Kccht;*=d![p"# kp^b)iOȧ|aEQ/07^"ZAU)j$%G7aKJ69F*D7Z{2> X.NV.Iy y8p1!ه봂1M^`(wnR8Ȣ!{3ZfvN8W#PfM (3C2D' EgGaPҲkh#',`|1S[MchڳM)o7^rTMD$6aw "[Uvy m} /w a@74(Sx0E7bh:w<ҡ?=؍wRڦ%D*%dU~o̦sTBꣅC@ " wܐy=BYӸ 9)&Ow|l.D5X[ H0]Qw}K憁kS*gKPPDyJEZxڰ ,32fz: Ae ާV d\n V+3ԫ&(v4:lnŧ^ZwZ&uo(eJXp-)'vMLsO/sA%kiE+;c0BK"{-XN*al^1 FG%V 3ǩ ;dz[d#Ą=n{Z w8.38dQa}u&hkǞG{P}Eym(IN}\;NbלqQ)M~/l>4Q{ȉB{k}xv2RʼnXF4i-C$d%hm?V X'$rq\E8!%-O_]s0^w ƞWĕknaSnQ&Pɟ.|>^RI2A|8hTQ` 酃>N|ORtݸVAR Ѥ~':3y4c'r4DDx47aR=:Ƅa,7=J67RNf,^Y>lrq 5!+<~z2UP|JdXpϸDHRoh1Vִn&&,p#D+Uƺ]IJ5{]e8"miuI$nI?{sj6sYzd0xEٞKB6`ޚdinCL 3[z˼-Ʋv?f=O?oo) 1P合%&#T,šR Z[Iz¢tn|0W4\R+,J|5UjxjmSO*W.! Fq.Mꋖ2Ci?hٍzt謯Z!3KaՂ<.6=,w!(ڴ u e*?ijX웖Iwƪqd &r׾ $e}1knmV}u Q闷ltu/=ˏCMiׂV[O!Z/\s#3YKKNK'1Lh1"$sqגYp?^K NRpϵ5+c8t9:iCg]oۅ&^K#2Y L4ux $z%ÿyCP pH0Kp#; ֹz\K`sriCǶ #;1!`wQQ?zz?`"%,[V_)?D(Q[-4C 8=]2 vnk|/̼vӗa"Qwy$QD93_I( =\ٜuP>5#I&PRว)RԎ;t}3*BL⡼(| 6|ZTkEVH[VR:% pö9 ԝLKNg+U k{Uf45Pp#A7o .X0;b&(b&#PNpX3zxcTR-1½չJ:CnߟDOuqRzkԷ3=u`?F?aRfW6f'O>5k) "/uT@elltDd^\sQ@* *cA;nܳt09X0[ft֋BR} l~n¾W`bB<#x0rE 01dyJȤ2p2yKo6{SݿXT'5X>#D %pwr}JJzӨ.~#iAFKb)<#]0weqTz1ҹh>1GfF.tSzKc0$rI \h12ѭ&ް/K) yЮ_^EU 0y({_qy] Ζ>\K`ݻC|1T0aD%h"gdx Up1#|\tL@im뼽f؛&^]F)qwK꘦Dk4{SקK^5\&ހsJЕiQRݑ]@R nըvv %85P>$jMƏNS 劫L`1Pcbؘu8:dfy6moPG:"O$/&%9aT.ͽ osXoQú;0 uX ӂNq~)5dE6y8xVZOxh/JtW6&$(%YQ:Ѹ ȀƏ$᳟Y L$Am#jҟD: l |v$r7"85T}-,`^N׵F;a{K$ P{su938zr"3Ĭ@;Lzt Ɉ.!9cCz ۼd7υ;CRU 6mB⼄$G3>jHrJBOm~5cZvO.il%{'KG *QŅL֍sQ)h~^jQ0rrUg6[F[Սd0i^F橧)狯Bi`_G^M<\ԃ$%轘B3q!UN܁'8n0<y;=XIz zǼ0+nPNHh482PGF^2&iP@RT@swvEiȊtD .*ZG]fh [^lw0`6H}SJCpG(ױz&RWq [oⰑ#Xȟ[lih]O+~nTqĭ^n tiZ?k&}[qr|)kHlзB^^dp?и z^M=_J$bJ Ix.>([r V?1b&":1nc-:b1We춐q}>\ 'jyS8 ͉ 5 ^ÇT@ `12Wc =f#>k!=NKX䂠x-aQ*O&yu3؆7I f4hԫ7yWuҨ3"u LO9P1 b;: .x=tFOq}ʡ$brYنz4T.A.ֳ oix>THDnʅ>1o)̟y`%S{U';le!a\BoO1w?kj02Cn efMByFJ5,&^ '27@j&n3]kh[yoH ޗlA\;%|Ėa!ݯ'Ǔ83v"] kN Vj7{E/^ bI-(6'V {9{>؜ %h uр옴½B +twʔk`}bW64O*lV'LSp/18/$4\0N̉Jl6G\VTbCs^$k.ӣii6VinF!vCYbΉ..h[ [yS׿JhXRc+c+fAWA/t17-8:/\]%"O :lNWh/ Evͷq#[]@Lj-~hm&FTEe%|c7QZf2.?yi - b Z~,!6`F'BwaLA$hm 7-v9[%UH|.6̧$ũcQ)jާqQ *ZzoObZPë<&<1Db$+ OVsj7ɺ̠GFXѯPtpؕK 7Z*-d>=Y2d9õeK35(ז;t8 I$V,WdX u.A.[e.7#' Fo0ij:kFϛz t{A~1kVyaQg*䋱3:άȝ $qF*<럱v鏝V)l\-^ahL "m'V/n1< W5њIl‘sR37#V!1@;P'DM(أo( Â*4.Rd4Uo(- #RyO`:}?ت$T&NGi 835g Ufq74$ <.ʧrۜ!UJSxB@r]z'ôvcRyw֛ 4E@ (uVӸ!Ć;c )2*E 2䋣_& i2]X;$IPR!+UR Q̓bƙR<~r㟝Y@PHbh!U0L' S~ۋ> ]d2F>A)yp{! v)X ܢJQP:juZ|f{ ݾgMB;V+wh+s F)'>0|ɱ! V 2@j ?w.z*lC{pZ7Ol5vO%zqEkM),OmE% JBs8b8C{-\=pos0+R?tWZ{B_*'xDeLEU^d|WsZdKJY6*[?4{Y}"'ptX ;xlLUlW Z~]oٗ.D$3@`8\ k~SC>&1Cڂm8eS4K~n3s., 8:w*zkOS_^<%HplM4&/QG0"RE'd۽eR! h2v  s6zk@a"7ԧuvflaut@/NڪÑdidbHl$`?"H$ Tiz~UXc[.QSAe.K)0%F%- &K fD U2凤,?eYT 6F/gޮ&@Rt9͘cET?^1f)j*A'O ^2.!7M&g_c=nTa<{)e3kglm[?k,ٹ; ,QYy%ma"V 8l7?֎lwxIЋ(hJ6CX K?ۉGv: T;qSc>,"EoɢwT>B"bc z" CP퐰k.%gmL$i-1Pq! !݁a_YOhL/]U!͛ ޥc) nw0oKi#($+Dz ;T!3ՃUPmڡ=v(~E╀_7rX n4xK!/$y,RVܽkgK~׸nȶ^*WmV>%zm_K"G޷Eؤ2/d:Q,m^ , 7WN*ZMj#癎6-ߊexh^K$}VV=H`-fpx ZYsyK@YTED!jD>zP=M\J<e!vHTRxYw zJ)(.@\X$| Ӌ gaâɴ[l D[Qw٢5@\od9bJdw+M"a3}Hsosf&?Ixaa*I3’z3A6n QBsy[@?E46[7=s*܇]8ovn\3e/Ȃ=hZnjL7׍^VVFTIF; ?h;Te|:5Ϳܡ5RQPvļ'i )%M ><oiFAB?\O9R1hֶ?m0V3aфt'bnlF=TnPBYwϧ+b]<;5HAUX85RIl$CZlp,'?5="'񿦕-B>:V'<uE德.Z\".m;ۦB2!YG/辈+p*A{Qę\BdV^qu)3c^6 +u9f}?CRPb:/^T1vxʪ0wx ë@JzqB"Ɍ0{#"zg["Z+Rjc#LpDVc߹ ~ (zA{TXaEs:nu]%f$/ ^ XKTH'RηX5SZ+F/prhɁrO {A$2TrDG#rZQ=Yak@@c`ܞ&F7IesLtY{`1w&t?v6^N`W\u&F8IX82"X{lzz;D1󬖼-06b4%X0 ̝puflB*|*3WYG_&i%Da￷6G;!f!6KE~DeN,G|+^LZq$F Hd.3J9ɍ@Ot\Z"f4 Q _5U #(fxmx)Q"F9OkGI3T/,݋i&h񜀟]`l":MlW(}vvy^!צ*2 :GPSӟ;Oe:+qL S\R{h@Q͡&{a>r=w%\F__ y`爙L1lXwK՘?@~ʎ:Һm_AiY2z;ΆlУ)%:}yO}.Cl2PTCPvEnDy][]qRL=5pT~-٘2k"P}*mQ?=$#dݏGܭUT% Z]{bCux5ۊ>Ep+)#V2yU3蹃1iUzYӞ2AՇ]D0‰cO~ ҭ]1#hwnhU^CJ2)E`J2ZnW!+a<׃; q!yC̎ K@a2 صdx)@6-.0(zyx|b'븀"*~D\,&dcI)XKWzSzgzN[R5 >*0$ȧyE>Ҙšһ_}ؑC[d>14K"uзNջVJbߴpRowk7bsFϟfxq+mn [d11gtK !>YV@ң_Jq%PE9qY?/)ޓU ֡YoQ`hvgʪ,gv9#'ʭ=<'dW1('^A8-Ěr9?HQο[T =Fj8K0網' $0M2_2Z:'_ "@X*Wpr"P Xx+.#)r^V:91f'J&"tM} U| t)q0|} peۏ1l ~3(wnR&ɶ6[sk7([-!yҌҢєFl7T-.Z 5`^1=ͮ8ǭ{O1vc _6z(\9j۠O*#zp!9sfxyBp\D?=;V|ݍ5hW<)֔ǻDٞ7VPgRA2b6ϑ .;"˖nez摫Ҭ\8;!`{%cˍ>zo6,!1I'À?NlrhBaQ)ue)>sy+kI]MyJ)zyrh/>qF$̠%v%[ixQx1byy]yOiFY7X+(]Gտ)NyoR&I6ֶaӇ38Ykd?_J`yn4.lpKJ[p#L8B<%em/ "P?LabkpN%0ވ8s NOն{\y*y6;UZ2V[e:5&~ J f:xMGZO 0=#MBLLuή c[u+!7yScG<ly)DrH]#WQ$Onpo%7_㜩ArٔG h+VoLnM#b!k&:J]=f_~9/d4 K.Hv;&C|ouh_M{ȶN1h=ד'ÛK&?+H1kQƻB2RQ`7L߶P`=U H!LkcyԢ)#۴@nզ&QM37:_ #9cl./Y1*M8b;_uH.P$q/3C_ǘ=e5mc1_zTdaCH ׼GcDs]5^½"Τ+ kOq[ *gddTOAjdʻeTZ2FG^so'G8=TT)T+P}8+3|ANڮ^b q3Jn(ct$;ChCֱH\M+h-Q  "8pux~TO=ư#%%Mc$s> Wz:ml0V'K,||CuѾHr9E4ΛM(?l3mz\ 0ѽ8SoM>W@X-8４uK}C }Û,]wZJ"=-?<+2fq~o&6һl/ XJ}%moJ'AtLnjtghXb,:W|0O98,fyl ΃Ld%vO7حN"#fU3Y &;3-UcVOMi*.c]fCpâ(S˕ur>rӽJϋ!;(bT4s|yNY~uy{dqLQzit<[1QC;6j(rvFD># aџr|PgG׽:r+7 +G:ig6ȢRȴ^ضL*zEv,|pzI^3=aM:iMHӭDC-єyP`)%;˷?f-JT%tZKlP̝o+L7=K٦,8>{.!x*'+s_yR:6 X&kr.R`\C/*=Tjn NpG. 34H XinbZf3 p=yr;E61EiɡV+Hq)?3bSVBC!y7BvQǺ;Y3E{mՕ$@L{HTRpr/`qkn ^՚pޤ|@0aBѧG]}$I+ʟL\ૻ^90ɖ`vܹ g.@>?|*cIW+‚s,O;rt{ƍ'cakK7?QtkCdc:q+f7gF u J:OR]yt9giWcepӰdd-#uZ$/,HK{6ut*D,7%̊ufIO7 WEXJ]lrQ) #OEJfFCvuxJV.4@{tq_{o( 54ޕ=|PJH4J# YŶ"TN Nv]k|S_Y;tp?"U]qT9)3xouAzA7k +5Ȩ Ҕ¬Ǥ`4 ES[wB=vוq:2DW2SDaQUK`뮝rKNǰ\oY f&vg<NXQd}v)`KYF`VD{2VWuTP4֍zDŽ:3\ug Bbf&w\pJ `jM[l[@ӧE|KQ6~Dd^=DJJur}c X'JAzH34BѨmnƏܴ?,x.U!6[v2 8B7!K`/8CEށ7=2ZΠ9:QnSn„ $鉌NJp_O8#oTgL|\"MoaIl^nEsoW ~E^ѳݳjTNf]2CVZeD>_*pk&m*L?sHYUv$ 2QI2{{!Zi]4t] K^԰,FfenVB<=p} ةnfQAiXWXhuҋ){lHϯۘ(/뉫QO'+\ryChj*6MsyXn<*PI0ԣ:!o #sۭ~(#w]AP(<50.ii'w[[I'X#e e42#Xe6XvQRx6`ʃ1QbpJa=%;3"1q3@,VKQp`ƝЊyyYy.סyy#\ ŠLMғ&ȥyaZZ0#z|5vVH9O ,TNR RQ+(\)@QDKW1& xIZ bm % 0;HX]tţfI2MlKteC}}Ő[W`S+hP9@N q~HyrЭhJkɺyO|[^S]8#@9=d9e\6x''[* nZ#褀[At$M(/ֲ`/gOK*ʜ>TYgC/gnLܮC Q}r/NToY}֞v%-U&te욯] eGfUS7ԸfʀҀ QizYO)c1V+2b #x 1y.'@49tMEbmmg˶/% mX!mÕUOb\<&paiCV))i"mo;).mJ*.3xQzGVsjqs_ ?~ у>XGSI'& ܨ߂qR:Jk\^',k7cϛt];@l'g:Gr6U7%h9Zj]0\0wB `qq gEB]`埪秓ֲ^uVC urnE3! ^9m#d 8[l;̃\JFۭqel>YBK&V̗@n%FD 2dߧ-Aq5~P'Ƅ0F'0/J Y4J+gZÀ*|mo[zb"7(G֜`D5¼dזvkȱh\Ua/ػ${:\ DȤQ/^ۭBnpr-ocx$S``HJtnM !N:/Ɋ; 6ժ=SAc53]pxvFȃCVS7į]-89^ uT@d,RBm-ZiK@ Li(P FBlnNbyՂ+mJc-Q]QwDW,*ߥ?3Ő?Xd~]3g%XI?rn➥a%n\g"09Hsv6:p$/qtYA)<Qm7]aTjkd.HvCJt΂(S2TyJ}ŖxC }K^i/$|<3?TmillѰ&M,v{CIHsҀ}w7vz.70Rm{nI~%Xp>r@މ!-4`KL+2T1DmJ.d\\>[ t.\+߱O$%Sos%ԺԿx*; 2H^\{j%6 <節|ti BDT+R`-aXəN)7Zž= l 2SAjqfn"21g1ϬHhu1@;}.]u&^,$GuRL !;X0ܯ:`פhV^O|<֫{fb(9=4y[3~- v "yNu S+uDm*^O~ZeX"4놦*u.L.YKor@TibihlEW{s:p ¼AY>_IQ}aԇv7+}G.7߇Y8!Z8q!ΡY(q|-PpnPq.,Fsh!1*z9#lMG̒᪭J"w  `!Jv~ís#Wg4gw$8sdn\w |qV50>#疣V̫ˍraFtcy.]j[ ւ@'|'ۜܐw +epi.%ЩN-g6Ӽ|MkZ۝>EI+Mḻ}ijTsY~WKT\ l <y]\vG| :oH"bvb ,dca =hԍ˛o>I c30#߷ωEJ Nwv uSYY$|upmI"]hӬ7/ m:/[B 羶u;\BcFJtVeO7hE75!$k%o(vwLLN {6M=P}X,حT/ˬmJ8|ϲmu*LUE7";'Py\@EVb`cB8g8ݭP;_5{?%Xv&X9u.)=hiMoDŽc0.@R+V}pm3:.=l)!#mp{Kq:?˔Y`na!Uը^$;~Hǒ9~wgϺZT!!vƤٖ읺"BG,Lͻ2㚴8(Lk$''?i@sg\U{="Q/XuKڥ<,A"$HRe|'xؗ(. Z7PgnIXhTA[B"vQ@ݥ;-muGOXxSFC9Yvb`X>}" Kp6dZgMq ZkK82MJvcJ9K#Ԑʏ.RjI+Fauq# Rg(=g~e}[t/圸sìOabÅ&_J~ R\u,;U< 0_XdvE$S!XAHo%FBKqc:m=NE7kMҨB vA/ C &6^b;I>o:I2Vh'=f6^U{٭TPK.:zU _?e2TZ[&U{u>%̞ .vv uapԫA45Lbmuˑ!_nq!; kKw+@<є*KwJD+sT];%ӮፑJߞ''q݌$S$( zA-=CR8u--J6#R5[)%8IAo!9F,ۡ/Ru7 !,K[6S)WfA?)wuhP}~eeo8 cGMȋ!C-f$Xe'AnxPŚ;qw|yLff$h. w}jiH5T0R]B SHxJUc*w=Ƭ):t< ;QyZov}څGË5G'r@O|¥%$d&ll[D{WeBZz C&^y9 a]qben @܃i tnm65:P񳥑 -xrXk.>6jz'$=lNj$ 8sn5j7zex@"ᅲUR 1AxYi6 hOk>8b" F~fq#Wmf v ք`M3+[beP $V`o{ivtr "KUz x}iϺ-$Y0F;碄;B=!YXpEx p˓Y1~g\+'RN<3ء=]yBFB跗+o^Uy,1q,)&`6E5ՠccf"yz|3BZ'OK'@lVAoժpCc0|'spLE5)_y$KJ>,12],M{?g|QAʻ3g ֤$ nKTlDzKdpϜ__HSpLn5 TՏI:`=t\reWFE5X.PIsu~?̪]N]QӼwy4&8V&j_ 3v`/MNþ {XrW'.7e$|a}@FN̹2mQuOk{#ޡtKd#T@ Ϭس.p KS;oq3@ulzV؏85[0rA_| ]Z1i 1pT@+ǼGNlցU-YwMG<C $(P;<$|{"RIso!92 W _t꩸-ekNgiyb] 2)F 50c|Ȟ{ =D*6H gVO v#3ug- fFy:\Zx24&NBU+:RKMm|qC >Ifg`2p!"~'Vp!a%QB9}RICg^xUys2ǮF\;\Jr AGaDg EpC_}ob6$k˭GQaA?p9VdK.V6{ףG[iC*t3蟣w,*)2!6l#{~Zpguh!FѕB'.dbf¦pn keHW͗\of$8b!dl7JevϭʙacoxSh)`ߝ4yM6b~Vƅs[1% s8NlXT@_xZvθb$}r?xR %&Pג l= EཬM5~ 9si~Nb2 %enr M^+Sw6*15lMu)-/^x-|9y!F<_y2JE ."nI]يȆ(ȯoJS7i}K6{4:|NsVa™O®UڼѦWAXǾЅI׺</l 1VyCmixkJ"EW_#C81?&0OBN$Eg6X3ڠY#R+mbx͈=GG]Yw8&z7ұcW=h3rLojbY5jΩP뢛?ԎѵΫ,-vֈl r{^5ua54kaHԲ.Db~drNt-ύ+=`W|u3Kj# {bJ|ȭ\CK~1$Ō?!Tl'_: yc-(W09iXt"տzVIkzy*k +nbM/Tr杤m78&5SMH)Vэ0a*Y E:+@2š=,爐*qKm8bg@d`4 k(C/7! ]:eE{$ 95h q߶xD/b}0_^p91kh=uM6!Va r)c9gqduFrdr@ /a ݁aow03@ rEC~3C̔jfz:0-v%h+BQu-X@Lغ[[&+q-EKn}d$ZxSgÛ1nMh{DyǾ[[kh{5Dr 5AʛJ`= ;2o B1)#$U@ Fcf9 ;D_,x]WkrB,o;|je]vm-|Uڼ&ќ}|a2tlG#҄ 7H'cha: >iɁ .d> >巘҅=:w*nhO9 ;҂VmP9ows(&[_VxlM@r 7_$d$7Iu=^5z"> Co@Zp,HM\uR]KtYY:2oLcF>4ķu B.`tN@xf05 |! 銗:ee8=wI8|9D9ETDMᦹ{ȤOw1G央#oT OwsmOʁ{/e5߀3Hբ/Z` dW[sBKnNw?+.;)'vw.~=[eN!j,lLUj{ڨ/#x7f,?] B*z^ݝ%U> fl)XX P3D^y FYuz{8lylYE}DGA΄w e-LDusþS4?術WMWIpDӜ mƠރB S^8159pk`pCgv.)_pQ8n P6%NKBw5*En11{m-Py=v2 #zFBRd3(v* LmVi^n_x;u -~5_;׌N)zw`x&{&yօMTL1{t +,SvCX}P>BixImΥKqPn q{xz+9)l!{,LȇNGl@P3&7VeKxMiriVqhZ ~#i?m}3mDmv/ko˻CT;=,eRux{V((<"ROk- ݙ_yH?2nnb#CjRi@A+RҮ!#{yQMygRBOf+: ȂJbհaaxVL 32UroS#~6A ΥQINJBBuaa:^C;\ܠCGCsWR>)Lu$LuZv|4R/jlNwp.e7t |UrIFZHv)7쌡t7%!(-!5bnFxT|¶.tSIin;wJo>..-eåף*ϲ'V='A8{OgHS\^'+MtH@k1O]0Jk3dC[/w ls$d#3C1@TWlTG%F@g^1IAz| })4,.s|Bau&!I!^C H\e' ~Ijp&flKW*[ Ɓm0*2QB2D .G1y@z2dFH9.F=H f?N';f"gfNP >ڬ6@TdEYĚzd2eibvӌ߃}Ŷ*Pe=9dqRLLZ+c,Yе`Z4{A6~cmj՛Naj IM1|HN@i${1 p=NuN("E'` C JR "wLd{x. hN @HFVа3qYupP9zdPHRP3#ǽq^xy-cI@b[o}/s]-/f3YcYh5, -`d܃ROy7ZCoπ.!S@bEhL'|HBh7=b , ^𽽰-ֺz:=ƿ'ax հYR048ݺ{ s }Q{5s7G7 v,Lss,C˶Ps5Q tDĘRDtqsƭ6IJZl,Lh86i%*pߵ&=,GUXm*ƜUdrM˽IEy>V^@sՀ&Wa)+L E3lӱ&ի{5E=$L9hhηgEk&rCξ)CIrP#0,Q(/~aRDD{G9@v6՛2"X%`C/+?mHH 1_Shzv$FtucWM[h0O[Y p5winNCo˅=c4"۵XjԞgs,9!t!t.!oުcQ`&>?XuQt|tʌHE=m OCzx `n,ˌm]s7k`}cKq=IUC&YN4ݪ GY?Kˇx,_RW句+UI{p%mLX$8Su~!hg^ be@,uzסI\G"T{Mywi$m?}$X]A֮FAd Ix${GPXkB7cT7\< Z9?t 8,µI-5($Y fniJy땨1MhU*H}$M࿑n(Hܒ{ u7`^tjiTh9C/D+OVh0e[لLu{^p-磾.!{EK :@<8cc s꿚Ԩ|%F|T[VHwCeրF5n|Iy9 HںqQ\QK&2qы4n,|#ұȅ jD9e `ɪM{[B :x1DH\KeV%:VBqAGGǼ f!6<W\r!we;@L4e_u)zC5IOC*+7q5?tڳKq&UY !,YK4"<Ɠ3]5 k 1n"y7A;Na'6M._n#}2oF 0@DqImd~b@YB^ʒΆ6Q n;2զI[ }=ĝq>ZH7tο0x_qMTWm+B {cGY>kpuo5 w g 2IpJ@$%z s6$dN<&׿Ҩ&!>ՋrQ`7o?J!%g{wa/Cj"3Ii!1KM$sJJ'W\^wG 뽙A+9LZ3i@mqh%eu ־鱟*B'42懕9 ?HO;njSm_+bJE!zKyǺtf#/ƃoq 'uk0%.&׷ھ\bYSsp9kBY {BL9sDFpVC <8 auܽg9\2DNRv;G V ]#~Dz9E."sXL82ުꄱ'vP*eݷ9_{"#Zڜ^X׊qˎ#+!ٯF!Vzi$wIؿac-ڞ|TepZn]ݩbv⧜ެJU 8w6 Nu}NpTe1JqUmBӇevpA[촣,g%E55VgqO(mImt0y8vfXkSMWG*&XXHQc~ޡ NBWo+b1Qp~狮+Ϗ=p/qWe-z#kHc*m%N}M 6= -{X$&\w# Z>KTwPtj!e*Ag.げyX9P782@1ּpca/wCJRb!︹:mLoG8P'./"uBh]LfY⡔O Xˣ/TR|`曣Ab{ߤx?$j㥈OCSty",W "by_ɭKHԲcs(tڢiVVJ{w?+6&,1-:e(eEc;7o.̤v@'596 \WSJ|YbbYHo+[220^Eu78fiBw5yp[w%Ӥ?`Acˉy)[ :G]H]*$aHOꥬ}(My&.ȗs% QeVtظ9ET' nFtZt<4#?kņa$w>`]\Bkț w]9+L#o8T vLq |u1*N+Kp9wl`Á617 h*|d^*4eHW)ח@Jtm .Y90wp#) u=h# ӑƀ` 0Q֕?`01X,4V*aX9RÛ/ XCGYxHB;ScDH58pGeHiyZ&G#4}ZRM Ewc\]9AwMs9GY-u p H)#pCzJ,kPD0V'dĔpԥ`^VIZf_s5pN7slڍ-ˋ)0*,!"TEevoeBױ,¤ >51 O6(\~kڛR]lұĶԣMֶNR쾈tu -KYRs,nsA`7QéLwЛ.w%>+eQŘ6@ܧ}qȦ#Y@OR<#Ml[Ff.j4j&SN~ _hZźNd%#Ș: ~G4mW?]F#B1B܃J"!b۳tY?*׬KUX NS?>fRBϻhuKGb=q5.ዿg/h )%1ahY [wpMnd8ӟB[1YjS4yK5 Ȫ7H%OI%v}ɘhjm{uIȹ/^cK:.w4:~mW70w ݠMOY+zr(WqǠ2%*~$,㢵\C 0\o0lҴI.˰lr=mCmN]22iE3SD8YAw֢Y#:]V΢R7 ̫d|G 9={^1")-.!4GEh06Mb=ϚJ8$Ǿt d< o҂<&k0"k%ӅE{ Ȏ_*Jj@%)ׇ gX$٘ /;2/`$$En>['SjOP q a\.R3M +hD&ƌ$yޢ-KҀhP?KLb6Y7F7 ςA8Rx3ȿn$~M@c xdMډm15 isب Bcn L_'[6lŷŬ~`qf/K#dz짩,=/n˽hQ- kGI G mZQ vxFkogApQ#EA #/X'Qg$첽=k FakWWXa-ؒn6Hb%PwB 8ڹ^30 t.$#(H5%ǽ{z) 7!dU)Q{)oWg٫nu?];,>ԑ<I0ͩyT;D$,nBTq;ޞCpSM:ZP3sXa6Lu%)%^ko&#h>:akη"TM~mZUI6*|,^of_*W0F1$!Ƌ-TZ~<:=LBxRԈr>p2R~AX [TM]x$A޹lqHEXC˶黻U>rg/Lw䲁g[=T: %f^?B\NU; )1o)BO oS%#@(RdEU"Z4f7Kqۇ%lc'm^K874Z̮`:,\!Ž ZU/[p=@8$i_-eHhi|;IQvi(jf߰Ƈ 'KPC꧳֒'%}4Z,%/㡧B]PέOlNf 8X 3DnST`<LnOk؛8.&}7 /֙,JWMS7'&*SMM6a/ˑā|Aj#P SRM=?ú7LtԂ# W㫾(H<4vVڻn /5 ׇ mzڟɂ^2cUmSG ՊQIXE+z] uxW5@;.A!. Lxʐl]NީXLnqGQC6IȀ :Ӿ@,FX Đ9qeF0cֻwB$9hA]s|IǘȒ*]%!J҅èYZ40PdScӇuG7ȡXGCЖ.fVg$RrakQŤo %LDr&Q/` Pz@[Be.ƲR}uq=N Ԥ$l*<\WF\q%Y+P>%!Bvԕ,e<YS?Pn䃩vjyvD#YH  WaSèb9xI#>ďjT#$}&R I,hq]ʙ<84[c,"iI >qY! ЮѦq_h]TLJJHs% ސ֐p윛EfKF[7O,G7 "j$yt^g8!>Acy2^x-})qm2{fR'3ڳTe-jjFHm+3D, iJMmBB޳mjNC Q$3^/[o㻯Ԋưr`Hɻxq cn3xɵ@Ɂ a j%Wi!0䣸SD2@>c:L:W\Ane7˙[h+nP $Lmh{*PĄedV%?M{-M 9)&[+@g='%])#Aji#͊]gqPo, bY-\)+Z䋜 p͡,9 x?(Bnc?T@EzA!/U7菎Y*aq%Ǻ:'{:5]A8t^PL d)pz|).[w8jޏ)c:]54So6B|F]ý\IMT b'$un_xLstm 4wU C ][GR@`APU_'BȈp MId 1UټhЊ/Ep'dГg 6Fp\8Jtx1HO{# _E,eMil$ H젌֜$={bձVaҖ=%14FdP)Crzq TLRV'Gam븰9=o*x.w8Ѭtr[5?r@dXICkI~e JCtf)WXQD LgZচ*/p1>Z4d2?ήo|JA˘֓lj1״/;cu]G:ߪdq]ZԊͻEO@ ss{@,?Pϧ' 4Gld֑Rjt*ML%cnZNdgr)$Y#ΒBG.u GIZÛz֛Lh!YHm{d a[ G|<Sf9D)c_;OV,.pҽ?M tkhuBF+f+%VgSES| bpg,,'ӂu;B@OdN>;1mk9Gn"ˀ>R#\ZTK㘳xtOkدÄAQ4񢕮A'UW";xޟ>d럎RGHUgu[2YΑU~CȽ#NYMO&9@Tb&JvSׯ_wNXt s:ar NܐԆ$yװ/R/Zo ]Ԇ(ydm$P(}y=KVɘΗn a nM'ン&\Qx/>Y4i~\(-#4O1ИD)?.2Xw3Nz1>9CaNp]}|$@3xGRuDhGFr?C莮^x _s 9#V~Ήl9f ~j^_'[2'ߊ9`R)*,0 P6SI{aƵ;~R.ڴuߣkas#JN 0 s@Dաj)R(!ޖ&ca1%5-z{. ޷2bs뇣&VaN1նw쁘3K ;01vA#f.W!vϪEeL#fۛ/qdROAH[E dN H]F܂ 8M(\&v%x(4KΗ~xΨ/#a5MCL721"mpm~ҁn q%_}dϤMQXyuZN16vE#|ˈS2F8%6vu߳+O4CŎPEdbC\2!"3ƒ]`3ɗlMmjcb~ܽ?݄֝'8.) 1s+͓ϘMPNӃtn-t f>)+GC"vќ[= Iɜ^{| AZA Vγi가c2*MUW;KV3[9)^E6`0qr|;[!ѵ^31Sb Ti=_VZZ]qr%EɁ_[FR+ՃW|hAl~K2 W"ߐDҊxvEz;Fx}%Tzb]_!!L3!eU9&geUWE;U̾d9n/,Vݱx.AKkA)[tbEȊcl Ee^QSCÞ1Nu\M-HtHP {%ߚe|@dR$uTUH^(R[R}p=M0Z`xHم9jZcC %)?Xz56w65A?0~b&վQ˸9?ipIߨOdĒ|zPcFO˷BB Csn'l" bLKLYP]7H&[% ,ráw].f텙̵?PE1J*\=nFB-Czz09&$>O BQҽd]@ix>4)Fjк_6?QcmAbDWQʞ004n%c҅#V]W*$asa&&$.>#*@ W'hCx` v?欭HoSN{v'ծF zh2=(MϽ?[b(S"Hů٧}>tP4S,S߷NVnɹT$Wjy=>.aHeCɊo8s(uU|N|LDFιW[@uùxHy`xFb[G}^0d% .Z*boNs01еK)-r1vZO:@JYmdу& ny\ZxZX)"ԈUkô /Dj"TD }|X9م@Snx"9) HEr^ƢfZNHRmך\[$FfULƷk 4.;R4SUK ѻ93zׇL=`J9U,4Z 9~欏 =r_eHf'T.IΖl < :' ~i?McsF5䍧 ۶k\Kȓ~ZSmչgtYʃh`# 8!hvyk/:U h?Osn!p:]!LG+V&Ɯ9nYи>K9/?F WNG GR/$iq>EYCҳ!8 _@a$\ALqV:wm}D&dUzkle 9W|}[zRK13׬I!\|̪wCں~c?Ow{>;g`j>]]<ց$n'0HgswuYh&zq &V=\MT[wFЕV*9?^^і%o^hOLk>qMެvF͜ѭsH LHY@p+M;Ю+AGlJO< c߄7@#HKMfigDz}̎)pvK_nI{rQCЊE1wLk7[(k\漢p;mn@o0kCNd[Ɵ$fZ-c-V#HvsLWNO-^QWX8RWaȡ$3_(8ؿǁٴ6MQ5N(yA|z_/T>Qa'M ?EP6Aϙ;z%L2RUC/ Bg)y<"(c 985WA{ t ^pb;)ʎ@.^᫖xw&/oho` >'3,W{?c{\8w?2zCwovFXG-jZoLFy~d)-"u 88n/Όp 6R6fWxኯ ZTŎ~*fT |:.:RL}&^ܕi `2E *F{|EhJSPKVspNB<a{.'ŗc6C9<0 :&ۑaW ,2ӿBAە/Rok}\cUNB70H#[ir;Qw#YS^\BҾ6xt6UVy"hnBr,f|V4,M" +58+*6\ep՟(=r_Wg5pWV|m=La@BNHIV{Dn%F3e2*!gyaܾV?Wo\JP?mg{|9YS̽)t4crJ ʶq<C}Bd+s4d u4Ĵ=1dꦭwB?:(i>Jo2~ED:&Hɱoxœ΅"H*?WD`\|Ÿ)^%RO*M8ÖbQϭP;>ʁebO(3yB2\v:qKBښ1Hz/Cfu6R|IV㡑ꄜ )4uk2qɽ^ܕ_}!˖Bq1|aIOF-ߋGj”壼(=U-5t4ϒ*G1ez ]fjM9?#_tNuV:wWW@ E- ^.40+5EJa]wuuyҶRvlQ)@DU߈⋔T%Ժ e9g׈`-\#G4B#H ŶCʣ{L#X]65SDs5BBpo,B,Cgv$lsZs]_^KojJ.E'rR[T{ N(YU|HR?sUøiC,2Qc*U[-] ޏɲ|2ϑaƯ $$ \1wB0cBxRQs!*;IT35sBkA jҡ~b~8jW*8X?A7^[U]׉ȍ٫~^ެX_wIBRCVQQVUB&'G*Rhn(`UXȚ7^=? +K2@_g>.@[հ5ziu̡7я]J7~IN㝒{xd[iSo3mr[ӕt*ewZeB^!,!Aԛr ,'ѴӌUI>?<8 MSj9jn R(gEf׭=!Uն=4іh4)+ɇq=0箠%Ċ4LJ]enI{ߜ~drq惮C?ύ b4*uU";!Mm8e*)6 LV1,ЦfS/_}veP89ƭuay_=jwʛ(vL*T[φAM啕&|Ǜ9MY&+0_d hl<<{<1HQXCR%.2m ԠBཿT /^̩wYJ#t\Z.Q ^c18p *C;C{`6s+3+0Y&j*BX|bcjO(2=~E5N]*d)_h;?3,TG* 1E_gR/8 .{iG: l%bʣ<tT$%s*6#ї nJgQ~WS׬+Zz-{ pEw>"އ_#ƍ PkD4*Yg"+zj`&qg(0 WBMX~tMnz+<}kG5(wX~JiRMty =_a6'.@e㑋C) Fe9 3|L]ȋ~xG `Z7Ecz|rc$XZjqInbz5Z5iȦ~:̒D|dLJJ?++pvj@;b\.WR Lwz_G7dƂZRju6kbe ܈ HXͬKu'Y|n5MmOG)wF8&<㺽W94.1hm.$rǠA(6y>bt^UL W+=hQ@&{ͦ";m u2};rœ+7j'5K5 TA,6 {h2ceX=tM[\ ?lnf 6Vx;4'TI ZUu2&ǟեP*1 lϙwb3M"'Wp693ԝ;sP8vjt%L +,PSQLf3o`7V\[ӮeZ?P/Jї&e>nl>ED*Uyy_[fIuGVN=w8[9pd~6vB!W=g> Qy/zғ 6YFL쌫N_ f 8BoGz0Z6tqn3G`4GK-f{ORQޓFə:Q\'3pcY=7/dtr"=wPBy[B& wQ$54ΰxr7c7:5`Ϭ ߸-@0?Tvr:AAx;\it^MpeV#R]R :W]?~YyJ-S5@Idg4Ax$އնN+`GU%xڲn\xn!㏂_75w0Tm'`D}o<"h֌Ltzʡrog@35pbo8]TY@vJtK^s]g#4j8lF4>[ƨӝoB9JH.dUHs='JPh?~|Q("gա @ܷnuI1'S|p'ٯA %7tznނAA-K~ mHB'%'t6jbÌ:gWs$`eחUoVKވU[ XCDq[ ޔf%'Ȥ03W8eSXVt s}>RĹ"Eh,s6σGrQ/PuT)0}ꬁ~FĚ_"P J^C*h5p}y 0x-Za3{RJ/bѱr IT P9}7+4?#VFUa؇"h74ДN/ J`rk G*mVe{oʠqfɛ+D7)ILf[iu_`4T߳(Cd?+YU7?2\?Fcs0@bR-n'VJK #UمK.9 il ˯~#t_ߠ-mw&\&X39C\0 ]^,vyUq5`Lg'3Eg)H? "~>VŞz:xyt3ppC,舰8Un}ZyQZR@;"rˁ\gUl *Φsx3Tm k@Ŋ˘7N\^:'ǡ w{@eHg$$ʎ4IlMKtrc?u߂i~,5`%gqSBW x'N^.P`Џ {-{0.Zi:=@ܮl\8&g"d$ͩs|Áåz( !B:y j!ˬ/Rkb-i$Em R9஍'zF[Ev5Ȗn,߈ϰGA"s2\=`~7Uɏs r7^;dUØ=bǜ8cS,k ;{-Ь{%: &U#fNuo?w%o{lIW l *?<vw&i:Izx?jjb@(RFg:<?"|ggN\Eڝ֚$dbY"Fp`o\e֡ƞ289 q>K0+[8{-Pl='-歧5P c9}T6J4E`>w3L`KUٿr&ٞs¡ĝP(y P#5 Nj :G7?/($VZ.8(kSgGY7(2Ƹ=ο~l·ích;H*Q{~1 ῇPY$¬ɤ@F?0UCıK(']B6Yry(=,T*I(C#ei IJ((5КC2A<GB貭Gc$A :< z؆#A9+_q19$.,+$(`O<Q r&>,+ɛYIB·{_Tt+|4uG8 =% sy'k&+0+g,$˅ 39xŃQ 54 @tºFzJ ޶/LJ+2z"yCY,jKv j£мU_mwe!$ 7t `<[A j6xl3֕5xjJKO<:\ SV,YJY7+M@wNҲERp,vo"reu%Z"ѕ970y$ u|vrWlӍ`hzit87!Y&yQ8lF0]?(uV{G^eqʹ3q^r!e6oNҭ3VzS\R`FoLj]jO \??#QzQަl6=gIzO&SUcK7GUn=G37@A779VhA4oqx~@HUzs=0ICX=$!ުfrAKuc-H`ҋ7]+D=E"7 7#ߔg'nQ':Sս@ cx dgWolJӡ>b_ۼ'D_Х:$Yv8 qS":΃맽аء6p 9„tT԰mTʧ/5ґ4^wWZn2mw{|LJ;8W!ɿ3ͫ"E/BQ@veɾWMkFu dd!}XM $NjE' eL +ȍ YVaH|z&LcJ:;};.CAP7%`yrWJ &dEEtY<2m[8́oLh[|\P%T\;@KkT#$쁀\3`u76eyY^03u`0'}г6aoዠ$)j›,mҤ hK3!+b~ZWuhR1eȽS|llwbdJS/l 2鄝n: 6_xa9'4uUdLe}ç͊="9;nj9s=zNu2'?Nr<ݧ5R.}8fxa;S:KFlB#MMY3{(J8p3L6y|^< }Alϣ{9ɇ^fW8CV@a c@Qm&1X+[(b{G{ >פ!quM,p/*PYɞ\4E ǿ]ayfa~Qe+uwH9~]1 ܇(ʲj U0] m=,\ K>Yr MjȵBU!*WJ>G -C ]9BѤE^c)g, 8i̎[Qs]i7Y)je2: I]-w[tB9V*knkh2W%jj)F3!rqQ&0E9/je r:zUZseOjdP-I=ddor{붏)Ӧ5驢W!nXRhW(@FG9k)->gz\#4bu5`dA 9F֨K]5= e +KzA[>7D9[hٖջw)wage{ :nr,bCiCMJ@:@2ޜSI,nD197?ʫlX Dm'=2g{[j*xk( ӵ"۔BSv(,)PCt"[[*V}8کt^e[8ѯX蹞9 VaCh @w64U3EBC_q\"{8$$*&$hC}kf{,Q7/zEQcYڐǿfD~wN({kůRI|8ItT8 6\`< 9dT*+% kO=?+bj9&(]Ԡh{$ ={,x8f:5cb>\D$*O•$3$9ř! P[5_Jߝ3ܾt|w yVѸAסW%8EoBoɠAXV4$mmW f"s BP@0>KBfX9Fp: Fm 4R'fX"j6l[baнi}^Xx҈"(Нojdq` y-z {YlQHKnTqipg S0H j{h3]]#e Ύ)Ƿi\GB>.E( xhʶjTC asduƗ-Kɳ^,vTC]ǿo8  $nq-}2h =.xEU+U뒚E>\&}F`C!WV2 ;L?ٞE| dgϨXVo,J#'4\Aθŷa *x UTj ?v=^GN1/K@Nֹ< Y:%zYRc||'$j*B_X8@k̷h9u ]%mQXx&\VܕDz늏-9VOwn ѱ+{?QaZZ: 5cWCFyihd42RAfM1B\w+}4P1~%+]OUDq;9ʔkZX(CkVzfW?^e]@QjWT`@ 1jl"%!C+?*%߶q|<5|ˁ9^d"{X[9ۢ^J6Za)~CI!u*W>b(L_xhL+$z s]Af k_j`mO׾F3KPM|K^>Sd85z/eޒ .u8\ڹ1#rdt&.yV "t@!@!T?_o%1YyTCgM/7Q}C uy3kG,ixًKےb_gq}kE+ʽ`Ѩ%^"FuD!&5i(꼲Ԣm6UkX~e"Tsp*-^U)~"_o;a<\ܫx.usSzRiy]ȸ fzATa;oiB1o~hfٍ^(z`EYޭpAA/qR@#.͘OTfrr¶d>u;QKf)\xFt0:1}aRW##Fѝ^(Ih9*.$\/RʆWu{9.@Oڭtty!QǏ0=Qw#XI%HXajAhY` Hi4W.FUbo_b;Ơ+nVֺף"n!S%L(d26V0KHC_ٓfVn_4?1hRoFd;{N;Z 1zNWY;GU%E#o]g.(9F-B0X5bMy&qh=X9wڙ^q1l oD=-!m \ZI lV ?pN_zz{t§^j-Ϧ\0FHЩCᦳf%VeO,lB&RQ,X#A*}M0C]nyx: -REjI^dM2nS:(XxyHֿ0s\M(F{Xu"3 5e|$vS$&t?+o;7Bt~oG1h 8ݫW_M+OD"kɼ>2FO)1*LiX켭dM$`E4ȚZeGU9d]m$.'FSRR9AVxh|.D!gd!SƯGZcU&Ǖ7FI q 5A;~OEA' +c]n$|ѵK#U ,ҢNY\cHu@ث{.Ai H IN~W'irOV7k[(ZE5qw5,-'Uqny)CT#*`?wȩ G*&OI C(x|a2+XCu* $LRn[íi7DV+.=jM8-R[:GR'e50df¶ , Z8Gy ~nDDSAypp4ZSk#Zqia|7"5s*O!{z<8΄}ɮ4;c[Aˈ'XgdDgd+0^Cgs`]#Ԑ \WHw|L|f1<g`4j}irPSk?ͼ^wix4\OZkaI'AHs.]@!qNl&i,Nu2&[Ƨ+ }n=-Q*P=b ¬ Ʊd71ue&׷3 b 1ݞőƞ e[wBDKu{U= C\sΑ>}>njRfkI~A)p:0\MBW#B\YmlR}_v]Q‰5¸C?g:uxw,pkS!MhQAcu*DSsЛ_vc(gc L̒#83x[7`ˁ1~PH-{,q[C`  ^LCGRd"-- #(? Qb@^̑_T&vx 'B2ڇ\ߵtA6/&׳zc%$$0i4/,:B<-lbN1ȳIyZ5/|0zc$&Vjt0M..؉($;&& ][me6@Wdz-+ Rݮxfd?`mpG|tȼ G"0Ht bƼ+Vq;MٺП2iVYmXI/\G| 3![yp TRikJ057D}TѐDH6f9plXELD,;m5 mⰝ~3r;0%E,9 bChʚN-pUhhI`1& USq-.FV j .g"!+ܼ ݖ&*EFc!# \lLjƷ']{n}c65FBpOEՠV_J1N?7N\Է ?7 =3>vhU⩿ų*mz:{%0LO&e MM#Ք x_sIHl,aL|bŚK N7搯5"Q̊0d΂B־i]u Ezڰgq4_mQnWPmSW#;oQ4ƙr)5/x6.gHg׊˩:w/ed tg 7IuXpZ/^홬)=7+b'O {ep(ty8cք@l"FxJ]#4Tϡ)|1xJyLW#%%BOp/KǥF&1"0FvmģRgGF`eqkUj!)ԏRb:a]V.veP3of´)G 2ȓ#J_: 7hth:o'6?cm.u*= Z|Փc}G'98X(R~dV|(p.XǨ۬gĝIQJn>=D`5g$IACMz4%!vzdc}uMMu=p Erc="‚QIF$LFƍj:RjȤ2*އǘ=~\0dR@!ɹWqFExD7L=8j| y ]Jd_>ojɩR)Hث"Qok<<Ɣ]gf:YEх³Ɖ# UV?l8{@ NC5i"u-҅X{Vr+P6XZd9DY Ci.%h=mUcUqz'#BZ?}bCJtf-kcAPx[b@)=XMȵj@bj_Q Khyy§Xd/ ޠۂѥ왺G_ `aPOD0ZiaRik$ׯ㏖}k@%^9W$h;ZL]:↚?:[^ʛ W[oY Ix~?' ,ZQ9k*Ph[.in끀kj&#-HjM)ZD|GDGPMRp7`*J$[0Uh򣃆\_+"T~TX"3lS,+k%p/Qq":o: 1my/ Մy\ǾRWdmT@kU<.7j7Wew-_[5@Q4AuG{)q`kUvW( awTM^#1]}zhѶ;.}ç92jkDf%aJn3!E8eBе U[@4+GΏӰ;Vu"ygWiGq$rj;al^O=cn⌐Jf-($j7FvN˃sHs (׿uZtS:a[Њֲx"3_442nyK!kIh /6/P</?FH⡔#.N(<]p /_MA*.&n@k!88Ő6d3k5nX˪'bҺ6qr׬@\hg⻺[8-d-ePCHϳɆ}QxhvP80\ iM`Tvlv4&vi$>03.0ni!XV0=P^~suG &RzdZ=Au;-ދ.XZn3P0N~_*!g'yj6j@Z ]:jKcA}gXQ<輛Y_* QM:G$`XFcBq@qpbut!|T3db DaJEÒ} ٨)h$Ꮽ'Zn3J{g[;̓_B8wĦ\5#oF"T>Yʶ1Vk Xr3~~ŗnѕz13A>BY]vu[/eq ܪo<ͤ!g`'_&TU^z%Ye3TnWqq8C8#aWS‘8'kȯ;Թ'qƌ\aVكMRlT wV>X Jk+_T#6"/F'KF6i!فUhwI< k YEM?HzfTމf*2!D1p v>ڣLInBwmpo:*' =Ƀ)kD3`NF+=ʢo!t~XC?ܤj&p^6[k}PTMJg2hCyT3T^5nv;+lqf0޳VK`(B-US=2:Vk]vi4bpIhb-? (3nHG΁Չ/} Fle*N?`;V1QC-&9 3yCa12z\^Н^;rO_Pyv^`)rZҍZ K(Z+Y(*/= MŬdۡ!WKI@hۭ ڰbe%h +N b__0jW " -*:ryF-M$pjfwB78F`Lp=B{tz+zXFO;WM -"MizIYڨF˃T Ԡ`xqQiz;Xѧ, [O(SoaծzR[*3a 묭t~G@a5LrS }ϰ;j2,}tY^E{ztO/&6nphϝpzB^u>8WXa{غ}JG zr!, KüvͻQϰ3 Dib]b7`NEkЂ?@5}i=sMW5:Pyj* h,4CjV"W^xM4|Iq% b<# jK #A5^\ 5x a$\P2@8i}`eK%Y=ʡ#f˿ Oi>("*Z"Uy;ȴTN>u6s$`+GK(x_aNE3'oN 6ɓg#Fo҅5E²rn!be8Va~uQȏ ?Ǒ;RK5vQS^GD=0X7 vLky]OrT4(GOc[1jg^-+ ?~hmg۰ȀژYU#HF&4e,l S㈐P!!&y $m.\ST+֮jOb^>s9am5M$e} u_f9-^JSHM$Z:@ȌM&tzǷj8JCe㠮ӽL]%!긄! T׽D/'3 s%רl?S UR o(9rh@tII:p ƍDWc3!j5r'ddw#_Pp{nUkajvo͡f؜%`c^6^bcieg?rTY']~N7;Jn@y|3˄ά=4%)-4אQ` 1fj( ǢWr{Q(v\iJv;F_s5p; 4ȺO|+rum $oKu:?)ntiG8rzYOHfR;a7.`#.ĵ{ޛgJ:E/Fbbr@ֿi=AF.Dhg+_=[ؔG 粌3bSmOpa۟nx zVQ[ڌdfH Y= f[(ҮІ6AҬY^e2z(Id5I\>*M | ڽJMdR-bվ$&6s`;`*<Ѱ "ܫ h;XآW ڦ{IR[é A+QO9k0OSaË: ꋏuxFSJ9D5 ؛T' Ш_sh\#hzri|v,5C % *jWL4ἯI% W**izI)S;INP UdlN pIılS=#IAF=YFRX5NyB})ǎ㻻(U";Hv'fZjH1$u0ehҷHホPV_+ ʮl04ө<%%FE5)]˴DySӍ-#`K4i[CDT) iIu@缦j:t'Wis],f8"whK2*g.⟟Mf#k._L)W.¬ȧ޳iGlRP4=Gns6x#1P,1ci,OêĔ>?P,L#-ߍG*wNoLpW.JrC–y~- bՆZ-J ;78},0Bh^BͿ"gDd0\4ŶlkVO/mTOyOV.ǰ_ 2t+'&OO$,Dvِ{c)k$7pplJzPm!^}O13?3R9?",S@0 H9'T!bWB$^9A@ TEL/Lz_1sOc;Qqe4VԒ,ѷt.߀! bu.܉ӉZ@Q\0-8/PM1DZӵ/},TXr<1GǺ$wpRd%;ґtvGitE46ʮF-2Ч6 ~ :m!*z6si B^Ny6MY-ہ3@*e隣^-۫/܂_&H{{*Ă ~pA0Wqtk5SS)ȕ.?5SrYN,<^; DYڈ_~6S>ӃH[";E3=PNiHz2oFEV^x}UW"o)*Ƚ3Ir։ƔG*_-lMsHeT(ҊkJ3`{~=9GTb3`wv`ȣk~j{ē߲p柝ez? ~5`rN5Z{FM׸MۆË U̻w ΍[900Г)sa#W<חRaֽL'݌:AiGtK QC("a<|X}&]"neSUz(%s"x!{tʤ3;rFzyAp٬qRSD@fK%rJ@5EXc(Z&xatr*DZjlt Ad4`Do[8ԱB%vbg-!ʘYqh/"~#sNX|Z , ^!LiO5]VݗUHM P 'wnzBp:GCQgq+GXFDFm໛1NrdZ-;*ؤ|co/]]I8/D~݋hBJ4uKB 1" ^ld 1 FSpT pv=S$D@6fM:ŵ~Y{VoYG[ےbeZf83/G7=V(ڵ^β? [OiL:zw0p3oTX ig%fTjx&(D*Rvd*n҅E\T٣dHƽq?/m+evY1tGd #7|/6!څ.hr+C`mFqq "5lLBjm= )׫b:9RHE 5b.y ,) O'͚Mj?9Lc9;w 1>TK߅!R b˾Xhgb6c8#ANbUQ#?$zjz  ΪQF%: QBJP"&̏w+$ԥCEWΘa # )OsQ8ӱ q'TR7,kٕ ' K7ն-6+ǽbeJpF2 +sSc6l%}PY𪈞.Fs0f#pSEHwQm`?H*CpKC$b؃"}="٤t.$:*Q86SҢB5y3&߿WgTHAc Psi|Y{lpb8 +'\ni_)7>Hx3TtJc[ \\LwӰ)4.9*e+j/Q8|wj/L&nNYoVNF/f­JoKk$9%#%؉-B1EA?Gs6 [M'mOj;_e pփ՘*w`@> ~N_efd,G)Ivc$~[&{7_5 nBh8\ X#;Y^׾$ia%~"ZEF|=bB y|V,7B>1|=WK :I-ffS$ܖiGV_A%Vw0[G2enP%lJ^BOc C3Hzp4h \tG!qX9,yTΐ' e|$,^ϭ?^vtGҧ^C]ԥZ nR: P1He:L6c8e8 %3E  ~J=ݨRV Ld٪>w.tdٔ$~,J|['x" ζ!6Is3諴sIb&{AD7U[5ԢmXԈ[ˌG"TyDĎETgVRo?;X?=y>Ǫ\pgxY~5l7%2^ &8]T$1޾AFȬѶƳX~lK%}`΅<N)<@}p!uNZc"X`BQ8o77Jj)twD#Ic%1n #]-P2Iϓ#[ZZv29QY3EV&c4A9e I ~K &oMSPiꢇwޓ"2VȾ7:c>4EN Ϯ"~גb>!s5" PvҚ 8m-ƞ*P#E7T8FQu&􄮮VHэCI(5D8ǖIxd3&~” ;̶4|̚f}y"L'5dU\ey> >ocg ]q҆r:nt"jYD,י8-ݐJS(MT.(ՍJ3AmH.|g~ALH9Vۛk:@ut(Rx}l_a/K[a7`)--!.Aqtg%2w}LhVq\*2ed2$Xgf :VdώKNID#*}nVfn,vR?ߟ1 6b-W|9ਔUw~ bYB M~ė B ,#_טo%\i`;yQ" nX=4wY@Qer+^ /<P݉m\F$Š\jsɗF9X3>IHt3ÂlZqxn"Xk& =NECI>FP,APMЂCf?lo'1]*cOp{p8g5ab~>}q {eEa]H"pշ/56x= sQZVh6 ;F4ZSEת݆ d"7@\OiDF4SKrUt3f߆cO$)d35x#Oi9rEyR(dpXH 3}Qx6\/<CunS~]O4aNk,58ϒ$jhgx;cqw %!ӌ؈~X`qõ:kdRR"} Vd) U3œh3*Nx`&O߉;^oOxocRZ/g`Y\bh:~ h@mnG"G4/Fgg{t-/*eRp%C*Pa}!RcGv&? /=b|P- Uh:a[chFQ6+Se|[&gZr<vyXsw" ,LW`7eN)+AG4y4q4UP(c*d50fAHa8+jl,HR71Oa2߬ʽ)ooi!6^n>|-b; \G6Ѷ6Ԍ0άQA:ہɮJ<-T1YPHF$̒>r) zI0[BRڹrI> {H60@`|m]dCF2:k׳ EcO5lP[ 1i M85@8HT2lPזߢ,7=/S~ ANk &!>w\N{7U1~!t_*~N=Vpwψ?“ 1)E$T07:ޞr߆K. KANl{7l SQw>ν*x4>|)xEYC}#AVK!%Lԣx-iaaS !+FP)>_N $t,8%szn$`z9TkRp㇆L~yLtvC TcDFmE M2pTJ:VgdqA9}3W6gex06P|kT -CYG؜%Q }0SՂNB \U=B۲H珪'!N cVäjv}iF6BRDl?#G= @=>:&pMWAmR\"q'[cMm"yrڸݗC'l:bՏvb5='H$ Lto5giX{CpR=D !\hE5#>1A?J{9t9 ,{gp'F,Z/5q?([ eV7>Kc%jWE,>E&kTyDGu 6`e_7qV @8Jxm=!x\Ԟ@xD b2/Do[}ʸO8B-w\wML-F05m^ L*r71ꤐJTqUNeAuo@Րr)1w.T5Qeo !ujAYqCGXX!36Ja~+G f?gҁD$ĕ7})М: BRߨs4iWrni 2=8~)~HXȨBai&"OR}u.1r9 YMFFo1 ЏmA>[8ߙbƯSر1r(IѢvl)Dor-tͨ zl3| ԩlș!0fS֍@&/ ~2Y'Jk{4L&|࢏wK5tD麭Mo@abfcS+KJ~t,_jׁ~/5N`1 A?5T'eeD9U6=*ЀpGg^CߢkQ_}Ή)J[.>0 Nqtwʵ*4\ 0u֨ Xdu 9A ?|c %oO&Qtjۆe[$|lVLfu.;9:OLrE_7Jhwy#Sp#n#%Ц&?Di!wׄA*椤l&Z KF֦}Z̕e>[!m$'}KXo n]/ t-n2Yr:1 B򽝞,q:hel* LDXmݧ1̃9X-Uw}xɡ}U܂9{f4@qaiUb8׮})hy鬖YzZQ 98ն6r$]Ya,]Csgnzr,"z ;+ Lϯt1f-e5+ RHbyzY'R\U<=W{ꛆg oq~;fLu Ob/Odyx+ ;:'6X|,|t? ^:O@WļDG V`c!=x<3-:#Ħnnu'wŇE0s!_eO}3*#?܊:ʕh[sYҡn)w*rq &>|u[[t쑹t6Q$&;uvv>i:oLOzXWқ#Es~BjƽB@5(  !6amBR 3=P_=qtXZ) W+ZsݛFT]!"voўcZVtݝ.]{[!f}M֖z03QQ J>̎&|aG ~rϡb*vHp52.-tI)$q%$s'FN!V?|*66赽gU>OAG_Vp(u }>Uhk5 >%\M5fۡx;G}iwzhDm4_O59qj.WH舵!@PǰÝ Fp^=ץDi@*ǎQz@<ϯ4^D ~*Rzž뙽кUi fH\rfJ l >&B;uYڛkbS'Jx+T!97v/ujᙠ@ށ]^p}(nhvB6iD xE g=uerwT8 ilQ˿EZ9I.4uXre6rj&?X.P۾&3m ڥR}&gZob|" {`اʹ) +?D}Oإ֍xdSƄ)19M(p{ h`R=I,ÕuQ5 >twGY]6A TI/Q7Z O!) j0=TJH۱;~Y橒0v}֢,?h*;~>ٓkC$jD2}꭮B 1]G!/V+*,"wjX.2x|CQ**FuK+ze(#Ys^v 2鍶Rxjn`lP3uje@)LXͲ;L= _l>+4&N 5t4Gv&:ixPk~O(p:ٴQYaS_?P'#K}\ubOq-wFNiʏ3".G*_q .Rˉ+oNA7 D[e']+ϗtGFQJE|Ԏ?kѹ=/V88b~ ZfQI]ç&+ƆbڎE;:("N @q }vPJQM+ϗ( 4w3n5pvlw|j ~iGD%)q.YoŕЏADǡgQSc7[W|ob '@?֕L ,\z֑}[-I_JqiUUx~ Y`N(9Tvv=R:]Dm:")#`X2:SaRlXusLߔv++D`bf2AJ{.% >2#ZuQ,;&ed^/ٱ@_WqLH~OfנD!LiTE8M؝WR7p["@7D({>y 3'񟰅)nEa?-L9ۭb@BCn$Fߝ,[EC}}>N6YSL!Q0pz,y4fllX5y䋝lEJ;ZZi\u)t09&.ңGs- 3ySӠ;Fj7GIOuwGד/-Jhk0s"bHÇav |1!%@K9dh,z.ﺡܙ2GТ13L0AR2np=/3~Bť2Є2 Eb=>KP?M]vJ1}Pǘ8-|i5 90'َ*ym%ƃ03O(e.TKgexBX4E%N9h0-'L~pq#yz6Hm|aT? E̎20 6!*ufC60p@:FZA>Aj1ęQMZSY|I_kp|2u]?d!+"쉰fs <ۻ.u3^< .'%꿎Jli!N]f_ JJAk~N7@wfUgq](6(Hke9Kۮq$ȿNIV IlcV?/7uv9Se55(=\Cu`J, N*M`w>Oc%1f$zHsQh<{-Cɛ^4AO뺔:gjIV*Mo3اra"teqz>)lɀM*d(~Y^F^{ cɐyF$1tM*4&>N&U " MѨXj#,_f~b魣 Gsj߯zk]~6vK:rf#L_c$깄E=9y`Hvyma)sHq^BucMFHș2WuXE";ScL0L}|- }&rRM>zzkn;3Q !N6#Y*d ;!~j1wUj"x]``GPJP?qð/kYp:sf@9Q@یp##}qX>HkCC V&:H Ն%Tc*ޞ[ 74WNHÿ>+O9> bkŦ)ŕ۴+E|4J~i,w9w3J|bFOeq* jlFy6 G}ϴ$#_6ѝxFtSx䡐Jc1|h<u͆ ev:DGP])X|RP B SLpVMj³-'ZWsP}hs;4a\؞='s8A3@ZRӂL+ l&'Ģ&W%v>h~1dϲP1DP0Z SHBx2fCo[ٖN|յ>n4R5 grk?#SRFr)U꼙W\] ⚧1MX}Oc_i?IVj;}z!֗^N Ǵqς e`%#mF ^k I =iC^(vu|0]D >劥E.`/fIuG@?+\;aX8R\0H5X ( ,̦}#[MZXBgÔ :E>w#’>[wHi<c$ -dC뛉x@pnϯ'[++[%3!HqH|$#݄Enܦ%Nard[iw1>*;;_XxvyIO(d3QS9nMkSHĞTK$ظ^I"=ar ~ޖZ8*əŊ{m~|p<%pxI-0F%)\sKɋ#{"~uKCOT?Rw̅NȵK#G挱z%.%EpSPk7r:!s}-T p@*rfm ZPb H]0D1 7'Ma7qIV kxVJ@ғg͔sR)ʯ'o>X)%pڨifA'7U4~6?fJ.Å ]!>oqTջlG(5qghd䇛c+H-;jIO]۰cf(fGONGz[=ᯎHւŌiZ+ppI\,$  lMnQ^%a`j".eSe ;vV_sbyᏵ"iЙdÂKybzXFxGBe,c3toF@YU)5?3>V{-SJ g *A!)%9gy`A?W1IzIdmёvti4ж"S%^RQΗeX%: 'gY'9{&"q H%@Yh y.2=B3;9{i6#ϝwjUsL"եGUYy3+x5+FSz]:mʃM? B}y{@#~a0X܅L(ϧlUd~:oh{ a`*Y vJ`"z G4gbuLwj?չqH-7FS"w svMυ|Xڟ 3H+@Gȏpu9(.`jhu0Hx\\`;\o,DP80.{|,5V~@*w*/k-71_Yg:vt"~:I}JXʨF57R)~M[2:iR0D*Foc>hyt3ѴWY"fV{ i r]pfKFa8 oǶ-V۵#^i|kUZpHBg"h9W*Tx 0 PȎ뽡4zuڪ6 PB|U^喆l!%;ʏEi@$6" qse9Cm/uhUH u ((Y8.ha1/gqϭ*(v׾eU4/< >+Dz'^, v$ӭcXqly34-?;pXo\qL 7R#6PTy 9|# Hz0h`g.6XaTыbfBifC ZOP,"(=7Wh\(@v7(uhDc}IաǠ2"T&pNJeOOE{;!VS~txuuDIJ}+f`@L,,nM4l|wbznRF׼=(te%G`NB.9-N e;i[\; }=^A^՝B)!dbÑ) euMkHr,rOO=y\Pd,}Uo-x+ߕiUi% D+K!$8]zH(|Zbw~4߬R Yh$v >E`,C8nM~%_uG8D*b?'u<4'%r+eLe{ڜZVi!&°u*kf b`y rv.Dj;@ ³߭e*)shH3R%/.J 3n(GR٬/NH@.P$f^ʐgFTF% R&QH 5¡ǰ6^Yq!P9!0SVxB7tt/h p [j?E({#y.ukMK>Vھ12'^6[K*IOjmL)wN~0-\9"u+.ΟP;8U B3 ,~]?LuIKi{p;)q 0Bk7uY!}QҺk$&JO`G[4* ?vg i T1,^ߕ: j,L'yOeGbA}c"e.7ĒP!iT:hٓ$5?':5259e_Ck7,^르\&t(F0ׯh*Eq^D T+VB ONwAaGove SǶ[Ifb"܆AK `[Z‹,qI J{^=PV,o0-@wa?'ZU ݭšHsLTjjYJazr ;UG{tsvm%qs=_QyҢ<* fbu 8tKqd]u:QDn 0 5eg /7|Z͞FK~:ōhgs@NOc7bh(EG 3WHý]Xv&믅- fXW.45Pww}3c|WQ!~`r祙Ѿk+\o:VY~blבg` *Ob=27M+z*Ou_*rbb!:ʦ'Q R"~" )unr&1A@v`&uz_if?b]xZb;N3D`7WFA\r .j#n:9NJPz)a!a?I xtBk>MF⇡N-lgDRy#M+ŪU{Kٕ\ⶓ@||* 0 >9mdT}Ԩ 0y.Zo?mD UJ,)q iWbw"s}P{$k& ݃{&IfZ}dIM4b /b4i?jޓn/) 0D_%(-j |F{DNcMzϊ7*eODm9#)C~{|={G *VϫB4L,a.< t! 02sx#(uJX<]~! (8w%T+$fCS%G̨hW-PG)ZVtJH ?~-Ll4~x!t'pa7yfO>ƙŞDt xtArܭv 0 Vczy&]Œ:,*>׽ Re+JfQ8#]'p,;އduU>iRm.dۙO>9 ^Qi$':"n?<vA6O7+IhCCLi8)-6T[ [r2"?ik[5'($ՠӔ 4y݋zuu:W-VšW _ ogL4g܉}aֲ~^eؖ)` ":pjH7ȳ0vA8ÆAQ@5 # Af-{:\%eh'AA>hn/>u 2,W֩Շ{{aR%鄙 <$0duC^s%Gy{ ؀eIpEB7rOGd{ x7)myGjʟ\)' U>82z!|Tʾk(R} oe5}@m{Tf ,ɶS\@p gz**e,gИПF4ģ+$~a+ɇe2 Sɮ=. F!dc?oyh4!{QZ#5e~jUꫩ3څ䭨{jFzxVv]c_Vs6Sv;/{?j&sHK27H*.˔ө ..6~ CT6k'yl&\m| {9 I79>T.MrKh"o àݻW& Mcne)I4ַ+-)RFVV9ȃ;o>QiN&߯y-j¤*߾s#,m4HN S,U7:(h;L uO;CTMk*tvc!z@h jr$֫v=RLF')IPYAQ2C{l>r6o;-ʨ`ܟtш{ǥ(މy{=bҨhh~PuAЅ*7aD.%80ʮ'٫?ެsRK08EP{hf5u{f1 1E}V>a ]?O$;髝#BbEa]̨`hSt;Y?>Fs*ozq$ޢ O"0N+yj1,Um'ͦK!|0@w!v"+(pk)z̧1^X]ܩtoPnQљ!&sEL'rcE<` ^Hԁ< fOsd\4S!1 G_#хdp09Ibuaѩ5=?}[M'ȊحӴ7!GgEsV uK\7IIY;T6m1Q8 IJB.닏eeV X{civ1Z<0 ߿@ C G~b a^Fj}.YK>-.sik 7HF^|S5|)\ 58Ol!uA^(u1v4<>P`G.|5W/#o (uqXunqydIS`h:4Gt\v ű?>៮_;j7&:mX&9-$թV`-C !DTaj$IԸd j8ݏi]&;K&]c;FM֫j=_#}m)i[IL8 6𔔳cԶ`2:g5S\ ǿ}N۸B96ƭ=B4J>>2fhLQb^ >ncV;d_[5^\JAe{*oy#8l?m A7N CH  ˬv5p.Kg C"%]-p\{Tuh>NV4l[E"`B%nw9aaEPRQVlh"2ꞠTvHL9+epq'iP7ʚ7ǔ~Q@:SCNޔ?bn pREy)"L]o.9;PYzq*׌b8r$+'η{Jw6I9viok{]r?\ )_) 9=iO3N1w#Uc6e\F@ _\s3rbV.{3 !}\i b8uz$5X=J"o招ߙ-P6xb* 29+;d?V-{//_-٧y=S {pm Tl`a5DP9njۻ|7 bfjRrEKs18?b=ܶfߍe !PxȞ)[(;W U11 d{6DFfֶC@(:i"Bd%O_lM&n rWe?-s]b?3(”g0T_zҩ!!f ^tx*ӛ":<{N߀`Rl=MRyE cF Mnk hN+r! H4 ˚`:Т|:P\̖FFǼ@x}>帱cAzj€6 thگ:fT{C^ rm~qip$&`XCxJn-q*rg 4:&T&1m2؋R)X)RE-WAtr EdOThx_2n %wX.>?3Jzy븜Xę[KZ S41(;=@+O]120 <ו9A+uh(('m0R$'u[ʏͿ@a(1%%a@[?g+HvX;x6䊤Niqo$0pw+ޥI&f:3YPF'zё$NRUf@~9"k e L%r`wcQWgZ|vQFͱHU27s>2c^iS2ڿi$8 }BziGFVs8;ݿy1G`eMn|+4b^6ЋrMQT¡]Xo|`_K"MѶ,Hf"tSp vލf&yCcF\V͖IL]*Ig&fQK4tIXK{R:!>k V yS :r'1{~f15_˘ %~a2֤x!EL*mzQ%j2Di~:Wf/ݰlQjK> }`F3omVZƞg%x٬\{_^W1|P1Jk |hnʋSk()WKZcۗIpf=.$Rݙ s/vw]aovԩI؂,D|gxCdk"Й0^ ?^v #nO7'eQڣqT?<%O] P?xXDN-j<7q]W JKbF dlaFYaMq/S]~ˊuyV,z2'xɋĥ&)X|ʹܧh{*-ZpW6@}V{ӷ(r/Jd@O×2 s)gty][D00 _̋GDRS?{E>]bv&ly)[g( `fLeck޿`}=F""XJ. !\=8 2M僼K;d_H-bX`:D3eHtyns#\ YySh3vژKu$7vl҇ HB]7A,j!F)Ȓv0ob&O@@^MX/O&3v{/>{m{\U5mLS(s[$dExD]QhI c6)IX\HZ8VAqEߠ!}/Pm=\.ETRͬk0.r1] R ½ 30bVLʕF]ޡ[NhӨh'I 2ZYW}?Ѳ=?t`h ϼV[SrXul}u9Z훲vej\G4-~|$W|>EYM F8TFX5GT=o:z뫐`9:eq!%{MbCd8ĸ˃kOhl'4_hx T@2'uzBZ0.6PJhFb7D bZJ ; L'hE[DȎϕK!9-wsЄnլc7)z!nN*hs="h'MթxI MJ-`ec_.]'Ktޔ*AGRs#!b<.ML%qڧ=j57m4h/hd5XLejoQ!ݫ .ux.?%wĺRIE\n2[LdVg^ϙb$!U&J"l-3߆>xeKR8Wd V|BIgRS&x2Mr ׶~2 d@aҜyb5lcFŦ=)=)۩e{3Ç7[wsB)`~i~4|lW[5Ua[ܤb}Žf-GQ$ǧ[_kgI%YyP޳4^;|pεFHk<ɒ>fSjڿfBKyom+ BxvԸwK){~DVwTM[ѢP_&I{Qg9$' :Zơ$p/ 3:^`?7EDླྀΏ 7Ix-R`wAAA!A9.kd$_N1'ϣpo)ɌD?7I5pk!k%}Wˀ0+o5_"#4zZa?X*`Zh*G"<3S)umFžy`@O@ =W/VlY/e|夑霘`/%ujTU!0nhc:22:,LM"JeJ_x"Vp(*)H;&;dUGFm}h:XssVsф9SR'>2Гkިsb'`?1yT]@,exKۀZqH66Eۍy6 g) lj0af, ơp. ?tĬ'Mtbf'Af߯%i#R5eݢs7PbH~HlS/̙B CXgj(J*n}pN=HxƤ}L4.^_ 0ՑAE$8wԓJCFw_D ftaNTĖO9#A1aE2sg޴<3ȌkM=^szJhP>Qˋ)@y6^$-N!? 6,ѳz}ʌ2TCyݑ8x>4o*.Bx}3e VtʉEzЂ#21̾]+cȀw CUR9ckhM esFz}9SRM/chhvw!hVCr$7u/>E،ưW*(7(ɣ6D&e©g]6~9p齙S` PhS` ?r\j囶 yH 2e"Ni9٠KFΗajv.n'wlMh==]v`ݻ2E3q)s7Mj&+~΀}*7qr{3&Nc7z*#1i0?Vr)MX\=1烧fPn/ iHZ> \hEg7v)\muFl((_ xkT Y.@;;w 3~8DNp"-F<"=.F#2,x["&3Rm<JEC?쯋m4 #X8 r©XL|ic)` 7 Q#'9]Ek% [N ^g|WRWqJz[85cV8ݧaz=&M3&P{۵ є aa \_ ߐ2jgm"lb+g^P/ uSrjܷi^{LR11jnKh5qaRY'/? a؝$o"qux %37NPB ';Aw/.#ゔ6Mx0˞rw% 0d;5IhURF3;3 &M_j. ˏ_U[A`5_% QE5 okJ -bt Q⭜ڧ^<'wWhP0ORQPd|QM`v/lμQXiAg`_5g\^P;JF,90uR!JkPF{AWU`x ̷'--&9z@GDaVBx%h\SYzZkuo~,vi39g$ _=^4J3or¹;4ȣ΂wЪ;"Qw8' vVq2K/aU~^ TKO`)p 0Svdxk~Lp`cW\lqĻؠ}4YF6崹6?a=Яw0zF+#,>\e2Bv!*}{2qd# igD57RRkGvO0YĻXYir=PNi4: Vn.;t;^h3rWVG#OHx;ƅNHlhj+6yk\ agمW ʍ1* L;b(FrkomC8rkd#|';h P7#~|J$9KkI{oTȲɍ{T3k*iH/Nb<$f7* tP$DŽ>PSo6A|(kEet?Nj/ͲL*>y+ x6{i}gkbb.J/Eɲ< E!,$8)@3br.ҬgEDѲۙҞ,.#dhmedhυ. O ȷ)'v3fJ-uW~A^6ZlZ,% nя/Z O^,=lIe/e f-)7A%hnv ٽ`l;МlgBl4lה!rP Sopv$}+PR%A96tjO8G&{s{qnOqlk*:nip5a׸.ڳiD* JL3.VW'av[R/_!Bv\˟{݋t}[$˙;*K;C|WIHp G{b Gl;[ xJZBjذC(F:%f9)y ͈B&JT26V7w4'pqbmv;q47ϧx ^Tʇ"*:@wVb:9#.ա=wH\'HttFvjwzF&p*Q+*@ ?Bd(u%/>RFP movEtc@@ vSf:$RDrX>=s>&ԍsvKMmi ,5&=@k/GQ&@K}33Q,wxI&J%eEźï?I"EQIG{bI<tYS]U%=AxAϧIOPi~rCY<;l}|iB?hfQ_1 #C{6R9\Յ[aQ!܎7QWb0{ǴӳHQ6v:ƞKd GPzi-sۏD+(}6gu3/oe"d?MV,9iKk+Q0<0(<+ FER/rrJrh /gH@Fym 9.dG}> (x AA0f?!GkF+Jdx_Q?x@ Eӳ0zHo8qSv!nb&j9 ˊ ّƻ|S*0B0< TX ?/#e< y*pDr-'y-9D+dL=nnkLqEVѪiG07ɶel):*jkybUG!LLc? e {#>EI-0]hTG$;1f'[mG/kPTw6Q]OX?e̵,B/*H=3>nf_p^:V2߷o&.@;O2| nƯSDcRf}~ãYo`ШNYNWӷyyؠ!=CH{ek%O4P -ȍO [ ަH;rYtrD`o>NNJЏJbSUK#<)[@+K-\3=Ϛ 2f7tɠ-3 |%'C#GRwy[lZB7s'x}4KN~ [~.7>t.swނ8#?S}-]FI14;S(4dh ڪ?'O`l~Y|wԁ4h9'Dv2E>7O^t-I#!Pd-`oƈfpR-`[rqEIKe!LZR{!w=vu3?~ofZ2];p]HFpHrX$/,=W:Ye675{ǒ\֓ t4YzCUʇCYUm*e8e] t,Rzg~Z{Q,S *Y.9щL]yy6.oOfk(" qvh-чBS?,f>վE˿ 8>3*f;{٤6L̵@ds_PyEf7[DHSr[77zo#LFTDzrg[)hjQk$Skb^f6zވlU]W,aQ7Af>Nʷ#"cRߊ] U8c`!a`ItY6kV^)K*!f̖^\p%tbu<$AW1 RF*J.RVViÙV?'hj?$IW}>VKtN".Xyp^Xs]v\wA4ʦ ӥT' ?eچx9gSbbHQ}UL ;A k_J}^ڱY<&'|{SmaYܨWqg\h 9m2>}% ##[N%v#aQ@lO!ۋ m /e+yɻ*pWj=n8|K0A#1仕?$Fܽ)VnV#`ӵfÏ:mlLJWukC+y3Rmb m@{Ŭ6*H6&ߐ0 "{^,2 PW1W<.C)' K q<a8o{u@Nm *- -Ǻj՜R\"džVHOz1k@KËw\pßRqjU?y5p//@?t.SPy!jwGau2RXH1 MۇૠIVtywO^{;{Ay%| UK .n1cUdž EuҾ_V._HȉqZN袘]Ŏʨj?]񵭹^7{jnH1A Z-b=1y(A~?Ҳ'굖k=lYWvT0g>k&lFgxUꂸ9\ҎS4Bb3PG+"<$ynäV9.Nn߰W^|W &O}эJZWRN:9s5/ a:֔ZnO=Mft-Kj;T9V];aVf va̱O<3^ZJb}h6#+/zW^S~1^hzkou(?sSOSi❘XK$ס`1N/Q_J y4'<%IM~#s3Iax>dbIЄ?6˼8>U.cLep{6ߢV1kɯ_cAh6qG.K?~mQtH.C wf+.UhYr(rv^Ϥ`(Ts.90gS̊+2906$oC'u*O*U:{`+Rϳ*H:6k{kc}xlTXBH5'O #pjEm 5Kg 2Ŝ/;_+ 㪿6˝%pd`*fGOգsQZ AۡA岢Z7_<{i62eF$x 6p`BH-6+tTוL-*%=;)E]B!e--H tAwXwJ!PH,omDP41 C#Jo/HR $7|1Ÿ-zctZ"853EQCu0ԅ_}"&ZWahݛO hfEн`6F{&n"ay+fX7'< n;:uK4[ ֪6*e{4hV~)!U!^bG\rOe']ng̡ƷhT_se-vI`<\ú#UF1FH Xn>Yt+O1V̞AOk)(:i !sY: Lb*W#F+ ׽g! JxzxE3#p>ʆK qQW{ayaU~ %:J?dxskXMY4U/+C|p@U@A*grG.*Žd9vB=WR;ex hUAnnե')Oz)za#NήR[hN*{eUa r^9D݊d;ĸ_W+` tDK˘oh $<" a{hv\& rrdvX2Uԧq2>a۪8dka#)rHj/6B8k)Co 7jT7Bsx&ZRI ˾( .>oU8fL+}&TD %t|EiI yn*LlM gTGt6%qy6(z6yk$[=cY Uu1S`p з,aQb=39ߙ4mi߸ 斃]J|7T+ШLfm0DwVTOjM2旍?Cy:wJyJfq( giO6dq'!g][>f]'qvy3ԅ"rkn9Y8t$p {N{clb.L„vQ3xLomn: Q4g!2 p~VDl94zل25pv̘{t6r K١a$2Y^M'Z ¯3p,TWtk!ES~8O^ A񰛮&ޟϗ6#.dl%d࢔Rr:uG20J{ [BvGZasFA`4I-MT6=s[|шW-.;qeRo8F!2pZUhaWnr]lvro0ze$b,άOyM@Kovl>kXY5gUFn'G~(z4M0_vpd}j%BJPD׬ieF<$T +A?󅈢w N<+SgrIڪgxuYw[URXQV 6"kĦb ?W̮0p UI_fޙ9, seGaZ|ԿO3*hܰʺqׁ%YjYtH[/Rkj1Mf_g9C5hdLJa;mF=@ 61H̢pD@fϘ~>,2'v Yev ҨvktgUQ5<)N>agn6lG(N[a m행XmE|9y$J*ҝc~\_DsBCY =7E:]Lk0pVzKQ۩.˫+9zZ=\DamfUpM9=%9n76  ݾ{kە>TtW L3p.b-ďvWHBX1e_>eڄU]ȥfTh5m]2 ȓP=miT ]k.\"u:j!Mߍ\)Eְʨ (ʓ┙ȚVlRi#=ЄDO_|Fd!IyxAx?>ȼl%k# ؐPт_We;;$<倾 m <EQ֋t$g7u xԘSwoE&/cjqˆi#Pss$`KempS@r6]hZ")`4jxTHs8nY 3{Եc %У-jwE С/0:X/C)Aق1/@~*܁&ZY\yF)mSFa}^V Pb~iBeyǞ?9A9MMn.px @嗤5Ba%_"ԇItlE>ٯCi;gC 5Y|&lrVןg E=y>!&]=ٷgkL7NCX=83IFuI!眣ljFC(#Όb~kUO@_L]L a: K {%{S/E G`UihspfY͡P2 !MO " e#(FT{2hi=P "d8Na[ IW݆TX]d;ҦG~Y>Ѧ6}`ȼePB\EX,9yT%#jQr%x/$UNQGYԿ8Nș.0:un4enl0#UA!h&Hw-b xلč5ʡ˼!9xQ٫N(n6yfb7}/177AE6{Gd~* KO՞ro1`fLh/ 2%$% Uh(gK3+e{Nobʥ9$CEKNK({%8t(uN`ѧ%SXV^y疟{.0y<;P+[zmZ?t} 'SAؽǵ y_IH-AV 7w;5T d?M.w썵2Xĕ9ҲCb`vovB¸pai jVNtvւEVC;Y{tIe9_coeHKFڄKӘU" 4a8E"Ejn FA+^ӈJDUnV\\Үxy7LTLi[OНl_9 )KycِOA @?oLMà/TMM ?5:E^O NQU!Wl[m3K3oO)M«9֠!eoM+zs{Wb>WbQ#KU%4VMЫt12]/xE-yzI/}9i9v3%x- `;|UXГk4'8cH nҚKY._Բ |eBPes7jm~t0${W *F B}7J3e[ŒQ-=M#Y ZjNRkLS 0ֹEU$k推?6ћ T!p2-J| 0Ʉ4/ J/SͿT;i٩:ࢸg:&+W/Pv=2"Oj1t=e$7N_;|)l3˅5#'*'qzK}6|oz7ґ[uhχS.t-KE"O@LPi+$EͬQAh͕Q'QWnx┸*bU8}푓T*<#Ew 4ʤ`,ɫ+ .hٌ=D.byݚVȤHR-\cIpk9A;?hF6Sn6ONCܑb";{T߬L f5/eywkvdH*_] <MUGh.V{u>!w"ݺM|v#>0p<# Z,֪6^9ޘW/J"; z~2`c&yې6(w%>E9OOg?Iڐo62"IdžH6^.e8TR|˥. ,Ioϣl(jҡg ;N~|AjdP5I>J 3ɡ%XZHd,V Vє/)\a5-"{[%/!?2H۪c!Nei>y82c&ɎWr 6SZM]L|t@"le3,_vV ^ӑ AыQRZk)ګtxNQC/ڕsW?gHAj}'ifzM {e\U8383Ο&Z!f 0v4{96 5llOS6]ࠇQ:N ^p ]X7Ddſح?]O=&;hcFaK1^ ovShÌKrmW9-FgU3!/cud(5W/G N2ddK.{U)JKW6a!U-hоyFq˩ӆ3vaF>P9~{ɺ)A#KFszGse?л 4wz̮Lߒz8 :g8Bhm(\#BCYmOZK*3 \aOmr|ߖ{J,ͧ2B^¿VC IZvg̱YAԴX]$_ </Ά, s`( r ܹW+9 .)\չ%Gg$ oP@0-3bb:͊Ğ\''"cYDLϹ`[ Tw@pya:ԮRnlqC lE+= 0P_ЯVV"&.YTaޖ~o)Xn28-`(ǩ\!fB{Kz&|Ь[x=Ӷh>ܐ[i4L@՛?Z~Pv%&Z\CK2'. 7:R!uޯz& 'X *2tro/X<$ԅ%:6᤻CѿLRi7jre9OPc1%LJo˘l;ffJ׫6lseG#GW&YClHAu4z6 t}+ҺCyRɪfg6P1~`i$g`ΐAWSރqUCH쏔⼶/Hgr^戝 ʐ )EL3g3ÒeNQ2/LEDa®ٻ%dd*%G(74GL 7p!ic.NAXI-=p ƅsyLMOytWb [ ?||,ooG{dlq?} Ȅ :ޖX:G8fz7m|M$4lt^#p#ԳUTx\ p xSh˽yM @.% h^y[ ~|ۍݖڭ ԅ;^, g vE| z' A/]N*EB>n6qjd/_e~bd;gXv!rh.Y2OFψD \@n<HԄl`r:Da_f=.#.7mJגGCWzԜ-4搻Aqk_rD1A$f-p*GC,:3bzT0~hd%킔^N/(E?S3.hze{W]-%WmyEqV}QaNʇ[Uyr<**ݮ},sCN N7;̦f5OtF4^^@ܨbtֱ|~.۫̿x^U`PPw4>{дd>?b!ݝJrG/v߃PAcmKq4OҪN.|OUjZ" AE_9Ě*d[Ww"O.úhDWu dqpGq K.ur)6x3khqר4Lx["pU&Ƥx?:6"Ь5/¸/%+>,|e*4!RR]||ȚFa)ʲD<4 NE*rb uRquSdƝKivPv?H׍y]ѐRU^aA>eU p,kvF%(PJE~|5+UӪ d{?tX]b+HtuW ̠[^hp|F}gAW@K;^flNesfV4ܖ&vv_&; !`(gӗ uWCN#ê;>rq϶ `?;j8hTZZ@ g+i8 \.pu7jCNIkO 7z[g7=9c=[ׅ4mT"&r׻IN: Q<Tddo9p >U+c򩳖PVi^NpA\ДIY/n-[Yc7xx 4=3ElzC>%  uI1l:VZ/`˷:1\;lI֑ ~bEErJʵ hY`Rn?8wXS*w{Ӡx/ 6Lki<+n]J#Ր@U:"!k dcl_K][S Q,rwKC; i}T7qҙ!6siIE&"ס#s! `o}>rt9Fa j+%W,7B)FQ()/$4<'a]VˊH-0Szt&P9h< K]XxAIs<torAB\ʢD cJqѺi+L*9iUdlf婕JAFIsMF9)Ū 6vRZi>DSs[˃2xE]K cYBw4=s#א"b ['SC2b02\@j 9sDՈ@9"=OoφwnQCeHВ!?ۃ$S*~ipSZfC$j %BC(S;XfE~¬)F66;{,~)Nصav1K(Bx>ĝ!e^Þ&Jg{@9ӵ: h)5wDN /}]iLI]zEGH`'1T@nj?L:zR5dpok@&KYEmZvKtHg/l=L߹RKܤ8nDA JF.ܵ䢼 4VH3#g͇M&"4@piu, ;ݵ (vpii剝<<۬I姏ܰU'~eFj>Hx_>iH@@خˣ K_ lo] C}}eq_(^_J b,jDPut-Obohq/zLڭUGeVU87H6j \}.S)wz?Vr !bZ@!7|0*؂c3yǾbdI򚹴ߪZ):^nԢMW ]Gb"T$48G#{ɆY肗"KAu6|0ϟBc ЂU3Ы߱>Pm"j?Rv4U) D9WqqLRԐX$B|rbһ$(̻2YJSVံg8Y&3\h|Un)0U+Wf\ ><<vvnَw(sO :I,ˑ/qFD.u/+ݧ G]vdMt U=GksSTpѽ)ܞ ,q R?!Kп$HלCP~?(Wܬ֢c~hg@xDtj`E[ȊblN פV'a+w"OI '2}L(آt&ʈX1WvT\[~?`tWAONJ.HPyAnjI"a"2n}Brt]=:ǁJ̻yph͗V*%{ ^+3R~Ugr/# %` ԊGzmaZ1H" @a}c#ԖNU&dBsR#gjѢ@>/;=f?W8,=]6tsYՉKŷwd xtwx⼌8Ȥw˜ҞtG/_- }:ۨ֬8uzOsv &A%)Y !hF8:9A$` ni\ς2C]q?-te+RŐ ޔld.:BS|U\>˦$LS=0q72J+N$f5Z{A$6,d4fx^WKgwZNۧ Cjᣠ@Bc_5O[†~[Vʜl~]DX.U5]U @:\noD˽?3%j d w$: |擲C4y6KGᔆ%G?{[o.[Q{¼{m7L~Ѫ #:N)eqgj]xiMgyrDP[K8Y-!HwJ2N\ &i$:x AfF\}R_J|/uZjIi=+޲&]rM ZUJK%4,#4.3'.G緉=IIQ0 57"h,*+>f/UKw p`TX\|IQBhl){gqZR2Mߦ%p5D$׌$' c8ϝ~ڿR+kD -o"x]$-XFNwƒGy6 lQY'eV(Vf _!"؃Hq}Gu/˪;r;^ Mao4FI)[8|+H2U7=HT0PG;`.$&]ԥPE1C ZkQ`NױM1zqQp{6f% sZ(g!*;5GƙB d y߉8O($Cjeɍ:[yYf{Qo-qPn<8j] 0QX+zAuf ؊!y-~4"x#I۹w1H!~Hy.dL""Ct(oT4ҔOvk @{@wG%d[7*Vns[0'PXg5-U3Hи(풨x3O<52&PS')#9S(#eggakŶ|҅Mulkq0w**PfiuLkOM /9ge3ѳߩQluMâ *Lu XȹUqU'x:Xy ҫTK@AaӹF>9/v[VWxYOFv7yqe[=M> LNǦ$#H0rw-os y*D3RI7h߫f\^Ky f+Pe=z)d* Nn%i F%^6x"WJLʁa{"?d}kuda|_0l 鲜yxzk . *Cھ!Br/8R"t.1Cx$>b%By2 &+AR,v7Ҹ-ئ:)7ѕxD=rU9ldM~x 姡# nJdjU4aV1骊ǶoGY^UܵMuTQ*[HJߓ =$<{C^X,*.#oCQd ڴ`2xB 5Ը)j-_yOWrZ&3䯤JzZ[+{q6Zp2.6)H vliͭR]x*g.RO5)<*ʪY*=U<^l5}j7 a#\&ybFB0a 9^ۢZ1]^7#(PfM$$LɡY)aeմ%*1ڨ-'PUɽ_ѵ|]1dP|{Xu{q?xGi5H%jyʂ݊{uqB'%R;PrjᴭxZl1&[hL'tVv~U[pGRz5 t߀e >HqGxVzit}ӶE 0;>M#ƿŌJjzҎ2b3 Vޘ~o#g[PO5gTu9s>ΦƨAFO~NJmL֩"Hje/d$G5-A4BOy_¤dc:d\W|"3>Z[CW1b:#X,8._[IlH0 mG~Cq{ zg $_׊9h6qƉyNvb%k1Ģ1w9EoB,\56LjQٮk˖ߗ0*?sZBl2^ZRau3w*d8nK7 wELkͣ@~#J9ŮP1[!e9˧Q8SŎN,,%Ue}27@^?;a3LN5=fYWբTÂ)UIM`諹\ Oyn.* 4YyI%T-ga*At؋l=$KKY5)l*e*0(>6*R Kco/BlpvpS">j"WcPp ГjH4yAu"?&a9cjr[Ѡpw~O< zXgJUl}8IrNsϢ*~sQ+AO.$Z+pGT~Y{,WUXL1,{׀=䎅yY?ޕ{?)syaľlEpSsL-'<.W!"щG|5ݻn{ҬcgR>@b7g\<@RCkIK̓Mkθ͸B~!ƨ"FwɈ>=nW=@Aӗ1h476 "aAWuDw9λvw]I?[u۴Pu,}"Rucm~ZoT{SAKI;xD̑qOW2sB#45_(D:+*\2,W #ox!t!{(s6GJ +:}F;ĵIqfwE5;>v> K?0E¸Eo-M,b p1T6wwϫkLדdԘ5gA}uv64.- vdD8on5;"&,IkUsi)} b"28GΜin0Ra؍ WU6h5T w uY;zz~=>I]-c,[n S"Џ"loH?葓O,w!VIP$C$(9szF-0#kChsJyivň&O[eL4;v4“twbDS}VQ}ɠ[̃>J֫eI M ~حIޝQ̢l1:6& BKxcEVf@k^%FH{@`48[}hA 3xv3ۂ LC'츰(5) XRaI . yEWB*j! sw+!"E<` S( =j mNj5pEb*CxB7%q#GS>3zlX&'IV1VM}8ାHB^` 4|pxqJ_ KUT*VmhY|JA,hC*)NCseh85fYN% X);dw}bqo dvZ?bS8AJmGĬ( 9N\c@Ѐ d*_QkSsM P/ltc"Ō))_,gqCoJ}[nM cwҁ1dhmjC[H3؆c:>,ߴxg7AFjS_YJyDŲ>`/ v"|Pp/DP6GzrEf͛S7}5Rwt͌qNKV4 ψ>ut2CD<)Whα')tJ DtIGg 1!j5IFIŌfԬ>?`1U?Xq G(4YZ<so1+SC›R؆c擘G?wb;=}Z$5+R=ݻiyʥ6GE@kQ\LMؼp}d;pEXLٸoo%;kg6}2njM)kbsu7UL-QCnQR͓h0$n&-"ɶuF} A՗(񻎮|Ք<;cu1Onګfu!Gjb3rFhq+V$FS&k~} H 1pI7RH&$HU(Dۭh5K,~65g3mkh[YN]EE Ʌb-,WM.BQU3lmaYȄҩ>**88XLibQm}QDžp7 *.Pj!V6QNIcD efϩ1yĆgAtiƲc{\2 aY`$n=aqXCqm阿i$56?AA).zp#LUM<{L|HUίi>}[dee(KHAh1Bi17G`orL7γw8/SŢtER>؟ @qa<3Xg JU=yь#X$GUN;t_+xsĮwcli5fC9̷rvB7k<,Lw1J4<|`OOWZ|D!0gGeW"dYjtUL胢'˟}E@eY !Cqش gw2/ DO on~WʟN>27P|YU147J ^ł1`DW}?wCc1⫁Q2mrm0cS9 cfInp zN$1T3$3)$: M:OBjoY2 <>@o{$v̰TC[I[ o[Y1sG"L #&:!pLU݂0(# LTK]{Y/ Vr|S;ߢq\; ̈;w'ֵw8UJmǪKAXc哿޹ƗG4wx"ȟWk Q ӿI,.]QFl$!~(kĿ(N؁)Ҳ]E; E9!XH ID(mxh]K`3^I̐e?mKCgԇ `G?*^j~ b]b.߬("l,δ\Nѱ_: Oҗe)z>LcXʏٙ 6]׉D5[:D (d%4zc6ra^h /fY/_J#(ůDݱ'^wD(uۖCrAblkp\)jFBXΎϰ.Ӣb5/t="V+L8[`syqF|E)% %1wT<+c$1U/ B]xw,3zl&iZBjECyj6cS d=ߗx x0]dU+kwӎg}42+M-ձbH|Nx`bo#h^w.ͨPzD ֲӄ^{J_"51|&G 7ۡ VtlV Hl_m/{MZEg z]B H>CɕZu P+桂v(܋u + >JRf4F62Vứܻ>Yx,d(w2{wq 蜉sbBzÆveDKژWNB &R!`܂(`Vx$b|_U KWB%O*c2 O{tMI_Мn@5W\@]3cn JhJDwP%DvWk4sH(Y鸩 gsU.;F т!Z̞19*uAgPOJu =:n{dD%h>*}V%w,4-A+,bT񣣏MlXlŏ Dа‚AZ.մ=:EB)`dH(cn'oA if0H (GߜDgI譽AI8nwlb,Ga]c6Bk) ó2u /OXXMMw_hEgw V'fVHߥ͍S7SU3WbhtC:Os鐽"kҾ8~P k'*)O!\y;OV{&@١hh)y:.!J_ø \:Td?Ds!hMM41AɋBI8gѮ\3tꙮ$C3c[:60^W7;6d2 `  GKn"8"7L=M CloYl-H4͐#N:"c3\iLw r_Up#yGiv-;w,{d`RITa"M-ni ʇ ؠi:+!̷&UQnq5`4XGNtoUz>]k{֬mbh8f0:#}v(]7 -X`[7)Q"$DJ ex6m.@2qrM~hRimT`44/f/qT ?vqJ}>HbQ! j@ + Nk.sv^ $J\v7|`(@x^A]6B@ }o sU\JEf/_$Iwdl}D B}фbSVW-H9!5Pb=ޠ(t̙~Jв͝&bhQ8R,ic3-ߔ(hY$~Tyeq-zS)d-/N{Tꮴ5$wQ=v|wh8m}-C[(H{*9Ȱ1=8Eϗͅ=?_5vr}ۜZ< aE$z#S2VFS3a+4o\/JeJw!K1ME_ V3dK/ܸc/WiELkq~7= z%j?_fLVWjNh|^HP7q(x VSlBfD$4!8%#<94WjrF՛= @[uXDR:WuVJqt+=9 "4C৹8ּ;'\iY;G-bXh In6=֐8j/@ܠ9Mr6҂8fC/9ms4N mGb$-LeFC7Vw7_T'X vk㍆蕲|%v䐬A#s 91T~'\S0i*BӬEZ}H,6Y&k@P[Kf;;g_,y (9y].ZȢhy?m,pRGdoן/BX9}rV_"=z&&/j+Qu]`̻ ǫ7 & V)oծj6/[E71%Ny)Ӝ*Is>egU 8.5gtm#;BhZa20~ 6^6{%bb~fq5(f#rw!Dg54.tݤݐ.k&4ppv,j#aSo! . >'rT@>j<0O$4:t;XO-^ٷkS=ikMWum6TI6J8qСpo#gj[%>6V]UTDPQ_)ď45k;3h@I~5vWv{~V݂*s,Reʂtwwvn|EegqQ8'#cƗx/>ZjCo^cϲ7a:}R=:X|ܸy,w5N:v ,]X]'t `8Ba&eA0ά݇Zb8" 9eCkKh (D `:LsZImFwy*n%>gaQwՆ3r"i/f!i6MN9 JlDɌ'̭hklS%%-qp vVh60Ne\G?&8E~!$H+H*>“?)gHp|`]X> 0tPH9M&E&/=BF4 p NQr3<0m-gLY/imXՄ0)1B X.DԌq\&@U#3EjwD&m7nzx1f'a U?q/Ƒ7oΜB)mSb4qjNͳE!95y쐗hx;fdc`an3%޲p;/)Kdf"rc }q1Yӕ Cѽ/KA^84 PV:RjO~ӝ1yFk=Ӗ7i9aZN6G D:R#'4V6vX9>(ǀQ-Rj]2b7B' F J(1p1qw:|ح #E!\re5Xq1> Qߛwԉ]k+=GQz7iקbU(ԆZ:GղzR㓤ȻHTݜq8xyItT+Q&FӜ,.7z%r S{|(r x<]. # \o(Lў,(_J}( JPcʃB5Y;v,\Tgb>Moyk"KI>h5% '.29B0"ҥ]~-TW)0RybtbSw-'VMkEcwƐEЏvEOX(S Ta2'D8euL#mE!fM-T_ PV8/6B R%Mױ,woAҝc)SP+F "IShB5V*[gqlMTQPcO\viUl?y`eRQ~נ٢C,c 8}QۼÊ0pyzYw L"osswO[ӗsHN07wE9/BxzCj 99TBN&!Pؒ*+ɇf (hDy_S+"JyN#%.0Hb=;z{< 43pƉ2=W}0 wL=t!j hw l.uQO:f0O6|9WvXE@|4oQYёߣu+u7S@ԛ7 'U3ҺTѾFbad\kcH|uڳGxMHY AjLozz!(%1=O5<_d"-PL7< /F5{>]4 Ȓ X "iO<e bu[fpp OSG^]FPIw7N {-1ٴؠJ7OobuN^r:9sD:)C(ֵ65w_^ 8iS )}S*QBT+Kۊtjh5"nF u'kcbIuo8heNi? Nek˕Z/hyl3譹 a㫟)3ؽoYޛ3 qE-㟮ZPvX2Yڱ=r|1Qޗ* Ekv"y09\=gn1W+'#2o f!`g̯nZWCRwfrt ՛] …S^5S$G٤Ȼڿ|逓j+N~<:=Po Vr=Pw&":Jލ hC7@w'^w4cA:b8D}N(KԵUbPBMi[:eۮK7޿Ch EY.g޽}hۦ0lPl܉l/=1,ShBCo/4'u/)Yht"*_O-k9ñᙿIz҇ke@NCUMNKMOWܘ~3L7S1wA爎"J'w3jWi/]EFBghu2I[ˉ[/ԛ>TE5ax 10Xw,f͵>%GFY4+"~9e|TD+fua^`'z[s_'*p"jGVP269[Ew:&]Ƥpc"L!8~qES?$Lwr#a/*+z/5 ,(m&^,N>X5ި$+:<' tׂE|FIg7)=6mAKTaB )O j_+(5"%*HپH<&dJܖD/]&6ޑ7VeEP[\]&g2K~0ؕϋt|'MXRV[{n%N!yTC-ףO P4jtpȾb.0,2Y%NI]Q&N^0<,Vt ~DMPzΆϟpӪ9 :rqmGp. 2ĢëI`-8?MtS^P;Cbq&P[ifIw]?Be}Ϋf /Tn'lY)4<+M(=i$\c  /KFa2hۗ90-G`i%׹o]RmmlO[ͶH?NeH5(ðB%DQ% &X@S?pʩjU| s fc:YbHm0m.6k_i$`Ē8@N-oaqsCfːe2BOgbV`>Q=aM3zm M?*eoeܐ='p`:Q}d"w/6A⏬%[ /:?n\r5gyl+ [l ;&߆jIѲt@`oB3@8xGlIi{\:|YUMп:vJ#BJt"7w[CMc>s:D݄)>)qϚcc( 0LP\B3sX5=Z) _:ku8>=Y8,sƛ=d1WLx>WWn)@e2PͶmM0qo5ZIBkЈY|9{no3VT6_tTIG#"Bׁ y:* ҟL"OKQ+#~_vcS@TqÊU +z4u' və8:q~²&{BhkNp1N;}/tY4:nc9E iQطжqE!a#) cQ)kc)mDQ ~sf`t_H%#F+c(Sa tGS4@ۉ!b0$c2@rr 1 F-b8K[_{$+Lٞ IYpNq7E]h?u vNE5c)yvJi`#DWu]4,Z|Wn%Lh=([7ۿn CJNI㶽hXT <2ihKG m^&Iݛ1%݁He2SbIpuh/ _9 Syf~6?2}~nhJu"r[vrQz!ʘ97RfnV#tT.;yh>2U- HWX2p) XGB y@X f yH9}\e XjR4mfpƾ=Q{Q!_$j",' ]$fu(WT DǪ7ɕШ|s[%D,%sPȠb2 ^!OL+}۪y\j1 g7;O!eZ:;['Q? !^&-NcK˖,AUEN_ l rhGrKDs;¼+7s \u/9/E<^-,f#Y+;K%B~K-!DcP{ίdTxz&,Bޙmn^.8v39e46'韺Bː .Mv?Vǰ!H廙P#e Bt55C(~f92#Q7KQB 2U la z1]OW>S33V5; irsP] y_,a`:uȼ/^qsX,WJs*߁ȑßGÒIUtwOaT Pz_w> .t&j5ܘSG2†%i 'D״ZGG<~Y$Rbrb/-}-8#f#ҪŠVjEпҺ Xꔖ}4<$nD2VK~C(!Y4Io/vmtG Y+pl*9D&KDtmo3"ao xlU>9㘷 %Yr3bzd$WYx$pfw4;@Y, RuL{?q YQ&'!\udT aSBjbK[Bcļgy:WJ6=/g7*/Uk c(,YPnƍCjzLMH3s{2b@*6C$arZ rs#Gӹ]Ϊ8ܧJvAYءLMi=gDg9L>s?\=WlrW#]Ƈ!ȏ9&ǰ )be!yKׂv`j:0]zT'ںgٵ{m\@hχg \Ρ1{aLzro+{C.)7dPLRܻs)ye8wCs8E>:(f .o ~癵w&/.mk#Oۇ&˜gVM$ҳ*KMh$ֳ` B MMXq(* ,F- a/`ަ z) 5W`wE -HM S)d鴈&]%Sja(>|2IVmSӰ{ MS,v2')= E0x"Z];zo~qTyN+t̍8(IT~ %*Fx`9;ӑv'9\:Sgb&C&q7HfK?VL@Y2=L7^6>rJLNP7[GbPu7ȇ'rA!z\ <\ב?,`LMVWEK Mֿ[ȃfsc#6"%;@{Fc?̱Vo Q) 7dӲW$aGf\cc;obtåch''vq i3Vi{٤ $cXⅡiBZg{Q%Yt?FOnq*دX-7TۯCJ oV"^cWc!W hm͕z(fo(%_k?7M ?n%܇@ w mypi䜎1?uRvj2ǃVi콽.a{$j;DocT 3Ƙ}1O]XV%4_s Pjdb6.01p P܎b\y95uѷ?P]Z[N+1{fNƄ64Ҹ\ߐ7{! yYZÓYQAbѴl<#VU3.~*N{RDo.$7 )??C࣡h^aL|돤SMO-Ǵ 8qӂچQj&FHY%n@jṃGrbLl%-!(#`Wq%4.ܴ8n[3+ u))%1)g\gWЊfr>).dš01σ !S+U?%׳2zzAl14JGn@K)=ȱxA*o@M0_iQWnDh4BmT~G*WHQ THftUNޞ 0Xipni0d_39zQ@m㞵2Y:;^z W*zXi>y %]?zL>Yu)6-젬5sggІ|dqMcwO-,\~޴-QB,u@GuNU{^tWa:?*zEl9Hqޜ(|:c9+|yIpM{C ߱;D}^TeKR!TtFllZ_uŇHʛ j"sï%Uk3{i6SmX*oْ bu4ז W/4E!&~/@S䂝Dx;$svPT& 9BڦٮZ+xqD Gl` @'2tMq~miJ3Ѣ'o\s;s#ZK[‚LML!ߓum6ȷ Ϩ'F=^?ub׾?PҐRw`$2F4w}bBj_1V?WeT_qofbkQit I)L;  =VwԮJӃhU'N5}.eC9`'@+s*g7K9t#Sz0{RaӌF/ްn( +a(fvc>H@k>27G)W W9ȔV?vFMa '"ߠZeڸ)A?'T+AKŐ#hC`P>= ʯĔjMHkexq~~SKu7ɟ5[RX&GM403$v 6_ϴFs6@?r28>@CikG )'.;`=Z>9M-&wʫx}`KDpji;HE@NJAP[U8I1r*v:}po &tDZ U[b4o(FFs3]~x/Zm{QK$:o8 qDDeo{/TAJk/#I-6̈X H4p-6a_,}rh'ԕ+ W+|~Z?7bپE`4l0Kƒf\'ҔD3ՕT k*\qp,ik[f1%"Ev4Oj|s`~yv1WH ?hq$,ZLf(=zN*}ýzYjG'Go[!ѿFI[!Xyu4 5;"$ĩظ8hճic/a0]RBTiͪɇ; N=L{n.biWo0/tHOeg?D8 .Z {y4=O؄3hbV XYXOvRzFEP sHNŜ&5CTZq֔HCswqL31o7s> A1M'1qپ2t$7jD;sߗdDWL܏hV҃ dٱ{ƸaJ/7 cM0b:ޖuߙ`]܌UzF<60_C HsI҇*0zE1??dz+ޒ8WU`()WF S5޺L{ 謰ݙg|jNm=!]i2q+'&}6L>]=RJM^ jԗ6lͩ2 f- "7Vr2% h6l-\?ÚceYy^ x)*UjX`Wk<h-_Ԛn : {`;~tMj]𶙓NVܲȻtYi+17 }ng5FhvH nQ໗J=P-Jn?[eNBjպE_qF?햚y= J9)>g9$2ziD-h] cV5Inva.i0;GRwsaR3þ|D*|=?Eu]lfbDI]1t#JVgF.@PNd}-P带[9 ҙ%*I?eg.}Q~ؓDIoJl,"cSLn'֦>tjꡏ2:\fT\^B;؍6rzH%9|}ɞ\؉,D zƙA֞!ȀeS:?~}ҹE={U֋3}I:pM 'plQ:T qgUo񞏍J@τ;KN= {,/ĉē{仄EFfn ]bX}b2k8()2 6BQȹ?XH~z:٘;KZ:`}[ci lsuMf+544V,ˀ)o@vYl0EⓡGɟ'R7 d@s]/x1_{nTs*ԤD(K<xErY|ޟ;ht/Ël5y˫K? NЁ3R'BG*tOg3T ^i;GcMcӯ`a9zRFAUՇ|̅ -/oftMe|GyJlY॓]!|J^eϛp(OK u@ F!]ا6/RlK#['Mw69S^1$MQ<33>7dty;ӎ2Ꭿn1:FvAïĐHeX;dӴ3]`Ez:ݖ;!R`_] lBݥR7BwϺ(ʭ5/QYIxj1b9J5s>wCQQF7UADd0.C N2.G^Imy ~d:zF}p|]O0@~xkw*WK8l3,xG}Kw@ow%{4_;sp mD04 1=?oXCq0YJ%6G#&nwQ[FV~b ,ZR?5!ס:֋H Bo2WdS|oV{Ã3whYpyI̢7V8tLRRrzm[_oI n(ʚuҚ7LFu v,b]JҁBDQtKEI%D^r`X[ƴH1rP5-xYt<1d>M"fk 61;D{7SvlV\Tv^6m=~yS|B.i{ uW38ɯrjjω/Yt0u|~zVvqjxrIә00*Ps֋ڠo/Cfa;3;tw>C Oj@jDq+(Z:Z;(п~=XnCZ.x1*G'D=U]^&Tgnc;C6[ ߞMX$*h %/8ІA~9ɮ[Bvg'F:tx0,C.`+t!*,_gF9+]eYϩ }hvދ&&֗6ПWxץ0_(1"l 'Mr9OF=,9i3%6C,2/nA|WH/}3 Qe*j0D%yZUvZz3C; S@R5OqftIZshȖkǓ[=ڡpE 3'G04ZHn?0ri[#BRu7a`qyBs Mݮd5'!l|eY85Э C xg7K8V)G+^Я,3ɎYy`Rα<V_# 將1MQ22YӃۣIރ6up}uΈ[籂D"H4Jۼ-K²szX}ںtjVZGRtѿkU:a{>> \T8+{ZtjLgdƙ)U*,ag;'a")LNF8zcJW?AN$ #$ĝ`R>D^k3["Tt?3+Sڍ7&ƞ ub jq3O Zޭ+sh~`cӾweC @ o̾E+' :VS%6l%P&%z[Q隖K<˶ /D;tuIwQ@'X^/vё|QWtL!t5K9Jkb1Jq\&?ߍ8q(4_f?ϙ\ vj/\BEsK3~T@^ľG}$|l#*ﳛ"M[՟VӦi;_F2*''%ti2,S-j[GxelxRgjE s#oh5nH 'uzlz-e/kg~b[Y51t>'6S0畺O#;d+x9ذ೵s!QHth߶*\d9=11xcB%vRAM#0%kǹoVv 0J_-Lpك%} %,K&&*?EXk2Zi"j +_:^4_p2v:շh{h(q Y_֡KHvꃔ޺o0eaG-Rt8MA ښmeAo~u' &O"9,+G|dpx!%;wܜ7;p)a8c`Ŏ'C#J[߿ ma!4#oz%"]tֵ~gr&pT2#+C^uDrV-S ))JmNl|(C R(mU0n-b^SD#n:K뚅m~ˊGQR2["o5 'z7CJD5 wW}la৤c3<~I7`5(_a7L7L(61o&A'suۭpBqmstfCeNq10=|U:́D~$pc?$xW,F΍(S@GXȐ='s"46+鰦!0MW]n1JmsX.Ä \Y#rYqJI2C9f!jJL{Y Ne+zyGLl3N? ߣ9[+ܭ :9t:0.L=-MQWQB!i4j*P}Y}$ȍIƧ P˟ ɑP%َ&v.ycVY_2w-U$okys:y=)Uh4/Z C`ml ha ak.~W?[DsڶO:^>ҌРcf0XK8 g%) gl.) smpSΏWI1H:dsԄը`$CCZOEd؊]ۿRt!/c|n!?3@ߏH+ĥv$_W|a>Rv(CkG L4u"&^~ϽMu&4mt ;pMuuM-E `暑uѷ6r[0kbΫ;>L9A_9I^+\:pѫmN䰿~{GA)42(96ӻp?֤KPkwzUpR$?fUyd=:Hs05Phf·Co.ߞ1[w)eh PJ]o=kg0=H= _Ȑ>vg|iD"kLJi-+h8!E,%ş;G*s3yœPH | qzϢ^E!Fwx_GA3jХihQbnh ȥ nxw_J 1mk9 EwL![R\dgQ[j8^ Z37$hO /PkXAj.$f>ǛslܸuH[#y &5Nm\j-ѫYCǎLn:lA,96ɼ4^Wg Ddq"Ru1dĹzіz4rQ]muwY I\c BGcP\pz]!|T0lu 4Ds;ݕ[{p 8SU7Vxzz&)դ hĎ2Q SQ1&v) x=Z*?'y "k%CVI VŽ)zӊ˚G,6D?LMkKJr <ם}) `jxadTsrk;Q9͇a@S5ϸ4+>U7 ߛ6xAȿ Rn+[AteٙV;~KX~Z u'(z\^h*e[*ܾPsMf5X0ʂ-"VVڡC !vX/nl!pүa؞NgB#OV7 Dza*l].UD|B|͘1] :i 1n9@L4ns%/Va::!9ʝ[ {mdOP{f(hqE=0xCupXX! U!UC[ѥy"L&t~|!e3i}hcm)߭JcrâBNJ 9 8+*]Y枌u= 4X s<.yWtFM&,?FϵS3<,9.wAO=}Ɔx\tiy~@04uO{2+ 81mmoISm2&"),| 3^]Q04Xp]sz]- d[J+ LGA1 a2w|1>.f DeKdPkIV b*%Y&'e ?ZJ\:~?tfBPJ2̔ S7i+ϣ4(}|ksw \S oAl8ftJFeQElgHQͿE" Έ(ck3Ru;TޢP*;, P;`9 S?}Ah<6DΞ ˶E/pscދ=7xOfś5s wIZz!H MIVK\" ˦kG @ՎV0螼Y;65mVu]e^xAorj~4Y` *~rLv}5VU|6W'G2a/F!Њ$HF3.Yq2!fƩXL##|{>[_ :`y@>5Mm%'C1W; ;{IREr !: UxB 5 d<^{=> d!n^ SA\9=u2nA|\1h38uJBFq<kѓ'V>o-7,uu\ &J$#Қ|e <8H1G0q7N5[O qxJEɚVErzRo2tmMH;aTpW$A8d&6C;`Sܢ²ybU+fYJ%1 i"3YQÚUt4Ũ$ x`~L(xCbc}ۭsL- "Do# ٜc3ڲkIWjoT&@*Zbr#2'C>t>6mdB6<NF*Js"BM%F (4"*3?NY|(čTVesӳ#3Q{rz%0v[t!!F(ΪM!蘘z55op[@Hv\uʁ|{@_7ʢAo4{QhwĀLZ$"IfݴDDcHAvm!6_߇?*= `]² 8??^T>Ds"LcEKNY_I4-z,MOA|2mQΩ?7?D"3-IEuYܙ0jKJJ_%t-߮?;Yinm1_T0/ Ya1XTYX%ȵ9ռ |59< IN[QuLl(,gEnjՙu+Vz Bϲzjv8Kqx)xsnbluW,EČ4{3 cVl'E?넌MU?wpVӄAIiUdDsrlvײR$(ElG EqOajճZ3 v/L!~o^E|&i` >%3TUJo"||{PPS:'R6*[Ģ2"Ȅ7wƏW גpdV +jL8*QrK14{Hޡ/l<˄-x$Y5lL}/ 6om( P`7:_dQߏ*f3w“ۦ'6MwdY r-7ZZZˁ:n<|ӊs $>b>A&1 3Kc^5>!Alٺ_B,ΐPT1v4z; #LWWarde֪&"Vj|Lc2Y_ڇ<,* :?je"&s^ m\ ^`^wqEwḁz֩@m7Ӷr\1`>QP$OZ$N)Gz.- ⛫V)l3<0^|ZS?m@ (qTN F-XץRXlPI?+?Z|~nts=,)ؔs44gѳʸ.. Vn/38ۧV.h< S8v**/"Ux@,iUh+e?Ziۨ%v ϫHV4E'$Z$I(O[?h:ԧfX ûv!q2X/O[Ú!n5`O fEl{T {3]?xM !8z̙aO٤k,+JAQT |T<(PM |Kf{֡ʰ]ʐdCs΁_c"-L-o𵃉$e2ޣ%- [`4wRJ?U%.;^P΢ uP|ജPZQ[TZĘI}ƬYC^|0 d #W됹ׄLʛ(Q6w}S3ƣtGBQbLrUбo_TTJ-|v?g(_3  ) *9;\~4Lv!2E ]hEj`0א4.IT~$Rξ.CM_;X#zp-CCd]L] ^F4f}A1<=C,Pp6v w0d~J,@O͇ùQfpVoe D6XQoǘc([ R%Ĉ+8y4m"X+*ϒ)B$"4C88P3^REbj¼t3\NOfcܳbN&SL d\iv:06'YLj^,2ًD]N@G6vB=.}Ϯ 5/#_H84!,꯲bBvɽ"؎Ql#p/v+'AE`_ %[x&\d 7@=AUxrT>ǑqdM:W"0-UJς&jY_R$ ' ( 48d:v/o|MWğjf7$|h9w+[>.ԅlrjR%Z-8+A %5Ip|aІܢO0Taqc/ Sd/7ZyoͰ%- (V܏-^+5@2Mj󥡌5SD0\<ɨ*\~턥~yj@)-$/T::E}5*^Y`Ý*a8@$\sfW\? 5CՎsE_ .V^týI3o!xf2̈́VeC 2=*߆49O!X{1vg½Ԡq0'^Lsn lCA9^xom DRc!1wA!a}hFFF"1]7.p.ك'R|O{rclwjdm0d$zځcq*MsҊXyœ>Tb܂l <*"_ҚP}$kzzZSNרwmO6>|l%_l[nĨTm;B;z{q6B ͨP+&Odr,13ގf]3dw5}8q!AG!%x@m]y5/+ yGEb6W'& #!~Xд#X1SyHAdE A#N}lM00%ǖioN U}/v +oeΒ.[P/Xo2BVN]뺋̋r/D2#y⼏ HM~L4l!#3gG.4`:uy?Ԙ]ps>Yy02y:Yj^/tÞ.|TH!iQPq|&RRތOrȝ\,+K_CXRdV)nf4Y)D@so)q/!)H c}ǚÏ9NˀۓcDJ:kRs7Vzm ]Sdub{0`kg=!DZR -M28]NjSC2Kܳ=xy+h9X^6n|$V&Gv2lRc> /M d2"}qf"t {YF&d4ZaKۡ-I gz?34Bq&-Ke_ .{Ha$`?ѓ⮥"lh$F0KAeݎVt|êxCs]QJ.:8jXz({'J?H8nf˄#_}Wi9 7cd;ݰx%٦ZֲG  u&+aXpj ļFIW1iy=nk]Mނ%`L@)KHԹC+:JZ>ꐔB k)hXhгer+< CknFDED.A?}K=[':\>-Q$d{]X 5xw4ʷB;:!_\Κ"욷d`񥱘T6_M$'M:%D |Hk5=xL#Ź.8W)ېRrh 4۰߀ ZEV`~lQ: 4 ϟGp?y >Ci,ZfT a_5sRH4p#O7BV<S_#mic1sNBd GB #sW`'4yC"4ɕblwm-w,!nQd'6GG鼷@l9{c:MuRlh{>}^T@%NUY}Hܨp|nfxUH:oIѕ%Wg<ʠ QstsrPI&.95/kSE\$>薄c^y!p: x5.O)#{iB#DeӿTF2=]V{|F]uqr`SG?4ƞS;Ǣ[eLu g$YXc U{,<1 S(=3?$4_y7& $+(^0_Uݒ-_&VDۍ@ T՛8~Ul屁W|K/z֦dQeIc"G#M-rP^A{Ȼ>U48")wcjE,"0F+ߪG#Ya 'zn"#se_FT-|+XG<9nlmc1pve*|b*V Wx 5L;hLKR5A[v.÷\`pҳ<>b//y}9ءmN߅tY^zk OՉjd| 뗀Y=6kp]0l4ڸ2Iց~p QH,tXYEUB%'9Ќd?03Fm9 ^#4XP&YgmNv1t9w ~-`2q<7n@cM{G#]ӵN&zP19 ?uo ~9 9H}^Ѹ̐֨ψ,;E =~u+ݵ`-.it@}*Ig]i?g]\BUQ25@! ·hNKP:S>un8KO!68bydžFl(Rb3#4^*% o䠫kmF؈Y$Ր;vkl/ 5_(!$LtQLaNe>fn+ʣez/t>Vwd[qd7-X~v-r~fsC"r @k+ ՜fDx0tah&Z:hrh +G Fs ݳ0Kyaf.Oިyj\rG|-Ah8z!fAތXVYRk\nzK巉TbBtLLscY/Mʻr:嚋 і_* [Q~'<ͨd?Ȅ"^ܴJrZ}TTtDuG?ay6⋸4{Ffxu as@" NuQꐮy v(3 x30zdfiۑFo9K, שl'qaam9 ַ3'vvg;̮S1dڰe;<珺8@bAKq p($h\pSjQ!i c Dgz]{!'mRl=P<{ڶ1ng5㺲(YzϕOk~ƕVC< cq{I¦,/os&ߏ\YRS*R>6?dSg1E@hoߋWm x.="-gtѕ`†\OBl+(J{CւN%/g/9e2 SDrea &j9Zm94q F 蚜j Xګ)|t@#TY1XЫcޢ7Ì ݒ Qe+nƌ>ZJ%"O5kv㨯*EYv'F?y7$ДU~0]4 wy=…a :<ՄP&[`.5dHIQoLG:=UPe6FT}qCcY46x9S׃]+4԰A<%0)[s~}q<[ 'SP284 V%~oSO[Yܪ{ ;n/Cb*L&Yƴ:{bc<6}%{'uL3 ̕g.9As]PWu 9U":^,q?_~!9Mo҃k26Uln1:1m5d(w|ո]с/a9N_ꏮrV|fƤ||xƚoNxtR̰/OOkQ9Ğӝ/`eS ^h谲 9eNl6<t䜌zeZx )հ wnRO%?şX7b>z|LErGE!޲hm]5 FS"#bt_8vY=BU"GEހ2fEΛb_ި\6 ~-`^*(×JVZI+!SsﳝIKn_߫ s,iNTHiiQbɽXu2'ۯL(ۥ4N>ߐzfudQL.ySqA8^,GTXHIth3XBa~I64=y9F %#l:RB?=2XwO|qWXāM ҡ&>ǧk4$Mڨz@_x% ƄA&5S6W2$1ƹ^–a5 5h=HAjB5m6F!M?4O0,.o!8Pug M^K-GQXЙP9 얠;^N9RWp#"#~k:rs겢Ta!ej%}٬sրY0֡EՑ̱Ж?ɼGn/h5s>4b4̽UtTGvS5 ]Z.nc&Mwf~)i,H`TA4 R5@W c8mfE!X{qI&gK-Ա "sܿb6ۄZ(1 iFoNe?e;MtS2b٦Ca-Ǽh?>ۿω{ r`A2ݼ`?E)U"=EKD_]ULx8v캲nJJl}.KZ(9e7K//}+֦%#E=9Tsf.Jn-ó6WP6gD;Sz#g *+'20 ~ G~@%: n;[ lпl+ C"vl5@W^X L,Wbבc(7wEl\WIs͔b6F8\E, ZqѻE=mc7Tbn[O'tm V)ݝH-l(c^G(ϕ:Tu46Ln%jh6X(򍽥E+ěye(1Y~KtԣIO|=u:#l .ͱvUf$zmw#OeKJƄ\CYU5 @*W R2arBK [` Z+mH nZkF{ UgjS`94RYIT[{ u!d28ۨ [ 5t E`QãQ~^'muBr4&1t .E2->UTW0زFm-3g-n.JJ. oQd$m^BB|nP֋}vM3tN(fFtr0"H YŐWbD}X“$,f:.DGL!$F 2׹?mQ0;'ZNhf-~xaPÍ/t`:;RbN"3kݪTl'熰q<ڗqP"'HnK8k)26bA狍LfM3"O< @{KP{$Y 2gA#Wpt;P8G]\)K!f>.C[VAQL3,ČCk nwO.:ˏ/;_Tx0JM&ӲWt8NZ 3qvNG58}}H`H2TT'x=z^=0pbk=V9@lg{K RocJÿ`A=e~.KL- f'M2xYa!gН xam+g{ 3NdlNjbwcEcq1ƪɏٌؚ'f;AcYdRV*bZv\N6'noi1QrU`x\&]ϫ\BUlS3S ^V Ci%i;s]$\bL_n`䯪E&ba l2U:c!k6 * Nw䑬Z-LNyI F3Ɉ 4hf8m3ճζJ(hМT6悢g\BH-)gC<<<7~@Iz},N 0+켁 j6}D;rtV(0qyx%^Huy0CO+':.LDEɴt;lf ?r4RX^}^׎&5Mx":99x}a0ޒ]5L#_[24R_dpؗHÇHK*#YK*J4V+A 6BuXE\1ȁ'S4x~vm >p%d32d):a䆶ڶ!AhuR(\+C˓;b@D6qz|׷M%N/ּU|['p1S;DcFh}8:^ !n?-$#Uk!)Y J|- ϏRD\f'Jc`Ђ߭)ϳ)g-yG)msiaX; PyX4l[V# y~~9$R/4z{X-I̞þe{35|m%c-Z30K^ z6 ,P'{(ltJ}4 y] .` uGd#^rKZ`ip=!#ȾuJ%R_3IVG X} ”߻( ^@v)Fx%F*C*]G<=} ;p'QR3EsIPޗ(y, XhMi& n{hno>!kL]x ^äb(wGbMnmۂ ,0L@rjYZM(?Hb(njvq3x;Wmg9 MIr|q0j^Ct"*.۴L\W̷x]^#q1Zk +.%!!q$L2mKtHiԵe'r֌+Ow.66|2x;mXǣ|/y*Z% L-B)SBᵭZc#U"jOE 5WN(Tnfc"'KAؚA* wB)悵Kfn9;NYb06Fr(3~^2tz@z@B)sdLs8Q^ߔ?w>c+F4W4eТih 4^:#(.OE`y)גXiϽcoBR+di#&ڸuEԻ˾S~g֮+zňj"y^Q:F0^+p1EԶ*3]Uo eSWL#x1yK?r$5`&S3SMـ}t6=ZV$55g7Nߜ0}srhr 얉oD}vZٺ~M)s4QI)Avڙ)@u ي2GQA8#<, b_OsFQ>hk2yYڑoUy8+ pA:d>3Y$c{ԅ~ٲ'Cy櫹u(~=2Z7+ihMR@@i^u6χ{^k4kjn4d_JT8NPNE4fψP3mi\,UoD(ErTjp8]c%. Aޔj1N8E+`,ZRUu-'wBnT6ZtT&gÏo+ߐ 5ߨE╝{-| 6=퓤{I ra~L=Tët0;_mf &$+g./eX|RƝȍÔg ,YT!͊ZTTg7zY/!/q>ޏD[>o07I m52]k{N23d٧C맺YP(I z~Xsfĩ| of_3U+ jLSLHb) (4[HNF]&qMvߒvA 4 2);jJ=yRIzny&:>Sԙ$REދ]Hkm'V y.dXv 1{xŶ8B=.e;!jEY?ʊˬfz? ;/j^Yj{fC-66#DcV .[c16]tژD@cNaϦqr m5$v6)5`+!-G g]-WPޤΘv,.)~nKnT  G7C$NYuAdɯHV-!Ftz=`JF54 ɄӡoQeNnN+_Z5GMld SZ-hUp{_U1 %dl Gd#6,m'^HUP +䬸jX5w7LM"ߋ]/f9/gp Iu)X$4aV@ {>AoeoTo9᱋'A8N· 7+Dj3¹ Ko7.s| kɝK/Fpab 7GrȺvd!AN3]5G[mCH#2ܸ]' gaE db^4TinKZc>rfED)11KH,!gh[>Ҁufڜ2_0}gf3k=8xzvM%MBXl&2N}%M5iԸ'ˆ;'*׆:msS2T0W(􌫥YOv( v#b]b`j$m\0>&e`8ͱLN6CXk2z6ؚ16TLV'?x̕*ˬ3N: F!^?@@9mȨ$!Ð:ﾼW (;<}Q.zdM"v;sM'axc4A]0FcURك0!܂AaolF%>^-$E^ݞ-GTw?\D_Ѣ Ѳ6;p9HSEFX[)Щ}(+8E?JB Gz8b:.(1+#Iཊ]nC ݟr˓K HRY<|>S :^1 /[_*'U]Ӆ˼EˋPbq~z38=׹{E8^Qb-CN◼:ɯ'˼S^|BQTv$%&Qemu%@AƼ$U-KL4O*FC0 V5_VG~3}MNǦhޑT65YrlCKcS >­8_Ce\I^>maj&آV姽нMH-ޏL4_)e* 5z~3Y:.Sb02UKB^~-0 ,Ն̀06zr4./Nh#@.q ]T9u:RdQT߳UA[,fC\+#|e>W 4Sn?{Bx UOl88s/*W/qphM\(Y3`hx R bfb$T={#yN&̜'  /RNٷRB9{l_|Iu~`['UjDLhc̛jvsa:9X0)Y"ߪ)uRi\+ ѹomjLYP [@P)RJ&o݈e0V'LVinz0y8a?XW.\}|{h 8v!X=vVi8b{Tֱ9pk8{XVJc9O;Ws2?5xm ~)%ހ`/acAPʼn d{L42d8h h,` $+}dn "vAz^!z3 tgOİ<9fc8*R7NOq}VO򱄤窕Oyj'#xЅ2a桠(6'W7ch-EHs4RƷ'M_9GP^{& l8B@1'EzǓ{?g!p; M\?cVDɫ4w^eTgN9jZ4KeN55Vx+_Qky]ZD.V(-,y0N^=}uMR@S>hy?@`zd6к'cG#s(ˮKç7PweJ: hcޣ.'?2VQ0qȽ'}ݎ97SIEC#EpLϘPSjF vXݤHap6W/o%dEg^a h&wv$TIPgK'?({$R?:ZIYjE!xb`U(-V. /HKV 7CՓZnoU{`iTа >ʾ=fAoD%ï`6^=lθ&j|=L!A}AZ{6!#_ƭhZ{W:юk _[I1㐗suVtF=xc9< i0 .8Mt1p_ׯ$ .l_eyEjax2?" M9&uկwDWu7YVq[*FN~tbk}ъTqjr.\ )׈;-ԏ$͟]&!=?Q$VCpA J<@h ŹKuqESupVo)v PXSqX r/a_=thuH;J}PKY8[?V"Rዽ{ETKUD6]׈,](c^Kn6YUםA$,ͬqP횕5ff<Y6ء*B0u*n ѩuP{񲳯D\O1Ԁ\)MBPG+Ԧ1_bf]$B]*.t^흍\X9E𧋪f?nmK:c suu+*nc=a~ow1A;Rixxxo M 7ہ@dl< mZ㾛ઘda+ @a)R1bct܊K!n9~޲3Uyza'GŷmT3 A{}I[=!;r0LaB+UO3~jr[el:`v3m>l|&2XzgM ;5:{&N8IZ g +ۇQ֛Y]ѥNwWh>ZΎ׷=j%td޳"S&ԀD1~xk„.͝o2Fa(>AG'SFLl&N^Åkî R(r۟۾CIyPiuA* `KT4|ty!~n*~x`p;Şc]k x~m3r7E#ȸ!rKimhĀ̗~/g\FxܖIDPXtbH:at&'Wgeȍ 3˔T f_-k3~ƶ(ѰXܔ >GhSeB໒ ]!<({} P3V 7[vm$z2ޚڔwNAE;:|a zu.q@{`?~bBVKlubAA&7$'m69k)a^_GÁ5qApS)qNɔSaǘl K6 3KFB`_L8qyqR|<"R{k[In;x%8֖iI?6n{\h[R*=ҟJ"^Z,%qKW)>& 5XB.?b ڀ*\{FJV$3ݸ].F 5:(ZO4>$_?"pR֑&r8G*[c0H;" @9<5fNjOnmaMj,sRilX"LW[`/1].4 Ye7&lz*zdܚy5] '㼨rNù$Oo5Q0dJhϏc*"[<ӓoAjsA?HB iҥ% |i- DG 0(B}na^`ʮނ f;?D6`)rQvZ;zuպr HDr&oo s?c[u!y݃%,:j,4᫼Q+\@ݶ~mD%q]2 U*8B6 xZ;2lw*J~6;k$xsŝCYNy[YRۙ/rQN?!8.Mn$W'U*fw8<6Ksq RFn>D^AhEs;vb3z"U]`Mjap>~b+/@][ȕY]:iE!$gZ F`Q ֯+eo>/ CߌI^]O,c\\Y1eGoPHecݟqXZɋ vD5 C!fs._<^^h RE}LIOJZA TV AQp aa\2|֤bu6I jO0\_P o<nNJAb. bzY*|>Uظ5Ftӟ,]哛`*"R@|,L 㾭-~0*@.h{2HpYk!#HmZ53kN6&MG&iEܚܴ2~S>Ssv=[Z>9Anpf&cLx/< kwxt?kZ 7h8|x(x5 Vq (d*mPe@ZU%w?>w[H#]p7[ T{B<)w˛0\%A)H=LMo\Oͱ8]+$RƓ)t;' =":|&uWQL%傿WJnC`~`l7{9c*-뎂+/\2DDk"ITBDXbe %YFJ\ӣ>*  XVt) /v3~gm> n~`[-Q״iiy oJ<.yG+:]jWl^tP9 lP : "ã\Tt؃bk9ZBZ3r0 ?Ay2+mYAܗ{T*H/I{'B( `$<$#f8W (xU3p$,0݁dWXS 7^QdG w2T #.&ίq҅6Ӓ"Xk#dW{~LsN2Xl-JGe *B܉@s^xC hppnJ`eXҠ\> iP-vv\zHU+GnޑW [nKu.**Xkڠ8):N ЂKQѦMCTz_y^--vpdnNsy*#)Y jF.aqCǛ5.jg9СȈ8e \LMWU 5\""QgN IBh+:sKJS5ɽ 8AOrwt.v F׋ٺ)IVEA7f$q#jQF㳬3T);44}fc4D|n fe6+,ϬW&2ף:iW rFފH&+Pm(NA|sL[ Z< 9;4?SP<xyiaVj’}nd`E} 60Rn9J6VoAFf4(*cmP=#9i(Ls h);8Ό>qt:Y! >@ϟ$G0bC-Z7z@-H:\RIjO?%$IW84.;!? |#4 [T[/t@W-w64kƭrg#ͮ1<6Ȥ6c/IŸJ(ij= e$T\ՕݸP3 wT|-ϔZ'z|CMRӞ֥*i= 7tŒ`;TvK6?=I]diy19ΰeeBW8\f+C:ϻ ߖ|[^Գ+/PJ[![cp`{K;R6RupT56Zq@D8^|m#Ky)H)F7\M5#0E0Id_p%^[huFUD:+DZ 0uv R᭤+f+fF^Zy\A{víJzPJߠk |N(AOڰҝL2VA# "CY啄M_O1E6 xmnT.9XaeYa!)Vh"=05] bIjv)¨kđ5}C xgSn#WF\ل L穲Ź}c;(?j32b.Kee>*-i#׊hGԜ}"uE)wQ dP3CLǿ,-PEf9Le,( _Ӧc>Rk5h9p֍bّ.5OԷQw~L\kE ʻ~gהOngWM"zi[Rra${M׹q}=M[Ezz )e<912>g'sIaœ(}1rb@+:pu%W#fb+dUS]ƷQ!!չypC7OM?^JMB50g%Aeo,bXX$S#l l  ˹ɇi'"PlgPzm*0JJ),E;e=[sSE=14w5NG9gy,y;_.GRۃvˣWٹ9q\vvtlC{rŐ~^ZlW>ՇsrZ)ڮ=E$ ^{CR=nJ9FR4Oz:4~uz\i| ) Eh:Np__(.ddyXoG-;-^ T:ʊ0@ˍSUv:eH`e Hy*R(ނy O>\{]0:)n;ws|q!!lwbiR(M> sRxk8ש!=7Xαt9}>e ?+ b0#X,n#&G"׭PomdBoLwYdAvpne 2v,)T:]/;G2O+"JG: %y} $2z( ؚ{4ZBY*C*#.۔n*FL/Dpjj!LB][3'!Οz@ }x'bJg#Kj݃(TS1IBe³EdpZ HJYh3oˑ6qSQP}Ñ.2+h9~nꙜUȬ`F-(b,1恱AR_mB?oB)@Q<*"U%F=$X^Z\'îٓ&-uPzn߸x*D9-X$'*Fi6MQ>\K<;VgZlŵU"#oqB΃˚O?BLHN6]4PD9Ԙ?-Uktu6rY 2x!#A }dQzXm31.a'^'$ eޜ%c `!ة,C-lyP5iڐjCuMC0[uvt~"ޑ|ȏ=d v'ꏁ/t 8T0X|X].r¬D B; :=)ۇ!f݄*KqeZ'cLM^xHRdꪁ~tBk^ͬ\BT#ppMHIe%s H6 8|r>KrOĬcB \e9jz6,5ek}HKu(KP:Ў'`-q(1[26$_Lcd=h%F1~ƍ@/5Eq™ ɡ \΢8]3p5 WPdM܈Kߙl~ؼ͇oW5] c5UD?yE9BLU{DU IF-XYcSP  L$GK/_qB (o} b#x2N^^>\'X×KBga.ǺhuGWXEAmwC;וX1;g%Hx}Ts[H:IlL)uLP鮟6PiZRvhQEΪ8i z&^g׬J*ι9)һ4#>{;H]ٹ_Ea*Mb3a,6,ʭ>aK6Cށ0iCkVye,'6VTz*~c(~Y(BB :<` ]jIK(_`,h/qFbW0))L0b^RQ1$!` PCeQ"䪄|UOCBwN\-ql&oyU tjA _@ @R K VKPG]7_ Xs0 ,ٸ8NN4 wh}׻M&A`}Sf~+SArx!͙hdžgy)LQŊ =- >Ԙ睍~W<L`5 rzׇozK^B)(eB,ta &QX8X*><@YK.Ǐ]3ʤ  5?|@y:)[wՓ\W-L^av`~8"Na>&xF%N#A-Iն Zn>t㠷>kFExKҶKxJԞXʔ Aɻ@RzKjw_sb [Yj[7CEP:ZnGxL*18i8땿zy@]Z̷DY4:HϓQokF3)JN9OE?wcsȖ܍zdy`n3l1z)ШWrE_fUJ[J~( ڿI95tA'"Y.wc;):4RuK74@dL~{%xrOghBS"K jp;_U+Nk"D?툻?p`7>&_^@hn[On>NHd5/sձ]RDSDKjDGh:y)]0Jv"T5ݗM${p5E֮&X\$w~i Fld_B[Un]Zi]w,Eh#ϕ֘QomV$6Xl)Cxڽa!*jhY†KuW;|vH#!`L_!,S+e'A4mh<\ffߤm|L[ғ K+l.#ΖVh ͚ VH7JO1.4a oe-m 7f^B;ӡj\a[(q%lglFfavo1V0`W)A~o`=TʧRpK+\*V.^g(Eϧ=CO0]WJnF)jdi ( 5rd%a0(5a?+_uc?Lŀq0=9W/] N|Ix81 X͌TL8(21 'ʆDaQQ.avJN:n2 vy۷O@ 82 DUJ}y7!:D_]_=Up< ~͘?Z<F(EH(OʛN% p 4Z#Zgc|'-Cb|N|Gx8,*{FlHGQ dOuk?! ƹg0+ǖf5Pv miԱ3#ܩ1G`Wjt=.Su߼X*S; 4LGm 36yJaQ%*}3ovkx li|v1Mx:[^"e`_tWizMQETxX@uY} оG."h1 g3@Gj%as&oM=ÛG*ѠoPekA5xVi5;X+;-J-TclϬ_Կ+ya"[p*x1Fo";Ije0~ #$Sǃʁ9{ <*0alj1W$omƺ ҥvѵdY)@_ @([,&q1Y8hQlF&IUY.:–OD # n.sKYX_@`z9nYKBQ[/Fnnw{1z0/ζfZR.u De 弄sK =/t  CIK N:c@M$}b7 @͐*p(@s?oӓܔC~j EgA<*LېCVqhwߊLz*~Ő#Mi}Y\1MA"LH,zs1{\v':s4jcTF&Mz|62LsG5 ^nsSdk+"gt*%czCCN/ V0 iZ9k9oģ6Sn>G8LS+ ԗ?㹮;< TZ6z'E:09.)˱1jHijg?̜wqmVFgu?^Ȏd({c IgP<(%4Bx~N{$bA1m}w-z%Hx埅0#!J(1PfA|UEb$E#AO[u38 cXU0D:fl,IHx]8OP/Bf$I]tC֎I-wT9K=Fb|(TKhDEJlĵgoQݫYDazpƕ\v6K{y2Ň/'pJpnfe1+>J=\y }e}o|E7'3< +,,r0֗blI+znO^'dRXWPn$:ƨ((G=Dhy2V_Dd8!1ywNh{La |Ѡ w [䂠V7ۂGv O:KCyHklC:E_)`nye&.f5nfa +ԭ'˖q:t Qܨ x`RPA #ݼAopO'CWaҢp%J};{t( CgeY̱KQmvt@vDP/2wsG!p;r( ΏAwM1$U3.V+H`WƄ>œjyJ4pa1H`rp.P` 6\@#x+(:@O_UWI)'UVF,`?CX U 4bE2({ EμQS"8'-f|zduW>4؇l<5E"EJ|rV1ȮwFϫ%$W gjn3+Z Vxa5Bj*C"/CS*F><-[xw:Q7K `!pcF!e$zBjID An6/P8Uܚj_=Ͳc:|bi=H ]:V>Tbfj' thϖ#Ǯ1 _ ѨBT-w K_g+YK*8H^F~:}P:^WodoCWڮD+릝˾q%*in~Ƈɾ.1y\-&BnGؑVRx[znHޱ&p8/ҼPc^;8{% ۦ&kyNb=A!AQA܁x۹Bʨ}> Oל2P# .2=NdGe>*~dJV7 ˌ=hA]ץ2J>,o~/[Ycm^IhH龗 ~K]GB(/vS͹`μ&6&>1JU2P[V6&p RDV)xEU}7ΧNn ov8B$N]Un$fMdᶆ`GB{JĹ3OPdAـ,YwfS~M[UX@XقĠxKn ԞRj.Y'KTŜ4wR 1:mv+(]yų)h1.wJdG7c*Pidi nl1V<7uSaCWX/pD=F~#')u(Dy uWa2 _Qޛw=LOPb%Hm̨52g^w733\si tP﯏\hbT?TUaK1E[h~~;?q78lѥ~n6Ryx TM]N`PUdpzǺS"\QCLi d ę֓V&ѳV6mcZ&&l{Ӏ6m e7zӳx2o)r1tM}#( r.7-4eT**9N(+$Ry⃼0} q6Gp6.ßEJ>X8g-S~- Lwl;McNׇO]E=3Yct<+=j0mG^sʪa@WfS+jT" Yy@2?|DDɵlhp &YGdܹ&w&|05HC|YЖzIe& ca9}<ɂZĖq 4Mo|H_ SZ )%\1)b ~BZsWB3hTљF|aR!Q3M3JPNo!Ľc}b{s: 4b"`7>GgZ5w>{|XCQG $phğpQRAApI}*L^l9MBg,yF|D^cѳE7$rJB ͜hta{qʳcOޥkBRO*O1}JeB38?ET9ɖE>B T{:CF3M)P2"if!+ey~-Ёnh$\|a=k»e!U:wVOch>#<7Bhw(nTsRqZhaTˆO_/"V#=: *ӂSۗ=DL$fwkj̟YP+GoE #ohf)a+%{'M:cm^TP+6 YeBV00xܝ-h); nr %jZig {#377kÄkmP3,ic̞YDu4kBsNZ?roJQJяˬ.2,a^鞲)jHșbOtR@{{O8 r2Ke[V)"cԈyCRi6Nn!]S}"$L#f;Hwۂ50PDVx5y Z~ےH+/g0[ž|N;6t!.ʽT}چ?0 ED *G݊?v ೦nu@wEE8y [\wIïvьq+{LBG7ewI^Y`Qؗ.HσuDCL7_pγloPZw:#kLHCKT^I>Rv\+OP}ȶt/Vn.v'Y>"4]r$@LwSgB t}6ؓCַ t#@;/:߾qlPDb%J1q B&cߞ9N3h!Kt9| YAN\q8LWYo6:o͡v@!LD)ܜkYӒ&f UM^SPiϤ qS7ʧ1`q4uWEZDB7(w4lom  ʯ9= Q3W+LBR,)C[R PQciuV21d}ےMK^Zt_&% ,ӕ$#{Q65sGBi8c+zfߡ@ Sk౔ $2vB}E-*ɸŰ!j5JA.M=ɐ=pZ)ԫܥ?a Al?o#5k5zK6 .}4fQǖu+T.'IodQ5mS Yzb`J*I/9N2 5Mu@F>Y-ο7N1 π#ca s'̳5IU$)g6 !8 HV t )NXIܠ9耥3d5 <*/dJ<5PB{a- \dq <8pD tϯ$Q#G .1R3k(um ۰vn[Tq潽=V.<89f\Y`ODby.Fg0?[=] I.̗{ u0GUuʑKQ}{=paJבX͞PCybKV5 { ΣӢ_&U}1]#]PLۤcJ*?Y{aͤ)61".(EYE#=T3!\d ±3vƐ9^_H>Ԓkz2!k1Фx6JRWeVzZӱ7ŭD92s CAm`z"!cS$Y8tsJ`ALBpt0c[f΁RMx3 ld[G9ddd/**]qJi~ۄT*I||9w+{,G<(dJmifi)W?0~^?@Ǧ?(/4y0R<0l|:#e/Fp7{M:U]n=0B9nնեg/\qt]~+xSeV³YQZ6A =7gϗb'%Mi~`n" A…cHz70V"E4=Mi\lUP5ƱR:M&҄W6Ps ''{>JYkWqцr0xY}[o󰦝~3S<R8;׹`;z+}jg!ѫ7?5;dSIx~Bv7.:CW:wH;XlPX=5$U'yPaڛt2b4ox.(Bu.2L\}1w WFL?zJSwnAx.Y0:Y3dEe-ɸA?!K 8x1QZSv20³!7E.]ѥ[5=l]j!A(Wap߇uZ% ^%\bM܏$RkD^V"jOvE\OXlnlai^tJxџe\/XxG\A!,%KxܒˮZPl sP()$e@vN됽Vݣ ơo,e|I "vBX4oEghZp̾ѲNDY{;[.+|W?1ׅJ{XficI5 OG̨\.Fr;P /ɍU/fx1Qè$KyӪbO5Ju0K=z?`lA,/ G֮9#Ǯ鉬E6-!Z1IN\X@xk I%o)>קhq]Ҿ'ϝťb1 ]-%ft*p͌7mА+>¼{jʠ0{^a9:[śGz ݪBkEd'wY@uiܒ3UhMaY_AKЪszRy ;Yz dCMĔ"Fz64~Y:/?,9<|3f&/-`7k0 m5>g-½@d{Bܠͮt(}md֤m7p_EVRO2ʡ@aHTI"&^sI~'K s+vOOaDsÎ_j֠uj|NlHskQ8//yr4\v_B2-C-n3ƅ$ %e@K&'a _)[k.7bi(;=@9 6]H=Gy/.^0C$WʱFtϮZ,UqtX~:c.;Xe 7RSߣDԪg^OAߵGff3K x3CN`W4!nD&lGu>2b)2'=cOHCpl.7Lo1ɸ fv 0i1+t<~Wiyig ݣIm#]9ؓE\mݷ3>yѺ(v:^ VcG+0m hqMaQң2~J,vM( .#s>^D=(F1g^*PJK60E/E2¡Eδf@Z'NRw/f8j<0 P :2@VIX}ڟt ֖8w x@ 7G|n+l_ѬO> %jHIA29!?kc4 : c'?4Ilde?[e Q)I+m:O}V~Έsc_[ d׍C׊e -iDQ 1,),W<ICa1gΧ͊\%%H4*%lʥvwE<ֳ3%9jv)VV"qtv]/w&[N7„G+>u;|1LD#$-}={D=Uޯ#yvL1LsN_Lx=ykRB ڡ7Ǐ:s I*]di]>5e=OzGt6m{JXKxY 1ҹ$U 4^%,!3D2\pֺm=I*yǪ 6#N 5qsg!'>#O?q_9>EgxcDNq`c;;1N5_V#_ @cerx]} joE}]0jSQHk$ɫ'yƴT^K9: k*DVs~yӼ2T<~T)] ōa_RR11Wvu>;&1#$ uPM]y\SVn)Լ oG{Mw?g=8/砜,("b=ӎd?ȭM! a]~ۨD c0fAȗ~ Q<~iUy=2Xխq(eqMX XةUAK'7ѽ?p?7$<[Iq&~"GeÖJ>w$!Los[њEﻨ^$|E.n\7xRȥ;ު+\X+0=.JztCn;)yٹs t`4+$Z+qP6 g*EG(Qp @+Z۪~xk@c_5y^4-ؘ+RQF3(U6>T#`֑iStAUrZzڟ 24Uznq{CE*oXѮx3cq@:1SbN8Т%t8N]TDLJ3(ɫJWM6gR%kLZVB xń<>15|m;f+1wUp@JysK?e=js%4AQ40:<9OU&FiYI E/*&/U0Q?c&#:G8ƥLUO'yj멖;4Xv ~D[Q1]x<6ӂn/"!6uLmlX~c279ޟϷo,)fGs5|k QL>jw qD56axBWJtjQM?J,镌7TWYxzFFF=Deo= XeM]/e+W H\ɞIw0&g٪/$zHׅok<ԡsA󂝇ږ5m#4@Y)<aT'$p0CqHU۳3ۃL%xV:ίS?ȹd8"mT6\Tnkxl:{hM٦]`u/ wH7r FY3desa!0>&IcuHfv̿eգGup"L4-z )(rډcV;7exW**K$'AGz v#&5ZCXr_3ЬVBh*vSGٵ-r NeRt©ou!0^.&"@o)T/w 4QF̈́g =-LeZ2IuG]+ݦBME3 Jo1aBϴFN ,~ChBQ7uW{`p1~c"@ v(4HV+TF6TNIGt,0윪%x33@~8L_s%X ,ȋl}s$2~Ul+SInn'+ʈtJ UuO2 =/UZb;[ZNth޽F*b[@a>Gi.h]r]zLaAwVs Z B IH{Rnnr,'Z"R |UXn~/VuP3Yj[U PX-I)3 ke \lz0/rĈK34_$y ['^qcOmd M.S8\WM_sjwKeؓ&Ǯ dbPj>f$C)G?Ȃ8% 3oc@dZ0$Xy;.HY|x@qӵ-<.15h= yA_"]jnjz3[xcI;}Zr H`hZҚ}yȄhJx7-\x<&( DN\*VWCzJԸ櫓--]>(ꆻb)z6DGe\*~S! 6-U]R֪ N7AuB_vBF"`MVK!Ņ ;8+ޭ-Jsb=sn|ǎ:;{ni4Ak;P3rRO33PvOZqS8|/G&RIRfEw ]x)#OL9w?XgL>'w79=v"؝OR)/_[[̏o;v/ُ*Zpq3E0܃ -@ƣE0QB0m!Ʒ>;c,1*qzdEagx8'\Mb4ʓge5ҕw> ڔٚ\}}T?kLKqV\F\zFey$e`mɶ?u.u`?_]d''sfIhĻcùv~_p'`TfuJG/dbRio*âݛ_ 0=<%:r?T]ɲϏ+evq'ʎ7HG]ao1NQ5 jADno˙Z,6]oYak9Q2lzvJHzc NAn>BZ2-.06N@h o/B:xQ څ~$cR"8~sAJV,PZEo@F(t6IؤgwPo!|=-# ɂ|~XK8^ u^ H/ouoG#Ju@6"W)RLKQ75g & Qe9A_?)8m8ĴV\Ec/G \m/'K Xĺ:<~C@)-5ObӶhޅ| %Svt_QK}z+wd]Dr|.cg9L_2m"K*5DkkgGS:D[#5KfҘM^|8/sA1Ueg D7tlkOKFڲN?&7>{Bw=l>,KU*VҝmF_~aM L! XG#h .UydJ95# )5ٌ PI0gDE(㜑]Q c2Ď 9z1J"J6#CeHO K:{ Z-̽Qe[.cwرnySϞ,X)pD lլAwt9#d8B:_ 77r"RF߽ nUtGbi 1ƒ^G ES?u d ilhki}X]=\R븤d N?ED!X Cnb9 )R Q,?4HB{T"mOdCgb]g~a ;y6'"*vs pia) e υN>6!{@ΩBX$n9׭n7l ҃ MN)>'_>n]_<iP޿#P;3ÚQ©O`uBR:`hOh>VO2-1p`*w ©mcggǿ.F1#l< U3ϒeYRhácH;-fTHt |qi5=R⌫.$w(6hӛjo#bŖbSkw#gfo8)c6 _K . C١,m*72{{4eoĺy/e8ZǥWh||||J$pU'u<+y[$x nT{M)vLz3e$&2/P&8 Ap0edl0jq  < n>|d:(hl )J<F5E@_uCJ2RQ3'`dLUg ?Ԩ:YbZI%i9-TV.6wAZ]QUEvNL0j>KUybm_k<5)IyofۓmÚ'`pbw@y}7O/? g KP݁~Ab؂r<$9s% iCNʖVi_JYPMM%OMWCd5L AGi?$@ad_?AӪ&w'`_Ji m#F@;vQ=@zl#JN e `];0|qcL{g\`v/l :5O6-i^֧^m\/JD Z3$B)ݶ75,rf-Ǧ7NX\)&gZoծK U9|`q{!mu}Kl2ܹxː UHqBQ ̬[iH:LJ$WD]x5O4= 6q|c1" WDӈ,Fu"Q JH}\K? ѓ]w"8oٶ:2pO+1b1m[´*l엿3"M*W iE e8T"lӝ/sH:RbBFn5_zC]=4Yx.f#vFIt'Fa &¤ڟ`mQ^](̻BTR ^NjS@w @l ̈́Fwl)^Gܟ3"6v̓Ik3cjzʥ ]z#'X@W8R{2 >X.|:F@, ef# %P6-e<( e{@{)dDPrd)=ׄa/=#.' FÈ :130*"'~E_VVGz(f שkJ[ҍ=MMPCn/X7|"aN#VF `[4 hQ}XffWDgP]d0dgw..۫Jſ3. tZ*%ni}ݓyKg^:D5{Y0A

-"& &KמlSbyG9HcjB6JWwGu=6D"p-801XYLJ3*vObƗd+fC2>}YXxJrxfrPi)7Wmx(@OǹFGpF,v{:2f!dhY\-Cɂ胡pPD.|$[e,$pl O%IѦT,9HxH̬WYF>rO<`9c5^" D6`Ʀa5#)n@p>EÌEM8̛Mq+O jw~KW`[GJ-w j[ J^#鳘Ḣ}naQ zXVedEDxZ@ZZ"~9^2(ap;I\]W)e_Q)s9gT R]s 9G) AX'0ES]r{@(ykA7TCq#aj(nCva@J%M g kf5,! .N߉ H&ߍ 'f˞a㐸\M_5p w8 n#z;c G=-K_&m|M1ed,*MKR^Rƭ8}"fH.P]gpcPCfʼ:Q^sX<_ĜBg3vɴDvB+r ><N2FaԘ+'_|U'v0a}V6wطADZ&3ѳ !u-%Zb,,t}Mq/\[Gӭ|X',q.tG1l݈Ɨ#wkJώk{$yFb!G처z߭Zz.w}jrcvbtS'b܂j{Fj3XƛHHrpT+V؟FF`Xyװd5B6\M`~ ʙIZl[wH‘W<t6EuIJ׌L`ߊ4pxe`,z|Q]WGXYAb;S΄şSmaCB568ںMXAlKzwR {jŷՊa372앁x֣C y;W_0>;~r",2\0Ō(=(=\QاjijTW:jzwS -U Hضp٭~Cلlـ湜%|?9vV2mdyv>AK_w<ϨҡW"\tm g}]xNs]aCFOu)<[!wa^]AE ;XVjo6RWU\4/qsHچIz%ζ S1]2J`Q0pTQj^ чlK0#g4+Qc+NWܟإ~>^KXD bcSWEDE@,boHs7C`58.dauis!waT肹{(~)>0gLOxz$1a;X\/fEc=&#q:D4CD&A@a~)*oՐ6VKWb[SKVEHL炫1O.fJZmt uiK.NW}0F::aTLaHO+hm"fS%?qL17˚+'[kXGД;+4B,#g7gĹx]| ]҉ 卼2RTf@l987cb& ]/]!o(?*?G"QՀTL&#W%ޙ+]x*>W*J* rrZ0X#IOsCG>/ᱺ6;8&M s :;pf p*dhޞ ݩkUb$()'yokKYCA)5O{zqmh[9"Z6Y cQ@| )v*gUP2z:2U;BչJ60fdUwCGn?,l581 G˪ @@#Dq@ L9A bk kO]9~k;8 D-ZT]lЩ^tAo~o1$ސvtCLZӊrE,?6.SC%_ئO;HFÌq3h6jeܯPKt>Ո10 , SbaiJygAWL⹈_}e>?e|/&Dr;Pq8"^5@\QR$ u5ȣ  eiw_䓑6%7(?;_Hi}ZAz6$v4D[(Wy.-i؂ސeӃ 'bJƏd /u$D_JAذ Mj0,O,sjswRr-ࡑri}Y;i"ÎQX}DZն$1)+qγq}xԼڤ@0Ln=gB|Lnb/N7GOs_wi1hkG0E~8<ئ&@W-7rla?--HѠna)O(,qnsl:23(R"8@E@}{[5o}!ڀ\7%eNNB;CImA 8D9uɱH+ ' $EǝyZ_pB4̡yEd5c;lMv HR`GVksqnj6phLxշF3(0_!}=ߠ@Z 56bju+F] q?IgWP7iT{m b7לF:7աG5oo^@-m;nȇٻp9lĸqq`jb^CL$.pX`yNN(uL z9Ԅ3f̋CY<̛k!iw7$UDVgF=(rg)p?!h 9/6N(!® 32;n`OV^Ld ˷YJo!e8\E-ԃL6]Y%HZN(8Lj`@5aK`D\Nؖ"T ]d_w,H)缋=|`cJ#u*{fKQ|-d1~$c3˭JMm,ǂbuAa+KucLp_U6洿X]O#[UoWrmOo0uTJ0 sRQ9򙐳8,ql|H'P3О{{XV0^.PKg `FPq$1k8Ut;{|dTQ3!IVAzrͩ  8V"^8]Gg+Uf+Kuߦyc\_HROk#bvpSEUJ@gcQ}{G):x3ȉ5XoX#L{#c'Dz^NϓZQBHȱ9Xnj_@Ni u'W*N|X0m 9#9]xj(;o*FXOPq. 4 9]etK AڶϹ"N'#{oVR K>Cv&j3I2HWW] 0 َ `m4 t&1\?D,=x{4nvM]e#<&EOkx)zM}ȯsK89F %pzGyM5*Q9q|h@X?ñs8M@*[ Y̯1`->"#`8IJ0/v~Lƥ``   ̄orcGJ=U&xo xPd_Ub3ܛ4+cb{;i谰KZeڈM.RLCփgPxczYUVqN5븎hoR\>SJCGй,^"]_@Q̽xBP1Ϸ'q7u_Iث C),pr:y#L 0@Vȧ!>hT=6 Q6ZN` vsT4~EgkW/rP^†Nǃl=J\XQ;}ƇڝCy+1. y88:.6b7cSctZē6hnbntr+&l5!`:_PtIwŷ _JLX(@l0.}uV TwN|>a4.T1beg1Bvp;ʙӥ o8Onz-CCkR1+Aq5(&wCgO޾=nʘMN A<[6` i~H_joZ{sP@v4/-eGdj[@Gm[\Ch l{Z;pV"/}IcS1paAh KH cSv6-iu-0x5]VUTy`E(3 A=q7ǦZh(B foe6Op*y4O~c*tݐ9drj9]A Wʷa\o2ÊO|*#NaMx5gRYRDnu)`*c KeU"?bk z$bwK*q:7_N6Y,ٳzߌ؝H$끰]yd 9F@ w0WC- ?XK V$Uuj%v' % N'8e6B[i8>HAԱ[ɨ~!LhR0m&4+.>fXg+u)%AVs+rjPZ @?<*J2^*AҿF=d::3Vۆ2mk+14ܹNbnD/⼩hLQ AbB<=?7JP04ǫc)dlnXEvIE%A+e8W;G.W.[DhV)v~o%WvY  gD^yfy Nv`M0גfxdz3()G .Oqq@ < :怒+,oA OU$PA(;rzߚ}ލE.o!v{&F NԶ~zQgHؽzJ_L*P)"Խ#t" ~PĶDPpz/c*03v^@L((R{8&0]TA2e&1!2bV>q" g͕ZaUd \0*{fg?<80::A%9 8yK[sHnSLRDT#ݺõP[Zm Odc(ۋt0iz0)MuhyD@& x,܇07k<#@.QDFj:`/sˎRǴg(:r~e;U`A!+9dm0|ø2~s?i].[ԈYgˁ!(-gj63ss g7ȋY %[eҒ,v !-?$CEgl"'!/טBHf(ĂRHn:Hci?ji@[wf;DBf.n=OŃ,"@КٚQ\:d2vV_JQRY?^-[ p[R&{/H=ȣfSxCgӁT3$[^"%CE8c<]Ҝ(C̩I}Rtnt~J|)q T(|(骯+Vs!o=p?Q avOڒ/b(ZL+)ک fqJbtGCυ2*U /:.5Ya(/e] xťqx2->#p.DH}r,5j H'!(`^EPϱLD2@dSx=%:ο*'1Wߧso K,Wh9A,(vI}3prI=GYr}y\C}w_ȧxyɷGF."ǘ@B6qE!E94hxͻ_ ;m /3֏XP);68k'Ho Zd)['PQ p Bё];X?'JLR&!ԣMF\}j5V)$nkHNpY$ |jMX {mA͵C!(1. >mu˳ZB'W0“6*P4 ;>|2E -G.. Ek]FY_`g,3 5qv+]qiϮduYSpφ6xăotb$2hrtxP=TD)[Xa7ỉSM7!'6D!u~uB'q{o`s{}+t`44?l؀'{"ԇPmCSjMRD|vjJynŠ ~οvB+FFJ7B۬+zAWLvo(تT͋m有\X"V9ۇھY>BˋF( ~v^+i``?X@z2K6L`KyAggC=p P׉S7}93ɫt<=#U'\IA🠻WŒE\XG([ W twOʜ?WY5m RP##©X $|y,称 4GUT=AD/9b R)nͼyn{ԠˀzZbٺ?홈YT7o~z Bbc3g1e%٣gYDyf}KhHXc:Wdז=HLv7sq1 |DY3ީh3~0Jy3C:n|.;mZ\*zÿgH߻Ic@p5xnmneWeVBBA*6OTS>~GMj`ċ<.K k1ĺ[!Gjռt?*ϲ'm_D( ɇł믮;JU8 m;BVklݯSo7DdS,N&)+ 2)t:!-OV j$) .\Hpչ!aR>,sc،?E<(g$W&Hi}@Nf*- h{|G͖(%k⧞ 9݊O8JjS7iw}*w+prxڱFėRpB~GG<` Rچ~5TO߸[(XF~A{/򬿃yÉv!~gSz#5h0k#!ŇZ|#O!elYpmUqYLɪ+kVLus?^#91u<ˁeuox  /̵/Ϯ6phܛ$: */;>[Z݌HNd}r[~?k["9\> +Qր앮ךy%fERЏ֪5LЪaV<ްɫ45!GmL*ɼӘC|YkN"Ew@ayr5گƂD X>˻+jB7Ğո)E_$ՉS<[,#V'~%XŒ|=:r(~_No˥ԡr»>'H%T/D.L{ru͍}R&}ꑩTPY"/|8Bt {B5,(&r2Qf0-/.]cuBf{g/ԋ? n (}["\ GDA.9#M.{}ܖgɥi+i;G@rVm`,DkuQ~Sg`qd׎w/DbeWQ! 3E_3X鴛I롧t/4kz 듑7)gɿ|rMXR pRn7~nfhn$4?慎Z{ e@p^c(>dE^nf瓚5(P~l"׆CYB C ؿA.G$L #p|\ʄVXx'y1me&4kM: V' Ԋ~n( #lScků/ \hH՞p!c̀=0{?#%K&K$ 3+Wnw&f1d DIcBU{V¼­"a2.QyZHZQnA|9T$[ļ 3_twrCE%5r7W@2@|BGEXDAzZXʣ.*Fx%X@atem@ڂ݇JC,/݋W{wH6̄[3#^;]gANU,2\˽ 'lu"?!fni.bf S"gۉeMi9U1E;tìXv͌O|"n2ɨj셽 *('J;m!I25R3ެԦY{]fPaK/a\mXzhb>'&ZԽ[Jgf$T֔@IePӃG,@#6Oq (mOA%k2xplN$ʎn!u O_PjlLV֪w#@JH0LodӚJ2R=C47|UG kU= үɩT[ܜoy?Z@k M 5dJDNn E-X(q!1/HPHl3N.٘$%O]qmE0<1qcTH Ϣhmde^T)_*X oc­h"#yJXJ%Mm 1ڞ('{`oY祣W-h^;=ͪR-U9:X|6SK':z}) ڵ;6i=1RhoM¾!.fN(C`if6_ޭP9b¬8TIT%bBDq;WI H1#2Bw5dk=cIr'ڬs'f'}:sxբk V^:*|욵KԠr'g l^<z"ݳݺ։)w"hl.Ñ?/?bkCO|RkkNYJAz7̯(ZPXFmpf SiB8o2^e>0L'O 8mZ'ՠ;6;mMDcM] ^a}z29)[@~Ƥ?"T*D:"4H!j:WF$Ԟ>euyDHI;+8n 7 @,c{r[+kR:fh1hG7&ʻ-:<h7x\VH_wg']{-º$e g\}~ʰa?uaG%'6Qmnh}0y$.%?'%!PJ?h]a8zQCloT[)pǦ:AxM̂K2?rtbNfRRT=,hN-0~ 0xV zv3+EޏQҌNه\}+ԙoEUViHV~Xe^'e/rQb`b%; Nj@?jNjΊDlqi@Է)˰Kk[^=@6&*Mz-ط%EmI~LG6/ "La=l"8(0_\Zll/ ?\98sPXJ!=7WrJΦ˼#+ue7ѳ,0/bHGp hԗ.Z80'υ%$"M`[Twq Zkfdֽ30Yӂ(p3Uc&uђ÷3qǃ)wn^KVhܿ;|7;$ᐤ~W&$x'ںZGsHl@"Ņ?P9 PF!lV{Sq4҇n4&/(ũ$uw,4l6x:gli2/M<͢a&avR240Waun1{0z`1o"'>gDPR\tFPu J!FdYjPZYZ6O &%& 7K 8JD$#q%d)||v,p)p}5HxoNbXF[w4qY.)fN' 4Ȇb)G^aUZ"|_4kx}D_hKbL`=ñ2&9 Z:pL٦)(:[|H 3y q)# P>/Uft&.ȈPm6QkցJ⏈iR>| SNN~hysNP=b 8_/R: ro7JZ}uO&"8ȎK{~]r9 QSľ#87ZI nQtF.a W'F9 PeGRdq~\+?!4ǵаή* 7H0^`wy3Q;f:JݦU&q4I~S7 ,hwפS'giN%n߰cZZ|X,q;wC^ʼn]aa4H9eXu>Ƚ՘/MKO`dҍ6\X!:LIJ#,9lsRh X%kYD%eπcvZʂY/M-8E5ٰ$H^/+&0^gj@"Zڿ#Ǝ:)Sv>ZTḽI2v(t_Vg/)AtќФ$?ϙ)wug}ZG] 4PP|r ^+UadvAJDSxnj>[SMDɰ< ջVPtX'Q0;\ -#k n[=1n4L-2%c3Mt:/ENHe(CH2^eGt lFƘ|rߗݡS.G.7l07˴+wh7 ::X@PVS},Y9>R?$Ʒ 栺T F N5(RU?(-k '+VJ%UStvTFJ 8 lfw-!_"i]69jMKUPZ|0AJSx?ө)<bCÙqUEORA4`e>vߍb:+ЪbSѾQQ=G(C`Qe|smIр KiCA>N4bw.C_\w;bͰajS%"߮"(xul;cɥV`nMN3unR'CK;kKldCyDVg{EV̯׀NSB%{;BQEDq E)B\FkQzz.m"lR©`Z E1)UIkd3c d@ ŠMp ciX.:-@憇G4~\=CY}G6Q5hjtTؿ:j( n_ԚZ8`,QraTT~Mg;_t6R+ؑ6 tkuk@I̳|5Wqh ~쓳L YIs1z 쟚6hAQ0,V8c nV/5#G$.Ƹszу] <%|ML_"]% 'ڴJY!⥧"D]0d;4ǘM۩K74  N(%Aiѩ c[L2:JF+_`wk))iT7Dvi4~ϑXOo#*e@)MO=?z+VWq9C$f_F}vt`S0S-XS%+jɯl*'g:4rhvtT6wa4}uEoٍO\R|-EC }r3V1Yu,%Lq|;'y21RٴN\ֳNC-DX:AY4(Z9Ia tN&vV].QGpZC604^azNyS+|WXay'iwfoR"2#Ҕe YgΒKIjmc )zAۀ\CڒgCr­5l#P'i<^}8GIuy':M4\]5BgHysГXaofz[˒仄 rt7Z_y=;̼]a/`^hR+A%Eq5`},|[_Qk0dJ?Q)x&BAxŰn2D}pŨU eobx+$?L..$@C;XJЗadw+>U?{|`\/̵Oq d]3 ~3c r&tnlWtuHz098쳦еj k? 'ԎBat91F!гb]?p/+1~JKmlBR0^ EOj L L+\BC=OmA2q@-x]\^*oh33$q$-nr ,>s+a$r~ܧ2f/a `,\/ҵgJH@T=w {>>ckV ]tRNl=+`iL H2,eG34 iy|b9 @4j~4WH-3OLJwVUU*Xjr*KY$3@|-,obٌVDϕd=r[a}DHEdmm~y:H#28>EWRURo0'݈!.HJ@; h\Rnt?>ݭO(A2&}{N} JO\?שVO&#]j] )-83AS`{h.45N [>'_{VEvt'߻+4 Q[w8~s)֡~LpJƺ=u$%S2u$>G 7Xr7ڟђ#)!4S8t^|#d _?n]nHЃP!՜jgdr'LW}e}}AU$Hgo/\]Qw]^ODc"zM%`w6pnL1'*Ku`,x וD1H({l"*v"_[s4b8_\+-ڐҬA Mf, ˱H})K{ht:~<ӫ _=6wKVON l060iS\eCޡFr ?TyPn$mer͖SV-,LfdL|Y>l$ =5x's8&7Pk8v^^ S:l8B0Okєple͘WV6#_; ~>_ܺͬ;ȼ4̙Tv5! ڟ6m0+vcHPlD/i?vLxλӹ.QS!(IQLAEe4HzA;w2{ Fyq':YÁ(#pskgNhNFYzyB u_iZFE-`åޤ:Bu'on:,M8=jYd2OĬ+ /!&>5;ݢ nk%Z qsf3:X8Zo\|5fT!T7A,Y-0׋Ys&;syQ)(9ܚZ2鏤j49`v0bЈN̽Fj0#Pr n&K @,׌g]hcdb:T'UAϘougcb?2dko.d/4sZrKPRk: 3}yP{BX:nJ[nrE3"0u2Yld/;A>" ܐ6'W45` *ZTXBBPj𞠿?ꭂ$^ MP*PQP{:NR{ 1M`h *8_pӯٵy_^_U"yHVQ+Lgx- R"SPS~2^̲d9*)8:\5y at>")&U'(+>yr"ܬF&tFA M㍻MBcj@)Hd10eRUSpS6 _'CQ?<(3(հׯe.~2%@GIҚp1j"ȁ0'H&؅ɧJ}AB傼;5OĖmGʶbwR+%gẖ\U-CIT ^B&?坺,i8 I1KW{G/lɃٝ9ǘgn 5ǘ7<ӫ[ى-v38G*19V9[6(Mmn<Peը{+@3ND  W$:Η ]ѓ@<̪d`"6Xé=6[1FTs4K>-@OMoCLD1 ZDiqAb*[KH'_Xmx@ɖϖ̐us Qc~[aub"A ngJb 1nRF7ճq,Bp/]<4bxˬSD$u;k߮jd8@Vݣfn/Ri`Ό9 o'?j)@C 6cH߭ڿ>`" tdzGw(82?O[U3np?MV#VRȼTah )RB Ѫ>HjrՐFDۙAK oŲ>;j)9RЬO2J?O9h#P۪;d_Qx Ǣcj:ඇ;!)@zl9tD0@jwgKqDE@/!5xuv?l~ec4 e S)٪1מ4D'۔RЎS-X݋p6;9J2`qH[4|.'wXS}i,'pD?EALs(-gqY%oq7^*QoBBi ,ariY!=;2C)_QݚFi[A1IR>)3(NE:Oz!D} ^Ꙇ\ ܨTfFwg=6ʱDƒ̤@3d9LlMlO07)QLH[K~,2\~@vwZ,[^2Ls& 7S:\+aF6rjt}[ QZjXm@> ;ϧZ4P$-dn!XBJ7$ 0ҫ5ٙOpJ-[#6A36X"/*FpzCK#1*Bn >`"A~{1Q̫i{H=*LEآgmب&zI/R)l&*=~j.iΏ]Z% *z{J&:o2OhWjΌ8܁pC7 3u-G7E @SAiܣވFFK Lxk"E' dX ,": ӻ}bCrU;eƯ:l,IH+Hp1GaJ<2?V 7}n:5M]uOp _Z:p"QbDTP{nJE9b6ێI]Y6dn6 K# %\xOwڷmSxU&*.S8h /ɏw"",~}NcT i0hu }7߮y~]c~\fˇ"R9%Q%T*\K^4RRY.W?O/(*c[R^2h73u_vR WO% D(c`M{l:ŐhFX)pQ.H;*u\HMy.~+`Wr\)=yrE`er=2j"m).{㠏jbG[h{JĜV>lc ۽qEj`u( AYt-ފ4΃7B7ܴ{|iw~1Ӛx!>9FpUK!bZv}xcծs0%t3Ӄ :JO|Dw[,7ɼ/򣨀I#ӶOc$b{qrvQuJ d^infHyӗ C [F{RKՏ9ZԬ`ާwN%r 7l7Z:] 3/یMZ!d[y/82|դZ\ Nq2D؅{6cO+7jPYїD0F-a.T ҂.p] ZN!؜%A)Phz7M.*8iC#Q#Tϒ8i Sゝku EIaT{\[kU;Y_k I[ sz]jceODP3h+$A'AėZE/9}=ub&Z!O\uqt4tgh`>#ﶊ@iu$m]U݌¦Z|!IbVPGO+kseyXսf]f"S"IáP`v *П;?i_Kii1LZ1K5%ļt袪zHMt q!%`V;|enӜYjwAAU CiZ :G8>J6WOveS)#TR>!MX;[`mo{sc8._cMN8HߑrYP7CȳNZ.8vkun*ǡmrċ%_ sf;C*jߘkuamSfdQyF8'JjI~-(ܧ]Cfȝg$Rf읨-FxBe=lwNWqr@ Q]^=1_G,`_;z QbүuqI?ٕ|BK9C6۞qD( DqIS %!]L D;5^H:PUy[f4Js䍆U:!13\_KedcZI2hKgɬް1B@mVŮ"jqwSH3jypnw GxW##9Y\ (m&:2QԽ?(s^\Խ!&4N*ޥDV8I%8ԐZ=g,;`2rJ赟,+w0xl7m@Y0=O[] ƥ dꋭfky6!"y՗җIZBK=)"λW$W0q9xwJbcD+C'CRUuvƳ$+x#na5=6fƉD*t+EX:+?wxV٘h>~O&\iOWY jJ%!f`ޭOwϝ)2N_L\m*ڲ }eIZ_cһG? . 'a.(fdQ²2DK/]7JzGT2t:'rZ}' J(3(HC ɂMQ+`6%)wbe[τo4LR]ẹ[a51C.gŵ-L:r\/V*sygAuq;0g .6H=lKǧ/ Ym.HKp)gJZW"6;$nήOzpRn%{1DᚳIOLn   rHI jGEͶ=XP1TeܓfU7VKc07Qpgk* ="rrAIguHtOXkpGi@7rTAo@B`M- ?H2|P{GrTĖA?GpI}]X dM;kvym6şwԹ(:J6"Xew8ZeYSɽ,yVʡxH@H"  ^b^j:,q<@3@'RJ !/&bIJm3|gR?g|3mz/;UT&%^ ]Aiw[;qX!)=Rxv@8r}Vy lŸDmWiP6; ~OưQ (AmJ&!7V]?Q4*ܑ-{P-"KϚNzutg tC͐I]"S.mWG>4 A"6b6fbm\&·hC4ӑ44nɄ:^ :} 8D߽ldCؘI-=1[GiJh[D%'U u{[cafv4ȝ0ۺy1DF\[8z*+S5%Oԙ-.sDP@ OaV%|2B0HXhpi<YvxQy|WjF->OF'VkWU#Sw!fo'u|5iZd)I_ˡV)ݿovx?$,*AƆ;ԓ*s8A1V輟\T,+"Q$fBc]6󩡎2BϤ x#SYhYl!@ pX K׃= O;/#2n*R m[޹ =g.+awhC 70lr Qfbțz`f6cc#=2nfrSώWA3|=Qjzİ "VO_PJ-1*Xs (ۡ'b`ٞkg.0?׶7\#g>~2'sY7x Sr4840^5-!D+BHkR-pƧΛ~Y^A7poƒKKyy" 'ZeoӺ4{_QLU)RhyR/@YpR$z?,j(:v=`+ru~>oDp9;L0aHثrfȼC&IIԑwK[d"N3`#O=TUv(IBćeIs!"J/wAPDqvCir̯/U 63ҥ|8.^ӥ-һ0GI_ !AF=[ N vf[gr?z3Ky bm ghbƎCd'fPՑ{\tz\Fw菄RSLlu}/{ fo305>2jC_@DC}'0+  јLyIlҟyX<^`n8+YFh=_}lG$M3P$+>>wPTbh{B,hKSf4ޅߨ;]%c_[^Hz>3Bf[ږB]2X-o,C"!#U7??רljB% ]br1i]?|EzW'^yZx9 uPG~%ܬ 87Ȓ0~(hRoV}o. d!-(5"/ }~l(coUcc-9OG6 P|quzO~ hk=w0h(@wo%hjx%sC#?EĘnE㵏*Xp)(KSGфL4'@hK UQշ :)! |Xoi)l+@V͈ᝄ:s(M2?#H3A:I!  -ecHRH%=kuhFHu=XMAwi;>gr;kz]`_Ϣ>J4dčG% ϶~đ]jD݅uʹ)TLk3H Y5zbBi 9okaL>'C˸ɸap<^$r>o}390]QO ܀(ߊ]pŲyj 0D" 3 9YR+r`09BYOaz~xɓQToAFnk30N(wuk&)4imgNpc:sXm ߵJYΟ!Ero]Z |V@DO|\oA|s窄mw˛̴}p+;$|ɘ}#;j4%{<%aZu Cc`TĹT Gy=xX2/RR4 {iN! ѱ́߀˭fOqޘqH`b'Ǵ&ϦXEa)q%`7|pŁo/H帥TbjPoNTIJ2"B]-XEQԪ .*};nvl vDPFM̈kUlE ßw97|s$"sD.%ћ=*|($4YprT*f =ξ,_ټ41Ƕ^}y)aq1ZCE;ث"/mwĵH*y%5~<Ff|9Ţs"X:{em`#p) oAT;eO_K_c1=9sJ>Cd53Dh8?䬁j d{;:^ pS vJ xzˊnt{@}aN-O dч4/@VՎejFoމP=>&`Od38)āk#]Q\8IeQ鴾t$tФ7δ0v|(/Hjҫ  fM H(ofKT̑ۈRE?clV*5{Q"ㄴ 2Xa؁S#չ6^-J}HRͪmzj4{tOeX4Q-p?5\ n}yĄ3RQp{pG$1]idq%!-%, VPZܬ8muh^p@K*~|W9_\WzYIJ.G? P~K_KYV] XܒX ]:lc里7܁h!òo^ط(Gw4WkgP񓔁GI gb=D}>z!Q4 -j.g 6yuamo0 ZI 4ჺ7%B2z@F{#0.٩>ov! ҃ܶٛ>;DW84~=E 7z.$ua],tfO$'+EdxrVȮWc]QyT~n19pL;c1cz)'1.J&ԿG>"+ 6aDNX`W%{Qk9/[pDWkN3a]fM8WvB 2\eW~aw+šN1h̴:8Ç\àAwٮk՗KGMg ?)FiڵaUl{p8F#vq,O5?[BN ݁q 3܀"/OBTpckwhdce?O- |~噋YmaֈVBn*Af(ƈSUm}CoD@)Zl,92ɹ%~]lv7wnKe큢V2a=Z&d}`!FO((Ԏ#(N龍/O)P5(dLc !ؠEOMye8*=Og S#DւW"Soey*]ځ$ l7cVIxک-o\!!m Tq?A4{3?3s.k`u=Ww) L)æJ#h)(~^6N #ϳmXt鎣|*# yèRwUu{\?5ݡ<"TԸ]ѯN1^UN?%;|˰kt *"&髱pk|QF\+=:r Wo,䍡ޥHZ7x#y6.)vø(a5MOW{ >4V-qe"ֽCƗ[sdw s`ykG)]{媠la<@Q_9{9ݖ*K*ֲf~mN938~I3sZ6CuAqkV3ܞIrR]^] L-K_5ZG̸g "i_- W̪ _ύMa!;%zfm##]Wi!#"5CpQgH-V\I=FC NvM[ѝiUk/LbPPssR%BG^㢼qyt$SW6yɍQ_i|]F:_`5rwI&(,!z-+ *=7҄>,$uÓC|z.M[#ɣbu}.+f&f"zA]>1m c! `&ZIotg<׍] Y^xMP]"Y?nyw8܆qlz%`}v Pd1==(S؍OGa#Pw%55qI鷘'A/ay>[?` ,^"iH_*Eo,h훖SXj ĽfȉX75+b Ǧ6z蟂|44.NUvvf_9y$~VUP{oz0x~19lbJx*02sRjI-S=/Uz^^LBQ{f7AveZ$1T!B#gQGt+恓53'8N2Cp(A-# Ae+u"u L> eKPCC$GI M3LsρjZ3_P9[ \c*kzW=ʆBq r\2;x}c_Tݞ& /]=V6ncYT%[ 6~;Skܯ [횜sl, +5 /&ߤ}R=Q/*n%r 6h w BI E,g9Vc}(O?I;2G Wr?-wA̾FB e&bސĜmQ$:6~4= > p~#7$$a.jھp46so[u6sLtT͡L]_Z]!t*(J:5AKuhBy fԻI07wd2s^$Po*ԜS d$]E q.l\[cз1 HzWmiꨪ HYTrEUHx%S;;t€5VgL0p1Umj՚4n@P2S֯}jeKyj,ֻq8"=}{Oj^vd)&ȝ `?(OZج㱌64SpM=;kͬ gT_-T12# Y(;.'E ʼM.5Hxy혂>hUd^Mr +T'Jy>7^ڌ3->˚okk6+|)KԏȪPQKs/F(LN UN=|OQ1o6P= m5:g+rZ }j$͜}۰ ʒl[R { SRIVXXoyh2^Lx!5=+Vm\q_n024[+g@ x*`unl f GP鹮#2VhnSh UsMf|k(g/ '߃u[泑ʠ07Jg?eFV`P 84KHfmH{nb. Ԧ04 1mĚj QMsEM">C왇Q .uA5xpX]Ʉm=$q2}.[Rcv 飫C0(nE]30oiGᇉ^xjZ <#plVkI Sd \M 2fFZ;:C*:eIߵ0cM\ɐ4]mXsil 'I0Yimrɧ5h{ލvSl+ :ܖN7+^.BTzwٹTdb0Gk9'S֧듅* q;'igXBm~EKDͱx,&GE3}@NC (ruZ1=e@Pӷ0E\_ ~Gc{",m< mxbGfFʫI;]58ǡ~ v0ѷn9/P]iy)|x1GsDT6 [Q6ծA,17\0T\T_=l$ kDžJVBk+ռ+J( b&L "B`KS4>j52c=cRҽ=*JĨ܇7Ɂ#0UCB29 p`w}#lѱKq .})?Ǽ]QQzò8+<ш;8, 32/}g>nv:w|4Y WCuU; oC-|;_Mgu-j(11vTg e5[puzJ /i%j}mH#ft\؜hT6Q"JQFv*b`u ⫼o>|I1viuٚv1ӎDA,k(N`[o_UNhY/ Kj{[_٣ ́D:b^to:l˪L5QGD($]xZ|l,7WM,jʦoݝ7HLϹ_1}Wubf!5;-a2*f,;~rl\@>$ءϤ*t5-4[=%/E5Cwp:=Tz-_,jKgy TّSD?ɃڑBlJ^`!%سk&n'!LׄW^ȻݰLOK*SO301=0an1@V$͂zH8e>ׅ!v^AYZ\mB=nt6DDgՠ`bjYYGh:{)F ɺmn(M1~[wY7%.b:/fڗ_m(̵Xu 9YM ZlPQ3K!d. wucF6V:JY:Z}b|m=jݻH&խw@)]H 261Q}_俌dyx{Ags+o]H+4u4qy{3? $9M1Wm+n{O:U %5@(%[hNiA()}PȥK3g;e& FnjgxL¨DCu B ѵTRCq$U1tD; A"xn {H1l3o4ĥ.8' #LBdyZ̯Ge2q)'mO'@0L8h&ѡ hmX!ҜY &=H\`r;Ore 7K> }VPл,W*Yșd|Uvu[$o TRM@xX%q)*=|NW4,4Qnu_auQ,BȐB &BEya/ lƑ.I[,M(T 7jr!+whz91O= ǍM'$@`sM|bLz{ kSkܼ،ǶɖאD{AQ`"eK=PjIzHI^ V[-Ն?nۚ S6)氒dzv Vgrĸ bցd x>—M{ c4_M\<-~=ܜ}9'=rxUÈf/AP T64;şL\N7Cϐ i6 lQ. mfUkv:T'bܐuWo6tEucI~޴9>GdR+0M?u&dnʙM0pϥEl7&*MOlȒAN|KbJ{o7yʇUf<~Z}sPj;B,gTN?IDߙRh "I@"ia[$f}UdQ4KǞ4$,|ZsZDm6y3r9)ʾ 3k"_u8PCzʦGu^,7ZJ|eKz:{٩s܂?Dv~F7\y6$c4Zu;c|  0%:c.W+4(偃[JE l b0S0D$XiDmx?P&p!~ 0*.]v[9 [fGɰhbVd}g!odp~9S48D|~M|I-!@*y ^4+}*ڥvq&p-zsnfĠՈzY5 s@N5@ 湻MBt x¦8$VQ sISF'@h]9kƩ3NaZ/V͛{WC2PzIF,{]m({'3LGyC>2u=kx"kx;&=VʩIgH =,ug4YMa"58Gw]BGUThv^쿂bh1&V0`o V9أ+pOVlLRn\Z3 em@,ߏqP=SZQx0R߸0{8R(wKetU/~Tw2v x+HBKtG2d4 DU-Ig;өAڭnyhR\<UٴK#"zGDةEC= JUOߒN^wE΢8%2 [*hPg;v JM7Z=p'E!C2/GzRQfɹBԵ/>3aB•I6i~v.ܖL"ZϷ]Q{3W)_e'A-j7+º/YubFkCS1DCDx(I~L!{\gY?-*<2l!1jEĺO!¤R ;$Q&j-ohw8oKL}S]6>"::4 *I#lh)4S:KQa. 6fnOkzYHW:!lzɳ\߁Ddvk]?nFJSF>>=lpenr"ŚDܜZ({`*]|72sZ<9u;߱h6^FtOЙW Sy NE:u14x$oºŬKOlW^kj,HU]Knp1Rmj?G7P3VwYgb!W_Y 4Bd2&'9ˠY]{R%T&}.Uwx)0.!73XS~܀ XI}d,\FHI>S.ǀ3^8鐵{n ;XH\(q}Zdݻt+G7K8M3sЮKVMp9a _Xx3 T쁈EMȊ+#_C}\S=^,6^躕~,0*t$5qKa/\ Z/K:|)C{.m$k7OPN=vn r)\hUϚj2Ks]bb*vt{="VZfX] ScR{Q%`WvJ٩M=5;CfiS}@Er2+鿞VS`E_Y\dj5zO*qr~eTI?b Hh.`agrrmW# m.H!`2<"g#.m1gnzk.=XF݉[ fUfd6a HIRɈ"rCϟ 3;QPΪw,|W7 /SQ{,V3.{X+i>=cbyO(@bfu]&}k=$qi^CmY1u]%-8ðN}qϢu PA'[Cʓ8ܹ7+~X\˭r urUJ8!~c2>ڧGtRvLo,-XT|O) ץ%p_lxn#1:|sӨ,%JMk>kJ7޼snu!.S'WhtݳS'‚i1wA337ibi~V᧤(MjQގAP% z8@Ѳضй$sw+ TRk~2ÎMpqj*%+9 D,V9(8k3dAŔdALw턢"=#Ad6$pCگMӧd-%J N?\:7Fsˌ"!i9&nfudji?<\2~X0̿Y]ةwI%+ ?YDزZLIYɩA9PvtaIya Q $ 2}l+HLtnw@4k_78 >=t,̆aY֨ 2|\fxV+FJ+S>+rj JY Cqb[lc_t8u}8'$f TܜsWŅ8!DYZ#ZҰlx ą XV=l S[z246MՃ0٩+GVKd/w4 ͋|EלKx`=𪠀$Xf&]H$;W.cnj,EC湏qһw“|ډ /QRcA<5Hyُ^"M]B~k spby%K?Kٹ{$<6*]wm"dMa5[1]ODj"7(Z\xUDh.,EQs玈  c 2L^Aw/> }6WMv\vgYX$*9~{׼B[x8JP{`rem;1J>i?1syGjNrbr[B>UQNvP%APDDA ƒ&F!&]x/-NLw 5}콜\s#bGw@-AU/?Ab>`VW"3WQ00QUY -.-NnG| 4&Տ ,wF oFA$NZWQy) }EZӽceїw/=K>|³U \}7y5iNW:&Nx}irofѠUhiϹ U# KOj_[+u<u^tJ1~wlXEb65j):SfN c LqZ?gd>HB#m|EiIzBdXAWߘ.ׄ>C"\s*N$Ysr4*aw^BA;7%Rǫ}=0bc[Ё9<1fj鄬UIǴ-:%_#d eqSHf8Ćv/dNp\+-t9#i.>ΫRFى^<}y'PmjC(snwhKƜTd0O 礞=0-+H>J|[=uB0nj?1m՟w=Re~'b';XH-Pؐgrpmt?# R#3:#(zpjNYΥUojUz\ώ.egdĀ0< dIRE/b0bcpښw%/z:y]Ũ6̳%X'"xKX7sJœ2imsGpETU=e l{64?I(E{0H.@Es2*0.`> =dȑ֚GJE&~lpRUR"燯ߝq`#TNN.>Rw}T,-3sW(2oLS\~^{dw RoS# x-{w~͈kBVO/F.VcUA^*`rL4GEcch4N3p?[Plyk3-ŗK+z?}H/gjУ{ Ih]aM!Xm'o}bԹS|z`O vϸ.G dtثDQn0sUܸ~>2KdfffU<"n]`& 7h_ȭ(ưFʔw"iWHYGf)c4}QǤ-׆]Ru_ d7cylo }idij>,C/a9]Ғ%0wjDi/RB.Tnkl20FV~D{ "b}mA{K!N8Yfˀs*kD7QuRP +qb@rx7Q[5b*3::#2n)v0b,˝mX)_FU_?N,>E{ȳAN( I*UiiҐpUIN͍F({Y]}r0@7k/&`ުJҧ{y vɿo|D_> s'2:S')B\}37[']pQ\q-GRsi+EK TQV/7) ZYNC"ν[QuhH@pskQ9ƃrsp<5ژ.Y:\ SR3H:lVסoy6a9b?h1#[FM7a O# {a'2.A3T[ ܶ(MhBZLNQǛFt[iA+w&׭*n/ D!c_#PI6ʤ=k$tbX&G4Wa(O_+A$dݰs!J"PRZ.~eb@kfHLXuɫqj+l3(fś  _5J,F"Iz^AVpxS[\li<mBƛC/ ^x߶rCa ͱۃmADю]_m3#}_X檍Gv+h(}Ꝃ0}AC}-n3(T5,˞0\aD>Zj*D>t=uX\7Wic~J,:#gpAbQ> Z05jj>V"l4iZE*;Qtg"qCb؊eȌTlG`86c&:Y8-Yㄙ&l Pԩtzçco66jfɥq6x-A AV8i%?Un.’V1V] FPR0X' pIy}.EjT)`YZ);ijW|enzNE;w(VgkdE Ս Ӈ% :W0t'4]Wuak"eCk_|B]YKWYn1?%U=HECfWA lK*y z8b9/RW42kA@@ lr(J W,n!e!歘GGYmCAo= ?RTEej-Jw)3VbZdѺHѦ&_8/X y!H]ңOZ[`ؼw gիdk}ߤ&Q<&0CYS ܭf0tl% %`FΒ\-握7HH=ҋDv+eQ]?Psl^{c'Dxi= 0EktǢsWQ:"ckkBļU0ܠ^wt]q(']?[gW8D 8`2M"laZUb޲k ufj۟#6?1fvH`+)U~.^ D?fTi({7 ^c4+[tJ<\XR{w VأaT$O7bf/wVln[VUC7~^BɈ6D:Bz%oe($M2fr 6Ciޭ&ѵ/޷[: t+ՍkIO9(E0H["hk^"*W y}39ڃJ&BTh紂 , g?ӣضvwNCEFw{K,~?Nw_x=1OLG1ʨLh45sIH2"͝PM^,xa fE5NHLpM5t݊7z uq+(&.wl1tK8Y[Ltv1L\n^Pr^l7_7Fe (/pYd :7`ٷ&b2ew JK$"ϨtPzwYN+>J=ɠ;I1}CM6uPrHL)R5`$qea|8d|鱁k!󗷦ݒkx<w~t{UDɨh>Nw H2{|͘T#6!,ȗ1n{'#/?I <6-ȋ@X4]*L Qqrd3LHDOh2Zj6ŷ b!qasIde<[\b[x7ΨorRH_6OsAَ{QIVEą V9/-VƒpYXA+] 2֗.rULSc:㮲lXR,^ 8RQ&!<|!((~7Y&۬Juq[ۛ5cO=rYTaD/Jv̘wp F,cع@|8eS< H~dL_ߪk}h$ g m3?sҞڌ k%M!?pŴ3Bk纼N'] w|5e1XĒuDEd!SPI@1Z0hM~,ա5lX _Ps"6!θzji&Qп EEdp7!~1~ >'Spo꯿ hP$- wLmpَAeN3,οà`wE8Ԋ&cn1ԈǕ~$fCFì5*w̷>z?SLūw|b6zUr Da|7ǧj!Zy̔XB5={vGtB4F}J`)W\b/ d5WK ړqi<ʌeSRqv$xFnӻ {`O OY¥ZO9lkiZջ)Jֿ17eDaJ.*rk,N (gHDSq\cE:|kZL,4Vttd@<ІlårRS׈^ٙ b.!NZ'tXGkj&q *}gC3nGY1N-]?<4xv,ĂDV8eyMWx]v474Jn؞C)-"X W'twtu4"dM;@rIiT@&.5/Ff2(K uQBQK|.qHc;CDK8.r@Mc72vrL+/`4AD⡶@8߬`F 2lj)A`X -n\Cw>3yRf&'C&| |˛*b0g5Aғ4RHg"GJg\s-tV7u3߽H% N01߇p7 H紭G V<4j\D)@s] 4Z /snxgX*嶺+BDx"kkFM3WL9ؔ[ o1=`>;-Yz4 PLŤCk meW|6/o܏#ОUp^Æ#y-W T񯘖!P8>Re쪱qv4+;,ņ}0V6ifcAUdeƎnpg Xp1Ad$u,rŮc Rg8}{dtMozH5ea@_#P ʗ7zpḡ ٹ (ƤYP KizJN\۵ 77w rr$"#Y*&Bk$t_(ɡ(̈q~"W3HHR+R?(챇r$v8J:&WU9K pm}b{H8]ǸM,?rΑ -^CFoU HۯZ I ,5>Ti 툟{}'""@:9,J^MwU.n:@+hC-[>J%Nq펻hy jER,$Лs[)INz+O@UTr7xtuL欇8Z⃛ϯ{k~2ZNk 僧i^|T*|{2(Җ7mz{2N 9G9%Vc;.a?&bC~Ɏ/VDVFwsa!vpU.`3k_ƴa9߆BɊh3L%ՠɖ%0]0of25:aL9赂P,;m[&n@8jꑻ*B?N].K)muxm^oȀ,.nxДLzNطvh /⩵]*bZ/ ^,7LH>g$ԁ4+EH70&;;L:#u S3Z.nty@݀R2Cl٥Z峧M%(.ewIW@rē zj.yd_ C@bmjgCrݦ)CJd]xW"|>UFv*zuX޳yzN{岑m7ŔtQ&<(/pw 8ٳ8t|yk~B䴋+Ge8P$Sא3@§,|+,VGj B=`B}_DJ*.0 DFJ!sAt%ZHxp_NMr1},JQiYsv~ɲ]%ɫK z-L+iE(C7Kikm =[*^r  VYAH1 9]Txw"&DSk.>.(sCk8hw_-_/s vN uRpbij*q[ 6$_.ROA 4ͻQ鄝<$ȣL6Ъ+!o0€YUK0w? *ACM\Dƃxp΋S{+}QĦbYb/rUgOqO-„("'v7%;pCg2r[n5/yY"8w(IFuҞ$@Xt&e{q;O 1NOuv=&U)Wb(w*qЬ+&bm+\w{ìy3>)ogeZUPL7|-<ﶀ1 ^OֲwzIiGAlJj t~dIˁ&ԅ ~z4і2؏"uDCNGpޛP㝅6PôtsтCU54 n_My0#;Fvڣ+cCN*ivkIC]7~.cGH4T^'6Uʵq׭()H> GCZ_vQ4cdKO *W^8 ^Oj^8¢aA9w^X%+V[#ŭn#(K 7yYj ض2ʶvV#$1=z,|С乲h"˒ *o,E`O7Ot2TѬN1Ht!ԏڤ.=}Y_UrhOʢOgٸ;&ĆԞ2#;fA#;ǻ @>8G-c(!p>s܋U !D_a}KYG)MT MC'rxBS?CfD2RBSI؊Gh8C<%wq궒 ٔ S;ebUs ED||y@ /3=%'. O+w-HJjp]lU`) .^ɰ T&aQM8$4s7 R;8b̶iܸ&|Ip$ҙ6m=CVvۦC-J6V̆H h9>ԼRjq1b_s;x)s÷sk հUݗg8 K bz.}2y -nmZkZeɋa&?4%Dedh{z3P;e@ C,(),5rPYo%A/Kd)4(OsG5S4-|orKXxAd(B|r|5/Cw>ν|y辎c;=*5)v5#?T?[2T!*@F XIɟ;r*&8R4$rRF։>) 9I4Rם[Yv좷CK+,tsb~Pu, [Xs^uA5~L.3X]WlBvNكǾ*{)p?Ɉ_*|x8Gm,i qŧegbdm%1į4PsICB <ٓ^g]r>IzUab,`Z=ܱɼZjy]A(FڤxDSJpX3ÒH ~ArSсogB;e籊歨d1&%P(%9ɐMiٚ5z#w)7:c7яBMfkM2ҮF5i.+ɒw*U0yM %jF~0CM⩉'$Oh1.5Ya}o];]~K|k,%13DitM M-?_g fS.ߺO kN%Ԫo\GѢTR-}NǮ_a&E>@HA"!GTI;>e sBu8ǍԿm@zUʛPcdIxg71"QgRb6.y=D<Pۉ:^͑+1^hL P+)CD9֕lSN,>&0mسLXA̟ATx&aDuVdGUÄ2Xgn$ԏ BzGĄT6>(PR5j@a._tL9gA}:GFt'AEׅMэHl䓟;,~Y@,?ށ_ Fwmx_>9}K2t'pAb I"/F9xj$>^^\B{kXu WG٣ha;|,[!4͙="7S6 #JN8tק<̄O̞DGdzgHXVok. &kR27u刦#D"4[`E&X|n҈*0Ph Dt?(D^dOߟ~b{&,z*ⶻ^+8\hbV`TM;;soil7{ˢX~-MYc31ֲh~CHp>\epFduJbwGsBXo);L{WjL ](]ǖ7\VL寈9?$leoYb`mLa#T~qjbgcC9 412_;f|dG<ؼηUG&а:rl-s~OkMI˓@m^Ng3}>F@&AZxWC Hxx.G^G?nbKf@`RYَ $ 1zjGUEUwTTӃ??dAh%F¬9fC(҆ >Fa^w~RbQ.oE Yr05y 34< ZH5cbYj;9[37T@.)Zًn@5-jBk4P6 ]2)Y nS2I-n8$e7 Ì_+D灓! 8vH{2Xޗ D c:=7qHy()p5 ?8D>)}_G!mӻH,@s5ownmڔ5~oşM:Ѕ8 7m=i,J/3Zv"DN[xAoEn97a1Ǿʐs|wc< $86=j^@/pʓ_;_V|Pq`J"gx.T%; 7lޔZB`z ݦ* (D:$Xq] _ϥGcqԛT⯹(HGgy x.υ@^ȶK Lӂ^nxccY][oMhbl A/U ;pEg2ޚvJa?oe (UɃU@f>V3cہ!4u`6jPx'́F':p!u"B~-s9Kz ^nT.aW2UןU1+QMRۯ!{%/g;.z]8C11aD2mBF؛0(dhXA0 \G!]sVٜaqϡҭ -xC,@8΂oC[/hjMeb9̃t7}ް.>1(XR|PJ[؈r/hkxQN;7i ` %qo~ 6(7ip)^Bif:D %WEC-C Z {U@9=fVHe#O⼤(= rZV5Cz:ꄟIH(3޸LWm2Y?N .紙 \!mjh`i}#]?H c̩}06ʎ7uk@Rc!Sl $rO9>IE~"z(qOB[_꧰nnl&F~)rdQY)y9׆?:)pBݜ~⥇0Wԏe -Thog Š C6`-e$ ڣদ#Utڹ$"z]׏R*TvQx $T% D.|6Ӥ=،@WȆ[h/&z_࡙.&?x2kF/[_9Stp3k2xFUrrWvϷh@5̒7c*YDR*Dp#1OlWڨE]uӄg&{;.@Xy&!QޜNtXiPIZt rh# ƾ}ƒA[ ۙRYهI *M [03ʱ0Lޥ+PjM|bHx8qӭ#!H4l#n WӉͬIE#G8fɘfH8 bb҂2Cu9zõvB)&8 VȤT# ?FHa3'uŨ}bzhX?6MYO lEm`ہCoqy/~x?>Siyij! kx!ZiHY.5>EAe!afju|`eu$f="MU(#4>۟fX̤Rz7|oHb4+]4J(x #/]@St#Fv%6CsDjysXSM*qA~#3A{[(&J|@af5{a^e;˂&57J5-?+SDң:&FJ/ixW_yPlj$[) P쉈dVx)%8{#M!=_: ݲmDdabZ@AޡvnΜUq Ў>L_Pz@.1?K=ɇ f /,[M᷒-x;߭'"縁ջ̤> CU}rb׹-$a'݁c6}+#e*vRxTs+grtYIsλOtLw U&TF_ }kvQd_Q;'?e'Q{($7QHX#@Վ~d@q'DTc?ԑux@>,:e φ5+w hc0"D8E63q<]ؘ.u$?Nf^A': X!H_T'E#ƄK"jԺP {: `8wtEjm֎x9XYK##M;2FVҋl^Ԅ~s~9RA<[xѲ J:\X̩ z2u%a__~TU{BBo)&Ɏ*j,nɡ\7/ZU47cPzzbGʮٸ,>o(us}yiZM8it$ԦS7N((JٞӯP/w%spU_١\]TA}Q:ߢ}:^hf;B+ģ3<&w@F(I+fiHj [o4͇o~2o0\tm) V'QOsA.t~[HMמ3Ϳ=M2zlQא|nC U!IʯiQ!7嘱 ltC>0x(K97'suBp-(Jvfa閈.CU@o¤)7T9l\am=78a;R~I=0G_t VHВXp߸~ xioX 9mެy≞X[JVQcR=?@|w#1[CoXQh:[Es+ql';e63T!շ]9* *Z}tz6%QT{Wd(e]k-=b ^S|r{oU?f=)Ywb>w7捝}GjHBnMҐ)y>Q_"PkLPi3VZ1d'&_rk\w 뎠D Ld<VW 3rvH9l^;f!rMvKU>Lb"|H=DH8N%Q 3ak?VxVyjb(Sq7$-mJ$V7qDp u]R=nY2ZE3Z t?9Fz߅SM_QbT3=$pɪbk(%V䇒%Z143/tCTCmҺ R{P2,LK}:AIH_gfLV6,kͽ҇o%EroW czكnM!]\퓘iyڃas@&ӌ󕩺<i39 謋mWcR[\=1gPF"|m^4Q GQe י\Ҽr06R ZQ&øͯyuoUT$eIĠÊ\c?(p )NSz0<AsRO]v<L!{︜2%c g,;5?,ug9إl?=2zEmכ<+sT/[JvY6#5e!;Reje\ SpGO3-OvwT5rf!rǏ:.N'lz^ tk!趫_%_ㄯX5аO #jw1)/&ݝ `S Lm!,g֍"ڪbe&42S<1n%3!B1߬ewN(^0I n$ȝk,(c{:JP>;# g:"E܂eOJtk~gq'ǠP&6L,6Úo6t=G4f5WC%M Զ /XtT1[] X|mUX=uqDج&VQ:9D.)@`6pBMנSE3(߀*45E"{5w)op/CfQxk7]k0ů=T0>,r r/\ 3B-}!_e9n f(fQQ J{ }{u}f7ޤКPܮxGiuKdk- Y˱+!yQp\Y%lmD/_[לx,"TP|LkRQi66}  ϲ@G追NdN%*͒{J'=ZۨZ N0"weM8;]υsn3t(Iwбli&R  l4'YH+q)V*~H).+Fu4؁p&]uG솵E{8tPeLkbF6J=連weࠃWɐ,Jbۉc?R ^1?cfڭʨĢ/6A6AZ JNcBsZBC@fk4\Q/ N/|˦FXr%Hi%5v]0Cx2q3ЙܷKo3[˴!Ґ?9.vyS2_໘땦h~Zx\JPvh'aF1X|J:,17KTYU t# =K/L6e;`8?IR;icTWD ٦7GL/iy))iz0E9{}얊@:A\IbV i^z([k+cOns[+c\!_J}֝"g?Xk<ԌNRdqw6M3*{]zv#~Pȵ`/.HS?Q%[^V:< ?B1wY,T͍ptԉuU2+e }yS:@Z1-AJGEN0{=r5 Wk'ycC\-z)Ֆ`/ƺc4D dō61 z})%dӡ_9>Mtbރjr%q'_}%ӝ4Tޏo=8@G/.5 =t d.x;F B.yх?Y77 7#)Efy@R+P]*G j݉3JW}2ai!+ _9*9(iҦ{ݟ09$DuܳP}aF/3L)(yN}KIy@Kr>G)4(u:5?taM݇jY1Я3NqQƒ\<lRј'3D_Ǵ]dta_.c'Gc3^&VPEYЖCh LUSj^ų(N r~~7Ϝ$OwͤQ_V/bsHhK*Oltu-9iU2w G k:+'0Rέ\LEp |*KL(I&ϒ&{=z*w:SBoݔ%nB Y"$N ,.Sx6w^ak "{PV)2ѿ(e: }OoώTSHx4U ML/@\VCk@K'˫;n&st06B<5.@\<Zo3X<ks&E*#/Qc A$]ҭmOg4%y=Eyp)M%4 KI| մwy5%6ե!~K_.uBz#7.n1.撗tpY?1hg,P*o8l !ѧmḙ-iЛ5/c&| CY"SNjD pȄB |KZ+od=F0]D@3dMw,<`4B]f̈Bw,lw@.e]קUOv|~ + 7Q˝vx-`RÌ`~zapelXPG.9"9c $2"ecFď$ :ZsCj=a\ K<l{fg龇j7QrˆaJU)}:%!8+6BVSYB_qyp _nژx2|a73$A".n'\|P(* -I%j!egv %2iG0C3=fxzo~ǠȽxvyrL$q7nzx 6i Z1Bhzm$guNnR>+B1{xUgšt?P \)5ϭa:.@P5o6D+p~tRxUS9.Z=9n x.L7D4D,ߞXV>SɰEz@-0wim5E)n@ѻ=xoQN\k7a`jҶffΞ%o*)߫vTǚOOYp`̪=U󲼂bjd :;f@|>4# n\8tCP@ Jٷ(-rTuuCrc31' t(y_/Գ$΅/f59$r7pȴYr iٔNAf\ @b:%8J-Qcޞ1[{*)w5"vWtP]Ƌ`*u fF{*DuaxGpRm@y9mu?k BgS;ݪfCXevD!zW2m.M&XJ2=Wl*?Jofʿ7BtQgGa05UhzjZ˰.-4]tYG;D Վ|hԛO[Vʰ@1WWr8Ƃ& zڬJtcl c(Tΰ>j 03vl}+k%֣5j ɃȼƠQQ #Dj,eåR7ESUQ{_d(bpHG?^xhժɨBwb&[F"äaH;f$5DAb)Z*)YElMf4a IHcV{A.=,DfѾ3DzUTuj+^|Tߞg$EM#6WUĀ}6e\L]2BIw%)qmPSwr:ZnP4_gc˙9C4.aȴzH .R'8l=?JΟS- ۡ6wQRJSȅ}1;F Hޱ<;9ŕhԯ*!hS~"/<l h,IW⠬̰vb:^ =ؠ%2op=eVy D@y>b+R#? Mc i}+<Ӟ =SArtg}SAS9n(WEQSk = zy:&t"aGYmi%YS2=?]NVO]Āx yUtى_6,%;?N2'c$~ѺI*p}Z}~>/y=_ŶݵJVBd*!݂ҫ/ հ3\^*TP5875[-l¶Z'1A8ԵBJZFA[:U2u2Mv5FA~#M(|:bNV&Y,R䈪 hFI (}о0Ak(ou1De.0+MT.P97U:t~`Uҟ2n{""#߀]X@pQ24BC2m+ tQ>6}1#kw?I[bR|}ѥKʆoo~ V[h}xX@-TQQ4<cq̂#5/bV(- ^݅ Vl{+gQS.FKv.%|ѝz=/e4 XwUW%C*VxM[M( YMVi l?{9 ߨ䈼Z]wX*.:Z\>Rz+fkFȏ82uXt4ڷDf7M+g`I[ Wn(z)U`O@5Z_Vl"SfLʝ>D®b缥ڕ[òeÎ D{5?#AwH4Jbjgo!MPUܙ 1F-+l4O$@ ӈIO7eH?9hsI _ }8)lN i"6Pfl@ΚSu,*I[uOI\V 1G]3d@*G?%TDY dݐ|wGr7a'۳P)?fiI`JKDEx B|#竬稷Յ *VGIVA&h`ո"(b)@5&}Nq2qiDqAy6l=]2Y+~ +Mٙi-|d0i]͟F;I)Рڈ.oΊfCbJſg(Iٓ 7GSϻ ܚ@gL #2kNovVGZߑ /]F{XQ11ktRo@g!j|?zfKEΐ>W47Nr\sT8?hOq.!d7ՊP嫈*9I+q0 16(a; as3QݳߝD"[])q8|-<2Q0:6+?NTlMX%+bZco||mD#>mNd L _ 8qfiCRՋkYH6k (X`l) =5[' *XmNBx{&7ujZ RG$B7 )2[-|n{Զ=HBnTt`Ð"V7Jwb#}:Ky*#XQ?l ^15j|Hx?XR-b>5TH :7CثAG>0>˶wxcErCFUa&- ڡ%ID)QB.dՂ}!Ľna0gOȂ?[ ekٛd"λCS}ư&^ U§G>}(bIi?>s;̆s?`M]TY"9.J*a:3ʽ";rvmBSQ򙬇bJ__6%k0(9oM8-l{NHGL#9Y҈TyK `~m֔bƄbT]0.hpB}yIƳ~3!- V+0b'ȳf^vVo‰<^U ^4nI#@S=YeU:uGE:En&ܲ.TOv-_FskK3YAp,i&5]7(%o0))IәW罯fa:6LA`HUդ >Mϒ` w\6:WW%۾$ɩ>WvNDOMKۥղЕ檖l]hq@'ͼu{e=:<*pX4:}S-ŷK3Da0P4 w{)~]26ÀYEA4Z9nV^MoqYUʪy{mI5?@XB}KcNbZlo<TŚmQٗMa{zN)ACe,ܺ"'XP3v U] ztQ{_xoǖ8$A¶Fly~jG_Z]$MHO$_v ;LZ, Jju:`]UU`ZOIoc3pUAx_n/* ZǙ&&Ws]MZdoN'~a@ɺd_J[4]=bK62a9A耤iY@6ȷ[jElgY1V ņߍ_F.qu"o7jX5Kpwᆞ>lJd(C,G<(Wa@( '۾V݈EB y(b">ERcJ#Z~'C%شU%?*n1k=2K^1{7t7gSz)֟ tL({#4L]̨ZV 6x$le0"<'LA>GiGYT! 1͘'0Z ~p^  ,y̖9sq1`]c,@S02!++M2L`jn{j,R}:XH_̦D)y_ٔIL\,^2rv\Ӎ?[K,IL’F?\˥#C _dw'N^,z %ceEP~nޮ|1{0b3!Go楊^aG P'D\ULo{nmzY{ p{y.&#.?$S<89kRc4HdunɲH(8Czn!"Ζפ;@vt=$Ffcp1b%)g^œYTs"Y0$(mn՗KEnDZx.-lTRZYH6D o0%0 2z{}?|n0C,Fzo-+?f\oޣ 2[ r|X ]%S"85I,4 wb7LMl͐TMӁ⡜p;gQm} "ݢ#cOx6OпZ]8n) u1F,c\۔?0~`e8ÞX~8ka$|7ŗ_w4|:iVvWM;ҴBiJ 8)E/ _ ¦\RZx^M#yKibҟu Oۡ(ly#ާl P+Q[4-cE=x 9j$0<,; ٍ񸤖=2oLK ܾ)8¨ `JSXi:EjI.FTٲFh1ڛfДMjYͯb4;0'AM:\[YMYUXęB,  @>TTHtzJ[=ucZ@A/&6ҏбB9^AjUJJY՟]  6LZEy"a; :;*\~13 (JdKF)p?~&4 )T&]iEuC֡OmWrFZٵEB 3e*JAfv* .`oGAt h, h']&N %9sXh7siW͵ѭ ҙ%tY L}`n>XvcF9uyi6;<'>{k8/ dt 㹜` N҇}\Cug&j4`>4`g$G"daU})-, Mg;RE0He2lC:hc/r6(@E&swsoO"7ގdΔ$τQ~js|J]$W-? {DĖ @1-:cUs隁1۰a 5n iUdz{A:sS&0(X~Cxs14=e󀛯qxBU*~)D܅s~X4q Gxw>XG1`f_I!c  HkMjD'&"*fhS|/Ոv <.79Ez{=vW !bs)SGiiŒ㝎UnQ'&Ό)aesd8#db{o9~ BZ@@4&J9]̝G]j*jFh4$xF\U6z:#BG@K-/*CƗ[s~0&ꨊ/a. N})n7.K?x lᑄ9 __kOQtY#7p 8`@#R3 aW9bE`Hڄ0Hb6 gUh@O 9ziH>9HmsrWb:f~{ne2TVQ\zTP0eC1=Ʊxp(=5.)d-UJ9VXQ쾬a܌9!zS"1|}E9ZM~heUZsA%ٯ29n'}XL*_eP^N/H &7eDU/Huoab rMuPt}wh#hbaѺe4,_OTIeb]ssJQ7k$fr^gE̪lNLWr&a*ypf2)ϣH$>ci%k5}zθ/σ/>]/F0`o1M2ߺ w+ۂ{S,a 3Xy H. oIG)r_3W ;jߗaQkeJ-BCpvP5%U:?鉌v(D!U]cM_v%amz;G-H~iv@nhaQ劚6'ytI)I$3b7f( ՗pn-/x:>k#j7[ۻ0Ƴ KL |7h??:+wcs,CYim>l h4yxؤׇu98vDW}v5!$C0s'`g01h9:}Etbѭ(MDvһ$\f6SdXGW)ؓ;n܍#I:6ba(\X@C TĴoȗ>=|~0?EajJOǘo.\1U)o<`.ǙHTeJEIz0M$loa~u'^rTȩʗ3j}CIàGme Or&zZ-V=dxi֋B->e_D<9Ȅ~1 {¬Z]m@M]\q~7e2JLScȔTPz}x8#tC_C!&Yf'ԠQRܨ8rfy]K(VU&p 4>k)o=64+ RbPA͚`ө}l2aGB>zx>e*.ǹ¾LWk5/ZgKA$:/lqMv RolT6r}ͷ6:pdn@HQ yZzäpI,*R345v}f:ߌPff(3Q f`p?:79a~nRKrRIyʴ褒<س&j9dW}egԢ0ڱ~)H_tMc3Izڸ!O~(AWHETԿX~ w9Qbݍ^N--l^ƒ`D7jT_vj ʛ޵kY[ܖw$YV=7I>>' %x:vwV/*Ugg68V& Zߣ`#W5`KدWgOXQWN;rU-k#CW_ղ凒 yo8SGh33V]y+JbƄc@DR&3:lM ^ugsDX>Fso}Z鱇OaMYL8Hqdz2 !?~D 5Vbp~ReJr$d||1TuOK$ (~|4 Z.SE᪺I4im5u1ͮy܎X1*GMr\ %H"9o){+yAB*hZ $E<{MOgmص'L)0)&e^' L1 "dcn1jܷZw$kU/~Z&t )0a7xbmVrMY/|sȥa4eut^ck,-B(A:9},hqF$P9 ę=6@P?)z~it+GGX%?ygFH3_^LArѵ}fl"eG ;BdD~d[! 5RrYDZ(n`uM{Jc(\ |FT~mběD_[pI2F538DCC$c6N,yڠh)v4։߰:N Ԙh(zv)<6#6>rԋ/ŷ~[WF|mse$Y𾕽 m+D储P˭i, k7mGCD* !`D9uE,F,vy7)(-6`[pd$ ;[!폞pc`m|baKՊ`-BO0>SbŎc.j2kBHBf C Q^@ H1c.!L.26ɫ.ػOeWb@zyH0IJs,\解ɟ!d5k]bSdrl7rh SY+`W5 [b}:2Z^uHL460B&(ܭ WX Ŏ\0)֫ۘb0}?FN+4:I7%B wqͰ4#IцdVѻ Xϻa,p9cf5A^jgAG߈Sur}w*N+WАN5,nwwvk` :>.wj v*\P4-)1U/˯j'_!mܮF|UcOMs1#KK;7Fh5U[}%%6G>Aݼ3i$>~&;!"gQ:藛cVduy.oEzbܔM5aPr_ھu) xoĊat{QR_+>vg9,`呵Pf×7[ 璘b*^şvppp<5|K/J^$B^1-YwK뺺!tc X7܊oЇWV046wҜȥ[R#U Stz}< aWZ`㹩E:+kOXQ'5t4V_}ڐ02Gҁ"0(@f"}†XW2b/T˺Ejz/q"4>r_Y|x稽{)+K@RsOky·]{uaI!G)aL)jh*]EQeƹkD7ՎPz|þ8YLpjB0BGbBw!rNaG5-Gn|F# rqLhU`[OǶG*$ӟ2r̳ rt2➀Q EJ@a4y0r;D.Hn )z\HSCxoi!00Nf#}?j^ խJPϝI0f+;usV$zAB1~˲b7 ڡ@eMBR'daKw4T6JVAJHTϡ9TBNPP3^z<gjjxzqi×QE,d<1ZHyCĎ ^ DlAeR4J4e@xDJ෿9kk)c8˅W]rmv>qq3g6fswQ }jPV2 ﴩ-tIy=ޓYr Pr[9xa-X^<P7֓`5+HHw5ZIuxm?K]R%ZrzF谳6v*`19}x,]fR\>ܳ Y.8 %eȇ>ri&CdǾH?'(/(+U'|?ڒ߄;ZRGO;6} \WMw JYU`VH|E2݌?L%JFJ~*ȣV,<PG v쌇Θ/nd N1 <}m &SK#&34 ߌ#1=փ|ZpcC0-ub4#N@mrJ&V5)]BWc}JMfj$*2ĩ3bg94sE _KBb*߹Rv w.R^x(*E D}% 4L9wA}N|WMB)l+82uUXʸ쀸֚[F|c8|˸'*`6F"H3^>_pPkdI`?QǷApȷ E5rӾ\Ow"£>9î $'qF&x4]1E*A%e.tzoU 5n`%HUj!)#xn٢/=iXŲj"L gduU42P3AȫHfP\1W[ܔ"uE Ϫ X h7ꬍV&:{N -3 wd)ү6 OYDGۡO۸f8l`Հn o$RpQS*^ ]'U1S p$|`R_/ $;uŖj>3-"hl ;cXbSbB<8mQP" A(ǩ*y.d*"W{(`2$( h4ԬxesبZf94Prw) zwǰyD?X#ܧ7ݿw -4;s&3OFEA:-޵[m罁/Ttj;C~̧̆HdՋZ)c>w[@ڐoTfi؆ٷ -Z-Um2BsrU׆n-2$֙h u5wѡLtsו{?ѿ tc^D9A'bc 'wr{:V/OFz9Ṫc8_ ӈ)b voJ~dx9L#-Ff,Ef~B?>eĜ/?^ |_9D|W~;vBРh, Gmi8S(箾p=-4 !T^xљF[)fc ,+gp_^V(N4` RiF,&1QcM-A왧JB0`\dh[7 `uq~x ۣLGPTWXD1/ 6 Y=0xوd&H #ȲDt3lܸ5l&Ȏ?^]X&3Hw_^j2Ê,H@h-=|(n elv직VQ{v.s∭?dZTD_Ɂ) u6sg&ךg{17+O2!$IJ̎3`.p{0 !K4dC$OPT#4*A ̧g$Y ZqsW Xl nCK@:i#PP q"B WkMa6Xiw=R%L?s1F՞- 4yI(R=tb& ^G"P( t;`s./%|a~CoCZ|l/Q9pjN1u/lL2"+rCBw!)G2{=?ȸꝪ{f!NF%a*p*SFt< N2?3G-%kJ{ Vxʛ'|G<H_(}XƩ|:7L2 t cZv14$89wi&nSK nC>@"ph")~">Q$5t?Pf>VؙRQX%[5)DH@/YV>+73Vѧ f) kF!-1QQmLr{YοXzq,x9 SZ@⾻!>VR/ Է)Ղ m'JsC_Rّ`jSj4>^Qe:=ude]Fc4'kg&y<il4!BzBW,\9ch/* Z+~ӓcKUD%'xo#:]\7APu% ģ2W NoNc4 43 ]CO㜌hYW&2.eEdq+am1[f:ݿ}:L.|C5*gu|aCNtׯwA"m#6}>W:e 5.d&~D:RR4O'B'A=sIJVۂ`ʤbʼnփ5āoer3z|nBH&{,B&a0mkKԆCF@蹤ٿØ]L-cqI^B~x"=Ys: `~+ Pz"Ru:9B&{ (AE 5Nz \ڑAcD;nqG'\kCw4'G݋ ư %(DS]~\:@k ƎX@9?h@ı`_VKրX%398SZ `sw?ytQ8)!1<G?/2&nsFt{2eiUM6QX[ wLj` (?#G+а;6]g$ M3\v|K4=UֻυSoz8/_bJ /N$4 Jg,{U3I0 I{a5Ʊ&0nwZMgbT }sQ͘$AXPL9bI1o%w?{Xs>]|JΛ!k}׃` _3 YΖuܵgvq d zjU* 7.ڢ"3,97̊=7觰ZAbxIP>ߔ]13sK8ar0{&wo!(sr^*,{;RLΗ 0>z2>,~: \~{+VI/Hc{HvJNKTd;R,Jˡh j5 ~eԙÞLU1m8Qgq>lT" ۣ+.\Ɉ&%)%ޚ27D%x.XWΑW"%(%ՊÇ GaH/RfL]Zk Ч|AFF]Mh>8kPI1FɭR; FQU/$yY}8UP.J*se"6Ǎ+S ;眜q$`-938q;=F3F  ZKaC?kI'CgNppb!_5pLK!VG(#:ܛzRѓ2}(op=BexeJZ_2}m鋄Gd3%d ,Nb5VZ/}LW|Xև1'mbkIN `Q:w)4hSjq9ސLL#m!TJpiEՎu\w1]A+橒6u JժD6h,o1|x Ha&n#BQ;Ǜ< -/'uA8Ym knɉf^];#b'wKo~ -V+LͶ7q T61;kǶ)_EJ}=7ؕHIÞ;ײwDہPfƔE!0T07ofUd3}不l噫=ģ=$Ñ'XKzM;X$(,̦/ b}YطWxPT8X/1c-%?+Y2Q_/j85_dɞV,Vw!u?@ޜx5K`Gh",7wBJvO.䁾? &kup|ht_@HB2rӹkG9tոyj'P-vykvYof'غ["8h^$D*lR2| kؘB妻@:f8.׹¨Ŝ4՜w$fqvHXDg[]n}ݧ!_ ^K('2dO>rv}EtUk#\lp"M TQޚ KN`<p LRFMz?>7’́rUuzfl 秝tyA`F~oɾ+J(_2qWl;!AM6ٻԭ97B:Ek6+}8_wS][b ]؂fx+X(-\EN`.2n6s}P)zV0KDVh6v^VIv3oH;:iAvcڗ}㜳!" h.͐x C]%Y赨H5:J|c?y#YZy.c>c[rF'h%=(y$[H}|K˝6 +~Jv)Vht:VaV,MTIh' =~."H_،ezqq]99\UѨN5ɥ4Sa)i8cbO|' .kE&ۦn_bʛ:.48oGLâ4W` K' Ԃsif|jA$,Jxc}{o28va忹зqel{8͐ާ+ `* (gŜ -#j`J#D9O X"u~rV{B"o}kl\v3.X28 TPR#`Z2&tе_4S m˝w΋jZz. M1.ZiqQTw5yW8PrqlS v}8=,ƼEB(s-Ͱ6\kzN%^*_z>j'P>xޡK -]{ht, 9h(~I}X1{ *݇CD).S|[:LЗQʺ^NںHp4?үNړ#BCzEȌ.hJfqbgV:DLf}!XmFSόw?7J,SS:l&C@s}\[ʀ[ly= uJR~5ie j}{h5!`aZ4Dֿiޜs#W\#ky&Ra'遶ϘoOG<Ϝ !5J 'CG GP+(y2)kHnAR79y٨?ɳ7, ;Ӕ^u0|H<]e OY EV  SKNb7ϑrI)adRy;Yڏh+>҇,OH n@aN)\WȂKc\V6P(u†*iH)@YJh\ow-d+c @XWuWq99nDɈ_-C{zwD+"NMc4N2M3!H ͡ht0of3 oѨNWXz 0 /s/5D rIvKB0}QHo sVBS!9rO8sXZwPF%EDO Y26b[l֜UQy[_ܼKy>s.ykH3RBeXpwr]acR=1K,ǁ$R"{.蔯#[Si<䝉@}?N"?nH$ӛp9BZCԴ)g /μpj2N.).ZH`m F^DK:AX{3Teޗj6kw%vE[f^wPiW1›kA- U^*S>4'Sm#r_RjBBT_߰+?|jPQq VzW>+BH/(oOǵ­~5޽حYY0Qx'/J p {6O;ZJZ^_U^?H/dl Nr1U#KvRdfwNP4{gr,ψ[K"cDhܓ]T%^m ]/A%^G;ȁ f`Պ?F$}ʡ5 0N@\*`Ukb~@l%B-춤A`>(5/$|BkK[a:yt7ۛz3]#`}#Wpַw0|}^Ʒ2 ڕ5T:{Ϛ"jdxd8ض9b{)4BWa|E7:uu04g>'?- 4gJ[dئ;egI՞i< ̇,նsc+pD픊۹ە;pR7׺+ Bet7b뼽ynC3Wl(؞(#TI iӰ B唢"ޚ e-mnv[K/ġ6$hڦ͗tѤ?sThY~ vO+ \A!17.NncU{ ~܋Nj&| c[Y`8z&mW xi~ Ba域V؎zHST:PyUT \!VyF n0B9Qvj_PǗV|ܲl0-,V1|) pcUo:j3ou=a ( -pg;ne[K8J4by\RChɑK-Y]ͤ7otNhVvy?z}eĝ:ɞs!nh4"' @ww|=dLDtLwc-xBs` H2ѳTI۹/1Zͅ! vu8( T[9}j߱TuPhc-+e"^]"܈Ct Ka-!Uy8&b`*?zb ^4h%SQA*F/Qo+XXu1*qxؒ/W(X@N-ٵ9hS=#9ED%IMFjDS=@g:;Г\bȭYWg*+#DgV)+qx( )D7qչ5x>aegi  y֗OFHrANxM͘3b|#Y|k-Q-8SSTf g;RuUXrz+om.9hbdY7G<-y 6LBňF]0c?>p  .C~p֯ N@V_fB@qIYr5mNUee<F1JF>to#hlpeWWuKi)dJ|k)ğ @5~'Z0^01M!SczY&&|Ebԛ-xyG$Ne- 9}+9ٶVZn $5N0Mvq.dՎtCY&ؖ+wg+u+U_;8vo-Y{"Q<iANEA.Q|۹\W]3ƩcwwP;5h KUcB*TGt\c.VF!s =Hvn-yGA꡽Mc oBI[O /Ņ )!#.Bx!KˏLi^M*ؾ_z8/6x8_ްUcW[\&i1 CKA~i((kסZ[,8.و&?z>f2nV4+zu] R@`5*=]Z٘5mu%MPg+4AF#mR@TVfhҖ2X3,١< p̮6o[=%J~l6rGS`fLJ'2o#l?&b՞WI`$ra.5HɀҘiQQnOu!jj/̏p >p&mĢ8 wu:>_NLp/fj[vQUj)eɌ pXnL)xaczfU!a _z']vPiӃs61& ߧjkK>zkC4C:d-<|#{l0ƩK4?wrު#|¬UJٔ&u^ :2pFn4zlrCi5;[pMoe B9?NWaˊE?d44Mq;J@!nE49zl j8Ky|i- ГMjr7mW{:NQGhj)"yg` ofNUkzAx&2.>}H (e:`Fut!cPnqV}C_eUEΘ+|gJ= /LrSu3++#Vdc6f[/o+S\NKLkdž.wM犍tل=> L)L4ÊXid{#%aR'|K. I`c!hGytL_0Drg?kV8lOgݼ ʘ8f&V,V{"{Y1m ] XgM2|7C@ԛRxPz!wN-J#x F6nZ%U;Zm9{[>oG#\+ U)71r S-|\nˌq76T7oj}(nv%L?qեS H,]JQ嵶_Q0wI`>E<? Kk#S vFlHUKqߌ̀X{9,φEKG!{pIx?JY`Quq@wx$DR`Y8\kVP~TY%%UF)9ŠA=[% 'H֧"J @iV>gfhGFg9MtMl%aA!7./ET6nzK,PxbL[DCJ*;h\9| %@0\2%I%}^]yar;D5֩; jvB' '`XFQI?F?R\ӱ=;bu%Xʴ{l0e4D /#pVbЋWCZB7\"vYBϷYGGhysiהu@('D#BMTȴytPL= b; X:ugc.svBJ!Y߽@Jܪfg_  L/=>4:B`)܆˜+!B h =87IqJܓS-t-iCx95ʨ~d1|r){PDqwV5cR5-CsIc-!4˻ywXU1(OoE~e_h?.k!D[/FpA ԓfgfW$@ͬ 2:#`e^k,&C{ލ0}LNZi 6Z8V KܺxBΤ"抷췀:xr 8*-L:+P4 `Ht%I#CV]ڥÖBo{(GUoH^t%׆{q"0PBK7?!^V낌3XDĂ4BWS 9Ok{6K?,Hk'`&!%=S3H;HQeR>Y)2e^ʄ"QS~UeB׃1)@k'nO{<&ӥ1]jzpnf?slN T5Loڤ Sp_ zEA00,ថQOφ@׬O*4|n(suΝ pm];N c_gD=ʽtC$eHJRsM&dM v6)S.Y] bpNHUŹʿ# ^SawNYhI].%&Z[/ RG(%D* @&`A>'b_'[ Pڏ堃@asFt3|*DȜi7z/T.o"&rL}4fy$xBW˂+EpWV[_2sz"i&𭌽/G*O%U̒%hoz[ߨ4#{b?,PCDx0qݩQkiq}RI_zsb[ |͍p,B\EfyN{θ.L]Ħ[[{T^cl^֩HK 'A3ӵʯ_80EɮAV6~g( 'H`ij&}7~wrA)7rduu" iY<8 wsuD~m>{Qq`Cʋf![MY[\ ؚ1yb~M= UwʠMNYN?.s[/a+R]Ԑ|k -@E2kfWտ-. ¦l /_YiVdJj[٠[3? F4VI[KC^d^_':@jcI˝pl;|bU10֍i'Te:9aZWRΧ1YcE!e™YANk͍DaUUsdwSW3zhE9y+w8IpE:uZyMޭ][Ǥ3mKi9"NuyU݂;f &Q<,xTV>E珍ZV|XT~#=_&s.CX`!|? ivSQ#K5ENXqÌnW./QJqBwMθF8yZ"r\<(Iz_L{l?9%2>ySְ]j4hd#6wYcqDch4Z#΀ͼ{`Y(3rqaz?x@rq+X{CQ ᙚҫŰ)0D<i1I P_qMà35 &O6e BŢz!ee&US %\֝ƌI(0|D_hajLbTڬzX9ѹOmuEvIR`48>0?hUzK3~Gķ_hkͽGAa4{u8vuX/v13rL,{ =Kblk]x$CwR|5&QQ@ :`dOid[+J8:JX 6X߀+"[cNJ`e`%`Zma^|tlY?R:S*Ϩ-xԆtK"|C7~oP\8OC1CI (ⱞ; ak|WQZTL= F<^U/=gס[[)(Cy2g8Rd6 r'dѪ +}٪ˡ2e4-0[øjZt=c:*ɝ@ = HRh- PBL(Ft~yLd.JRĠYZ9.jP?1NDŽa[ɋ I&4t(>ΐ%YR_u%i!:X4e=x K1mrE!`դs@@/iSJ\[Zkw%~ hdľ_'"Bkʕp]uoEluE\IF\E>LxѫY1OVLٶU&}YKW'܈t~̠2cRO/O1K_<߮_ɷ׶Gln${cͶlj й.):KFe%0Mkny+4,3[j/*fbT̋Zt Z?=t*ɚ= Kb飷n5Fg߉zQBzw]Hˣ$UB6/EeW>-nv$RUVArp\L2lHnsWcd^ QG;7Lvgw+Ǔ<")ݝ-\SeZ u,zq:,fљ6_9'$Omt3r+x6{E?֧"@̼UmLQXE|N6aL/8\vm&XxTEb-F}{ >\: laK=_WifA?%D' &&zoUd5k#4x| zN)a ڕzi)ٍ :y )“sL5_M@c} Xa,>ȩJEï*Ԅgi)bq86!oYmF`0;pv̟^PEWH/$>5*. %RܩE|=2:O O~sgrϔyd,,mv.!* y >h_̣ms7AlwkXyw> #'uփ(a =En, @^ (wNJ.Ve";7%P1QuDgή?m<~L"d.{$,-FBy@83*8 p3:Gmquƙe{!1"{ OzB g4)_;@,.b^QimglJ=I⡃eڌg<-y0gc Gpˉ#z v W+`0ϿHsrwqćyGZt\V,Kּi} VIS\/Hjx #"^ko_5ڪ9.W[eGge˖dso(8̌hmpP𲝨kzw[>O!Xch,QV|_lg{5{P}Ie<$ NR+Ʉ8O;xI NhD@4bS@¦y9 Tk_qLXQ 8X^ٍ}y@RR2P(od8AL׃]O[1 /u1_@^4(щBpQ/`}=^l?~uօߏYB*xZ $2NP89 [m}qQlgf&V(ySU"{U>RT 0%(@xû`y4h8ֶ.#K^ʄڢIZGB2RլdF̈́ZGqUfPkWjۏ10*mk `6ccۛj y$[ c.A i(o'Y$8ˊ-ֆ,YF QC1͔S=D|jC3N GT?ƊYr{v^u"\,,qy2YtjJQXl|7M'8k7m+u\'-Hǵe`(օp6s7f{rRNܕW%.NQpU% .WjD$Dz挸7'r|4R".a1X(WVCR#&ɞ΃^gyq ^.\'=,WYLk`:OlLΓϠjhow)5TKs'@ [9j>iӳ_= ^8"3z#xۢ|] 3bJPR~ːBH4J]kT,L lLy&)G-M^v3QcA7X Μ +h^K&3d]nE~8:&ҴZ'A\Hcn))c@!%hp}- д}|Rmђ(P쟒/?njLW#.<%Y-ڒkq =rpoYflJ]mOZ s4ؑ-ˌ&\ pgy'bOzk췏QCjؒ#aB4Ġ` w",`~~UxY2c! r˱L,_ӀweΝT^xL1f:ҧQ0hĸm&yT:H_>=DҲkD&5*:4JUͷ>ZNkI]XɈh8V@[:CF~s0@%[2YgT?+c4R +87һRډNkbw^lN'`h0/-JעȢ9i7ފH0ptv%^3 %X^A `ڀzA`>T !x$BfPLf qpVd 0YaT`W iZxކU^`WYwҁx8he8v2`qDXnp% j.&ꝵR9oN/D ؆ꤛܣжl [KL/Yv֤Vw63}>-^Au(,l-wv}M(c.rgwe}q}`t(R+n*Vѝ3=u+A}y8 - !AK=W"BA= c31M+/ Լ"}Q*hg}KV3ಥ@ZU 2մ'E5aC,~hn w. *)TQ2 h0pNN[;B>G+#yZܸdj;:S]sVn!ꗥV͋݉2bW'DNW%nϔY܀ a!.豓 \Btu\L͜ϴ[ Go'zf\f;n4qU+_i*fuehFr-HY>Ww+>fw UEd@gCVOr.z'G}]pc*H?]8Ĥ7 0Lq\< " 4\z*ۑk'd\|MlVら|nP7K) XfLj,>) |+^Sl/S)K.Z45SPak kLat[A[ӎP|ػ0 P[[Kos9B"4'w!fڇv͈]HɽN7a haFRd SYc\RH@//6 @<=u&P{ V+b&|ڡFh1z'Fpc@qmG+ơ^AQmvl~MAhB XEdO(l*XH'lgՆm}n#2r{ssST~'^l&kN.u!] 08y浿1Jc =-V+\EQwoQDxM7fG]"ƻYן0nPf=4U%<lJ0,"Vv}y|`﷊ w +zxr=* /p-%2V]$D,{rHrw"ҁF/>NKdu1ζNT ]oA[;]Y[24P|FhP|!sv[@p8%&ԩ*3#R45N^̿tv!Q,d'*&tO&-bF%!ĺG.RaՍj̎b{Mz\>{mQ7s2 I9(F` JrÖKGt2ExDj.uC! DS{K o/ F&'a3F֩ƙlp$L9/w1yH<8z[V@*rw*x-[%s Y_ei˽r,_FoH0)Po/%ZTSXٰBk [x}lˇG)fOگX╴cZ(ie y (d%iu? $d`lG_vXV8$(Y]ɵ4 v.**WBZUc, +IjG)R=Suƌ V/ R _JLz_9F5!%>sӣPciD^SAJJ^6+9š-,[`3щ^eV.òjI_yVGBnD xJ2LQy%u'%c6mEp-]_rw␄rdXeANZcZk53O8hbV:_PQ8AHҳCU: I b}e\$5p.LF-; +vkڋ@JV3ynwđ G!C!G \\{}Ke30<|tA/F|6b=,hJ AzMqg_/@w)DdsY#̔i0d"K@]ʌgobH[H@螻+nlF>sv$]O \eA]Zu  NٟtDU!Gyl 7G<% #߮Xx'镴I"S;jhH[*Q)0xyͫ~J:"IqKV\1wk̴ 9GtwFP= kQCIB6I6A/}Rβ#9J\z$ a LǷ>~`\$H*1;Ék7༷Z`shsȯ86Rϱ+V:-6z#Ak!tGTB&lsÆ䱮[D 9C2#d`,{ai* ݩȟ91WbfrD*\PUT};[VBjmnb&<nq/aSe:`vVr |b"፹2H .pQ==Z%lJ? B^PS4Uyvn0Ũ+S 21%E Q{%h>ŨF4c6&^/*jX=ubsBG&o+>G' .6͟F4 C0~=9Q0|q2=mcR9C25!OC~J ?k$ ĥ ` xVuNnp9SJ|Yd x.t;}Ty.;b.cbh\2RK]kmm}˵ '$zڟ΢O IU*MDQ|z1 Z8荖Fc8N1bI\Ǹ k&TD0mT͚Z)%s@}4_T)wZhʠ9ɍ W4{ʮR)SAoRۃnkėtB6M0 (Y&$]<^v!XJ~}c#Nvͧؖ(HΕrr<%3͚ydU+2Wvڼ`!8f΃Qi$=~A̈́od6t<ջC~g&vt!58GsţKZ ~?>8<c8M"'VkԺHȧѽ$jv6NcI5mK+߹1 x)$293u$L>ZEޣR=:4(3u8.`I(;yckSݓP_9QAwNTσB!.JXz6t6yLXҏc>zf}[oKPRx\%T;B"8"Yg6\]WfUE=,>ه$(f$gS&=bm<+ݕ6kGMZW7LѝtW;}88YϺ4pTqa~q'gBt>4ҢIEr 44 [/#I[^sh⬷RHŢCQVOU:+j"%lt5r?h2(tM!~Γ4:pu̫!dFM򍛣 PaWyihmi\K҇?9b 7U~PV)BEm-ѫ!uy*pBCT5Wɓϱ3=4R2֍$?%o>C?uef>MF͵D~RꫂyUNce!k)^~5F+ؕ5oRm QUb] J/ ZSn!z㷙42_(z8t;N+O rJFI^I͈>B sYoͣ< Siyf4\'P=$0z?2n u-AGZ!6h7ʵ`+H2m0xLbpI҆ ^ +~h7m$ٶu(2s(L f7EKTE~X52Q1 Y ] v7o!& P_ FVsF:> Ž~D6I2n[n~am Ȉw3 1J_{I6K<<4Wՠqx.!ޱm ~` (|<`7ooH]%>qvNM1|*U 3(7lӂL/>Uʦ;PFA,؃_ќ FX̢҃E[tP׿;7sVO9eLF:ˌOV>(?AM(ẩ` *hFq"P¼SN u+^] ՘ivS+GOlQ-cχHR=mS}_t[H=YŘ)AP,4mF4Qm!܅L2IPь>xA<](@c%uˎW VsCr XY2zP VKt&#ΌR%""}H -'v+%9蟂z ∏(d PgR[ 6~ E0r|̠h Ž*捬tRgzl- w~sYub{cJb]M?LqWbyK%.Vf=wq6*MidrP$Ucwͱ}UGcs# N P DA{޺LuupZǾ`HǹqE_co@,jmՑNAW7TF TJY?PUhRccYP}2FӞ@rf375ںOq'c|Wf[/^PA%Զ{ް+V@?8ΉlXl %O$ J xcn3' KGCN2 pʮp^ߺ'6@KC'lᦕxj%U8^ :I*٪WC{:2'ȈUoǸ(Gh>o Eq^4}GL0 ׍܈Һյ4 n։I*+EK@He~ kHZCEN8E Oi:a5MV[245\`*-B"5-8znĘ5s&$/j x,w B/t-+Vl8DZS;ލ*,j4/vZ琩#܌Rf6W,TX[zt5WQZqIi1{u!UBŝXE,/$;[CCt- 1U?:+&GD#]BMf"m YI'iWj 9Ϛ#{"'Ϣ&DKP1#! "ZYLAv˜϶*3t΋my[e862 $[rXx!<@֒[)65>o`q!Lʓ4k35vIGWf=R㙁NR"7A5zqsj{Å3.Y5OsִKޛORCw.Tk,!{5+v]yըTLZ }-UKBqC~|Jj /;:y1:llCCxEi=Lxyqҹfq2+R4a!7溴|rV)5_l^_Q訣u ^h A׵nLԿ%'ᦤ9̐-[̽d8EOZm§$_ߥyj: ͈Mh뛚4T|[_$1TX ز! Z44Qgm3bSRmN>Ʉs/rz"1ϋL&31XTՠWS[E) XJl*tQ1"B,5FVlha(Q?ժP&|Fiu29vlŃA#TX!rq#8 BorHJ'4 wzT} -ه=wYEMbNW"87 Yߊ_9.& [~Q)Ӵ` Z07'RDtQčW&O@_ua91Z 42f_/yΛ7TiL$+QgTr"9Rf{ʒ7]A ף2d/fHaJ۵b*+kXgnW%7$5E$qV q̀Vtūe l(,j&4Mm ecb,"Af֟L[;z@|t iwCzնgT&soⱔPe8(&sef^@>.B-[{W?Fžx P7e. jXY3Cz4~(7. W<Cs/$x?,9{`d*"ļ" P?ȯ,OCU@|`8@A֑y VZ%u6 1/(t-0Ip&( -yV5 _1jZz{iGK` 48E^*$[e`sW^ `݅,%f4װw{_#Ba3axK_CH>ƽ1bą2X.ukL\fL\9S!(jm'19]*_t댩Cz ֊Gl0ޒ2pU<[0eGݩEab*5P% %+ȫ J$G~vFMOĕxNVFyհ Ϡe1YvIU"1Ds)Ȇ){ZOQ&V7tDFAԱh*qmu̶vsc_'۴fjmI˯v GڿWFdXmgЧN(h&"܂+تS#تrR<Ǖ܈\]RrpN |?VYAK E'r9ܒ]*8wˮ϶=Ƀ` 9KJLSk4`&a4S]Oj> 5-137 xjMDXk |YAu%7F׫Cq% 9=Da]N-L+tPz%(4iYJT|i1gZN++NI C γ1IS@@Ǎ'6+ 5|Er')[#HYDR ~IqG2?2N))Q~Y]Ԃ`!̌M11ch)]=M$(>9g :W5ƞhmO5X9DdFG޲ ޓq,KܜN8 i) '!g8܇( BF :OLhj]2v:4ۅxܢ ڭ:@s퓫Sk&/g9 YqH '3u"A cjNł !8l2eƂl O5<&Je&^L4^#Y!TK"UP`G>4S$[(E$ѶeL+L@- &ީ{6`Ķmg8_PmNª6 2pgk}\= BZu_7\W&{^- [S#K]ED?:DvnWmXT&ӷ|zFE{e( QywHi( YQ%Uf jBD;ȁA/I G,;+啜*O잱{! Uql(kR<9~Pd*<5GJ}.}X=\!;J|Z-S@XY}5ɗOh 7tqӁO!ʔ5Ϩ:!Ԧƪ,yyу Ց 0GAgO=N( Qmacw<ǂhc8W_N\2\RphJpְ?or!DOԚ(+St7c D]o.AwVVE9 !kP7%򚇤CIi-PA l+#πs.H K~8g:\Q_[@է!/.3!Rhl.'!/(›XQEvԗI'7G- p직R@$GrHOp{*S?"iqpi$jR, snI~*Kn^oGt8+jG b+/z v&U#p*yBeY m(# -1xT#;S+F&BQL4Y2Nv͕#30ÐZC {KV`ͱq9U9lyjlTb'Ɋ<$I6-:j 3M3޹xS_3ZiC}X?X֎Lb:J,4(_&WAUjMIVH_I2A!z,;k+-ۏg8Ybg]ן,XN0 U䨺YKg8U>Hvf ΥƓhKH@1m8qU(!B{ A1dBڿ| :W5᧔n#($̗U7f=cں=*bVoF/ ipRêQ݄~%=Ք(7$ IS^~L j;Ki i`gR{L2AEʕC۔F^0TEIc1UV -ɪ{f&&xʠHը?XOq{KƇ<exa󾪰xdVoL84$85$f L5Ўeu|*wi+%RV׸z5#vTWT)IcV.s6.[wq{lܤ/ʤGoЯ+ {7H;S\ ,r-BZoB| t(;)w䅀}vȫupa2,%bZe3|@?CNr?v?ޢh'й*Ivff٬D񓯃K.|mJ7,QRӪc&^Sr* ײַTcD]ߥh"3Q%~nJ7SItH;dDƥjiK-U )FR=Xp'^}JO. ](4[+ ƒEm L(y.V 3dnF̵Cq/Ǡ 2kWޱ::  LX`s5mUJ4KICVw"lᛝeWAMjKq1jB]> [j!1rbr8+!>7|44Z"k@|@pR%Y  ,erQ[K^!\{_$+cc$Fjab¢ (%3ݿ3X IbqڱݽlV4%1gךjʥ%טn);!ZMAeA*Q昮-!<|l!B1T}pcnYA}CeD,LmNZT6yk^=" v't5eo {jy { k&L5v_-PuƔEo'KYE"^FSGk#::t ETIs2XewYHrUF] Ag@ko.mU#bみtL(4%yӛƷزrlT>!zo=$ $8}(MHm ϨC1X[D7KnϢ!;nVU[#I): mo0 M{C daV̱$0E5"R@T <[X%vŝ Ob_Ӎ1mu'nY.5ޯX={CpfatsVCh&P( _ƽBOf8HE9eAxwkX9BGӅJ6WKb8u- ^Vi!>i*x5fsg ŞoKAArt4q#y ")qC$_eB9rb3n 'K7r%t4OFV ffi|I" j3CcH\ү,/rhaH{U(}窡?]z𚒽Z.q];h<+i:>Bܖ ֘לP0M\[Pvn-WyV7ICk,b ܀\..~$ðcg!?Z!n)׻zePOd0JX yABje# ܭk{Śn%Mr7A7*m7{s=wIDfK H ѽ 5vHeYt fI3SPqب1<oCNVGA| mJppܫ)ԑ&f2Cv=%F \FrH(IBh줊4.؋F^[PJ W9/X-dA&)9u~mXeӪM__ Gzڏ'q/0:󴺇L`*Pf0U^A#f|+7̲]:%]6c";˨ôʱH.Bőzr M?jh6}\>$%o A91)g wLLU7:9=̷C[Uf:)~`g(#IN$<R݊߆<9MfIl ja.r*+Aeb|wrē I@"deb)9Y ƎW\rJjҹN$fu(ힷ 'OGuPKCfˑ:4p*/kc1úbZQs\SeY};̎C'$/D}SpL-µ~jI"w67d,e4[CSr7 <VZ_ݹR{tϠ )^9LK xVjCs[=+G7̪!vsahGix0'jgO!pk0#E1gÄ"L$C^1\mo`Ȁ(xq$!W OZlFW[~wBɹ-ԟp-(kDS4ZP[U9] ߼kXR41x9:ihmQ `:)yN,o1&;Ւ*3m28Ih~]$ap;CFbiUm[}p3A54Ft1~Hs>yl~˴ڪ| D q"n]9h ȽM<>ϼ`fPB./DX pijh#]@N%)?p/rٖ|5f0*շYWҡ>~HxE4٩I]>\C%Prפ6mAq)Hۆ' hFqD~?Λg(Di Pgm9t`'  Uo:z; `q^khsʣQYjhT h9 1#m*͍ :'ϷuTY`ϟ ?#ƮuaMpAͽO^Cwr`m' <}·k/$X5O ""k6/X`6Yٜ߬T+BLYӛڣh 1plU/AލiÓ{IR,?AT !&e!:}rF!̚{1)2OHO>u UANA" 4NrA;g]ŬLmEJ/kr=OS\'mO<6K8gmuTË5o)|@0fl@ ) / %h{B6s}]d[!#]iaCw҄`c$11-mqpllE3d ٔpϠ H,.3a`P~u "]✏1}*t[)Pۂ4P\&efHz\Q,k8KlH¯|=&c^IYc,r[|hY"Ll%ЅH:@~zߟGQOj}nioahrvS}.fvGΰ,`1Lu r3կ2:S5^g-eZ>hTҀy7׬;a1ҹb ֽ[䔀(xX]S؉ ii'˪ E>4]WSyJg 8vuQ.A~)~i9s$ޢӖq1Bp@>ӛ2_h9r7a|!Bzo! uM Y&[wu pŧ (M:f0j%G饔/,d9d'X~YMlU8aR v5&S`훁6Ϻ+#1x\sZvpwrao'Ni8udYu>9ߙ&r4lXVBlD8]8MmLs ey^&nbߦfgwYܴNIF݊vuG[>$E8Q䟢DK!E0 zs3Ig ۓ ^ P`߅r$k#XE+3E"ۡL9_"N)A,z`rILq:0Af3S&V?SOMv+ yX~.7.}M!:u[ {ݖ47PNWJ]->TO>oQgyl0a D6yM&eZ q襋g+A#Zh.}4';,2So ١hǾ<ԕ2y+u6h"RG6dp2u?gA~` H8֑YKgYI޽ ~vsOUbϭ ?a2XlG1qam0Hjkh:sco^Dsɐ*NFBKbl>,ڦX}n/K.M%DO$NZ}sХmQ34Zd_m\vFH4L8+?gjEͮim` P4xX@o<zhöwõcZi nub guHZOC?s:a0 g/jwڊC֠@31+Ȭ#xjNhkSL]4w~߉=%[uIC4Q"£W]9υ%}/4.O:b2 :^ҧw=>ri7 >=X+l%6}U`l+S !olsc tѵ;"dRQQt9z?UN#iҜ \x (xw3:$ )He1g xj{\ܝ0\]xm'd59(rō=JSjR]Cd3 -;\.^>%Xnmrx6vmBy&bl/z g/?ӂ /zˢ\kAٲlo2v/] 9SpWd5/bz/ӫ;5B{q{pkEg;;K}Xݰ䣞V김&']_qu]*NGq1QUO@~}@7ɨy[˨VB1O5ZIS?fwOdk,\z,+YܠB|}E- O3xVPqH0dYd9>Mb j[.b!VU nHrn)=/1?"L('Ky!RyDJ50l7;9 {9(+ޫoP\"]hVA+%r\ki.2-;JDi@uwXF1Lњ62.]㡯Yi  }^{qDo)Hdv)7נ2 ]$"\xͮp&#~܉W%S4YR^E?oZ+߯yHxPXU(Z U6V:' ߴ0нH3\EuHzk  ]M8-ߞUӌbVnv+#S p2֤bB&| Hw\Vv:+ƷFDW92u~.uI76-SvJ(<4_#2uKt bӂ'o<-WN26_6tƣW3 ܦ9P6*^) Hćb)ԒC H0&uMScҢLȠԕX^%+bu <]S.眈k(:r$f^q'^Ƃ, vϻƴkM~9zC=>2AۉZIX{[Cd/e]j\WڋWo/?B2_#>QubBSm;G4_2ڐ`_}< [wHpk{u6iڔ?r6K5\r|#:n}Q[NlädMM8 S}<\ǵlSYxf 9~8 nUIK<ʼ $@M' ܏'S#Ce}J].n~!nH f78+]C ]}7Ήя =h"4N Bn[ l)U':9/cbJJòN W^\'{W)cAH ң}wH2! ^zӣ_/;$F,2-P5$+){ ^S܈T])Uǝ%D IZ HZ7_]oXaIFQ3mf]ro8SƓ Ch 6LU-(|!Fm;mFj32H媬U󂡇]?ZOJ_]Qp,RUBsZژj( Mޜ1 sFՀX݁􉞲l@\5޲nX$u?"s9h6!!̍/$@[MpA};bwK:4/UShEK(\|3xebZWI@xgt'f>Wڸť,܅0`W.:{iZu|(/C[쬅B10HZZ .,P&H|8^~qR0 GFbZN&:Iɝ8H]BD9i|Ch(8,J'(z5 pƾ@?w"9xrJjb^C:;haL$VnwrC2 TJbsikZr/\X7lZ|)䏙!iFA$.f:oEQt ,җ9܀ժZ>H4lMÁR#dpi}K,or¹>&$}_駔O f<Ol@Hnb5MI7lwKv%yV0Mϝ{-EiuvN=2`C1#~#w>W~g?|]u"+lpyJfTuI\ Pi}:_)z.*wLr< r&~y1MY#xVꗆloAol8*%^(b" ߐ(N7[p?\uJp+F"rBho|Ju2Zˀ!'K *Fc>XKenܤr*>oEW(bgq<$˒yFlxVrcr$=hRJg/YCxْ.FН+oZ}5uʈ97g"q#>HZ2nw]b+5^UMR[.mLD C7+ w:,C&SFYAǾgtD=dڒC^5 j5O*Z]::0v&a;ӲDI|kjGX64 su]s$W#jX%JLDxrZfJWS-H_%Ġ=C|P0B4Kf[Ȧj]=J7fG ڙgztuYTljJ&ٓ8v CԞMno^*.l6ٔdl6oG$!=zQü<'AZ~?!Z6RXiXrV[ 4m Ť;l֨ 3f(D,izÚR5my%7zeS_k }a̓Q%hՐ),sWZiP2& KkcäJ1>TߍEy9:T>w4QGU1_QT7c  DC(ŇJUJWB3e4/1t6i'Cx<1:>vTt648a7 a |z|埕2`q?41!}xgL~1V% ocpeH~3vEPJ5R+ؓL.Fs 5Fbm!KRZ`E.6tgScy/ݕ3Q}^ZN׿v "dĉHYeYJsj'`D fgN&N$s<LEUq_V]^Yv&ʫft\1#M\۞S Lo(+/dMU.W ~X`yz5 `_ŭϡ}y> vtGj-r&JWrZF#ql<Qd5;2ͬcqE /O $i#E"xdL"Mv3R%u[v"h|iscbFP_zU 1a){Bzku5kچk#Bi?00k9)b_r€iRHK@VMz.KLߛU:Oi+Ŏq݇.ߕbأRt>WBؠ~[_j:|3{ؚP O}V1&3G dF[IIkeU4qF541KK# 7Zv*8jb6a<^f3G2uV;rXy׺R V0AgWn  (S0=*55Z> UB˜̩켢"{_ĉ3u+fQT3З{Dz*p O-FAиְ*{{e#g |bcc'a;X6#3HCOޫsesIH3k0ٲBs'Kc^53Ti#oȧ7-493=C) KB씃׭aL;6̱!(fV0nq>" i |1k "S1dMtͺOE?~~>\ۗ6D?Si`Mr1gL@~5kaV$_G"R/%)@_aࣟh.VE8Wz=I!EbyJE!n{az([)2zdH6vbyاz9>~wnCZ dzDVi|'þ(Ȃ׉: uiʠpeE5uAQ6-;>;m6)r|ؖa|8],%i̍iie3K^-·bb9rPi)pO sn6?mҍp$o"%BQ cx}~Yh` Uot- c#%`)D|姉vhBu OT)B"/Mŝz{e`ǽ\ԁ/'yxn¾HBpvS&26Rd&g|=^;4P+Kki)i0Vrf\^uZĊG!/-(J%OM+`v1cC:3j.BT[)v6r{7 "geti@.0!x/\I=7]Mȁ10 Pt(_r#tI2([laePږAzV{覆Cr d2XZB\̇Ljbeюc3AX˫[ P.o Qw -#ex[J>Zϰ'A#t4&rP{ɚ սMpX)҂5 Wx{W,q6gwmW6,wk _VפXAUJ<8"07U?5?OGXle\L*4l%smpxCia:* RX[}oDJ%z?|""iǹ2˔dmȧrU SS ]YYv\ Sd߫Z# .QUsQsTv^ 1ڄ(ōXc4! c^9t; =2}  w`lӺ!UB8&ٗPG ^ J, ec;>S>1Ϸ-g8\=3`h7 I45r}!+B !k4' pD3G^[?|!:on2tDL9dmg>-~ؙzyѷT%}qKAԯh`ȅ Jڶ7ռjYX0~c@_})EE8b!| EG.];V%\Xs3Ka"{Ԁr:ߧ띯; "\# kV,RȝxQKCVA9K;Ko훚&i(%/>h{^@{hzʂ)wYbZ>S+%5s@+=\SAjbM u(4P7?#kƻp+R]Q{t@PSiUjM+F  VůRW vTeҐ򎗽8EHMViħjR7"dQ; I`lŷCUR9AoS&>"`~⥂2mnd;{#! d7R `cRVDL uHbIvO.*P΂犢WwRmLtj68<.DLg_`Jݞ&N~,ҍ*J'<_[WY]m7}(YMb9L 痥8qei*)lwU &}) xO{&s ^aq$$NRk7,kBe2?^5%HLW١}Iфw%8 xmWXxDmE2M:L\7IweT~SGgf9#[\9rxE +z ՘ Bؘaqb}[Wװ\$y[<%dj(tuG>B$+uUo<~ ҟL#MDE.(EA tL,#Nr!MR/G}~+~ynɌe2/ďM1&CޭUN\{g#)#'2ߪnzL.،g۟bވ)^iBJ5)^4BUbRC%E^w9 ~_\9GYXwL멫x 2\ @^b74|s)7<6me+l&M2ߐJjZv΀eo r)gHk%%] =jcw'g/]aip\1%G5T& G ˆgĮݹ<9`fn΋,?B2Z,q5OծE|ܩTU;|S؈)>D2<0~D%_.*I\1ㆃG &aQ:,:|'ܳ*{\Yh!% SxoDERޠ\NfR'򶵻t;ZZj_Jʗw\( xz8MY(V&nn-cL-[vlr 5CVP=+ۛU`WGZ|bgk{5!YU vd> Z0a|,;_VʐYsR]7 (q{C*zd@ Yhi 7n\7eoqRw0Y=Sv 6,8I,#+ EœG;rr&$TZ>},J3!ge&ȣTxXtRUl_$1—j~{zJh]RZ1qk *5v2x{ ͖56t]RX'=.-ɓF-*UH9,|v%IJ*?2@KdWUȏ5} ѶF7I ] s] sJW:}(p$~4vy0QN>Z%|v ju 񞇳-pe.1jALm.P1-I+[Z!ք֥R (~Â$WpJIvQGp#ŁԪoc YIP3a67$/\ sC~حdmg`QfqhX}-U׿&SYЊ2}kl,eA꽡 16Ij4)f~k](s9"&F~ ުwdꕺ'M6=÷5Ta 㗦nzZ=AsiY^FeB?E^pBLVU.᡼QKl$(a(^oeTr۬:We 6짞"0rf|~Qɷ*D{x%@rSAY*'N@]{.`S$vfw5'+ sԔq=hSpɚ5*>ʈ+}TCg|^x]z"}CY܆>LC47X Σ-@}t@!u6°Ea@hP"ۗ8b# lnO>'D X<{CbҌeZ% ~Ey\㊓ult3 &Je=։nRg-VJi38Y{8ef̯/=P:) Y}1L#X+H'xKC_nMƠ>uf]ҋϯ#n 'Ls۹YyI+ݎCBzUhsc$!d7k%##t%)}_^]͎O `]T#\'8X WkEWSN*I l-B}}B4DnJRLE[)w7wXFA>Էb[J=,`~ݽǂB$T@w{@4`(2$sO-E;.5Ck.ף_`$Oo*.iN_Z=6)elV&/[>n%e,4q W,;D&`LW6*`Q]XЋLJ4 Ozhn\|8rˋʆ\908fٶ{=h*uJy0q? )O7پ WSXRPu''>M{.UIE'Q(OnWlJ{\;;5pi $ o4~_J:u `up#&8xOnﰀfF[zh3ȁ19JҮ84Z<6<9"b-kM2{U{@݄Jڴ7k:lB͚vcK&y$GpBV6awhwT6=?Ǻ,L<ֺ95(kAHz;R{f#7$>)5MqApUV3Vy)6}A/D8 [:pp;2{%.0KBHaF'gqF ˉVT?QiXOgZ;iW1/$}U-Ȫo*w!c9J8]F?wKe W0ݠ辧:Wd~KTN`Ee-sxO[0ZȫAѧ\}AyNzZR=@{h)y9 e%1-k܀N`o]dK q>}L=kmFxIqy`S{MWׄf,>ŒxWs7bWv#,Q/ IY^  We/^"%Gn} DTbj5g% "nV#,ՠZO>WRsꭠJܧz8 \dG>NQd8nOHL.|^ĆKk>_PQ$! m`J8E=>WWWႬ2Ծ}K'4") Sʭ{-_AqԤ[m4\)U_)r!PkdHSƦ(NrEW xueE|í+xAJb0ݘzHRC-c0<9yjq^jAirfVWg.?2yk <@Ek,+w&ON(/UavuWF<ј-}:Q7 :-]U#+t<?)+} һ_4YZ mlXW۳ž YV:c{ Ǫ9h7tѵ((¾x[D9j\pGN%90KdFt1O pY2E>#:.9ejܟ`_yqs;}*Xj, p[gI@*'zHqV7Ñ+$2pyiN\io\!0]/5zH 'څc;i!m#-}z8,C'XǓB5q qy0W ?+kL+TZ=̏;3FXi%)0V2#wΈIFɁ4dr!jm^:MbRSݦj&unJMs G#"$?E++r fO Y0>;6iTOּTGжκ$\ַ,c*V#/|:5 zL֝W%e8Ao[t-ݙ5=E^_]k:WMa<6!?ŹoFސ=0 "u)]5V:vRNA%ޛri ^N#pk _R/Vjrӗ@]-F$@mvgT}93nR.:t9͔'J[Ɔ/RujQ~hub;$>x"ig`VW0;TB#1HvK ݍJ%0a xY5["lB6UΝ%:RA] B28TNISSkE\3+AM-6d+'`s?z6&l 89^huwUwnڿgG| .X<(BJ⻢Pk^m\qWJ'b +pt7 G(bZA!S< r>VC38+Ɯf)`e.BX[@WE9`VrShź$ŏ+޴԰de- AD >r E=҂<e6PI@"h͵in}T84Sl5lE9֪B*>rEHÓ,u@4(xglTNx"Lў|PcGHQd{C%gbg+ '\ٖ1q6n/zwa# 1]M% E%c`+UFXzKmΆ^f rsrNTz^3}U}@N$2E8H-v:ȅ$܎ %Uo4|l<\)zVeLH%6Y ]t\5[<,:>|kXd ySPimO[F%ߡjk_u4X?z.M#QkY?cXiAPaZ%t?l~fw PM*\2g L"(Ĥ,I^650@G5'cٌ mF,>-:mCV`lIz+`Fz"v>f& b^]1B>lGp,]_fs  Cȼ>RHa^8So9~R,R`juId)U̳wl 7JN)(68g[#9m+u0^$wWwPs GOn)ʜǘ7OHJ{%_iLk%M89kH,_{,Y~!ca+ӆU/0CZ> ֚FEs}G>CC'":FhH KZmzӿ"@Hr./~V$Xhf}~&#Kk< Cҏ:2Drtw.;˫։;tUdEN0ͪ& /U~޾ʅMD/Xċ^ ^an$KG!WQ)En jLqk̦Ϛy鴼ӵ`""!=!^v€y^죿I "3>$-Ԉy z̐Y#\vOFC34-;8d(.BV;DNE2%^[xZ%it<ѻt |vY`X,|I"@'ݷ4zpTF ]Ax0OC';qwP^4y2J%K^ÓXHwҾWIgnڰڿ)o xӵVBRLH#PO {4%;|6̠!*) h[_˞Gyha2"1Py RR֍Y!~"' ojO{Z_aȗw TrPnGi߁^OkL$z垧4U {2Ac"f˝;S#FfM€ZAc&F_\a,Pq"[ 5DH%e Qx?5Å0# O2h ?ZC#QKj>eW46ZclL߄ .j̕0fL3/8w^+45&@ 7&gɑ]܎Npk'09\i IH֗r ,*3لƪ'$עZG} "e{F1Fn \={=20*K ?kAΟLhk4I07р%_~sAdk6wZnVPnF ȓS#ؼ, Q,ze: PCU1*(sP;/=?]b_NױЌeGvaa64˄{DABс6(,My; uDksz(dG::wkuբx_yzԡǂJ +έ<~1HꢤyZ5_IHҶ;dC.Y"OZ2/pXYU2s^=Tx)ô5'(~.ՂKPuP6 65MƼk\ntu(_-`hu( 2f])YibJ"S*FmeP}_[b>r|DMMIvA#n-: >llJOe0 ÓUc[;r <17sULT"o'HSw)ZFTSӠ^%+gh2]AgiP_k!`U l?dކ༲=} Z[K#E<eݭ ۅ2T'_ILVW5Uj+f?Ys07yl a߿.Ga ,%b UvUn*O Є( qhhGU=u<`I2E*T|0=Dbg'N*/HoG]#%QPV?d_>"'An%9hX;S9| S-F]3k΀IVv|'`(?!,4b+ %R2rr@u6z9qڃ#%f\wd܇A4RBqwn{E`)k[EzNwq0r>ԩ鑣z1 SwF ,OF$ GU[p{*63vyT %R9qqSfS)<@B"g <94$H#4F.LtZ?%l&N}\䞿[gJ{nݭg2-+;;Ko|,h&J(6}t~YePQp[=hR_OZԞ0"[1W,u(8ZxɢșM%{pEBP<㠞ƗZ=K2gs'"6H<Ny:-L][g" 0= XƲ@V'2Ra TE|JEacu0(oK%̇T&=d͡XNGtfZK+nh|N__*_GdWEи!` [$oR":5Y_RBU+~'Ϥ%@+glAH40_hܘGM`#1~M 8G!#{QN_F;`P`]/3%9G'|&r3dO{s8pM^vB7_&ФiqmzGA@M`:q6"js{j0"ƙ-n],hu [ej+ , Or;>a0¹]BOePUqFHRE84FLF+l'?KqY Xv [秈X H888*BN2}P)'MH I`'զ;NS|.Wi2how((Β~.Rܬ`ŧAP9;YybÿvG[?f(=svV-F`?"ՒoMӘdDXz F7͎4Y!Q kpIHI>+C0YYk-#&=ց NQqXԙ33#G'3, 4HB8o#H@(pa _9mN>L #N>{F{qa?þvɈ3=$; $ ;]&^U/*BxS|.dL3liiqC7케MS"Y#I73]+P X- ^e_ Ld"bvf?[2 a@XPjP)b^~@Xg܅fKOs^M[$H+YeŒ$W6jÞ]Ԗ zam5&`h \Q`s'M`!}O 7#zCtRŢm(89YEEx(iXݧzX#GV`/]:vZpViieѨ**ȶ/j9'L aHkR%Apigc'nI PXFrc64`8L @^͂8%2 3 @ZJ+"O^Ȕ$*Zp]wwB2`1!h~_,d/{晿i{!)N+KMe ۊ98CVJa)=IK豾p[C3:vܘn/E83M5trU -q9- (FjbU6cS/v5AsˏP 368}z9Ѝv /ɕ'v{>;I3xU&WLPfuwXcFiL^ Ul:ibPh/OtPջ^E{  PkWmoepxT54`ӁwoYNæGZ %}uY^&j*S5|`/EG&~c_K•`3@݅nپObZ^;36UϋYz?͈eMx]ȁbf4$|\dbz[OT?c2sK,a p=§_88JWyB[( Xvͱ1&x (I2lӑE ͉-EӴOo5LٸÜJ0ڐPhd&qvH/[9ruVL-87{,.B{ yFm^؉_#ɤJ̪W%djaEwsKQ^ mj=Sbtp}}ȷ}WtB"µ6B Be>e\&!Tm[ٺϾӹ).W3־c !)>m{mȽ\ȟ̪E[i %VX!~50VҔm96@=vz}= 5+F bu?}r$5(Ԁ^P[)KڇgD{ݛ?p9_@]ʂ]<6o]`[;Y2G*J* (D쀭0 {;Zkh:? {ɯ;TQ,$qkVIQE$J-;ZTS,u4>iP+j+`Ӽhպު$߅3Io&?HcE9NFOJWW y3A,U,*-ʨP W)>|#ҠsjpiL/rB,(mF>ͻGc3~"=wXe͙P>!LIYM: dto{^1gM©T9SWLV7r?tua =ɕx{'1Q A6A! H")B',( ߝ3ió=׎sG_wP@5^IL k !!(Uu=l0ŎUKgz88LE3W;O{UD\5:'ò5oZW@Ez*Rd@>:dt/Z`xљ8e*}dv=¦ NӮ۹J/䧹iMP@sY$o :y6NJƤ  eS-6sUv9C5R~јCӟB\~Jb_er@F:$)KdҾkJ,}D+xFv05~ g4פֿAvM;pv5UX7" VBKK`H]q 葥s$,WVU$?Qc&h^Z;:ETShŅ n#\m0V`G'xaVUUd([*6yts(\NCAݏ6J=&inKbg2?Vj N Ifa0G‡/!;`MOtHL?1*{w)hlf 9diMM+Z|,?n]Һ=UP,|&PgL0KȰ{qeUx+ ̌i`@MOowPnLh(0~ Ѧ]x)Ty/ॎGJ Nm%h](y AH%tƄ*gҌQÚuw}/#_(|/m=BH}16#mԤ*'-zn\Lx uàʨԲVs>E$ h2NŔ:ٹYK*PT 3_G,x-m} ,vY_+&jY]@_L!/kuR<'>?#|ӴK#З.o_rKhRu\Kiq%G=w4x@(ܲȣkivK/bqx]91IED%rctʓ.w+Q7.{Ho@=d+4|1pE=-.LQ?.8}[-B$߿%|4>yȕRBG^@̷MsU7x+WO?Rp~}?5ωĶ& ccYք lv_8́Y64F+"UhH$52m?v 3)m8"t#L>NO((ny{A~@,g#G N 0=gMuvu{QiU=Bdt{ ] +py|E.*6&zC6{z+Kƽ)2dRa27+*Bq~ h+'v[ZpѾGI T$ϣy]'!~Jw sمt]?A"М%(#eNI5I*lӨ!nɞ aFosFi8$xLu`tAxxՎWѐD Cۯݹ`.3Ζ}o;>U3؁m i1kŮ!KxB_(hÙpis! YF-d]׍r^fD_]kT`KaMsuv7u]`SjI@W|b7y;0p.j5οIeB^{W,r[4%q9`i2'CX,%V '瀺ݰkR@Gw^+ZttFuEv#0r딄*J#]a'h nRՊd  :J¬qF%#b8R\uΛ.٭ p'i›(An]?|84A#:_`wfYWZW%6)' T?2_3 /b]wH/Hĺ%~ZR*r!D1nc'fH ϛG6h[{Q7 -]N':a#!lpоp,Whlxv71( K6̨CV21kK(a'Mf\/] bosEJs̲=@χ B}ڡPh%GOIfh|*QSxR݇î9m|Q(ߜ3Zbpş@Z<Sݶ_}ol_,hNRǵ`ID% ]G:ZֺV07Թ?2z94vvWw岴 ۃg&qzt0 >}c?ĩ&&/QHYZai*r7ak؛#0WTV&ɌX7,8?^Yu"٪+V% ԦaK S`F2pEAvqaeEJO|ao:@V}AA~DB&!Hs@0]د5d3g"h$ۈ?{һ%7wEʱc$7<g!rSbT}݈e!JK}ԃLʔnTcizVGBѰpU;3{%ԃ~B?k@fՂT@=MqnXoO<h"yI2;TL*z'{B^Q)P>_Cu0>gayZ[ BrMGWk^"L nfL2:A+ ҷyto@ޒo@#+ p;֡WXv5lt/Z]KUVIKUV{R/{sf䆔H?Iu6E-cslEC1ʝЂ]Q(㔊ͯe:%T w_2:}`PѫP=}8cgu ?{ʫ|Nϟ']vkpK\BT]^7'>'ڐ@v+PK]xd2^N*nrufM~j$I_].y]L?AF/~ěŅγ+Pn;KK6 Z#FD̎Bq܋^1]POhS]5K[Z 8n'd]?(|؟|MuF8ۈiusED}Տ^A5ڍ81  ? /^Xk茬i9<^w;ʳxB*DtKdPBAOՉd?K8oe9ю djV)`r5lb s:kNF~*hN7'BBDFY OgI kUTm*Tp>b#qv(:wڏmIyu.}ɖLG> հhDiɿ(NKV7)yj S;&7d"d#)?+O钄u~\%իV.gz.a85TR/0߀pAI(btUm~sLg  &罔')!yDz-p?Qyj+#+4I-xP~^p^lgFF̤@D53,Ty㾙ֲY w27Wb*en.CVZ݇! 1bKsrYIEw\9#t68 2LTHzTסK>ܰa6:݈ FZ #>n[d <}\>+þ^b3H? }⧊R5?^֊a HE:6RGYqi"¡laUq' a 8JZX %=+P Ks Ai4;Z[H'O޲$ZI!Ic.2r!8'HIrأ-xUGjZO28g1ZU;Os"ҧvoY{_#7EB`y(,;^7 a)"_̣UqulŐT#6S=3/gCu0N-O4񉮮_[(/5AS1B;!KI1,-~Ih`4{4|jQƊ8 js,%j} 3p\kR@ധhen:C 1w 5bL$7fN÷Lzg%Q.7YrwU l W`}uI_ŮJGԼa P:9aRr/n-/vX}2x HͭEbCOpx!5D1&ŽzNh $|L[2C#OG,._Y|%'LJ8k"ղ9cqVh ^Q`n3T54qK㡨ĹL`g  ӕPH2O? {AoHO<{ԡ#@k|4݅cl0){ "&zlkܷ_Р }N1}6~v˛~[iR{|ۑqa pvGBi@KB^C|İW_%s2A4=ceuhGl&\xhIDAAvHe1{U#lIW|AR"j0MEՐKg² bmjfjQIjүүiE͡eeG Gܦ2㴖/ƅһ;BeH^eP-ս&J"C.4GhًHPtYuN^_$ ܃hz5N`>x`ӛnS\9B7p[KԾ&eJ: ^_wn>@.d$o8kMlY&&ޙ&',y;~ʳ_$6?pXj- rV)D~/VbU=1Xl4> Qz2:?޵hQW7U9,6S(IkӷHܥKbGiE*eQ5mA%vqF6BIZ\2PcKxgJOv~2WVyf -ż35GK? Au[_#kZZQPHoU`0s[a(S T` 1/.,zqйqaͲ#%|ݟ#)-"RT:ҨwgsU9{v=ڃ".ʅN;jL ɏ!Um3g==vOF5]YS5h8),ϑ In;=%X<9z@+ߗ(-((Fu>1Dqo=d jKw jzYAGԖ/N#֍2ɱϽl"l|жYY7jEHP+]FV.hJiєbT(.YɣPEL1-YEyifH 撜p=$@Pa1d V4 uT& ?`8"RS74%R51/Tk/0~h>~bɌsr T1]v2!_Sq4ep+ ޹zop֍ߝ11 hN G]swe~Hh3sVSP]>~˫oMDRB`Fv22M0 %`PT'~v8örqQAǶ^ 0g0ƲXV21 u5|7D(|c[iu~+?z"2P]xG D yC6}!\V]':En![mg&z76#l"5est uT/,<_1ڻ#oRJ&}!{}zv-v[^5(*Gcj`F "̲`{ROPaODhmwp͝oNy߶C1 v`!SDV=RZ1AlZ?ml W/4mORaθuT *Uw`e@8*L%+PJ~Ҧ&D{*V|hF"Sp#`߶G,JEiZ,oC<^+'臭3&}6xX8Vh"B(1IzR\2Ko 'o19j"Y!I+!;kka)d"f9q;'{abˆ|9BٳmJݳ ©OiG'7[JpJ*yq =^kSOL0mR_xowqtc"S0w p40q7(nr2rUuMjI]L"M```L=ya@?WkM$Ë]|5+]9Bs߻ԯ+qPLvYS=6SlwwwpMڹ19R(!ޖ96㇙D]_MG7ȶ8Oo..fnBw{(=e<N6]Ɓ'2u0&&|VQnv T %,fWGUPb0Eby\^Ջ~ J_jfT"R[;bi=2  aAEMOQo,ԘZo)qCHC"6,̗2 Al_ϲlΗ$} 8 ۨ ԩ/l˔$AVKW}aY8 /U 1Kp RbcX7'kWZe +ZO)7FiNz%Ef wU  r.څX9y#Esj6azA'Վr^$OQ]AhW*&} U&GOd?ApV @ u?Yfol aOiL`0A侗;# +%rdoKRKza]|/GhA]|Y佺M ; /w04l "l jI;nP|iT-1w-ѽp۶+ͧҹȼX qء ?t{C']Q/cfOhey5N{R&A;1aG5xӘxvp|FB,L0>NӇַ1{WGaw]Ig.<]˕Ib &߳g# (tŎ!NF/Q6k)DuVD?5^``|Lo~)~Eۜ v%ìI9ᴣC>ڵ٠"1=a7Ȅ `BIM=&ƷOaUܲ>"  &"&s.Ni=nypK Пᝑ pQC"\Wj'{ .;)'xfk▧BR\*nn}xyb9GKp+i)H)xz{h<Pn#z t $E½Pkb+hyP§l0.Cd{A=Օx='IVU9$]|0 Ь~-)%63!%5h>)Y:<eӅP6|x#N.ܘ 9g)'oPDE$C9|o K?ݖ>ش Pa;Pa[kH֩~is\\E&0cbe8 岵SO|Eh84{_MC=%$>f&QI U? h5) $bՎ%>wCwɄڵfnhJ1Q,4N̉zcļҒh],wc{ Tܚ;F !^˟pOuobj[*y<hdx\ZqKIo]Xg:,) GA UE d2<(ej1uD0R)|d@@WK+dH;~kC,ȋE^=[Tvy=k1 -}{n=GQZ6ZFHsh%#i~ybg6O͢ԑ#*n{'=5?$iaJO7?y?RjeUC oiGRtЅyF˝" a)C=_kvE}qe?G,{˂<ڮZY166c oGv vI40 OA3ZjQu 2#cb2{޾doi^!@0vbe_ no;VYB}k4|{VR/dED:Ԑ o@ZZ:kEyXO0)Yz<ŝP"ˤzA!Ko ί}#MU}mLA-"kco=3vz5B(YV*:ΰ*ÖfU>ֵ7r՞v<7&$DMΞaL? UsPHo,şZ <}b3s:}F{A~J#KwBʾ Jkso|UW̲eml v1 )k E,+bhK5Z-@6 VE!1u'k-kRˉADsJbz9;4naӺEt}НD>;1ő@ 9mS]}VСLF9Mtr1;7)6CL9(8|UO;^[i'Se%2qݧ?(p}q%9o\3U` xc< {֒@== _@L=fSEi8=Z3oa::ȱf}s2OIm5΀Ϊ{G704p!a1:KbpI#NN4DyFZzGG1w!1@[ t=E yd|G-doɎ.1ﾃQiwR4kSD_mB=waPǮ0n;! H\!=vb[T)MKy RX '{lYTzA<ḕX, U%6" cm= uh 'ȅ(k/$`3x~qJ՝ 4ci *bbad%jwtV$0HC$ cxݑC]ݼ46h4sFvޥ?"9IQW^7翕Hz u₪xR_ݦxxC=2Zg{ 6ֵn8{fd~Т[`wGb }m@hꨙ R+p|-h%'xbbM4BLD:z~jaDs]vW㩅j)jq?TL84\|Qn{l"nY uƘq=$?f 4VsjK:;jG~I8IƼMr nc!]pLnGw3_”yr @)l9-RߑJ)={vr߯jn~zolC"lBK `EWޱG'$ca .MuAz(?r6 I"Ir20v@"1WG:)V-6p 4}%;"oʠ*[w`J)38brs+޾X7 `hT4^2`A~D$* a(`N2&_+9}P^I}%7ʇ.I#s~q)kaM*X fp_oP1R*6ỈjQz=iWJ^jn-oH _o!]FLP9B!PXmu/+޼^xlǎ]NIb?hgj䍳)Jz/$S)_-cVlJY4Swh^d&|m@ m+pײpj="X^|ZVlvEUgX'/@LDKS !!/sKo}`&6TjRL5baYUb $-em#nGXc> ae+,(`9:pT͡{tXEp?: 97U5aGHsT<%LScL1bۼu<9PO "u<hTtEŊ!D {$N|^k+5[_ 8Ħm?Zd5.637"@Jn a0sv dYHc {)b.9QJ>McsiB1Ij<݆Uf/ màP{Pw G R^&!QDv?CH`r?Sʋ9~eT9-z;=[+} uy"0s\#X(4 L•1uS& 6SgEM᷒2wUoXgI :q\7GIҙ(Ôjyf:|tJXY6D.vaY( ESvwX{q7ߘ;wxAש_,}m铹$GN)!WSMOݣ~hs\@I`EJ1Q-qpǡ72Ζ}Cf>ธ< 5z^ۢ C%hsmH/i_A;$\jSVK6gus648*iaEp3 @ xX~ ȕʅQp؟Z|l7N “XYHqlA[Ѹ^)vڟ5Q/D8EAS4I?'-#^Ap7gkORbwmѮ_ gK?i;u`eDpT]+35XքLi]>q3%Djc^6!9>2mKEs"@F2萅YT[\r~ўR'ة!P՜e ĉemv5\dlۑ9\}k0Xs2p(fuI^5(soп8TOUO{ B2Ngs/n%:\[<4A;p:O!ɔ4AHsY_jT2̎`:S hN??`=^lX-K1ۨI+8Pc 1. ʼnwK(m_0߈a`MgL1*ӂheS6u0c~|C,\Cݬ2VG%#$86qS]TwXh\" ._Gu{a~F)}@G$k7ʣ6+?U# )~.٣a%G̀#Ŏq\JdЄo@0(|anܨE$Т""riG*w ). %sc=uI01 g?&lGPCa:jP^ےt8&RѲp -VU_7,_K o? V2s*=} . 'npS #3"Z49)W )<@xT>N /q[+L*xFlY⺜Q-/C'B1_{mSKZ~%ԡ㯲" K Pp+CkibR r0Ypm%lsܖRaP &J}GV$kTm)on`B ܯ8K_yD"6^]dFFzV0sx9  H@ &$0.T*[hY{{cMOyjiil q-$c@׌Y+f}⇩K)oi-)ff";H쟻KlV@NRͣ1ڌ+ssK3diУ^aōNqİJ0:M".ܻ=[-\zڋZ{ˆu`?hԸ&d 2adr2nc,xAΌ2b((kTibR9=HDN[ӖUUjA&^rjcBbF61j7]ڛ0ȱ63mm\\OXȗL-_ywj}(\$-g۱\pϲT{R]o1j8N\w ))% wۧ7]X RSERΡ7sٖ2M,S|w;$/ MptX5@^D;vǧ#^JuB\tb6fA)s]UYL>Hr2x8)%]]\LxaʾHO"(zA94ށwUoIyz3߾:](gfkyio%ה~H;ʐN[e swj< ayS~$Lz.3Sc.#CUEy&0P6IDA ’_sn_;دD ~iZ@[ÀAYyIɤ4㈪59~n4c0&KҕNnHJG}K,%Ič o@=u2 rJP/.pWN/B7\g#Fj xii-'Q @(}"J.492 vAˍŤAIwqs;iU#G| 2D;U{齪q'`wքn/RH3 TGL߱Wq ǰ3޶cb_VX0\ܢIyJ|#%j_B '(Vke4Xy>g`}fq(3,vkN#Hj%7)3_S_/V&]11!2Ww;GCU$糝>ۛhM?q{瀀կ{yxȵ-n`b߼-*RA;SOsI22r"> f6e8RRn{aOVx!lAIL" ga{|UHb ~b^`uF%ROҶ`?^6&x}>o3ճ$ۄStHS?O-^ 4KbӟşT[R`tӀU_ij¢WN~'F% e;+/V &ϟ^8^@Wl#Hj߮VK`0a^B?W_#i&=m[Z5 >n܄gϱo">*e} ArhcxfW|r7}=zS?TdO(jE\ҳoj +7ޢ&|)b^C .6M:8/dƯ:ktYM}%"va`uS XWTNetV|MxwE|+f\K c. @z "v 3[}y#sZu~Fpn媔x`}bZMk rܷ㉩GX3<~-tW6-Qa86G%2O'Bg14bX^ڱ^pukԴx-ƃvDQ%vw:qcϱo%0^ le2,ĈOu掌#Uoj>DZiA i FwNq+Lwmc M/> $.c͖-z #O|eOcc?N˫G1+1RT{,|ma^7R0!༟a'-#o5:cLcJ{z'AaiܾcsD"Å4KYiJzWB嶺ݤ9kRhJ,E>g-* 2dՂㆢosvBtߣVMY6:Lعi4﷬4ͨKz͔Ke%F]+KKAMo#:ćƛt%F]6RóKo6? UcLUmzS'7wKV) ϑeh`V:x,&}31#|pbj-["B=pT#=B8Y;RWؠwlHx2./3f7s~ybL4khh^Au&φ~x!d06mjiV]bs)P{^XȮruG&^ rQ4#t2(%v u3w%fo"Hj>vorxѸ?XC78sk3/vuu-8S+D}oҀjĠ9BVX;iv3pxfd}z0^VQNW?;b_a}i2.§A8ƬO $hxPw}bA ئp`=z 5:WHHOa΍%{iؐlz6.+Tl*MhQ]%ޯ7CfXA%9gzO5V8ʶ*avփud%D>c-VKeU,뇂EKyiIlVUlsRMT PU4+J+"nvHnIj#8>,;`1S3~Ut\3Y ’ $"n`7 !p$5s>x vt}h?u:'IP_NLoz\"~׿qL ^JFY3 '`{W4h=*DN[ l.B48EZPY2zo_Pl-~UX-\S92wuP7VIŢdr l "cq%ܓiM8DE5oOVc-ipJpNv.Ѕ-ׄf:U/V`hQWx _LvtHN0VF.Z2Zy>-b~/Fo{ اF&EgkW.Av=Ԋr:9'T)kcJ]/)Wb]s%/)</3.5\7դ1Gqí|E69# oJ>;2- ůͶnGq/ʺ#.Xn6$l}\5X.hO-/8s9y%Ԁnr E5@() )[h=S> ơX{VK^*e,Gַ?li u2(>)og ʳpc)~ r!֯nUܢ^cMo}ͧzl2ZMt+t;=(.]W)p&Á vڡyĴIm20 rsᏅ 16ۭ&ð;2NZgZ. J.5RSk]"O˺E|e$BV|bgn8I< .Gs'&pʅ)C(m 7X^Bʸ/`[%&%Ox_(pKQ<8kV4LTOїUF \w-t L("H{ |^#7ox.I@kn$IUA.ZE|D=B"H fU$w|)FK2GO1ttlC;0|ozwr`2 j d8̴w+1=Wrn zIVŨe?`E{9e`kj|rEHf¿{i@|]Q7F].3ӾPi&ݰk'q=Z* %Ph'p2,Q)#sL>1›F|TK[L2م[~)U,̟$\!0hP)1)A ħQ$YDrgdp~lHX@)(0o;='y;Ng Q* 3%. CDz%SY=?*HPq]ͻAOJG1hEԥB >ր3RTUf`Ω~ӗbiQ,FG8rvY^ȧ1mFA21)FMGb}]TgKm1Ae>_ݙ jF@GJV&F9Z"QDj.N1s7p<&]PԠ0r )cm鰆2lE|G=OCu'I =Jx 2c;]PtO.kLYL 8LPeHqGw?:c |'u.qh׹?dƗ!Oo5pJ|`-YB\o?UYm`OJo()&CW-* ٱ6:릺P܃{ܥSںZUMۧ? M6X2_[ړz_7ml~.W,G.Q $j?4L z2O3ϲ]jJ(|G c/lN_8)WG;dDqܳP)5)] vrQȔ~6Vxz)o~E \ߎk*SpQ!i{hnD574Kxc{_1YwĠΠc'=lv(> AmZG d\sZq x\/ʷO?XL>UV`+ ^+}o 7Ap$#N Hd_|E Drg_ݪQ_ؘ뵬 doK 6WD#lCe,z,CuD4z!'i[lfiJr0C tK*!1/*ͨלv:5<{j\KQ-&]zTj%2"+NF$S<TYbE-`?By\si-&)I*ii?DΜ8Z7/3G^J.\hjgX,{æsn/nXʌ:̞!`ʃ'GU:Qap<8j/(s\-c~E^vpAxX, ӜG^GE teX&6P"* fuZKP9ǵ~n wSni fhI1!e+쓱¥RT$^QGhfW")ZPviZFл2뾆¢S 7-i(FO] 8pCn°1kb:!$mI8y qi2 lw=FMw(Ͳ;#z\5?rϬ:\r.%qy|S4[MEbx\(\[~j8nw NY$^J^󗶰 K$y7S.^ 6(U\0\ωvºΑ"nXS`]Axy ~uoھk6⻔9@xΗfhZ6 Xj>KҖAbl.z ]_uc<3-ȧ><Pv}#2ҰbeDz(8#DO{ጥ9.~+xFQ"=uoK1[jtOn{jseM]:ѼH܏}Y&w:7nN{:`. :t~WYi}h*-4E@ X• |#-SI-ݙppѶJ OSLVsY#C[a, f9RH -U"ZX8 @sB#FK-~"}@qtY wH1`Xn(=XL40յ>uȉ;|ZH(mDܪ%J C &~%CoS-{/[j7`M~"7 A٭;<#C?e~ρʶZt-^ BȘV Uq%V<|7  -jpTuΕc_z7:1CdDSVW;%2H8t51>RʴpptWLV@=b!ȅĎ (K.WkWsǃh:xWmhBcSJ!riK7р|P-J-YqK& @UW&'JRO]>th"O)h}SSVWi󵡂}~F{ :* &Ѩ GfSb;LYʤta y5“*A#3B]ȣV\*WDN`q)\1f ghVa[,\ْe 98LL P)2u,37}ⷩPꜹIuƎi5]~Rz#P5:bPp:lNdi6hbk9as\}K}Š;"dP&VZi~~3Ս z]~:V>LAR"^g}H@Z&"DA.N]D°phF󮘔qOﭭ?r_+Jx.8}[Bv .FY@ & 3}cCY'd߁uܦ繮xDY*4l.[*5좷dn^[ڪ r%tɺLrCV;{⌒g#PeL[LǨ`X/=֣ijjj_tC et+c$sӯoQykVS;7{/>W Ϣu 8:؅mp*¬F%mLѠgYOQ}}x _!|]O ̿IbL-Y>1 :DC/j )wкI)i/hQh Ү,~W76qz(ȧWHx2 K&W bs?IwįK Rt_:#iY5˧mQ~DWLXJ ʬ3 4I/]l pB3+2C”$P8 ! W`r8&U4bv]w aV&GπIv4\d*V<o1#(jZV%q"&FNGY[$%jtIs84mh*Wd԰^x \~c [_6z n;Ѱ^=Xs›r\n yyy~$ \v쾞3Rn_5$cm}^S fqL&{Tqͱv9_HFՒ&aG6Oajݬ%l' >KwBa-.C[E%9l1!m=I]#ؕ3_`0yC1\suͰsUyҥ#k ^1(67LW7c7攀K:%\h> :H}t2yRJGOO*Y=yWQ.#6JqԁM/6 >16JRE|1,@7H_X4dܘTSFg, <~5!~8 $Qr A=i^u龄]@yUeMe,R;,E%_kIj6 D$AEo}6J%>LaGx5hqijδ"eF)ػG?f4Nº.&RoAA 4D Z ntwERX@t!ұ%S=&/d!9\xrxkas/F,w >sN~|U hpbRHXHL'PC A"^kJ^%@pJ\a`md(g~ k)0| )=|ArU75\r`A~_1^B{X+B(r1GT%|xF!ņq,p]԰v tW:u9ܙeGKsBjϪ#QGhy KFѨ􂰇n`n 濲ЈL/ ؇o;927g2,F;j9 =^q(hRMgxd(/!%c5H@p颙>X' p<8ICǤۍ)W#H\ע菅>+w؎D3c%ڷg:=bLb1^8^(ySc{e?HJ-GE{AV_#p (g{Mw;"4jZ-Z'B+˿NmC5^eݙV]d]& 3x)aGL\8{KJ,>Be |9AӔg|mh7d$>Y̿b%OE^\O"~zQ@k{AJ'G 9b(~]`P fH`9ݷÑ=WZ9Cle,ϛWvuY`WTOOд0)A4P Aĕ߂8s׍JHLW6P]HmF\ƬPT'n -TCw$P͊lU'Q$o'vQ+w{A",HnjwOH$2y Lq&,IUbWP)Qkzqqf#sC.2?]RrdoMΐ8f|<$QhzŘC6Ă' xMe'i-)A^@ōӡƻݴX!I-|h͵W;2 :0%Ri񥽣Kfa&llvR|GzaH:">R*v)>J8ƽ#$o4Lb 97= &q,0#X)utS i~;wx 6ٝTޮp ARV$. 8hr΁֚X Xɼc0i^%^LX+Wq 5xj/嬩t룿[ɎtU^/j(<"2on,6U!* I)G$!F%+\_1eQдjTb O圥G,B5>gBZJdj~PD-tkTkxlu-}>4$ 2i (VM1z7K"7MWb ώS~U"IŦ%πC2LZ+Ayp> 3_sV[h^^fk}cVl<+ǂ<7Oiqi)**5(z=o58 ?sd`tN.].h U¹r]J1 GAPX!KYb֍YM<_0> fDEdQ#UjELӆr!zAQMN}44LǚRDF4SLh9,ft) 2%>;4=um6%҇ӭW0_*:BC֖ iRgTjJ2Nx-LrGCb]XZ%{ϳ旲],O./+J/$r0g]?/|J$j%!uO?(y}FqfŴgw𼠇Zȃ D.J“f^ 0"@hk-A+(c\.%Ȫn1KEc] 15hQXkBHm7A&^ҒqhDHC=~,5"6}rA6|iu%IѬW8w"esv(2Ȫ5zqKU3s/boyXvrN'9KDaA>ٺ7 ԊO$XX!z43WMh@o}zH[]7z4kf}(tm4zns$hj$T[ ܾly]4RmD }ě6HHgppc2xQȻ.xw\M6uXMH}URMŐ9 v 3 hzZK)ReX%wsq%dzUxF,u}>.GUS#;+ )=9;Ʉ;8SmJ- >8٦d ͚Ow|3W(VYK,m*KhmR\gûd9(sqfaƴAUxQ5zk7y+W [=vg24v7rb[6#gu@Kp?&cB䥮9.7Kvu zR4)+inLczWe|4~*q`'&[`+C~,gԢWcdR7E.2E9\.9KVYVc hpwn^edƩé'֬(Oc\`))Mq1MDrAOÈQ5|$+)(y/1FMrZP|2TL8MTҩQ(9 ';JTAEQA W5nrF3+MٕG) AU_MJFBQ 'k8SB$yIP(xYVh\ Yz,$fai6|C[<9FJ+#nm/By$>1 { &$'x"(7e< K*\\mF> a]+n0l렀Eq!kZXWWQxj =GA l_fggl+zwdȿD贌SySDٞ謥swwH*4mTFԵ!ǰђ'2ǷZQy^kvz^L݆C/M ($YqJK櫪N VrSǖT _-!wezܽ=-l‰CbEEތrDX$6l }9*ԻQ|)̪:提Ay?~EvN { >OTANFgBSto7 @G 6FZZgtS2˃>gȹ|A*pE HE&dĴ߲5OSC6ގ迦V?)ZH.†nAOf~QDJZ?` :9n7_Mq4ܫ9;3(`dgJ]q i/.,AMP,O) lyth ċ,0LfD㌯ܳ/ASq.dL)Ӡ9lsK<8¶vݍ6<3ٮCqw/0J/"{* PYX:]N?v&'^89JsD/T2Nien!ٌVްU#;΢[\Rtk{7<]A*1 ք(*~ȋtp-^ :B|%cمrlRtX ZLq&/L V aCiEBA*e-Ja l?y7$f*]e@@6nC/NRaH)F8*DyGp6\r2ҵIhB=soxV3 e1$!z *60uӥ@";tZ.1@#ޘYxHO<8sa]>ߋ.'^5Yx*0B`q_Z_d i%`͆/cM 0?|OuYPymj؆[US~k>bIuT:7kNhFgҒ}#:KEA2Z )Ѝi:`mEQ*4ȭ-9 qВ&yH2yz~KQwz%P%^9X!=@0]E]͔༓3IhpȪ5˺v?f>y1RP D$򘲴k 2S/qכz񟗌.>A;W}YU9r=JxXs]-j׋O9;-Xw,{j!B*NAɔ잫MRYB]l}Gt\N dnuXo;D$׹@RSj<ɸ]*xfAr[&Wֺ&i3 %٥2ӪsOH_`JDB2ǝϧ۰#u6^L<` qglg.dV~AO^> { wo]>8qP_cqUh%s'#Y$5gTZk>g}*i'Ӏ(8|9mX9<!VX1;R߃pۗ؄Ya",ZSp5sp8߇ȄX ,ah4O~Bu]☓bbo_ =6>J諾P5.7fj-YubCd ;Q\ҐfqtNC{9wJu7 *1:`)*P߷>1:Hx4`p˚Y*fYv>&oj$ Tha+d~q8VdluҠ6%M| =~9rR-CHF 4<Ҧ'AkoPiќ|ci('m ]}A.|ŭ{O_#BUr1D…Q: RBBOaNMAE9A`[tin>z>dGAA31kZсv\ pnH E|@-f"+MwZ4^"n@9V֙j [˪N1= ,IC QNJDWJ ms)5m:8H_Zi[0^;ӳ, Lx>Y%ua5 fǕS玂Q1FGx6+OzH4P!Q0$%5zK~WwhI`tW AǸ|wU4֘ jxYe*$y"aUz]1u ;O6#QYV}BzHnq8U~?FhkYQ5IZh7vt5DwsU0zqDtJ ?NOBmYm_b[QIvٌML~!PܯI1=+u*~H 6kޞ-ŎbFNd7t0|1VRh zM]++Yi3/$&yKRl6ïR"^i ±HTzxjC= $eRqToݖzFβjsn 51!wā+s\NBGRXf)03Lp.˛|ZH"2\Z@SUԏo" t|ļfOq2cǑCH W}X(|^ 1% kPBӏ2og^=ktwA WRoW&eE-CA+3Y `)Ԋe1oyE c_OardY/ɮ>n96Vr _|pfj?935iR<Ā%xc  䎊%7Ž54DDƋ=.| g톒!zi=7,xF#Wp: t /9>ӓC'5ҎM&{9kQ\NAJ!LXVg ~+ XhrG~Ch9= ‹4n ;l*EKɀמw{w Z[x=N+4X<Йqpã<U >|[̇]5c AFS2xAbkqw 8@U4FaVsH/O5.oC F3| Gu)dkq;7%K5 4=l_.]5RK^9Z[2bH *d}eWE^Eigo4ÖIBMHKIls`@tțu[S5 Im,ic " x(fmxPS:ZR8cj_QH L_L)| ox yT*)m`p`e3qaXrHY͑^yUr80* SmcoQS9/t\`arȱ:9T"Ѿ>.7vRI]"-cc!26lVԔwM½r'ʾΫgc0e\A{eHs9:#A0MulDE([%]r-Pv5gc.vȧgij?+\x&:9s6 %SŇXc@I~1$` 1%:SH/Jq(f#Mer\OlJ% *kmT<pE|Q;5L^W?ʋ^|G AY<) SY-3(ZpuObt5sS Kxr_>l[AA9Sw2 @+$>{o/Z9;!Zt< #3<(II _K |7*lL[-3.n9[AJ`&]W'ÀnHbFjWu]ܗt*= 1YQ=)oc-g<zn)Ea_x zw6۞-ǧix|j}r_cXX&u󑼧܂iK!|HЦ~LJ!pb.SdD!ˁuI*1'9%,vv˽}8E2(/Eq{;yfowymj=c&M]TG=S*~]AcSv!p ;5+2_֧\ bXJI g11T}6!^-DM(jOQO1$M%UΕлNx '$xd9|o Xa2Р?{xuo\)pލ5a?㣛?DJ"l櫰5ҶoMќ )>HO=zECkr:#-]Km$I) Y[ #]6O3VE" [I!^h񘎯_Do C:5NaU9?4LL*4y'ˢ[ y>VH9|[wet8V{'NRW$hQ^#uya/Y'ȋ;d}P 5@GFbt[nN|ڶ٬IN-@-L"ܮ"vD{t@+(!:J5R a0)6pEI_qg4a]RMeJ{̓n4ڧ+ȤO58{JkZa<#GͭJ%ϴ<{+_Wq/~ )jY4/3E1'TcֻNח0ϽM+ iſ'-EV8y(ƒk.,1*! B9zmFN;MЦut ҥ&۴n{xɈԎi>3ȧc-2z( t3?atEYțjo8(v' -:tÃ?T{'锟q|vB5VCvy6'!d@Tn4ijդE퐋ǂan@82h%<~gtk+ egEWɐ B=P9i@bωŠ("A,~܃nF K! - ޵Gx8ŒU*rνL$JRϓ0U{_(̛+Y~HEA[g^X55hkho ~ױ+%=&4b60֥$XZKlѺE;?z͢6[;ukW,# q*; W _AקV?3PRIX<0 p-cz$ZnW bRMֳ&bwE 8aF$gY[\) -.!/V6ÛkCM`2 ~X:Iu1!X\ٺ!+BQES'k^Lpe"$3OC]jyz>yb ˉ(D ,1G _BMK,}xڝ(nwH f٫""&hl Q:SSD#.|nj4/TCS"NbSbB;M\R޴l 1O$ g8~Hh) fr*d3R`x˔vn7;&69pa۹tس#r #M=;1 G=`-C) @y>NW*=ac߸ ڵV ׂ5#8ZM2ϹL&,ͯh;Zȶ@T6{Ŭæ?)iIvŸeF6t1;Uؘ8R*2^CB^ $\?Q=sfc]&K6y$ \SŤ?f3?.)d4#?h{L3MS8DWG ETڜU=>Hr/8/J6P`(zjf`ndf& Q0%4EшxƝեU*T`]$WcpQ*$_9WOL V(tm]`@j|I)n>c.M;.FN̓18 Ffthv;=xXTUץ'Ɂ+vdGɍRRq>]nfP㝰qZm04' x 8kD3F,!]4A0Un}xgb ^=Q=2I Wbyc+C4|HNdB *DbU UFvOLhj>0\kथt-KI2k1#Շ\?;ѽz)5B?(P{F-E Xs[8!;uEesXRX8BOmC#:Mz|UM8w@NWӒpw9C-, -{Z ea#g"tZsKdN _p3;X"{#e\_ p_*fC[;^OI7ec@iTH}'*5D>o\)M7 npe谎nأYl{S8.B>u<*H>d bTׄJFtS9soHM(Xfc$D:F U'#Prx7$g_cWu?ǻP;;6(*Z{KG?>CO/=x18GFZlIe ZXmDҌ|Z#mҹ= iPk \9VQ%{OD*>),-yAO{UϿX5ŹGEdڻ擣p+Jt6= ULM['@#eI8NhW/3mϝR+o";KHōϵbdWw6M2 C68W j$(q_l2rJL"+^#|й6[MJ0&%(2ҾﻦXŎ@{P%)`V6XR=ǿUdPduUc {TVO(gwJBhhȾŨ|POeT-o[֘P3A5@6gTroMCт|l+bΑXy5ϹL$ .\ZR,dVS#ܲdxt-; 2Cp;b6\2u;sǩДFɦ}S*-x \G*'o%~Y43fC9Z < ^a4Vh25ׂTjFbtY;U$iɚ;fU|K e }U6zh ؜3| zo6OWάa:\+MϿ-cS("BН! zvoD}?>m~ӻݳ*Nx9m@" WYCCȃAP3fl4)(]_$e0ea?>llIq5`0SS:݃ړdOrǩ_g'LUw/59Hk37z`ðP[f-ge,(;+!ӑ.S{e3;+6\ ~FmWv os"R[DXL)~};qP-Tgك;9V'T<6?i7$4V1dXy1\\oFbLnJɛ:p nfEM%z07n)@ŜOMKR!>c<'"(.!^N69)n޺_Zi9WN33b +sc#& 9cv8 0 Frl.@Xv7} yuJSFՇaד[K2lg "R9!@<+lGkw8ˡ Is^ZXX#w~;Ҁz `Va~ʰF~WBRi[' BLzeQUO#̲a]CRW &XO=1GnJQt.fp"'V=,hbum;=ɹ-avw\#n/}JsyIWx Qcu Uɏ([ZS2glg\ NmRln۷-fE(@ѵ"fr$exLMĵtRԑ:M,g*2:b@hlh8]JDYbtY{1l0Ref1#i_U,]msZ$:OUӴ 1ӝ, ދЙWQ~`M\/i:ftNM <N`gvboZЪ@FXn9A񉻢ytK? 7᧪:2YN1MC-29 V⎣ԩ#R'Ә'L!շؓw@:?^2؍u5^"kސh<=4:|1A}9W/3K{Jw%ތ uLZE 醾b^WRab/Zͨ͠S! Gz#E$xjc  #Kxx~LKL)%a%щ"f¼& zR`W}|3"$sO`XEV " U cDd!صDP]4}=$S \?o#t)1Kl2p00 @{L\%{,>:h-cA)$'/t/GlMz\(sG`M}yQ f'T*:"cMg ?:Vblm]lӛk4ڏSψ~Ir՗xi7 $-x2$[^f<ўJMcA n֮-ׂ-5/u1rmw.[ה϶:?U=Q+t/-/Pnjm NFg`)gQT8_etLtVDNޮy''dB#;[:0K3G ⺓Bz4ZƟC^v}N[MށSEҋBb2R?hovW^Vc#RC*aH l^/b݋=8l2gI'BfkTĐ u/2mм?وrK)$-"&$4 rfm&=u&u,=P+P N҂V&oAqN;ǢY=%k.oILhǸl0%/՛ч|DNP|((u;/Sy'id2S=ju׭NJan9=坸idqs~2|etّsˉLT6 :"۹h֟e:uձVn}>:^4Bl>zMdm&h\'K9#z >DtO6#V<LDwq%S5)H2= r *ÿFX n٬ u>RC$6EZ#un-L⎡M+ PMJf:d %>C rnza-Js9)=/KEZ,Od쫬k'x(NRNz39_o"0C1U>#$IfIy^ĒZ~p뜈9J;(AF싱wg@{_BlGOms!p4uSm\+8wExe15āMUj\,|#4*CyL!%-_^[9*° є.bZ6ID?ҚSh2 ?v|Ʈ2 /mB'_m?>k!& ⺩l.qjvP<3y(`R^hի[vecXy2;{kP2C K_^BiPBI]Xo>hR+LUYn<ޚo.A%pz@eUŇ 3)plzɪZ A-NjfkL@r4A]J@ڊȭ*R:!4sja{oA j@m ̩ԜӇ.iBQh[Ĵ0No:y5'#ܱoaHdsԲƪe%rF T\MnC<#mA`yY :ZMr K#J -_gP_IT/X7J`5eҹOent01aM9m-\Pw9 BboϹQm--$V|Q\}2bY:QOccCH&2H' Prfے+l%&q9  Sxw4X5F= ne[ ;lb8?wxח⁶]7g%iE:Wu'M|6os C%#){t{lOs; 6z8畲<}1lU=D<9q+c\G1-+񔠇fjTT^w\0J\|C˃}I :oR{GƄ}mDRXP+_A-_$xّ45+I Y{I4M x!d:\j[9 G O/'rLwB gMhy!?lH#bhwZĻu+֟i*୺wGD\ųyxw_=jnfd,:~ 'VIF:WmO,oy&>b-xiK8 !у㖸o>2^,uw4+I$/df'u}@Xy:k|RAۻ!M˻q3g2_FB5UDA/L}Mh 0L2T޸=?'<g[WNdTmH l0M?R$Lb EIݬJ*o#SN!i]g2u>憛KJp8x_݆ ,`i=s:γ?99dh|ՏJ`ێR,E4nRDijJ/b\N7(2y?vhhC0vgWն MXtW?y8!\i[tVNmj*/p%\_yfUٳk\sru5hujS#q&%|Ż][N7`|A4k0ؠpv)wҁ"+1Iԣ`}O4Σxk;ǢoʳOVOwjW(m{ݴ5QxK'N{Ά `co/sxaxK7~)x2Hʢh'CGU*щ׺-;4sy&&ӳvzwe &I,j)}?)0-M7/*p)Ct)-{l>W/[)ԇBCă9n6g |%Hq}Q'ŵjѢjC̮CRCs\oꥭXԭCʶr( {Dq!s93ת`<&7s͊Tn}.nGS1舰WuƅLl ?qAg>.dPa`VZ{=\ smfq!S\-%%6JKDP y7cDtbr{MtSZk*oOhSj/Dҧ=_]{cDWź$tn z&NgEeJƼ{mʊv TUO7&`$w=QC?b4Zǀ0Ϸyba?24_QftPd ]0-RmNśJ$--z]W򱰣{Z]9u¸UݪLOUIݾk ]qr/?4<,EQTˊ`=srь1pw[tr˹y``X}zg>IRl#r f7vfo<x>uЧȅ+c%n5Az#S}uRZ2.پk"{=~-.7 V#5Do”!-Z`>/o>8-i[zNRCK{ЙҮPvӰv:l MA_QҫmIqHF8Wv ( c~"$qj:QUoSXMUqSݓ]My3'bk=!p{ꘃ+alGIq\e[:΋nơ vBQTk"}C [W,)k:AnY*trCpBCCYMNz8 iX:aJо_Dz6Nnu3D?WB ] f?mb/ZYBBvb>3OLflol&ȱ xcˆf0B:v@[ɫ _ܙVa'_͏I/F-ѧݶGUYk&R;H)P]3"x] ZT~Gy޵ݥ1Y ti5_5 !Р?cI+n3]|jHN0rfJڌl%J?y8О8҄hC"`=ҫAjE }^Z#ʚMt73Y`o"'JJ"7\]9IZvLyܘE֤PSi@ @=2/(!0|`'FZ3!8}ĕE1]e;CAVPȬH)SmiB LXDhr٢/.dKB-pmfGjGͰFC$;cv\DlJg`Q~z\`y)3WmE_ =~, 8Cr{.gn*7eC _â~J)ۭ^^x*ŭ"$ˠz&mn[MQ"vv[JI,hu$Kt;DCDيߴLVB ⾡?: :ܥ#%Ѻh6q z}IAM^.hО0v?mEP7c˹Weǂ_-\a>w`*4ci)sLMDsRUɁb+4ۏpk9ۅ}6%  -^'/E `cd5t7{њQ/!|n߆doNdgv1OsX&T#ZcR(fc=f G.3 w?~q! q Qc2#R$T3[f0cd46Y($c athŐ@:;z_D&\3*d "o$l[xNF`uZY+GX  -kn. CBVפSR#٧TV8FdVAB:~>qU" G C%SiZ/!߳ܶX)~H[3+J@9ɪ95! GWƹhW|E+V_Zb'u v "w~ ϪČ.KNO+3ZM4F@`(RinE3Öb xqṸ-4TJv@d &q11w;0E@U9a;x s\0 wp@zqFL `#9#9v.]ߢYP8$TT+kA6ӄ-] oѪ)*BŐ"msvS$8g}8ݶK˝drhY쳎h}/a P)坭[V l}2زet 59Qyt |Gse43Z1aBF3l d1V=}boCoWou, 5İ 5M^دUs/{HEt (! ozS()moj&()5U\1Ll@g2һt,Om,+`2*% D6égu|vגp_k dLN߲س"G]Rd;QwR4I0#n{PpjZ_$ۑ' , EƐmZVW'Pr_\Aˍ2cB޻їb>,Gu8ktDOj?Ayr Ň07cW>!st yBSSh!bfJ16V~$$Yo-+aapZ3|̈Jd O%z1HHn1Jjr2:2C V /q*XɛwVʐyXƉe"#Ԯ0 2=JuM ZC@4>cz?]N0l"o'2g;`*u us1/BBQ~ҷP-}kHֶPM**f,W* 7\h=;GFuto'־ &OIB\{ ;FT/=ot_Y*xxH%1!eTKVȐ ĴhͣhbQTET,A rK蔵:Sx}'! Uw043&UYk &1j1=)Ű=H~7lO_EJz8>x8k?_X%8OVo>$p2Ny^[^O5.juܶTUWp!cEJJW5pnzizHOaF$Wбn x2B0劺d^a/2̌✼GMِ#}Ouiz;yQ ֵ=iXC+a}BV&B_A12.JzSB +}R0!0,lGEVUtH7 e *:W>Q@&;4;+okdw*}`Pkl;HL(*K$gBV#ְ&KM0k7m0#s|^@(Q)?t]ַ/SWvoEeF[Uvxvecm+%m/4u-Yް >n||Q ΤØ}i nʦ!Dute8Q*ؑUj+5dmކ_/BKs,uՊd":P/Z)]7bl/Ͻ T;f_Ɩ ע~ЅGXůG"G*O[+L£kKyG |xGMt5;q4㑣`7Ⱥ$]dceaM7,y|!jݽ ˪(H_،4L]!^0蝶VJ0)sN+M"3S'e}'zCMs1|eA-kEU-,weNX?XzuVEVsJ"WbEOzFjJ)Z0h_PZk-4P0 h/ۀBՅ3Hܹ&F9-Uy_i.~Oqgi*b|$4QQ ckߑ _ ӳe8س/#- _s@踗fioJ_=Wy׮8Bۚ%7N㾔ޭY9r1^Z,+R͵2&:U0NC`gv4Bʼn'Qtw̄r.<s 2;Q:)WMn)Oq{f ^IWoSN q TnQ>7tV֙2@'.7586/(9 f!'r0jٖ`],%Db)r;'_)aQ 9)>n0itex 'ir/%<fhZDޅ OmֻIȨ7> YiqQZwzp,n{e_`c N3eW&9,!kSrWz|oH)bUsAފ"jPCk1=/9d*;Oa'{=oF5ȝdh›00Nka%=w`/ޡCF!j,'2AՈۡkzvJ ,(aj۰i*v?LԻTbN%y,.ͦ:weͩ>EHׯs2l&1sGxl3]~_-$ qu+{I+~0t?g0H(!8]! 5[Pߏs;'1ߧ{ieQݖ}6:矋SQvxn ҭ]&>Ǎ .%GUA>(æc-Fۀ^TҌM1bEJ?uv({m}Yc8H5~n{ѥ[uNxXI'Vt%; LNSz*Mwi^Hjgh#w@e88UT~*| }a;vt_Z%ZH`n;$OX.|pboggV5TJoƒхNҢ;8?c|`H8%ڤVgr*Mk ڻ vA{_HwfZxٜG/Gӹ(v=|`WF)pDY2>î䜣a{-`_T>u]:KX,Y,ze[sXk >/m,Vz7BqpU_ȯRUV~s9܌=. "YQħ=DznZL$|37*9F'tmsQ)UQNC?duzD^k$𸐴ZVHjod leؔ_"),pp!1hr[-_LQ80K$1)˳CڀSW{WL8PMO(|f`?h\;B%4wJLIqOY-^|"NӾO+d4"(%^v.tdtR*݂::z{_ܾK;w6kLKXVW|y<@KZ|attv6zvS I~KwtK⯫(v&ϦyA k,>;U5M˘W4{JC7wSQQ;)5s WC\&[[܃s6 *RNˉKMK4os#3P2g$LWG^d[;AUa8_;]$zo9 zc"D'frGn"aCn:ebeyϟ[AsR`8I }Dxl=ex y!j`e)G g75nknjX\QaCԅg,LU#>(+ V-ޠ/6#ChM(ia=\-N,j=eS05cb `%gkxC;(ә; :6^qirX[ )it20Dˑe#4~| unv۷$>\ʮ%'zoB\_"#7Xb'Zq '&猛EuQvdBAwc+ϧ-fYLk $OcD+w:?2ל3?cZtQC_)J e=%+Dxo9'***wh{&{HSpV>Yfw#'4.Kùs/&+CeX%d1΢7^.4DŽ3< fп_;5^XOD6R\)-/.mL;xkr<;mW! 旜4TVV#eHJJ{r#j2k"4Z7E^^l.=;%Ų.o#?%{wAAJc/uy̓.+8,Tr&ߡ P9vߖNzIp7Q4g V?}bš8&f.Or41%HK$A[!жP|tEe,Hm+mjK+)jM^buI(&TL7IT=b-Cz<n.ct7 m]W߿H=*(]U/khl Po:=`$7wҟ8ѮCw fٗD1ݩ"lF2-[;RKO"zD] ;q%hp6@cTot|SݑϚ} 1wluMt2LKIBb^K[9(^fl]O Sg$d/LbW0n7P~btvJ2PY(+m#%}g%;W(FJUOՈ狜c٤6m)>dcw/El]1VB r O&Ź-mڡ1Q]te,"ڹ-qK\{!η|9܀_F}Cohk̚n]dڮxV}fNYB]Z\}#7֤L" x}= )Zgdpi0NT%J8W#v8S!Ec?FSG9Z+|"5&lvb'|NTm,7U+{Az^LU۫C*Ü94˄%+i/ 5 53˛r3`ha &uMfhg7g,*^Y}ᄖ=$9U2 霅0>{&+%9+'Jv77Vb7mbƼ*h?O"7|I1%lE"3}DHZBxW: Ag-MAR{>$-Z Ho~9{D "tJ]%c}L6G {62q @"qW&#mrMFpZ^` ϖ5?_ڡ6IL'gax~ 3W'^o<p_^D5 )o2L w =?gl3I?NnzpN#}/t؎)6kBdbdW:?-h]=^ǃ]wUڝ[8 {uE"|OZ/uرoS% Gײtg?D_[%l|#!_s߀Tb(sW*BX'W4Kb|Ws&~%Ƒ܈1tu/ N 0{fRSp6ljoND>^UV 7dD(a+wLś`OA<ӇHF>0JIW"n15'Qχ/V^pA؃& k]q[YCdӆ;F5To z>~d`ӷ\+l롫T첪mnQ(}'ep8-='.u*wD̊tБ"W5g0݆dGvZE%1Yʼn~FR!q (ch44f եeAe -]s (tӚsڒ%idN,иf\kp~'wY+sA\IiH_S9a{nfpYZufpsMP3vw\N"6g ꑯDt1鿰["^﫹+(QFݓfh,4)-حбG{#GN"]_C[kA$1,zBzGM=U~N*4z_[Z~Va/DWj>ˮHk7REÂ0*^8E'֋׭ j!?j awYeX;5k5yc]! [3 dN^nNIXi2m`ZNY5V̻EܻxekAe b (7 $)ۉ\G4eP/n7nჿ&v͊u\G(*YEGxUlմO V#֊nB=aB qʁ<Uuڃ'hH(J8 ޔCP'0E14K}^'PD$A|g BaeMo;ppIĮyx[EA&kջVja3tH֋0k-Wnj#ڿUF^äD#6&K sMf7>2%,I;ّhJ!̀W%}VKs[W2&_ӀzLVcV NJnDꍢ=UAlGZUr&5O|o9\lfhƾ:YXhkl' /M[&cڸHZU!#o aFg{n=umGKȱW̨Ҏ˧0ɽSaPJ"Y|ӐLv"]v,'\?Oģ.RwS +nxT"kǯQd&#GFϰg,[8AU׋iQS4MuDl"1_}_nTk{˱CU9߽  GF 1 C;]'jSc0;x0 y5u1v %ȔOገ%!!e Ϗat Qvgj#HNk](*3lb(b8nN\k"bUwݹb)[bu f?<G*z4Io1c fҍ> ~96҃lXb^^5C iރGBp\4kN;toNT\-2 Ь~rA ›f&X53kC㗸_m%僶&:xP9+XBc)y!c׿0olL;T0i=e *mG-Gd#2`n>, mvsC|L]RGՅh-G~CI0 O {(ԭ#= .c3y)[:ҽϏNx5B&#զYt6qe⌫SP [_2on3OJ}zr/ "~/8#Nzh(]958h\ >pcۥ.5G뎤1ߌ;R@Zì#'GZNj8!]`cGk=j3Gm _ ,W-rblײ6K`N8I/ m6o%)=jGF ijЪrB[sd˃^X~Uסqq455!E(缾ak~} ֑C'>]cs(*NbÝE-(E#Ԫj.VpsQiU -.xt% =?jܾ5|ֈIu/w$DG۶"Zڔ[qa{%Ŗh"]N'at3sCAk tDzePJX=r#0IP ]<S(pExI ~rEOe)>S8 H#T-'5-)aX6 L2nIчpS~ NlaqtTwpdH)VȌ.Y3ј0d'~P+ǥ.U̺-DlS Ll‚01٣"gց]QbeQ)Q28y8.{Rg~tܧX1rqOXrߖKsC]ix;~[-l@BXt~"b y/s7>=0"lݢX@[):/DWJ])9yHyD6'3-LI2_+hJSq WX'pKU \S 8TRXx&p|QDQG}' /a!4#M}4>v*DžF{G9xI֐3 AG:WeAMqFx !&gROͻQd# ];]΋0#V-z6M,J}1CwJ,ُx+ci7A9LӞ-4TV(a-|P>%Xj*-(Lc1cx(&} Y&cjDh  Ƭr.Z˕9c+(>GQ~hxq`W>M,EhZlRdqW]8j^źz+Wa4R9q=?GrVz&bջoU*wz~D&6*Efp'64!%q%o@Fs|K9`kN?dULaXT tu1߅ns~9=c x i~rQ[W~gb\ UAul%1y&CF߮~^JlUa;D& 45%i(ԃTIa3gm ?~RjcbاR}wNy7O7'I`>ji_t+NE$ ny9S qfJiqo9q j'"ԔmCv-tF;DHF p9`e=c˖"F g${J; c3QtkuW!o[4x+r7udЗ&4C&tMy  V,w="TQEi˔RD$F0"+)$@::WȤfG`׷_֣ VdF<=5<"T _& +ỵ]a:42+PL ~^SvUT nqH*K~+{6KE;>KPݐ=vϨlz /k/}ݷl-M )[)Xb_?ZK⅂E? />nDdV E],y1yɂ:GfB :Y`I,+Tn8'þI FVA;Blr_1>A sm_bE:tSMU9"#D7g2S&˃c He -h65+l 6 ۶IЩ`J[!vn^<j Y'x/c0cPr䙐s^bld׬673'؟hLcxSc.`1lƒ:|$!3%.k 4cQQg0@BJCGڣAbJz`C'ycp5cزJ~}pI8K{鶭;=6ңK&9i{XzD=V蚽3KO¥TGD[hIfDYpZvCi2m0 \孿ˤ +qqp. #01;܃ytsX88kHf^g%n^߉U¼7)|7Xf_=,)ѷvI `@)s!.OcDިh=;]<²_GU.mX@Vno֋Ѫn4a ߫y@2(oaL+d" Pq+,;Q;S܇ȷ/-{g>8-j8A\ȸ|1`EBkH{몐R$0eJ7l=_oIo&̟x+泂_ecp?*DZ!LU{*Nwd.8t4SY(wP/mҼOO|lxF[߆3Y-2ÞMJ깙'GФXQWܳڳ$1U ($ ͙kl/đ nn! PᅒuH#1%A:tǎD3a8 {ZI;HO7@WfcXfᖻl,bdW'bM0GcnFz׀Bf_ ;2'WoV A{(>U)!6GCRvz:6~Bdb#S-]Ҩ35D!G}exʛ4D[6[^VnkUSš r2T3%=e pFV]_߄Q-pK[ /$ V5"[\̇U!N Jo]wq>HJ U$^O+sxf ɄGw:f›hHTT-qHIivqa6f d*mA0Ya0`FQGV5dc]]f}"y]1.\5^]EsO1ysli]6\ؖҝ s٫ *+&y*-m!-ѿ"߭;evH.濋8 q)+AL*_Nvf3fdse B? .'j+*zSpZE49]v;!P+_r4ĈB!zSaGn =mEfQCۢSil\K)^U`^/OQ!XgH. īyY$; eE[^P#KV0iǔhtF˰_%BGn8heUʈsaX/ZnNɷA<eyWOh0Xg͐TX\>1|H/aSVq5LH)Xa*bnNI!k ;dGOfgpP Z UVK%t'Q.'j4#v@ L㵸0Ko5%Ҫ$Y[[u#V\bƨ^dJ&:7 Fሥhûxh7u&2 Tgz6`}̮!;1 qS hc^ZqC,BƩʅo1y\lx [oB?1ak L+֫j3o9srHoois)I-SJ{YQbAZ rmzP{U։RtرK+bc'FXLظE;iwf Z_#aro[7Q9”>',Ko^Ka≂<D%ꃛ]_ LB؛X:,, zn5C_?- &YyX =fStKfH]}(~]z75-Jn:GPZ82,er/EL#+ltlWZH\?Twk{ù^# 4[ψ]Jw]0R~iMJ|u P@V{bE'0V0r+7tPZXIMݔ' zG)QM%0[u(:lI?! B/u/-AfVF5XӚw3Qۉ2bl)yDSnUd\"(KO,mxbKqam.qZZ] -2/JC2u_^A= .H9ؑB&~ɯi.B#B Ϻ-.sxHAE/=T1/S! gM虔&6ƒA$H8~eJ,ڛˀlXi1Ћ.~N5Ћ dO$*+N5Ŋ#:]Jy8uyRL8>ʵas845Oij=YCroY&@Gv}2 ~tZ'PY.UWb1e[k_\]ŬUH_[AIfE9U )u84K5HEn8J.ق-C&|AXU(k.vT05i8ƒRgzbEeX), %ǦZ{M[cv+wh)ILWPish<&μJavbvo@ A 1dsTnLȅ?9[ʥ%0RH=]HDzųa [;Fʰ=dz Xӎ9;q 目&̄FaXoamiRDŽ8rJ`LZaJJo,GU2z>Ww'g,-/bNj%?ؓu9ҋF6<,%ȿ 8:PP_ޞ또i-=+>px"˘G<۴1>OkSbE0]$YFab͏1aM54`攄tu 7r^$;'YxE%+.Jn9L /#nB|>tӗQ!%ds+&@<5ȓ֨x"E-XeQ+KBӱW/1D+b ^=wC7:]׿yl ^5dmyu/ב]ˑ9?#m8g7HuQ ))|ֳsNX~]-f^zX fp%zwJr4C$h԰V܇`o --j!|(rEJ*soؑ_zT|%<-$*nS߁dmSQ"c'cx!4yvy U7p.c!FWHN"c8Ʊ\\pp:}Z"0| d!9:劷uZ+}2U V]dN"Tm3/0#ҋzk-z1aCk{bڰ0tOQ&E+;:TYZ5sF19 G+8B .S hYiѕ,+n0 r=9WbҾԲDv:&"HǐS(*()$>nkRկ( 7kSN/vzY8\cU Z r&]cǰO K`REZ#s+y Pق\󠿥WyhАƩnΪ!4{uQ" ;\*A/U(;ejDըnZNL,F>(a?ʍ:Ŭ w]Q{p$#?JC\ 7Ў7'RBu{hD^MOoֈBöV Tc"Ƒ?3+K;dQE6"̗U9#rN(#ln#M#,5QHSbZ|4} \rlE)(ZRt\|YSSa㦜`Y6rѝmzf3Ge3gc"r龏#ܯQij.CpN-3-6vbR}-[Vi3LDHUa,QeǪ\RpDE2sb =i.;}Ga dU?`+#oW3x4 ZGFI8yPI APTx`n, C@Ŕ Wi֏LqmP Ʊ]Ƒ>VNfKUmL$-\)Xytkuh3gDkr&Fe{X:SG͇M%Mo-UXz+& 3 (vwBx9 Fcࡂe64oFwvq_9NVhG2WϾ  7p^嚧/ ]NJ|}gl==Jb9bCh TN)뤊+|kȾ}, YL)q}d sI)I5|ݠdDa`lJĩ.]y^5ݸ#>qp 24mr9x +ԸO}_"H6X"@ 窖qNYyaꇳ\,h5/\%ͨ1n~|tgiIUZvA0b!V. # m;N'{Ц! B|0|ˋ5՚0ܭb.Bd' *P'::AnX\|md *e 4ӎ**8Z>Jۥoj7n< I) xEbCzI !$.%W60NjUy˦ |:RXsUMp$ps%_&f >x pځ@Yxr5bF_/*oo݅1|h\gE.j)%Q+TSNCy`[f  po2Vi+/FܤeC/e4 ^D8-| h1xJXz 9-¾6}HPYAR~ ͙Mq@,Aj*ruF)hBstkW`m#=`r PB :>SSvr a7N8#bvWkCoћ=Mt:%'aZ|iG&iEiuXڵ *;v\ Oz@lޟX6$Ly"6qE0K*WسG5P<$pn/(e8n"B,@X. QݖʄZּJ,hex#$/|x{=LhOqX- +J*u& [;87dBTf8sz/4BKhgL\b1۞Z$;s6Q<W} ]n.Ҝ0:;9Wá,,_^& 99_OlvܵĽf_Ύ-d5iZ6D煹=_,xť5w^R P9;{}tbK7 #BǛͼ{l0M WQ;$ε}Al>#HU<Õ|Dܼqm˶8&`*wPvG.F"l]|̩SPdɎ]hﯚklV*ی  Vd-'FYx1?m;لd9Qc|zP.|!PyЛbe;4yKcE. oĒ9gp w؁j.5G1c`l͉7IHOHvE u9`8j/tЅ:vy~ U[9{{'{[S^<~!uߨՉpl nT[w?h!KA;z5[0Q b ۝/oz+i+] xS<9%jAwwVCj1m5C"rY~!C98uFH=뼮{'\%q)(5WXƪ?@ul(Ua'ٔ_{S%<;|2LqlBn!0.k@։݂Ņ A.cP-BS8atSPߧcZF"E[HZ%V)ղ`k.*jaO*@Ra_j3틸<SȞ;Lh.v@RخZ~Õ4_ުҺ# E]Me@Cڤz';0̗WӜ"q7~-ܓPZOpBȴDgby9T0rt%&ː<ص8TxO9ɤ>GQm3å1E֔#lC"tX6']q,𣌼R)Zzb:eIV7곧x0Mʩ8 oêy` RUDRjSq^62B񳵋*@Mgt@%|#2谮1*%.<Ϯ USR;KSMCwS2\%&],A,V1d}C4GW 7y24SY1~70uuI;adxt M5[s:ŢP'<<k:PC,('7- }4H%eR+#{oԌ4Bkw(΁89"_'1]C(KbCɺ┆]Cwz0E^d,ܦ4]jdUqᑿ{)PțC;aGqo2 -'-fa"!7ҚS'e|̤n9 (rSquABOgf6 W.zbiR9ˑQ_9/F_~'ejɾJKgK9^-UllwF>vv L%={eb<Sa%P!4_t6\!n O񄉸3ʮU8i Xԧ2IHʲz-C @fd)+W `xŭ!_N)[`D>MO/R%Mu6F ٶKV!DK^~)Gun{Fr|Ɍp[;t4N_oǻ@xsI *+W <ø"GgȝC`4k4V& ,a?K2Ee;gB Jo>[x%-̓3r4*{[J#)ኪu=|o.~F9if]%WU6ӲBA%v,>Էۡu5|z{ }na#xW =st^ lG0Kҗy/s\wzbOȥ@P Ftro2@#IE= z7+ ) Lv#|]գO6΍N~< ,J"[t%+z \Ɋ_a FAMϙp wElL[:Qqh[ޗ#eQ9wO2/]Vr i4}ﭧ{nwS6 vDJM n۾Bӱs%j{Iv"*:AfhC Eq ՒDAUF) a ?^NEo(8i5ЛCnRu$ `ܢN׺^sP_i`md`"  { R|՗z 0.ؤ 0 rj#nN2IH '˖舠IM7z \N+S/հ_ l&!!3 ۝ 2"n~bS?,LV,6:䐽&T^DttZx噴2B+}6=@qu=s>dfNW_G'E4 *MـG;u_~V +\ )!/1gM:ͷZbUG)PkbܽX8JMhZ v0z . 9MtCwufIDމ-{:^utJ/:'A<"PUQ2 )tV(wǸoyJV4&VGmO !l,+qňnS),7I#%=!H(6T7tz$U6B?9o0[[}"y4ݘL*e|y~g PG>fdXh `G/lM4F}97UGdҲ)r ^ @\h]96%vr:߱TS\KM)r}=Bxm7)|rjkDleף-^I(3}㬏CɽۄqC.氦|J>Ώ8YZ~u͌<7}EZ!}0.1]aW:s:+xgm]J+XN x("TX=ATga~`UTu 1*oUGϳH|g814IjEA ]I:#`TNk2, Pf>)a!I' T""0o;kz[ևBep!Ì{FKJa]x@ AC7vS+I'1vT-b !90i6 qzrqHQj4]>͡o1V IP_kG"^(hk/3ڜ\6W*"2VqHR鏩Uxdw{ d^w DŌMDVJ# S_C7:Л N^,OEPfZlX(%=,>o \_!y?wu%vQ$OEb>:C[Z#T`ba885a"U2geTnTpT1$GQTΞ[9)fI1[.f=[`FSx g0 H˥gteT ' [Ð [GYZr~Rwق{lO|1a$ק>t*ٶ!vq˪ v{Y1h u4B@"4o,u&Q)UѵX0t h:K"0TcZuB*OJ`E2]f#TUi2v?7Ƃ3{ SԳpU~q͛go'b+oޘs@K6Ƀ,+_{}MM xB6wW#sRU1+BZ^s{/p b#+v]&UDd:iSۭ˄@Vv).HJۜB>/SpFm/VPߓCbQyWrL"`D 8T\ ༔ʪbk-CaᇮrSo*E4nM:ږɘ[gC:3Bڐ$[ɕq#v}06{ "1#ku7|?߻ `>֢ W%u$v]"Bnd gm98ӔT BWjef6^Tj"#bc8"DW.jI f8wkoB(OQdUJGU0<~3a_E-G Á[_O~}2궈\UZL*ޘ:0tDFZ/a8 S ypW|C _Sf{lG~t{GCne7 < VآHmǩ5@х.'D^{&tbQ2T`6[CO𬁅 ¡ѝYAcDC<^coGCLoieg#*0PJ])sFU E  W{? 평Dl DeMgw7UIᡳRtCY23V7.j7mɏZb!Blѿ$腎9ISP'$"$W$P*: {": `qfsۨ!ڻICc*QC"Ĭh3/'Qj<5da{|_[s..FX\ 8/| ^EE)r ?=|~?nMզ !=w*n' fV[inPlv)+"\jxw=ēbn!?Ȱ7ٽ`W*Z G^k!}bף7='ؗ;rpčT` |VފhHI%[aPO|Lmik9NA^l,1/U]3K熚+{njNAzrx>+)QCjL{aΩhH[3SU?r F_>Aj~}iǛ4/>E$NYD@yяq"_5?CI*xR a\r^ טG}sWs22Y+K;@m1+6)5ZrGXoGX4#7o鹋sEH{Ї0Qa`fpQjlr2l!9}K)Aa]]}̼'KD,/=-i=Хa#? ^fnf 9Ѹw)inIA$ nT'3PVn5OHr^/qSB ctE]7Y;T@@j2S'gE>"易ZW!/c̀ d!rm 8kJQv 6w.38 *)- ɮ hkdjL6 ZNN7*>CA.u=\@ꚮ~2}D1@o,IAݭR5 s_F/5½0TVω>D}fWז70,=VL_D6jQV PO~^-xj0< * \^n’q@Xxm7WR@<\z8p ?x_X5l):f9? ?) t0-88_h)0lV K U>Da(RG{ 7,Y]hI:VZn!t=MCߎ>,rڸehH趒\:1n .7,/+a薫me#sƖ9 ^o ͻ͚*ĺ/H^tume@$y,/OO%UB S6H/ cݯe$) 3-봍ɨd9DR sxސSXT^VI1qllc ACq3b= GQ$K,l9Df .f p( D|aur^\>q Q췰67?:M\m!4Xm3;Pm>i3ol rv**N"N̖VK ֨œ.gBTkQ|Ww{i McSNs}-tlwb9LC0b|Rz?bdvRhHUrrɽXl,E"D &=`_Mzq Y2:kfȧ#Mm!m;__}CaFۓr`r#.D:r֓8Sr[t  ŮFw?O7EV]iX.Kf 7e_GbdAH';YM;uPdIɜ5)U}aa{f12y9aa<9@6 [Y1쥱ϣ )$bq$sy[e2_Fb[]hn>P$%Y׎֖cLjV#,)Z]Jb>2;]f6mN^pYȣGMxs${9r ud(}[ݰ&fmaJ坠- ;xGwܠŅ qRϺn=+/d[\JU%wNw* kX2~GXzre pn[ ! EΰUU2v޽԰0Q k1IbQX؟AD9nC_U5Asm;DoԱWsGM %k(,[t[H13?ݛV)m9\tC!EHbhsw3_gy^sWrCt!;gVK?ȁ)Rb}mH-;[RI6Hbxc%vw`Z/p( ]]X!&).|X'Q$)kH1A]\s!:`;I̥_M_KkegZdeM<3Y!x')k=Cqy9-!q  9o#aF˛ͦ% moZڽ"Ϡ0\RLhŝ#3AO+E`?Z`4Jj(iFQXQh{ WvźSX;Ҫ-8 ZIxp}N0G̮Q)w}#m(Le;gջ[ Urz Ƶesע.Fwì&8.tj:OVG(ϱWT߱u| 9wi@213Dǒ6(*v 0cՖ:+ =01735cZXP  aNx.nd¤TSHKy;-xHdfn$TCjY&maqFkyp F: :^E+u?ESs*]&"` b.s .9& l2l8 "&9m˝F5eߥI|;yv=ħigLF+hł_NԚ k´G 7_ mO կ0q2n]qU J>4:@kgZ4DTQV]* U.Wr5'j}B0M&O#P, wvSS.!;3~wĜƢ*dG8(eNQN 3gۑ6aq|ivǁaLc*-K=1lw4A]En]aXv~{2e; îA;ձ0 ³ۋ Hs(57|K{, 4'(BO>r=18D]ȤuYzYJ @:e\0%T''/sd^ =6 )E.GIll: p+]\lP6P,bQq߹7ӫm\fevW"lõK.@ҘJ`J2v_e\iWys$׵`Q,uI˲ti#˱0 1O5D@{) {5_QݱJ=;A?K)0RV{rZo Q.~E}ca.'c!BBiIr/%9mc؟җ)7 uR 0h,_EB\nSSuZ\=3FsKYoA`]yQQM.TEյ~,:ƹ鼍VZ6 '@[8v/6l)i7g"V_i /#:I :,LR%Ԝ/,:'i,h' J2-`n5 h>}C: +tl>R/r}IAgrCUJpfaV0RGV<1N;b?~81Hn٩ Y뾋eR(d s[x1z #%',lL[gkDpّ4j}=f&f7 cbVPN;$#5-ݶ+<ʐ9'FA}Ȁ-f}tըNh1su!?U!I%l+CqM2籸5(|hN ǵn`̲Y}%ndc FhvYmWGE<Ļ3kWJtӤ6 ?&uZoԂ#L^K=lW+̶C.c22{c2[\抉M!9Įݎ!ѷZVPQňԂxVq6AgZ2g'2ϰy90C3q%=(k2.  Eo?:M|LbxzF ƶBUuc_48.OcA@!ߓ.r,Df ū #ndB0{d:O"'2 `In(Q+;Rv8ۑݔT>4a9-$N,L<lN < =^KJOs*Y*yI<̓^f70ST㟫,]#D-52!W0ThY#5ۢ*lW1([!gBX:@4hkձl2|iJUeY!(ٮQGٕ~*_a$AG hn d,nK쁃[9>0X|4uZ? &E}3 d:gC{t!샖[7ʡĤŞ+~{&¥~h;߶9dq̍ "ls-¿Ql T:_d,EGfþh=&^s 3/0xIJ`L<*2Bh+${@<jh[Ǽ<15wLG`S2Lv51DmQ[alkyϛ:9[D]{et¹ R}]ߪޒ1y[ޠz-|1l#:ՋB kK;.X붨f F֏S\QUg"NװPZO{嬢m~?fZ~=hd<VjeQ ImҘ?զ+q.d1PV9+VwBPm|TT;qV4Qn?2v:kHF07~s=kPv E`::"᝱ @;%ѳOtPz<.;ؕ<؍}t~(6H@7^s{ƨ^' j '>xҶQ$g >Dv'9cO:ԕM F*JKpnwA ^!+=y0c#9U|FJz=8r |œrه` ~^qqpa#J60hDddMx=5ͬ UYA)>\K瑏la:?@R_p-}it缯m{K̞f239˳IBrjhV#? 2 P |`*(a,gbh_oQ+كp;cAzru6^Ҁd&dMQ]^T7vȲXKgz4Z#+Ov\&~LD)#s|+)#, yztS7!~ԓXъ +%)50fՓrJb7ۻOk|3g:ɘ)\`1&簱!BfeF3X.{b]_!40XUV k7x)?Ԓ?;ƿHSNc:^-KgЀ8(ϿIzXHQ%\E! բL. |- ]_ !ʞԪ,iDžj,w;0~zi-\uMs3 iuO-})BAR}.jQ`aژȳ#h4gP}*UB brz/ cKnƢOL*}VWSPwПtSo{OWj.HlIt١JQSS@)Od|A;>oYpKrGvYK㮜\rv؋pl*O<@(k9t"N#ZV+fR-vey܇$Vt( yHjX qK޻o)ߛʻ7x2.t;  :K 7:mEA>s}+"M_P}t0Jej1-y)GHUNأkB^@X fMBZE^ _1On%wevKHShl$WmBaWf&ě*/JSHP*8u`3 '? {lJZvTlvSsZglnk3HQ:U3v[,& Foy̾$?a9oVN^O6\η_pgg&eV"'-j[5E20h [JsF]A,=!pA_1H!; Lgz@?]T F2b EAG6NƻV&/F᧛EQg/vvVNvM(wuܴ 2<$=1۱@'a&{̊l }6@qcXi˭9SZsx2-F` 88Qb0a.9OuĵtF\%Td3J}3ZP]0v]erȕtMӱ&˅:H.  a]~Ec 4t^О&=" )RTBX$L'.4^:&xX)yA=E(vZ=c@Q͋nvY_7IkzK'x:H?Tʿ(/S6v*ʳ YQw>٦ݺx,AW٪}|<^6qeŐDLWgs [9*l=&=z|vm.-*9}6Gx2I-Ԃxy 9nfxnXFȹil_B/X-qgdY(t8~yW d{QHǿwT oaoiy `LY ~H#R<,}]Ю+?K|&5 |s| /U Mv 2~:Vۧ] Nl\ ި|(CKTwA~^A4aK ToV);FLp[Ĉ-Ga՚75~Uuj9"ހ<0ݍС-ˤEa /3UtJE6 $"q cQ1rd.rk1L6vLk |L:QVs,PCͽ}9w`׏Pd]y[-n!L 6F[wC໊r0ERNmDtnkT g/Ɓ69rb$e` XI_>P-?骗΋dX3=|Zwv|nl@| BLӇ)[f QݡWUW"n *B !١mE GA6/0*~ ]8z{)^h2i͌&Xc*FY7Zg@A0"*9[?ד@ݐ 'z+w)2Nq1jtCbl?Bj8jj!GUS͟?Gu YTwMo~%G{Z9嵁`91|?$.B:a\wK.U7)U.BzPonWNΛbT}BZVeZq77ZuE7],R1߹rF.7 >\LJX z{E.9OWeZH| J<&f|=l=\jN@>94t\I#dn5еp%t&mee}KL3+X DΪzJ K,KseN̦Bw3E򧩑vU5WS?־ot*2ey9a>zv- e| d2/hP8NB|WJ\z|U:F)e d)25t /=*b nk6OMhÇ'/].PJ5cuB:ן;Mxuvj;ĖGq)l~_psΣ<߹|}>a)˪+ .` L:I5 q:MEUh:ٮ]率3{|WrϥPY6zV4T$,qQb'cFNUS8(;B,?sX|֖F)%gW}S&bm"SB3GJt$RA_`{CD͒H<>^rF//VQ6_rkלVd iC0çk;2 Ly]n]FZ&Q`Mb0Y#q%sC:^R \&;O-+E_#\5c W% Y'w%eFH(OTvWٯc,ܬ Ν){2 ur) )r!Aj%7f7Tݚ\[S.U@w~%WT*iw"X%lyG {tD9,<0U_'EKEj=,tVk-&o;Ts@t#E}An0aފ.չ)Or0,jV0p?_(M)A\&C7be{ c (֭CƘz}9{L?nXCR;^T{sy5Ԁ  Z+eEz@~j$r^,%},"AUMV=apqxcXyZ;'AWВs-eG(#*#rJM3˸E r3̖ak-ɐ[ڵPf-y[8^7ZL8s q-t'xo0zT:#:l^~bQ:Yp OVZJ:սȭw|pǩ6lwjlrߴ I=eXT.?HbBtof0 {_$vf =g-БFiOՒ]miCuVhI8$=؁%[ARǂ?O~(MSaň!ĤN~5K3tuǝ%fL,7WYb:t~9࿮"}moE5 ȭVo ^Wd[?mx p6Bz+{9e:@%|'ۿr%xC9y9Cb{5*:"y)v+w[a@!Ihp* whz3 )oLW TW 3HSKjǬ;eT[F0NLؽV'2YYJT1Ū ם{unWϻ1Ws9@G)IkScf; E Wzwh`)4e%¥4 T7"T~ NL<ל/.Ly) N|lgͲF Kdg]&/olPdk]REuF}W5J| ca\|e aVqyV Z{? /EB&u ݩ k}h= dt{a|3@q? )vd1ٸZZ|}v 1ݕ_}WC]ȢPxh(S<N8:$?`u` o/K|*t6mZzW- *y7?]u]{10LKRruiw-+k`sD{R,wh_B+=mJG[J}meġ~Ue.mcTpp[bq"%yw*L1NK3ggU"O]0~Xo re$>H!0af]= A$K_lwN &BOg) Q|bΚ'[GB~Ʃ C-C'މ-<BL:d,?ӀEQq~l1V㫞ˠH &pXyE5!XF"{GE6';l~\:!΢%_UF ' F(; x%.# 3d({pEW}>3?tX>QjQ"O.n`5go4.W,en˚a[əu'lB)S;4!/А>}> mA ּ ~9/cņѷ|X%YQ"Y QXvK'C t'@ 4iOoWk'jg^ǂroX݄k8-BkàZ]*Wu,p%|4mW;/r8:Kgx`&U:yx4a:b'w8^.R(C]xތw`l(ʭ~A4l $X%g5g{OanF*[GcZ) M򻗓M7aAC4jyQ >x:pƮ$qU<ݻF+)'_V1jp) Y( !Hfm *7i?oY6.~t0".0E7վyG#͔qqMi¾l 8HCDTF٪6V4M~q SjD}]#-9Nf5cT(ep8^sfYT}K&g¤)]W)P.!- c{ݱ%C*)ۘ>Iwv7GufɗQ/9"@ts<݌ s3[exL?^j`> S&5[@B'z\C[гLcV8㈽ ;s2!-P 8I}m|S؛sXh*ȳ`E7S9iLT1H` j`oEdɎw[ Ԗ dTAry;z{\>7D\#*Ҏ©ˈ)*<RB28Çe26B|l!#8c1քHw[;!ό(@ٹl;>qh8Mf`Ft׆b */ٻ9<^1:968N>m9ow Asb!}coACCb_~zrRmg# sLVGqK nB9h WvXYS:cNы譺[(EsZkG]Ks"K/UqivCkIjw wud*ڲMEC+2b^DOh{ I!h(0y*K Yc lj*wWA  ejFV#+߳p`3b]j+Ȧ(]k3`x[@cM3sa4$B̪F#h)Z*x|PJHXwBjh/=Լ$pF i̴_O:fo-:PAU42rpQy:πaNڳ_qxL5SL۸N?6#Z쨌{784Gu=/?FTSU%=XԄ_lW-{ K##:j~4|@S yĨ BZc7|F6ʗ;i;<Tf@j &L!o9I|%9@-zj<ݸBh+\l]xأNn[|A֭KCې4tOX:~U!Ĕ5gwX}64DJ!6mܥD֥֚AUaȄ1v;.F"wW)cCq}D&n *fވyM~Ԅ[EGM1&!Vz8zé~J ?]+C _7ioFI4!( yx*o1*ZWCxq U\'ÿ^yٓ"T XPn,n Vs7+C- 54r1uօDrڳSOQ5vM΂il&89EզBuJcWe W8S]N}J|[Ͷ(k F=x[gTI>.-hZz3 eٹH^X5`B=Ckk?n$w&;U/cE+35nB'wqOyv!9ݿNigtC` `>,VrJ5-]lXxH:H<\+'>^i&U{T c!Gt3+!g+ѠuؖѶ;v A#j26=}XkWCNۢEFȶd(g|Emgyh";pu:< .Mp"F*KX"Ϩ}uzFWQiz€v .&f)Vm5oB9q236As!B]g2;jm?|6|˹ܯ5y.Hu*'e?D44)N{]Mjê7G>^Lh/_!B)W:ح`b&6q VVeڇ>8EM7`yb;{Y=]TEdn7J CY\{YjdV1ķn` Gش H26|_XǴ8}y .Nlz$WP0REßE'2]abPDJf3=0$}c9yŃZ `yI|&-[^b{%K虮.`'(J%_f z\ uzXXgJ!*&Ӷ+tZO-BsF;(c4e*X:˲.F>U+d~f iN}Ugp(!Ӽ}2YV`ǀWYf1A{S o&D)$~5j[9ub^^[Vф5 ))5gXL|֞lD3pG'ee#`%$.S(UA˗smSPXmR5鮺Zώ1@ѻG'|~Y:bI6W)f*A^q?gyUuuA+f^@y`Dgw͗޾ԕIFPsp. eAz#WXzT5яDQguih/>L1JG<ΓM >\by~{&eK8!W*d0`rƪr$K ae@&@!sXΤH 73n WƎ|F9/A\7nE{acYJӰg`_Y4YPүCw_gYm Lcٓ'6-;O4Hž@p Y/س3F#Q?Ll;0a<$>/֬۾HMǖw*yTmll(ZVάPŕ[<ͯ{r|E-4 ׍[D*fXdJ7}Pg/ `Y~:ZM*d& r5"@yr6v%8N,(%fC#TwPښxd,p*\M6ײLĬvyȻSJUѦ]8/߁6|[@6PfpqYӓpH=`qCaSZO>u c&NޙEťcӐMBOEe} ;*yF+IOs{Lj?fO@)qUݶTY$#!A\"1 22Vr_ egј9$j^3 };F ֯iQxJkT(JjS'm%jH-eptAh;naA7[ʤ 7C/]E;1-KtG-~|۳g@ MSds)5SWmZs "A!z'aB($kJp0Q4g-HlGcKsła#,L|rʷ51%{7N*>=ޜnn|QlX}ѐkO<,M%+ F+pS9EO,`-{o( |X;܀Fo1 A&H$.?8O-[*uQp(պl-dy`4ڋ=Q@MA2b$,n|QX| eAqd_ᡟ5tW[H'(U63TcXrzQM0 e,]_V@0J"ekV<ލmCVIx'N:&2E݋O=/1Q!]Pé\K)5Ľ-j^63iT~9K?}89I6 @ |^q9*k@=T hdey@NOLbj{1_KU*s  2D(7i$G%ui?فm<[+T"< *f`kB@.Č[[nPG"]YSUg|gDyW-F΁,R: ڵz+R_ū!tɫxu&n;=0 eKߒoANN(b lukɊd.^(g&V1 xWn80Z@.8pU.5GBƯX‘/QWRZjFr w/.> 4D 1DLy#H;)b^F_Q¥֒^dqo8{izN8XZDa%ϥm.@ lMt4hv#F^p7b4e7ptE=\~_y'uLˮ|^nJ E(Zue05BCe3(-Doc1gK|QK`,< :nrlY\ٱaI>Mŗd2G4 c W\NvXzD:R83f0_0]^Wڹ5ڇ(I <6T&.]>;gIx8/"d-}юԕjDԵ6~1hE"'q@i;`MnX ̘Tkke[,v <޷I's"]#W:7 meفg 1}c]=CH z-J ;+ .^JTU.;'Bv|kĦ.]Sf$uDCy mZQhv 6WVR*y=e [rYK}#61w:(jPCU~[Kc8 m9; dS葜$/̫STP# {1T#RpDD)4&BL|f4mSR;SMJ|6U~f ҰI0ӧm[P&%l`Foujp!p |7p!5!ll\1pāmE^W5R`.-лFmH017Jk}bqCpB a Lܡb[HgS#EFvtp4ͪ-n?zȉ.qm㍂vǴ&Z}}o֬gv8?h qյ3j-C#'N=H{*=0}l3V 9T}k{lwzC/L3i,DZ1UHg6c&lFꨢ]~+O{tG_A; ǩg*`aꝅGZ??1dj熐@3euqO-!l FEN ']K=;$`' }YEu,GȜǵbߠ~ADjEIcxc{y[Qafw$_Ѥoڶ*KgTaښn8WuG$wGCT>X)FmG^7OKhM~JhL ,OsNl}\B6:%X74WwD>r@=T@ezĪƙTeuv>1b|? GvC@^7զǮS . ^qpU7ȍm=oRSy6GN.JO TpWI "M {^KvNjo{I+f<[Tx%iSY.ǎ[ +y8sYn5lDO#UFlECV;h ?x) jnuH{3#\~2^Y65!I~~a Bb硕wJ)s ]'DȐ4ہh\#-b"p(SU܍!d1֊߼VSw7nЄ Ũï*po͞hbLjQaRU'j)/q`V0cܡ0v;1lIEC?o/?Ќ'vJ_մD uc.Lϯ|I8I6Ю}叓 Y!#_LFSPqLDAƆ`m[uʓ+=:onJ8z7^0dv2 xW{} /[$bm?@.GΦdcqNۿ&nSptگ != `n H[\|$p^iv9N~J/Q-d ^ ]k73Ѻ )%޲X Ti ޸YY%ӛbD)p 3PӂRmnk?E})1s ߫e?iìG:jrK?q1xH_=@";\m)Fd]_)"P(|k(:"-<L[U[ DU`;7zcN}L!U79z|4X F0 Nî=:e0W&68=@Mvg`g6za#yT Oev> )htI 2#-tֿiix(1>[^zH{ i72|p))CqW<1]˔KPZ: sE\+E=di7eMi}mge JQj!%ITW+Yc5~}jN(jtE] [5CLz/cHl,G/ǧ"@e"'|-B(^$v. }RY' Z9qO ]cu,2YOF`Xc t/%?*9y{\tu~C>fDŽNmo kb:>S4lzb$ϡ+D%Cyw%TOh>>, _iYLEFot]3 {wʹ;gHG\5 tTloQDi'fO~K(1&֢,(Y47uQ8\@TJv!aM@7oS$:%=m*<:QmǗ Xʢ`bw ~õZǔho2ÁH ':7 }ZN t1bh)fa ^C@',Ɛ't [tw<8 jWX0nl.U@1F` T ip@PrT94`HMQ w5@7igX÷\YF 2/<3m7FGy. )r|{ DcȺ4&M5ĵ=o$p}rD^("1Gj[EcU>ԂL&9z@Gþ&}K!}pt<Z'@/ti&^ R(@B$h14;vB&hR!Q40p oʗ5e4pt ]`gk&N{h]L4eD(OZ5F Y g8מ  Iv MՌ1iL B;*#v2?n^mKĪ/`S&P uD& :YӨ6X!F)J^*e]fRF-X֚Ƚ7[bؕoU )@ 6MHE ]G WYm ACgMGj|?vA#Ao]ċ8])"p">zE"Pbo|1>{ңn˪c׽Oo/(~xhtvQPF JzdY[kh'O:Т8#%hE =aPbБY2TBoyV>-@ˠh ϴs(8p#j -RCR\C'u@oMG !nGFtj t~A lkdF3QyBYG[nI;Mfe臮wrz}w<5 O?) Pl]7carry<և|2t!^]l_Vk vξ^#5 Auz8cK'eEv̛{ p{ãXk_MyPP x ΁w@,IĶo?XwwUuvB8=uOV55^ݍ e1/V19S.2Νa(Xo"I5]%CψP-ٶPM%{2ll<.AMF}۬}k5 +:_!7)/hiYg7k,H١j',&2 lfD@W&кgPn88.uqǨ\Iw1p6ѣp|ll#d8HorY4C}ۙH i3.tUi\So^cYyB/O:ӫU:뻒V7RěJ{R'VB;cr<FCvè;;TQ`ȴUkmrYUgBNng3^@2Dfۮ*JleO 2n mǪ f%*qKA7 4k,IӲ2 s,d֝g>f/#) SceF] "b (]fx"L»w LWŀc,@鴻)f$Vprv̚ nX(Ԑ4#^gmE')mX yG/n=M UhTgѳQfV^mCy#ɃɠѨ 4[38tgG{(Δju# v(.tBȷ4ʔ#9B|p*)ˆ{PhëSk1> .q{݀oaDsڕg`cX()BV-KW/3}x@* qgڤDWF/6X &/sD|&=Hɽ:P~5;^^| djݰ\ CC 7Z9 oun] Ű Tc'z$pt-g2- 4eȼ 6MV)rgSpG'd: vWt&1#A3@54V|q't\4ņj,F}s7).]Mg5Y\h^( lukCf>,{"ޔ0=UT 2hifS< i|3gljg{T0~9'qVRYz6z{ Qx*.`X{S%%dSĉm ;xkNvUhՄv:W5O OUӢN3|ϰutYٵXG  (Rnd|+b)trϸ,3X%y茘kWs.MpS 둁:oJŤ FS!ki!aXu­]]wvx5j6TqC_P6l, [%+(> k!,_ 5C&Px5/39Y[=u [*1X4FY2 PÐA}12_VZ,Mi /o(| B!:2rpq=<Ҩ?M߁giCsjR\FR5\ˢ`l):ȷLՒ؎2U"C&"9++Գ@@ijQUP-ۅ~ؚu/― 鑤O{jf(P >mӃYW7,umǡn@2gLlST٪YB7Xo R=IkX߱x9rRýOƒ]. ׃tÉCfd8gk+^D*DiR)_PtLw=[S3׏.l_ wET(phyѕߪ?YSU] 65Ņcz˸X1[<]~֯EAaVݪ;Aab>yZaI]4CJPwZ@Zp0-7ll'jdy8{%̍;Tn>*N~zS\㲔Ehb!2+7gUõ|gJ-S/ D(y9dm|}]Gɲłjk?ʎ>B1qOi`gWY@޺%~u%wRmʎH!-Գ:(nhJZ;p6J6ARihwAcΌ(ܦXsW~6U`,dݍ2݃۳fIMm~o0D0 #0 iU('P5$χϛڇ!F*iuy8")^8{m4ءx1D$/Y.ŽAh9 Ui|@ 5].~ce-?qdNxi']^ Nsf%%[每z"hJ)bugrB1FGfǤwOck2M-?6H]hwũU t!4+T@hR29/drSzGiq(vj]-#s4f-lZTT>A_;Ubo!ȡr(gBqdL@D˯+y7p{/j3-d Wla_*mBhT4o$ZZd^Fa[`i qmϊǒB_c"xaCxۆ-a> i~PTRksGKn !? i\bזI_?(&][ /0z&Z@=-G‡(r+ ;^LDvVѭ, 6X#GJ-Vĕgs٪vnh} ΜYvql-j1!*BB cHYNle_*c).xuuHń~}ػLϦq܄Um)2n|eWhAm/! =iL 5a/+8Ү×G_ŏd~2M?egq0'IFOrɘV6]xv%zUSK+%=Ђ;4Q.>EH3NN[\IBoQ\O&]2*oc@IIK5X Ć;UumVvD]3~rB\+B|JrNPqO\wا~;9Jz:Kfs6 [R#g)N} 6}PqvnNɝri9? 7C废MGEe+]thd(#Ü{74H¿ 2%m*{\yMZJ6}ɦhH^)>n٥JWP18~ c„oZ# xۗmq /iFfn5$‰T1B mxUh fBW~{Hda MpXG@al 792CA02J!Ҹm3|<>sANŀp䆆%<%0.AUXLY#fKjƷep͟e. Mߊ|]$Dl=h2RzqS( ]}J,IYȇ PNâ".hUPHWdB>QjgP7β?AWz%? s˶HI>fUtel^$do )> :xۻ&ܤTB6*j^pH2Deu3Q[fM+P ] u 4[n!XȒ#BG#du:H 0= lIYkzRZaҽ;1qf_f r{Ыl̖omXOFKҠUfs<$"R|psLF.h^Lˀy!fpz*jT#,0ũڌdK~Z>!_]Q$6+tX%½oWbw?Q ?UjخnK:WWxb60jeFG:F E^)maAlaܽ0*Sv&L-a)M] gnKna;uf >q%~fۮӹk "3yR!WktlcOGQdÑ;bƧoIE#9Kx_Ʈ*37m9?.&xGlրRRp`9M Dm r6s* ΍-V+JrJfH0ēT5bpLuK;oDEՇɌ6U 1aݩnך[z?|} DyDVGFqxiN ( ggeJ 5 lGᇈ/.6绿&}A آl&[0^VHZS4F34q!zL|•6{~G_ۙm(%oKXOfv_V#Sskqh{dĽ[Y˥7:IIeWd"4v!IWjON+Cـ]-;. ;fk63< >ਃ1*=ѭH.yeTT/~5Q!Df`3t؁7BisAWzB]nkPĀTjEi˜ itJ@YY WЅkӫ=}}a˯Uy1J e>CXYsWf);5md[=%MO ce/N:E?5haJEgPaxE'Ure. w;|qTlqRU3N|绫_)ɉmƬf;}}|^<<&#f$n5Yq"5Jᓢy9& L:{ۢ}!15@ңad¶ Ve&>Ǟ6f$)!63!t$Ŝz}a\vl96>QѺ&ơf}{nNm4_( "6`Swߜc12h^9Z>䍑T²bYREIwܖD9+u[ήX 5}zҀEӍH{.w^6!Bt+ltQ(IofINM5#&b]WV-W)t"-asYQь0tLiNƍL6`xo /ʁ˺aKি\z eF(nl[x0ٹ=^a& \wBzK%9*]XjRX< Ri 2QtG e`4i:fDK?BwMci}ut6ӓiLx]tQX:.3\X~A\UTPygn6TʥκӤz|)Udq>]U2!˙DzQ(8]:PWzby!qx^@oO! /<v-R:30"+npC<8HΛ g6Ɨv$&j<cg엑=Ʉ>X0}P4zs qofrޝYpECܛ%-1z׾pNaùDvQ}L`8Q:K)j?GVؓ oz+h0`=P^*de`e\*8s,E%XdS3R/3:3dJ+urh-#!@Y=ղ3ē% c$0ex ZK TE=ȊoQ:(a %UhHXҠ=#GTDe5s vIݸ 9|QO-|{"4Q3MyL Dv6+pe..Z|O=hjD-:d g!,)?x QcUkBU0#/lƘRp{)aG]Euv,W$8J/ !6,;Eํ>&y{f-{:a*/M+{ b]g[gWyvbsT(T.(Rΰz]%(b[PGՃt|;vj6 kzBH*XO@S0& :N#f6M ckRVfU221on6?ݿ0V924uu?#Djо3!#Y,PV;4b|Q'Ra)gFHM c}#AXˆ`jk_Kp}9zK,2 9uޙaKTїEQygmSmٷ)SRw7ƨ lmw)R' eȪB@o rݖᡝvZ>?WK! >rɈ'ئt7X-1) ʕI'_&K]+F`p|iwÇlq4Γί`QY3T϶챜q$l ~B0Ec< 9YF>+x|w4g.3IitiѦro,"IEVбuVꐈ/ 2W#~OX_Kr$ƚGip&`8:uV" BgRfs|Ek!AR dsL|*?N?Ó`y8b 4 ڱzZICފғIF9F~ mXm]<ˣ-(i* ։LA!! 76tM+EkTLnwKi%n˯>ur ! Lplwрj]5xkԆ?%MԯWژ?=2VR1J_1X bo16Ã6QX{O%dwuHVj,uޕoǖve~cf1Ǜ'B,  M,D+ŧq[s&Q #n7pKt)h|?gn2Uv'ڵ O5TɊm47$eݚVa2)?DhJ)E>oJ*bQ/虁C$ g7ūMS;f)0qXR+6lMfrz*^S*ֽn<@_HSҙa< ydԟkyDHa5ZˁlX3ɂп*a+_Hd =-Du.t=3 KV]Vipz@ݛ`ε)5Кpա@0 r&.=oc(f TTÙ8cg_8\qSw2걱 ˪ (J " DFv'Oc\5#ψ!~2 GtkFE1MKgs"$,: Hv.F T|PRQlAj06 $z-$, d'usO0 V JݱC\dY#^! Ɯm3nAAcN;ͪBZ:ydyO^׽cHcDulPqn+'!*,!>^H W"İ@.CQve: L! ^r5)4qnpo--R] Kn3m#! Mag)$غ8O:!RAK;~`)4rMѵ:)3Ty'J63=PB?ʥSX!%;Ƀ{ .8%idzQ5#-sgs/: >jvS~6nA9Fu)"'M?{.)BYn@>b G>>J46P4. 2FQr)нS9 f}ftU~| w?#9QlBpOhM|p[G})GLskAͲKhl@Q[`(zrx$Q4g{7lˑv]LfW>pP6v#f•F -ɮPtvv+tY]uhh+kV=wNJ( kEבPMD-lR]4Jrs4a*]ge5L7 wp pQ=)z܂萈aWf&8RKF>5B.H}xKD5)NJnPB"評4uQrY3ȥv@2py@I4PhԷil␝5Q|R0 FJN1$'וms{[TpeWnGB,3}^t~hNĀ@X~Ӑ=i"@Ml X1&/=E*4RjyEI {Ձr},X. sX'O7X>NuC'3%i߽D S^Ta4 Ac @x g؂ݕBz͢=1++K5 I6qz([9828?W|Ax@%<g}=05PQrƍgYS{g,RiKC'l+c`3Qqy 9|qJCGjw%#rzn (E PX9rܨ6npSs.P`X~5TL.~yִ~jK^}b$M̱&wt?V֓bRBE" k7_LiQ&ۅԁ'#eg2-t\㹴`FA m4H]F8H_zK[!Ìy^;`oܮ@֙wI$yDf*֔)Pry GgZ/tP8/!$<#/c~>rc\[G0>Sc-ɨ@yʟ2d<1(@*5VF>6,Nq+ז+#pGA()Sw i 'Q n5Ym15SO; ]䮍?L2˸ 8UTD+GaLh|`6iYľ\;;;X4gQŻ@ jڀI1l{[PN7mR3A|t5ب#9mvm~Mg,9,&fEҚ& ~*)&'M" Tx#LڪEķ]]@Y@ՀϥtF"XVa#@ Vjm3汖F OѭCPtW< :(;Or1$rC0nxeR0 :n$֌l@ n 5:Jyj.8|_۹>]~Jj7a<9mYYtp7yekv&ز@u{c*F'Rdݝti#ͳkzPipqKd ? hC]!W_t r,)jjJd憗Eoer}H n&\/#1ҤC:QgCIa{Z UD\]BoI39 ވJB(^ ~J 3vǜ8ֱ?T/Y"|[h5i~+*/1nSeLUlhpmekL{ܕnᩓkV^U'dtDdETЌ;6`-^X-93aBDnc-пE/ȗ 4,ƕQ$p9Kg֕cQ0ت/bs@KQy;"%nv? {sAh$]519Gh4 Īݖs=ζ#6IX?ZSuk" @hIՙ@SO 3@icqLcN>J>> ٰIb~[^niNVmزӴ[b63 xO٣TwFyͅ-󕯲NxQXlvp? S]I{wj!. ͧG2d % X5'V4h/^kwW捭ېCfyP8&$4[Ex}CՏ䤼\@oX Tc{V>NZ^I7Wey!TND -7+r>hؖHN;e~C=>D656~g~xAZo_uzS`E ى peA2Q(%m߁&xY[}Ug5~ҡg@drqFDp|@ 8M;ogнyB,M\ $01p=TL'!|KVè>``H4Q9kj)f&c@)\X!,2' |Ȩн9Ȟ25]wђ}B"z_] P(x:̫HZJ+`3jJ}r"k"ȶ7xN$L]hؖ ߡGZ>)U(jxwC};xt}#PϘŸ0BNu] 'kBaRT4ꩂYL4SHu%j[Ȫv?B 8LzOkOƘ/"xbڔkdAEw-`"jҐ*㓠ɎEO q-3|ȔMj.^XdӦQy9+uOC9/ޗSM$K$@?Sy-lԽ2*GprX$q*(u7k\@; `Yݔσ3]QZHgaU6ꐂ~Ghʰ:P)?tR1e2/|Ha{`LjmLG=P"߁\R f *?*1!Ԕ {RsEGjqQV!EhwsAlĝkDKENMGno8;}RW1 h|2Cp*q&=f>W@K5KdȌj*4M"W<# q# 0uƔ@>Ýqg qǕfE$vg_*Iu~Gҋ5٤Z|$zYJ)?0{j-Ƭ(ޥV,\RZ:TVYsKۂt,Ō01ȴJqqa`62D]nrm^L®>ʤ"=8jE5/ NS`wo*nG:0 hXӀ 37nIl0/z|M| $f(sc<Ψa/Y k wc^"++]'ŵ{[ЉmȳĽͶmGAfਬ)waA&@_0WMBvԲA!-7)R壠hg*/+;PS`am~s:oCK޻HrOZ&K$123g(ь91c$nG* AcnR4x25?⥬a[K3;6٨;!9tG荎2ћ_ӊ[ ԚVCǛM=1%1r-C1 CMd'ϠX0 -@vC,Sfy0qKe*k͜ny$zVki{-~CלԦc 9`q6Df t][&~Er.p*llm޴y^2ߧ%2KAѫiHypK,LC{/*uNl^&+=|(ݙJ+1zځߡ/$aK%xLLO; _kv%h1IK#FU4 pV?;/.?N9"=n.1ɺFtfЬN)yAmwb4wntDk) u/=E[Ȫ?BH301TCw4 E rbA'EGjA.V~Dž7Wav!&>2 (.vq K{>V8X#1"rñe'һ%JZBBSm㛊Pyp `3 N\_ܭLLҼ;8%l #6Uq{j , l92bΦo0~3RB;iI}9mnpz岯P/eQƕ~~WĹ!g&ݦҬ}n5EUט9Vhes kh"_%|ipj4Mu`FK4ߍJdBͨE7׻ P[f7lwɤ}s2i<~xi2J#OJ)3P8.ҥ`s6GtKo)pΡcrIIC987UH 486I$}ÊZ$/n yp.Uʪ@+s Ea;uRd|z`lPBŤ](`unm5+)$xt.4I eԋ,L'7z S Z^bA!}w@Λ: WIv8 H[4r&Tn'U;oV WNmڕsQV.)bgPpV^ >{FM,J2Ioi+huA@ 3Qʭxr5Z=4ckIYߵUo I:ýkI1`.`: \i]anagwAxnCg+&/݋Ww Il:`y="\U9xDNx"B?NGz=QpR{gz7j"貼'fP׬\ O6U;˖COl88,-n$&& G[I_I\֥+-)~Lz`  ;z>c[uW'e!> ǚu%QuΝyݖ/pFENQX&ëW PW32U=sic $*P,#huI°j$(do-Umyv!tY,r RBeR|751ԑn4Kw^iOTaNTQ[x+Y";h-jƖ"]QN3}|<8V]o"OGݼN{u)$ͦCજDK"oO @%K*K ܜᮣ2cMS1dY#ʼN7,%X"J QNޓ*OO5;pFϨ_I*YT S1VC? 'YzM&I'^[i3uG!bnvmRD*6k6 o$¥N!Cխ51(Ci[161y᯿L`uzO _#䓔aa2V_? F:0[wecMkMȴƼB?.5.,pWmj8It51I>͚˳i-W F .nr)"%r{yo{+H ̢'d~>vj1]ۆG[x톧FpT╟M- SG[ Y.z:Q*d\?&kBetw' M)/߰ZtI4SSσ !7GKB=8Y)< y'^Bn7,]~v8 G_Z =<[m?m4Q7&2Q:GLL1 `,V@єIb.kN,uQSEMLCւ-u"J"p&dvuŝ&}J~Sz jQƸOΡ0ʹQFfJy8\S5&xoLHF{pg3tO +AnTDL-}pCGFlG“cw|{mturX6LN*j;҈?-(a~(~ |thLu'-7zt6R /|&wS> X(*,;_r Bp`C0_(TDG&ZNh/y\=a/-ȯǵDq9j>l8jL@/ Dɤj1 q7sG[eiZ r3G>I.hRj BGrUՠtMN?id 8aQ{aIL:R=7FLi2?agϐ&ϳPY>4'DnY }LڨOv.yŸV34ש%8͕MQZA~Blws^MoE-ijxYpOruE/*`. * RQ0;Xi4H)^euPi[EK+ridx(Km9:r,N8l- k!uPHAA4Hd&qk0IRN'82(&zKQ,~5ɪ[Bˆ>H7TXtip& spfINQf9*<¬ O6@|h9sǍ[qðx؁]> |ѢR+;ڟgaIÜtAQ$ g?cТ/9Avmꖼ5s0?ːt G`VW>ve&%=J.'3 AӰ~9ُuY< #Lx-N˒ީL`W`{?O]-Aq/Fy, !~؈ {>q^(UZB5u}U*B 6pLbN_S&Gx+˅V:)$)  |(Zm z-8LU;`a9`7jU(Ӧ}(y/К⍼j!!>i7Yf41XB?TRǧ &)v8(GX vՒp3P ý#C=* =>ז%P}c zuB]}MdN1&uK`o'wi7GjE}LwhiI׸p?zMP.9E$+Ʒ`ՙ-tjX<O+8un+MC纬ܧ 6[B_ V.g\->箨 sɃG8WDpAҁ -NU' iցEo)=1d1=@Eg?HArkgt9m P֝ 'M?Q"jLϭL~:˯r 5Sy x>B L _׬ETYΟ,`gk/agSf/.RnmytmջMg%f4`NKꊞ㊿*O?^rhT@IZ.RӓW(G.uE{_z)p$fI)p&P)\E!$~\Ve;3GîCL8M{u3j~AbJ1vix Bf RoZ_tK;1L6:ZBPU?zU%f{:jc5l4J_&fL'u F) ǽU)k:sqa,6W}Ę8+1lDFm%KՂX zczr܂0B6"ֵB31R[FlRnL&G3Z5 0;*+%4EQ"b 1 _*i!2!4*59i,j\'X++5 e}W|3hGȉ+D2(Q NEa70Tyc(3RD]f~9XL2)NfB1ME^)y3f [-G$ _PgAF 99l݅ϣLy@u@J.XG"HQAܪi{^w֟ <UOyL68=aj1 )n*u*oCKs\u)-J-booL`XRėi(>}\#|Z_:\C 6i.ߍ 1 GE83ں'ǫ wg1;HuKnoK6 5fDM ea [ ]oؙc]Q^4D[l~8W? P?"6 ;r]vGa'*tnQYȋF$b\W\𕳝uAKkvDyY>%ddd\>l4ި dl6*KШwK@%i-0>(At!Fz$N92Acs{*HL F ,*Q);[MRyyET/WGG}$]i&E[Gh`CK1FϹ%փ}.|R|pu䃬,-.LcA{{%0s"ATfwc0A\˳8\؟:f@FdHAM=SmǿE|": gb`] ^ILjNd{ֵ9i`MO}̍UV):۬#fiAHrZq~KHsN.1[h ,Yw '|RY5K׀cQ}C*\ɫq^,1/tZ}dMb)2s0bFƍS iBņŬ(_-7ŝP)cۨ3ZAyl6\ծld5]3#3~moKῳj5a)ə2vnXrOB;k/fbNÆlOw@o74u.e*F5CF?6qp K! /:Mu i_ʒ!G&(^Fӟb=NyP7B`:>mѴB+yu[I:#t%I)/Ő$5{,5 RU);վAFOvsDM0;%B2ԴetI>u#_4ct|y#ۣoHmNCA,TK i֬s ׹UD, +@AJ4ihh Twtt۵zi V>yr$?$V+LVzppV0q+Lݧѳܡ %7kuV)-qy17c6RQm޽QO{ĕN{{mJ\}\5i{c&g3Ҥ(}m2n 6kً:EaXM[xd9+Ms0^f]J._E1~IJy?vFM"($t[@k"?ȻfLc/b'Q?b~KC0>ֽ8y\Z%5tjsoî|`9nIbQ׹OVtv9=A*b9y b^HajUFӹ5\ﵥ|#T;ըq8xdj$d͠<]q8xw%LEdԅΈ!y.&YNnn-Q!oS:=j.[c:X]! 76il tp?!" L|ΎvRLe/!"$W"f!e9WS#_nXѦ* ݳ<YO 9H߯^mU!H%*,# I1]W(}3+Fb>LtKX+bSwvu>~j^(EAU_D"E-I SX>EJ+UuP)ʦGyF˒xBA oAKR^Ai#[/RfBMu-"߇|)mY1TS3Vq4ޡ){:KYgڒ7pCХOGtτj.wn25cA0r ui&c+R _FSy5jM=} >oaY۲rp2#Kmh\nDt3b޹*ug?Bnp4ѳqˈ'efu {^z֐yk-1RQ?d~^}'#h\UŶ|RL4O&s`96zm"dU+lmK6ӯrqXPm JZ}5LyLhZ6l[b@;(Fu~8g< BOsǼ6viWrK`(ܤ|iH 933Ft7D*_(h|އ 7tDQ:y1 J(f@"lsr!_ed'IXvvrÿR=Me5W/k!T?Vf')cFyQ]bMj7Gc 6^I%\<$:2A ^#lb+(px˰1&q>oC#O!uVȉ"[G ׼ij0aW\UN &!8}G;'bgͬ7HA>/R JsH8ߏ5վ!,p.nb7lTR: _Zݴѳ3[NuVx"3 +w1N!@Ŕo吷PV-t%l9UpwO.u`0Ee\+1zR7( ЈaإZ)!)R3XL! Ӗ`{P!B&o.NRa M+whM(aD; P/ YOKg2?Rh{rI3 luBg ?=\W]7gNugCB{.XBC#z$>l`Z)d8 <&0\>'&?G2)BvJ4U6F,ɒЛ¸&7 %tK`B%V(d/_kI,Tsi)&IZmKӐPYHff?mUluZˍ=F 9(|vPIU>m mAo/VsbJWh jJ'MW`H[CTӞތ1ƽ{e5RcXz~>k9ܟ7:*!jV RsN] )k)6ӛJؘz\=,} lifSD~plIK#HK#Xq́]h3r,`J1 Od2#^ @?}dpI#~uUV;c~Ldt> U{|q znY(1ZYj18̥ㄙif S]ʁ j]~:>KI.Y[BqG#+[u6m0Q*96ħPR Ƃ8 .8Խ ).cV4,\z?gTM釆d#7/.̓Xl75m }YK;Z=]oYY="[K 3| x2<%"8 h Ԕ#C-19biN L^&C/&&N*_a7'7?LI>f!7jHwc w5+ղ͹7 `SG%Qzzq^itQUuT"x0=6pv~5"!=Z6Q4h_Q!yձRha?%>)j#܈lS%п,\bP>՞ ҕU*ԇV+8,*2]h ht,u3\]` EV?~g?k"$W ~Qvk1SXɢbLOhU4Q=(cU(d.:caK߈a/b@q;lK Xr`_Dy -\ kM)8rΎ+DI-LT_Cۀ #ڮؙ;]1>HTIk1]v7 3c^9ʮ݉Vez{WhEQMӆfrC_6ßU2\5-s-ST5 wG$#a*(ͳX*0o ݷwr?EI Ln~%rGZ>cɈ xM *1-d&Nn5aRKX=[6#*n֪`I#Wo?#NvWJ G͘9Sv,R;:=5![VaR 'L9VXڞr*KuaXׇ{ka\ETkn! "}usP5i)F[5ևF4GZaWA]xڵ}CK?Nۣc^%ͣVGddd[ IX/"! #t IB߇Cel荙$.6FxwJx Lnrhpȧmr[j.]PSc$^qdUE9E;"BPb&~T)t4XO m1ӧBumzꇊl`ŕKccbriF$ =_!q(_ g>Mr[{0Ĉl .`F)W]edn[@!x1.md,/D?8Ks1.xYیvm&H7Z1Caj6 7FqƙK$1sS9.b}_LZ]H X(u|5pb/0sg:7";^& NRuJSfL}$#)i Oj+|wTMT8S'Ait} j%Pl`DRn!xTh";$JZVg)۸TaٵFz,> mη]|?Ta~;{f\T p\_={Eq\B3w 3l15L"4xK}ܙ6Qw;,p2Tx;~mdftX~9%Ѣ:LZ"~7zʜ0$ACW1kVC4oG'a=,8}+<(>>pE\=cm("SR^J]oX38KZS[hOS!W./Daaw+Ù6]1j$zV:5\L.t*90<7r=5=lX Cc.h30qڻMhYw#w)*,dՊg%\ޓC`'-h ,uqB48U?Pt1h?n?_+Vl@WoWÇӆ7 m!RkB GX85k_򺴟{3T){fDPzɽ6/ mR'0JY0W(\ Rp/7':ըvUcO* P!WYF>wl)᝷{AXPAr"w яZdIh{qORSzŞM7x5Bo|h*]g+ʱ3P[N]P(ӓqm[?iinWXڷNwĐ˯b ێ0*\ bC|ذZ=6+VLs _\w7̚GR/6lg(QhDor ;*epEȆebhXN s_ 4UJ(?B6yC=%DѴ /.k$U~BЕs]^7ϱ|8$Dag)dW>7QhBᰖaЊ;,d owu|:D*0dM5ΣWDeCSuGKO@nxB!6`)tzL6 L_i߻]t5LAl dΝفs.Bd^<{WLj?;kE; tJDlW!KeEEV9mhFj:=-}ZYdՒ;Z$dx-2NGr5WVx Fn&9~DyqZLٯ(JsY* (=}w/O~Tf1EȘJƷGHUÓGmBNY6DoG';dкnL4 W)}nV}S ۅҡx|)]U͞UWBzfT('DToojX6\}C%"` kbm{ V)3MqH8}Sb"u8T4վn$VVnA7cgɵt} ̨W|srޢYKT`'x)%[qy }NW Dülg`{ycݎTkKybnžs:_1E6P ?Vsl'3L~CCN|P๶57*w,;|<>S-7- \_ t> Vu :)pLme[ͷqQRv*g8dV{ kqV':*)@7}'F/dқ>5`+M5`Fh5yHۀE˩E]m=QM5~|]ȟX-MFos3V<7G>+K2~ _Pmd#2}(#s4PfKz isuoshvbs~e!ӟ2c\gI=_#1.CNe<-w/.nk8{qnjMrk>pd@ƩE?}Jt.!KD+M4VGɯ >9ĦV? ~g4.8{:%_%pmlLC:rn {vaR2UV>Е FLI*$TU S,12G1!ZLy>$.h!7t饛|la^ |cmq9EH*»ޡ A ;*Οk&oV$D*qNKrDڤ98=0v}6D:ef[_"\(C5PP*DV>||f[1C'=ԚDӉ',㙯7סZ.vSo.*S8XYZRy0HLO0Y 碫:B24a~c8ʥ2{7 ݶze L@t'瞐sWY0<@TuQ7r$`v`{>p4V\66tnT)ԑ3xGFւZbM Ƽd KHA+qиKf "NZt'$b'Aj[Ia>ǯX_d"ܟ8 =z1< k<",˧iUov_M0,5=2]ΗZϮW9G=hi7"elw|FjG[,jw"H/ϲBpcZrڦ]6|:P}31(͍DF+nֹΝO\n7&7gܡ,XKJ<d2XmUNpZ/FM/>Lrp^5 oaWRK/!,} 8yJN99UȞ(m}f1pbmVOeFA\^g,vH 25zGɕKli3ꠏGtl+^n^o4MkbndIJt, cN6OBL\m D 3L u Ԇ<()ղP:KQN 8?\BH )cppެ*5ҟ'9u *m%__Nd7hЇX;9 tT(n XޅNuz3j, {U[~Xj8{JaXN3mWPɳJ00Em<OF ]ަ'EqЦ3KP94ASq6 dWՆ4[ E\+O)Rl~/*[6^rgYY 2#WQP2ꪬFXE;.d͊YzK&шw&EK&rzk pS:ziEqdnMsmỲ~G4ӡ/sZ[Ġ4 UJ9&-k d0b}c˭l{ܿ*iF`WRhR5.s#k6Pܻ~һ# 7cp0y{w͝~qLhdZ|d V@Ī'/ ~]d Hե xAd?w-#Lhjz H PUyA'Dߠn[qG7%;JjJy՞Ckp⾷lz 4vlT]՟a :6N@> ڣy.x)AJ؉\^\1hNoKu-bd;5Q?`{,v+׻}MƙPY5)j/GT`;â F/s]Hό+Aa)SHA'bޯwg,Gc+B s#ul[7U^ڌ(ȫrŏ\+!O6>#N)>h"g[S^A<.ީ|δ>-em4)Ly,y  Lؾ|f[˓5Fx^Ԑy<ܦ`#G; mƋ6as~AH_l'x~\bLoBNs!=/<%ϯ`?9d?=+]eAW1P:f%J4sC"VFM/ȢG_gie*')G/) hSӈZ@&pc9gjsuqUcCdVtQ߸ڟ@Wݷ9C_g;L ;N<BV}3O<@M΁bkGF<^;QV=up EK_b/{xI(s:v㑅}@+Xf[Cёws,|fG4RZ quُ~Ey?%?H i_g,~"xaVg?@ռhWGjm'q=Z \wl,肮hP)84Dā!$z2qp~?7hzoRؗfFc FNx${09C; yl 6DF~hfq5wSl u`X_J7 y0ƅ>i-mݺ xX9ff\%Hmc̑L!d~&$CngbaZE<rb?߽z8+y3Q#s\4Sc3*TeLzln Bဝ9hDuPycaƢ4Nkn ZAF-ކ[ 7dnHc6m\%̶YU5(dw֜4ȯ~EI6+ P?aUپC2ouز=g)CϢ0>^bLqw/ѭ2u2F'ͼMwR#lpq=t6&fG*x:a?u }R&*Ti$h%r>‡~DrN4d瞜r{Xo#[dszroGamYdlBź3|%okz/E".Aw0HNV ;щA-S'KyқQ$yN)?^>҂i2j# EzZwv[cש}emE5wM# Iflx[öqt>LA7s E%({Ըҳ:f9'W3vmLFhRCFR5_fZ%S?e7[Y \h7\`G}`^r9-5dyb$t+qaxh\0,A9}aSU~R~͐7'?y 665}`Z`8Ytڕ!EU}|}: I;) .c[ M3A&?/!hN}͍Kغ͞j1R*TJ? u4YeMTf,_F#uyx;'_8T55-MUd#R5p!P<3^0< 7r^n(nH[ɣt2O\~YtF#9cRM[rڣ҉5;n"i_%{(/^SqP}͋ w"uuyw\9.GSSߨXKd^sڵ۫|2դװtSԎ˓M#"#B ݉ %j:27X]o`J K`x c 0$Z%:]'^cwjJF!Lj wkmI f2pn/jwHRpenx1Ίcg+_%f۞&vX. U3B&t(܅@AſXޟȆ} }2 feYcwS(ǃ vb<(MG 6TLn *;8cBFg± +hI z_LW(CH'+c?R8mr}=/Z/CX{C׳G{|~ J  E;P8)'u1\|uF8SMp7%}jH[zBbqhjvӖdjŠDPghB໭+>ر&d~eΟFp 54{6L?\zGsswٚ* ެ4|"LSkWI2y9A009Tc oԚ+1:.Sv(KI!!@75WY#M Pnհ"czΙ UXKIr)M~>ͯX6cޤJBGN_Uok3_u'8Iü7ɬ(ݿH9a⋕ŀJ7\N*c4n!Y}RJM@*,Ošų6\gש!ߚ.+Cx}ElUq(κ ..uBj3 q !R[^t3̊kLe|I?Bd's X6:>̀!_pN?$Nfh(tTRO4lGuH}I/m-y#/%!9ZE(q΍YLriٯZMc$ `%t PK=q3ۦ d7I|#{GV)aNT.a\GrUHX;)9uy"xwViAсL$X"Vu ̼-5j(6Sb\Ǝ.'1&`\ f:Hf: f`vWXrz&F9 W ;gn?"\B.&J|v a;E"l;bq M%"A{DEqyM!K}GjBf[fRE',rV$LĮ60t O DSDEj>"'#ʛLD-F\Ɠv>/oát7>Tfe(c%UnJ^+n V ^J!m"GZ|M |lvC*'õ/:B+$d6^Nk44/PJ\ρd焐tDtgUx5e3S =L1+Y9cɶ}u\7~+0NBPQDڃ‰wQGiix4W[O{C ޫ83d Xi,܊SOn4:YK& kut RyB3q\t'guV2&m`6\SLJ_uDV;8[`Y`):Kw`Nʁ" e~ۡPE DN bd_ ZC#x4K7N|ug<-}jVrڎwnQv^'f_TfˋF)Wk HeV@֯ 6 5jTkڅ'[kJ {簍^0r[E޾s*# ܜk>CbwBV ʎӐkhrB+&lM>B$B=}\.0uڈMiabHY* jƃCZkj&epbR-̤ˈvp&@%@U?i5 Ov8bD)U튵 tBK'VITK뤭jWєv3S=3 &@gDT\JPtf nMrIeO丯dա,q [2-NRWJ z>ݢ_m},ݦ$s覶%㭠E`Rc~Voi#?.AlDto>r68YoK}\ ji,ad^\֚́mH탚>LFDN|93|g]҉?6htΤS.FVêd`WJ8K?V0`dE az6 >M0F? /Z8Sy}Puh,ȿf^fw"A&#_D/cN Bx=ɮ,Shg`GI.3:3˯-o%9TʷNZ(oKPXm=yJ--<fdxz4!Mw r'+,v8^Y97XsE=y`<(<ۯI^'\Ҟ:{@)躭6}]4.WU3^y#!CNPFzU5A>ۺ S-_,\ޕ|RWBi=#OR1W>۴\;?BϽf[)cexEK8=k$dtWK]>yyg\c (<_+֦Z\<,8ı%:/ ʠQtaqtVU'33"y_I|\?61z`c3i4ԡ0IΊmJUB"! te!Ump-3ٍ7$Wx]h't^ْΔ-I_5ZW7n}K8>1~Y[@ӦT8P3{m'c4=`-HUq5g* wF?jH6Јn~-mvi`œ$(Gɋu& wʰyMEFU]\S9tg^bP1-n|\gW>~̜_d'bDϟWZ9`СuFOZ߲\1AT%9f93tjLeM$D>md p9)|u.@b(։:&) ['޷sLSIAz+T ,V[|.q)x}Cs\ϖ[5#Bx?}k1ojɇ&odA`UBWO3Q4䙯n( f2ʈĶRzk^hnfv@χ>d;B=R,*.U|y b=3I9{̟JW;q2ub~5uT5׵ANu'I*^|Ғ0:on^5|~B1 <X׷m`P(f9^3!$稑UOv^PRqiOТo={`~QV~3bC?{)؁JLA=`*]WJAH^ճ߳Rv㘆y2[?yf׷上1ۣ1]c\f.w9.nj)!EhB&j wq*>~ͦ T=*?70DJb~PQ]ֈ'0gCs#@7MB4Fuqzu.Qi7W<.#I"55Jur`@fe+n5._cBu[,8׷|]4/: '#uzމ%]>I;_9e$CBr7]v{'[D/F:qp/]{vh4Qd$?7Dptr$S sd slWUwU#nJp҇Mq9`iLq#Y+~k:?o$:xn2O͹ORtny`!ViFJ:*os p|>bN=XT*v}f+\!M乯IT&yp᳆JJVsdN6b qdb$~Mo䵓u/f5ombᕬRVO.k=/fiC?d:7p(*}Ǘgf}p&X 8^D\kVOg] @gfZP@C>WY>~0<)S.-26gI}*2dA'WGdeykm (hO5#4A7#!z{EZR(h` )EN/>Y8N'Gbn }9?n/~x(K}1nᑣ]؁&pT6rRQ~bLhtrkDyqB(+ g?gkEBĘZ+mGrT#Į|*3H<ix!$QsI)^I/F¡Y'N9E$؉4e8H :X&@[ (!9 6&TN졇@S Ka,tXʊy&'GMG>2.ٶd E'6b ,M?~zߤ@\⣂3yzocAc[o2D]ʹ]0Kg>~ʶ\ƺJjy w 6ݛV)L3En~Ջ@^2PyU]t xǪgNhmƟn*@ePb& ɟ, u-$Td*Z6fjW|vTE_Hl  "253X]UsjJؓ[jQxE?0ȒutsD BWõ|˃7q,ʰ?.(+1xEJW"C)5( 1Z-2/ZNK8ROZT3u=5۵ PœB'u Xۤghrn %+Q0sRƓqdp96Ojr2Uȧ }+Il4ۓbIXm# P6=kx @<j h,kMeM%`0M#*L(Y$t 0NiFĨًӭz~)4'~\)wOĀ"= XHxy/NWϣt$M3?6yCШ2CoM-_k֯1b$6Xsen)[w0U :'$ X+=Lە[BmC,] m*tkVtEFn)c]ӶO&[k 8JCuiB]zED(m cs;ʙ\8QG{OfFCHvRd ;\wJWr+,t:`Ew=snK,Sd.9~~B= ݾ^.5xGYf@ќaR>e1Y9Zdxu$ؗR+ɒdnsau|?C?|1Vm%3R36gORnSݡD{SۖqVK4-6neX0-+#>Ϸ&QzϷY:saKՑ>M]SIOGBr{_=}*PaYWl.D4ʑD+;;L%;rB 0d4`JG!06J`L|9>0G $#F|q(>\JGuf90 ws >ĕmM%i-[7JT qj x[ni#57pä +7>IgGj9/ded}0/& >AO8p5Cj~m@ٷDAT9d3Zs' {<-ss1,)"ܯ"]hnb(G]|!h/ԘD؝t|sTR~5|:~@|UydRÅD;w*Ŕ ;:!aT})&NZ[6)J+_.q9/QEyc gJ5b90G(2XY/b2Nj";*T&'|| OZO,\ '?S戀-J2j;OOEgʄaxe'TA/^164eės8<5hqNFYjpVIFw[SNTIe^1RrH\AK>/mSnLdC=9W{?r=D#ՈwuoPRƌ Zi!sX"w9;kd3P1hwQҞiS|gfvz=>;~@=1^_ Pu?Tj+KγYd4` ;%})( = vcnG͚k: gޣm:۝6w?Xs0 O#<,EVK\Ѐ|W]Cp5̛Nr ⁝E7EUпDf./3bu$B,Q>XZ%ŋǹ$A)V)Rz] =ˬoR1/U%u@!kjkp ê8"'4(>AH$!벑>Tg:]exe"1:&m T]&݈e")=eQł<[t32j1c$;7XOs-ߋe'xdc%ٰYXYMc]^7 #?5=a]s/s5A^izeSf]$|Bb&UyR~4(瓣|^Yh,P+=6Mf */<0[ {s(1?jR<ͧY   { P>p(dz({ó6/֡QGK/h`~2|87K~05,bx\B̦ OFSwQo/}?S % IP΢1̊{(#t6O8 .kk+I["H7U[Œ<#[cR )0tVD^h̤oۅ1IosJ!'Yoa^f׵E_̌iZDk_%S30Zj8] 5XePQçW!أ@#eu!ȎB'h4Pll0D×<#VFriକ}~hu1߸aFL"/S/δzf#h3& O B!MWz"0=awo2T#,aE y4T;$h]HӣH/۩QbCƟ1چzvHvt)IéHA0flн Y ~otI(4[< @;:Ve}jQ5394%2ӟZz^6zb-=atP3B5Vb1kd>IMTʳt]})=[(X{zGxD2J04pթ lzWSqXj _ЈXUg)ױ.˕m،< =I/-.r4qhtU,bJ`Q>y(? +3mop |=bŦt*KO7_ ,[swFox ,n tf{Y7MLxԻйK.53;ө;(!auu ]C-fIKBQBPEmX`8犤;Z 4Hra7(2-^?o-ͭBhSuY$m )fP-}@A qcfkoyέP9g3F"ȍs޾2]-=>1OcLw8/e{݉TKq>wuR%Lق_[ÂR0KGW#IӰNs2ňȇ[JU}*6лnH}ǁ=_VM5;xqB&UnHME8ٷFӺ_Q, 1r>}16K0 WyE'D$솑O94WSGm&#S^@32JhR 5FsG{s1iɒoJt㥹s`EbhjHI/ Bw6Hb] +;1+ &(< Hr:eE0ӔfMIe}s.6sia 0ۿ`8or "eJN"L5^U7C[^L&x[ V@X\z)b®+P5xCͤp0.8l+h٦e^eBLӎqsk 'EF&dW I0In7!'RVq$s 9r)hڔmʳRGKk~7^*ʟPpہJĭ#ݬtXr xk.CN?n%g0UPA9'ǫsc&Zs!R+pK7 ;ز5N$RPI0@a1Wm ł+M .yh䣍=f0A& ͏/'.o+w%`P,.Lu+>񖐶BcVQ#:[7NC7=L1t i%%bt. eݥr-[o0NI6OX g6IZ]=BdeE%1Z YumXm)T]rC=V!pꆝ É_^u\>$Z"}N|&\?t֬&  2| o`{Vsfuw~ё1-/sb.F9'4_w[)]8r]Pepi8bGoRi TLs{8e{tդW]jJux _A<V's_lb ]I~ @dǯi`%2$ٻoMEhcFɤLB_܈mzbЂtY],@+4rppk`m~}Me}ړ+hwҬw1I`{uUlZSƸkO%qɓ+ .Մ̓).m'Fsɯyc6v#[T73Xo䏻 ;=..qrmie0Hsϸjm{?>0#0P>;3B,벜r`{ݒk!kMb~`A #LB.dU'ckٟki aoԈYF2/Ř py~<pW8.~M:g1 nLd9O җP>wz>ZF" HCY;ŅZ\uCEԹg!$ }̩Jf|՚R ڸΟ0#d^ Fr`(!'@X6]uMx Fcf |nB_*OiNy! ?h6{mm1'7FSp Hz͵m#V6yub b˰Sh@Fh$q~e <N^{sl2@(D}، lC6&:c5erPWc0f^5:l}zGUnkP  dc=8ڲa{}(;-X滋j2=Pa7"k9Ye=v|~5h>wifFzv 䥬XʱIc$ :B5_nqZMVD#>vGPW ,,eWRv@:!paC㛖_BFAX=P [Tä_}@N24198YX ㉠ByG~w 229<4ޏ!N`rW1D(*]ƒWTw6JE 3 :ҼfȠ5ːx~ƟvOA ^f!2GDtfVgh{Ѐ0y9д-e7`%CQ`<ЗEKXEL<Ü&HYcT0F$a@OJQR񫏌ù+PXu4`cd%`]\DKwgމQs~{A'/ql{* I8@tE7V4 r?7ݱzML,ЪHН(I0{ֿj^!>l!$=xjqQ!<'3f-1o# LIUsf8u/ N~|MaGSVD2pUF_'6m$PgDݛVAeb㵘+Q 1](mg|mTkYNwGt7NF[]ULOKVX3]\p$A8梁,jb h6jrR9S︪fZ&`yiPT7!d ǖ,#E@gY{T^wV>Xo &)1Bm<seGt"w|Y0g[4rLAtFēxO1T!cN˽QPyqPՐar&ZqzH@0nֹ'%H;W;H1XﱎN;]8ʀ?}qmIUmUZO~w}!wێ~8T :-z^!/ rpL PR F@7VL4+< 'ÍYǤύ{RY>,hDiMÍY fSC N г0\L;\!ݢHׁ$9ύ!{~0_l\A{,.WkG+&U*kgVHv1 L)\)kMwFST73BrK-)⧄jU'#2_3gh;a'8#G/[ -2-rzR9 t8ivZ|֡IT!#g{_U|.Nk_{1Q\xcCn+ Y [ָ,Y$.o[ZP 9@"-g-60)X$Ͱ0PPgibY~("˜ԧ,{oDKiM [kEp~E+hbL@}D'[{"[OɴFF(9Wa87R^!ZT;sᡕuyw!]Ie `ʢj<OcCW@9ġ`&v^J ,T] y~-XvlavE#NN]ۆF^{ Z ]xA @:4xWe3^6<= ESxl g- ׼yP5E_7\H5yoNԽŮrKt[r۝84o`he2ԗt pfvzH!/'<S=- 7\+%AϠߋ U=bҞ5\4eW:PZG{k?R7; dS7[J+U[Ȃ7nA,Қݽ^:}}F|I48pa;Ho7I|󄫼$g')>o=?07CIc Wib]$K7-h-ݿOtۿz^SCF($L"(Dp-.Bɭ+C=4x{Oʊ5[phQTܨC(߻9\37)=!ZFMnVTam"OXR ~HUf-3ňPAАʙ)(Q<9'9m VSлKCbXu4+4x*M hJN$oOvcIw<[ăaAk# M5|%F@oS/!Jx*9*ۥ{ސ戧UG:"@x1B\0oZC HwxC\ϓL':\l&QpMQmVvQ=dv9>W1CKD}4'Pȱ*Y4h#Kw/kq (V]݊@g;?c?ujڱvS~}m^;tJ#6Y5\s4@M!{{  փF?7 QJh Uq NIY &0GZqj+3< !ΖFQ}BN;KjzߌY]ڴ_e9_ L hRCl!Ft50o3#DzCBEwnLkghHO ug\/J߼kh>&û .{#un4;ybkTʇ14ϗ=z~c۲⒃x4K=X+0E$mcmK8Yh'FEhim5CkVt.[e[Uk[y tSP0@j&ԯ ;għ>9?K2uy>Y~o¡q^RUߠ #?Thk~ٹY+p6LP}Djj܂ o`_s_iu0] u~ =ژ##EJP'纍Oß @{â΍P&Ǘo"!l@ G9=W&r ~1m{JZX`{,G=z+q5ȶ<=ecJF̖ʇ "Gߒ7jLhp̅`oW3LOiXyCb hܐ}-jj-<_՚aXA2j>qp?9IF8i7}*R8_>Cf~A2 |=%yb$p^W01%Ie&ˠY֪EŔ|HɶSb9Ynx6]Te2$+D~a*ؤA̰!DLD%g>5+hr\sOѭivկ0Gi4W8Aֲܥv4PDMI$%Hz0]<`0WMI)b?= `_K' d80` ^VR?MK8&\st7J'l7:hO ͊E);ԾF)$c_TuJ0Ys3쉗m%[ZwK*Α 1iD if!㐯k׹tHՀTj"Ҋ ;?S%9Qpaz۠~Z%S,ٖ'1=M;קR1]PTw:6)<"èP1]An'+=)T-"_9F]tcĶ7-(-6[5*wfhE{%|ʇF 3fs$2H؁}1FaK4@9$sc{%33(|MPr PSCER2+\S3@A)Fߐ4n>%p.IzӶ @Z% B#*3t -*,VH%-y-{CM$JWt_q]w-'f3gB%CIVi|=m":񘿂'WYM͟Un'USf.QT4%ӷ"xC;7rY`K7xtN0^:$峼 BGcI2^;`9H3}tcc즍ڥ5 b5)ғ~&LWX:])҅_X(ʔ$>>)r` +)(wt ΂\i\l4RBF$(Z*0~6[ 24x_n V'w; %m7r@^^z: +N-#9 R=TR.+Y&]FWwwhlZDze꤇P q/?qvQ.|N^~E Hqvu xDC' 9@&8DQV ޤEaY@v%[Ȏ[Jy ϭDԜ*{G;*JG+>ފA eeq$Ǒ?`hfc.θ*fE8P6(7s͸s1W⪱f;è90`.}¬8Oa>Z3o^8Ӎ-'L7nw(Y> Tx; c5+F<)USj$b  q#?2iŐ%G! 1heURsgt5`֝,/Y!VY2U2$frPG@Qdh+.qBx|g,boϓo!A'ڴVa,U &Z,FJGC` S̍+qTwt,VIBa7ͩ5j\̇\ȱ2|| =$yTp]L\wq40 .Kh@86èM3/ Vf̑ť6jQlfK Όj ESS}%s 9zYs5VHtmfTݞ]56ʅ8)2v;x?)#,Cl.;r'-WwR8K7뮣A/DA KHT ঌ"|=W8ʤo+i"GU@uAwv'%C եsz i,Z|&K/M N'Zvp<4ߤMwяLjX(Hr57nemd >5 suqZYK`4% `4k yx#Ј_Û#;)(ݭ4]Xw!{#|E%.GmAp 6NYhw_rRKXDrEـ7*y~dܦ 8G$QvqƧ LԀMyzʁx1~8~!}fngNY 4.]BBQG"&!n"O[B Jܙ)7v4ry#j,8Y4={?+8:#7:A`ـ?lk·kZx[*E!g30>izSEt'uy%sG! O}^z9mksO+Z&]0TXIO^Bb=$ܩ0#/D.5l7j8:+^"*8\P^>-껴D(ȒnPr娿Q(Ajʉ'q~~\z-_l;ף[RgcET3 W6 q^h'S9Ҕ~t/Pb#SĕC+1ݲЌO [TWKuc?VR @ГTGj ۙ (~\>km ǖ[ +6Rzt:YpP@߱g[47DIMSz{ؔl Gv-:$žŇ2x|1LJ./uSDN#dBg¨84HNB,|I!%gp#CC(à$.Nd%um(R9%"-< 9jŅӪxvGᐯB0ܪ&c;J5}Үm]~n 9  1Ⳁ2c{;{}Ґ4a|ߣP ٛb'FWz8!2q-Jb`!3|FIM"of1e CHY5KK?dt2t1rF,` 9qqF#)mv~Nt 3Almwߛt؉#dtͱt9tfޱZ`F4SP hhb3j◃?9"0,#RP~3a-TQg|D.sdMwiT`m&avy|[U8Gx(AT=ԃ njKlGLjLz{hJ=_+l6/y|K|ٶ'g$ g9N3oĞ/5ׅ#G=)#}j RKLdIJgfRs'Z̑FVW#VbRҚA\b^”#QL))NEoGbD4͗週Pl%=: ;K)\8˴Q"AD uLG q9c2X2+B\4l{-:v+=pȁ8M.WSȀp'd8tRBBF/3**2$! gPWÀ7ʣ΃h :nɚ/q% he: )+e$!/)8W6*O[]-Gu(_D鄻@INTBŹݙ<+nzfHhh/7*qm! {>O~ Wӑ) ͨt©@\V2 W\c촿`>\O͢xivJ,)!f;epOӻ=*"HENZgBEA.u)6?C{].g[X/Q?DapHf%EfVif=]nI;$h͠;s ^Omj-GqU01;ƌ~Ǫ$B1v(]>!DZ<ȉ$cK܇? k{"Q#>a~Xx^~|0' \ Z>ip\ \?3R ."Jv^Ѽc1臁m^ga,v:a6>^;LPvdB)T+]ѐp`2E0AW)dR %bSE;+qE Ǟ3x YIn"+TQ+ GTzA=[bӟ!&S[$XL>m1j&CPY%1o\ͷnyG q [X ꯔY)M )Qtwj#@(_| :I +"YqÞ?e}%v_̓^U4.q}G؝-_ 8z3f bDҩnJhWTvK`4A37$r:6ܰ]5D%DyҀ2s,n^9}>$?W.qCϚ:vQ 5deVMu`f: zF8] m(QflQ:zV]Ҽsj~r~kOSB͞TJ.㋆tiK܍@xN/SY;Ɗ4եn[b{=HDJ=t"  ]g zҞhq{ޥS4NsL)14ب bL7=9q0.j3h\P]#;)a)5hK-!K˭i$DcK֥\ASy5RdUD˴>fֿGư^}tDYvq WArFs1uz[JcC&0$8ݺ٪}UFYɱbUjI'Cg34|C"ܛ>t`q)P(H5@0/P LLZg;8J[D. jG1S$z<'Yjnm)QIHb<T(UUC#Ef Q)݉Mkm)gf:,cOl2yTuRyz7mvxTjh_ST.-Z/i.M6BYnNR\^4`~{\z*2EB_>pmvUq ga&G ư>yNWu9y2c}[rCH fj \qP4#VG:jc,p Ehu&rp<5ܺT?`,剨>Lyt^Q'N3͘)Z3^. v-p5{|^/^3N:c0(3d! >e&!$@n|v!i34OFr#߆\KqPv%>E^VSyivAdF1K-QE[NwF*SPh\ule\_{J/B8 #sQw~&ee[1~P~)!7wl!Q&>[ t%*Δ&㒹.xgRR^<[& 4%ftueBFbR V*g^LDeͷʊukt5xv%+Qla,S8@LAcB\afR ƠvGh&&^ZG9kD) h%QT+Yp+-Գ%W+JGA'JGb#UgW@>^nIbM*w > 81fzbRGp# (ѩajNJdZ72I҅gf.ay["l"7-p[yd` ۴tHG:>3QS*IkO4g%ʕ $p`e#O7'(a@Z" JM7]Ηe;tlOjo`UIG~0JgG7)8kTUg1H:_0Ӣm "x}Ys)>dYwf+vwp$Bkp`],O+le] aUw4-?[! L8Ĵ/zq̦#TS$Vuac>JE?{KV"/>Ivy B" Cop]:%Px7pܷEN2 yƾrBT8$c*w4$lW`c;UD*Y--UqnSLO+kDLJ3?7zސ!IALmDeȈRW}Nnq:K%L˹l>nY~o9%7VVMC(93-bF%bqe(xI64:&!D~&]>53HzV_B 3:ta/t 1k*fhyd|[yu4t W1xқn6'E;@oyc rTӬy3ape!>lj6a8X S)deQ=SSGxV:sJ6C e k魔<ǽq{к>w>I$n۟W耜ZF $,]|'[l+"l=dM__嗟_λuCm6[xF^W8EıC)tN!U3nJilڊx 6TL?950f |dl'7|8j >j]}GL hXjggMS' #}M[0g'ٜ_=\:IQN-,Wg_ :*8Z @NMyR7P. ^H~OeDF? :?s0V}_ZTHK)8ngLgOcSS!'ZŬؐ{- 8I#1 ƝԴ`:HwB&5DC7%*/#vA%ԏcڃє҃j^E [,IS߿86fFWJ [ai0Wyn7uFZxV!+ul@5YN$x/rZFtl!kqY1NaqEIn'v2ȟj':z&MSkFP,F1۠ !4QD4r3[#h8 G@`e dkHto\D0]v$Epk^ ؼ嵫cK,2#[~q~dާRx:ŊwȜbje#1 3˨faЬF.c&|gZ.14W!O9}!}t83 oZi01[FGנ/pO(9Nul+WxG|)y>ۮb?@S'8~Kr78gf]bO6+M ʒ+@,[9Iĺ '׷pb?@2sb:u8IT҈\hy^ntΜbǿʉeH#oM:E>W .o%.CN٭H; pH9r] TK -~~`̟¶!׵PX-/b%X9([uO.DR}DZ7/Q+gd@Ѹ\q:h`-C$F|&0>O`rٰM|{)<qZmuY-ɦe&]U6 QdBjHl.:W;N^9M +#/  ,=z1 kO%"${H=qҽJO4 \ZjHDFmDnk`n$u^ ù8L%M/q A.g5qq7_֍j ܚ)@msϪ6]B^ȁ6[ʮJXcn#+Pۏw6E' Yeyb> ^^šxI_IvН1 l!xu8oha5%3k ['jFo,ԭ*ĔLa+gK-ç3Jb@bF@Oa5o,=egtҮa'Vp納)JZڪX{bc0_L$nÙ ĸ(9H>فʿM Ί@dw+Z⡾+m~idzjO`{ (d9ob쯘G>XNǩݿOU{mopQ%z2dI+>*gPz4Zd0yCuA$H$*GS:rЅEF ^5:1aȑ5$ogف g1>!E+tA +'@?+U@S _ѡ rcMƷ0Z  -YA|f+j{R6"@+ɇ5ڡj98SRP7|:WVq-Z P|k>կt/zT5VxS͊qnr %؏tKLf Z Id6!)Ͷ#}C#`5#fnl[8lhBy)9ɗYR.9SJкS /Yks!OFBTwmet0Ĩz\HfaeX,'+]7:QGG„i #3·J 'z24b2~nzzy].SghGwdJ;E22(US6o߉_gj(f('pcpb-o0hzx6W{#$*>{ E-Py^MA'j >8M ݷPaw*أ &ӄ"Aw*J.smeY#, k\bn6-Bu$HMIo1"ɠ/Z(wr?މp c\TNum6Oێ x;Rs)$G8ɆJ9GSBd;" d x.r$پwRM#neY{a]?±+D;2QߨP|Z~I77 FWNW#H \A)TvFMU6rs;JO2)sDJ^^jhףn*gt1bT0 Jԛ?(Y\BdܞlՁ=TY7"(D7=2M.OǦ]uQI\1D6O2rusq;8j@U l9Y4PV*i 0Q DY,&P Gx!7)#lW%' / V'&5F#~[Мd?4%J - ;r^dBJ:.-$=T"I\^]UW4רɃo@Ȫtq!@J$4@ s.OhMa{>2B+7^cC6}-/;'~o{s"s Gʩ*͘Mt T%x`2eK H٢e$ I9'±\HU^Y/2$ϠbGq?# d;jU!$8݇ w=?D:A˳IX9֏i0RB`6P] ZG+Üvۑː{\?2c~]`eHyLjuK~jО3myWo?Kș8b?@K,^Q_ÿUKB}MNG:/DMxe߲Z!rVHU R!qnaϞ^{hkcqOmCCoڜI[{mAY5ؠ)Һ:Ӑӡt.pvOV9-&P+c#妦+SׅgشIgwj& +vLσoR[9Z|f/ׁ`o(ybeFګ_M)nA|q/sm,B=Ǔg@FݜӶΦ0 C.Li *8Dc b I囮Gj3.es|Q_k"7∓PG-J8<_!~?l [\eȍV}@\2XNZM?A۞g~x#bg[>Cl_l^9,RPC0+72!ȳpo Mauxj9v~yZ~rNΪᩑ6c+J#1?$>|/`Q;xp_BRA vn pM/G@M[ nƬ3j0 Sʲ=K\@Gҫټ{P17(}+-v jЖH&!3 rr#cm K?f^ExlQt zTݣ+dzmxtd7_of90]$U?{V|Ua _JI03) 3!b/f9AZT"ϴ$ĎS kehzx2PKpi5`Q\!gDƲ$ܴQ[D^$kHRLF J7] vU`lлa|v4 j{xxm\C+rE?p4zl\>[=ʊ<6_o8tx;#3YĒmL aîp:hy< ` ~!t>~^ά\uئ_z~l ?7=[k`+#˙-pLowכ{It~ylT*[&8&WeIYn܀"3VC 3;4^lSuXe^FBֳv IQ_Ó$i)g׬Sɦg bu=Ӿh 2{×unуTbI;:[nћp]=6Ed[_.8\ed帊ds9ҝ7m=&4@Tj栫խ( sz+7aI)~lAa(vȶKD ]L- .$c,PtU!9hrݩ%E,`#P*0-ȭ8:qgiϏoP󍦳 iq]Bţv )l@ln@ۍA[DasIʈȄ:ɹ.箘_l-d-ՓE7uuW `/iov=guT^L+;+:p2\ & $ >#u; Y[Eyvx31!9 T49^V8%3"e"j"CeZbnF}-3X!9'e auƭFZ2$oǦY &`+>p@: e쓪:k^;ۅ܂-|)I!LK|..M|@j.bj]Д|,J& :P|BG(3Ms7FB5̀n['RЀ|~urH _"iΒ #nDpTBߋw7CPcJ&{ y2I4 D}πqrרzsB[AϤ FNbEDg:9Ļvf5Bmeߨ~:ӎ5b%QA}I)1/ [ r~#|obL>˽/ xe؇FUqFGo+|-f&2|]>'LeW {KAD>p=k~+R|[^JJ q v$1fZ:20P--vGJu>XCMCANu b> ܹ hWl87m2jބN:Aه,,#0&E~iNzG,72S@3%\;NAlЅA  _Jj~ܢhS~ܻ3,^1yEsF6SB`q&mHmǫ Gpخ} )55UUSxfUSI+5z['Q&vsR67 Q=U5q!OF2VXl p&&ߡR&e^ ϢD)X׫{87*aӳ D!i#R>0HԻYG]hr$,pHߢz֨ww(0:`VLDNy$ff/dIy[5![ǼPq30s7yS g􌧵;14w߿QI@hIcaClLd{8»Tʳ_6lB"6OTl%,~e Wrׄ,3 lPaukF"$R  # B37{}!bj̼.{W0+7-³(JUH#b1Dz]䕪nR c?B{5XvN{޺e9E!o3'Z&A0]vA~|97|`+Ms4clfǟY~>*׶{IG1 z ˽zژ$  2ԛW;uـ -nꢟ`1 0gT}p5&1gd@2u ͆P_TVDq  ǩ'z/ |c.Lc=\]F$aEUdxainA cLjO_uTZ.B, BSF;BXGTH]ȷRcy:YQ]gGq]AWΌ0#K}G!Ջr"scAk)W5UC:W;(?M72}" 3h wEi8luT8$sqM㭍F=5lOqf| G$hģ4sϝ;ew!CQMvrSA`eџ66{ \pbɐC8$Q\;4.8}8d;DLӀ'KG([0d"d?q| TppgyGS-ˉ9/ >N<-+>uu̚[. 6?YB T`%k9q-ʀVV|_2MGY=z.ѱfmf;m`Vݛo;޳ 5Z r B'DNP #Hn5u @?ݧ uόHL.] @B.$=猳#ȏM"4UG5~@ Zs3%)`gITyq:amTwӜ7a}0X{_+=?L\A'2+91Ht>6r׎,?3@۔DT ++oa'* Ɖ(H߷ZT3[@iۿ{MWWNg^O_&b娘"蘰DGc96- aLdq}YwN6}3y&Z6A4ʭ274Ve݉.)`Ȅu8.[S2jg8G }H/͑GpAݞc8AH2Gt<&kX&J%" YxFYoR U2Z""|2GVb~Mfx6tk/ixsԣ0,dqNeQ(M>BāJl\X,Xܥ94᫸D!>Ԥ`adr3a>h%B?z~) |nyk nz2J \[z [eR:F/1>Xh`oe$7Xޫ!`[-ұg;4Q"QFHx!%Qz+<vj;Sy9wӸYߧ3q!w Hh6`=HwPbO{~E}/Vs/ mv,%(;JAX˼4<ϭ"Y/"aVXE.CڈnsbL6}ٝ^2Ynb"?-UCiOkz9 >"n]<:| ;30&ϸr J: 0n&S82C쀿5TZ$N@c7K.okwe%rF_l^ǘ{zeh,AǬrB%ͮYBsY*q/e#j:T(DtɗvrGI2$3pI{ۖqorq>Cc}Sg`| Pz 3JMzO4lg\T_ǒ1c$IWʧ7^G7rzJ3Sא8I(Mo2f^f?NcfCޮA׿4Y]Ǖ;+&|TzuZFΉ<9x2ɖ~ α|%IR'PvG8"rD2yQ_a__u:8>fXbcUD@໕*g3  0)D%W#$-PfcJ6֙4"$Ԏ+Fq17Nq+Qb]_f=.vGZ"6^wb͡xLCo&@̓'}t&[]#>Hv0R+qg5`tP7=OX!W}j@N"?)^ş2hJ.ibSVrՍ췧 -iE~Њu7v)\e{[^["ۻ@)LWh%_7EdnJNHz4O'324'MנN- my8U0_ZFrrk\7%ƨ-vZ, G!PB퐉8A챤F$]bErl4*9Cۉ厚dd1Rhy+ua E! :aC ^_g@C_v?B=m0Uą1; d?%qy6~רnj}()=϶.{XgIL`N~˲xS/-y)l5 ;ʇ,t:0x Y+G"&SK,$qWs8w}IWw /5͔PkywNֈ84Z˿%2QFSg0BeCq"`Y 2/Qk$T"`e7au/mZf8;=F*DwhN_k3z&W2h>Rw\%`Ŝ1YE 6(eKzXq>w{aۜX5$ͭ>͎ eU6Q ʚɉpT'(/Ns{JyY2;c~`t{\I 4䲏%;rBX287خ\;¹9|U'rh* eB|ߠN"qk҅7t~ Ӡ h X\VѢpa9tr4~M 8"W6u}cWx=Q,r^Doد}AڠPIMGOSɕX/\&J^*iNUfPQ\NJ= T P7$H&d'n(wIDZoZ@33TH[\s6L;X!Zk-ܔ iR}Jw@Qބ8I9s{qwWbc#= t`}.ha~Ԫd RfSq+b8E2Hd>r: ?I аIߴqvɉ iQveڽazkD˜l !o\;h<\L,[pVaWW5eB쥞_ނ J}~ňsMX&09f)>ԐʐvGfko1  4>|ޝKuv 16t]KTEYط*@|-'E, ~܇%s -@!ůItoal4 'pUmݳA4 *"NUF eqnb %꽘YJ8iX]O0 r%^b8na#TF^l0[a(^]Ki 0wQaOCvKZԧ"֝/.?WpNӬӂ& Y|(."CbWgi?$- >fC@︄mz8S+p Z؄{-Kw^#>S. 6p5 YKeҽ\m^ETS~OQ2Hl ~: 2yf7SGN)&OZW#v?<\g@y|6 OPZDRZD$-9dwd0׃[+#*H5!xEa]XS\!ىͷx0CQB᏶3HH֐y.;nOS mUҌ,&`*%sˆR9LU'b4SXo&VzcWbGi5ԇd{hwnH{ ?_4O}Rys' h*j q4'%o@F2oV#\^q wR" / V"+P؉4vjn4 ]47}DV;WɤDā?Oak^-k@hj[-6^2VzT x"Vs瀫$[cbDl+:g< .ʚ! g3AaH1:ޅ ;l=Ίt1֐?85ϑ))Bv 8DTZy t 2nhN"Q:b}PEN*h梑~;Ap"Ln9T$tRHs9N{"͛oSl2#,c&P.%8 k Ak{u>3v)zdiAySs<NnN MX~A-(v w@UrH@~j斤73!^ELV&~{;+ q脓' ^@NBC0POe6,Siܣx})o!&r:|X'rU/A Q çCSxXgm@pqp&w8qM+1i[/)^s}N:L$!B d;rĴ1HDھ򞍡҇QE{<ّ!b!L;C/#CmhL_]ш%V/@v]_}ZDn:"} zih{Б̂t#Oa`:+o>JNa Z">ynAQ6 |3tx3G_MwʻͯOo@$tl |?vPA{jc;:LcV%ςzDCvTօŠ‘2-{Bc?R!.G?~H!%4*[Whf̩hqq0F%er\.b5>!(IPzBu+AJD'VW2/1tG@*sQ$^јSjH97 Ё饈FNE uhI66;+)j@xE5@[JZ9mDy0([W3N'p%]P ߏh v_Q5髋W\=/j C_)$IQh{I0@#A4x?mA"g3Ow:[f. B=,gϘ/ցSӣѻ,vn6l,r`yDgQj򠙱4OoTYCډ @Tl([t9Q_L"F=j6] =爨y}"O[i"4ۃzesy:_Jwś OMNadܴqN136T I/ܓ3]A(`;",!`X6K lcle$`i[?%k>f_H}IR}QRbTi}Gs$+nkzi6"`$|w\Fl|!DN .k/(?:ҶbX?~՞s2.Ÿ0{VPm?ob? m%%R ovA2rExw9< n7ԩBҾBZYD頢mLYl {O :t艑c+|GQ _rYL8OUl'4a@ܐՌ賁AS #_/b,.C!(z{O ʖ,tWa_A:F1̋REFՇ_.P. ٺNTl]R\SR|Zk:$Cܱ%:|X2JHFZtb.ٗgO%ۄHip+9|hf3#pJO7w/~@e>!q?:N>cū)yS.M; L]T-p V!WPν=9V'{ddZE4 ʂErfƸ!E{ЏB+z`ӑI`^pXAҶ'PRʿpp2,$9֗$ WY }1+ri'4S@9/(4` 0#`8$ٚ`L'rRuM9Ȧ™sbSd{9b1s:JRDV8HɀQGfU=E-TԹU?:hala&sS+3\+@+,tnDuTX K!F$!^u(U}'A; țo)*Τ*U]RBvLQup@J)O!j/[%| +Ac[lћCa;l;i~(omp2;=5 _ь@FЎqTzh%x5sg |.HJ!6MW#W~;-b i{uaST8.E"Ej.'EH/SG-tyPGLS h03d<63/2Bۘe_GLK5*-\3@]XUo墢- VsO`Ju< 4WR fܧG]"p!mM_s(zQbߚW|ƃ[(JbE J2Hı0o[Q=QX (%fs?]/6j&Wttx`jrNo$R!؈g{yeZ5 70jh>氽\o>Ƞr:YH_DoʙV(js}:kzyő0hylN~̘"6&GgqM붻cCܴρ,8?]X6{Aet3ŗ$w)|Cʵ?`pOvxƠ߁|4}ȧ` ]tum@ok6s^(4/| J6EZpQmnsQ*A @oF磅))^݆}.5 8 ^Xj ]8QhHn5Gt^+Y\_gF8"1qlnޞwx] V@L{axCe,ɁTiuҖ'C8h P2~\VByp9E6pX]%N|h٢C#XyTjEfT{@k򽂫@ Jؼ &A0%H?B[p+pұߜ9P$TؚwǕ=›o BDk6SΣ"l6~.ݸ0ʣ7=j<Dnhyzc0 ㅭAA֝{e 6p#S|tI!\@fǸR7x0b_~9Ȱ(W[f%+$!%\1͜OZA[8T&`:@P5%ůhAȐQ~O2uesDE~E0th%YPesHݞ+wDPlP X @t_|,X-0wL/L@;dUBi].̟X@a|r> ^$1gSw v24@ -5}Q<@%˛zZXtz f?9[D\O4!$wG|Dv;hOmnO̽y )]bZzBx\r]<ƷD TA|$q\d'>.儏!%ʕsRA8jÐiY]1yi_v4{&҇Xr^)8ONrrA8[of|qjrzMu *ȠmBSYJ'U򤶓xvfsF}<У=r|=i۸tD9ҲKg%]76?WI (A9+))XZ9lKwuK,6 ۘ *J3'LjiN C4p %Ӌ&`uQHMmqu]M2+&>#/'~'9rۿn{x@1éڹ'|v40VQߘAyD;u9Rgl'̍CzSP2Ոcx$}:[@dRG#͚Pee:_Ӑ|JzH[zb+emػC V?"1y™+2Z`/꬟D d?[K,`x< t*g 2>ؕD'PEµѱN\ՂƉߠ*r ?6vyJ+ރJB8]h Θ1y*~0~Uΐc?e,>kZ.d}Df9 )OWIME!&xP䮀f n=;5gp  ea)F2 hLPR],d lsG!j$P='GUln`1R;Xֺ&m\"}MB[R;Q> 秼&d?j'pz|M9w3ezjk`8)bхGEgUZq"<@(MK]Bؾ <5YS1M3uϹwmL'gl~ibל3z7i>rS~44 y2)ʎ^jfM{E Qv fW{`&;m"i #^ψ١}U! GfaiZoQF9)2 /úfİ$c+E&pG$qgB H'BdMB IPbNgh@#'2^:(g$/E`tFq=Er `! :syycoSQ G'ܧVs~ۺ[MNMsAz(kquC-߰?mr$ [ȾUpin1P;< Jke»a> N!ɻHOD?> #9Ii*"5-tD/[­^\0t\jCүVG l 5JVirljm(8s];ƅ*_Wf+7;Asl`rtTԯr +&[F[FZMJ1oG!K?LpD]!I]< Pw@790 c\d%j_ Hfu@jv,rz%­.np:sG^5@;`auVY!]Xhx٩Vp3pLJ._auuΚY@qcs+ӽO.J63k ~Uze"^`3KD9[ޥ#tOQέLP}o"?64boQ`[Ymd +P#"qJ|#>~%Nٔx>fA/? 0_i;MQW#<7DEB̦?Ôa,Ik^' AҴI\* ~cb#,Ch$@W~;Pr7[ l!e} Wb{[ZO[W e~k2 PgbRfc$4Ze19< [Fd~=qm0 (_WFE=sr1t1,f謕3~`@-ZB-5"M2/ҙ[t.m09@X!pJtl"w03%TgWW`Ēl{x?ϰ`Gjc epXլ+v4c*Xu[ES.6L:lA3~'3Ɖ2>鮙:x;HS "o־@9ŭ+ny=jZhS|6"T,jp&_{P-$o"y5a'vnF&IrwϑefR(퐸B^`3 97Nh>]3Ղ0ax=@qY+(\z1X:ƗqϦ599xwCP&!ulU.RZ}/h٥w d+|qIaIۻoM)͂Ɩx Qi&lȿSM }CvGh aF>TLpgɞ9>D DDݱS[Ɗ"4z@zd43~R]\'m]QAk)h5ٮ :{3;: f>gCx^U }Jݒ4@^6т\*_^n>{ f?TF5MWʞ+~mz8_[!D+nEB[ְ_i@Μ ^- 4j-X{ɠ_0rcnPdy$M}wcoēNؑi:cgt 0NrX Os@[xn_0 |E 1J;Ez<mH:H.`+rUf`gY\ՒWyuל\A}]PĊW~JK5' ߰-oZu^Ml%-~2Bs(n?'2ߛO»}IFd* O;d/d͓W""y9شmNrJ?;3b)Ec^mrcA?<V ii+.6S IF[S J$jqg/fftBvyG @ 7M $%ΌeЎ495Xxր`,s,;:ЎE.=@( b'0:־h`:c63cTxeZnhdwD_)"Do۽SeT6ĕxTL@0NV6$uRdY$J|e2*/`؊F= Ix>{Uox!2=V%BؙVt!$ _huѦ⃮?R䦖z>.uK[pmA.PoD!׺ցk ojp N-vB4䧏:riy~J.3=u5 sh_hIc#ۅtWy)#p:?y w+nS=ȬCalՀ%جӭsÜa8{"IδhۢJ{-Y&AroTQc`;>h=?St@hEV_Q_"_ТZ{ǹqtmO)^P!Md>{KC-etOEk۔'<ܿR:-h +lg7_k&7!/4fW'や2= n4Phb>Ha#l>vMQ.R%&)L~:f?9c*3,D^Zܷb+Ѣk}cH:4 j3[cF&`ZpG/TAԛ۽v=h s9 Pz6@˨5{7NL؜0ΞA. NMc*S>SUH}غkm,3ۅ-L8E魃'uu=h؍DĄlH6XOL"fԜk6clbHjrj͎D RQx̏N/KJ[=7oh> ?\QyzwYXf Of0[?0U4n)Jz4xm1v`_䈚|Z+y&cR'21!zmZ/η~_dxƒ8Zpc <]|ز:QRO zא`mI")tv9 W8"Xp QjA%8_V$]G N-t~qU:hW38w7] Z|=c-eD}LWrÖۛ0J{dAgcOҩg4ΎS=G4{bIX87qݍwF"Ah̼,FBi!5ᙪphSw`](>JO vCCvu>~])L¥IVʶ!ʩӰ@ZK$&7S4ޕgf+Ȁb ,FlWjl0Hp/15Y1QdA@ľ ZHT`4*N`䈶5пL8yrs%08be6Yh #gOo0v?dJr)8w>tZ{TPQ?p-nԝ ~`lmqL3LlRȗZ-ti8ԷBhLekP펀{cmc㜜G ::.\`(#\M< '};LYF1z}pPq Mr)$umf.x7՘wSՖ:aVY*d;Z^[%Py^Rx<Տw<ҡE={l2 o,a%/Dg@k ôMJ Q#>&ǯN4}'Lc_,I +@U?Q9à)}G+ߓ^eWSq$~YnlBM7ES`}Zyg6xsK˯zM_Ll]g9X9VZ |Nc1~o@e &]Kg*|~$摚\_]@՘{0X㇁>5'Ȕݕ\|@n"5Q<_(ܐmS7i#Z5* _#0#@vJuz\mDF\ '"qa (^a`3epf߬:R3*A,;[u2вϦ)wdC ˢ)။=lѺ9:bPP[H_1T?#CAŽ#g-Z~l;(]̈4WZ/] GOFT8H?~:.yJAuLA>2EEyH Yh%5 d I/cg^Z;WXڃt JK^rm ,b&yO fEEvfA".Hd -rЭoNbC3Hfţ^E%tVbrfy D^ޗOJYF`g4?=ڷ-b?љ,,5 ,g( TQK!\> 2u? ؍nVU{D;-B`qrL,0Sn S,@|m8'Y\_t[1P oECce󿢁`U% eīku̵3N22z&hpT́^IC+..Z*=ιw",nЁc I+E3pڒ$ϕ\wCTj"tkS 9DyQoS Ffn9v/ &11C]h69Q-TxN(F,H9E,l OQFx'x@9 un O B Kr!wT'Soc#"-Ε b*m'+E˘~q\f.5$}tlˈ9^H0 먲;0҃i3SR_#d2/ߕC7vԶv  Ӹ1*zPW+7PW L5X I!x\xf!Zª0- q5\ٹӟSƫ[Q*tڹfSycK0=~<ͪ1¬- *3BMemSY֜#אF)>yea+0땍ӍG"%TVW8eArNebTv;bo4 CPbQv|?}wWKdJr"ՕV ?=WE9#dssQWt&j=j_' /71sRI<6~+PSZwoca@13RJࣝ8|}|[ܔ;'پmP2y\J.ՀVt|/gz%F VNUZWlCWB2[!^TU >@)5gQ>6:h ".l`$j@ɍvPg F{7[* ]GM'F ]ʀ̌i%}ygsa^ Aׅ)Qy7(jd8{,gfy5f{L3=[[L칕9ejDLc{H/0Ď́??KWO/ >HAHUz nd)Kd%Væ A 1_7MIlD&>/l/U>3I{ř /,4ˏ ! ,` Nҍ".9r̈́) HG~Y)=R;,Vyq<ۋ]۲O/}U #z >Xs봅>=&\I 0ߢf]9Ӱm&ϳ#*<D A3 gO HZ ͘B ϰwO"iT#mՆ5nmW}5ʤ%=俉T/c3ؕn3u<^g+,mv5>[xr-=j#8e 6#(9f$%FC|^V7}2CQE0ICKxB/qKk?ʜ h֫!GLm( hPEbQ2Hi .#'qSXGc #~$h 6,B))OahtJşyhAB$vk1J&Ajta  y#Fpvf C?*O0a QhJp@;=D=l]Y|~7) ƵBP,I,|QxU" 3VFDk-o7YWcےJ0 SǗ0p/\#z+Su&L 7 G=-|') ~Yu- 7w)JΨ%;vT.,fjStrew4U`q͹6M ^Z߇%PCfL;R3h[ٜ\lN(;;;;b Ez.UW&24 *bְkS`Sص\UUAY/%G +ߗI?vv55hhQb53.u@m Uު,R`hi%Ef!C绔'.[OGGo/nYV#zБ7Q2kM#Ɏs}F@)`Ϯ dX{.[994U(Y}Z7ڋ@I Dc <& N:Fp; ۃ}< b'{{odx}_G.[@X`)Rh/LR Ra`cB=W"ϝj (}p%v]A ؚbz(Y4OF-+UAԍn7#$ïzA[- ,9(;wYDڡ&7;{nb1Xk/glS;o^LФaBy:Z7(\(3Y {WVN3]vl4װ5nrn]FL=A<{%fn8 hu A)y\6b|a:.\[ Ĉ` ńr,NDDk%ӎifr'SADӧ"2X[أ@ӽXU!ۄKU0PG00KLIev(<*Aȁ{~G^'* ӕ"u]IrUy\iG\O̎zwd9.eP_٤C&^E yQՆ5EӍB+dρ#>8맪n eRVn&=9uuV~шӡ ljtD7oFc0oBClQh^2$ jMxqRԯ %BƩ F¶יǴ [ G, pZKQoi.f4©OD)D=ofvBKG1‘]A{䮄6Yb-Q: |ŞO3@Npc,!"O%ߗ&bߝx!tgsPOn|7Y1?lW4崋ڨ--(曃1C@i~V{^/ud_0m==45ͭ*5F6(Zfwvx+,|RZ8}I"TCPXOI":g:eOB׃5Gp@.]k >4wG-Sw C8F[ WǍxRddw6wAj @ )"I^J[ b>MS#tԕR+ox:Q !O:ATT"B v91n)kp=>j5:y;dr0=*@qQ?g]8+@<3&WnVQR2Yaf?Չ)R¨}]g6&u &o9sfaXU~&VoNWh Qr@gmᦰޙQg%7p?` JsA6x-_ :Tvq4=w +‚jW/AGCM9ټߖjCe"ӵ͟≐zl>Aթ^rʌZ_@v:L$!+t)"eF wcJT F+`̫R4dѾ^S{ndzV<\'ޞ]D3JucR#816Qjk5R~V 9ƚgojH(`mҗItOZA.|Y 8Y iL³ |wG߬e"q6\q .]2Y$M7X(>䯫:&g(5u; (sI ōQEܪ8p+_n` V}oqX-`"|Y!QZ7x7ѹS\CUV* M?,YzqFc ȧ{$:2{d}on\c=G`+1-Huo]$;|2^0BHL&H.]E/cM A("&+_˧;,@vOY׳լ) 1+UurʆyW!p\Sn5} 9hiK?(s i[8x 9M`Sf~h_Ͼ \LcԔӭw+ ,t`W n_e o5,QoF&ΜR(XcVKn:w:0H6_eZc_\Np^ϖe\zb_7R$\wP˝]|;0۹Bȑ;";Gі]{EȬ 2 ( .jJ{E7 35C4LI6m0S}w=OjC ۷B LѼls.͔᭽.p5nT۱BYYI ?"/Fr.W|xMmބB6˼dkcu+ Z ̮@ *PhݚQ|՘aeX/VIN.}.)2B2䅀EN H-]|vWhj,sZ|SvIHɣ"(A)%Ez 8$L\E[JC3^X̲`0]»a\~YxCL9VNƑ =Z8Z6-%gbՋG^z; B ^]N7 ^ە-\vBNN$kQOMcq~͞KRD[GբF7SpdB-;Ab,Q *Vz+mpy񲀛]ߢ߈seMkzm]ٝ`#:%ȅwJ5BңF45bO$@)AĂu?XfM_dp>NJ |g{^1NxF7Tp- Jbit@ŠU%Gcrӈe]EI{I`ϴ#噕_h4GBD].d>ց{A8qQ`U_M?D8_ #ࣇ|(Y_m&xNp]{x3wCR{'[`lMX&  tMUx&{D+P{GV$ g0=crU;^t'PB<ԁJ\;yqь`ʮS*BSÇ J,Rt,-tZWѪԓukznjawtagT0ib-,RV͎>M4QE>lB m>ޠ;'_Lq|DU#۾# 9^0A8dFkJg7:x@PtD1W<2 Q#O#=;XǷ]00/p+ Bgyh4fCx=ZV$Kvf4L$We7Յt21s.Ef!@%DSKo&!\Ru=`bXH8{c38D#'Α@ؖawM\j^]P؇t '$|FT@饫W]h$(a=C#/Z aβmdnoQ xW3̉B,2yn3DJ`v\f!M2RTL\3yvlN9CPP2D-ڷ"tNm, q,IV PUɴnًbؼZ) yEOT:6@˗Rf-ܼ̉f"gɸ>6!ù?:Yg{5Yqҥ<3Dyqo1KO \J]J/ZžͰp@'h^ٳDl5/Uh}XCs>`oe w7$$%yTcܱXa;qC T$٦ !!+ItN̓Ĝqh}u<:@F6ϑ4DC##] XٗSfʊ:^zdW% ΤC~4*WBĵeJ^EdsLI #L4wuR36fL5b 'b\E/myhrvG0,}`;-}?k~*q42ïemmJ#gK^:2aΡ{cmDi3CY%0$tf>e -Bq__('F@p,F9M }S"-ó$dί`Ŀ`(j4P4Fĺ^nau河烴xV5-qvfK Vܔ3VjI8.`!'DpgpJ!xnzҕA'B8fzTąlN\+)]ts$YGad$o{i<\zpL:G?H{-NC˼Ayql+t[څ\<&;@n}'۝ ֆ&71x$W}t}yIQ#kΑ#$NDro@в''\QF52V6scWL8C}+߶ .}SMʸu`ܟK3. Gv':/`יPRm#<+ ɶ@N<@յ9JJj K¢vǽ)VA ΅ڊs$)t!棵%GtskV^Zq;%fA8xVE6om m*!J q 0ݴNjoD9}XF#zh~~s'pa=,DR7>W}C~ebEv$u] )]s죇 r yԏU5˽bեAd{1EG0Ŭƨͷ[G[)EH;0`_bRB%EDU d>5Ĩ+;;9m ?~Y`EHоQ  ~v10qS$+3f|/ozIc4ȟI[p MmsˊM/+xo^lF}2^I985.@A\ -:=o}IPOs*|j]TZ^O\xy[V2: X*[_1d5ש @d5Rqĸqsc{>yϪ"5\x.o݃.Es눠ݚ/ciא@)e A(ji-W+BO +A˭b%)zJg̞7mϑ!?c \@27p:CTiBq\q^I|dC|#}PZ`hV/v65'2Z횗_'Usj&UHƦY/8,1RrͩjtpZC 9l^ ;=znpg2>3LP?a?aMf7<}At5p\`7%q7f9b K땱 g:'|UV@TQe# HLhO}@g{ӎT#y/Цѳ MVsCiŁPqM'?We.ŏ[Vse98UBq82u:t#qFC_%"rؖ}FNq0|kcTn2|5t 6R]nTمrؓa>J%} *!Ӌ쐒ЅitUH`)n@bI(*M&j"??жZ)|4ոC痻c|hF n .2/1/6pwϹ S 7!kôp++ܼ-˽c/"75>o{gv%cT39*X4d&VsC||t˗.u-G'_aϚ)kR7-V7wDٶqT-IBWU[f{4=`Ƒ9  =D-/0>spo0ns]0򙾹uvfarK#iiՎkfq#eGs; 0y;)ͺb"J;7,LdB㱉 ; ЇOikה8ҙW˼J`gְoVWj0>/]R&2y”AľE)YF0 R^Za|t 5K|!IllmF R#Q-D֏>:ٮb /Yl9dzSقmEٍXܥb>\ ܎}X)6ʹ=E_E r7"4U[A7\Kq 8hM:"uJmRe4md1BaPD=2vɴPBZ֐7)iu/J|S!0&X}qGȼ$9@^~sI#Sa7vL^gߒt_qKr JuJk(eR2I(Ьu5C2[SBʝ+fv=̔_@o(wf8bop1yV@j2Ghf:i-^G֞  (` UpnS(xG-7- ܮCu #D^O$k4[~OfՄ,Ɓ3/m⚸ϕvU/ <~ߓHL%hm;X{ݾ.{{yp{U0\A:5}(M,ǞUq"s|"GƥgCXm͈tHO~m72|ҵ#}0eW7c\MѾ{% ϸsXqo8gi7x̫W0KXY>w˓)2c <ڒ9:=̫εn)r0cgڪϡ6K|3q{Rq#&#Ȟ]_U(.mMs&&?4C{cѶm~ugZ6)#sw[Iynk?%d3A66iϳ_mW-rDSv2fL 0>qs,T}y_9"0zi2ءLo agTAqn 4JYz9N|]̾p>47OU%%ɮ(*']"]C+E7ӫaM)$J<NS>k^1QbNU@ɕXQ uZp秋w R?s5g*7̕lȉe)UQlV6I̴EpZ5U|ulj S>+F/iݹF}jaLe`V7.BpOw"}%*0Kyt?G:(f lr>#]:764s:~Ie?JV$s!7F!\Q3<=kQ)+ݘ.ʹS}JpQ1š[2Pn;Tf!N~]7 a%/j.?:*:yHmu B_S|<[\sWUFʚdcX+F|aݮu _dsZhxwqCj4R*|K55$Pg/1  /"A)"Z;"A˳Jсmxm,?\2?;sdΒU$yd(YX_0\;q8 n`, |kn܀/@9ʾI|ښOiF-UsB> [W񟄃b^&_RDs l.!A?DF>G)AGr 0zmY,@YMV<ďaf@/Y]t|T.tvVe`5 ր-tQ3,-entm' Aei1(>$tXmL}yX]4ڶw`|rDUs=8L&E)^,Xea, Lqff45;wBF62St%&;AW"`C +{p[[&ǃAF&3s.S/ɮ{a״R4|{#,lb%YvmjĠL9̙:HzbƱ_79}x] T%':1"XЮ\J1c0zQ5C^CXR^=N#/4Z6gQ!i_~P$g|bP8N+K.^( xpA#BF91wjni՘-骺(4zYPc?`D{ ~Sg R'ў9;Ȝz*Q5= (hV:P NG:^T^2*l Cs!+ݑT0Yt'on]@-<"4 IȚj"$&RF :!MH8MLXpaV˒],&4,Y 3s!I.Cڏ)Kc^~M-K)(9oR Ǥ x۸H*W6mAEsԐNx6(`VW1IɃ J=@~*sW2Be 4BI=(u[&( oY(:Wha/j֮#Hny AīK!b,LK[Fn2cYF̯z%~HX)m(h_8D=gh|{EtkfZapoZ;F0ElD%!4HK =[z5K,n`ڈB5#`)CB:9J%TUA€ؗX-Ś0`-={χ7jVaBQKqSZEqqdmC4Po( Js՚ Yѓi"]_؅]C~w4( y6N@`wSQBV 4!m#knq;چqh }BwCKrfN*n1@6>~vDpS̰#4Fn~V?ɼC,7LYOsY7Ĩ^?H5 pmgW7ֆSvS2сU͗U?*$_Q%3[2jimz6q셳az8e ws~IAoB;pYP]b ToE.}n.F^>S֚!A,nJPJdR1}g(ŀDJ:BB^;jHH3 b C*ybj%?jW{kX:0B{*YNKgh+וCF$ԃr^x&/jzM$ꕼ׏*`1sEAH$j^ہJo+~bi.4 8/O9tMfr.ȏ{VOVw `I@I(|*$B0Y},.bm`/~ca"-FaΣ:I[k-]Y㼄@Y<@hci1XeZPbsٛ .e)^thꅥox?U!־bٱW 0s a1\ VZbWE|$т~vZ67oHiW} ;Y (Os_N6CL|*YB:)QLp#)kv9fT D:xԻT<9Oҁnlg*o>6I.{0=&IR;=Z&+'gO~kTQ \keA oD11T<\Eu߸ΎF;fpK p>tm {'j4;yTx8UaQvuO~+hƉYLԻ_|ov{)%b"FRsz sQnTlpɝŠiV4p55ilx'EpV[*Ck #cZf{!2?׹զ:V4 W{tWׁZ_><<%.*8[-g8{J#Az lf-&V])TgWy%Wo 4b ~÷}9 g#/F|x&Z.Ko*CH1>ldWOFRF̽1$V5.~+bKc> ?1x E#.%p¦F+C.U&"y{9lGTdEBLq.g4l0r* |J؛}&Pi@Ynʃ[gG[gཆq-0zAFY4{<cF;n=2_5SuzBs">Z[U}Vq{Yܖ VSpP nJ OڈLC͜m/Ve_;Sliń[*{cl~ۮN.-}hӪֺ^1m(8WVIWC?9s$[sxfO',Ėo d<)hUpK;#ATe8Zb0P5_̉.y ;9 i' giyưQ`Bi0I |Ko@DkUm7loʀ`$zk/ -Dwi*{yy*ez\D: IW+ن¥{s`-sDTnoJ[Sи-D^aTy\21lp;yY׌MϩiYVÑb!z%PVp^|v{ћ/aHTa֌;%~Dr~`=JWTbc7igHh-npvX562+CMz(ӓ"ҩ%F7pPs/[}a3SPmu>Wy l΃W[(L &\,\'wч0G*N>܄08&Nn@V8ҶS-{Q>j륄w# {>(m7TZgR #OmPodRT*H&+^um}w1 F/xl^RrI>cV+ܸy]W{ooP흩SYFj[-L g?RTs[U )u˕0kl6yF嶅灎 H|wj&F{|؏MP; zŤ 8%Bq#X~{s,cWOR` lnA"jOK\ qDvg%T}"qZRRڼ\{[iNg2 )cG6˖ ڤ 14j}ʲ%.#jԜN?A_z)Dw\Ǒt2EPg9sX8K#M&eBqqHo,͸cUeY=+>iCZ5j`wwr:baR3f*l~^H0wmbm$4R, a @ r9,5AU$|1wS˧j^o]Y+>i7NUEo K\A$p65( s<&ͨ5X5 FnPyp@Jݢ"#juٔ;Dw,v|=[ٜQk9\ 06Aʕ{g|V82'r|ν_&4YxLbhDP2 u.d;@v" <)L'Us˱_Y,_ ">O*  .(kYb-qnd0<|rϹpbcG7&\~Ikxn50ؚJZ%dj|1mҒ,fe:hOox\!CFt9n+Rwv0Yuj#} hRgM ST .7Ć oě{XY*CZQ>>[u(#I9WBl59${̗$ORbxk"r]- sGq:jK:՗ T|{5K]L>od@[D35IG*!}s*FzuS5;bT3ӵ Sn뽣p12Ay pš-h,p=j&WW8{D q5 nCKp:~EIapI$ =Nls3ǣS~'>ꬅi< xnx$cJ _ANHE6n8qvOAf1׺sixLd?o0{M'Ԥ7b^%_ґYokǞ[-,ڮSc!D(/t FhNhٳ-C,|i5z"֑p]]zfO hT:H7wLJ^quWHۥF|TnOnkpTj([JREGʎ< <`<+h/ʛ/Txӓ*+FnB!5H ߁%w=U&D1>dD"h_Ą {Bp[!@QC=.ǯ].8 N=eLlƻD8K8QpVe)j.;!8fP7 ٽ RoXoc8;5Yшs̥.( kjʇx]񀹚wA FrG|^ksiDh`2fIc݈s!r)brG >O~TC(z)V^|;LJ>UARpzcU; r,Kau >|-YZ1jޜKL|=E~BFϾRDsV'd66ܙ/#?$#=4 j\HeKJ _OTu#MLݧ0Q>ٶyj8xJ㚂hId map}^nNY_()iΦ㠹F;0IP#~]]L50*?k]jF'[ пP (EX#nEЩW%+(=|"CƑ "SisH*1<[w=dw5}Ŝ$elHߞdYaIva)ʩ1/LR4@06%{Yǥ*i Vnځ@W~rHxhSvzpiO -#YBf[/-KJʱ7j.?>t[>r/DeU۞!҇X u^[ȩӟƅh2kBR&?5cv9{0Uv*NdsߦgoбcV->$ӌBM.K"H0i%L*a#Ӈ57x+?Rk|vQ; xT(nƞ_Nz yyvoX&߹69j1^? g/Pg ra P$HVHFҙ:v_Vr̭i}58h9|d:-peqt[E< 7Ż̃ k@D)%u4>gB4` a7jG7H0jCu@f}q+QddbO괣Ss Ue9++9{|WeMu\ DLi)flRznia=FcuHQo[MXL |7f#Յ!İ u9Càg_~SU(NLg,v1Nl11x?b0Β ⫭` Iv~&Vr1[ϣy]]B2{ wa.]kp*X I[l4O,{;urݠe/DWa";\ w" >x;wH?eY‰Щ%Ұb`ѻ}ֶlT5I@\ـ޺V7pkۺL(G҅|};RM*^ᆗV,>UH5(>XfǾj5#:Xv ײ! .9dq jׯ3ЎI||reCi/7L &oH28Ǧ;&þ[M-}[J^[/V6hGԒȰD~:Z?|M//_S175k.fꋑ^9 bK]gCe{mrN`^* O J"aa62ݖ0&~hi0k&`=q3@If` "7d)ceu.¼aٵSDnҬ"l; gv}N%a }]y! `(UOƭF-toMlw2,t$F ;9a>Ls^jUgnژ6W6{[B]SBR}U^ ie9o]'nfpK6GL;LSqS<#~O~)򩮠ΦI Xֱ QFu4JX S>^8C_iRx?a}HܸfjBX PsK(d r$1}ˎ|d-Pbc948eln*~C =B\ah39v-5f]7yy=}V9Pmg |{i"з|s ص %>*2YVܪD(xRn)F2 疸b&5*"} 8RG^\}pj..42 kz1`"~JϏcb'-u (is힠bS;ԟf4XO)[es*F`o[F27-yd}c8E$ްLt[9yya?e)u6m=ΧfѷF֟(S6_&GGxE PC/lwn E2VZb8m}ĤTk2O^ F-ڶ8cLNIC|+[.a<`A*ZGo3Jurǰt=~P@y. &47wE +lUQrhO4A ͹3՚F2p$)k|ӥdSV9Hc*_˙"͹;<2v+"u#Wr砅arNjf|4ylubd ғPo:~OX̅f.@!Wh\~N*j^+]"f+(E@1넀wj@$##0Z 7Y\`b4u @5: G йA_r B9ۑ{n]1z_[U/fJ4G@;W1Z{I֤gC{('XSY}SKZXJ q UQ+Wg^abR$#H3Q¦BReq4@t\UP9B}f!房\ͺf;]ַ 2҆^TEctx}^IsU#p' k؋YhYn۟"'d5Ci7s.j"9ml9ͤ2R+":)Ey΍1y\9-,k @~43l48N|Y@%Dz`E~el_ZS*bG)dž{ .p H5j3oxDa sR3MZ/VTt:ȷp7IA~YT/֜cgO-/}1<ȱmMA2\rSsOdL(FBjB`QnBl\xnctu e:)]_b^3hmX'+)w^'CIQtL(gWFfB$|$ 9uܷn- 34NUbWgxEe:t !letvCF($U7&8*j&KCӘMt;SHQ^flS>jB%s>]eÈvg6?q.=TMvNY'˦!"L2 4E'Vϫ6́O0SI"XQnV x̎v8ɱ~9b>zLD_<1tqK*{Xk7id߼UY)LųD \LLƒ~=Vo:;,nx À#tKHhӢd^}ٲ}HR ~sAe rc3p!0*RI'ն}W$'4{m(SL߼߷O= ڲܒ]0c2>P .M~5` s!=]/ҀA29:9vc. ex!ѮhZDM~e)Mu-GFȉݜSeVAQ x~R0EGncH 6R˖ǝLp5SY>%i *z_Eso[5PQhź{p$0u_kKQMK^AEd=;sڻ{ _V[@nR>xfoίf^..XW{tڻ xc 6} ZXXmd߾Rҿ(!nav$lmӷӉ2 BWń IIxI":k9w-?LhbX*u"5a Ďu9+'lN4l = c>DwYo0F!3`m(71TP6y.bϲiQ;؟N#[( xZe  [X2-q Q"pᣮh)Cf/wz\t,QWE;5R#g#4ߍhlz\n&Ԁs`s(N0G6POLz#<>̛]tx4I'ʹ 䔝*$hHS 'c;hr`f؂r[@u'd o5-E{W%]S-Waf>0eaYRjӪ?g\E kn9t'qQmCؘ~lJcb܁ ͚# . )0Ρv;Eo`c=q*8vjm5j!(bj[6c{|A+1^"kħi)%R-<=ME*I#_׆k}|4#/p)*aZMx}2 ~ J6)@sg15ϧTREvd. r^ ,o.,w!ONTd XӃ"Sle{(j$UHrnN7*0"@+W+j}pdqxhokp }W%<ܡE 24n{u!@m2jrӁQҪvo;X#8 x/cDB2GHMPQ*]U:(@rw{ըvȁ#xݪ)56B4݄xc׋|7Xxf7~z*56 iLoLycUmgv0ɞSLAjޅ n@ o> li 6Df|??̰ώE؎+2\ o& zU"kW֦sv߫%ZXރ+uuCp  VHfw4h?8uX)0`fزK@ŷH8 Ғw`N 8b_%N)Ll"{%fS'?:4 d0J{J䚊~{sØKw:߾쏆?2\u07>: ma)$T^4=1@ӤHT,,ǵ._^(Nd&Tv0G/״x+%%o N]h Xu}Ӧ )3`'A>0P~儥lݞ?Ku_b&#R/VS&br;ۤWZ5#M`ցS׼_sĴ*}&3NƣdpYTxբ`,o8]CRW-eSV/ݽDOkΞCy|;0ƛvԈ*QG5@VKt_gF&8}ܴ91ǨiM*[F$DLQD8RJ-mS>AҨ\91er˖#]\Hp/uVdUwq(E}`lbrSDE Zf8jb)ã (ӻO1ޅ]yV;IΒO9]й :Y;×Zf?\w\`%5V.tFd]2t7OYo4`2rj 0S#j'$ЈtA62p_*i4eP}fbOZju4㕙Mbbs,A߹Y㴟p=>o?H0-Uz_6 gl<}T88I'n 8pڝ)phe;lc:`,|`ѐLˆ#uO`ȘqR^w$YpM2U؃m&Cy& (& xC9HTVNp/.ћ)WE " K_4J&.f!s믠Uf{5~Uv|笭IN+#%_,W .%}hn- O*}J^['U_CheA[-yPJYhZ,'U vqM&-G)[fd4z"R-vXՌbnRQxE徵;RxlZq0L(Y3#t`m|F?NRCn˲8f=zG*vku擷6.mYKtzS^䒯RҨV}%Aw>}UhRPN,R+g㤁M@5E"cGaz=Z/"=BYolϧ'_bZa X㬑j%}{۝oW#KP.=Qhəf#eCk@&,'ɿB)jJm;47]`QS!!Xvj79+ Pq3l>ЈgC>9_>6Bn!2UQo/#~;~d&,|!wMKHO!rbp58>K:I%Q_}bK>.|‹"(Ϭ_*/D ,:s=*񱖕&o>^t9o^uAA-"v:DYt`0Umϕ{#Ѳ:WSԧw5 Ե3:t#] 4 mc[ ݵmY[m)23Zuq-tSl.Jל/a|uh2``,]Un%"U:]o3ݝZ:Y_&b1-: Avi5Ҟ|6-.CRWw1{HfHmg5byŜ>Ҿ'+$[Da |+ e<"Zrْ10V-/ ŜSiŦ R٬ %RkeY6z|dG=VD: 2vNKj6i%D RÌ>N'wa]#z7C0xJ}wV_.[hݪn8 ʘ_r6}Ö!gg/inp@aVpRV: %jpAntTԂoT nQ ateע'7 4O.+7zv ?&AL*x Ŝ Rt ž/g8`0G((ӊ:9sMU{ qgDE4j^ʓ '|)1l9hY]T~~Y~ęˆO>ɩ[FT|iTI*.sT#(3NYqoOLW4_rdqk_k# j8$\LgLJ@`&cq)dNE~=^05v(@.Sr|g̙J}$U.ج:ʼnx^,j]@əvkQu̖gs)$s  /Y`d?$n@H͸*}Tg7PHkv˄i:?|"pr S4K\BlOïRm+uZH)d" žS&F*'L_n*H##k4t#K+y8>_iwb,#{R(%!mѻ% 38(UÐe2͊/ <)7{=6pO'raXə94 &hc%S%S}TغGW\OGIa `=P3:&ui}L˃,8i wYj3d]%!(aw;L8ǔ:/q) "D%@j}_30Y=m ӻ9 0DސaKB!+ao~t-RuGS.ˆ(lm!war3t~վ-Hk`˧F$J/=6b%rZ,3Z@j94W~tF 4F:{^#m~[x@vzj M@@'¢ )?,|x0,Yȱ꺂@|*1]b8@ +L$ 7?/y;hflhf?|,fөNƿ{[ Acn*G ( #*9TÕ+qCB6!3 Š~&es/O(N0M^FW [pM%nVAPv yknIX$6_Ji9#yD(d2\xvlyZr[x*pƜ _㢉j(cD ޭ,LI$Fh\^D³SXZS T!Ro 3<9d}lS\űVG~V\ (DBrH]/>"8&]B _cq>2 4fEoׇo݈%y8q8/Ї5@-kwB%F*CCqѢHﭢb +T3j_;hucӦ:F$?Uٚ*]JФ%0&Z _oX`,.j2x 2npg͓?Ѥ.}kmyۗ2{zA7 cOO ePD8h8*~b:$CH~ڃ`[.u$OQٌmO ZZ dE}"*vI=#Q; 9L>j/d)uYmfaxeƭ9i;7ow6D \~! QΧR#W,zH7rĀzx+o8%>/ l Ծ~%h6y>eM~g6tE?3Uk/Q vFH{MДWy?m>G]MVNl@NN1UxZ|qQauz[k7~ ]gUϛli<0jzY~ׇp۠eJ`?޸o<+NOgd7㸦a$yl%:2CR8QeFHelϺ~zW}z(IJ΅*` IX qVn9gk|pk~ɻo/Q Bz'yY;C} s;}ȳpM'mߟQ'"Z0}ɭymlBH;W#`ړųSyS`qR:8z#PC~ѨeO)eLr}cE<@#WCE8$S%+h=M&EkE0b sZs7Ϯ>sV-+,Hao3ސx73`x_$CkKY" zJ'\ Y&X!~ىM6%|qA3\MCC*d! `Z2Bx-%3.Y!c'ԉ"$)+'֩Jg{ $׊ hm8\ɮ7ۃ-RMz pPӑrx[ T\ _{ <88kr=P ?- eu x똍L4AOC]a%p#@>J#D}|t &FA- ek2=t}8-&p1@qU]tИ): ̗epO(KbN߬DZ&+vKm>7 ]y%d89E[[9>Q|gA< n|8adp{H}:68*$f#oag䀖Y#jrRʉT "lYQ4qU'J J396#*%&s#k)QE{ɉcV>MLtiH./ &}/K2^)!2u3~$'O2Mb,70%.;V_ ll|at8 ▯R, *4Yʲ'گ,7}Aͪ!$OTW:hL"<[Ks2ʷ213Gn'QXS"E"d92$ߋJjOXTKf 4ˣ(vFv%IRd튵FJF`4ZFX.@ ^(`[;ߧ$”jP˜J x&in>TDMϭm)vOf:^l!*Öڎ1p)o)HdWX02r| @꤅֗NR@U b'0e0$Y6X^#|fYuj&Z鐼&Is& X}+16M6W[叅|SUSsw:<9*M$KoGVs>X=o<Mb8Āa#+^mrw13j^'~AZK"nAaŸ)zl3>uڹ+}Hnm䎆}t:bhzbώxIS0>kB:jI?ovGIlg[ϝ LFĠ?o*DXybt"kDJE==]^"? CԽWTho8zk4;{:$ Sgg[|2" @˒Pdj4$F3q^ݾ1>6u~E"['Gv=*SL0NЈxȏ]0{tY`wv%:DS:kݢ]>/.O[(ԓv΋%b.@euދsŋ!0/L8n>5EwlF{mr,{<#TF)#ұ=#ܾ1OQ-qU'lrl(%O6!m+narcYq&hEtġW]/@dmkYRX>ct^.{Br&Rʛ zS3aH 9Zw8ck(ԘNM NGVFoNeE9a흖YJڬ 1i/S iö7稙|d %yd.ڴE;(ftyo-qVC9fef2|U<_EtBa;ֈM :Tj*󒲃#ˊY2 (^;R{vqB06ek >NyYC=KVr41.\;h/="Q(dQ;1<Tl懷Ǩt01 etez%"~}ees`SU`.B8?Me@Jˑt0 epD(LٖPتdD@jcp6sU7sb#8]3|JM3QI6@Ue([oop$u6 ؛lXz$e~L-;ܱ@quS>Ȼe.N`[(뜙Y?4YQNjTԵ d) 35LFڻ 9u0HS?ÄTvht*N Ə4B794^NF+KQ=SzАhT&w`_~hco-0=>i $~%S:|_ I6:YV'_{kY.ˤM{aB ݕl X|ނ Q}5xʲF|~%NA:ۅP;P_ݧܘpM\^8:.+k IT;p:[q\ErOrJx(2o*p'a[|o+A,YtM R1EZ5: |O?uf9( nʲ&L<27MHĴq &5ƅ0Qq@KO1_ qL&D|ьY$X [6Ɗ SIV«$Oqkf4b*!RUq x4fdtz ja<,S=ѝ^ LO`pu\ 0}xw!n|m.8K]jGpӳ77 9@^5gc7_5- D"@Z J'@CgA r悘bR& D4 (YE1/ acI2lo7_3^E #U8G`rL 'V.7=K;DɤSg='\/2[jS(HZH`VX]sfxM)U*gEBHnQ5'>㣴-C6|x> @L lOt8ȶ/vf:Yej]]g z4BC!)>5aI:R*'䯮/WyK4>Fv6~DY^l iIřFNsF/ ڻ$BS촳_Gإ !0`_@cOiCNH Vޔd }XI"e.@1eC7:dKS|&Nضh=5-w2kD1ƌ%1)1^`T0{Z%-ח+o~xtE1栝}>4Eb|_/wji_cx~$lRBC]4T.^[̕-e<1}8B%15i}TptAL?MV"fODuϛ4E9,dsPhXQE5﵏w7)-ZT^vs҉4a`Аpԍ`{Y5uMvGpEM(f?˘ƫ/SI3Δ?c{&G vZϘqm} }Kuwa 7˟.{Sģ젩)xE9NR6=4չG'>|}qX%]~ O80$Wm 郰^с fg7K9t"; ɭiY=z]2 [~y"6|o| 5 K.ܢB+}<{֗>1Iwi#'Wnshl$oV=гE Z'qNɤAHMcܽ%g|ZAӣH#ݼL淠$$XHk!YH{r'RN 0nN,Ǵ_x}I{)n5Wj]w*S8 X`4qd-7<_TmAtKZޛC AS\@"}tSR/Yʑ0tG=AX2cPq58 4X7@{2owҎhM;Γ.% 5?ܑLbAw 팥褮a Z$ŚR䜾b4<) /!e[.Ό b1r˂uYZ'[/^cuefZ~`Bڐ v%w20gI}||adwilWc6MwNc3m2+lMCV#y52լKvj c>Ҿirr8bh+sNSsNj)D?+o^"q幔Q)c AP2t=4xSG9Awvʾuk0&Rr4H[64giot!{r=6 mې|w%R^;Dc`YdFV hn],0ta; 9/@qi5Wq鮼Xi+j ||K:ꑹGX*2 ڕԷ<&7!@/w뱱\T/Kգ=Ϧغա#2zL]G ҏ^&˱K\S늪#/j+ dG?J{D"L+$Ϝf)k&2cZAE4r(tLrB3Waԭ(\5qyMq`]c`M.MحeDO 0C҈v I- Lw<'#~~d #v hO0ݓH_sv VMѺ/&؊K6<ˁ@^E]Tƚi:\M4* YPc.w 66;9x@B`N?irw~',e,pI4-5w)jbCR LaGy|Q4T{tQ/b‹ޤxPCklw̾s%^NqSY_}l"2+O*xMpvTu6_:(fYP˩ @N;F9ѯ".* ot9>97Kcҫk@Uؕ_)5R.lĒDq2KZёS6ÛQ.GcXd,f%nOVJR@5ށ,Alѥ}@Ww@'ew~t]׎41L`=Oj40w6%)`hwk>j}Z;#OŰJ+8#e6\k,VUw(~c'P3lN;(AU"A)TfU6`Futʍ9dFUETF@~qKqmT#y<([ޛkLwɄdL됢 h0rM&".ۉn!J(c3}bӓ~M ;8Gv*tWem,F-/ h.aORٸ\ zwThEv3mN(Rk; kԾ̅ICl ^Z?G`hT_W I2)bȏzɑ+`?9h}Y4U/`0PM"lu sZ]ن30w[͘r(R"7C'Gk} mb> ݈z /&'K AQ'UCEy}NWzqb~"Mmi P`Dm77|pTa㏓Nm.ŒڜZVe aي.Ot=pH>Z* C:@`dFOۥqЇ}wW".@{L4:Sޠ/Vn|tl1BS4Q:E,<=~i 0Q7&D#koXB}KLۊM|Ԑb|3)\kFUu_,u!t}yNnE<&h7{"r'ܒPK1O}{_.pxr c\q2yM5[(z ݴ;0!)Og-H@OU~N ;Zt5ߠzq>KB8RgV¦g ǃ x /_frt$Jnvָ=] ȐyIl~VU .֢e {q  ēVIclF/ᳰO9By[9ϪF/yȥ^U~9pEt1 Ct T&$6fA w)|V YvQje@T+;Qw?"O SݝcO^ vq8, ? E!uyZۄŞK0Ė!eﰏC;,?|"$gЁ_'OS3BKwPneCۇgkm[ %+*B{|&P}Zݳy9c%+`"^פ>U3mYXRsfW@< 6@MGw:UwIx˥f rY lDoZiйbPزIJy΂ VS/vW I T/87n2Nbn~/2#8-g]'"­bʭS^N?Stжs; '=,->"k6ԣq' 2[+wa@9kFB }B uJfQa}f4 Thվ0? MF+CND&v KhϝobwQҶ6Za4PJ˛YҴUdmv@Z?AJ#_ ٩ix!mt W/X:ZABk8Ǟ ǽЬT69Ǻ*@b=JIt8yfϞhYGF6/nӇ9`6 b.d a|+RXyfWز5]%yئ*T7mwH W "1cnw;I/`-ؼ1$vIUˤĵlRV+p< \ɧbUhQCK#8 lɲA: &"~u4UƋ_Eh|32*L$E&^)\c]Rr) (G){7%*F-J=Qʉh~*^l&{ε:h:'jUWr޴~(,`S+@U@.FT^W{QNV&zCY:MY2 Dt'L*gl7y5o„B ~<>tdG5L?6"/-Ȃ\G Ȟ'bnv\ 7 hxYy:½_8"m2Cш@&C*TX"9O;1R>0#(AV*yV{mN^}JL/hX^^Na#ݍ%UI  gQ7j ǻJSbgOzBtjASd8F&ސ'}Gq!"xt` ^Rǜ[ZF^% TDsbg?&Lbsȱ" ^Rg-QB]'=,ҙ.0Yk,jޭWZlY^(SxJ0. ĆBeؖ3 *4 '! AL,"md{r7Pۗu':4Ǚhfq~7D~ݕi24&̾V0EAUD:nLŊX=@׍jCJ}y^ʴG3*K{ԩb\uE]W;yg#oӱ[%K;np ^;ˆ6/S((4-Xҧ65lqTyj0:#Ib (v'4 @N$KyV2enx  U)O=W,I 96{1uuu"tsleuRWGo(x;Gy k )+lXyk|X -JVFXfD\`M=i;g8 ZQi6;1UWSՁ}Q('(?pb,L B]].ov"A["6ݖN1dz^CÒe*:foڍx'VXzo{^qSv#ZJ.S0h\=@)mKˊ_4f61k#~٫Qa;NmqQcȚziR7xCaX:JꏹzO&2$l ߚ%YX覌PG@>IRk.KH[_> N"[zIO @EЅtLʟBnX]&Ex䔁9#aA(gveEWg%IeM>NAĦɓm?N6HzI>靝/ѷ~Yu>Rї<̘yR9{_;'VE yՏԫ=Y>)/9DFxhxHtbXfüL~ /SNx&h9FX㩁O;CpVbl;95Yv)r^l\i*w[x&k=e CVBrP^Izc?ӳf.Rx8=SPV6^,b!U0noZT!T\gͯ,,ѿpZW+N4sg E`]#Ml۶fyPb8ݦ37 Ō~:\Y_HšmܸmN_FPU[mWoKbjps,XރI]n}1AQ@t;-ݦ-f| (4[ʹd/7 \7%֚cGVUo\PjgvD';+hSxw/[<#3>f? }ۍ5UKWE98VY}5zڗG 0=h@͇HKkqt0q 6P9[ps@vAw);& ,7]:Y=/3Я2c'e9ZAMdܴfO*ģ'9Vmx/ξ:jaYeN6> hWW ˍ޶FfQ^m_/ˍ+5m:׃IU:kIR?G C~*C~ubrw|XZBM 83UU;Q,},٦^O[JCby-ʺґN]"JcwX̨E.#aK#ѫ‰ۡ]%]x5[GDZD+}c!ın3=6F^[9OP!pqgfTzS]Ž/1V &{UHBS 11mUЁ#& 0Ǧ~_-":ޕr4,Z@~ͨEԾ&nJWwk,x۲w3T-DPw/4O!KA8[ F(*G3jbjdWfYR4[Zg~'L`ބu*E= g,3F8-LZʴt|\ba^F%~Ns? ρ$Ko, e8pڲ 55aT_-L!bV9d]5)d 4eOXʖQviƵ\kч۪;(MХ?f, jE`Yfɥ,9C]4Ljb)m6bpoނGF~fTqR=ݖa 7غ`-(-M`H]iC('uOp8ZI؆<Pff"cT7q8׷RwoE#agzDM%-=5G`.t`tLۋ!bc (QNu`0)Y{(9/mΣ3F#n <Nx}#[^'ig+Pd][Z/inh?>%XltՀ6ku<|2Q =hNSIf+A+4IwZ! {~u2B, Ms.^8p7YpYjv y#vD V׾EO#2=yN#XĔ* RΖHC*CJy#(lxS^@UDt㪆叶XJ)eI_|?iZN cl4Yc dO#N# >qE Q5ɫjMWV\~],j 8Wvi-8(׋(&l.LR1\G'59yP6`Lh oRS~0Jcv&qC jeտ\/LJU;7J`@̤b `_h 9Ew|(ز-894^Jm^I.jĦn*HF<.qqelf>ueޥKF ~ ?O&q֔~Y&Rwcۖ}iGʄӋH&]&_п S̖LŃ}p;4nkcf͊~b~@,'v۩5e!\mcS^7vlNh4+-E`f\/Yg[p:$90ZNFr"Yd!Jfĥ'JO_3j׆͞b WGU$>*K@ *wm cBܵjh4?8]VSzyAԿ @": 18le{"Ӏ-ski>AvF1f d<+Q&6Y(ř쒫jч KП ?$. *Iq[ZCdf<z!xS&JVcrP#G:z-)0*7/;$25SBbmJ؟+(Jߤ>OgwS @EcX ,/g=RF ҂ G ~)t I{VBiODJiȄՉjx^0z@ځLL,x?DF}C.|[Ue͝5IQ:9̜*X ݠs"{:"}G)^W`W5`媰{_xxl[ 2%`[U9Oʆ,Il<T $*AGTRDBό M x&e$]!\Fg?r1-[eL/Prn) Z]صۛhPZX^y~óT˓=_Ѓ/r5bq1^XHJx&j2p R5NI3{;4=U6#ӛ .Xt2^mYNxb7}mg&~ vY.qaZ+>(FY,Vm>zkӁ>Nҫ>RӈbTYh??K[o8"3}u‡MEq˂޺J2Yכ) '~Y|[lN(D};JOOV՛>nL&o&s:/y?Q@_lßn9sPZ9+~U, :-]L+ɑ"KE$EVQN&;CtՇk*j!=bKuhz3Mq'|ӰaFFjgC4:;GVҜb\hމid6ۧ=aL+k|Fӏ} 6;: 􁣻\k×lg syվN|Ede7?@mYHN>`i~{OX^)?7W8pjcp l%8@-()$Dgh Ch$\<%q L)zD h{$/RMp0R\ kO(T{@>l8vz=sTvFkˬ]LsĔ@O4LvyELtiI/] ƁiO&LJFmI|Kx* :kܾF40PWEBk?&aɤQ-2מS1>S;iK4CR!+60 jXެt h?`\^/ҒPx4B(!G@`t~c@!Ėj,AƵms T}@aM7'^vYXK`IE&J1)a=@t]{ FBeWDY_2 n(A{7O ;|W^!PjVUGzgF\PP5aR0$*?{K-L}Iw <7eϗYϘONt].]BtNao:)&X3~RVuga3@muFΥ'g?w]`~qK CI 65xW#m̫ʃ)RNrh Q}$6X<=߅=? qzS"NƗxIuFT;,d |+|Dn3#5JqmQg}>L@mᢞHLx{\Ln!疡|pSZ.d+wx6s8D.kƆhZwEDN $(h^}@uZ+Oj['d. tejbaK͇,JrR)W tp=BOOmtaÙULBEĆ15;qb;rpJbЗ ̢,B'6(-hx{6҇Winҕ2yZM )*ȤKCܖ.ѷϽ?Fe{nASQn֒!*v|\s`SFqtp¸Fgl=dv1Lr2l C%Zzjt Jͽq}וXGMPE̕q*!9?d!fx|")} ܪuObjK-,OV6uxfXŮSi{f´2wxpFWNj&~"ʉTAAh{Pj)o\ _ӍegaFy[ZD]ij- c/!S0^ot2X]9MWtD˟L_0J!vK(뛮Nt+/O9b 0.z 8{d&!>֧/{0j 䇈,m4yZꁯ1-)O/2>#]gta˙nJe\辄oB%ޓUw_4XzLXLNT}oDQ{7j .jbѩxʾr)I@fj:(llQ x+(Y/m$_ jZh(Pc4m ]Hqu Gҕ"+*J'o,°y+G/_5H3?:LJi%N3e3?Ar9.cF\!cd.cn:`Fa5q u3)-t^/ .<΅`؊ZR2^4&g3NB#x@,6|qyza v_.5^D5s#ȗW0 +vc6YmqK6~oYs_QB_ krfY we `mhe$m,E5v Cs[U2uC9]_iUATy^ 7hEᛵHXgዳpr>P4T,nKzŦQ 9 l0RWRɺhѐrK@5Jh<)tbۯjQG$gv>s[& [㸺+7:TSiAyfw J5O^Wʜke3CNl,;\fdQ}Rt$Mc( dDsqó;b#͛ɢOJG/t&Svݓ nE^ $~`JsLB DHC'sIWKC`b9 Vt LT0bGXV}눃2D0FVn>]7Z1CDύ_&\b&S)oe5%q%M4 񱱷;ߛJP)Y3f4[r$ȿ;w[~sb^ۂSܘ3Zjg*f~AlCڼb1@%1wIԴ7ht%bD&#?ƾ/jUE2շt`\[eoۭ6/-',W/@b['}X3/~fP!~:]-g[o몙G>^T̨7A&]7|Wx QZo~ܴHG4]={yjM (FV<x1P "OMKu~&"q# { _9P GTС~V E@uDx57T_2,3Is ۱ćk=2i2.o\@DY0u{ˋcؗ'7KNQ?1N~pvhNř,n$#l: 0 ӳ0Y6'qfPm9Tب A31;VM85}[Ȭ'Z3Xܗd;eե܅J`Jg04VcGDQ/p\PN"|d [:5dy/ ZC5Rb{c@BZw=Ek+? FP5^NsݺjFwZ~6{ ݴ#T[f$G?͹y.Zި*vŀ{i@*^O/IGrM LUɇ#NYn~@J=3xso$}u:%OoW*inD2AĒZ`[Ys/,yhy]9{n,n* 5A8l`V_>^PL{O/sX< A4:c' Z}S7諕 0 I'b[d~Yh:8_oaQVդm]G2 y`Z 0ߠ84Ð ( _`? \YE9>|2C ;ey)_,zY67(kW A TH0i0 ^Cӿ,MMם8Bߗ"eg<`jWADYq6JK.<' =K}/ÇQu7z35m؜{|5,st 2 ҭiP9?G " `CEYViRﴻBc,+'gqxvn!zܸZTa ݰD\մQt4.zvj1HZ:-]X.T7G tĭT2+!jbbuKJCy2Ly=Dր軤MU# 3feh^0ׇ,d>ʕnm8_C+\yj@&\Q[ nI;g9o& R?p?@%wL80\,Sk4V39 b%1&o ?9aJ)T(v?#m%q6 s!;#y<f׿- L3˷L ^9/\4}*7sڨ>/áĝ=^KEa{ŞߜB(E_y3a}/Sc|toHb\7i" ޴ ΏPK̵=KOǁc f@ .pDF'i2ä.jrUj(؞)="%BI,D>;SzeD& $C7)Ҭ%7 4GM{w࿴T/PԼ 9#VE>Kp\ )mv 8?:j +5ơ#)28RK#IX#)tvҏ._|7#!Oe,!54 ֝w:3Q&5ǾJ$8gȫ}5{wT#\g="Vo2g1M?]RH$QA=&Ԏ弼43D+xǤYЊ{f `>")˜.Mstcf\?s%h@ E`@ѣ_ ]Qh3S[;gPCkAJ ٞPATP TJ7n99b #Pg!ηfHs}憨)|J|OI~^0ޯX.E27'$!Kw^<=pؓ 08 {ܨ5CVxDzԦ~FtX?v]~cLF5y5ZQڧM4AeLt̵Y,qI9_620-Q$aH6T2֮=mmKdX5D"ؿy+Y.J0%G!i T"4"Ր8!k zTO\gso9YdId32BLY{8)O BxN(9rAG.@SqGq.A  ;Q&+ 5g!cJq,:I!HpuϵY|yT\#Rng-[2eER#Yf'tdxQ{rspKձșa/O(kQL~:\o(~N;" zuJ7(2ŭߌkm`?E3ڸU7_z|i_ A gDO$_&#E45c"넽1H_d~.cZAYZH _ЄQ_q[|qN2W1 PAI cjG&_ / Pb ₽|_) 48S :iJjF͛?$/QwdézZɚ8CA:w*{QR1lǩ9A;̼` Vo5ڪثXV_ISXBfQo Aރ^p#}= '%JZ3ISqEh`Vm0%(]VI5,\#,0'W\ (xx8jH1k/Rq7PEԕaa7rkVN])C>Fn`KF{P 7r/VM0U#GCYQEr;kfkb 7KnC,4vۓDķ͊>>KVƞ>v?I5O}trvS;>G?7oK~j.f%g:j?=Qƭz떛v&!*[C3A-V)o|` 7Pbp!ryP#k׼C@/!%F#1XA*kfm}jXoujGL9 b.լ9@z5 ^t+Mҥ. BwwFG=f^T#cq%6od yA )[W+`8d,R$O-\Di7BDhu^aGι?N /֌TTEp rmQ^8F&pe Ufw8}Šżf ϓW]F/U|@y@&tBݻ8W#EE9/_+x81OΕe5|-%gz1S4 13f],\xFvPC^ȋ*O ZT(9G2Fvb0Aq?yv"l a cّcxddS sycQ'y33xv)YS1R~ĞB\%,c 6ݮyINU O~WR1eK"NF.!?j0%z_+¦)[5 Na jvv3LQ8ȟbL@+kYQWĚLYzG|Ro:vR=n1>4gUWt 3 2,fr6H1SݧuXW=;$ iBx# mPW)/Gռz)w/H/ B!}~t;ŕio/GI̞ʩMbzMZOM{zM%"/հ=Ws@Mf*glWD)ѲPf4 Hɷl klq)Eda[yb:뇬lXA;)!:&8 C;8Luzun Dcq#/444.0mVǧ囹,@Tp׳~2DIĒ=:B(ʸ23ӡtk0owq٘i`%80z"cT`h|$E ~'DTAztYxI0ZtE.݁@g;h5QCzDvo d|y|XM1s0e:h7/Ej^ m*1ؒZ 8.;5.\n`D ZKu,n#"* `I 4gE0;[X+2㞈Y+ң v.Gq4!1xX.5p@;W4r7 ;+$shmF-e }^VZfO'IY>9*!6 qFGÆy ʑmx'7wȞ#VNPnީyB^#,^]-`lk( S\WCntet@; l?U-uEwzf } u2D١I;8V#' PSJ3싰uh(jR7uH^|Seh-MlNS5HY'+*]MayG@eZ~ڧ?"ۢ yy ܡ:9JR D^xQ~ cL'EW4_Tj`f_'FӔ Pxlo. ^8I!pz凘wa|So%y^c$&\Ny{K:&~MMղgֿpu4Cn:ϣl2rJEpݷ49dvnDx׾r |J@r) x(>̽ ܉$-G,+^~~Oi 7ylc1!d2EDʨ>XvM,1`KV08,q&`nTy,-p˪T8B,7 4Q-` vt*nkODGāT^4 ݺ4l˖2bwNHWib2u )yO9XD\jql' ;xzyJVZ2rvbðD$DˢB" h4BX}bXS - |苻 ޔ ?}W9lU<*9JZҮP7qIL~/*?KMEA9q２#ϩӎ4cc!DEfX̮ڲ-G ze`#LU*{TDߋ'3lͨtat ;n$z x5882Ś =$ZOON"hF 4Idb/e'!%$.|'~Ebxt'a$rƇB/8,d43XG˱mrXHC]!.Тe cdX$TG( 㣾_X')\ڈpm@bJ D^O#9wb*B?+t?%ijlwfG՞"^[&*1|o 3J沏x U,@ -].mc#KV?²@;y GoXU# CBr0nOkt:O'.D6^(f@ħx:U{$h܅6%JCyNG\3(t/4᦬~x4GBvē76w;^VS|Xp~`c) 6Lb2FoD11 >IN;-rHkG +5 ˧&7OLKR7 G5AZ( *:9ZV=+zx=pCݯv1lǛ[gKLEPRҔF{O:tl؝ߵi͝` Ŝ`,uN:D->ڬb9}93믮>ۑb8Wu%0cYJg[g{mˀŶ{mPynG$EUȷɜʽ8{TUeGp=w#蠌*N" 6<H[B>zd[v2eKQ7 'U\_`Q:=AӞ3\y{yma ӾnHօoDIDTv)r=&+3e>ʍ-)I|T2.WJj^%@]0|B{M_)7մmrɗrmsS鑸oSHws5M̊%񍅱Qv1%Fb-`4EVT.jMKfϖ%؜F9wEp]..Px ňʕx`# um܀)\#)v\Am y֮Wnܬig݋QAgunC;kjq`S$ׁ;>vzȶj.vUSm $ c0T/. *t{33E$AhSɆč&+VLgr@6!?呟%Uن+Pٖ4өц \boS3{lf \EeI^2&*ң?̂b nkg\K0 t@đ.ٞLD de 4o;W1ǬQ^!kNT@]~VۦN//tHjBzma E(F>F_JXh*^&J>5~2ڍ>QQ: lυt#0:HcJJ3!f}5$D\б*/ve@Ok6 K |F0JK<ltʢr)?n0Dg9k[_6!NNTQN.䣖ٕy٧xJ/ċL`4 A)Rf55frV!1/')+jz\A=}K[21U>׊Ȫ|Q1xn1W뾱XG>tS28pr[YYxj[pJ@噓St#@7ч36CQMk&H$dwO.\F:DLWMlԐQl)(ߞ:Н1M 0qJ9EHPApkm G'ڇ4KD]rOX9@N}ލ++ M;TUE8eKrSMh+}pøSI^zoWPɃe?< /#*E'ڛV_K+o+v|*PwhF/yGGb w6'^ED?O*:P~ֶeS蘪5g5>uHEYY Xxp@?+F/=N듬迶z #eyx.ndl)c_# ;R*<rOY7 J$(E#aFvB~$5ȧDQWFkaCFJ4MG]롗jJ8OX 1AKCxZ&xA=. fMXV;BǴJRB^\cK\o dzg[¶ba Q>αh<c؆icdk=~zt}s8x#8~D?ߝxGo[`Ŋv|򐇈; ;Ldtӗ^J: Ŀ&\!TBd˫\ ߗ:IxR0p(rԉJO}׶UxrQ̚1Ld 7`Zpd潭ѐMm0k~xdo uN&4Tt+ߠ0ҿd9+u!6g_e4L e꿔]dz,`$=PhoA{!XhCRmUIН. {ɸjʟ{'ݜ+wح쬃0+n>ƐEk[G'4bEcq\]Y&VqBfOAk|1$Njzd xf`4q" < #fu9D7nYɅQt& iu#v/dd)AϻC;IoB\u8GRcy"`#G.GOj⡖s{?ľ(ێ4I P)8SW{Pӕ Ϭ!9B%l6X#{z tj3\dGrUxFf*h=IƦNBqq1MN~ t) }eAԔT2V ֈJjb V }_J,8~j+ ~v<ǡ fۮDe0³ICe%JN 8`[=t[Q< T"ǧW B: 'WSWjSmj48_n_%|}LEt}H>X_yŚ7001Jv;qH'H_6@#f\'ktf R/jC^:;XW^!-[Y J< XHk7|yӿ}^b!)\zȯOr,m m>!C9iZפpA1 VZP= !#&1QḝכZ:ȕ1 2y}~ 7h7o Bv6eM?cGPo>>]d237_CL7--oS)4sfrWde6jA'oARk2χ}4#A@XӡE$b/[4%] ʟ0`D+`I6Zf:D4=@𶑽=T:'t[}Qqq‰$Էgdޥ<>RB-~HAKu/? QI1gZT鮂m굜E~z\y ~kG/>K#:1i#Ε^ޤ[▎&JSrPC?l*"ΟnԴ;@Eu )eF|`/^b/J&5:W+[;YL)>#T̊ɻўw p~S/yzQ0@gD~B^Kݳh  %t*^Ag5dN-5ڻ$bQ5e FV}k+[qJ!FA,AZisv$w-pN3( d2zMlO,Bٗ$/f>f7%‚ŸX$qV:udSfG=g!.Nz$즵-8a(N1Ԝ4uɞ *I_1qjPfn<[!'飜(MwuE^\NrdUcvL: cț% :0oJOg67N:VPDq@<`u V]~iq z)X7פR[xHaN1|0]ΒZDG\N+`PdI`άB=CZ?Wuє0tjAD*zD}ਸ਼NǛZ3܇Sy؊[aIw0%XODh֩G|'5_z:d<"64I(a76 6B!ImG6eZX=nIb_w4ΪSt^.j@TGbe֋3&z=]MsF^ĸsWVO93:#T0^)3DM^ef{`eNiQ)q9:+bbGDeS9gDΛߋ q!:5J{tBKHϋ)"bP g\k{:Yf@H a_Q}P1(^2(rj'DM>vJkch/^*oOgQEǸ*Ey6xUFT,xbsB±>q['Yvscw2G[m]}{b#JC\UʀX2Lv)ҶxN,c̛ywo&g]sܡ"1*U2/C~jKʫ$>dRt7gU+'IMoucCDJf _bb̻ʔkLrg1 UZ-,3⩻ c??&Vde"?jF;sQ~Оǵ`uԣA^5E gImNjuƟ;:s\ތ;Dx CW+O@ϨB Up ߨFO1C/!& _* /UJM Zp+5p=Cevت CN Fhg(?|c*Hc]|ti֮.4)z@؁A.yHj>$1p/oDnLeoy^DOsnRRR06  \meAyhC*C_(>2uuӣ͍;LjGcn{αB6ʸQ^ՒV%"b6lQƌ^ tFMVyk3Fxd#/;x{Q Gb? 7AuA44W4\:n / 8w]H)fVD׆JЂsAf:?W\,9I|NuR#Dq/D%8pJH406Vk0UI;jH)o%. p^{}L|> !jiL}8ܞ{-#ԣ&-z7rwEc((vIZ71{Ѕ?8vt'՗_^]j)uhi I8W gSFyN-!A,v Y;oC=Ԇ`+Hi5 Ez^lTA@Sw=Z$n9x_K\ Fv'~ ܁2v봹/ܡipE?fa ~g7+^di蠤ΎkAd95yͶKCVң^ց!_:R k?I ߭6X7o_BN//TV \5x.DPgit-TؤtSeH+SKPE~ǐ7H7Ji2Fxo02qvFi $uFP2,jP{fFp8F%I^IkD-[mZtG⦳zq ^8w>KE4AsyˑvaE @ e0vfnUj9?f7 hנ>TyAGqfB Jj94<&6"{@ v}cDmdtp&'.В0kˍ 37hpVxDZ5_"gÄHY}g}틥nl*W XjGs$`UR"s,|\.e/{6=m3"r T;Ei;'eQ;?;  (vcPo#Vc.(@r4YJW2 ̑kR̓[FJktؑ*OkĪ*."e: wE@Lv[eJb/"aF19oh?KEeL&O~8]  Ui+pz %AW_jTr)O(^N,`-IʝYUaDZ[Yfy>T 8Jqq6oGJ/.R/axOu$cXxԋnn%3C޵E[۽9XKJX?VRWO ]U>؜SkŞ`7bdmϔR`]*\j;D۝NTV0) L. fЩpX\)_,H3;M So\C~ 4T 3z*C9 Q̍zeTWuz->u78TMb\pn=⟠ QSB>oH%L6].oxc "9l* 7sH0"4KsyIwG'^.&y쾐q[k+@d,좰uX jߕy+gϏ\E8KXߠccoda;RD:7S%Ba>H <ūP'iGԙ7S`,zt< ؂zP55"qGOd5׫!6GZQ"0" :q{>mzy%f?xBscըi,HO\Cg>nW ɱlV8PD~~Mّ~!oaoI|Gط>,ݵH.1p ⾂ /yf;3=8lqѦVk_,UjP^yh2%3m%wFj,,# j g6KZ]WaY/WqPV5c4h?a%0i|> 'khLX]23/WABֆ+/ D n(U ^ے[M7)&tyCU]Lm yu}'?YiwT欙v! h5儭roh=R%\|%RIY2ٹ_%'(bɝNVY%{t.!J( E'AJkel'%͸ f,~bo?X; Jb:az$r S}Kw+XZb@2_`_{3o|s£}%gw8XDbqT@8ߡ>(0*bkDa9L' sNNݸ Vx U Y Tni 7ݳ\eϨ44;#Л:CH,KONvQXLG6쬑a%$$HڜE.BZxfi t*1悛#&w  8^ m珘HfpDaPp0$+4}+O˦BeViHwY`SWŖzjx'Lb,2r; rH$*wBvuzi Gh;"+:[p7b-oc_y0߃^Eug(cV90!ڐ(NR~n\FtOLe,oI=aGHiٖ@M!'B^D?ٯ+r aٕ),R+,eGH{8݉å#Ӭog`sn@Mm8~ژLv!:tux;}QʷbJoN{Ml&>P Vp 9@\Exs%S7pdR_SG;aEq|R홓LhsFkf{;ȆDycx;d,.mT\C&M3*mf ~hV2썱V0;cv=hJ|&P{WWO71n{i#r~س"?gJp"L0juIPa=/յ'|23A[8^[xӚ~9qGXrJ7`ȝr+:bSΡ0 DO׋*^%{ #JOW'~Aim]N9 C/-$"0AJ-% Z?.rQ v}C+dP'=f(0qMD:^!(/Ky@~VQF|7FHͨg=Pfs:HWۃ AѓZ'3^`tm'[+Rz4Mh2١cMrj%Kc$e${%F sMnӱN4M6',J. ёO0o}#Aq"!;GLN95VYb`r9EŌR/6Y![r_Sl\ZÐu^Gv-9^Wۆ__E%E'w3?hi4 `S/i#8Ph _&hP k^1!z7HMI`[3 uMߵШsh>1%Gԇ&\K4o>mXO6{][wGqj8zO\Ak)ڊ@ LvcBpӐ@v*,1HcdB %NZhq6cb,f/y`c֘.g0ܸ! {M|XfLI5#)3Xǽ5XwTWα%^MH] WF9N`YfjCV#M:kC}Nu*-_[|7)w _ld$v\nUmt)^߆4):-I;g@Wz=;"0XrKۏ9, `.+ԲZ;2P{\H4,M%EFjnT>CQ\Y)lŠTbͿ*yp1M"0j ]Herzc|hq=&CM~NXhM\5`5$Kc0$0˼{jZ"ѥ+H*gg6;g+9@ңmQ~"WSX7q.T iz[֬sq< Ұ^(#$+q%v0MCy {|MU㲦F=t,(2mi G<;l M):#bmǢ,VgfO(p мE0T}nFB,}},?0m?zvarSyw@5odZpIM֤l֭]<5!ٲ(jKyg޴X"pDO+ A_8 ʝ{XQ"8C8ݮʨZ;>6 .jpV)j7#1HzC3Q,+4 Ɨc)q]9[D&ʛvz0 # TY'X⦫^1mS-@X^LܭM(3 PpGs&obXq} xC F!SRfUU9M@T'iqJ@{du\,EuOo > TQ\ۙ~tRil@noVF As_lj:Pc=EmFR>j-9UGG?\JSz-&5r[ Q?ADt6yfB+f]WB:M|nK)3gݜRφ?şk0VWTS҄W?a J)FW$`%fm}n1<|1=iuKk.O 179Ie|zrZB6 _d8^'y.A֮>phS]1]`g|!4 NIw \Uw4.wۮiF&| &a)8SqQxmO#$ϣ!R0"D (?ux?Y#?pX7zdWśOYaؖy}~(ë- >ǒO[,GatOΜQ7%]`hP9KB_;9 Q0,$-tY(:cE̯cnXRN3y-fy!TǸW{M-ӫÎm[GyKK8DBYJ}Re'106Di-xn)JjJ;l=B`e9 ?;tj G$)(F|xC!j] 7ibn!$wsxt{BIkŸw-uz劃󜱶s9 OiTA1˱g_}J*H y,!c;x'[m/kCa lk-"cTE56d4oNMP`q31z/lfRXyJ%!g-WgڎUѵr/\%K.\+!D ҋ: _6Z0/J1nN PÖJ-hcm3r)kj1u_"/b1VsH˼܈Gt&tJ/+T |EJ~.ڱTIu?vUpՂA++jMY߰ygeR#nw[%kY^zyM^b @ofA1P;m'\*cK8r:ˍ.C 9}ɌWrg`NN?BgyVςs7Hb-\n{:\GS_opd}kYf,r2&pkoBTZܹz^A8}R]^l*ElM 1jZ mG22=R SЎYR6?ng4LGʍ̹Ȥ]&$A6 ~?xEF7+_2Eֵ M9Z8G|A$]b#^:g{l)mWgӵϬv&+t>(1dK D`1f|$})۾ cב:dWYe8Qs_ӸMH4s4]C|+P|ZI7{'Qϯ|bB=He痦_ >M{5 @uu`ucViF2jO,]Rv"W^1r}yn>THLJ_Rg+hۈ#Sp} ;z׼̡gv\>훖FƭSJYҴuè el+L"߸f~jdy Ǚj/i.5c#Zn<1ȡ,C&<((ՔOCV`32t?֙~˒COMyQh( [l1lT ixGK)Ҽpk.2-ezh[`%'Xl|xW%-t?I/~Z20VgZ*wT *2.0A1)xC:c:l;g"TSN;3 qQn?َ2T\GQ|zí =O"72 <o4}} ) %[ f{أ?|aHdiY%CMFjŇ56i)}a(1A$ q $rjbSa~s.`?ԡ4a~wm"@mΘMAI+~0JvSBK>+#ML1k8$> '5͊%kWU-x@zC_U28 )f 1YrR:G(ҡk#mZ+ /ч~DQ7: . Fw:<6m*F)%/chC:[V`7yĥq7#868`  >gARPk0s28JȲ<@h2u$‡wVjqi(%Aj7HF2Jm3ϢSR 2;'#x8N-?Lʹ=vQ ~ :c:zܛl9u xZ\5_bP'ϹOi؋ ',NyE$[:35hkӼR`WCB`4kasҹC?ŝ3E&AдKl>|H{8U[o/b˕|b?Zt}"<rlK+19C%8L\!H4'YŚ̀i`[MQZ_ߣqqn_G[eigb{ީu֏*V'e>L-*v׼UeӐO5 q!g5xES\$*/HAԟsIML{祚QX̶ܺ>zYNRb 2w ReoͅdV, 7f@?3E|)_L䀖o'c)뒝u>QΘ%wa荱&_T"3c@0ܴóV4e>2[>`{gɺO AY+Α:e֞plLY(3\u#߉:Į8#uޒ#5C"D( "i%H $WW{ 9IHͶ r8491rWIniC ɘs\nr8L~]BxƬV'lO}ߤS@ݮu]~TnEH}Sa!!+s֋[bX]p:\oOEjV^Q/Ǯ $ +2)ʄc%2*:k`o`? +`x/m:XzF?~'bY*YGaQTY߸)葝7REG&mS,?tTF)1"m'f#%;c zβv/Aa۽;5x9>ݘYE%ip<+UQl@.1>ЋRc95܂ 7*'$8"#Vyaq`ueg ҙ럙iX o@t&$MZ 䐌ON(eJW&B)&29ik1 h[,eJH&6T~YQ W@RQDnm-f9\qϣ=eԯ+,nI`ֆaDBM QO|&"@TxJK AٰXʶLF  I'/DiĊ}LZ] !xYS6q%iBd*f!e#>)Q/(]J Qe.. BQzƾGZk:}KܴС*ueMׄvHvUg05eHNf0Zj*c-HT c z-iQL\+a~'s?b+:K(ρsZoG':C_z>_:.D<' U>Mft\STDy\OIfAWg?gЀV ̩Y R{>ʞQ 6{ԹW2Mts8ťpW=,ljzQ'k6 66Wib1!VKNks^6ƺ׶'r5sO@*L{UeLNc%OWr|U#$3UY&seGy@n" 6 REc\-U_* >kWԴBbXPb~{nMm*-VUl^o6rib|,] .jp=,}3:Ȟ4wFCGH/ bj#!GM.i[Q,{UDW}'"Kz!~&dޓr9]]vNʟbƖ:v՘Ѹ"^( ٶ#Jxﻹ6Clv(U{3VMBGp'J_n]p(TWX kEq&dz/VKdKAShtjrh5 ïIݷڧTkF{[(r XJ'Z v%':t%{ָ%JA x+}/۷qŇ$Dʴjh //]-DjM0Ύm 6[t}l,r{"D?IL+Y|@Av>#&c&biGQ*NU`M,o4ml6PHE`cƝJA'(7嬍"l x"%ZoT=ӗlC?I߱Y朄Y:^%ًusǷrHW3v,OKυB|/֖%#S7V4~1E'e)P# /V69i5ָ`ӺM.^n{+ d3 g0@5i_Y(lM=t"FKTI'3#r&~G<G?aulx։eG<)H13ɗŎg*CIp[.ь%kC?-?nBTt<Y3Xvs?]0S1-UZU~;7=mL\g5A+9Oz16 i 5|30Yب־jL_(4* ]r9]sSEF7BX Bؔ)3{2fi]gO,yhn ;p'̂ʪ3 WlPPS2Oӧ|Opp8-tFyti&<1dX*fܜwܬsSPg;Z3T?0S4|W֝?aa)ud+$ \t(P~3378%RHgA&#L,H^瀟8~gn&!~M{Ya(ׄjXJ@ <ƃ<яuzThV7w9Ӊ;/tB>><SDR"|HźE/MJUҗ6RaõHW>q +2滋uAd1-dhf|?aJѺH>`w7*c /H\6|rG:߅b^X R!z_F:$婼HϪCwBd'bF D([0`_ }qA8b=L 屻sM E=r˨κiRzKQyaʈ |73OW hP+8ymwyӼF)].>ثn()Ww>Lߪr(wQj!+&68 >$W@c}ʪ 7%ruqWD]x0ޠi x.զ fQ++cqQϑhs p";uaM 0[]#z_)Aq - /1(*>FIcn"X)\)Ůhk̰mf"<4eL 2_]y#Z({MB@56n N"ٺHIv?K= MgZ_j +_wo`}cn{4޵Cy<6ePLzk2[UM&OY0M^L2p^Vb[mrydڌ$L[U#KPPV̺SE{fLXҾ,[,__vr ^hW<b[rۈCOaOVWeBȚyf_ .Ֆ[ۺY&VFePpe.u0;XWC*E;A *,ͩ6Ӳ! v0:OCS1RN5GafB5ܣM )ï+FȎ :nRasBܮVׁU0-烙}VT!ihUX8}}mk`%y!kJX3 _%LIn[ IysɜGvrԎ&my1)ys:kj>q3r1jwZV.:x% _Ҿ}QuJ&w DZaD{pgTMu'8&ps|/1M[ܛjZó)كfFΗ^[%]W Gfķ"ivwfO|ΉgAqCvHzdXUcA0#42e3`EdVg$3,W K:1_SjYA|yџtI =fM'^ b Z14ha"NgR3': VNG4f M|RћXs5&F |^i{/w¹;"-{"r eV,~*5oM =C. n&\^"օ`Q-J#T1`0mdV),ƃb=De_iq1l#Mށ,22V=wYd Sce ?| EGF,o]H^ { \J]Ufn˞'.O$Y-4y債&zbs7zfoF;tЊ7һcGb! I C_T>^/!<o,O>!Ah;:kCh#lQ$T5;,9ȱL]hD-2S N쿑F4:bK4k7jqPҙ#w߇L+ԭNkn7|96!]EFgeG6 2[_EF剙ۼڮ@H/+y *4ގUV4/DPnŪY%μ"g#|Z5aҤE5k<),x&QipЇ}8&{P9p 'Ng2\!Rw0NpY~- <}@G\38-畕8h(qU,^i:Y{;.4/g0*X0@NfO :'t)b+"q+c< ]&cK;ؗ">==;F?Ȥ.<اH­0|#XMYmp9ԦqN$lsB;s|&z`jW&l\ L~gKD1-2xVM- sce\5g;z'(ɏ6)S8 zzaRASP|0ލ 7RJ tfRXk9U(-Xg%ꃨb}Y ql ѩoJ:)k,; *Mow&A`>)|&TOТNO[izܤ@Zz% y{hd> tԕ$QDpNrkū*݀s3', Nm,>}%vʆȕ6. ,YPT.y9mX³`e3.)Dd t+eK5|~۶IJ;W'< THچ'>\x w1(;´V6{o."=S 'X9j.s_(9u 12=5WA~ ʊfN}U@cIdA7m47ŌG?i` DÍ!Yx0 /&eh.S5Zn=4t|Ӳf=Շ$BjjmBi^ uU\! `JQ`7f5D:)jENn}U4@UD ĕk;Йh=1y_nk l+6M1=!/8 "NkQNHV"~N'J<4Nw#!R6e&(pN+A3{|.[kS5 8 }_1W ( EO,DWϴ1\WVl,In0/3@?t%Wҥq36Ӄ׷Nķnib-WxɚQkq&KXS}BYbgǿe޴u)X!Vi#L%)qQL淚\k)'r(#储o6Pj^m xe.A˿̓FbM |7x}š@Ƕ)XNEc25ɎGɽ; B$g^[+P(鿡Hi>@*yR. >d#n1oɤP-B/>b?#d?g}ܭN(WGg~Z1i'!Q<\TG(Xΐ[8 Ww>@v]t@/OƲDJb]pMfV3g,?L5ITi5ك::<#+t _(q9s {KpMC`RwM= 'e|oe[4rb:a轹15{:fZ2.꜆V ȦjKP3Lȋ >"l+L/e06V"\-+G/*Suk͹ j;f2(c E리!3Y.й s`6J}!blsFln`âi@&dLlTn BS>VhWV7}SKMoĈ}CA/1x 3?gf\3;g屚:3+^vF֣4CA jGEk+O?o ,_&+mOIVcb-K?:=8k?az(dId˝)"'qyV7<*;Y:'Yty'.yRI}Yn'dGnzpw*c:+IޝFzNt-\1mŻ/FmA`Jdf\~;^/a>Cov#g* ~񿏉b#'D[-He8ZO4hj]{I/ǽO&ӃZv"W fe1 ] !ιtހKJlހ-ߕģQ c!O5yށFWO*^q5' #u60-fQpe]VݫY7 )'WG)rijn좬Yme3&AF܍jIR =|mE xSx,3]H{5 _G% d =G4ntf<ȿ9-fAۅ9?+,뫹a(hcrHXBtkRL?h{BҘs+9n^v0) 7_ DUp+\=4tIMW%L͑ix '"\o(T0\$ҹ%BX)0IJrƆ&L4)߫nl=Lpca~&\Úq~.gCvC93-mry=)BJaY5@d&pkk^NdG;wxS%S}!}}WRbۓD*݉q{nK@u ~X@̝Gp\m1AH |Q4-MHMڹ*t-Z[]<pBwd7zfJE͠)ky0pyg>lVfr:U0x\͵[ ^';XOdlf=wȼL GUf_NUXI |9$5>UsN8;4xP]+J̀15Ư2ϣz+<檤lJ ipe{.+\!g=~=]&.U Ɇio";6 p^1ҞA! k&SҜk? ̿ g8C&0AT#nd\/Yk8; 'kŐ>|6Wߓ\2”oq.YmÕxE qs.ըZY/`xR!r>%ც$)lP5f!vw蔵&3e k7GYn^ŇJŬ')C):J|w=gɧaa\嵋(g+34?a0^Д36`ז;{EUk_*rxo*p\ Uu*$\^Bpe.MJLCYp&aa~,28i~ ]F0ɷjP<8sVH )4NC+tFy[@J=tDg)h@B8DFpgi "h+"#pH.sb$-cQl $k ){Rҋ &3 yב8}3X KDeumJ_I][E'!Ez6U8BAXɈI<~dz0;t#1(d NDzF^{|l\$Y};%Z w駄= K gol]J\Ν­ke쪍6@ 5gtej6m4TP {ܳb}L8)vJ8; f.y"h?y!b֝+h8ԥԩF˘߈oGp dHΰg̾͒ESf[?Fw&)D%ym3Y g"S*H}%Cx֙Ng1t]̠ܓxi0}K=pyNĬIk3*x#>*M`nɛ$!+ %5=c~\:ܲk{qĜQ_9|"LRI9ơsq1׵[#t+Ww<&&a>aOL vXyɃ2? e@Ӈ80Ek+PM fzt-a:C#2:˜!Fyn,UN9:(G朚(RT n 3%Yxk%#&1b~f#ؖ B5 ΗHB#/,7)Sr&g VF5:fϵLjE Pf!%Au4->2—, JuRq~"i $Dhmtㅾ:HzbyGTDbgZE[{]XM8ٻ`&_o~@o7^[&h*#_$xr.Z_E=ȿo ?X9Ϯ *=-FNO*3-ۍ)) !٘|)K:fWa>+CI|ܑ{zr#,F՛̱5.]ydWY&wESi>.ˁ7B^%?m=K#>8W|$h7 XnZ2 GR.ڔ]X`F*Ɓ;3\@~`HhH9u4!7w6-SF,c11/1Y=o]H [\1#R (^VA0C7QAx=/:T N/Al3-bYE͡T4^VY{p H*^^$wب0rfFcpxTc @|@ۯ躐qpW )3լ( Ԝ)LF4@{7P#j>LIXo܃5ha67H,Xg:|&#KGjaŽRy1ޯ.n$*{>Y?qbWʼ ~Wݧh~Ԙ><,r1xqB ,4XU =I?hUWD; +}'&6*JF X9>^ӸeۭY6P;[;е͝Xxc^8|\OQR [5 2A9X_*h;[h􀳋̫uUnɍ\Ptw1ġ6C%,ӫr2nP@AY^{P7,P?-)sVplքL;uhsW?=ޱ2)WL4pB 5Zw̻6KHw=oLt?etX&GSW.(mɐRD86'._L)QDBmdTjeKA݈#|0 [T> f`vSJ٤?P%RE7FK/}zߍ$ȷB|3J;1{Cݸ/N1:i-m zi VGX+8n 3ރI jު<6=KZ&eCPGȕVnXƸ(wc__|ɸb}+UXc:ԘHY sѰ㮏6#P `Ҋ5_tq691DYnUl1I@];|s3eh"ɷD6&Ʒ$ H;ac<pTr-_חN+؈)zB1c +:4Kk?-Ș'!:zr>F:;AE{tXB,I<4]E =s, ;xy\ EkΏhN,dX/O/ݽ&Pqh[Uǘ}{@^)r,$$Ո?+&_vQϠpsK]zvY1' wۋ;\ٝr3$<}iv ҩ\)ezRt^H`tqwQU'`'% &l킓¿Uc퀰a=.x$af#X\C]mg&OV:hV8sCs4`ӕBR-ft`9UBbjy!ʹTcj%Z%,LiW6t q6; -3Urc6L3R6-J-_s={{?+o~AGmU5";Ӊ3]x,>X]i%Ɗ{݌t&&;0ZG6 waحgӃ^i,>|[0 !PYf%RI4}1UM2ns!lKH̿>ɕi/1&CҪ`l9ehf w%_)I\jvdÅ;#}f~"b, .(;03*ؖJ8zb‘m/xvy-Ҭomh oHJ'V9ew" 3]5vvħ¾L`6dN nIavݐ ,7LLI 5U;w͉Jxэ 0 ,7mɖKտdQ|_I`_,)>+ Ҩ@ˍ"[@ו`(E>-5;RE aʟ.ZGR̪^OĎմF SdY3Q#y:bg~W}"fHb{JzRs\JF YX\L%ݱuUO\Fk5 \SԏZvIR) 3)D)%/Psg[lgezL{>N&}C[Nԣa'~[@SvGx7(pCWD;VϜ7alt"݃nopa(b$O5kAzq:Uٮd$ܖӄisnz9IpEw `IS|3]lbVԡ #$ZW`(STF>QZ&#C!YJ8!++ ?2*U/Z̪r[NZ)-qBxl|h0b+BV)dJ}ƧCٗ]6x:#)Y0•c[Qꙁumzz}G;[ w*ZG30;4VJ9r7G\R7>#!MH'|w2qG1v@5Z/(fe n0?;Z3z͎LUN=vg{x΄W=g%.Tv1$u}-!a۫5y|'zw̢f$NZZte={wyTuS$ڞŎρ}½]ng& I=nDbi?= b{4"ǔt]x Cu BP󊺾Ok ?I)414lRňjO..B?!q]3XVNb{HA):zu*!JF߭)@tyܱ+f1#'+9\t,]2 Ue=nw@'2sSpc"cPv~ڜkCfr-wz쇩N6rCϸSkҦ$h2~}4l,)ƜB`ąHUl"S1`\%9nZ $3gp٫oÞ.u %*w݃t*& + D0j\%@aCj/gQ"\^=@#8hohn{,Ĵ6ygŹη8<kb@K?Zs*%mj j [T\ ߓ:vodߛ)0W ΚeDYyLd>u}lssZX*N$8RV$JPW5K *cm8@!FB%|*^>^9: ¬SHʎƲCN6N1P ^A8EgJ֍3s߱31:m&0-Nk¿S/ly=}D-ZBLx&.: 4yOT{]\w_EF1M.ӏ"@řo{)HK[&;#pgG%ž*tG>ű5KݒU̴& U&儽׵GuiCNzZƚ+qq;ͯ to^ (*D,fR,֊r0)xV8oeo!۶dwZ1xgE$V yyvO8-c"?K}󤎳3i l"z_ @s%ve|^E6/'b jfwhHŰރ?ﳒ;/VTYk@t$DKk݌m2w.W6O`p9J:V;`1n&VʧgSJ\,v)/ZTbG!ANkܵSI_j/8P&תWn6EO w|Ys L[YC &Դ*OMq0}UxZ5 ^yev؟EPQAj61 ol@ɦƨIp+gWuZ%ڎ|5-_E?Ms߮<"l62=1 }J8\Emu">yqIRtdg*6u`H? h1+xH0}Vy}ȂRPy~Gؠb6&kJ2L^r^EFLeXx0mRdjHڷ3/'5YAYhOxn6jN6@R<(mx XѰ7wȦQkMlaAeS/`R)~hLvbNzLgzqɉW\)I^?֐%RMWA^M'1@@!\T^LHM(JԖaD UB@ҭ ?; _[:D=`m@R \P8XeCtN\߱VLTd#Pр9=-a xy4oIhHOǪEHPҴ>r4i{V)o8Xasgybb$Q ,щs EY !d> {_HsKרiu(ݮeˍ갖JNPJJJdQ+ Y(1,dnݲߺUs9~Eji6};F˓W:=T@=" 1〞`؋d+LtԂ3-\ !hM™2'&ee' [WZ@OƖyh5㍌,5&`W.(smWg@(F[9ĚSgBİ)4C@߬<j4RzHp ̖2Xy -ZvXa7s4Ї60+ЅűV GR83e^b5 tz,d+1l1MAAQxmY &ab,gn Hh1w4[*"܇CE0HYF1r%,,ޮ8?6O_Y)P\믒9a%-?'q)Ӫ6W2}&5ybL4İhqӵL׀ڿvj~% FvKgքgw\ '>ޅϝl>EtB]:0f + +֫a2HئHk*eR5i d͉!}rEKke8)7 k( E:~YRK9_dJX*?DIBl \f]r@ ";ݱ#GяUg䏵2*֕}KyZf/CKf[u/xfw~nCU3>E,)|Բsc4('= Er PA$T߾㢦1g ::k.k8$~&hD`wYˑ]}9j#/gr>- uLE:<vdHЀ7NZÙnz,ERxƲjBC:V&c-($oZߖ36iPLz@E}ۓdΩ'B22k+6Le 8t ڊ?I-QUY,bWaе)<w O\;.[D[7b;PA'4sT$>0BWq=>g՝JeYa1$qexЙ WUUǂ6NA nMaRb">f7!ømٗM #T.>IPH/~'RnzĸG y}r#362Wb)YX0I&@2(ZB o(ٓ얐G ,\r5Agή`G=1Hx?8UjqX҆0 RP!;6pP|*٘Ҽ> oXJH@ksF9N;6APeGd< Qj/VHLІ ~C1GR#鈘 Tu 1c`J̽,WndWrbgkG1znC_#?bx("0:>yX5yDSp΄՗'rkMMfZa3rLH.7gH.|n%#+5[/=27- 8|TrHMGJ"dm@H+ϰ2te`gS8):lZpʳ~<qYh_S g;J5 ~9}\}ὧw?7sfN݁E3»LiI S$ ʭ(8 @)!BdUyxv%l=?b6֥%4% E̜O" /' Nflӿ&a^rHm6.! I{=2~;>ύDS>gZf"Jf W<ÃǤ5 :߫2{5BE~|W6~EҨ,e+N':"@Q4+{SB2ܳE*"U?M]-$ϟ<~3q;fs%h .ZE'ûp CDXKxP>rҺeP\< _C퓦É|HSP|k|Bo3+T)фp+0AtHPCsC,rr6n pXfg˱VwJX>+> Q S&^SέK!cmLT:Q)>gW̾C+;:ϐ26:e/" KF_dtf|!ܚ D4y/Yש+B*TBD):JQD4Im!(HK*JF"nff߇^M%_<鲊lh^YtH {Hģ!hZ5zp4E.JY7+6˳Lc_}>?)%#nbОk@%UL'h.7AL`_Zi1G#e1*~H.c{}+~q|L޲5M*0:!Ra@K, aaTcŃoPl9&HX<1 sJUDom,o}$'FM[P_i:ʖ$J04], i6#P-LHf>Z8Vy&_P؈^jD,% Pb*Z Sm l~1k]$&rP\_h3bsk^vzy_@ƭTSyu^c&eAkLڬc&3mlqr4Er|'؎5$WOͮc-]@ q݊VJ*Rl~#mgsĉsl3vܵx CCf H-)~Iu /].0<)71&zΜ *PpJ ZD)~FNJ||IW#x.R̿#$ (ѳ)򯟎Hxܼ'Ʋ$|bq=A3, I";:6`9̲ 17ȝC3mEWfq:ò=vjuai){׺bNtuwV6QsJLy!L,J_$Zv!Ekm˅rj_)4;ri!* X{~@Y4oY~{:v{pZ5R#Ņcn]3|&_ggƫu> qȐm<6~;zm>md: kJ Q|fJXzMtbFD|6_t`;`7qH'\+EU Ll=Z1apI,0=TlI.8<]bW/N@e;כ#&KEVDjS8HB`jE|;Ya+̟"Q"Te;Ͱ)eS?:^|7 /A~Oy효{  d[„m?+!<;A4-a4z~CZ#Ls}i 8KM5m1eox}~@& .|w]\4oMȉ_$Yf^Іmc&[%&| B&G9W!=6bXcJެ*]]NkwĿM9[Wf+lJ̵|snu]ZF$7i.ͱ#w}@MX81"<y1#9yԧͤo=b=juF۱q:@~;FyATLA$yzaEBqJG}k¬鮇ћ6[H~|WGo ='Rm6EPH0ϷqG}{^roX>*SF_ٙNُ݁xʇk^tz,QV9[`5ݡ.S-/QFԄTtş>P8K1ar+I?x"?a 0LT#)ԇŰ{9X!<): 0Iz~jl !}:^awX,h P'(jX$uH@ (VAY TO(M;"h2-ҕyc Wt5m.EA77r}׷35w#^xuCQ1~VLhYQ"^}(+IoK(VO.@%Wa![cXMn$F{gP.+/a)691Yl+m#*՗'˼щm"SjxDni80q&A`n|.5WwJ;vHQ LjsmԼU- 1]y#i}>"Nt `I{{躴n8Ԥ4/sڛ 3y02HW|7`TH ?=)puw2!IĔ`Xj?OAQelAqqڨ ! luCULnes9Q*T붢"<3WW3陀I<=ŷzA0}*5ۿ=H%onю7\,IM,ՁNX5[~O;*H?']0U!j㕑\sW;]j酐< =8V==9}vLbc#`D+lT/^ܒjv,* c&G \i%36H S0DJ5._idXS7J:W[6m=\bͅPzG,H`qP> Jتb̴IL,>|9`%BbAz~_:XZ+>1gyXӢ^ E=2z 2CK{k "%,\ۜ>ۢ|J}P܉[I:줋ˋ; b\ Y;R.* ϏCD|aZ37͉+Q@ fEG$X@Ϥ5U0 ;*|EJ H<#S3T5V5ܪ7^i ;tn*d" kBE&@?o`uND'06amM:z 6a+.f_e(y֒ՃF=uѴ[w1"dtUQiq/ȿW8=h69_P +hx$D>زn #zLyG_ϻڧX6/-zI`nl۔U7gfieB7 DIF .VbvMI]cM^ZL9E@a7'hZ,ɕڔ9sˌ!R'>LL -*\E$DžƝ:MIw1C,]EY# ^3X'y|N}gaHA: v'Jax~AUM\C fnȰj5*gKg+h Gv-v[pA׸2DT Cxzer%Md W!)TU+g']sjZyq`ܸ;]Yx5bm 2jgI3N'ǎWt}J0XA}MK^֥"D bܒbjOł VEsɪo1ĴPpV/%5\52<%X%ތ:Pe~`-eD~ӯ)]aU,%L6xuL"͇#4Q iޫ79Wh.dشiA #WjQ[FkhxHn6+PnTOτjXކOV;0lxDx:e( b+q~yk 6_H;XLZ7#%댽mqՑػ=OQ|^z/CwԖ;IlΌg7KqrAD r0^Ԫ$=ܴ>`@C綏15 l/+l2C7 u8mԐM@{9I 1\hے1V>9 "G߄&j] +ў(p޼ 11]) iExy o*鍰/~(զ+Hh7B>w4O:hӴ}cYDG!XXPAV9r!@mPƐO ƪ{%;f(oqztɑB)e0+[t:"\jFo<\Gd+Rg7 Y›9~Z1ۘ{XiyQ^JC*>*/I#1_~Q+GP$k^+ܢV|؄n0h(IGzmJ?uxLu&pL7M1H内1fcAu];z{)}*-*|̞qeFnB"1O4>_~ `9)J CZDtO%KD1M}/Iܳyd,%g*\~ Hskad{[ 4` TEfuJQrrn9J $z(b4p޾EUCўnVN  ^w%"zDC]%mri6m (Ջ~18? _d_yZNTy+PyH!K`qw1X#Bka)mܘkAj? v&0&Wjڄ:>6RD̃ zܪR>XgMuqP)xLXݶrXzm/mM^n^ַFgym :#럄y(j hD:3$};y!Z># R4-,%zE-3feΜE'f+_r=[6DuvT Ek`9ok.R.0}ׁ5sSxEDQ[Lkwۭx Ԡb\U=:RҸ,)lՁu5[%bLl0kE܏ΡֲD8uY0Fg͸it=gQ MDbVf *pȚiamqQnPXUux۟CIQeˢ3CSæ[9xԪH7!@.㊜`-:T?P]@F<3\XBm OnvWхTރI5"W)0\vz5mEس)y9`lrڢlنn}X!yÝt|^JR|kx4$]c |L/q+aS1p/(0/oiQo yKY en6½ ` K%U| JwplXeEt/v~Κar^jLGH f ҸUXsƕ[(sr<1s::^ȶ&]uBwv cӄxzoGaLNG't n +h[1$l=ⳏ` 7ܣV0дW<3_ݣ\3aAtRM1_zố]Z&D /9=Xry"X$t 3#͔w,RO?RlRZ;V κEF PFMqSyNC+@~? R _WH3z;&:L6,`tJ`'r^Ղמ`E!҅ySEyQI'MS$AzEYjzɔٝp>;w"}=S_p6p#j.Iz쟂ػ"+.˘gEbEXډ/c1F;7vnV>'GV0_,_rؕ3lZh&zWC@7T q&-%vEdy68h6"+?bemjDILn7A&f&f4mJ` .kݥp!BKTsS{1;w{eN7Cf S\+DmR2Y=HrpOmW'۠Lb~~ٶR |0jV0 \򕈥bf3{mǍn+ZHcX;z uzS'nQ4'5SȜwLu1S_z%2˳9\NJUHsG,R32~m¸Z,M=",#OҔNτðe)xQ80,?빜c<|.|M&ΪbN-ut ,=+:HnMȱ9>?hi]|C_̏v \Zj8;yvS9|NgmBAGPڔ`Lc.Qfbvw ]Z=Hy O"SR)V2c.v1qv*ZL}dk/-ѕZⶉ6ݸCt_"  dz\<&4\Auv~TZ~#Wp3W^VJFN5avz-iQ@VxCصЫ#Pd¼,.d[BASn~+[<__%p\'Ufp )莯om7OA=_)r8xβnoר;`Oa) ;{)ZPO -V.B㬍O-RJ>e=+Bl6 ivBɼ֯ r6BG&>tkȅᲚ)F'CƳyXq?IV}?b>hW8'|_(0 ?JˉU7iUCi& &ֹX~Bebo8K1远kkѥ+1#:y@A%۞ kmhQBg1ULnF(F~<1 [?cYl%3< u f4#]sT"/9͠cr|y;̩n|cW:wD!#p&̈́yYL׽&yW; 9vaGQi$ ;DZĒE/W9#]h)usy3T hoW~VKr9XޒeDY(/N΂x#;:M}׀Jxf^7 nswCS$sxAoc GD0-9b"2a{m|EW`%{,zF{#бDd6:HgV n Ǟ._.|G Hm| ˥XzB 8C`@ Ć&3}oT.+4t!7d"Ʋ֥pO.[L:b=HigZZEz_%t$ܭ]YOh;+g8'ΐ@cj&wԃG+@fsQ+s]nRvj+KE?F=aO]]& Z9E{OtdiDgdYꅞ+(P$ QIk%M;khGH:a9|_Y_+@aDudX~AI\i m NƷSqAP! LVPҌ`ǥ% a6Mud^,9@" p|'|ӔmGGش?59?[~ddv'uˮa6;eޮ~ #ckoLdjI`:Υ~)ìёKb-@^pz[x9ڮ:r> WGwۥ(r%U>'W1ulFtF$Js\ݏ_H`wkw+4t#&j օGR9rj< [!<\<.!i4d雒3i_fR}Z4;|POuz1` M랫(9V¾ Ia%׻)Gk pQ9PX¢ ef7Wq \4A 3MQdVa0 岰΅i|RP6Lmv*,w"nj|i\O[;Nd댁/kY MC+N>Q~6qaUC}>`9s(0 =2DZԙm,@/`n?vE 3-SL6KƼ!ߛ6K (I.k)\Az,26, 1¨eDm0ˍ=9.xb6k@+@6O"1)D)3eS6ق)k;'CzXrh+&N3J k}>0P\7oF"=RyO2y܉}; 7λe͇[*߄Q S2#1##t斥-pDd_4_sЁC?.(?8 hs?3KzRN}[pR+p5GNU4BF{71$Bx9$*`Q=w`p0m2-lvx4QP:@漠 F)deZ ;=1/UQs\ɑEn~TRa&x3/k9/㦳Yy+y}F8־p WE$Zިuxk O/CFFQ0m(S!딯C@@ܠE6ݰ`Ho v'ȾdzIK~&y(Q%Zkd4%Bs "֜_z5Q•}pbݡy ='h,v 'escEaD\^01v]Y&Yp^`H"NHm.GzdѤ$9ݳiܿe?~m;?т&L 79G5/AdHDn*Wy3mr0 ³;voJxwDkr5Ħ|]_W$GTg>^uWx *T>M=\i *콽F"QƜ3̾{"^4 !OU+U*L6*ފĻiщ vU=`T5 8n#2W&^gJv[1}OB`LI\5L"e ?i1g6F9\6 +_IP)z+ߵnn~NY C2vݘňAF̞u.;;z;t!4  ,snz(ČRIPLxJi)2dm(b3D5Dl/ǫ=i_$OA5XDdՎKXjQe1:ҀgWcPitm:4<5W:ҝfXsIW wZj䤤y?ֶ~Vhqe7feOGKU6K%uyf޹ͥ-/: Wnif@s8C%-yg3Z QJ矣ONbp2C(d̶;k V6mX&G(3öi"ZP9Zzn]57ͼc+k E.'Y*mYu|<ݮEQ87yi.&YS#bV(Ē?k^X 4 C8pCU/w[qrJ@ܯIms; euWHЫ#XI4mXGЋeNy]%UKʡQId-tl~)..9zqy!O,^|f1[cp<8J\Vm'WMH*j\>0ÚK-ܘZ߳nj尿שțK¿*5Tqrpjup{˷ּϖyPpo6}xoYq5ZeQHqqN\o'ў>B ‰tbrv9fEUtaC5ogtG<-kZ*P6jZ%O</V.q>.nC#GPX>\WT1blEʧ"Se*חJcLaZ;MYqJA^9@ʟ]`W%+ΓsK}c8xnӉeZsQղݘp{Y`e{ ׇC_.0h zST 1Ihf@Ҫ\y8@:2)2H[Ts YrmW'yl$r V&:[^Ѭm,2z^tA%?4}"N۪q:?GDm#aF5:] q?|bm"z :q hl%ܯL7tzRQ%r\:.#UQհ)FZfi68q[3Q\#XuX-'d EJLM5k4'*^ M{V%4ZpKʧqk%0*yLʲ27\ ItYY4J,SD4% LJRhe0d~lj9hiEЏ"HU,[XΣmHp{&3$u//fM*dr9u/kxN LDi=ndۃ:Ns=HW;f"gLW  &@'?gWb}2ġh= Kf+Q?W#1ٝ F#GJRdXXH4Lt%T+ɂך.n,diĢT-t Iv6?lmU#0ʅNm_W.H(k bo~`ĬaT:miljm|č67ff|*{ u,kpSI~fRmd^A-5ܠR-K%gl3g v‹]<洛?IvGY*ȴc-Iv{inQ7)'!EeN$gwP4ѳw<o/r{ꘅ cA,⡧4hT(Z(sH6)rwY~r1ѼX&Naŭ%WDKtao>V= 3S+9BR,FfY^rthF1;0gðFMMw4sޮYɔz-4h%zH#@ 0^Ӄ7#*'&ӺHseBtNxG7)j#3ge}t(*DS /~{XץՒlJIv0zEhR5tqѓ4G9_]?$X)vl[zRmpX5AztYk ۆn>_{Plr"Nqb%dN-;ɨ帀C\4U.|iq >$_\68MOolC5w~UM5'1ӂjmj(@yrnr"H_AdղJq=7 sC0f@6>cBX1"{xRZ2Ay%W-˰{nPyE ذ\*d]& ('`F8'Wf}JAQy wo,w$cųJF^+~4"W.p>W{$`nLZ6QJ~d3NK`ReZX*Pҗ[;VH郀c铊Q1Tx7oP[A[ }8ë03#l?YPؽvY ;SO~조C1ސHkp"Pt}_T#v^b. Ӊ$Y5Xq^Jj@NAM<<#`VCrtBb$rFuf~ M-!5hWo)LOc|?3g5: O\>lv3Sz H A$Ǎ0T,ˎ#%]._\.~7$);_LLR~A\v[ĴGhy)#+&%Hp9:Wۧ[ r ~/8&]t ^kYC_jZpY3.~2& inL^VPz'sb}ok檀\?Y֚/~rз?oQпO%O 4>ք.;ojOszБoMCZ(㶀  1Gs{.y6DV {͔="fn@쉀*`_tCZ{SÞKe{+P՘)k_Xx[n-azSq rx튧D~o+i}~*Q7y4U1,?쉊Vy!RsmLO\O;q}G H TxK ^ҹZ9%]r0>LZiA9Tca\.ƝZd<`(KӜc3[D/ uzTyV˭T><((c4p>Nw_y-ݭl<{;f`k{ftArCtz125%STGAvi3 XcGǍ^vO1Y_ }hyªc.35w繈֥B !ʌ+FXLyCguhEnX(?xUWcR؂Y*ˇQI Xaհ.M_7gK 6G*odvF\|.E,Mez) P"r,)m.BFe-lc sp`kٮE"hu&An[+݂}`^L kB >7R=43w_5]Ű}1MJr/HսD|uݎy gwHz+W[s iTbGM!upL  -FhR 燑LyR1fh?le̞ؔ&@.SvMJ**+@lmTs3&# @[}yUSIpD$bQ>^;!(YF?̙y=+L\bY_`#YCOW~CBȠ$;Ahg?moYo|׍Hn+ Λ3Ϋ1G,~eл/RΗ)~PnUI7A3[ 2=#=ڋwαANTV*?^rHL[RHT'^nbk ZXۻ=k#4+$'xsm`j{2&p34kߎ78=S %B3DFBe{y\Q+<⎽zKebdxyּ&wW\KR C"1KSn8^+~w/83={.zFN:sOl! 8sV~ 1*y7NɕF$`9wM:W,(=$FxwUh\VMqښw|Lۏ|U-80,3}[޲\ eqJ~\~ףA-A;W#ڊʊh2o~Kin,OuCȃ`ke~XUXS eDOy*^1KbRދ@ɫ- mLc0{x/8fQ飩*g"V0+d`/'T";E݈QPYYR|=cNV;+ c.,gkܢ9k-]M%HM 5xw1+VX(HP/靻sZv;(!-b;ĺ]8(?v1wSq^fn\0(!>{T˶d/o/ZZjF]=gS+mǠn2ri@Ոuk1bͅ_CO݈<$tcC}>cѬ f$$ ^l $ |>k+f[P;_Y[`Yr ,+?Cc.j\hzcq Ji%Qx 51}I_z}Э_G ;Hwy/b - Gz4FCb8e Smm%% d/LPX}0yvż-р ojQ[I5Ow~"=g ջ 5U&fM2?^-GN҆l#pנ !xB=?Heiyp#*gucD -Bs$hC-@{w[Rû}e9X;Q9pZia$5=ߓ6/SCs,OBF2)@D 6iHC=u/a-9@V *W5ZҔ0("<,PQp;M+\p6',O5(5GN!Q#b{=['8|Xw`pnl p/WZ1r?qPG<(ڷŮO? ԾLJ`p=Fi958z& *aꤪǎr_gcy_CʉC?xJ^w<. kX Bcx6Y;*la q.O|?9&9jQwS L2Ha+x1ZxG]2opVNM¨ p6 Sn=mpDܲڢ(T-L1{)%{ z_^MNrmè^LЌPCs8Klnbuٜ8+yHIߌStՕ0G ] vqг3,I(@[KB $U˳rJC!,O=12(pL VBv0`2.XPT j40oG"ƳҚM)\N|e!֎  -my64onȃQY,.Y<:wf 5զ\beq?rj܂hŀ(WhKհ{R1iZRVK 0F/M4\c'm߻˸q-N`: tVAEi2%|ʴQe~.Κ?j؏ng]Q=0@]F5Ю$ngI2k \U.ް,4`6Ωqº*m5~Ԥt8(AYgx 0y ;ɒ ,]tj_?zo0gKQ̓,2߳8D,7#en& z!ch7~.129Fh杔g.P6Z)⺤wzfL րORQ̖O ZꚱAٛ5O>7>^hZzc:7o 0r0J렽$Dn/O)rУIFH␣GM`QO0X neX0N*漈Q֟8=A`Hy9<"{,!e7L?ѵ`3D-,fQ. x2SOHX."OȚ;`<0ivn^zuX:B,^{xE㹵Lwo LNeMBb`y˥!#ΔjC,bJԥh\uƈ} Uur(L2PʇNQr)k`WbD}`5iEԋֲt4ָԨ R ee?1TT* (pb,@ɪU5$y @/0BQDb2 Ηp7f׉zJ%. [z*ctvڱ~sqcy/d=hG CMkI'_)NB ZL _Ut*4eƢ_S]eŏG.fI|x96؛`yd?J; ]wf}[ e~v0 i"O>.DWVnᩣM߸85c4NEL RHn(r*x(j^Z1T?IqAS{l*g Pc%,UAW:*I<1{B~ձ᪢^d2)K4۠V[u6Q8q'*-cQz~"~!sь: . àxOD%5[,Hj-c5tX[^c3ldo}R%Q ^, W~un.!+,3dRE[:5啊Q C-G_ *^ֿ[)!!6{Xq( HRjq8D^;q;hS"e_IBoJA~ɭ@99{i;& }–Gۢ$k9LIMZbc00)0dսW>>I'p?dT|5ɉWz}NB5-9/ʗ_ u\SѦ5cƫ:-iPZfѝDD31WKF"0N_%05[{.kGwzi( `4A8}p&+ XzTHd$wio9,64$0fJ^U i23G0̴vy Epk="٩YӤW ۆe`dedGċo :?GHH)FHid2Jʶu| hѡژӶ@PM] _=]k#'.oQ`( rO8^`뚎a ‚N԰FRtR⌋,I|bC?2?Rͺ<j8WIEV5g)8yn< Wx0do3ZrsL_k7cKdܭ*=fqV𻇉nWޭEkZQۘ"ɮ4ץAeՁ8I4䤽S5|TgO,82S%쵚&'O.49MӾEF)lG`縆C1]Km2Ⱥ].%AN}lE\)=./KDdzMFڹH!֣ jvl9%y6>M/: df?#w}s\`(wHɌME  zxPe" ezOF}|?rpBV޷MmBf `c42]`MɫR&dfMRܦ9hgX hUOȊTq}f;՗5˯? _u>ܙ!1f:>C]ZG:Ӭj'8:%Nb M4JZ3j&vKI<:]ByUNl]p~qhiTIu+p a@4\b[sbAQOP !n=p9[ܤbu%*iM b"S)٣UWI-k䜀la:䆿c20Kclgϲ=ckB鵳K;MR ٷTV+%N( OUWy)T :8kw]{M~h [PGMg͡ D.ك"++g {`F"mڅE#}[g4YP<&?bӁlty+ucGP]35 T@HֈqdA%O0n,}&BGegze]nØ1|lH= "ǝ$إ4KQiߎҲB,bS=/6l<{8f[(k IniE1>qeaߺivnF1R?e'yibȣďo$I'K4w);j-k¾y>ETir֗ݩOV7ȷBSw1d9 -GAB.)?+L?]j]o/4PƺY!Z-=ޕh?JFBJ˱|νgPJ-,b6VkC"3Х'H8T9 )9nP/nEK! ` @~ʅu嘰4)'9d0"eE9*JSZeN,uaB5.E̛o۫%\Nzm uh 9,2<#o^9,a69?{@9맘 ` &e "YֶZM X&M ـ,8!.GFBmcF}\Tb}c[X1Q)#}-M8T.D0HVUF;0y_6EJ]qx(!D䛡JٯTCdXy4B,S-nґ"/QF<.pæ Ar$yWu NmυxVyz~,ž 0ӳimU[OdLv[8ꐺZv3\ sB)yT*2.xdOpKHX59sxҪDutdq{(8pdAfR'[(.7,L(˱ߩW FJgM.5*ZA/-jaV=.Zm,_꯶&6w!u%Ԕ%aة]TN`Yf0K;PMJHi{J>-u+# xGfXoEi Pr,o@0c [enZ]dW3mC%&c4B|ԋq@b>!4oR֡Dfyy S9:#,mcD]+}B0$)qwcl~؋fEIhy&dq>w5N><<[Uhj(ǡ{ؽTefdϚ|Ms2-VﭘجFTuUm5E7k΃F^00?:j(S̯;yIg|˰hI Np} ~A d3}3_aF%hD>CڞԌqA,n=,hUjsɺZ3.2hdhL}On2ڦ٨ POLWlzvE{ *eY^h%g,dZ}b%\&]`Ƨ%>7{ªߥ )YZ.C Jw1*:So`"e n"<"ZS!Y])_ \||6."N)̹ _"1|~Eo\e=Ip# p~[fdJ~ <-Oj>&&Ys _jCBъ)u_Q:IohZA(K ;] Wӡn,c?oq^aҫЩze>:a~VfLJ=uOT5fp@+I4I-4+Eo5y$GB j$̀\_8/Mso1~8wDw_An8nK+Hͽn"]ޱn,"H e"-$)"wb5 wpO6~%A{U~r(u_?q8p2;.1#J!Zjf*bc{+1v !=.R7*Ez$" 3f۟n!a Ꝑp6ZdoF^4$e!K.-[$D}2{%o[ֆ;n mP6f qf$|N;)&Kn9Y5?z0}Xm8|}>gCIIFB಺LpؿV܈/h}îm!l"VbdK(!pcr(-커̋[=`ixIT#7 );2pByX?T2mXڬP1rp`Qf)|Y<^p-8^oS8݂(D1 X[.2uEӝV2k|l@z̶/HvXӗ =2( '".!Wy+|8Sh%%'Eq׌ry@Fbٰ!Vꯗ t9:Sj4ld8e`HBcM9OpL=H*w ,ܯm;.gBJ"iL$CB:jy-)}A,Գc\Z^CX,]ǒkX}κOl>2BcI' ;*mK/5!S\via7[@NA9*:#s-((ґt/mR^}0W DZ=4@-8#(0c!/"_kYן?]}u{~O{дE $~ʛ O*'U3W\{pv͵K)M2/q- .Y"zDUc5C0ˆdd"bMgIcMI}au%Yl~) Ńl\ T T*LNg"᝜MxȗhRkyr*cZd! vbt'uGsK# *@8DP0 y&Yx؉nenX ~͗sĞp0ÜL>u*Jus_' 3Ak@1; !yrԛB$Sq4tAa+>cn$CHO /E}5¬'O`PN8IhJ[0r0-2*s&04N} Ga[so ?De u7 Z>n*^P [rk?!dc?, ~<{e~˫͎6/!E*[X)IB0ñQ3vkNa@ $`?Pl֮OC\f4ӛ煭Hf:YbИ1?S[[`i2)XPA[``ϗ.9љ}{xc**R@̙lsA:™UK6'۷.}bVc=uAXǔ*/I[H3sTn~ڞR7KgH"E P{E '68 C` T@"a!ōgdb>RP%RH|M_|oaU& T~JdumYUJ 1["|l<`vH:Й3q~U;5q V8 YxmCzL7]|8P QR{5T`8|:t5T2lj#l-^"B"=.z-:]Aq5qB:FA&|pR#bZ؍٢cՈqK@QxvHS/#HV4:>] jP4tAs:XD?n M'L]\֫ {|xNx) (J^X):b30,}t/ ?ce:eyzqՑ=錌d9 !ݫ[` ƶЕ=hk5Xv"K#𮑍L&a.Ն6E(Es^"NfD|_"IV()~a:+WV ȲR&bw><8hr7rZNRsybhRSGK/$Cw84U /-9jwPy;p8መ^nLk9_D9gSDId (ؠr?CP݇!`XFqi^+̀@w!L_ +l49Uz1A_N^q=)֤Zkbquu!kb+D[>R~Rwbw,dpOh:#s,, zs9$O[X8N\LibX dC\l\ΫF'Zv9e뒗:dCs!о06S_+IodL<)h^u:ӕnyg Gy8Q.5oǚB)ԃ}u [;Wi~+׌Nw* f n %L-JV7DX7AIU$4i?7ŀdo>=M:f!|C9e%}2 (=TDSY)}.y&r|yq7nLv9CUQ@Z㲊ѿڧUpa/rǢԈˏ^HCLW!VAi$y Ӆut?6Id-Zb߇nGg|0|xSAb>!eBF,VR* ے+.WΔCB/y֥霰>^㽴 `}c蔞 /X-3^ n&Zw| mhfJ[*䝀 }yifEx#DyI! .6o1;=u?sӟxMrJgV]DNeIU_GE{ߚĬDqt&|2/[izӣpPpИ̯籚;?]yy:lv)i6w\y'9%Ȩ8ud<1Fdu9(Y;"UrdzZjb˫Q;cM,w; K<o8UY<('|B7isH4-#H'M\{jZG" A} ECb0g浝꾇$Fu.ZH? Rb'+D$k ЩR\bfGL~0ða[s<đ5&vZzoRNSyN`a,Y#LDs<\xQsEL3ç一)`t`jRTYFJV4Q#P_w1 jD(pb3NCR/.&@?Hxq6_Lɶ]#?(|7uȨmL6j10: YZ